Remove dead config: Zammad remnants, typo3's Authelia block, orphaned gitea.nix #287

New issue

Closed

opened 2026-08-07 22:25:02 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-07 22:25:02 +02:00

Owner

1. Zammad remnants

The service is gone and hosts/fw/vms/web/default.nix no longer imports its vhost, so what remains is orphaned:

Delete hosts/fw/vms/web/zammad.nix. Imported by nothing. Its services.zammad, its auth_request block against Authelia's removed /api/verify endpoint, its sops.secrets.zammad-key-base declaration and its services.postgresqlBackup.databases = [ "zammad" ] are all inert.
Remove "/var/lib/zammad" from the environment.persistence."/persist-local" list at hosts/fw/vms/web/default.nix:114.

2. typo3's dead Authelia block

hosts/web-arm/modules/web/typo3.nix:196-209 — a location /authelia block that is internal;, has no auth_request consumer anywhere in the file, and proxies to /api/verify, an endpoint Authelia removed in 4.38. Already recorded as dead in ADR-0022.

Delete the block. Take care: unlike the other two this sits inside a live vhost, so leave the rest of it exactly as-is.

3. `hosts/fw/modules/gitea.nix`

Delete the file. Nothing imports it — hosts/fw/configuration.nix:57 imports ./modules/forgejo.nix only. It still carries WHITELISTED_URIS = "auth.cloonar.com" and a full services.gitea block, which makes it actively misleading when grepping for remaining Authelia references.

Do not touch the ADRs

docs/adr/0005-read-only-diag-channel-for-agents.md mentions /var/lib/zammad in its diag-wrapper denylist, and ADR-0022 references zammad.nix:79. Leave both alone. ADRs record decisions as they were made; editing them to erase a service that existed at the time falsifies the record. ADR-0005's own 2026-06-28 amendment already removed that wrapper anyway.

Human steps (secrets and host state)

Per CLAUDE.md the agent does not touch secrets files. After the PR merges:

hosts/fw/vms/web/secrets.yaml: remove zammad-key-base. Safe once the PR lands, since the only Nix reference goes with zammad.nix.
hosts/web-arm/secrets.yaml: remove zammad-db-password and zammad-key-base. Both are already referenced by no Nix on any host — orphaned entries.
On web-02: drop the zammad PostgreSQL database and delete /persist-local/var/lib/zammad, which is still occupying disk.

Out of scope

claude-mcp-forgejo / mcp-forgejo.cloonar.com — pending a scope decision; it reaches further than expected (the vhost on web-02, the Authelia client, DNS in ddclient.nix and dnsmasq.nix, and the forgejo-mcp server on both dev and dev-new).
Retiring Authelia (M6) — including authelia.nix, its LDAP grants in openldap.nix, and the stale …/oauth2/authelia/callback redirect URI on the gitea client.

Verification

scripts/pre-commit dry-builds the affected hosts (fw, web-arm).

Human, after deploy:

The typo3 site still serves normally — that is the only change touching a live vhost.
lab.cloonar.com still reachable from LAN/VPN (unrelated, but web-02's nginx config changes if the persistence edit triggers a rebuild).
git grep -i authelia -- '*.nix' returns only hosts/web-arm/modules/authelia.nix, its import, the openldap grants, the gitea client's stale redirect URI, and the mcp-forgejo file — i.e. exactly the M6 worklist and nothing else.

Step 3 is the point of this issue: it makes the remaining Authelia surface legible before the retirement in a month.

Part of #266. Remove three pieces of dead configuration left behind by the Authelia→Keycloak migration and the Zammad retirement. All three are already unreferenced; none can affect a running service. ## 1. Zammad remnants The service is gone and `hosts/fw/vms/web/default.nix` no longer imports its vhost, so what remains is orphaned: - **Delete `hosts/fw/vms/web/zammad.nix`.** Imported by nothing. Its `services.zammad`, its `auth_request` block against Authelia's removed `/api/verify` endpoint, its `sops.secrets.zammad-key-base` declaration and its `services.postgresqlBackup.databases = [ "zammad" ]` are all inert. - **Remove `"/var/lib/zammad"`** from the `environment.persistence."/persist-local"` list at `hosts/fw/vms/web/default.nix:114`. ## 2. typo3's dead Authelia block `hosts/web-arm/modules/web/typo3.nix:196-209` — a `location /authelia` block that is `internal;`, has **no `auth_request` consumer anywhere in the file**, and proxies to `/api/verify`, an endpoint Authelia removed in 4.38. Already recorded as dead in ADR-0022. Delete the block. Take care: unlike the other two this sits inside a **live vhost**, so leave the rest of it exactly as-is. ## 3. `hosts/fw/modules/gitea.nix` Delete the file. Nothing imports it — `hosts/fw/configuration.nix:57` imports `./modules/forgejo.nix` only. It still carries `WHITELISTED_URIS = "auth.cloonar.com"` and a full `services.gitea` block, which makes it actively misleading when grepping for remaining Authelia references. ## Do not touch the ADRs `docs/adr/0005-read-only-diag-channel-for-agents.md` mentions `/var/lib/zammad` in its diag-wrapper denylist, and ADR-0022 references `zammad.nix:79`. **Leave both alone.** ADRs record decisions as they were made; editing them to erase a service that existed at the time falsifies the record. ADR-0005's own 2026-06-28 amendment already removed that wrapper anyway. ## Human steps (secrets and host state) Per CLAUDE.md the agent does not touch secrets files. After the PR merges: - `hosts/fw/vms/web/secrets.yaml`: remove `zammad-key-base`. Safe once the PR lands, since the only Nix reference goes with `zammad.nix`. - `hosts/web-arm/secrets.yaml`: remove `zammad-db-password` and `zammad-key-base`. Both are **already** referenced by no Nix on any host — orphaned entries. - On web-02: drop the `zammad` PostgreSQL database and delete `/persist-local/var/lib/zammad`, which is still occupying disk. ## Out of scope - **`claude-mcp-forgejo` / `mcp-forgejo.cloonar.com`** — pending a scope decision; it reaches further than expected (the vhost on web-02, the Authelia client, DNS in `ddclient.nix` and `dnsmasq.nix`, and the `forgejo-mcp` *server* on both `dev` and `dev-new`). - **Retiring Authelia (M6)** — including `authelia.nix`, its LDAP grants in `openldap.nix`, and the stale `…/oauth2/authelia/callback` redirect URI on the gitea client. ## Verification - `scripts/pre-commit` dry-builds the affected hosts (`fw`, `web-arm`). Human, after deploy: 1. The typo3 site still serves normally — that is the only change touching a live vhost. 2. `lab.cloonar.com` still reachable from LAN/VPN (unrelated, but web-02's nginx config changes if the persistence edit triggers a rebuild). 3. `git grep -i authelia -- '*.nix'` returns only `hosts/web-arm/modules/authelia.nix`, its import, the openldap grants, the gitea client's stale redirect URI, and the mcp-forgejo file — i.e. exactly the M6 worklist and nothing else. Step 3 is the point of this issue: it makes the remaining Authelia surface legible before the retirement in a month.

dominik.polakovics added the

ready-for-agent

label

2026-08-07 22:25:02 +02:00

dominik.polakovics referenced this issue from a pull request that will close it,

2026-08-07 22:40:52 +02:00

chore: remove dead Zammad, gitea and typo3 Authelia config #289

dominik.polakovics closed this issue

2026-08-07 22:56:53 +02:00