magpie/inventree: add pass

magpie/configuration.nix

@@ -195,6 +195,27 @@
     };
   };
 
+  services.inventree = {
+    enable = true;
+    domain = "inventree.project-cloud.net";
+    adminPasswordFile = config.sops.secrets."inventree_admin_pw".path;
+    database.createLocally = true; # local postgresql db + user
+    settings = {
+      INVENTREE_SITE_URL = "https://inventree.project-cloud.net";
+      INVENTREE_DEBUG = "False";
+    };
+  };
+
+  services.part-db = {
+    enable = true;
+    virtualHost = "parts.project-cloud.net";
+    enableNginx = true;
+    enablePostgresql = true;
+    settings = {
+      DEFAULT_URL = "https://parts.project-cloud.net";
+    };
+  };
+
   services.nginx = {
     enable = true;
     recommendedGzipSettings = true;
@@ -241,6 +262,20 @@
 
     virtualHosts.${config.mailserver.fqdn}.enableACME = true;
 
+    virtualHosts."inventree.project-cloud.net" = {
+      quic = true;
+      http3 = true;
+      forceSSL = true;
+      enableACME = true;
+    };
+
+    virtualHosts."parts.project-cloud.net" = {
+      quic = true;
+      http3 = true;
+      forceSSL = true;
+      enableACME = true;
+    };
+
     virtualHosts."stats.project-cloud.net" = {
       quic = true;
       http3 = true;
@@ -328,6 +363,8 @@
     RestrictAddressFamilies = [ "AF_NETLINK" ];
     ProtectSystem = lib.mkForce false;
   };
+  systemd.services.part-db-migrate.environment.LD_PRELOAD = lib.mkForce "";
+  systemd.services.phpfpm-part-db.environment.LD_PRELOAD = lib.mkForce "";
 
   security.acme = {
     acceptTerms = true;
@@ -336,10 +373,20 @@
 
   security.sudo.execWheelOnly = true;
 
-  environment.memoryAllocator.provider = "jemalloc";
+  #environment.memoryAllocator.provider = "jemalloc";
 
   systemd.coredump.enable = false;
 
+  # The upstream part-db module points APP_SHARE_DIR at /var/lib/part-db/share
+  # (where Symfony writes its cache pools) but never creates it, so every cache
+  # write fails and pages fall into a recompute storm that eventually 502s.
+  systemd.tmpfiles.settings."part-db-share"."/var/lib/part-db/share".d = {
+    mode = "0750";
+    user = "part-db";
+    group = "part-db";
+  };
+
+
   sops = {
     age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     secrets = {
@@ -347,6 +394,10 @@
       "borgbase_enc_key".sopsFile = ./secrets/borgbase_enc_key.yaml;
       "borgbase_ssh_key".sopsFile = ./secrets/borgbase_ssh_key.yaml;
       "gitea_mail_pw_hash".sopsFile = ./secrets/gitea_mail_pw_hash.yaml;
+      "inventree_admin_pw" = {
+        sopsFile = ./secrets/inventree_admin_pw.yaml;
+        owner = config.users.users.inventree.name;
+      };
       "miniflux_env".sopsFile = ./secrets/miniflux.yaml;
       "wg_preshared/nixy".sopsFile = ../common/secrets/wg_preshared.yaml;
       "wg_preshared/workstation".sopsFile = ../common/secrets/wg_preshared.yaml;

magpie/secrets/inventree_admin_pw.yaml

@@ -0,0 +1,25 @@
+inventree_admin_pw: ENC[AES256_GCM,data:HWjIhHhzLyBxvRdZm2VMANf49qu29n3A,iv:UGvzypdH6RFzBqNG3XRewlszCFhRciZAl1LLkBPtuzU=,tag:poBopBDDkfcLF2iM9z8DjQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvYytXMlgzTUtxcm5LcXJ3
+            VURETHIvRTlIaWx6eVhoRFlhdGl5UGRGYVNjClM4UzRKMFRnNzljK0t6emZOYXJt
+            RkJiYlBPNTRTaEgrMVVkb0xZWFlYRGsKLS0tIGxRZ2UyaDE2Ly9CVUF3Q1JMWGJV
+            eUNDZ0JsRUdUcHJqNTBNVkFjaGZnK3cKgy79yyoUOI34Ixdy2v0tG510LD300GoE
+            JgpJnem9BQiDJmu6+hrJJRKhVONrnZwkOj3GRz1TQX9fglo956rLPg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age153y8mz6gqy5t54q4fnrdvjj4v5ls9cgp3hhpd2hzf5tvkcnncf6q4xns0j
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhRVdwam1jaFYvTGpFeGpx
+            b0FMcVNoMDRKWldDUk9PZmdkQ1pEZUJzVWxNCnhmeis4RENCT1hYcVFYV0R5eGlD
+            WVg5R3RFR0VvZ1VrbW5qTVBSd0VwQUkKLS0tIDJUYURneDE2UFpvQzJ0alZPbit4
+            Q29UTFQvQVdRTUxFS3VsbXVuVUhMOTQKxPuwQc5w0sgJ1/pU1aOOZt7tZRO0mSAo
+            XqDN732B0N9vjIG/3bVg+EBpgP4+1OQ5z+06zg9lhyAq6DwS1GXQnA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s
+    lastmodified: "2026-06-16T20:36:07Z"
+    mac: ENC[AES256_GCM,data:4/psCipXWIN9PoGK/ueemgPKzgcFxaeQy4tXZ3nXCStvvBxisyF+l9tf4wM/F25CzPezPQtTex2jqFDreVnznO3ksX6T9PD7lssOqH0wM0PuhNzs8/93CPyJYaRr3OgtVGdu7k0SlGuWH1Dv8QNsEacCSLL3aaHNgFDwdA53Jng=,iv:+N2bk73kjZjHztDGB37dWZUVIw7UxGNK2Nd9vx5+0eA=,tag:KoYWRJ+LYCJK3oJVuJVcQA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1