From 5025de400e24cdb8f36f0e340db0ad1df21430b4 Mon Sep 17 00:00:00 2001 From: Stefano Sciacovelli Date: Thu, 22 Oct 2026 21:26:47 +0200 Subject: [PATCH 1/2] flake.lock: nixpkgs to 2026-10-21 (PHP 8.4.27 fixes CVE-2026-109618 and CVE-2026-109619) The two PHP flaws known as PHP2Shell (remote code execution) are fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; nixos-26.05 carries them since 2026-10-21. Nextcloud runs on the module's PHP (pkgs.php, 8.4), so moving the nixpkgs input is the whole fix. Evaluated on the lab host: Nextcloud 33.0.9 to 33.0.10, PHP 8.4.27; `nix flake check --no-build` passes. Co-Authored-By: Claude Sonnet 5.5 --- nixos/flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nixos/flake.lock b/nixos/flake.lock index 3aa3854..2523ec3 100644 --- a/nixos/flake.lock +++ b/nixos/flake.lock @@ -77,11 +77,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1790635395, - "narHash": "sha256-bNyvoIyOCu7lzoCpWKWGIsHpTtERUWzqYWFPlN++WTw=", + "lastModified": 1792615934, + "narHash": "sha256-MlvRfa1O5Cqc2/a+gG+l9TSuowEoCKCmrJ1d9oAVm0I=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "7fc6f2c20af09cdcaf48b92ec3121860139ec668", + "rev": "da6dc0e7b26060f2f71ce3ef7088fb56ee44fa36", "type": "github" }, "original": { From e6d34bcfd7ae96f3cc026546bb6376ae9aaf04c1 Mon Sep 17 00:00:00 2001 From: Stefano Sciacovelli Date: Thu, 22 Oct 2026 21:55:49 +0200 Subject: [PATCH 2/2] v0 replica: Nextcloud 33.0.10, as v0 now runs after the PHP2Shell patch v0's Nextcloud was updated by hand to 33.0.10 (PHP 8.4.27) and the module is on the same version since the flake.lock bump, so the migration has no Nextcloud version step left. The rehearsal itself ran with 33.0.2 and is noted as such. Co-Authored-By: Claude Sonnet 5.5 --- docs/migration-from-v0.md | 4 ++-- lab/v0-replica/docker-compose.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/migration-from-v0.md b/docs/migration-from-v0.md index 2b6ea6f..1965faa 100644 --- a/docs/migration-from-v0.md +++ b/docs/migration-from-v0.md @@ -1,6 +1,6 @@ # Moving v0's data to tidepool -Rehearsed in the lab on **2026-10-05** against a replica of v0 (`lab/v0-replica/`: the same services in Docker, seeded through their own APIs), without touching the real machine. The driver is [lab/v0-migration-u25.sh](../lab/v0-migration-u25.sh); the result of the last run was **15 checks passed, 0 failed**. The replica runs v0's exact versions, read on the real machine on 2026-10-06 (Nextcloud 33.0.2, Immich 3.2.1, Jellyfin 12.1, Vaultwarden 1.37.1, Syncthing 2.0.14), so the rehearsal includes the version steps the real move makes: Nextcloud 33.0.2 to 33.0.9, Immich 3.2.1 to 3.2.4, Syncthing 2.0.14 to 2.1.3. +Rehearsed in the lab on **2026-10-05** against a replica of v0 (`lab/v0-replica/`: the same services in Docker, seeded through their own APIs), without touching the real machine. The driver is [lab/v0-migration-u25.sh](../lab/v0-migration-u25.sh); the result of the last run was **15 checks passed, 0 failed**. The replica runs v0's exact versions, read on the real machine on 2026-10-06 (Nextcloud 33.0.2, Immich 3.2.1, Jellyfin 12.1, Vaultwarden 1.37.1, Syncthing 2.0.14), so the rehearsal includes the version steps the real move makes: Nextcloud 33.0.2 to 33.0.9, Immich 3.2.1 to 3.2.4, Syncthing 2.0.14 to 2.1.3. *(Update 2026-10-22: the rehearsal ran with Nextcloud 33.0.2. After PHP2Shell (CVE-2026-109618, CVE-2026-109619) the owner updated v0's Nextcloud by hand to 33.0.10 on PHP 8.4.27, read on the real machine; the replica's pin now says so, and the rehearsal was not repeated.)* ## What the rehearsal proves, and what it does not @@ -36,7 +36,7 @@ Measured on the replica: Immich dump 3 s, Nextcloud conversion 18 s, everything ## Differences to check on the real machine -- **Nextcloud's patch step is rehearsed**: v0 is on 33.0.2 and the module on 33.0.9; the first start ran the upgrade (`occ upgrade`) without incident and everything verified. Nothing is left to check here except the real data's size. +- **Nextcloud's patch step is rehearsed**: v0 was on 33.0.2 and the module on 33.0.9; the first start ran the upgrade (`occ upgrade`) without incident and everything verified. v0 is now on 33.0.10 (hand update, 2026-10-22) and the module also on 33.0.10, so the real move has no version step for Nextcloud and `occ upgrade` finds nothing to do. Nothing is left to check here except the real data's size. - **Syncthing 2.0.14 to 2.1.3 is rehearsed** (the replica runs 2.0.14): the device ID and the folder list survive. What the real index database holds, and how long it takes to settle, depends on the real data. - **Jellyfin media**: v0 has two media trees, and the libraries point at their container paths (`/media`, `/media2`). Both go on the 16 TB disk, and `services.jellyfin.mediaMounts` maps each container path to its folder there (the private `host.nix`); the tree that was on the 2 TB disk is copied to the 16 TB disk **before the 2 TB disk is formatted** (runbook 1.1 and 1.2). - **Time Machine**: v0's partition is HFS+, which Linux cannot write when it is journaled; it is made ext4 and the Mac starts a fresh backup, **after the move has settled** (runbook 1.2), and the host declares neither the share nor its mount until then. diff --git a/lab/v0-replica/docker-compose.yml b/lab/v0-replica/docker-compose.yml index 442a065..332c9fb 100644 --- a/lab/v0-replica/docker-compose.yml +++ b/lab/v0-replica/docker-compose.yml @@ -53,7 +53,7 @@ services: restart: unless-stopped nextcloud: container_name: nextcloud - image: nextcloud:33.0.2-apache # v0's real version, read on the real machine on 2026-10-06 (a floating tag would drift) + image: nextcloud:33.0.10-apache # v0's real version, read on the real machine on 2026-10-22 after the PHP2Shell patch (PHP 8.4.27; v0 runs the floating tag 33-apache, which would drift) environment: [ "MYSQL_HOST=nextcloud-db", "MYSQL_DATABASE=nextcloud", "MYSQL_USER=nextcloud", "MYSQL_PASSWORD=v0ncpass", "REDIS_HOST=nextcloud-redis", "NEXTCLOUD_ADMIN_USER=admin", "NEXTCLOUD_ADMIN_PASSWORD=v0adminpass", "NEXTCLOUD_TRUSTED_DOMAINS=localhost cloud.v0.test", "OVERWRITEPROTOCOL=https", "TZ=Europe/Rome" ] volumes: [ "/srv/v0/data/nextcloud/html:/var/www/html", "/srv/v0/data/nextcloud/data:/var/www/html/data" ] ports: [ "127.0.0.1:8080:80" ]