Revert "try store mounted read-only"

This reverts commit 586be6f309.

.woodpecker/cd.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: push
@@ -7,16 +9,12 @@ steps:
   - name: build
     image: nixos/nix
     commands:
-      - whoami
-      - pwd
-      - ls
-      - env
       - |
         mkdir -p ~/.ssh
         echo "$CD_SSH_KEY" > ~/.ssh/id_ed25519
         ls -l ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
-      - bash -c "nix-shell -p strace --run 'strace -f -o ssh-agent.log ssh-agent -s'"
+      - nix-shell -p strace --run 'strace -f -o ssh-agent.log ssh-agent -s'
       - cat ssh-agent.log
       - |
         eval "$(ssh-agent -s)"

.woodpecker/check-data-model.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: pull_request

.woodpecker/check-deployment-basic.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: pull_request

.woodpecker/check-deployment-cli.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: pull_request

.woodpecker/check-deployment-panel.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: pull_request

.woodpecker/check-mastodon.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: pull_request

.woodpecker/check-panel.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: pull_request

.woodpecker/check-peertube.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: pull_request

.woodpecker/check-pre-commit.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: pull_request

.woodpecker/check-resources.yaml

@@ -1,3 +1,5 @@
+$schema: https://raw.githubusercontent.com/woodpecker-ci/woodpecker/refs/heads/main/pipeline/frontend/yaml/linter/schema/schema.json
+
 when:
   - event: manual
   - event: push

machines/dev/fedi203/woodpecker.nix

@@ -111,7 +111,7 @@
           WOODPECKER_SERVER=localhost:9000
           WOODPECKER_USERNAME=x-oauth-basic
           WOODPECKER_HOSTNAME=https://woodpecker.fediversity.eu
-          WOODPECKER_MAX_WORKFLOWS=4
+          WOODPECKER_MAX_WORKFLOWS=5
           WOODPECKER_LOG_LEVEL=info
           WOODPECKER_DEBUG_PRETTY=false
           WOODPECKER_DEBUG_NOCOLOR=true
@@ -202,19 +202,21 @@
   };
 
   networking = {
-    nftables.enable = lib.mkForce false;
     firewall = {
+      enable = lib.mkForce true;
       allowedTCPPorts = [
         22
         80
         443
       ];
       # needed for podman to be able to talk over dns
-      interfaces."podman0" = {
+      interfaces."podman+" = {
         allowedUDPPorts = [ 53 ];
         allowedTCPPorts = [ 53 ];
       };
     };
+    # helps make sure DNS resolves from the containers
+    nftables.enable = lib.mkForce false;
   };
 
   virtualisation.podman = {
@@ -223,6 +225,10 @@
       enable = true;
       dates = "weekly";
     };
+    defaultNetwork.settings = {
+      dns_enabled = true;
+      ipv6_enabled = true;
+    };
   };
 
   systemd.services = {