From 7595e7c9c80d8ff4d111e2f4d529cf49c2adc5a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sascha=20K=C3=B6nig?= Date: Thu, 20 Aug 2026 12:36:16 +0200 Subject: [PATCH] chore: flake update, pgbouncer SSL fix --- flake.lock | 179 ++++++++++++++++++-------- hosts/AZ-CLD-1/services/metabase.nix | 7 +- hosts/AZ-CLD-1/services/pgbouncer.nix | 15 ++- overlays/default.nix | 13 +- secrets/metabase-env.age | Bin 682 -> 1121 bytes 5 files changed, 156 insertions(+), 58 deletions(-) diff --git a/flake.lock b/flake.lock index ca03d67..1d7e187 100644 --- a/flake.lock +++ b/flake.lock @@ -243,16 +243,16 @@ ] }, "locked": { - "lastModified": 1785348116, - "narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=", + "lastModified": 1785979955, + "narHash": "sha256-OP96Ak4OBydR98keoNYKdGY8j+wrIys0LafSZgwS20g=", "owner": "basecamp", "repo": "basecamp-cli", - "rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6", + "rev": "61a5591de1da9bc99c56b8072a4d6bad2c9b9e47", "type": "github" }, "original": { "owner": "basecamp", - "ref": "v0.8.0-rc.1", + "ref": "v0.9.0", "repo": "basecamp-cli", "type": "github" } @@ -315,6 +315,7 @@ "buzz": { "inputs": { "nixpkgs": [ + "m3ta-home", "m3ta-nixpkgs", "nixpkgs" ], @@ -335,6 +336,29 @@ "type": "github" } }, + "buzz_2": { + "inputs": { + "nixpkgs": [ + "m3ta-nixpkgs", + "nixpkgs" + ], + "rust-overlay": "rust-overlay_2", + "treefmt-nix": "treefmt-nix_3" + }, + "locked": { + "lastModified": 1785934673, + "narHash": "sha256-U/hMY9kkcdxt497yfGuT7+ytrRmE+E15KF6Sc6VrbZo=", + "owner": "mulatta", + "repo": "buzz.nix", + "rev": "f4bb77a87f1ec10e5ad51cfe6d0c4fca481c0534", + "type": "github" + }, + "original": { + "owner": "mulatta", + "repo": "buzz.nix", + "type": "github" + } + }, "darwin": { "inputs": { "nixpkgs": [ @@ -641,11 +665,11 @@ ] }, "locked": { - "lastModified": 1785119570, - "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=", + "lastModified": 1787146702, + "narHash": "sha256-YbRcLdU/yK4gWsQg7V8WTKZHfXL33g8+wSFUX3wyevs=", "owner": "nix-community", "repo": "home-manager", - "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d", + "rev": "173b7e8d40fdc8c296a9c99854314f17a3a1704c", "type": "github" }, "original": { @@ -707,11 +731,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1785753922, - "narHash": "sha256-cRnp7DSvT4BwRI04YSbA0Ocn1iY6+fN9KTfnsADHm3I=", + "lastModified": 1787199456, + "narHash": "sha256-hXW5My3dyh+AV1SnUz0zu86CnYJ9EjRgpFtLpKlBk/U=", "owner": "numtide", "repo": "llm-agents.nix", - "rev": "8a86f04f5cfbffc5b5d0b38ac24795ab4909b46b", + "rev": "24a6facb2f1a9487d8ff87c30896ac40a9e45bfa", "type": "github" }, "original": { @@ -737,11 +761,11 @@ "nur": "nur" }, "locked": { - "lastModified": 1785750596, - "narHash": "sha256-bVhnKFnFnxmntaYi63tx58wN1v0WI31qWyxPciqVuuI=", + "lastModified": 1786880699, + "narHash": "sha256-3Pd0sb2Wgu0f6kaM+4G2i0RR/6vGIoDAG98kVQSMFIQ=", "ref": "refs/heads/master", - "rev": "6a67324c6d1a1ff740ca7aafc575b0a0ea513e5a", - "revCount": 112, + "rev": "6a311045a4879fef06b9755cbdcdf5a896431450", + "revCount": 120, "type": "git", "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home" }, @@ -754,6 +778,7 @@ "inputs": { "agents": "agents_3", "basecamp": "basecamp", + "buzz": "buzz", "nixpkgs": [ "m3ta-home", "nixpkgs" @@ -763,11 +788,11 @@ "openspec": "openspec" }, "locked": { - "lastModified": 1785670526, - "narHash": "sha256-tC1CW+Kxh9ZZxJC0y472i0KoieMqNwNi+AiCmS4n7To=", + "lastModified": 1786795567, + "narHash": "sha256-+fc2Zo7Nf6Td+/x5Y8SX5qxPM3hi0nH7i/L0vgosnGI=", "ref": "refs/heads/master", - "rev": "69fce234a8607cd3e71233831564b8ceeba70626", - "revCount": 374, + "rev": "b8b541c3329509b0df3b57d384ce5886d3cc0d47", + "revCount": 380, "type": "git", "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs" }, @@ -780,18 +805,18 @@ "inputs": { "agents": "agents_4", "basecamp": "basecamp_2", - "buzz": "buzz", + "buzz": "buzz_2", "nixpkgs": "nixpkgs_7", "nixpkgs-master": "nixpkgs-master_2", "opencode": "opencode_2", "openspec": "openspec_2" }, "locked": { - "lastModified": 1786563125, - "narHash": "sha256-a6Rom/Tn66AqPipVRkYu8aaQqFkJjbKh9GaaHVo660g=", + "lastModified": 1787159856, + "narHash": "sha256-GeoUWSYKQ64o7/HrDp6ZLnpiky6QTxtil/5Vnc79t/E=", "ref": "refs/heads/master", - "rev": "af9422c7b5b0c028a7379a329075bef450a9dfb3", - "revCount": 379, + "rev": "2e1b87686261ad28137481e19f4c69f472c18a79", + "revCount": 382, "type": "git", "url": "https://code.m3ta.dev/m3tam3re/nixpkgs" }, @@ -866,11 +891,11 @@ ] }, "locked": { - "lastModified": 1783265394, - "narHash": "sha256-cq4YfNFGYzp0NItZP8tEC7xUI8OSgY4fj75AU/NSaPM=", + "lastModified": 1786747096, + "narHash": "sha256-9QqhmaLVsPhKdMSBaWKjDqeGRn8G4ov4cVuZ6JFwXbo=", "owner": "numtide", "repo": "nix-vm-test", - "rev": "1a587212d2ac8b669c6c32499015f996506b6ba5", + "rev": "c8781a0ea2d8417506fff7722eae5a6316461212", "type": "github" }, "original": { @@ -888,14 +913,14 @@ "nixpkgs": [ "nixpkgs" ], - "treefmt-nix": "treefmt-nix_3" + "treefmt-nix": "treefmt-nix_4" }, "locked": { - "lastModified": 1785356851, - "narHash": "sha256-UYKTcayxYPE3yIruCv525WMbcYDLlkv79bRfkOuFNLs=", + "lastModified": 1787124618, + "narHash": "sha256-aKf1k2hvYgaxP9oxDPRiv9npEJLODC9eKxk7nR69lzQ=", "owner": "nix-community", "repo": "nixos-anywhere", - "rev": "5887f1c72fbf0e88000716237194de414d2299ee", + "rev": "ad8fa24e11eef167fd72d49fafefa3f840312d71", "type": "github" }, "original": { @@ -916,11 +941,11 @@ ] }, "locked": { - "lastModified": 1784802994, - "narHash": "sha256-4PcD0Ibzdkh85G+70w5dLlR9YgQ2bmNIjiPPMSzO57w=", + "lastModified": 1786617555, + "narHash": "sha256-r3brKkBWm34wltszIeoZw2VCFUEoS2nNAe3W2Zgzc9k=", "owner": "nix-community", "repo": "nixos-images", - "rev": "6ece16b0c97986fe085122e796044add4cc3ff64", + "rev": "f01878e82602ad3d0a2e74a14440521924e57bc5", "type": "github" }, "original": { @@ -931,11 +956,11 @@ }, "nixos-stable": { "locked": { - "lastModified": 1785133411, - "narHash": "sha256-Yjv0WEg39KRYS0rBdTbu6Fc/or/ihAKk13W9sQ6VWd0=", + "lastModified": 1787042014, + "narHash": "sha256-lgnV/xeEatfEnPZG0RrXS0fhcr63p3tsVvL1GdaVkJQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "2f5a153c270b70cb0f8c11f46d96d6d3bc39f4e3", + "rev": "c69ae8fb8faeb3472fd11234ba55a70ac3601f9b", "type": "github" }, "original": { @@ -1041,11 +1066,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1785692966, - "narHash": "sha256-vUfIeBEfpbAfZ5zjgIkYk7eHBeVfCYVjLbWnMkseYnk=", + "lastModified": 1787070829, + "narHash": "sha256-vXNVDVtvfiQuXthP0NHPFdNvvMTkGpx0UP8oddIWbNk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "643809054d65fdd466a63e3155b8c498cb483c04", + "rev": "0ae2bc1419c3f345984c2629e72e7a631820fa4d", "type": "github" }, "original": { @@ -1089,11 +1114,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1785602060, - "narHash": "sha256-z7D96eESRM4CPV/XtwpwFn8IDdfLAmxz6lVWrGYXvR4=", + "lastModified": 1787111413, + "narHash": "sha256-sFosWtq21eHGJRnTc/hvf4M1obRgLEUMNm/IzllkHMA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a5cbcfe954791221bfffe2307f7d1a1bf61a871e", + "rev": "afe3d8ac4395617bdcdac9f188ac8717a062e014", "type": "github" }, "original": { @@ -1201,11 +1226,11 @@ }, "nixpkgs_9": { "locked": { - "lastModified": 1785599192, - "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=", + "lastModified": 1787101114, + "narHash": "sha256-gwrPcFf/rDjHPaVflbDZ040ZDmBTRj/7+s8ZmE2SaIM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07", + "rev": "b18a4b905f8d028dc4476412e6d6891728695379", "type": "github" }, "original": { @@ -1264,11 +1289,11 @@ ] }, "locked": { - "lastModified": 1785765597, - "narHash": "sha256-p1GIp3seaFZZlBFkmls7GydU0t05WD5Jc6RmN++9GnE=", + "lastModified": 1787199531, + "narHash": "sha256-OHKo7ycmQpc4wRxy4wtmKCVl7Zhu68/7tREy5JasKPw=", "owner": "nix-community", "repo": "NUR", - "rev": "2b594a63f182954b69bba5d140c558c9a5f17005", + "rev": "e923d9114cb211bf3858e988de54b7ec43492d8d", "type": "github" }, "original": { @@ -1515,6 +1540,29 @@ } }, "rust-overlay": { + "inputs": { + "nixpkgs": [ + "m3ta-home", + "m3ta-nixpkgs", + "buzz", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1785820796, + "narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "b6916ba032e02122d6ed3064f40cabe937363d43", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, + "rust-overlay_2": { "inputs": { "nixpkgs": [ "m3ta-nixpkgs", @@ -1604,11 +1652,11 @@ ] }, "locked": { - "lastModified": 1785360170, - "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", + "lastModified": 1786901030, + "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", + "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa", "type": "github" }, "original": { @@ -1620,6 +1668,7 @@ "treefmt-nix_2": { "inputs": { "nixpkgs": [ + "m3ta-home", "m3ta-nixpkgs", "buzz", "nixpkgs" @@ -1640,6 +1689,28 @@ } }, "treefmt-nix_3": { + "inputs": { + "nixpkgs": [ + "m3ta-nixpkgs", + "buzz", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1785360170, + "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + }, + "treefmt-nix_4": { "inputs": { "nixpkgs": [ "nixos-anywhere", @@ -1647,11 +1718,11 @@ ] }, "locked": { - "lastModified": 1784369104, - "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=", + "lastModified": 1786901030, + "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "df3c0640565d04a0261253cdd89fce78ec50168a", + "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa", "type": "github" }, "original": { diff --git a/hosts/AZ-CLD-1/services/metabase.nix b/hosts/AZ-CLD-1/services/metabase.nix index 94c7853..b03ba3c 100644 --- a/hosts/AZ-CLD-1/services/metabase.nix +++ b/hosts/AZ-CLD-1/services/metabase.nix @@ -1,9 +1,14 @@ -{config, ...}: let +{ + config, + pkgs, + ... +}: let serviceName = "metabase"; servicePort = config.m3ta.ports.get serviceName; in { services.${serviceName} = { enable = true; + package = pkgs.unstable.metabase; listen.port = servicePort; }; diff --git a/hosts/AZ-CLD-1/services/pgbouncer.nix b/hosts/AZ-CLD-1/services/pgbouncer.nix index b568e4f..4ba1c09 100644 --- a/hosts/AZ-CLD-1/services/pgbouncer.nix +++ b/hosts/AZ-CLD-1/services/pgbouncer.nix @@ -11,6 +11,13 @@ # Podman-Bridge-IP des Hosts hostBridgeIP = "10.89.0.1"; + # pgbouncer (1.24+ als auch 1.25.2) lädt bei JEDEM TLS-Setup eine CA — auch + # bei sslmode=prefer/require ohne Verifikation. Ohne explizite Datei fällt + # es auf die OpenSSL-Default-Verify-Paths zurück, die hier fehlschlagen: + # "TLS setup failed: failed to load CA: (null)" → Startabbruch. + # Explizites Bundle umgeht das (verifiziert 2026-08-20 gegen 1.24.1 + 1.25.2). + caBundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; + commonSettings = { listen_addr = "127.0.0.1,${hostBridgeIP}"; auth_type = "scram-sha-256"; @@ -22,17 +29,19 @@ log_connections = 1; log_disconnections = 1; - client_tls_sslmode = "require"; + client_tls_sslmode = "prefer"; client_tls_cert_file = config.age.secrets.pgbouncer-tls-cert.path; client_tls_key_file = config.age.secrets.pgbouncer-tls-key.path; client_tls_protocols = "secure"; + client_tls_ca_file = caBundle; server_reset_query = "DISCARD ALL"; server_check_query = "SELECT 1"; server_check_delay = 30; - server_tls_sslmode = "require"; + server_tls_sslmode = "prefer"; server_tls_protocols = "secure"; + server_tls_ca_file = caBundle; }; mkDatabases = dbs: @@ -102,6 +111,7 @@ in { client_tls_cert_file = ${commonSettings.client_tls_cert_file} client_tls_key_file = ${commonSettings.client_tls_key_file} client_tls_protocols = ${commonSettings.client_tls_protocols} + client_tls_ca_file = ${commonSettings.client_tls_ca_file} max_client_conn = 300 default_pool_size = 30 @@ -115,6 +125,7 @@ in { server_check_delay = 30 server_tls_sslmode = ${commonSettings.server_tls_sslmode} server_tls_protocols = ${commonSettings.server_tls_protocols} + server_tls_ca_file = ${commonSettings.server_tls_ca_file} # PID/Socket getrennt von der Haupt-Instanz halten. pidfile = /run/pgbouncer-session/pgbouncer.pid diff --git a/overlays/default.nix b/overlays/default.nix index 946bf3d..ba9281a 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -36,6 +36,17 @@ }; }; # Flatten llm-agents packages into top-level pkgs namespace. + # Keep plain derivations only. llm-agents exports `buildNpmPackage` as an + # emptyDirectory derivation ("buildNpmPackage-guard") carrying a __functor + # that forwards to its OWN nixpkgs pin's builder. Flattening it would shadow + # nixpkgs' pkgs.buildNpmPackage and break unrelated packages — e.g. + # vaultwarden-webvault (npmDepsFetcherVersion = 3) failed with + # "fetchNpmDeps: fetcher version must be one of: 1, 2." because llm-agents' + # pinned fetchNpmDeps only allows 1 and 2. Real packages never have a + # __functor, so this filter drops such traps generically. mkLlmAgentsOverlay = system: _final: _prev: - inputs.llm-agents.packages.${system} or {}; + inputs.nixpkgs.lib.filterAttrs ( + _: v: inputs.nixpkgs.lib.isDerivation v && !v ? __functor + ) + (inputs.llm-agents.packages.${system} or {}); } diff --git a/secrets/metabase-env.age b/secrets/metabase-env.age index f57ce3c139cd8c92ca4729bfba7fad27ae363889..a61807ab07fe02cab97a04d5b9cc6731d2ecf1fd 100644 GIT binary patch literal 1121 zcmdM|0Vh{?Pd^1mcUJ{hKj)yxfDl&~1vgJ0SCE`8S7dlfj!$@4X{522X|hL9L6VV4 zX_B#5o{w>4g>$BXwx@?*Rid+DPLzwMpkn5$um zLAJL~h)H^~v0uJVcv!Y?R;VGDZ%B4}sIix4WQ3cOr$?x1YHmtSScsc%SdL#wc zSayzSa88bwUzn3mcvw_euu-x>V2D#@im{VnWKO6FS7LUML1JjAcXF1KcZ!==V0cbo zc}PxBXrz%>VoGjQet5X4cc{B%cA~qNZ+Ng}Sdv?TL2yo(PjIDWMpSNk8CPU^en~*4 zQ&qB2dP!7xV5MJ3XoY{UQ*n^7TX=YGa(ZBHSVg!;Mo^M#P(`AfU!i|QMn#BGMPRCn zS9X+Zb`@8!u~$)~VS$;yt5;O8o3CL?mRoL=QBYV=V1ZYZt7}=fi=TUnyIW3pXo*)? zc%*4iuBC5Oct&=(i(65kVL=I3N`$LnxT~SBZ)j9hWSC!mYIt@z*64Hf3kiwH$&adZ z^6?EV3H39mFo_CJapOv)tY4GAhv@kj{?ay6(33U|v+ z%ngc2b@i-FtnxJVF|q(hpO1@aaEh^4XmX`tUUF_&MzT?8I#)nofm@)VUtW-5L11!j zibrZzhF@5=g@LbIm}gX;uVF~GTSiEzVNSSvRB2S0Tb^^KL5WYWlSfpTTUcaXMg&(# zh?{d_cvL}HPO_nIu9shOXplj0W=XJjm77sej$46mc1dn{cvw(WRa8l+QF^&^eqnH8 zrl~=xxle9EnU6PDZe)OSdU>99ifehKaaB%=lUatNySH~zgimRNU%5+)he=tOt8-qN zySInFL4J0!v00g!sY!ZBX`x|3vSW}BSE)&EmWx4#qi2+HZb+%4Nn(56w zNu_pSj+bYcfq9aNg_luerEgJ)TZ*<}N`{HHPg+)Giiu}_Dwk!3d1a`NTTV)_x0|P> zzH4HdQ>dw*V_30QdYOBXVR?$NQ+{zksX<;|xTU#aaHM&en`4%_OKL@-wxNEYNfcL6 zNwQ&Tu7P`4UShswnXi$Hc3y?Ad4YM5afpjqdZ1x$a%Hw_Zcw6mu69b9XMjtgX{2jm mnq#>~jPc%`#{fr+WPlcTLI7r2OU^>e{ldH?_(t!Zok literal 682 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTS$_Oh?O;@P&H>k4A z)h{$E33n|{3N!S|2`WeoEhx=2aZb!Ca!fa`@JuvG^iHWX4CQhu^!E33a<0sd3W_Rq z&++!sFRpSgGx81z%nvZE@CdUsaWBaWH8=7P3PraqxX2^1&`}}4+_cC!xG*I=Co4GE zG0`m2)!Dho+b|?DILk04%dav#z%R$gJ*C(+Jd(>a*)S(E$<)KA%+oK!qokxLptQue zDy2LmHQXgR#Wf_{I4Cb9#KX0~IUn7&9QVSosB{I#tm25U0HgdW^K7G(G$SXo5bXe? zyySd?{IpP`3Vko1V6W87qD=D~_iQe2i>&;_z$mAbfO1#2fE3eA%fgCuGhc19)a1&@ zJX0@6U)LbdbWh{rf?{;roP&KUGtw1IlZ;*cOwzp4T%0mYf>V>z%)`r*J&W?3{45H6 z4b7Y)jLP)G%!=L#b#)aC3|%dP{KJcqyi2OglENx716?drL$k8dQ!35Vy)Bb-JhdbI)7^?g zvhukeWS@Nbw>f-?q~6>_hAIw=n7vObyQf_Il)q=)Q;*1fvjx?6Ye^j5&^%A*8rQBU zzRgAM5qp~NnckSY&P1J8Ke5KSq{F^qW3hkb*Nz{VoF3aR2$vRbVy-;k?C|f^fpvyE ze;qklXZGekduI2OC9}8by46VZJnC8EHEo%yZ>`OxAKMK~3d&FZOPq08c&qBP2b{?Y h4gVin=IY-H+Eh62mtn7h`s`04-v