cluster/prod/app/cryptpad/build/default.nix

@@ -3,7 +3,6 @@
 
 , buildNpmPackage
 , fetchFromGitHub
-, fetchzip
 
 , nodejs
 
@@ -31,8 +30,8 @@
       hash = "sha256-BZdExj2q/bqUD3k9uluOot2dlrWKA+vpad49EdgXKww=";
     };
     v7 = {
-      rev = "e1267803ea749cd93e9d5f81438011ea620d04af";
-      hash = "sha256-iIds0GnCHAyeIEdSD4aCCgDtnnwARh3NE470CywseS0=";
+      rev = "ba82142ff242ce385804bcb4287126de52d329f3";
+      hash = "sha256-3WX3dTWJoeApon1AH3XplBIvEosVNzchkjgi2C808B4=";
     };
   };
   mkOnlyOffice = {
@@ -41,14 +40,6 @@
     pname = "${pname}-onlyoffice";
     inherit version;
 
-    x2t = let
-      version = "v7.3+1";
-    in fetchzip {
-      url = "https://github.com/cryptpad/onlyoffice-x2t-wasm/releases/download/${version}/x2t.zip";
-      hash = "sha256-d5raecsTOflo0UpjSEZW5lker4+wdkTb6IyHNq5iBg8=";
-      stripRoot = false;
-    };
-
     srcs = lib.mapAttrsToList (version: { rev, hash ? lib.fakeHash }: fetchFromGitHub {
       name = "${final.pname}-${version}-source";
       owner = "cryptpad";
@@ -66,21 +57,20 @@
         (version: "cp -Tr ${final.pname}-${version}-source $out/${version}")
         (builtins.attrNames onlyOfficeVersions)
       )}
-      cp -Tr $x2t $out/x2t
     '';
   });
 in buildNpmPackage rec {
   pname = "cryptpad";
-  version = "2024.6.1";
+  version = "2024.3.1";
 
   src = fetchFromGitHub {
     owner = "cryptpad";
     repo = "cryptpad";
     rev = version;
-    hash = "sha256-qwyXpTY8Ds7R5687PVGZa/rlEyrAZjNzJ4+VQZpF8v0=";
+    hash = "sha256-kXghuktaKicFOz98Siy/OjJ9rlgy6C2BTKkD2OFLE+k=";
   };
 
-  npmDepsHash = "sha256-GSTPsXqe/rxiDh5OW2t+ZY1YRNgRSDxkJ0pvcLIFtFw=";
+  npmDepsHash = "sha256-fjImdtv0bwgdDvl/BXV0DesreOAW2u8HsNqJ13hrJMw=";
 
   inherit nodejs;
 
@@ -117,10 +107,6 @@ in buildNpmPackage rec {
     runHook postInstall
   '';
 
-  passthru = {
-    inherit onlyOffice;
-  };
-
   meta = {
     description = "Collaborative office suite, end-to-end encrypted and open-source.";
     homepage = "https://cryptpad.org";

cluster/prod/app/cryptpad/build/deuxfleurs.nix

@@ -5,10 +5,8 @@
   pkgs = import sources.nixpkgs {};
 in rec {
   cryptpad = pkgs.callPackage ./default.nix {};
-  docker = import ./docker.nix {
-    inherit pkgs;
+  docker = pkgs.callPackage ./docker.nix {
     inherit name tag;
     inherit cryptpad;
-    withOnlyOffice = true;
   };
 }

cluster/prod/app/cryptpad/build/npins/sources.json

@@ -2,9 +2,9 @@
   "pins": {
     "nixpkgs": {
       "type": "Channel",
-      "name": "nixos-24.05",
-      "url": "https://releases.nixos.org/nixos/24.05/nixos-24.05.3311.a1cc729dcbc3/nixexprs.tar.xz",
-      "hash": "13al93fac4xdxj0jllfby2v9klwqdhsf3yg10mnsm9ys84v7gsnn"
+      "name": "nixos-23.11",
+      "url": "https://releases.nixos.org/nixos/23.11/nixos-23.11.7237.46397778ef1f/nixexprs.tar.xz",
+      "hash": "00cy8q07diavxb91g7pxl0gqc68s3hzimsggjc9rqyf99h1q9d3r"
     }
   },
   "version": 3

cluster/prod/app/cryptpad/config/config.js

@@ -188,12 +188,6 @@ module.exports = {
      *   DATABASE VOLUMES
      * ===================== */
 
-    /*
-     * We need this config entry, else CryptPad will try to mkdir
-     * some stuff into Nix store apparently...
-     */
-    base: '/mnt/data',
-
     /*
      *  CryptPad stores each document in an individual file on your hard drive.
      *  Specify a directory where files should be stored.

cluster/prod/app/cryptpad/deploy/cryptpad.hcl

@@ -26,7 +26,7 @@ job "cryptpad" {
       }
 
       config {
-        image = "kokakiwi/cryptpad:2024.6.1"
+        image = "kokakiwi/cryptpad:2024.3.1"
         ports = [ "http" ]
 
         volumes = [

cluster/prod/cluster.nix

@@ -99,12 +99,6 @@
       address = "10.83.5.4";
       endpoint = "82.64.238.84:33743";
     };
-    "pamplemousse" = {
-      siteName = "corrin";
-      publicKey = "6y5GrNXEql12AObuSfOHGxxUKpdlcyapu+juLYOEBhc=";
-      address = "10.83.6.1";
-      endpoint = "45.81.62.36:33731";
-    };
   };
 
   # Pin Nomad version

cluster/prod/known_hosts

@@ -13,4 +13,3 @@ onion.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjBQ67fxwuDDzRP
 oseille.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAgQdQ5UVFFn+DXN90ut9+V7NtEopQJnES3r8soKTZW4
 io.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIvgCJ7Jew7ou1RZuaT41Sd+ucZAgxUwtdieqNqoC3+T
 ortie.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMqtfIPLk8a5tM6Upj7GQwlIS16nBPrZYVXE2FVlO2Yn
-pamplemousse.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAI0M5qny9yQ6LNzWqPfSlOWwTYpvxQtuSpFiOb6aVtA

cluster/prod/node/pamplemousse.nix

@@ -1,14 +0,0 @@
-# Configuration file local to this node
-
-{ config, pkgs, ... }:
-
-{
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.timeout = 5;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  deuxfleurs.hostName = "pamplemousse";
-  deuxfleurs.staticIPv4.address = "192.168.5.201";
-  deuxfleurs.staticIPv6.address = "2001:912:1ac0:2200::201";
-}

cluster/prod/node/pamplemousse.site.nix

@@ -1 +0,0 @@
-../site/corrin.nix

cluster/prod/site/corrin.nix

@@ -1,8 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  deuxfleurs.siteName = "corrin";
-  deuxfleurs.staticIPv4.defaultGateway = "192.168.5.1";
-  deuxfleurs.cnameTarget = "corrin.site.deuxfleurs.fr.";
-  deuxfleurs.publicIPv4 = "45.81.62.36";
-}

cluster/prod/ssh_config

@@ -44,6 +44,3 @@ Host io
 
 Host ortie
   HostName ortie.machine.deuxfleurs.fr
-
-Host pamplemousse
-  HostName 2001:912:1ac0:2200::201

cluster/staging/app/core/deploy/diplonat.hcl

@@ -54,7 +54,7 @@ job "core-diplonat" {
         data = <<EOH
 DIPLONAT_REFRESH_TIME=60
 DIPLONAT_EXPIRATION_TIME=300
-DIPLONAT_IPV6_ONLY=true
+DIPLONAT_IPV6_ONLY={{ $site := env "meta.site" }}{{ if eq $site "corrin" }}false{{ else }}true{{ end }}
 DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
 DIPLONAT_CONSUL_URL=https://localhost:8501
 DIPLONAT_CONSUL_CA_CERT=/etc/diplonat/consul-ca.crt

nix/configuration.nix

@@ -78,6 +78,23 @@ SystemMaxUse=1G
   services.openssh.enable = true;
   services.openssh.settings.PasswordAuthentication = false;
 
+  # FIXME: Temporary patch for OpenSSH (CVE-2024-6387)
+  # Patches from backport PR: https://github.com/NixOS/nixpkgs/pull/323765
+  programs.ssh.package = pkgs.openssh.overrideAttrs(prev: {
+    patches = prev.patches ++ [
+      (pkgs.fetchpatch {
+        url = "https://raw.githubusercontent.com/emilazy/nixpkgs/c21c340818954576c6401ad460a9d42bab030bc4/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch";
+        hash = "sha256-B3Wz/eWSdOnrOcVzDv+QqzLGdFlb3jivQ8qZMC3d0Qw=";
+      })
+      (pkgs.fetchpatch {
+        url = "https://raw.githubusercontent.com/emilazy/nixpkgs/c21c340818954576c6401ad460a9d42bab030bc4/pkgs/tools/networking/openssh/openssh-9.6_p1-chaff-logic.patch";
+        hash = "sha256-lepBEFxKTAwg379iCD8KQCZVAzs3qNSSyUTOcartpK4=";
+      })
+    ];
+
+    doCheck = false;
+  });
+
   virtualisation.docker = {
     enable = true;
     extraOptions = "--config-file=${pkgs.writeText "daemon.json" (builtins.toJSON {