modules/prometheus: run alertmanager as a static user

nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only
exists while the service is running. The matrix-alertmanager-urlfile
secret is owned by that user; at boot sops-install-secrets cannot resolve
it and rejects the whole manifest, leaving /run/secrets empty (no ssh
host key, yggdrasil key, tor key, ...). Deploys masked it because the
dynamic user was resolvable via nss-systemd at switch time.

Create a static alertmanager user/group and disable DynamicUser.

flake.lock

@@ -151,11 +151,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1792664877,
+        "lastModified": 1792819087,
-        "narHash": "sha256-yl7J8TPJ9GCG0T5KreuquOpyP2yzBHHaK/IlkO8x8z0=",
+        "narHash": "sha256-1bxllGymY+u3NvEX4FHMZyE4l9y0nRpvk/qLaPkwAjg=",
         "ref": "refs/heads/main",
-        "rev": "a566329bbcf0f915c4e6f42c2aee0354e1cd2c12",
+        "rev": "94862153f6e63016151d7c527f9e7bb3e96b0598",
-        "revCount": 15401,
+        "revCount": 15417,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -249,11 +249,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789770686,
+        "lastModified": 1792526520,
-        "narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
+        "narHash": "sha256-3hSJlv8mUVnZPMWK2+CM7a9O+nR6Z4mCh27NfLCmTPc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
+        "rev": "cedd626e11b635470fa6f9fdb8ad79b0075dd7f9",
         "type": "github"
       },
       "original": {
@@ -419,11 +419,11 @@
         "std": "std"
       },
       "locked": {
-        "lastModified": 1787631179,
+        "lastModified": 1789106589,
-        "narHash": "sha256-l+Zt5XNTD0f0ChkzDJURfQlFAgANIMrGYrk51SZEJKU=",
+        "narHash": "sha256-RMQdAvDaa4eUcdePDqUGAhnyTtzKxc6a8abauy8bzb0=",
         "owner": "kurogeek",
         "repo": "frappix",
-        "rev": "fcb797886ae753b26a6e4415a7f2c19ba6adcf3b",
+        "rev": "dbfa76d84df6354bd7528c9d0c407387f66c3e33",
         "type": "github"
       },
       "original": {
@@ -689,11 +689,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1792366139,
+        "lastModified": 1792737899,
-        "narHash": "sha256-jto4pdsl0bgErQ5vaMc3gOyj//PILLRJuqX3I7fUk6s=",
+        "narHash": "sha256-P0/GhewcEQmAbzq3QunNWY2jLJaYH9F6c/5dEM/jQ4M=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "f0ec2b3fae4df92ea7788359aef9e07bb88d720f",
+        "rev": "bb0b90dbd54e207100de72b5dcbe3188c98a4b69",
         "type": "github"
       },
       "original": {
@@ -890,16 +890,16 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1792506237,
+        "lastModified": 1792773339,
-        "narHash": "sha256-Q/8KLB6jNfpaUN1HAedE/u/Et9feE/zYSsutBLKrCFk=",
+        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5adc50831c259f87faeb09ddf930d43597197473",
+        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -1014,11 +1014,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1792056300,
+        "lastModified": 1792809984,
-        "narHash": "sha256-YU1LjDe1o2Ymg5zEiCHbmMXLkDCtxHQRiVqZ3nC5GGk=",
+        "narHash": "sha256-KV+CaZX7QS0hcdKxwGKehDb1jmUgx6lbkTPpaoIW5Nw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "44931708c62937c2b1bf7953902989fa5bb9ee1b",
+        "rev": "442449fa7b1fe6c692d0103ac9fc8f9e82931cf3",
         "type": "github"
       },
       "original": {

flake.nix

@@ -31,7 +31,7 @@
       inputs.home-manager.follows = "home-manager";
     };
     import-tree.url = "github:vic/import-tree";
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -100,7 +100,6 @@
               inherit system;
               overlays = [
                 inputs.self.overlays.packagesOverlay
-                inputs.self.overlays.phpPr576853Overlay # TEMPORARY, see overlays/nixpkgs-pr-576853-php.nix
               ];
               config = { };
             };

machines/bosona/configuration.nix

@@ -17,6 +17,8 @@ in
     inputs.self.overlays.frappixLibsOverlay
     inputs.self.overlays.frappixPythonOverlay
     inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
   ];
 
   clan.core.vars.generators.frappix = {

machines/canopus/configuration.nix

@@ -17,6 +17,8 @@ in
     inputs.self.overlays.frappixLibsOverlay
     inputs.self.overlays.frappixPythonOverlay
     inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
   ];
 
   clan.core.vars.generators.frappix = {

machines/deneb/configuration.nix

@@ -26,6 +26,8 @@ in
     inputs.self.overlays.frappixPythonOverlay
     inputs.self.overlays.frappixToolsOverlay
     inputs.self.overlays.frappixAppsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
   ];
 
   fonts.packages = [ pkgs.tlwg ];

machines/ramus/think-greater-chiangmai.nix

@@ -56,7 +56,6 @@ in
   ];
   nixpkgs.overlays = [
     self.overlays.packagesOverlay
-    self.overlays.phpPr576853Overlay # TEMPORARY, see overlays/nixpkgs-pr-576853-php.nix
   ];
 
   clan.core.vars.generators.greaterchiangmai = {

machines/tangra/configuration.nix

@@ -1,4 +1,4 @@
-{ self, ... }:
+{ ... }:
 {
   system.stateVersion = "25.11";
   nixpkgs.hostPlatform = {
@@ -30,7 +30,4 @@
   security.acme.acceptTerms = true;
 
   imports = [ ];
-
-  # TEMPORARY: wordpress php-fpm pools use pkgs.php; see overlays/nixpkgs-pr-576853-php.nix
-  nixpkgs.overlays = [ self.overlays.phpPr576853Overlay ];
 }

modules/clan/prometheus/default.nix

@@ -256,6 +256,21 @@
                 ];
               };
 
+              # nixpkgs runs alertmanager with DynamicUser; that user only exists
+              # while the service runs, so sops-install-secrets cannot resolve the
+              # owner of matrix-alertmanager-urlfile at boot and rejects the whole
+              # manifest (no secrets installed). Use a static user instead.
+              users.users.alertmanager = {
+                isSystemUser = true;
+                group = "alertmanager";
+              };
+              users.groups.alertmanager = { };
+              systemd.services.alertmanager.serviceConfig = {
+                DynamicUser = lib.mkForce false;
+                User = "alertmanager";
+                Group = "alertmanager";
+              };
+
               services.matrix-alertmanager = lib.mkIf settings.matrix-alertmanager.enable {
                 enable = true;
                 tokenFile = config.clan.core.vars.generators.prometheus.files.matrix-alertmanager-token.path;

overlays/default.nix

@@ -2,13 +2,15 @@
 {
   flake.overlays = {
     packagesOverlay = import ../pkgs/overlay.nix;
-    # TEMPORARY: drop with the file once NixOS/nixpkgs#576853 reaches nixpkgs-unstable.
+    # TEMPORARY: drop with the file once NixOS/nixpkgs#578265 reaches nixos-unstable.
-    phpPr576853Overlay = import ./nixpkgs-pr-576853-php.nix;
+    posthogPr578265Overlay = import ./nixpkgs-pr-578265-posthog.nix;
 
     frappixFrappeOverlay = inputs.frappix.frappeOverlay.x86_64-linux;
     frappixLibsOverlay = inputs.frappix.libsOverlay.x86_64-linux;
     frappixPythonOverlay = inputs.frappix.pythonOverlay.x86_64-linux;
     frappixToolsOverlay = inputs.frappix.toolsOverlay.x86_64-linux;
     frappixAppsOverlay = import ../pkgs/frappix/overlay.nix;
+    # Must be applied after frappixPythonOverlay (overrides packages from it).
+    frappixFixupsOverlay = import ./frappix-fixups.nix;
   };
 }

overlays/frappix-fixups.nix

@@ -0,0 +1,34 @@
+# Fixups for frappix's python overlay on current nixos-unstable. Everything
+# here belongs upstream in kurogeek/frappix; drop entries as they land.
+# Must be applied after frappixPythonOverlay.
+_final: prev:
+let
+  inherit (prev) lib;
+in
+{
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyFinal: pyPrev: {
+      # frappe >= v15.120 needs sqlparse 0.6 (db_query.py touches
+      # sqlparse.engine.grouping.MAX_GROUPING_TOKENS), but every sql_metadata
+      # 2.x release pins sqlparse<0.6; the sqlglot-based 3.x needs sqlglot >= 30,
+      # which nixpkgs does not ship yet. Relaxing the pin is safe for frappe: its
+      # two call sites (desk/reportview.py, core/doctype/recorder/db_optimizer.py)
+      # only parse SELECT statements, and the only sql_metadata test regressions
+      # on sqlparse 0.6 are `CREATE TABLE IF NOT EXISTS` name extraction (2/150).
+      sql_metadata =
+        if lib.versionAtLeast pyPrev.sql_metadata.version "3" then
+          lib.warn "frappix ships sql_metadata ${pyPrev.sql_metadata.version} (no sqlparse dependency): drop the sql_metadata entry from overlays/frappix-fixups.nix" pyPrev.sql_metadata
+        else
+          pyPrev.sql_metadata.overridePythonAttrs (old: {
+            pythonRelaxDeps = (old.pythonRelaxDeps or [ ]) ++ [ "sqlparse" ];
+          });
+
+      # rq 1.16.2 (frappix's rq_1 pin): test_parse_connection compares redis
+      # connection kwargs against a literal; redis-py 8.1 (current nixpkgs) adds
+      # `himport_registry`, so the assertion fails. Test-only.
+      rq_1 = pyPrev.rq_1.overridePythonAttrs (old: {
+        disabledTests = old.disabledTests ++ [ "test_parse_connection" ];
+      });
+    })
+  ];
+}

overlays/nixpkgs-pr-576853-php.nix

@@ -1,59 +0,0 @@
-# TEMPORARY backport of NixOS/nixpkgs#576853
-# (php 8.3.36 / 8.4.27 / 8.5.12; fixes CVE-2026-109618, CVE-2026-109619).
-# Merged to master 2026-10-21, not yet on nixpkgs-unstable.
-# Track: https://track.nix.ee/?pr=576853
-#
-# Remove once `nix flake update` pulls it in: delete this file and every
-# reference to it (grep 576853). The overlay becomes a no-op and warns at eval
-# time as soon as the locked nixpkgs ships these versions or newer.
-final: prev:
-let
-  inherit (prev) lib;
-
-  updates = {
-    php83 = {
-      version = "8.3.36";
-      hash = "sha256-RvS0XjaI7SsYGQFae1MsFbUcwFW907E/0A3f7r7tzV8=";
-    };
-    php84 = {
-      version = "8.4.27";
-      hash = "sha256-slMKh3xyL0sIyeF0owywi6wrfhkD7m6eMV8KqfX4LCQ=";
-    };
-    php85 = {
-      version = "8.5.12";
-      hash = "sha256-/7YO3EN87WO1E35JhNs3moERxQBJxxFRDYuVgnfvwag=";
-    };
-  };
-
-  # php-packages.nix hunk of the PR: the new releases' filter OOM tests only
-  # pass when the freshly built module is loaded explicitly.
-  packageOverrides = _: phpPrev: {
-    extensions = phpPrev.extensions // {
-      filter = phpPrev.extensions.filter.override {
-        postConfigure = ''
-          substituteInPlace \
-            tests/oom_filter_input.phpt \
-            tests/oom_filter_input_array.phpt \
-            tests/oom_filter_default_encoded.phpt \
-            --replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so',"
-        '';
-      };
-    };
-  };
-
-  bump =
-    name:
-    { version, hash }:
-    if lib.versionAtLeast prev.${name}.version version then
-      lib.warn
-        "nixpkgs ships ${name} ${prev.${name}.version} (>= ${version}): NixOS/nixpkgs#576853 has landed, remove overlays/nixpkgs-pr-576853-php.nix"
-        prev.${name}
-    else
-      # `.override` on a php buildEnv rebuilds the interpreter with the new
-      # args, but the extension scope (php-packages) keeps the closure's
-      # original `packageOverrides`. Only `overrideAttrs` re-enters
-      # generic.nix with the overridden args and rebuilds that scope, so a
-      # no-op `overrideAttrs` is what makes `packageOverrides` take effect.
-      (prev.${name}.override { inherit version hash packageOverrides; }).overrideAttrs (_: { });
-in
-lib.mapAttrs bump updates

overlays/nixpkgs-pr-578265-posthog.nix

@@ -0,0 +1,33 @@
+# TEMPORARY workaround for NixOS/nixpkgs#578265 (python3Packages.posthog: unbreak).
+# nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked posthog broken; the only
+# failure is one test in posthog's optional MCP integration (field rename in
+# mcp 2). posthog is a runtime dependency of frappe, so frappix machines fail
+# to evaluate without this.
+#
+# Remove once `nix flake update` pulls the PR in: delete this file and every
+# reference to it (grep 578265). The overlay becomes a no-op and warns at eval
+# time as soon as the locked nixpkgs no longer marks posthog broken.
+_final: prev:
+let
+  inherit (prev) lib;
+in
+{
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyFinal: pyPrev: {
+      posthog =
+        if !pyPrev.posthog.meta.broken then
+          lib.warn "nixpkgs no longer marks posthog broken: NixOS/nixpkgs#578265 has landed, remove overlays/nixpkgs-pr-578265-posthog.nix" pyPrev.posthog
+        else
+          pyPrev.posthog.overridePythonAttrs (old: {
+            disabledTests = old.disabledTests ++ [
+              # AttributeError: 'CallToolResult' object has no attribute 'structuredContent'
+              # (mcp>=2 renamed the field to `structured_content`)
+              "test_prepare_tool_result_delivers_into_call_tool_result_models"
+            ];
+            meta = old.meta // {
+              broken = false;
+            };
+          });
+    })
+  ];
+}

pkgs/gtcm-file-uploader.nix

@@ -7,14 +7,14 @@
 let
   repoSrc = fetchgit {
     url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "895092dea1da99ca1fa3c5c6d805384e579d417e";
+    rev = "fdb71d61c7786b1a0f3fa595d2eb68e3438a55b1";
-    hash = "sha256-ffbwQVQ1lL8XpubsGX6FTbJOjz1mbqCn+AKvR7xJhRw=";
+    hash = "sha256-oR1DHYO7YXHGWPEdewtPuHnIlQ+c3BuKI7B3QNMDCx4=";
   };
   src = "${repoSrc}/upload-large-file";
 in
 buildNpmPackage {
   pname = "gtcm-file-uploader";
-  version = "1.1.2";
+  version = "1.1.4";
 
   nativeBuildInputs = with pkgs; [
     nodejs

pkgs/think-backend-gtcm.nix

@@ -6,14 +6,14 @@
 let
   repoSrc = fetchgit {
     url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "895092dea1da99ca1fa3c5c6d805384e579d417e";
+    rev = "fdb71d61c7786b1a0f3fa595d2eb68e3438a55b1";
-    hash = "sha256-ffbwQVQ1lL8XpubsGX6FTbJOjz1mbqCn+AKvR7xJhRw=";
+    hash = "sha256-oR1DHYO7YXHGWPEdewtPuHnIlQ+c3BuKI7B3QNMDCx4=";
   };
   src = "${repoSrc}/think-backend.greaterchiangmai.com";
 in
 php.buildComposerProject2 (finalAttrs: {
   pname = "think-backend-gtcm";
-  version = "1.1.2";
+  version = "1.1.4";
 
   inherit src;
 
@@ -32,5 +32,5 @@ php.buildComposerProject2 (finalAttrs: {
   '';
 
   composerStrictValidation = false;
-  vendorHash = "sha256-1cY33xOF0f1qWkZKtJSjOYReb9vLQRnLZuF+GdVA7xU=";
+  vendorHash = "sha256-9PLtZ6b83PHC6jA4Bso7H4qMg1h6HKZ3EbK4uwI4hj4=";
 })

pkgs/think-gtcm.nix

@@ -6,14 +6,14 @@
 let
   repoSrc = fetchgit {
     url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "895092dea1da99ca1fa3c5c6d805384e579d417e";
+    rev = "fdb71d61c7786b1a0f3fa595d2eb68e3438a55b1";
-    hash = "sha256-ffbwQVQ1lL8XpubsGX6FTbJOjz1mbqCn+AKvR7xJhRw=";
+    hash = "sha256-oR1DHYO7YXHGWPEdewtPuHnIlQ+c3BuKI7B3QNMDCx4=";
   };
   src = "${repoSrc}/think.greaterchiangmai.com";
 in
 php.buildComposerProject2 (finalAttrs: {
   pname = "think-gtcm";
-  version = "1.1.2";
+  version = "1.1.4";
 
   inherit src;
 
@@ -32,5 +32,5 @@ php.buildComposerProject2 (finalAttrs: {
   '';
 
   composerStrictValidation = false;
-  vendorHash = "sha256-rEE1C4uYNoVq5wiCooNnjj6uIQmSel7u9khAlM3hopk=";
+  vendorHash = "sha256-1+2nyXiOr9Lonp0xZQ10ahLRI3VOrvItj+IPt8KnopQ=";
 })

shell.nix

@@ -4,12 +4,14 @@
     inputs.devshell.flakeModule
   ];
   perSystem =
-    { system, ... }:
+    { pkgs, system, ... }:
     {
       devshells.default = {
         devshell = {
           packages = [
-            inputs.clan-core.packages.${system}.clan-cli
+            # clan-core pins `nixVersions.nix_2_31` for a CI perf A/B test;
+            # nixos-unstable has dropped that attribute. Use nixpkgs' default nix.
+            (inputs.clan-core.packages.${system}.clan-cli.override { nix = pkgs.nix; })
           ];
         };
       };