chore: flake update, pgbouncer SSL fix

hosts/AZ-CLD-1/services/metabase.nix

@@ -1,9 +1,14 @@
-{config, ...}: let
+{
+  config,
+  pkgs,
+  ...
+}: let
   serviceName = "metabase";
   servicePort = config.m3ta.ports.get serviceName;
 in {
   services.${serviceName} = {
     enable = true;
+    package = pkgs.unstable.metabase;
     listen.port = servicePort;
   };
 

hosts/AZ-CLD-1/services/pgbouncer.nix

@@ -11,6 +11,13 @@
   # Podman-Bridge-IP des Hosts
   hostBridgeIP = "10.89.0.1";
 
+  # pgbouncer (1.24+ als auch 1.25.2) lädt bei JEDEM TLS-Setup eine CA — auch
+  # bei sslmode=prefer/require ohne Verifikation. Ohne explizite Datei fällt
+  # es auf die OpenSSL-Default-Verify-Paths zurück, die hier fehlschlagen:
+  #   "TLS setup failed: failed to load CA: (null)"  → Startabbruch.
+  # Explizites Bundle umgeht das (verifiziert 2026-08-20 gegen 1.24.1 + 1.25.2).
+  caBundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+
   commonSettings = {
     listen_addr = "127.0.0.1,${hostBridgeIP}";
     auth_type = "scram-sha-256";
@@ -22,17 +29,19 @@
     log_connections = 1;
     log_disconnections = 1;
 
-    client_tls_sslmode = "require";
+    client_tls_sslmode = "prefer";
     client_tls_cert_file = config.age.secrets.pgbouncer-tls-cert.path;
     client_tls_key_file = config.age.secrets.pgbouncer-tls-key.path;
     client_tls_protocols = "secure";
+    client_tls_ca_file = caBundle;
 
     server_reset_query = "DISCARD ALL";
     server_check_query = "SELECT 1";
     server_check_delay = 30;
 
-    server_tls_sslmode = "require";
+    server_tls_sslmode = "prefer";
     server_tls_protocols = "secure";
+    server_tls_ca_file = caBundle;
   };
 
   mkDatabases = dbs:
@@ -102,6 +111,7 @@ in {
     client_tls_cert_file = ${commonSettings.client_tls_cert_file}
     client_tls_key_file = ${commonSettings.client_tls_key_file}
     client_tls_protocols = ${commonSettings.client_tls_protocols}
+    client_tls_ca_file = ${commonSettings.client_tls_ca_file}
 
     max_client_conn = 300
     default_pool_size = 30
@@ -115,6 +125,7 @@ in {
     server_check_delay = 30
     server_tls_sslmode = ${commonSettings.server_tls_sslmode}
     server_tls_protocols = ${commonSettings.server_tls_protocols}
+    server_tls_ca_file = ${commonSettings.server_tls_ca_file}
 
     # PID/Socket getrennt von der Haupt-Instanz halten.
     pidfile = /run/pgbouncer-session/pgbouncer.pid