From 37c67710b78f6639f7d4686f865e77dade90bfb3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 4 Aug 2025 14:41:27 +0200
Subject: [PATCH 1/3] discourse: 3.4.4 -> 3.4.6

https://meta.discourse.org/t/3-4-5-security-fixes-release/369347
https://meta.discourse.org/t/3-4-6-security-fix-release/370631

Fixes: CVE-2025-48877, CVE-2025-48062, CVE-2025-48053, CVE-2025-49845
---
 pkgs/servers/web-apps/discourse/default.nix          | 4 ++--
 pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index e8186c8b7716..5c3e8b6c1dbc 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -46,13 +46,13 @@
 }@args:
 
 let
-  version = "3.4.4";
+  version = "3.4.6";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-rA42fOhSJVrNPcFSB2+On7JVeZch8t2yNo+36UK+QcA=";
+    sha256 = "sha256-HS13jNhSrPo7CHAk2zZEKSt54lBTw1PdMCIJUO0rjLc=";
   };
 
   ruby = ruby_3_3;
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index 92f647c7d9de..c05f581c03f3 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -745,4 +745,4 @@ DEPENDENCIES
   zeitwerk
 
 BUNDLED WITH
-   2.6.6
+   2.6.9

From 7db4feef657a4a6686417d4868e96921886cfedc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 4 Aug 2025 15:19:07 +0200
Subject: [PATCH 2/3] nixos/discourse: fix postgres dependency

This was broken during the postgresql.target migration in 41c5662cbec9.
---
 nixos/modules/services/web-apps/discourse.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix
index 7a5123392ee8..a5b74025318c 100644
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -733,14 +733,14 @@ in
       after = [
         "redis-discourse.service"
         "postgresql.target"
-        "discourse-postgresql.target"
+        "discourse-postgresql.service"
       ];
       bindsTo = [
         "redis-discourse.service"
       ]
       ++ lib.optionals (cfg.database.host == null) [
         "postgresql.target"
-        "discourse-postgresql.target"
+        "discourse-postgresql.service"
       ];
       path = cfg.package.runtimeDeps ++ [
         postgresqlPackage

From a4cadd9cfa69ce0cf0473b4ba76a671d483304c2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 4 Aug 2025 15:23:50 +0200
Subject: [PATCH 3/3] discourse: fix passthru nixos test

---
 nixos/tests/all-tests.nix                   |  9 ++++++++-
 nixos/tests/discourse.nix                   |  6 ++----
 pkgs/servers/web-apps/discourse/default.nix | 14 +++++++-------
 3 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 76867b74b49d..2784afd2ee87 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -422,7 +422,14 @@ in
   dex-oidc = runTest ./dex-oidc.nix;
   dhparams = runTest ./dhparams.nix;
   disable-installer-tools = runTest ./disable-installer-tools.nix;
-  discourse = runTest ./discourse.nix;
+  discourse = runTest {
+    imports = [ ./discourse.nix ];
+    _module.args.package = pkgs.discourse;
+  };
+  discourseAllPlugins = runTest {
+    imports = [ ./discourse.nix ];
+    _module.args.package = pkgs.discourseAllPlugins;
+  };
   dnscrypt-proxy2 = runTestOn [ "x86_64-linux" ] ./dnscrypt-proxy2.nix;
   dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };
   doas = runTest ./doas.nix;
diff --git a/nixos/tests/discourse.nix b/nixos/tests/discourse.nix
index e76d0a3862ba..e4b15cd10076 100644
--- a/nixos/tests/discourse.nix
+++ b/nixos/tests/discourse.nix
@@ -4,9 +4,9 @@
 #  3. replying to that message via email.
 
 {
+  lib,
   package,
   pkgs,
-  lib,
   ...
 }:
 let
@@ -26,8 +26,6 @@ in
   name = "discourse";
   meta.maintainers = with lib.maintainers; [ talyz ];
 
-  _module.args.package = lib.mkDefault pkgs.discourse;
-
   nodes.discourse =
     { nodes, ... }:
     {
@@ -62,7 +60,7 @@ in
 
       services.discourse = {
         enable = true;
-        inherit admin;
+        inherit admin package;
         hostname = discourseDomain;
         sslCertificate = "${certs.${discourseDomain}.cert}";
         sslCertificateKey = "${certs.${discourseDomain}.key}";
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 5c3e8b6c1dbc..0a103f914ba9 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -8,9 +8,9 @@
   fetchFromGitHub,
   bundlerEnv,
   callPackage,
+  nixosTests,
 
   ruby_3_3,
-  replace,
   gzip,
   gnutar,
   git,
@@ -43,7 +43,7 @@
   uglify-js,
 
   plugins ? [ ],
-}@args:
+}:
 
 let
   version = "3.4.6";
@@ -433,13 +433,13 @@ let
       enabledPlugins = plugins;
       plugins = callPackage ./plugins/all-plugins.nix { inherit mkDiscoursePlugin; };
       ruby = rubyEnv.wrappedRuby;
-      tests = import ../../../../nixos/tests/discourse.nix {
-        inherit (stdenv) system;
-        inherit pkgs;
-        package = pkgs.discourse.override args;
+      tests = {
+        inherit (nixosTests)
+          discourse
+          discourseAllPlugins
+          ;
       };
     };
-
     meta = with lib; {
       homepage = "https://www.discourse.org/";
       platforms = platforms.linux;