feat: centralize PostgreSQL on glyph (#359)

* feat: centralize PostgreSQL on glyph

Move PostgreSQL from spore to glyph so all databases are on the host
with the best hardware (i7-13700K, NVMe, ZFS). This also fixes the
atticd SQLite connection pool timeout under concurrent CI pushes by
switching to PostgreSQL.

- Add PostgreSQL 16 on glyph with atticd and pocketid databases
- Switch atticd from SQLite to PostgreSQL
- Add databaseURL and localDatabase options to rc.web.auth module
- Configure pocket-id on spore to connect to glyph via Tailscale
- Disable PostgreSQL on spore
- Move database backups from spore to glyph

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: remove owner/group from attic-credentials secret

atticd uses DynamicUser so the atticd user doesn't exist during
activation when agenix decrypts secrets. Default to root:root —
systemd reads the EnvironmentFile as root before dropping privileges.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: use lib in spore backup module to satisfy statix and NixOS args

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: update Attic cache public key after PostgreSQL migration

The signing keypair was regenerated when the cache was recreated on
the new PostgreSQL backend.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: remove redundant postgresql dependency from atticd

The atticd NixOS module already detects local PostgreSQL from the
database URL (checks for /run/postgresql) and adds the systemd
after/requires dependencies automatically.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: remove unused db.nix and backup.nix from spore

PostgreSQL and database backups have moved to glyph. These files
were left as stubs and are no longer needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: stackptr

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
         github_access_token: ${{ secrets.GITHUB_TOKEN }}
         extra_nix_config: |
           extra-substituters = https://cache.zx.dev/main
-          extra-trusted-public-keys = main:sbkS1Xz6P4g66iyttRGj/o8aPODE6bVG9oKT98/ULKI=
+          extra-trusted-public-keys = main:mu0jkxdJTGWC3djDSEQb3rvZgqlhA8WVMulcTo5IW6c=
     - name: Configure Attic cache
       run: |
         nix profile install --inputs-from . attic#attic-client

flake.nix

@@ -122,7 +122,7 @@
             "https://cache.zx.dev/main"
           ];
           extra-trusted-public-keys = [
-            "main:sbkS1Xz6P4g66iyttRGj/o8aPODE6bVG9oKT98/ULKI="
+            "main:mu0jkxdJTGWC3djDSEQb3rvZgqlhA8WVMulcTo5IW6c="
           ];
         };
       };

hosts/glyph/services/attic.nix

@@ -1,10 +1,5 @@
 {config, ...}: {
-  age.secrets.attic-credentials = {
-    file = ./../secrets/attic-credentials.age;
-    mode = "440";
-    owner = "atticd";
-    group = "atticd";
-  };
+  age.secrets.attic-credentials.file = ./../secrets/attic-credentials.age;
 
   services.atticd = {
     enable = true;
@@ -13,7 +8,7 @@
     settings = {
       listen = "[::]:8199";
 
-      database.url = "sqlite:///var/lib/atticd/server.db?mode=rwc";
+      database.url = "postgresql:///atticd?host=/run/postgresql";
 
       storage = {
         type = "local";

hosts/spore/services/db.nix hosts/glyph/services/db.nixhosts/spore/services/db.nix renamed to hosts/glyph/services/db.nix

@@ -1,15 +1,9 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_16;
     enableTCPIP = true;
     authentication = pkgs.lib.mkOverride 10 ''
-      # Any user can connect to any database via Unix socket, local loopback,
-      # or Tailscale
       local  all   all                  trust
       host   all   all   127.0.0.1/32   trust
       host   all   all   100.64.0.0/10  trust
@@ -18,5 +12,21 @@
       port = 5432;
       max_connections = 150;
     };
+    ensureDatabases = ["atticd" "pocketid"];
+    ensureUsers = [
+      {
+        name = "atticd";
+        ensureDBOwnership = true;
+      }
+      {
+        name = "pocketid";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+
+  services.postgresqlBackup = {
+    enable = true;
+    databases = ["atticd" "pocketid"];
   };
 }

hosts/glyph/services/default.nix

@@ -5,6 +5,7 @@
 }: {
   imports = [
     ./attic.nix
+    ./db.nix
     ./avahi.nix
     ./dns.nix
     ./filebrowser.nix
@@ -85,7 +86,7 @@
   rc.backup = {
     enable = true;
     paths = [
-      "/var/lib/atticd/server.db"
+      config.services.postgresqlBackup.location
       "/var/lib/basic-memory"
       "/var/lib/open-webui"
       "/var/lib/roon-server/backup"

hosts/spore/backup.nix

@@ -9,7 +9,6 @@
     (modulesPath + "/installer/scan/not-detected.nix")
     (modulesPath + "/profiles/qemu-guest.nix")
     ./disk-config.nix
-    ./backup.nix
     ./services
   ];
 

hosts/spore/default.nix

@@ -4,7 +4,6 @@
   ...
 }: {
   imports = [
-    ./db.nix
     ./grafana.nix
     ./homepage-dashboard.nix
     ./mastodon.nix

hosts/spore/services/default.nix

@@ -48,7 +48,7 @@ in {
     configureNginx = true;
     database = {
       createLocally = false;
-      host = "127.0.0.1";
+      host = "glyph.rove-duck.ts.net";
       port = 5432;
       user = "mastodon";
       passwordFile = "/dev/null"; # Not needed
@@ -84,19 +84,7 @@ in {
     ];
   };
 
-  services.postgresql = lib.mkIf enable {
-    ensureUsers = [
-      {
-        name = "mastodon";
-        ensureDBOwnership = true;
-      }
-    ];
-    ensureDatabases = ["mastodon"];
-  };
-  services.postgresqlBackup = {
-    #inherit enable;
-    databases = ["mastodon"];
-  };
+  # Database managed on glyph when re-enabled
   services.redis.servers.mastodon = {
     inherit enable;
     port = 31637;

hosts/spore/services/mastodon.nix

@@ -22,6 +22,8 @@
       host = "id.zx.dev";
       useACMEHost = "zx.dev";
       encryptionKeyFile = config.age.secrets.pocket-id-encryption-key.path;
+      databaseURL = "postgres://pocketid@glyph.rove-duck.ts.net/pocketid";
+      localDatabase = false;
     };
     authProxy = {
       host = "oauth.zx.dev";