diff --git a/flake.lock b/flake.lock index ca03d67..1d7e187 100644 --- a/flake.lock +++ b/flake.lock @@ -243,16 +243,16 @@ ] }, "locked": { - "lastModified": 1785348116, - "narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=", + "lastModified": 1785979955, + "narHash": "sha256-OP96Ak4OBydR98keoNYKdGY8j+wrIys0LafSZgwS20g=", "owner": "basecamp", "repo": "basecamp-cli", - "rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6", + "rev": "61a5591de1da9bc99c56b8072a4d6bad2c9b9e47", "type": "github" }, "original": { "owner": "basecamp", - "ref": "v0.8.0-rc.1", + "ref": "v0.9.0", "repo": "basecamp-cli", "type": "github" } @@ -315,6 +315,7 @@ "buzz": { "inputs": { "nixpkgs": [ + "m3ta-home", "m3ta-nixpkgs", "nixpkgs" ], @@ -335,6 +336,29 @@ "type": "github" } }, + "buzz_2": { + "inputs": { + "nixpkgs": [ + "m3ta-nixpkgs", + "nixpkgs" + ], + "rust-overlay": "rust-overlay_2", + "treefmt-nix": "treefmt-nix_3" + }, + "locked": { + "lastModified": 1785934673, + "narHash": "sha256-U/hMY9kkcdxt497yfGuT7+ytrRmE+E15KF6Sc6VrbZo=", + "owner": "mulatta", + "repo": "buzz.nix", + "rev": "f4bb77a87f1ec10e5ad51cfe6d0c4fca481c0534", + "type": "github" + }, + "original": { + "owner": "mulatta", + "repo": "buzz.nix", + "type": "github" + } + }, "darwin": { "inputs": { "nixpkgs": [ @@ -641,11 +665,11 @@ ] }, "locked": { - "lastModified": 1785119570, - "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=", + "lastModified": 1787146702, + "narHash": "sha256-YbRcLdU/yK4gWsQg7V8WTKZHfXL33g8+wSFUX3wyevs=", "owner": "nix-community", "repo": "home-manager", - "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d", + "rev": "173b7e8d40fdc8c296a9c99854314f17a3a1704c", "type": "github" }, "original": { @@ -707,11 +731,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1785753922, - "narHash": "sha256-cRnp7DSvT4BwRI04YSbA0Ocn1iY6+fN9KTfnsADHm3I=", + "lastModified": 1787199456, + "narHash": "sha256-hXW5My3dyh+AV1SnUz0zu86CnYJ9EjRgpFtLpKlBk/U=", "owner": "numtide", "repo": "llm-agents.nix", - "rev": "8a86f04f5cfbffc5b5d0b38ac24795ab4909b46b", + "rev": "24a6facb2f1a9487d8ff87c30896ac40a9e45bfa", "type": "github" }, "original": { @@ -737,11 +761,11 @@ "nur": "nur" }, "locked": { - "lastModified": 1785750596, - "narHash": "sha256-bVhnKFnFnxmntaYi63tx58wN1v0WI31qWyxPciqVuuI=", + "lastModified": 1786880699, + "narHash": "sha256-3Pd0sb2Wgu0f6kaM+4G2i0RR/6vGIoDAG98kVQSMFIQ=", "ref": "refs/heads/master", - "rev": "6a67324c6d1a1ff740ca7aafc575b0a0ea513e5a", - "revCount": 112, + "rev": "6a311045a4879fef06b9755cbdcdf5a896431450", + "revCount": 120, "type": "git", "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home" }, @@ -754,6 +778,7 @@ "inputs": { "agents": "agents_3", "basecamp": "basecamp", + "buzz": "buzz", "nixpkgs": [ "m3ta-home", "nixpkgs" @@ -763,11 +788,11 @@ "openspec": "openspec" }, "locked": { - "lastModified": 1785670526, - "narHash": "sha256-tC1CW+Kxh9ZZxJC0y472i0KoieMqNwNi+AiCmS4n7To=", + "lastModified": 1786795567, + "narHash": "sha256-+fc2Zo7Nf6Td+/x5Y8SX5qxPM3hi0nH7i/L0vgosnGI=", "ref": "refs/heads/master", - "rev": "69fce234a8607cd3e71233831564b8ceeba70626", - "revCount": 374, + "rev": "b8b541c3329509b0df3b57d384ce5886d3cc0d47", + "revCount": 380, "type": "git", "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs" }, @@ -780,18 +805,18 @@ "inputs": { "agents": "agents_4", "basecamp": "basecamp_2", - "buzz": "buzz", + "buzz": "buzz_2", "nixpkgs": "nixpkgs_7", "nixpkgs-master": "nixpkgs-master_2", "opencode": "opencode_2", "openspec": "openspec_2" }, "locked": { - "lastModified": 1786563125, - "narHash": "sha256-a6Rom/Tn66AqPipVRkYu8aaQqFkJjbKh9GaaHVo660g=", + "lastModified": 1787159856, + "narHash": "sha256-GeoUWSYKQ64o7/HrDp6ZLnpiky6QTxtil/5Vnc79t/E=", "ref": "refs/heads/master", - "rev": "af9422c7b5b0c028a7379a329075bef450a9dfb3", - "revCount": 379, + "rev": "2e1b87686261ad28137481e19f4c69f472c18a79", + "revCount": 382, "type": "git", "url": "https://code.m3ta.dev/m3tam3re/nixpkgs" }, @@ -866,11 +891,11 @@ ] }, "locked": { - "lastModified": 1783265394, - "narHash": "sha256-cq4YfNFGYzp0NItZP8tEC7xUI8OSgY4fj75AU/NSaPM=", + "lastModified": 1786747096, + "narHash": "sha256-9QqhmaLVsPhKdMSBaWKjDqeGRn8G4ov4cVuZ6JFwXbo=", "owner": "numtide", "repo": "nix-vm-test", - "rev": "1a587212d2ac8b669c6c32499015f996506b6ba5", + "rev": "c8781a0ea2d8417506fff7722eae5a6316461212", "type": "github" }, "original": { @@ -888,14 +913,14 @@ "nixpkgs": [ "nixpkgs" ], - "treefmt-nix": "treefmt-nix_3" + "treefmt-nix": "treefmt-nix_4" }, "locked": { - "lastModified": 1785356851, - "narHash": "sha256-UYKTcayxYPE3yIruCv525WMbcYDLlkv79bRfkOuFNLs=", + "lastModified": 1787124618, + "narHash": "sha256-aKf1k2hvYgaxP9oxDPRiv9npEJLODC9eKxk7nR69lzQ=", "owner": "nix-community", "repo": "nixos-anywhere", - "rev": "5887f1c72fbf0e88000716237194de414d2299ee", + "rev": "ad8fa24e11eef167fd72d49fafefa3f840312d71", "type": "github" }, "original": { @@ -916,11 +941,11 @@ ] }, "locked": { - "lastModified": 1784802994, - "narHash": "sha256-4PcD0Ibzdkh85G+70w5dLlR9YgQ2bmNIjiPPMSzO57w=", + "lastModified": 1786617555, + "narHash": "sha256-r3brKkBWm34wltszIeoZw2VCFUEoS2nNAe3W2Zgzc9k=", "owner": "nix-community", "repo": "nixos-images", - "rev": "6ece16b0c97986fe085122e796044add4cc3ff64", + "rev": "f01878e82602ad3d0a2e74a14440521924e57bc5", "type": "github" }, "original": { @@ -931,11 +956,11 @@ }, "nixos-stable": { "locked": { - "lastModified": 1785133411, - "narHash": "sha256-Yjv0WEg39KRYS0rBdTbu6Fc/or/ihAKk13W9sQ6VWd0=", + "lastModified": 1787042014, + "narHash": "sha256-lgnV/xeEatfEnPZG0RrXS0fhcr63p3tsVvL1GdaVkJQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "2f5a153c270b70cb0f8c11f46d96d6d3bc39f4e3", + "rev": "c69ae8fb8faeb3472fd11234ba55a70ac3601f9b", "type": "github" }, "original": { @@ -1041,11 +1066,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1785692966, - "narHash": "sha256-vUfIeBEfpbAfZ5zjgIkYk7eHBeVfCYVjLbWnMkseYnk=", + "lastModified": 1787070829, + "narHash": "sha256-vXNVDVtvfiQuXthP0NHPFdNvvMTkGpx0UP8oddIWbNk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "643809054d65fdd466a63e3155b8c498cb483c04", + "rev": "0ae2bc1419c3f345984c2629e72e7a631820fa4d", "type": "github" }, "original": { @@ -1089,11 +1114,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1785602060, - "narHash": "sha256-z7D96eESRM4CPV/XtwpwFn8IDdfLAmxz6lVWrGYXvR4=", + "lastModified": 1787111413, + "narHash": "sha256-sFosWtq21eHGJRnTc/hvf4M1obRgLEUMNm/IzllkHMA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a5cbcfe954791221bfffe2307f7d1a1bf61a871e", + "rev": "afe3d8ac4395617bdcdac9f188ac8717a062e014", "type": "github" }, "original": { @@ -1201,11 +1226,11 @@ }, "nixpkgs_9": { "locked": { - "lastModified": 1785599192, - "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=", + "lastModified": 1787101114, + "narHash": "sha256-gwrPcFf/rDjHPaVflbDZ040ZDmBTRj/7+s8ZmE2SaIM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07", + "rev": "b18a4b905f8d028dc4476412e6d6891728695379", "type": "github" }, "original": { @@ -1264,11 +1289,11 @@ ] }, "locked": { - "lastModified": 1785765597, - "narHash": "sha256-p1GIp3seaFZZlBFkmls7GydU0t05WD5Jc6RmN++9GnE=", + "lastModified": 1787199531, + "narHash": "sha256-OHKo7ycmQpc4wRxy4wtmKCVl7Zhu68/7tREy5JasKPw=", "owner": "nix-community", "repo": "NUR", - "rev": "2b594a63f182954b69bba5d140c558c9a5f17005", + "rev": "e923d9114cb211bf3858e988de54b7ec43492d8d", "type": "github" }, "original": { @@ -1515,6 +1540,29 @@ } }, "rust-overlay": { + "inputs": { + "nixpkgs": [ + "m3ta-home", + "m3ta-nixpkgs", + "buzz", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1785820796, + "narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "b6916ba032e02122d6ed3064f40cabe937363d43", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, + "rust-overlay_2": { "inputs": { "nixpkgs": [ "m3ta-nixpkgs", @@ -1604,11 +1652,11 @@ ] }, "locked": { - "lastModified": 1785360170, - "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", + "lastModified": 1786901030, + "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", + "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa", "type": "github" }, "original": { @@ -1620,6 +1668,7 @@ "treefmt-nix_2": { "inputs": { "nixpkgs": [ + "m3ta-home", "m3ta-nixpkgs", "buzz", "nixpkgs" @@ -1640,6 +1689,28 @@ } }, "treefmt-nix_3": { + "inputs": { + "nixpkgs": [ + "m3ta-nixpkgs", + "buzz", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1785360170, + "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + }, + "treefmt-nix_4": { "inputs": { "nixpkgs": [ "nixos-anywhere", @@ -1647,11 +1718,11 @@ ] }, "locked": { - "lastModified": 1784369104, - "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=", + "lastModified": 1786901030, + "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "df3c0640565d04a0261253cdd89fce78ec50168a", + "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa", "type": "github" }, "original": { diff --git a/hosts/AZ-CLD-1/services/metabase.nix b/hosts/AZ-CLD-1/services/metabase.nix index 94c7853..b03ba3c 100644 --- a/hosts/AZ-CLD-1/services/metabase.nix +++ b/hosts/AZ-CLD-1/services/metabase.nix @@ -1,9 +1,14 @@ -{config, ...}: let +{ + config, + pkgs, + ... +}: let serviceName = "metabase"; servicePort = config.m3ta.ports.get serviceName; in { services.${serviceName} = { enable = true; + package = pkgs.unstable.metabase; listen.port = servicePort; }; diff --git a/hosts/AZ-CLD-1/services/pgbouncer.nix b/hosts/AZ-CLD-1/services/pgbouncer.nix index b568e4f..4ba1c09 100644 --- a/hosts/AZ-CLD-1/services/pgbouncer.nix +++ b/hosts/AZ-CLD-1/services/pgbouncer.nix @@ -11,6 +11,13 @@ # Podman-Bridge-IP des Hosts hostBridgeIP = "10.89.0.1"; + # pgbouncer (1.24+ als auch 1.25.2) lädt bei JEDEM TLS-Setup eine CA — auch + # bei sslmode=prefer/require ohne Verifikation. Ohne explizite Datei fällt + # es auf die OpenSSL-Default-Verify-Paths zurück, die hier fehlschlagen: + # "TLS setup failed: failed to load CA: (null)" → Startabbruch. + # Explizites Bundle umgeht das (verifiziert 2026-08-20 gegen 1.24.1 + 1.25.2). + caBundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; + commonSettings = { listen_addr = "127.0.0.1,${hostBridgeIP}"; auth_type = "scram-sha-256"; @@ -22,17 +29,19 @@ log_connections = 1; log_disconnections = 1; - client_tls_sslmode = "require"; + client_tls_sslmode = "prefer"; client_tls_cert_file = config.age.secrets.pgbouncer-tls-cert.path; client_tls_key_file = config.age.secrets.pgbouncer-tls-key.path; client_tls_protocols = "secure"; + client_tls_ca_file = caBundle; server_reset_query = "DISCARD ALL"; server_check_query = "SELECT 1"; server_check_delay = 30; - server_tls_sslmode = "require"; + server_tls_sslmode = "prefer"; server_tls_protocols = "secure"; + server_tls_ca_file = caBundle; }; mkDatabases = dbs: @@ -102,6 +111,7 @@ in { client_tls_cert_file = ${commonSettings.client_tls_cert_file} client_tls_key_file = ${commonSettings.client_tls_key_file} client_tls_protocols = ${commonSettings.client_tls_protocols} + client_tls_ca_file = ${commonSettings.client_tls_ca_file} max_client_conn = 300 default_pool_size = 30 @@ -115,6 +125,7 @@ in { server_check_delay = 30 server_tls_sslmode = ${commonSettings.server_tls_sslmode} server_tls_protocols = ${commonSettings.server_tls_protocols} + server_tls_ca_file = ${commonSettings.server_tls_ca_file} # PID/Socket getrennt von der Haupt-Instanz halten. pidfile = /run/pgbouncer-session/pgbouncer.pid diff --git a/overlays/default.nix b/overlays/default.nix index 946bf3d..ba9281a 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -36,6 +36,17 @@ }; }; # Flatten llm-agents packages into top-level pkgs namespace. + # Keep plain derivations only. llm-agents exports `buildNpmPackage` as an + # emptyDirectory derivation ("buildNpmPackage-guard") carrying a __functor + # that forwards to its OWN nixpkgs pin's builder. Flattening it would shadow + # nixpkgs' pkgs.buildNpmPackage and break unrelated packages — e.g. + # vaultwarden-webvault (npmDepsFetcherVersion = 3) failed with + # "fetchNpmDeps: fetcher version must be one of: 1, 2." because llm-agents' + # pinned fetchNpmDeps only allows 1 and 2. Real packages never have a + # __functor, so this filter drops such traps generically. mkLlmAgentsOverlay = system: _final: _prev: - inputs.llm-agents.packages.${system} or {}; + inputs.nixpkgs.lib.filterAttrs ( + _: v: inputs.nixpkgs.lib.isDerivation v && !v ? __functor + ) + (inputs.llm-agents.packages.${system} or {}); } diff --git a/secrets/metabase-env.age b/secrets/metabase-env.age index f57ce3c..a61807a 100644 Binary files a/secrets/metabase-env.age and b/secrets/metabase-env.age differ