cluster/prod/app/cryptpad/build/default.nix

@@ -3,7 +3,6 @@
 
 , buildNpmPackage
 , fetchFromGitHub
-, fetchzip
 
 , nodejs
 
@@ -41,14 +40,6 @@
     pname = "${pname}-onlyoffice";
     inherit version;
 
-    x2t = let
-      version = "v7.3+1";
-    in fetchzip {
-      url = "https://github.com/cryptpad/onlyoffice-x2t-wasm/releases/download/${version}/x2t.zip";
-      hash = "sha256-d5raecsTOflo0UpjSEZW5lker4+wdkTb6IyHNq5iBg8=";
-      stripRoot = false;
-    };
-
     srcs = lib.mapAttrsToList (version: { rev, hash ? lib.fakeHash }: fetchFromGitHub {
       name = "${final.pname}-${version}-source";
       owner = "cryptpad";
@@ -66,21 +57,20 @@
         (version: "cp -Tr ${final.pname}-${version}-source $out/${version}")
         (builtins.attrNames onlyOfficeVersions)
       )}
-      cp -Tr $x2t $out/x2t
     '';
   });
 in buildNpmPackage rec {
   pname = "cryptpad";
-  version = "2024.6.0";
+  version = "2024.3.1";
 
   src = fetchFromGitHub {
     owner = "cryptpad";
     repo = "cryptpad";
     rev = version;
-    hash = "sha256-huIhhnjatkaVfm1zDeqi88EX/nAUBQ0onPNOwn7hrX4=";
+    hash = "sha256-kXghuktaKicFOz98Siy/OjJ9rlgy6C2BTKkD2OFLE+k=";
   };
 
-  npmDepsHash = "sha256-Oh1fBvP7OXC+VDiH3D+prHmi8pRrxld06n30sqw5apY=";
+  npmDepsHash = "sha256-fjImdtv0bwgdDvl/BXV0DesreOAW2u8HsNqJ13hrJMw=";
 
   inherit nodejs;
 
@@ -117,10 +107,6 @@ in buildNpmPackage rec {
     runHook postInstall
   '';
 
-  passthru = {
-    inherit onlyOffice;
-  };
-
   meta = {
     description = "Collaborative office suite, end-to-end encrypted and open-source.";
     homepage = "https://cryptpad.org";

cluster/prod/app/cryptpad/build/deuxfleurs.nix

@@ -5,10 +5,8 @@
   pkgs = import sources.nixpkgs {};
 in rec {
   cryptpad = pkgs.callPackage ./default.nix {};
-  docker = import ./docker.nix {
-    inherit pkgs;
+  docker = pkgs.callPackage ./docker.nix {
     inherit name tag;
     inherit cryptpad;
-    withOnlyOffice = true;
   };
 }

cluster/prod/app/cryptpad/build/npins/sources.json

@@ -2,9 +2,9 @@
   "pins": {
     "nixpkgs": {
       "type": "Channel",
-      "name": "nixos-24.05",
-      "url": "https://releases.nixos.org/nixos/24.05/nixos-24.05.2355.d032c1a6dfad/nixexprs.tar.xz",
-      "hash": "1fynyfjsmrxs383mygzlbkb3yhzmlnnpf8x84mikaiqc3ngszsv8"
+      "name": "nixos-23.11",
+      "url": "https://releases.nixos.org/nixos/23.11/nixos-23.11.7237.46397778ef1f/nixexprs.tar.xz",
+      "hash": "00cy8q07diavxb91g7pxl0gqc68s3hzimsggjc9rqyf99h1q9d3r"
     }
   },
   "version": 3

cluster/prod/app/cryptpad/config/config.js

@@ -188,12 +188,6 @@ module.exports = {
      *   DATABASE VOLUMES
      * ===================== */
 
-    /*
-     * We need this config entry, else CryptPad will try to mkdir
-     * some stuff into Nix store apparently...
-     */
-    base: '/mnt/data',
-
     /*
      *  CryptPad stores each document in an individual file on your hard drive.
      *  Specify a directory where files should be stored.

cluster/prod/app/cryptpad/deploy/cryptpad.hcl

@@ -26,7 +26,7 @@ job "cryptpad" {
       }
 
       config {
-        image = "kokakiwi/cryptpad:2024.6.0"
+        image = "kokakiwi/cryptpad:2024.3.1"
         ports = [ "http" ]
 
         volumes = [

cluster/prod/cluster.nix

@@ -93,12 +93,6 @@
       address = "10.83.5.3";
       endpoint = "82.64.238.84:33742";
     };
-    "ortie" = {
-      siteName = "dathomir";
-      publicKey = "tbx2mvt3TN3Xd+ermwwZ6it80VWT5949cKH9BRFgvzE=";
-      address = "10.83.5.4";
-      endpoint = "82.64.238.84:33743";
-    };
   };
 
   # Pin Nomad version

cluster/prod/known_hosts

@@ -12,4 +12,3 @@ ananas.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHs0zAyBy70oyV5
 onion.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjBQ67fxwuDDzRPveTko/Sgf0cev3tIvlr3CfAmhF0C
 oseille.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAgQdQ5UVFFn+DXN90ut9+V7NtEopQJnES3r8soKTZW4
 io.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIvgCJ7Jew7ou1RZuaT41Sd+ucZAgxUwtdieqNqoC3+T
-ortie.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMqtfIPLk8a5tM6Upj7GQwlIS16nBPrZYVXE2FVlO2Yn

cluster/prod/node/ortie.nix

@@ -1,12 +0,0 @@
-{ ... }:
-{
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.timeout = 20;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  services.openssh.ports = [ 22 33604 ];
-
-  deuxfleurs.hostName = "ortie";
-  deuxfleurs.staticIPv4.address = "192.168.1.37";
-  deuxfleurs.staticIPv6.address = "2a01:e0a:5e4:1d0:223:24ff:feb0:1b9";
-}

cluster/prod/node/ortie.site.nix

@@ -1 +0,0 @@
-../site/dathomir.nix

cluster/prod/ssh_config

@@ -41,6 +41,3 @@ Host oseille
 
 Host io
   HostName io.machine.deuxfleurs.fr
-
-Host ortie
-  HostName ortie.machine.deuxfleurs.fr

cluster/staging/app/ci/deploy/albatros.hcl

@@ -1,5 +1,5 @@
 job "albatros" {
-  datacenters = ["neptune", "dathomir", "corrin", "bespin"]
+  datacenters = ["neptune", "jupiter", "corrin", "bespin"]
   type = "service"
   priority = 90
 

cluster/staging/app/ci/deploy/builder.hcl

@@ -2,7 +2,7 @@ job "builder" {
   namespace = "ci"
   type = "batch"
 
-  datacenters = ["neptune", "dathomir", "corrin", "bespin"]
+  datacenters = ["neptune", "jupiter", "corrin", "bespin"]
   priority = 100
 
   parameterized {

cluster/staging/app/core/deploy/d53.hcl

@@ -1,5 +1,5 @@
 job "core-d53" {
-  datacenters = ["neptune", "dathomir", "corrin", "bespin"]
+  datacenters = ["neptune", "jupiter", "corrin", "bespin"]
   type = "service"
   priority = 90
 

cluster/staging/app/core/deploy/diplonat.hcl

@@ -1,5 +1,5 @@
 job "core-diplonat" {
-  datacenters = ["neptune", "dathomir", "corrin", "bespin"]
+  datacenters = ["neptune", "jupiter", "corrin", "bespin"]
   type = "system"
   priority = 90
 

cluster/staging/app/core/deploy/tricot.hcl

@@ -1,5 +1,5 @@
 job "core-tricot" {
-  datacenters = ["neptune", "dathomir", "corrin", "bespin"]
+  datacenters = ["neptune", "jupiter", "corrin", "bespin"]
   type = "system"
   priority = 90
 

cluster/staging/app/garage/deploy/garage.hcl

@@ -1,5 +1,5 @@
 job "garage-staging" {
-  datacenters = [ "neptune", "dathomir", "corrin", "bespin" ]
+  datacenters = [ "neptune", "jupiter", "corrin", "bespin" ]
   type = "system"
   priority = 90
 

cluster/staging/app/telemetry/deploy/telemetry-service.hcl

@@ -1,5 +1,5 @@
 job "telemetry-service" {
-  datacenters = ["neptune", "dathomir", "corrin", "bespin"]
+  datacenters = ["neptune", "jupiter", "corrin", "bespin"]
   type = "service"
 
   group "prometheus" {

cluster/staging/app/telemetry/deploy/telemetry-system.hcl

@@ -1,5 +1,5 @@
 job "telemetry-system" {
-  datacenters = ["neptune", "dathomir", "corrin", "bespin"]
+  datacenters = ["neptune", "jupiter", "corrin", "bespin"]
   type = "system"
   priority = "100"
 

cluster/staging/cluster.nix

@@ -14,7 +14,7 @@
       endpoint = "77.207.15.215:33723";
     };
     "origan" = {
-      siteName = "dathomir";
+      siteName = "jupiter";
       publicKey = "smBQYUS60JDkNoqkTT7TgbpqFiM43005fcrT6472llI=";
       address = "10.14.2.33";
       endpoint = "82.64.238.84:33733";

cluster/staging/node/origan.nix

@@ -1,4 +1,7 @@
-{ ... }:
+# Configuration file local to this node
+
+{ config, pkgs, ... }:
+
 {
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;

cluster/staging/node/origan.site.nix

@@ -1 +1 @@
-../site/dathomir.nix
+../site/jupiter.nix

cluster/staging/site/dathomir.nix

@@ -1,6 +0,0 @@
-{ ... }:
-{
-  deuxfleurs.siteName = "dathomir";
-  deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1";
-  deuxfleurs.cnameTarget = "dathomir.site.staging.deuxfleurs.org.";
-}

cluster/staging/site/jupiter.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+
+{
+  deuxfleurs.siteName = "jupiter";
+  deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1";
+  deuxfleurs.cnameTarget = "jupiter.site.staging.deuxfleurs.org.";
+}

nix/configuration.nix

@@ -78,23 +78,6 @@ SystemMaxUse=1G
   services.openssh.enable = true;
   services.openssh.settings.PasswordAuthentication = false;
 
-  # FIXME: Temporary patch for OpenSSH (CVE-2024-6387)
-  # Patches from backport PR: https://github.com/NixOS/nixpkgs/pull/323765
-  programs.ssh.package = pkgs.openssh.overrideAttrs(prev: {
-    patches = prev.patches ++ [
-      (pkgs.fetchpatch {
-        url = "https://raw.githubusercontent.com/emilazy/nixpkgs/c21c340818954576c6401ad460a9d42bab030bc4/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch";
-        hash = "sha256-B3Wz/eWSdOnrOcVzDv+QqzLGdFlb3jivQ8qZMC3d0Qw=";
-      })
-      (pkgs.fetchpatch {
-        url = "https://raw.githubusercontent.com/emilazy/nixpkgs/c21c340818954576c6401ad460a9d42bab030bc4/pkgs/tools/networking/openssh/openssh-9.6_p1-chaff-logic.patch";
-        hash = "sha256-lepBEFxKTAwg379iCD8KQCZVAzs3qNSSyUTOcartpK4=";
-      })
-    ];
-
-    doCheck = false;
-  });
-
   virtualisation.docker = {
     enable = true;
     extraOptions = "--config-file=${pkgs.writeText "daemon.json" (builtins.toJSON {