[nextcloud] increase cpu count for nextcloud microvm

Reviewed-on: #205

flake.lock

@@ -88,11 +88,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1786463371,
-        "narHash": "sha256-OgyMTerUYMCCRgxF3h0y9bzLa2FJ9m0SwSCtSDzj1Do=",
+        "lastModified": 1786138873,
+        "narHash": "sha256-+G/hTquaK4AjYxNSJTpcZXUEKxFDv9lOn3x+lHHTWJw=",
         "ref": "refs/heads/master",
-        "rev": "25ecbbf375f9e84c2de2753f2372c63f7207afe1",
-        "revCount": 128,
+        "rev": "c5934d05c6f01c94c36221deb7ed4de03aa91ca1",
+        "revCount": 127,
         "type": "git",
         "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
       },
@@ -108,11 +108,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790742243,
-        "narHash": "sha256-kaNo6xHiL31AbNNEreG0OTKf4j6Cxlo5bPawjX7lnbQ=",
+        "lastModified": 1787377438,
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e5fcd298a00f08b6e8390baf04aa8edb62203070",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
         "type": "github"
       },
       "original": {
@@ -149,11 +149,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1790526615,
-        "narHash": "sha256-33a6iTG1uFv12/zV8yo5VvdpftMNQms6TIHhMCVN6zE=",
+        "lastModified": 1788263502,
+        "narHash": "sha256-gyVqW5U9wy6A8voJNu6SiSYTKDplo/MDl31x7FszWlk=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "81f70a2002254f75b572fc34c55e7df16e9bb176",
+        "rev": "974d315e504e666eac4920d712e3ff6804dc1502",
         "type": "github"
       },
       "original": {
@@ -203,11 +203,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1790722812,
-        "narHash": "sha256-XwFt1uLyaBCQU1/nUeGqeBnqNXPVgGRnz20YVYdmF6Y=",
+        "lastModified": 1788335262,
+        "narHash": "sha256-3jBEq8avfzlrsY4UpW4d5TOmm7ocseZfnitEJhqauyc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "06f9ecaea5f64b6ff61cf42cb32f21621c4fa14a",
+        "rev": "44d95795ee2d475b3d687325e26dcf4ca9104557",
         "type": "github"
       },
       "original": {
@@ -235,11 +235,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1790689126,
-        "narHash": "sha256-ilerN1WLSvF+HMjziC/Wv99J5y02maDH+6hZPwsORKg=",
+        "lastModified": 1788179007,
+        "narHash": "sha256-hn1oU2rue2SYK8dAr8+WNZWtbsz1S2W5mnHlSEuh3bo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b4fd65b198c599cbe814fcb9f42d25d021595ec9",
+        "rev": "34ab99075ac4f7e40cf037eef32cb1c360bb85e9",
         "type": "github"
       },
       "original": {
@@ -251,11 +251,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1789546076,
-        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
-        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -264,11 +264,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1790750587,
-        "narHash": "sha256-VfjaoJ1Uyb7JZTrBgE5Jf2nhjtQPmD9KOd19HJwmZwM=",
+        "lastModified": 1792615934,
+        "narHash": "sha256-MlvRfa1O5Cqc2/a+gG+l9TSuowEoCKCmrJ1d9oAVm0I=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "78e9c786dc08cd4f3420c2395cd977206a9b1da2",
+        "rev": "da6dc0e7b26060f2f71ce3ef7088fb56ee44fa36",
         "type": "github"
       },
       "original": {
@@ -354,11 +354,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790498116,
-        "narHash": "sha256-rs9meAYxW3zzrh43yaW7htrqCD+X9+pupDPHN86fumI=",
+        "lastModified": 1788337237,
+        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5efb5a6f4f5ab192817d28557dd4d650fa14d866",
+        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
         "type": "github"
       },
       "original": {
@@ -370,11 +370,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1786032750,
-        "narHash": "sha256-+Ba/kIn5BjvV7PN8bWOo7RoqgTY/Yv2M7qeMf3wS2Ag=",
+        "lastModified": 1785761586,
+        "narHash": "sha256-MWOMVqJJERwjQGgRIv8d6rlEBqbLM3VZWxHkNKIIZNw=",
         "ref": "refs/heads/main",
-        "rev": "77d2389874bb092b8dbf05ecc5b1030372e80e98",
-        "revCount": 1417,
+        "rev": "a7762d6f54b40560dd5255ce902e6e6a5d980fe9",
+        "revCount": 1416,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },
@@ -568,11 +568,11 @@
         "utils": "utils_4"
       },
       "locked": {
-        "lastModified": 1789131197,
-        "narHash": "sha256-gpjhy2mIBt89oCVzoSXy8AgfAKjJ9Fi3u01CX09UTF4=",
+        "lastModified": 1792488750,
+        "narHash": "sha256-VLBpNctawQ+Yd03hkfhNPUqQVXNCc7bc6Qhu7mwJvKM=",
         "ref": "refs/heads/master",
-        "rev": "38bcceb0e8b84d6dcd50d05683c71eea8d410479",
-        "revCount": 161,
+        "rev": "7a8b9d4f3522c68cd15b21a1ec093c8c441775bf",
+        "revCount": 162,
         "type": "git",
         "url": "https://git.dynamicdiscord.de/kalipso/zineshop"
       },

machines/albert/configuration.nix

@@ -86,6 +86,11 @@ in
     };
   };
 
+  systemd.network.networks."05-unmanaged-docker" = {
+    matchConfig = { Name = "veth*"; Kind = "veth"; };
+    linkConfig = { Unmanaged = true; };
+  };
+
   nixpkgs.config.allowUnfree = true; 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "i686-linux" ];
   services.acpid.enable = true;

machines/albert/hydra.nix

@@ -20,6 +20,7 @@
 
   services.malobeo.gitea-translator = {
     enable = true;
+    host = "0.0.0.0";
   };
 
   services.hydra = {

machines/fanny/configuration.nix

@@ -263,7 +263,7 @@ in
           client_body_in_file_only clean;
           client_body_buffer_size 32K;
           
-          client_max_body_size 50M;
+          client_max_body_size 500M;
           
           sendfile on;
           send_timeout 300s;

machines/fanny/dyndns.nix

@@ -1,17 +1,12 @@
 {pkgs, ...}:
 {
   sops.secrets.njalacloud = {};
-  sops.secrets.njalazines = {};
-  sops.secrets.njalaantamap = {};
+  sops.secrets.njalarm16 = {};
   systemd.services."dyndns" = {
     script = ''
       KEYCLOUD=$(cat /run/secrets/njalacloud)
-      KEYZINES=$(cat /run/secrets/njalazines)
-      KEYANATAMAP=$(cat /run/secrets/njalaantamap)
       KEYRM16=$(cat /run/secrets/njalarm16)
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
-      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
-      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=rm16bleibt.org&k="$KEYRM16"&auto"
     '';
     serviceConfig = {

machines/nextcloud/configuration.nix

@@ -6,6 +6,7 @@ let
   hosts = import ../hosts.nix {};
 in
 {
+  microvm.vcpu = 2;
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets = {
     nextcloudAdminPass = {
@@ -39,7 +40,7 @@ in
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud33;
+    package = pkgs.nextcloud35;
     hostName = "cloud.malobeo.org";
     config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
     maxUploadSize = "10G";
@@ -49,16 +50,10 @@ in
     configureRedis = true;
     caching = {
       redis = true;
-      apcu = true;
     };
     extraAppsEnable = true;
     extraApps = {
-      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
-      deck = pkgs.fetchNextcloudApp {
-        sha256 = "sha256-Oc/J0Ey7f9aHhLBWoAXaDMe2t0eeEQKvpwY510qNpiI=";
-        url = "https://s3.g.megas4.com/ya5mczgkbk6bw7tcy2yr4bl2vdryfe76ok2dj/malo/deck33.tar.gz";
-        license = "agpl3Plus";
-      };
+      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms deck;
     };
     settings = {
       trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
@@ -68,7 +63,6 @@ in
       "default_phone_region" = "DE";
     };
     phpOptions = {
-      "realpath_cache_size" = "0";
       "opcache.interned_strings_buffer" = "32";
     };
   };

machines/nextcloud/secrets.yaml

@@ -1,12 +1,7 @@
-nextcloudAdminPass: ENC[AES256_GCM,data:es9hhtCcqBqPbV2L,iv:Kyq5kqao0uaMPs0GeRkJT9OWYSZfImBXngg51k0uQ0M=,tag:zN/u90/j4rmdo0HtY+cF9w==,type:str]
+nextcloudAdminPass: ENC[AES256_GCM,data:RsP8Q1FqS9qgYTNe+H/nDHwQwr0fvlQawCOJWZVoF2U=,iv:AqJ79m3GAUd6sczDByJlb+K3XxxEt3HS4fURd7kn0bY=,tag:n/GyRKrIwOcksDtewnnXZw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
-        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPT3ZxNEpRVktDWG9BR0Rv
             ZUZQTkJwQ0pSblNvTkFOT3BBdjVaSzJhVzBvCnVWc2xRUjBnRFFXSDgxczRMSFMy
@@ -14,8 +9,8 @@ sops:
             aDd0UlpMR3RNd3BDMmhqNmxhTFRoUlkK6Pni+cswKIU94WkP/fg5fzSmx/fhXjjl
             mRG2o4ALCqcOxAxHBrKJppUCLjUgKG53wPF/jlIzkvbwHwnqVMfYsQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
-          enc: |
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRK2o2K2tPTFcvbXRkZ0lq
             bS9ZOUc3dG1JeERZYVNsc3k3RjcxQ0RsdkRJCkx1VFhBQXRDOElqakJ0eTd3NEJX
@@ -23,8 +18,9 @@ sops:
             VjBFeldXS1p0Zk1uSk02aHpJd3BPOHcKvCmnK/KttB4RgnID/fj2KOdjvNnV3EWU
             B9mW4yxbEqhoxtu+GFD3eR/8SvMPEsHl9xorT/ZygMG7hAzedSukWw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-26T20:00:50Z"
-    mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
+          recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
+    lastmodified: "2026-10-22T19:07:13Z"
+    mac: ENC[AES256_GCM,data:HD1uqrxxfLrHGQfu7HFpuunpj/npPe35AvvFrhGFRUTtXLGRPDn5xeOiuHyT+qSs51lukE+hYhv/+u4xolb0SInOJtPTZ6suRcZ4maJ+9P0mgjs7OmI4e68CpGo0xuOg378WvlF15VQH2KCcVskEkO9UBTfOUmyNku1g4F6PeWw=,iv:cJaz6dYkspBlBY9aCaK2/zBDiVg7J7nCE+fnwNHz1Tw=,tag:5sKITZ8uD7JnRtwhaOPoGw==,type:str]
     pgp:
         - created_at: "2025-03-05T08:24:30Z"
           enc: |-
@@ -65,4 +61,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.13.3

machines/overwatch/configuration.nix

@@ -145,6 +145,7 @@ in
             "https://keys.malobeo.org"
             "https://tasklist.malobeo.org"
             "https://zines.malobeo.org"
+            "http://${hosts.malobeo.hosts.albert.network.address}:27364/health"
            ];
         }];
 
@@ -263,6 +264,12 @@ in
           targets = [ "${hosts.malobeo.hosts.albert.network.address}:9002" ];
         }];
       }
+      {
+        job_name = "wordpress";
+        static_configs = [{
+          targets = [ "${hosts.malobeo.hosts.wordpress.network.address}:9002" ];
+        }];
+      }
       # add vpn - check how to reach it first. most probably 10.100.0.1
     ];
   };

machines/wordpress/configuration.nix

@@ -23,10 +23,17 @@ in {
   };
 
   imports = [
+    inputs.malobeo.nixosModules.malobeo.metrics
     inputs.self.nixosModules.malobeo.users
     ../modules/sshd.nix
   ];
 
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+  };
+
   malobeo.users = {
     malobeo = false;
     admin = true;

scripts/gitea_hydra_server.py

@@ -26,7 +26,7 @@ def _parse_response(baseurl, owner, repo):
     return pulls
 
 class PullsHandler(BaseHTTPRequestHandler):
-    _VALID_PATHS={"/", "/gitea-pulls-sorted.json"}
+    _VALID_PATHS={"/", "/gitea-pulls-sorted.json", "/health"}
 
     # Class variables to store configuration
     baseurl = None
@@ -34,6 +34,15 @@ class PullsHandler(BaseHTTPRequestHandler):
     repo = None
 
     def do_GET(self):
+        if self.path == "/health":
+            body=json.dumps({"status": "ok"}).encode("utf-8")
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
+
         if self.path not in self._VALID_PATHS:
             self.send_error(404, "Not Found")
             return