[docs] update nextcloud instructions

Changes from a cloud filehost to a local build, should also be more maintainable

.gitea/workflows/autoupdate.yml

@@ -2,7 +2,7 @@ name: Weekly Flake Update
 
 on:
     schedule:
-        - cron: "0 4 /14 * *"
+        - cron: "0 4 1/14 * *"
     workflow_dispatch:
 
 permissions:
@@ -89,6 +89,18 @@ jobs:
                 grep -q ${{ github.ref_name }} &&
                 exit 1 ||
                 exit 0
+            - name: close other bump requests
+              run: |
+                for i in $(tea pr -o simple | grep "Automatic Nixpkgs update" | awk '{print $1}')
+                do
+                  if [ "$i" = "" ]
+                  then
+                    echo "No bumps to close"
+                    exit 0
+                  else
+                    tea pr close $i
+                  fi
+                done
             - name: Force push branch
               run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
             - name: Create pull request
@@ -102,18 +114,6 @@ jobs:
                 -L "bump"
                 -t "$COMMIT_MSG"
                 -d "$COMMIT_DESC"
-            - name: close other bump requests
-              run: |
-                for i in $(tea pr -o simple | grep "Automatic Nixpkgs update" | awk '{print $1}')
-                do
-                  if [ "$i" = "" ]
-                  then
-                    echo "No bumps to close"
-                    exit 0
-                  else
-                    tea pr close $i
-                  fi
-                done
             - name: Skip pull request
               if: steps.no-pr.outcome == 'failure'
               shell: bash

doc/book.toml

@@ -1,6 +1,5 @@
 [book]
 authors = ["ahtlon"]
 language = "de"
-multilingual = false
 src = "src"
 title = "Malobeo Infrastruktur Dokumentation"

doc/src/anleitung/update_nextcloud.md

@@ -1,7 +1,14 @@
 ### Updating nextcloud
 
 ## Updating the draggable patch
+As of 17.06.26 the patch now gets applied automaticly while building the package.   
+On a nextcloud update:
+- Change the `services.nextcloud.package` to the next version (ex.: `pkgs.nextcloud33`)
+- Change `services.nextcloud.extraApps.deck.src.rev` to the next version (ex.: `stable33`)
+- update hashes
 
+
+### Building the package manually 
 The draggable patch is a one line patch found in the deck repo under `src/components/cards/CardItem.vue`   
 Direct link: https://git.dynamicdiscord.de/ahtlon/deck/commit/77cbcf42ca80dd32e450839f02faca2e5fed3761   
 

flake.lock

@@ -85,16 +85,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1763992789,
-        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
+        "lastModified": 1781319724,
+        "narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
+        "rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.05",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -126,11 +126,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1776340739,
-        "narHash": "sha256-s4FDictJlPtY6Shd6scG5hgrDMiHth09+svtvTA5NLA=",
+        "lastModified": 1781389237,
+        "narHash": "sha256-Ne1/E5XNUq0gleaQz0vW5R4xf/0h/uEZ+bOW1aNjeQk=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "2f2f62fdfdca2750e3399f66bd03986ab967e5ca",
+        "rev": "6ad601df0a07d9855c5e8f9b81135ecaf7c287eb",
         "type": "github"
       },
       "original": {
@@ -176,12 +176,15 @@
       }
     },
     "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1777917524,
-        "narHash": "sha256-k+LVe9YaO2BEPB9AaCtTtOMCeGi4dxDo6gt4Un3qoPY=",
+        "lastModified": 1781622756,
+        "narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "df7783100babf59001340a7a874ba3824e441ecb",
+        "rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
         "type": "github"
       },
       "original": {
@@ -209,11 +212,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1777578337,
-        "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=",
+        "lastModified": 1781577229,
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "15f4ee454b1dce334612fa6843b3e05cf546efab",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
         "type": "github"
       },
       "original": {
@@ -225,16 +228,29 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1777673416,
-        "narHash": "sha256-5c2POKPOjU40Kh0MirOdScBLG0bu9TAuPYAtPRNZMBs=",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1781216227,
+        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "26ef669cffa904b6f6832ab57b77892a37c1a671",
+        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -249,7 +265,7 @@
         "microvm": "microvm",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix",
         "tasklist": "tasklist",
@@ -264,11 +280,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "lastModified": 1780547341,
+        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
         "type": "github"
       },
       "original": {
@@ -280,11 +296,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1772189877,
-        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
+        "lastModified": 1778940603,
+        "narHash": "sha256-voSM8dZNlaOWN3kbYFky+FNY6fFQOEw0xF+ZMpZKkCQ=",
         "ref": "refs/heads/main",
-        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
-        "revCount": 1255,
+        "rev": "367dd227f539267eae2b62770b4c17b88ac8c1f1",
+        "revCount": 1265,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },

flake.nix

@@ -3,7 +3,7 @@
 
   inputs = {
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -43,7 +43,7 @@
     };
 
     home-manager=  {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs = {
         nixpkgs.follows = "nixpkgs";
       };

machines/fanny/configuration.nix

@@ -165,7 +165,7 @@ in
     defaults.email = "malobeo@systemli.org";
     defaults = {
       dnsProvider = "njalla";
-      credentialsFile = config.sops.secrets.njala_api_key.path;
+      environmentFile = config.sops.secrets.njala_api_key.path;
       dnsPropagationCheck = false;
     };
   };

machines/louise/configuration.nix

@@ -46,6 +46,8 @@
     ];
   };
 
+  nixpkgs.config.permittedInsecurePackages = [ "electron-39.8.10" ];
+
   services.tor = {
     enable = true;
     client.enable = true;

machines/lucia/configuration.nix

@@ -67,17 +67,17 @@ in
   mpd = {
     enable = true;
     musicDirectory = "/var/lib/mpd/music";
-    extraConfig = ''
-      audio_output {
-        type "alsa"
-        name "My ALSA"
-        device			"hw:0,0"	# optional 
-        format			"44100:16:2"	# optional
-        mixer_type		"hardware"
-        mixer_device	"default"
-        mixer_control	"PCM"
-      }
-    '';
+    settings = {
+      audio_output = [{
+        type = "alsa";
+        name = "My ALSA";
+        device = "hw:0,0";	# optional 
+        format = "44100:16:2";	# optional
+        mixer_type = "hardware";
+        mixer_device = "default";
+        mixer_control = "PCM";
+      }];
+    };
   
     # Optional:
     network.listenAddress = "any"; # if you want to allow non-localhost connections
@@ -199,7 +199,7 @@ in
     defaults.email = "malobeo@systemli.org";
     defaults = {
       dnsProvider = "njalla";
-      credentialsFile = config.sops.secrets.njala_api_key.path;
+      environmentFile = config.sops.secrets.njala_api_key.path;
       dnsPropagationCheck = false;
     };
   };

machines/modules/malobeo/metrics.nix

@@ -41,17 +41,22 @@ in
       };
     };
 
-    services.promtail = {
+    services.alloy = {
       enable = cfg.enablePromtail;
-      configFile = import ./promtail_config.nix { 
+      extraFlags = ["--config.format=promtail"]; #TODO please change this to native alloy config later
+      configPath = import ./promtail_config.nix { 
         lokiAddress = cfg.lokiHost;
         logNginx = cfg.logNginx;
         config = config;
         pkgs = pkgs;
       };
     };
-
-    users.users.promtail.extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
+    users.groups.promtail = {};
+    users.users.promtail = {
+      isNormalUser = true;
+      group = "promtail";
+      extraGroups = [ "systemd-journal" ] ++ (lib.optionals cfg.logNginx [ "nginx" ]) ;
+    };
 
   };
 }

machines/nextcloud/0001-Patch-cards-to-be-draggable.patch

@@ -0,0 +1,25 @@
+From 0d4b14e8eb62b0f0ed01f45bbaa7c2721245f7d6 Mon Sep 17 00:00:00 2001
+From: ahtlon <git@ahtlon.de>
+Date: Thu, 9 Oct 2025 12:22:08 +0200
+Subject: [PATCH] Patch cards to be draggable
+
+---
+ src/components/cards/CardItem.vue | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/components/cards/CardItem.vue b/src/components/cards/CardItem.vue
+index 7539ac53e..aaf9f2fe0 100644
+--- a/src/components/cards/CardItem.vue
++++ b/src/components/cards/CardItem.vue
+@@ -20,7 +20,7 @@
+ 			<CardCover v-if="showCardCover" :card-id="card.id" />
+ 			<div class="card-upper">
+ 				<h4 v-if="editingTitle === 0" key="title-view" dir="auto">
+-					<span class="dragDisabled" contenteditable="false">{{ displayTitle }}</span>
++					<span contenteditable="false">{{ displayTitle }}</span>
+ 				</h4>
+ 				<h4 v-if="editingTitle >= 1"
+ 					key="title-edit"
+-- 
+2.54.0
+

machines/nextcloud/configuration.nix

@@ -39,7 +39,7 @@ in
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud33;
     hostName = "cloud.malobeo.org";
     config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
     maxUploadSize = "10G";
@@ -54,11 +54,24 @@ in
     extraAppsEnable = true;
     extraApps = {
       inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
-      deck = pkgs.fetchNextcloudApp {
-        sha256 = "sha256-epjwIANb6vTNx9KqaG6jZc14YPoFMBTCj+/c9JHcWkA=";
-        url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
-        license = "agpl3Plus";
-      };
+      deck = pkgs.php.buildComposerProject2 (finalAttrs: {
+        pname = "deck";
+        version = "1.18.0";
+        src = pkgs.fetchFromGitHub {
+          owner = "nextcloud";
+          repo = "deck";
+          rev = "stable33";
+          hash = "sha256-7R0IteB34mWFwUlHptvqNlfmeFhJcGMRlKFtDqsw1Dw=";
+        };
+        composerNoDev = false;
+        composerStrictValidation = false;
+        vendorHash = "sha256-gAuG5kKVpuaOpw2HvAP/hu89lmcVWUiSwujoN++I/ZA=";
+        patches = [ ./0001-Patch-cards-to-be-draggable.patch ];
+        postInstall = ''
+          cp -r $out/share/php/deck/* $out/
+          rm -r $out/share
+        '';
+      });
     };
     settings = {
       trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];

machines/overwatch/configuration.nix

@@ -37,6 +37,7 @@ in
   services.grafana = {
     enable = true;
     settings = {
+      security.secret_key = "SW2YcwTIb9zpOOhoPsMm";
       server = {
         domain = "grafana.malobeo.org";
         http_port = 2342;