[pretalx] pin package to unstable to fix security problem

if it gets included in other flakes 'self' references to that flake,
instead of malobeo

.gitea/workflows/hydra-callback.yml

@@ -1,15 +1,26 @@
-name: Weekly Flake Update
+name: Hydra callback
 
 on:
     pull_request:
-      types: 
-        - opened
+        types: 
+            - opened
+            - synchronize
+        paths:
+          - '**.nix'
+          - flake.lock
+    push:
+        branches:
+          - master
+        paths:
+          - '**.nix'
+          - flake.lock
 
 permissions:
     contents: write
 
 jobs:
-    hydra_callback:
+    on_pr:
+        if: github.event.pull_request
         runs-on: ubuntu-latest
         env:
             NIXPKGS_ALLOW_UNFREE: 1
@@ -24,8 +35,29 @@ jobs:
                 github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
             - name: Find pr number
               run: |
-                echo 'PR=$(echo "${{ github.ref }}" | cut -d / -f 3)' >> "$GITHUB_ENV"
+                echo PR=$(echo "${{ github.ref }}" | cut -d / -f 3) >> "$GITHUB_ENV"
             - name: run hydra wait
+              timeout-minutes: 200
               run: |
                 echo "Running now @ pr no $PR"
-                nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 "$PR"
+                nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 "$PR"
+
+    on_push:
+        if: github.event.push
+        runs-on: ubuntu-latest
+        env:
+            NIXPKGS_ALLOW_UNFREE: 1
+        steps:
+            - name: Install sudo
+              run: |
+                  apt-get update
+                  apt-get install -y sudo
+            - name: Set up Nix
+              uses: https://github.com/cachix/install-nix-action@v31
+              with: 
+                github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
+            - name: run hydra wait
+              timeout-minutes: 200
+              run: |
+                echo "Running now @ master"
+                nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 master

.hydra/spec.json

@@ -12,7 +12,7 @@
   "type": 0,
   "inputs": {
     "nixexpr": {
-      "value": "https://git.dynamicdiscord.de/ahtlon/infrastructure master",
+      "value": "https://git.dynamicdiscord.de/malobeo/infrastructure master",
       "type": "git",
       "emailresponsible": false
     },

machines/modules/malobeo/gitea_translator.nix

@@ -55,7 +55,7 @@ in
 
       serviceConfig = {
         ExecStart = ''
-          ${pkgs.python3}/bin/python3 ${inputs.self + /scripts/gitea_hydra_server.py} \
+          ${pkgs.python3}/bin/python3 ${../../../scripts/gitea_hydra_server.py} \
             --baseurl ${cfg.baseurl} \
             --owner ${cfg.owner} \
             --repo ${cfg.repo} \
@@ -75,4 +75,4 @@ in
       };
     };
   };
-}
+}

machines/nextcloud/configuration.nix

@@ -63,6 +63,7 @@ in
     settings = {
       trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
       trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
+      overwriteprotocol = "https";
       "maintenance_window_start" = "1";
       "default_phone_region" = "DE";
     };

machines/pretalx/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs,  ... }:
+{ config, self, lib, pkgs, inputs,  ... }:
 
 with lib;
 
@@ -58,6 +58,7 @@ in
 
   services.pretalx = {
     enable = true;
+    package = inputs.nixpkgs-unstable.legacyPackages."x86_64-linux".pretalx;
     celery.extraArgs = [
       "--concurrency=${toString config.microvm.vcpu}"
     ];

outputs.nix

@@ -118,6 +118,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       users.imports = [ ./machines/modules/malobeo/users.nix ];
       backup.imports = [ ./machines/modules/malobeo/backup.nix ];
       printing.imports = [ ./machines/modules/malobeo/printing.nix ];
+      gitea-translator.imports = [ ./machines/modules/malobeo/gitea_translator.nix ];
     };
 
     hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (