AZ-Intec-GmbH/AZ-NIX-SERVERS
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: flake update, pgbouncer SSL fix

Browse Source
This commit is contained in:
sascha.koenig
2026-08-20 12:36:16 +02:00
parent f06c9164e8
commit 7595e7c9c8
5 changed files with 156 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.lock
Generated
+125 -54
View File
@@ -243,16 +243,16 @@
]
},
"locked": {
"lastModified": 1785348116,
"narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=",
"lastModified": 1785979955,
"narHash": "sha256-OP96Ak4OBydR98keoNYKdGY8j+wrIys0LafSZgwS20g=",
"owner": "basecamp",
"repo": "basecamp-cli",
"rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6",
"rev": "61a5591de1da9bc99c56b8072a4d6bad2c9b9e47",
"type": "github"
},
"original": {
"owner": "basecamp",
"ref": "v0.8.0-rc.1",
"ref": "v0.9.0",
"repo": "basecamp-cli",
"type": "github"
}
@@ -315,6 +315,7 @@
"buzz": {
"inputs": {
"nixpkgs": [
"m3ta-home",
"m3ta-nixpkgs",
"nixpkgs"
],
@@ -335,6 +336,29 @@
"type": "github"
}
},
"buzz_2": {
"inputs": {
"nixpkgs": [
"m3ta-nixpkgs",
"nixpkgs"
],
"rust-overlay": "rust-overlay_2",
"treefmt-nix": "treefmt-nix_3"
},
"locked": {
"lastModified": 1785934673,
"narHash": "sha256-U/hMY9kkcdxt497yfGuT7+ytrRmE+E15KF6Sc6VrbZo=",
"owner": "mulatta",
"repo": "buzz.nix",
"rev": "f4bb77a87f1ec10e5ad51cfe6d0c4fca481c0534",
"type": "github"
},
"original": {
"owner": "mulatta",
"repo": "buzz.nix",
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
@@ -641,11 +665,11 @@
]
},
"locked": {
"lastModified": 1785119570,
"narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
"lastModified": 1787146702,
"narHash": "sha256-YbRcLdU/yK4gWsQg7V8WTKZHfXL33g8+wSFUX3wyevs=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
"rev": "173b7e8d40fdc8c296a9c99854314f17a3a1704c",
"type": "github"
},
"original": {
@@ -707,11 +731,11 @@
"treefmt-nix": "treefmt-nix"
},
"locked": {
"lastModified": 1785753922,
"narHash": "sha256-cRnp7DSvT4BwRI04YSbA0Ocn1iY6+fN9KTfnsADHm3I=",
"lastModified": 1787199456,
"narHash": "sha256-hXW5My3dyh+AV1SnUz0zu86CnYJ9EjRgpFtLpKlBk/U=",
"owner": "numtide",
"repo": "llm-agents.nix",
"rev": "8a86f04f5cfbffc5b5d0b38ac24795ab4909b46b",
"rev": "24a6facb2f1a9487d8ff87c30896ac40a9e45bfa",
"type": "github"
},
"original": {
@@ -737,11 +761,11 @@
"nur": "nur"
},
"locked": {
"lastModified": 1785750596,
"narHash": "sha256-bVhnKFnFnxmntaYi63tx58wN1v0WI31qWyxPciqVuuI=",
"lastModified": 1786880699,
"narHash": "sha256-3Pd0sb2Wgu0f6kaM+4G2i0RR/6vGIoDAG98kVQSMFIQ=",
"ref": "refs/heads/master",
"rev": "6a67324c6d1a1ff740ca7aafc575b0a0ea513e5a",
"revCount": 112,
"rev": "6a311045a4879fef06b9755cbdcdf5a896431450",
"revCount": 120,
"type": "git",
"url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
},
@@ -754,6 +778,7 @@
"inputs": {
"agents": "agents_3",
"basecamp": "basecamp",
"buzz": "buzz",
"nixpkgs": [
"m3ta-home",
"nixpkgs"
@@ -763,11 +788,11 @@
"openspec": "openspec"
},
"locked": {
"lastModified": 1785670526,
"narHash": "sha256-tC1CW+Kxh9ZZxJC0y472i0KoieMqNwNi+AiCmS4n7To=",
"lastModified": 1786795567,
"narHash": "sha256-+fc2Zo7Nf6Td+/x5Y8SX5qxPM3hi0nH7i/L0vgosnGI=",
"ref": "refs/heads/master",
"rev": "69fce234a8607cd3e71233831564b8ceeba70626",
"revCount": 374,
"rev": "b8b541c3329509b0df3b57d384ce5886d3cc0d47",
"revCount": 380,
"type": "git",
"url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
},
@@ -780,18 +805,18 @@
"inputs": {
"agents": "agents_4",
"basecamp": "basecamp_2",
"buzz": "buzz",
"buzz": "buzz_2",
"nixpkgs": "nixpkgs_7",
"nixpkgs-master": "nixpkgs-master_2",
"opencode": "opencode_2",
"openspec": "openspec_2"
},
"locked": {
"lastModified": 1786563125,
"narHash": "sha256-a6Rom/Tn66AqPipVRkYu8aaQqFkJjbKh9GaaHVo660g=",
"lastModified": 1787159856,
"narHash": "sha256-GeoUWSYKQ64o7/HrDp6ZLnpiky6QTxtil/5Vnc79t/E=",
"ref": "refs/heads/master",
"rev": "af9422c7b5b0c028a7379a329075bef450a9dfb3",
"revCount": 379,
"rev": "2e1b87686261ad28137481e19f4c69f472c18a79",
"revCount": 382,
"type": "git",
"url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
},
@@ -866,11 +891,11 @@
]
},
"locked": {
"lastModified": 1783265394,
"narHash": "sha256-cq4YfNFGYzp0NItZP8tEC7xUI8OSgY4fj75AU/NSaPM=",
"lastModified": 1786747096,
"narHash": "sha256-9QqhmaLVsPhKdMSBaWKjDqeGRn8G4ov4cVuZ6JFwXbo=",
"owner": "numtide",
"repo": "nix-vm-test",
"rev": "1a587212d2ac8b669c6c32499015f996506b6ba5",
"rev": "c8781a0ea2d8417506fff7722eae5a6316461212",
"type": "github"
},
"original": {
@@ -888,14 +913,14 @@
"nixpkgs": [
"nixpkgs"
],
"treefmt-nix": "treefmt-nix_3"
"treefmt-nix": "treefmt-nix_4"
},
"locked": {
"lastModified": 1785356851,
"narHash": "sha256-UYKTcayxYPE3yIruCv525WMbcYDLlkv79bRfkOuFNLs=",
"lastModified": 1787124618,
"narHash": "sha256-aKf1k2hvYgaxP9oxDPRiv9npEJLODC9eKxk7nR69lzQ=",
"owner": "nix-community",
"repo": "nixos-anywhere",
"rev": "5887f1c72fbf0e88000716237194de414d2299ee",
"rev": "ad8fa24e11eef167fd72d49fafefa3f840312d71",
"type": "github"
},
"original": {
@@ -916,11 +941,11 @@
]
},
"locked": {
"lastModified": 1784802994,
"narHash": "sha256-4PcD0Ibzdkh85G+70w5dLlR9YgQ2bmNIjiPPMSzO57w=",
"lastModified": 1786617555,
"narHash": "sha256-r3brKkBWm34wltszIeoZw2VCFUEoS2nNAe3W2Zgzc9k=",
"owner": "nix-community",
"repo": "nixos-images",
"rev": "6ece16b0c97986fe085122e796044add4cc3ff64",
"rev": "f01878e82602ad3d0a2e74a14440521924e57bc5",
"type": "github"
},
"original": {
@@ -931,11 +956,11 @@
},
"nixos-stable": {
"locked": {
"lastModified": 1785133411,
"narHash": "sha256-Yjv0WEg39KRYS0rBdTbu6Fc/or/ihAKk13W9sQ6VWd0=",
"lastModified": 1787042014,
"narHash": "sha256-lgnV/xeEatfEnPZG0RrXS0fhcr63p3tsVvL1GdaVkJQ=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "2f5a153c270b70cb0f8c11f46d96d6d3bc39f4e3",
"rev": "c69ae8fb8faeb3472fd11234ba55a70ac3601f9b",
"type": "github"
},
"original": {
@@ -1041,11 +1066,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1785692966,
"narHash": "sha256-vUfIeBEfpbAfZ5zjgIkYk7eHBeVfCYVjLbWnMkseYnk=",
"lastModified": 1787070829,
"narHash": "sha256-vXNVDVtvfiQuXthP0NHPFdNvvMTkGpx0UP8oddIWbNk=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "643809054d65fdd466a63e3155b8c498cb483c04",
"rev": "0ae2bc1419c3f345984c2629e72e7a631820fa4d",
"type": "github"
},
"original": {
@@ -1089,11 +1114,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1785602060,
"narHash": "sha256-z7D96eESRM4CPV/XtwpwFn8IDdfLAmxz6lVWrGYXvR4=",
"lastModified": 1787111413,
"narHash": "sha256-sFosWtq21eHGJRnTc/hvf4M1obRgLEUMNm/IzllkHMA=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "a5cbcfe954791221bfffe2307f7d1a1bf61a871e",
"rev": "afe3d8ac4395617bdcdac9f188ac8717a062e014",
"type": "github"
},
"original": {
@@ -1201,11 +1226,11 @@
},
"nixpkgs_9": {
"locked": {
"lastModified": 1785599192,
"narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
"lastModified": 1787101114,
"narHash": "sha256-gwrPcFf/rDjHPaVflbDZ040ZDmBTRj/7+s8ZmE2SaIM=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
"rev": "b18a4b905f8d028dc4476412e6d6891728695379",
"type": "github"
},
"original": {
@@ -1264,11 +1289,11 @@
]
},
"locked": {
"lastModified": 1785765597,
"narHash": "sha256-p1GIp3seaFZZlBFkmls7GydU0t05WD5Jc6RmN++9GnE=",
"lastModified": 1787199531,
"narHash": "sha256-OHKo7ycmQpc4wRxy4wtmKCVl7Zhu68/7tREy5JasKPw=",
"owner": "nix-community",
"repo": "NUR",
"rev": "2b594a63f182954b69bba5d140c558c9a5f17005",
"rev": "e923d9114cb211bf3858e988de54b7ec43492d8d",
"type": "github"
},
"original": {
@@ -1515,6 +1540,29 @@
}
},
"rust-overlay": {
"inputs": {
"nixpkgs": [
"m3ta-home",
"m3ta-nixpkgs",
"buzz",
"nixpkgs"
]
},
"locked": {
"lastModified": 1785820796,
"narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "b6916ba032e02122d6ed3064f40cabe937363d43",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"rust-overlay_2": {
"inputs": {
"nixpkgs": [
"m3ta-nixpkgs",
@@ -1604,11 +1652,11 @@
]
},
"locked": {
"lastModified": 1785360170,
"narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
"lastModified": 1786901030,
"narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
"rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
"type": "github"
},
"original": {
@@ -1620,6 +1668,7 @@
"treefmt-nix_2": {
"inputs": {
"nixpkgs": [
"m3ta-home",
"m3ta-nixpkgs",
"buzz",
"nixpkgs"
@@ -1640,6 +1689,28 @@
}
},
"treefmt-nix_3": {
"inputs": {
"nixpkgs": [
"m3ta-nixpkgs",
"buzz",
"nixpkgs"
]
},
"locked": {
"lastModified": 1785360170,
"narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "treefmt-nix",
"type": "github"
}
},
"treefmt-nix_4": {
"inputs": {
"nixpkgs": [
"nixos-anywhere",
@@ -1647,11 +1718,11 @@
]
},
"locked": {
"lastModified": 1784369104,
"narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
"lastModified": 1786901030,
"narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
"rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
"type": "github"
},
"original": {
hosts/AZ-CLD-1/services/metabase.nix
+6 -1
View File
@@ -1,9 +1,14 @@
{config, ...}: let
{
config,
pkgs,
...
}: let
serviceName = "metabase";
servicePort = config.m3ta.ports.get serviceName;
in {
services.${serviceName} = {
enable = true;
package = pkgs.unstable.metabase;
listen.port = servicePort;
};
hosts/AZ-CLD-1/services/pgbouncer.nix
+13 -2
View File
@@ -11,6 +11,13 @@
# Podman-Bridge-IP des Hosts
hostBridgeIP = "10.89.0.1";
# pgbouncer (1.24+ als auch 1.25.2) lädt bei JEDEM TLS-Setup eine CA — auch
# bei sslmode=prefer/require ohne Verifikation. Ohne explizite Datei fällt
# es auf die OpenSSL-Default-Verify-Paths zurück, die hier fehlschlagen:
# "TLS setup failed: failed to load CA: (null)" → Startabbruch.
# Explizites Bundle umgeht das (verifiziert 2026-08-20 gegen 1.24.1 + 1.25.2).
caBundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
commonSettings = {
listen_addr = "127.0.0.1,${hostBridgeIP}";
auth_type = "scram-sha-256";
@@ -22,17 +29,19 @@
log_connections = 1;
log_disconnections = 1;
client_tls_sslmode = "require";
client_tls_sslmode = "prefer";
client_tls_cert_file = config.age.secrets.pgbouncer-tls-cert.path;
client_tls_key_file = config.age.secrets.pgbouncer-tls-key.path;
client_tls_protocols = "secure";
client_tls_ca_file = caBundle;
server_reset_query = "DISCARD ALL";
server_check_query = "SELECT 1";
server_check_delay = 30;
server_tls_sslmode = "require";
server_tls_sslmode = "prefer";
server_tls_protocols = "secure";
server_tls_ca_file = caBundle;
};
mkDatabases = dbs:
@@ -102,6 +111,7 @@ in {
client_tls_cert_file = ${commonSettings.client_tls_cert_file}
client_tls_key_file = ${commonSettings.client_tls_key_file}
client_tls_protocols = ${commonSettings.client_tls_protocols}
client_tls_ca_file = ${commonSettings.client_tls_ca_file}
max_client_conn = 300
default_pool_size = 30
@@ -115,6 +125,7 @@ in {
server_check_delay = 30
server_tls_sslmode = ${commonSettings.server_tls_sslmode}
server_tls_protocols = ${commonSettings.server_tls_protocols}
server_tls_ca_file = ${commonSettings.server_tls_ca_file}
# PID/Socket getrennt von der Haupt-Instanz halten.
pidfile = /run/pgbouncer-session/pgbouncer.pid
overlays/default.nix
+12 -1
View File
@@ -36,6 +36,17 @@
};
};
# Flatten llm-agents packages into top-level pkgs namespace.
# Keep plain derivations only. llm-agents exports `buildNpmPackage` as an
# emptyDirectory derivation ("buildNpmPackage-guard") carrying a __functor
# that forwards to its OWN nixpkgs pin's builder. Flattening it would shadow
# nixpkgs' pkgs.buildNpmPackage and break unrelated packages — e.g.
# vaultwarden-webvault (npmDepsFetcherVersion = 3) failed with
# "fetchNpmDeps: fetcher version must be one of: 1, 2." because llm-agents'
# pinned fetchNpmDeps only allows 1 and 2. Real packages never have a
# __functor, so this filter drops such traps generically.
mkLlmAgentsOverlay = system: _final: _prev:
inputs.llm-agents.packages.${system} or {};
inputs.nixpkgs.lib.filterAttrs (
_: v: inputs.nixpkgs.lib.isDerivation v && !v ? __functor
)
(inputs.llm-agents.packages.${system} or {});
}
secrets/metabase-env.age
BIN
View File
Binary file not shown.