cluster/services/monitoring: use new Prometheus Remote Write enablement flag

`flake.lock`: Update

cluster/services/consul/ready.nix

@@ -49,6 +49,7 @@ in
       DynamicUser = true;
       TimeoutStartSec = "5m";
       Type = "oneshot";
+      StartLimitBurst = 25;
     };
   };
 }

cluster/services/fbi/host.nix

@@ -30,6 +30,7 @@ with depot.lib.nginx;
     };
     sonarr = {
       enable = true;
+      package = depot.packages.sonarr5;
     };
     prowlarr = {
       enable = true;

cluster/services/matrix/bridges/discord.nix

@@ -1,22 +0,0 @@
-{ cluster, depot, ... }:
-let
-  inherit (depot.lib.meta) domain;
-in
-{
-  services.matrix-appservice-discord = {
-    enable = true;
-    environmentFile = cluster.config.services.matrix.secrets.discordAppServiceToken.path;
-    settings = {
-      bridge = {
-        inherit domain;
-        homeserverUrl = "https://matrix.${domain}:443";
-        disablePresence = false;
-        disableTypingNotifications = false;
-        disableDeletionForwarding = false;
-        enableSelfServiceBridging = true;
-        disableReadReceipts = false;
-        disableJoinLeaveNotifications = true;
-      };
-    };
-  };
-}

cluster/services/matrix/default.nix

@@ -10,7 +10,6 @@
       homeserver = [
         ./homeserver.nix
         ./coturn.nix
-        ./bridges/discord.nix
       ];
       static = [
         ./federation.nix

cluster/services/matrix/homeserver.nix

@@ -77,9 +77,6 @@ in {
       # HACK: upstream has a weird assertion that doesn't work with our HAProxy setup
       # this host gets overridden by dbConfigOut
       database = lib.recursiveUpdate dbConfig.database { args.host = "_patroni.local"; };
-      app_service_config_files =  [
-        "/etc/synapse/discord-registration.yaml"
-      ];
       turn_uris = let
         combinations = lib.cartesianProduct {
           proto = [ "udp" "tcp" ];
@@ -115,7 +112,7 @@ in {
     };
   };
   systemd.services = lib.mkMerge [
-    (lib.genAttrs [ "coturn" "matrix-appservice-discord" "matrix-synapse" ] (_: {
+    (lib.genAttrs [ "coturn" "matrix-synapse" ] (_: {
       serviceConfig = {
         Slice = "communications.slice";
       };

cluster/services/monitoring/server.nix

@@ -7,7 +7,7 @@ in
     enable = true;
     listenAddress = prometheus-ingest.ipv4;
     inherit (prometheus-ingest) port;
-    extraFlags = [ "--enable-feature=remote-write-receiver" ];
+    extraFlags = [ "--web.enable-remote-write-receiver" ];
     globalConfig = {
       scrape_interval = "60s";
     };

cluster/services/patroni/default.nix

@@ -14,7 +14,7 @@
   };
   services.patroni = {
     nodes = {
-      worker = [ "grail" "thunderskin" "VEGAS" ];
+      worker = [ "grail" "VEGAS" ];
       haproxy = [ "checkmate" "grail" "VEGAS" "prophet" ];
     };
     nixos = {

cluster/services/patroni/simulacrum/test.nix

@@ -1,8 +1,9 @@
-{ cluster, ... }:
+{ cluster, lib, ... }:
 
 let
   clusterName = "poseidon";
   link = cluster.config.links.patroni-pg-access;
+  expectedReplicas = (lib.length cluster.config.services.patroni.nodes.worker) - 1;
 in
 {
   defaults = { depot, pkgs, ... }: {
@@ -26,7 +27,7 @@ in
     def booted(nodes):
       return filter(lambda node: node.booted, nodes)
 
-    def wait_for_all_nodes_ready(expected_replicas=2):
+    def wait_for_all_nodes_ready(expected_replicas=${toString expectedReplicas}):
         booted_nodes = booted(nodes)
         for node in booted_nodes:
             node.wait_for_unit("patroni.service")
@@ -71,7 +72,7 @@ in
 
         for node in nodes:
             node.crash()
-            wait_for_all_nodes_ready(1)
+            wait_for_all_nodes_ready(${toString (expectedReplicas - 1)})
 
             # Execute some queries while a node is down.
             run_dummy_queries()
@@ -107,6 +108,8 @@ in
         clients[0].succeed(f"{setEnv} consul kv delete --recurse services/incandescence/providers/patroni/formulae/database/existingdb")
         clients[0].succeed(f"{setEnv} consul kv delete --recurse services/incandescence/providers/patroni/formulae/user/existinguser")
 
+        for client in clients:
+            node.systemctl("start locksmith.service")
         for node in nodes:
             node.systemctl("restart incandescence-patroni.target")
         clients[0].succeed("[[ $(psql -h ${link.ipv4} -p ${link.portStr} -U postgres --tuples-only --csv --command=\"SELECT pg_roles.rolname FROM pg_database JOIN pg_roles ON pg_database.datdba = pg_roles.oid WHERE pg_database.datname = 'existingdb'\") == existinguser ]]")

cluster/services/sso/host.nix

@@ -46,15 +46,5 @@ in
       http-relative-path = "/auth";
     };
   };
-  systemd.services.keycloak.environment = {
+  systemd.services.keycloak.serviceConfig.TimeoutStartSec = 300;
-    JAVA_OPTS = builtins.concatStringsSep " " [
-      "-javaagent:${depot.packages.opentelemetry-java-agent-bin}"
-      "-Dotel.resource.attributes=service.name=keycloak"
-      "-Dotel.traces.exporter=otlp"
-    ];
-    OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
-    OTEL_EXPORTER_OTLP_ENDPOINT = cluster.config.ways.ingest-traces-otlp.url;
-    OTEL_TRACES_SAMPLER = "parentbased_traceidratio";
-    OTEL_TRACES_SAMPLER_ARG = "0.50";
-  };
 }

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1723293904,
+        "lastModified": 1736955230,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
         "type": "github"
       },
       "original": {
@@ -39,11 +39,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730906442,
+        "lastModified": 1738524606,
-        "narHash": "sha256-tBuyb8jWBSHHgcIrOfiyQJZGY1IviMzH2V74t7gWfgI=",
+        "narHash": "sha256-hPYEJ4juK3ph7kbjbvv7PlU1D9pAkkhl+pwx8fZY53U=",
         "owner": "zhaofengli",
         "repo": "attic",
-        "rev": "d0b66cf897e4d55f03d341562c9821dc4e566e54",
+        "rev": "ff8a897d1f4408ebbf4d45fa9049c06b3e1e3f4e",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1728330715,
+        "lastModified": 1735644329,
-        "narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
+        "narHash": "sha256-tO3HrHriyLvipc4xr+Ewtdlo7wM1OjXNjlWRgmM7peY=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
+        "rev": "f7795ede5b02664b57035b3b757876703e2c3eac",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730504689,
+        "lastModified": 1738453229,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
         "type": "github"
       },
       "original": {
@@ -304,11 +304,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1723736589,
+        "lastModified": 1736919270,
-        "narHash": "sha256-/Vdg5ZKtP71ZEKVV6JXlrOEu0CM2Flcs+nwDmWRzgjQ=",
+        "narHash": "sha256-cGd3JaoHeN7g+qLrvvwR+1RbJ0oTJp3LiHDL3OlJJUg=",
         "owner": "hercules-ci",
         "repo": "hercules-ci-agent",
-        "rev": "c303cc8e437c0fd26b9452472e7df5aa374e9177",
+        "rev": "cae08186393d9736f2b3a5d30b2c7efe5569e337",
         "type": "github"
       },
       "original": {
@@ -327,11 +327,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730903510,
+        "lastModified": 1738237977,
-        "narHash": "sha256-mnynlrPeiW0nUQ8KGZHb3WyxAxA3Ye/BH8gMjdoKP6E=",
+        "narHash": "sha256-oJN/yvRL7G0WlR/hTkQIjFbPkzCV+sFnNB/38Tb9RL4=",
         "owner": "hercules-ci",
         "repo": "hercules-ci-effects",
-        "rev": "b89ac4d66d618b915b1f0a408e2775fe3821d141",
+        "rev": "6d1b6d5d59758b4f5f05745f774fc13cdc59da43",
         "type": "github"
       },
       "original": {
@@ -369,11 +369,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1721084841,
+        "lastModified": 1736693502,
-        "narHash": "sha256-zWajCfHFqPa3Z72DHcxBUq4bmcCu1lpEKUbZZewpYOE=",
+        "narHash": "sha256-v4pmfHApR11CNLVMko9uqDU3jYFYrNkEYB/5gLf7ubY=",
         "owner": "hyprspace",
         "repo": "hyprspace",
-        "rev": "b54fd70812b98994630cfa6aac17ad7c2be9b468",
+        "rev": "a5957e485ff0c2e9133e7da5408ec1273681688e",
         "type": "github"
       },
       "original": {
@@ -451,11 +451,11 @@
     },
     "nix-filter": {
       "locked": {
-        "lastModified": 1730207686,
+        "lastModified": 1731533336,
-        "narHash": "sha256-SCHiL+1f7q9TAnxpasriP6fMarWE5H43t25F5/9e28I=",
+        "narHash": "sha256-oRam5PS1vcrr5UPgALW0eo1m/5/pls27Z/pabHNy2Ms=",
         "owner": "numtide",
         "repo": "nix-filter",
-        "rev": "776e68c1d014c3adde193a18db9d738458cd2ba4",
+        "rev": "f7653272fd234696ae94229839a99b73c9ab7de0",
         "type": "github"
       },
       "original": {
@@ -500,11 +500,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731271232,
+        "lastModified": 1733338937,
-        "narHash": "sha256-HSNUAfhtG/A2hnrzPMT3asZZ2Wb3dAmedOr1VzptOCg=",
+        "narHash": "sha256-rciw6KIBxnH4utK+7B0bnhexz+hFJ53YE4xAPvPS/SE=",
-        "rev": "1eb19dd804a83d99c497118af8ab781eee569c65",
+        "rev": "09416ef0230295a5645532874a662a798e14087b",
         "type": "tarball",
-        "url": "https://forge.privatevoid.net/api/v1/repos/max/nix-super/archive/1eb19dd804a83d99c497118af8ab781eee569c65.tar.gz"
+        "url": "https://forge.privatevoid.net/api/v1/repos/max/nix-super/archive/09416ef0230295a5645532874a662a798e14087b.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -513,11 +513,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1719848872,
+        "lastModified": 1736798957,
-        "narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=",
+        "narHash": "sha256-qwpCtZhSsSNQtK4xYGzMiyEDhkNzOCz/Vfu4oL2ETsQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8",
+        "rev": "9abb87b552b7f55ac8916b6fc9e5cb486656a2f3",
         "type": "github"
       },
       "original": {
@@ -529,11 +529,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1714076141,
+        "lastModified": 1735834308,
-        "narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=",
+        "narHash": "sha256-dklw3AXr3OGO4/XT1Tu3Xz9n/we8GctZZ75ZWVqAVhk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856",
+        "rev": "6df24922a1400241dae323af55f30e4318a6ca65",
         "type": "github"
       },
       "original": {
@@ -561,11 +561,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1730785428,
+        "lastModified": 1738758495,
-        "narHash": "sha256-Zwl8YgTVJTEum+L+0zVAWvXAGbWAuXHax3KzuejaDyo=",
+        "narHash": "sha256-CZ8T4vP3ag2hwkpSZjatxJb55ouszvmnWw09qxGW9TU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4aa36568d413aca0ea84a1684d2d46f55dbabad7",
+        "rev": "ceaea203f3ae1787b1bd13f021f686391696fc5b",
         "type": "github"
       },
       "original": {
@@ -582,11 +582,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1726560853,
+        "lastModified": 1731533236,
-        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {

modules/nixpkgs-config/default.nix

@@ -1,9 +1,15 @@
-{ depot, lib, ... }:
+{ depot, lib, pkgs, ... }:
 
 {
   imports = [
     depot.inputs.nixpkgs.nixosModules.readOnlyPkgs
   ];
 
-  nixpkgs.overlays = lib.mkForce [];
+  options.nixpkgs.system = lib.mkOption {
+    type = lib.types.str;
+    default = pkgs.system;
+    readOnly = true;
+  };
+
+  config.nixpkgs.overlays = lib.mkForce [];
 }

packages/checks/s3ql-upgrade.nix

@@ -56,7 +56,6 @@ testers.runNixOSTest {
     machine.succeed("echo HelloWorld > /srv/test/hello/world.txt")
 
     with subtest("should upgrade"):
-      machine.succeed("systemctl stop remote-storage-test.service")
       machine.succeed("/run/current-system/specialisation/upgrade/bin/switch-to-configuration test")
       machine.wait_for_unit("remote-storage-test.service")
       machine.succeed("systemctl is-active remote-storage-test.service")

packages/patched-derivations.nix

@@ -2,6 +2,13 @@ let
   tools = import ./lib/tools.nix;
   pins = import ./sources;
 
+  acceptVulnerabilities = drv:
+    assert drv.meta ? knownVulnerabilities && builtins.length drv.meta.knownVulnerabilities > 0;
+    drv.overrideAttrs (old: {
+      meta = old.meta // {
+        knownVulnerabilities = [];
+      };
+    });
 in with tools;
 super: rec {
   acme-dns = patch super.acme-dns "patches/base/acme-dns";
@@ -19,7 +26,7 @@ super: rec {
   };
 
   jitsi-meet-insecure = let
-    olm-insecure = assert builtins.length super.olm.meta.knownVulnerabilities > 0; super.olm.overrideAttrs (o: { meta = o.meta // { knownVulnerabilities = []; }; });
+    olm-insecure = acceptVulnerabilities super.olm;
   in super.jitsi-meet.override { olm = olm-insecure; };
 
   jre17_standard = let
@@ -55,4 +62,26 @@ super: rec {
       super.python3Packages.systemd
     ];
   });
+
+  sonarr5 = let
+    version = "5.0.0.12";
+    src = super.fetchFromGitHub {
+      owner = "Sonarr";
+      repo = "Sonarr";
+      tag = "v${version}";
+      hash = "sha256-Pw+dvXNp0kQSwK+y3xZzcDivy45zgpqfZe1OUM8GOqY=";
+    };
+  in super.sonarr.override {
+    buildDotnetModule = args: super.buildDotnetModule (args // {
+      inherit version src;
+      nugetDeps = ./servers/sonarr/deps.json;
+      dotnet-sdk = super.dotnetCorePackages.sdk_8_0;
+      dotnet-runtime = super.dotnetCorePackages.aspnetcore_8_0;
+      dotnetFlags = map (builtins.replaceStrings ["net6.0" super.sonarr.version] ["net8.0" version]) args.dotnetFlags;
+    });
+    fetchYarnDeps = args: super.fetchYarnDeps (args // {
+      yarnLock = "${src}/yarn.lock";
+      hash = "sha256-ckaU3me5fGcOhK0m8BzMWaXc+zPpYyu+GhUHLts9edY=";
+    });
+  };
 }

packages/sources/sources.json

@@ -9,10 +9,10 @@
       },
       "pre_releases": false,
       "version_upper_bound": null,
-      "version": "v3.2.0",
+      "version": "v4.2.3",
-      "revision": "9ecb233763048c730d24ddacecc8c002d3c8fc89",
+      "revision": "a142630ff970e47303fb0aeff0f7cad6f6fbdaf3",
-      "url": "https://api.github.com/repos/cinnyapp/cinny/tarball/v3.2.0",
+      "url": "https://api.github.com/repos/cinnyapp/cinny/tarball/v4.2.3",
-      "hash": "17ndz0x5zws2y533c3wa80mhk0k5n1d4il9agv04aglpd75vn1n0"
+      "hash": "1dh1kxfkl69l6dmwria60s37qnbip4yz29n3l5jfw4lz218i1186"
     },
     "excalidraw": {
       "type": "Git",
@@ -22,9 +22,9 @@
         "repo": "excalidraw"
       },
       "branch": "master",
-      "revision": "04668d8263b35bf76f1390b25abeeed4181820f6",
+      "revision": "302664e500c7f2ee44a1f107d8f4680c0254305b",
-      "url": "https://github.com/excalidraw/excalidraw/archive/04668d8263b35bf76f1390b25abeeed4181820f6.tar.gz",
+      "url": "https://github.com/excalidraw/excalidraw/archive/302664e500c7f2ee44a1f107d8f4680c0254305b.tar.gz",
-      "hash": "10vxvyzx5nw2f0ykw3ng5lh2hiy6nrgpdqiypmcq9caxi6qn7h11"
+      "hash": "02a9jy73lqgmb8h2zcs37h932gzxg7ky2pvb65wd7kcqrcybpp6n"
     },
     "searxng": {
       "type": "Git",
@@ -34,9 +34,9 @@
         "repo": "searxng"
       },
       "branch": "master",
-      "revision": "39aaac40d63d53555b7fc12d56f0825c85ecf567",
+      "revision": "6324a9752a2b21a1dcb709c7fb643e361189163e",
-      "url": "https://github.com/searxng/searxng/archive/39aaac40d63d53555b7fc12d56f0825c85ecf567.tar.gz",
+      "url": "https://github.com/searxng/searxng/archive/6324a9752a2b21a1dcb709c7fb643e361189163e.tar.gz",
-      "hash": "0bhlh28n7p36v1q67xqmzxz6icm7kqgqxiyz806swfzykp9hfzxg"
+      "hash": "0b2wy613mds5xl5pqizrb8ncbhk1m8xcbnnsycqks1vypyvr00q4"
     },
     "stevenblack-hosts": {
       "type": "GitRelease",
@@ -47,10 +47,10 @@
       },
       "pre_releases": false,
       "version_upper_bound": null,
-      "version": "3.14.82",
+      "version": "3.15.15",
-      "revision": "73ef1823bb9b76d6cbde5d349e82eed0d5dcb4cb",
+      "revision": "a39424667f67c4f9836126fefa2fb25fe83839b6",
-      "url": "https://api.github.com/repos/StevenBlack/hosts/tarball/3.14.82",
+      "url": "https://api.github.com/repos/StevenBlack/hosts/tarball/3.15.15",
-      "hash": "1f3d1m27xph8canm7ll0c2fbh6gzf4pfqmrbhix1fg2hxz1pwbqm"
+      "hash": "0kpha475jsw8fbq2z1mn4m94a6a5skgmkia0q6w8sh8lba30y9y3"
     }
   },
   "version": 2

packages/system-filter.nix

@@ -5,6 +5,7 @@
     keycloak = [ "x86_64-linux" ];
     prometheus-jitsi-exporter = [ "aarch64-linux" ];
     searxng = [ "x86_64-linux" ];
+    sonarr5 = [ "x86_64-linux" ];
     tempo = [ "x86_64-linux" ];
   };
 }

packages/web-apps/cinny/default.nix

@@ -11,7 +11,7 @@ let
     src = fetchzip {
       name = "cinny-tarball-${version}";
       url = "https://github.com/${repo.owner}/${repo.repo}/releases/download/${cinny.version}/cinny-${cinny.version}.tar.gz";
-      sha256 = "sha256-4mOMVwwoR8NJVD7kikXAEN3kUAoH5hYHz0md0LYX7bo=";
+      sha256 = "sha256-T2XKSR59lZoazTN0boQhBOYZTac/a+K1OZrgeKwsbvU=";
     };
 
     buildCommand = ''

packages/web-apps/excalidraw/default.nix

@@ -27,7 +27,7 @@ let
     offlineCache = fetchYarnDeps {
       name = "excalidraw-yarn-cache-${builtins.hashString "sha256" (builtins.readFile "${excalidraw}/yarn.lock")}";
       yarnLock = src + "/yarn.lock";
-      hash = "sha256-iEk6yh+2sQkm/oucAGj16x/SpKc1WqXYtYTos82R0bQ=";
+      hash = "sha256-SthMtDZtGGTVRYYRHIPUbQe8ixZ9XSFMAl35MMN4JHY=";
     };
 
     configurePhase = ''

packages/web-apps/searxng/default.nix

@@ -50,6 +50,9 @@ toPythonModule (buildPythonApplication rec {
     fasttext-predict
     pybind11
     pytomlpp
+    msgspec
+    typer
+    isodate
     (callPackage ./deps/chompjs.nix {})
   ];
 

patches/base/kanidm/unixd-authenticated.patch

@@ -1,5 +1,5 @@
 diff --git a/unix_integration/resolver/src/idprovider/kanidm.rs b/unix_integration/resolver/src/idprovider/kanidm.rs
-index 63cedb4d5..35c45fb0e 100644
+index d0a6a8159..7ebc0449d 100644
 --- a/unix_integration/resolver/src/idprovider/kanidm.rs
 +++ b/unix_integration/resolver/src/idprovider/kanidm.rs
 @@ -7,6 +7,7 @@ use kanidm_proto::internal::OperationError;
@@ -10,7 +10,7 @@ index 63cedb4d5..35c45fb0e 100644
  use tokio::sync::{broadcast, Mutex};
  
  use kanidm_lib_crypto::CryptoPolicy;
-@@ -38,6 +39,8 @@ struct KanidmProviderInternal {
+@@ -39,6 +40,8 @@ struct KanidmProviderInternal {
      hmac_key: HmacKey,
      crypto_policy: CryptoPolicy,
      pam_allow_groups: BTreeSet<String>,
@@ -19,7 +19,7 @@ index 63cedb4d5..35c45fb0e 100644
  }
  
  pub struct KanidmProvider {
-@@ -102,6 +105,19 @@ impl KanidmProvider {
+@@ -103,6 +106,19 @@ impl KanidmProvider {
              .map(|GroupMap { local, with }| (local, Id::Name(with)))
              .collect();
  
@@ -39,7 +39,7 @@ index 63cedb4d5..35c45fb0e 100644
          Ok(KanidmProvider {
              inner: Mutex::new(KanidmProviderInternal {
                  state: CacheState::OfflineNextCheck(now),
-@@ -109,6 +125,8 @@ impl KanidmProvider {
+@@ -110,6 +126,8 @@ impl KanidmProvider {
                  hmac_key,
                  crypto_policy,
                  pam_allow_groups,
@@ -48,10 +48,10 @@ index 63cedb4d5..35c45fb0e 100644
              }),
              map_group,
          })
-@@ -256,7 +274,11 @@ impl KanidmProviderInternal {
+@@ -262,7 +280,11 @@ impl KanidmProviderInternal {
-     }
+         let mut max_attempts = 3;
- 
+         while max_attempts > 0 {
-     async fn attempt_online(&mut self, _tpm: &mut tpm::BoxedDynTpm, now: SystemTime) -> bool {
+             max_attempts -= 1;
 -            match self.client.auth_anonymous().await {
 +            let auth_method = match (&self.auth_name, &self.auth_password) {
 +                (Some(name), Some(password)) => self.client.auth_simple_password(name, password).await,
@@ -59,5 +59,5 @@ index 63cedb4d5..35c45fb0e 100644
 +            };
 +            match auth_method {
                  Ok(_uat) => {
+                     debug!("provider is now online");
                      self.state = CacheState::Online;
-                 true