magpie: add part-db and inventree

magpie/configuration.nix

@@ -195,6 +195,27 @@
     };
   };
 
+  services.inventree = {
+    enable = true;
+    domain = "inventree.project-cloud.net";
+    adminPasswordFile = config.sops.secrets."inventree_admin_pw".path;
+    database.createLocally = true; # local postgresql db + user
+    settings = {
+      INVENTREE_SITE_URL = "https://inventree.project-cloud.net";
+      INVENTREE_DEBUG = "False";
+    };
+  };
+
+  services.part-db = {
+    enable = true;
+    virtualHost = "parts.project-cloud.net";
+    enableNginx = true;
+    enablePostgresql = true;
+    settings = {
+      DEFAULT_URL = "https://parts.project-cloud.net";
+    };
+  };
+
   services.nginx = {
     enable = true;
     recommendedGzipSettings = true;
@@ -241,6 +262,20 @@
 
     virtualHosts.${config.mailserver.fqdn}.enableACME = true;
 
+    virtualHosts."inventree.project-cloud.net" = {
+      quic = true;
+      http3 = true;
+      forceSSL = true;
+      enableACME = true;
+    };
+
+    virtualHosts."parts.project-cloud.net" = {
+      quic = true;
+      http3 = true;
+      forceSSL = true;
+      enableACME = true;
+    };
+
     virtualHosts."stats.project-cloud.net" = {
       quic = true;
       http3 = true;
@@ -328,6 +363,8 @@
     RestrictAddressFamilies = [ "AF_NETLINK" ];
     ProtectSystem = lib.mkForce false;
   };
+  systemd.services.part-db-migrate.environment.LD_PRELOAD = lib.mkForce "";
+  systemd.services.phpfpm-part-db.environment.LD_PRELOAD = lib.mkForce "";
 
   security.acme = {
     acceptTerms = true;
@@ -336,10 +373,20 @@
 
   security.sudo.execWheelOnly = true;
 
-  environment.memoryAllocator.provider = "jemalloc";
+  #environment.memoryAllocator.provider = "jemalloc";
 
   systemd.coredump.enable = false;
 
+  # The upstream part-db module points APP_SHARE_DIR at /var/lib/part-db/share
+  # (where Symfony writes its cache pools) but never creates it, so every cache
+  # write fails and pages fall into a recompute storm that eventually 502s.
+  systemd.tmpfiles.settings."part-db-share"."/var/lib/part-db/share".d = {
+    mode = "0750";
+    user = "part-db";
+    group = "part-db";
+  };
+
+
   sops = {
     age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     secrets = {
@@ -347,6 +394,10 @@
       "borgbase_enc_key".sopsFile = ./secrets/borgbase_enc_key.yaml;
       "borgbase_ssh_key".sopsFile = ./secrets/borgbase_ssh_key.yaml;
       "gitea_mail_pw_hash".sopsFile = ./secrets/gitea_mail_pw_hash.yaml;
+      "inventree_admin_pw" = {
+        sopsFile = ./secrets/inventree_admin_pw.yaml;
+        owner = config.users.users.inventree.name;
+      };
       "miniflux_env".sopsFile = ./secrets/miniflux.yaml;
       "wg_preshared/nixy".sopsFile = ../common/secrets/wg_preshared.yaml;
       "wg_preshared/workstation".sopsFile = ../common/secrets/wg_preshared.yaml;