n/zorigami: add matrix (dendrite) server instance for automata.of-a.cat

+ a side dish of `nix fmt` inconsistencies

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1715290355,
-        "narHash": "sha256-2T7CHTqBXJJ3ZC6R/4TXTcKoXWHcvubKNj9SfomURnw=",
+        "lastModified": 1716561646,
+        "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "8d37c5bdeade12b6479c85acd133063ab53187a0",
+        "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
         "type": "github"
       },
       "original": {
@@ -337,11 +337,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715930644,
-        "narHash": "sha256-W9pyM3/vePxrffHtzlJI6lDS3seANQ+Nqp+i58O46LI=",
+        "lastModified": 1716930911,
+        "narHash": "sha256-t4HT5j3Jy7skRB5PINnxcEBCkgE89rGBpwTI7YS4Ffo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e3ad5108f54177e6520535768ddbf1e6af54b59d",
+        "rev": "a9b36cbe9292a649222b89fdb9ae9907e9c74086",
         "type": "github"
       },
       "original": {
@@ -373,11 +373,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715922002,
-        "narHash": "sha256-FSUrne82MXFzZ7R88ZnJz21kv06GS2TS/Ctsd+RXbP4=",
+        "lastModified": 1716618639,
+        "narHash": "sha256-H3kcJDVqDmXZ9IfVtqObL3JUx/a0ERn6gWBTn+7vwN4=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "23a55d6bb80f6340d0acdb9feef754646b68f895",
+        "rev": "a358c56a163b3b7d149571e853a8f75b2c1ceb38",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1713369831,
-        "narHash": "sha256-G4OGxvlIIjphpkxcRAkf1QInYsAeqbfNh6Yl1JLy2uM=",
+        "lastModified": 1716805126,
+        "narHash": "sha256-yqJWx74e16Gk4pwW5DWfI4orTKeWezKFNbW7eaojpLw=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "850f27322239f8cfa56b122cc9a278ab99a49015",
+        "rev": "2eb19b872bc0a5f336b9b934ba96ea029e4da8c2",
         "type": "github"
       },
       "original": {
@@ -441,11 +441,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715885250,
-        "narHash": "sha256-IUFYAl3158Ig5vySnRBHoPReb2/S97bjodCo6FhzJv4=",
+        "lastModified": 1716856858,
+        "narHash": "sha256-dfNGs2AW/V31nMVeEBSUJCMfT6bZAKJ5qsWgFHWhvUc=",
         "ref": "refs/heads/main",
-        "rev": "53d713eb486f21d653af3ef3528e9a19ecfc45e5",
-        "revCount": 81,
+        "rev": "38f31ee7c1a60adae58833789dd855c128b056c6",
+        "revCount": 85,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/nixos-module"
       },
@@ -463,11 +463,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1715787097,
-        "narHash": "sha256-TPp2j0ttvBvkk4oXidvo8Y071zEab0BtcNsC3ZEkluI=",
+        "lastModified": 1716754174,
+        "narHash": "sha256-L2Vni6dGDFWXWwY0rqkQWtZXt+qYQKUZr+Fj+EpI97Q=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "fa673bf8656fe6f28253b83971a36999bc9995d2",
+        "rev": "fa4262c3c9197e7d62185858907f2e5acff3258d",
         "type": "github"
       },
       "original": {
@@ -544,11 +544,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715483403,
-        "narHash": "sha256-WMDuQj7J5jbpXI/X/E6FZRKgBFGcaSTvYyVxPnKE6KU=",
+        "lastModified": 1716772633,
+        "narHash": "sha256-Idcye44UW+EgjbjCoklf2IDF+XrehV6CVYvxR1omst4=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "f9027322f48b427da23746aa359a6510dfcd0228",
+        "rev": "ff80cb4a11bb87f3ce8459be6f16a25ac86eb2ac",
         "type": "github"
       },
       "original": {
@@ -559,11 +559,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1715881912,
-        "narHash": "sha256-e4LJk5uV1wvrRkffGFZekPWvFUx29NnnOahBlLaq8Ek=",
+        "lastModified": 1716987116,
+        "narHash": "sha256-uuEkErFVsFdg2K0cKbNQ9JlFSAm/xYqPr4rbPLI91Y8=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "ff1be1e3cdf884df0935ab28745ab13c3c26d828",
+        "rev": "8251761f93d6f5b91cee45ac09edb6e382641009",
         "type": "github"
       },
       "original": {
@@ -654,11 +654,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1715848674,
-        "narHash": "sha256-IPocDyAA1eMxek8uD+sxR7moO238OLc8iRsSZlAndag=",
+        "lastModified": 1716991893,
+        "narHash": "sha256-Eoyi4cFspfDadhSs4d0eSsLkL9kZYiM2Tg17bFSm750=",
         "owner": "arachnist",
         "repo": "nixpkgs",
-        "rev": "7c8de45891a2e815da83e8f312654c76fbb9b2c0",
+        "rev": "7869e74e5aa899302d2d36b23b62550c6a29c54c",
         "type": "github"
       },
       "original": {

nixos/scylla/default.nix

@@ -452,6 +452,11 @@ in {
 
   security.polkit.enable = true;
   virtualisation.libvirtd.enable = true;
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+  };
 
   services.avahi = {
     enable = true;

nixos/zorigami/default.nix

@@ -63,6 +63,12 @@
     mode = "440";
     file = ../../secrets/synapseExtraConfig.age;
   };
+  age.secrets.acmeZorigamiZajebaLi.file =
+    ../../secrets/acme-zorigami-zajeba.li.age;
+  age.secrets.automataDendritePrivateKey.file =
+    ../../secrets/automata.of-a.cat-matrix_key.pem.age;
+  age.secrets.automataDendriteEnv.file =
+    ../../secrets/automata.of-a.cat-matrix_env.age;
 
   nibylandia.monitoring-server = { domain = "monitoring.is-a.cat"; };
 
@@ -198,7 +204,7 @@
   };
 
   services.postgresql.ensureDatabases =
-    [ "nextcloud" "matrix-synapse" "mastodon" ];
+    [ "nextcloud" "matrix-synapse" "mastodon" "dendrite" ];
   services.postgresql.ensureUsers = [
     {
       name = "nextcloud";
@@ -212,6 +218,10 @@
       name = "mastodon";
       ensureDBOwnership = true;
     }
+    {
+      name = "dendrite";
+      ensureDBOwnership = true;
+    }
   ];
 
   systemd.services."nextcloud-setup" = {
@@ -260,6 +270,48 @@
   };
   services.dovecot2.sieve.extensions = [ "fileinto" ];
 
+  # automata.of-a.cat
+  services.dendrite = {
+    enable = true;
+    httpPort = 8108;
+    loadCredential = [
+      "matrix-server-key:${config.age.secrets.automataDendritePrivateKey.path}"
+    ];
+    environmentFile = config.age.secrets.automataDendriteEnv.path;
+
+    settings = let
+      database_config = {
+        connection_string = "postgresql:///dendrite?host=/run/postgresql";
+        max_open_conns = 10;
+        max_idle_conns = 5;
+      };
+    in {
+      global = {
+        server_name = "automata.of-a.cat";
+        private_key = "$CREDENTIALS_DIRECTORY/matrix-server-key";
+        jetstream.storage_path = "/var/lib/dendrite/";
+      };
+
+      client_api = {
+        registration_disabled = true;
+        rate_limiting.enabled = false;
+        registration_shared_secret = ''''${REGISTRATION_SHARED_SECRET}'';
+      };
+
+      app_service_api.database = database_config;
+      federation_api.database = database_config;
+      key_server.database = database_config;
+      media_api.database = database_config;
+      mscs.database = database_config;
+      room_server.database = database_config;
+      sync_api.database = database_config;
+      user_api.account_database = database_config;
+      user_api.device_database = database_config;
+      relay_api.device_database = database_config;
+    };
+  };
+
+  # is-a.cat
   services.matrix-synapse = {
     enable = true;
     settings = {
@@ -349,36 +401,52 @@
 
   systemd.network.wait-online.enable = false;
   networking.useDHCP = false;
-  networking.interfaces.enp36s0f1.useDHCP = false;
-  networking.interfaces.enp38s0.useDHCP = false;
-  networking.interfaces.enp39s0.useDHCP = false;
-  networking.interfaces.enp42s0f3u5u3c2.useDHCP = false;
   networking.tempAddresses = "disabled";
-  networking.interfaces.enp36s0f0 = {
-    useDHCP = false;
-    ipv4 = {
-      addresses = [{
-        address = "185.236.240.137";
-        prefixLength = 31;
-      }];
-      routes = [{
-        address = "0.0.0.0";
-        prefixLength = 0;
-        via = "185.236.240.136";
+  networking.interfaces = {
+    enp38s0.useDHCP = false;
+    enp42s0f3u5u3c2.useDHCP = false;
+    enp36s0f0 = {
+      useDHCP = false;
+      ipv4 = {
+        addresses = [{
+          address = "185.236.240.137";
+          prefixLength = 31;
+        }];
+        routes = [{
+          address = "0.0.0.0";
+          prefixLength = 0;
+          via = "185.236.240.136";
+        }];
+      };
+      ipv6 = {
+        addresses = [{
+          address = "2a0d:eb00:8007::10";
+          prefixLength = 64;
+        }];
+        routes = [{
+          address = "::";
+          prefixLength = 0;
+          via = "2a0d:eb00:8007::1";
+        }];
+      };
+    };
+    # funky crossconnects
+    enp36s0f1 = {
+      useDHCP = false;
+      ipv4.addresses = [{
+        address = "10.21.37.1";
+        prefixLength = 27;
       }];
     };
-    ipv6 = {
-      addresses = [{
-        address = "2a0d:eb00:8007::10";
-        prefixLength = 64;
-      }];
-      routes = [{
-        address = "::";
-        prefixLength = 0;
-        via = "2a0d:eb00:8007::1";
+    enp39s0 = {
+      useDHCP = false;
+      ipv4.addresses = [{
+        address = "10.21.37.33";
+        prefixLength = 27;
       }];
     };
   };
+
   networking.nameservers = [
     "8.8.8.8"
     "8.8.4.4"
@@ -420,6 +488,30 @@
     };
   };
 
+  services.kea.dhcp4 = {
+    enable = true;
+    settings = {
+      interfaces-config = {
+        interfaces = [ "enp36s0f1/10.21.37.1" "enp39s0/10.21.37.33" ];
+      };
+
+      subnet4 = [
+        {
+          subnet = "10.21.37.0/27";
+          pools = [{ pool = "10.21.37.5 - 10.21.37.25"; }];
+          reservations-out-of-pool = true;
+          reservations-in-subnet = true;
+        }
+        {
+          subnet = "10.21.37.32/27";
+          pools = [{ pool = "10.21.37.37 - 10.21.37.57"; }];
+          reservations-out-of-pool = true;
+          reservations-in-subnet = true;
+        }
+      ];
+    };
+  };
+
   services.nginx.virtualHosts = {
     "s.nork.club" = {
       forceSSL = true;
@@ -499,6 +591,30 @@
         };
       };
     };
+    ${config.services.dendrite.settings.global.server_name} = {
+      enableACME = true;
+      forceSSL = true;
+      locations = {
+        "/.well-known/matrix/server".return = ''
+          200 "{\"m.server\":\"matrix.${config.services.dendrite.settings.global.server_name}:443\",\"m.homeserver\":{\"base_url\":\"https://matrix.${config.services.dendrite.settings.global.server_name}\"}}"
+        '';
+        "/.well-known/matrix/client".return = ''
+          200 "{\"m.homeserver\":{\"base_url\":\"https://matrix.${config.services.dendrite.settings.global.server_name}\"}}"
+        '';
+      };
+    };
+    "matrix.${config.services.dendrite.settings.global.server_name}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations = {
+        "/_matrix".proxyPass =
+          "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
+        "/_dendrite".proxyPass =
+          "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
+        "/_synapse".proxyPass =
+          "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
+      };
+    };
     "rower.zajeba.li" = {
       enableACME = true;
       forceSSL = true;
@@ -506,6 +622,23 @@
         return = "301 https://pl.wikipedia.org/wiki/Praga-Po%C5%82udnie";
       };
     };
+    "wildcard.zajeba.li" = {
+      enableACME = true;
+      forceSSL = true;
+
+      serverAliases = [ "~^(.*).zajeba.li$" ];
+      root = "/srv/www/wildcard_zajeba.li/$1";
+    };
+  };
+  security.acme.certs."wildcard.zajeba.li" = {
+    extraDomainNames = lib.mkForce [ ];
+    domain = "*.zajeba.li";
+    dnsProvider = "cloudflare";
+    webroot = lib.mkForce null;
+    credentialFiles = {
+      CLOUDFLARE_DNS_API_TOKEN_FILE =
+        config.age.secrets.acmeZorigamiZajebaLi.path;
+    };
   };
 
   services.oidentd.enable = true;
@@ -539,7 +672,7 @@
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEFHcfS3YKXUX4N8cD2IEF3GxHvb+IlynSSudDF1/e3U domi@kita"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPkJRQYGIVC//ofxYrIxF3nP3D8gTDSSSMyEzG6JVQii domi@sakamoto"
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDVJ307BmZvIkQMxFIGe3nTYOL/Qo0AeaEPmxUFG+vSASPdTaSM4PHYh6WgJIRNsKcZHCF9gCFniY0TCrC3chBJRsRxTonCZteiib3/rpn0c+jFMtfi+SId56/BhQP8S3LAw7EpciQ7U5qmwYc5f5hhhXnEFhT2SoxxA45eIBwZjTo0aE1SC1M5buzVW+VnPuV2+PYE8wQjSYUnUChrJOgZeCapbIvfz8Ml7ppX1LmFLCeLHyZHJpzhoz+6Ios7FbkuhuaCTjMU+MqmSzM4MBDRThI13e/lWsExGDh1BlSTB4FawUCvd90Z0KBp671UsA0SXzzB4UQujVSNO/yDwLYvldlV3mXkLAsB0pdmRfGFAD0C4gxe8yG5jM6FxBYV4ZLEAvKRLROr4SaWJ4OXh7cplnr78zQit0r3erqusf28xYnOvF0zTvCMvPPFBVBGqolYPPFUleClZ1HaoTnM36NDAdyO5P9/4og5y/FfRDajql3HhBNA8MV+8FN/leJ2Hfk= domi@hakase"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIImhJ+2pw5c1Tzx/g+S04on5bUXhwzloqRaiXti5UC7A domi@zork"
     ];
   };
 }

overlays/nibylandia.nix

@@ -13,8 +13,9 @@ in {
     '') emoji-reactions.files;
     tl-replacer = super.callPackage ../pkgs/glitch-soc/tl-replacer { };
   in self.callPackage ../pkgs/glitch-soc {
-    srcPostPatch = ''${file-post-patch}
-      ${tl-replacer}/tl-replacer ${tl-replacer}/tl-replacer.yaml
+    srcPostPatch = ''
+      ${file-post-patch}
+            ${tl-replacer}/tl-replacer ${tl-replacer}/tl-replacer.yaml
     '';
     inherit (emoji-reactions) patches;
   };

pkgs/glitch-soc/emoji.nix

@@ -1,110 +1,135 @@
 # autogenerated file
-{fetchpatch, fetchurl}: {
+{ fetchpatch, fetchurl }: {
   patches = [
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/227a8d71b3b1f475c29f864e3572ee37ed24b139.patch";
-      hash = "sha256-0uCMtrOyLjXw9OxFLFjP5geQa2XJaNUPAwfaiFbomdM=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/4dc414453dfecd6b9a45ceccdace92812814212b.patch";
+      hash = "sha256-i0zXqVW43ZQuCrGNxgVSf5/OV4AdeJDykTIgo9FHLeA=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/14c0e46ef42f853dc26e385723bd30a26d3c6aca.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/b1f2ef4f95eb1dc982561514cf96a6b4913d9083.patch";
       hash = "sha256-mPTn1tSFX16H3qw6tTMoY8ZEpSFw0WwMoAlwdMdN5o8=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/28ecb2a4bebc080fba4aebfd611f502220fd2bd1.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/b63636b0a68efb1d228d2e2d095ac3856c7e4972.patch";
       hash = "sha256-W54/zXblx89YfWqkkeHYpYArDPzI63S+XgPw5kbtVIQ=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/938175d5e856e54f4469f746a019955ecd16a47b.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/c6ef1a902cddaab21987fae31a80321794a10573.patch";
       hash = "sha256-ShXE7LykbImUByMjpKpMrB+mvjV9Y+txwNWBQwlHYX0=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/22fc82dfeedda84b251b136a2175e5e3e9ab0e44.patch";
-      hash = "sha256-oZx8NOdXqEOZImaTmubFQGXPlJQkgquLofOpKaEo7Gg=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/638ea3bf2df621a43b58df03453a1015c4fab139.patch";
+      hash = "sha256-EYNjYGTtpvMA2rX959RjD7buPeC2zRYXcqO92jUszss=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/03ea7618ad2f885a027c4c9a73eaf71510ebc622.patch";
-      hash = "sha256-d9G3JijFI5gKBDfHX5RE766+v3e0GUBT6blmRxtAB/s=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/e60b2ef24541ef626f24da577bd1ccbb29d015ce.patch";
+      hash = "sha256-HpYr5hSVw39kCQd6RUUAgZvbDpZ77lwmKXhuQ6//UGk=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/4d832522b9e566a6e59778490ec50bc3ea2d2fd2.patch";
-      hash = "sha256-XaV5ibRFQgReLKlTGLzA1hN8Z4EBEQhF/2GtWSFAuu0=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/323a50c9a9a4867d2bb0003929f241c6bd102ae4.patch";
+      hash = "sha256-Q8gQwOlakdulWBKT4RQ8HLq8MUuw2gBum3mHygsu1OE=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/a27b8387419b8229451b048a646f2799305b76a6.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/3150cd5ebaa7b2106e74284b9bd0ebb72a881e7f.patch";
       hash = "sha256-//d36ZolRH5Z9/2tBGWAUjlbIbaXb2MQGrDUVrlPHGI=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/0838432237260d207adf57ec3f76ea8745ae7dc9.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/0fa071703cdd29387b02b7585ea7708907a0b47f.patch";
       hash = "sha256-F73oi+m6905u9N/iE+0kG8a/raSPW7znDeoNSjzrWJc=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/09b64d761a6f2559eb6ed34a5e5c628894b87189.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/7691ac0053b51df419014cd84e2c5646e70b71e0.patch";
       hash = "sha256-WgWtfn2UJXUz1elSPlM6PfIOG9xRgP0KVOtJ/35tY44=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/11bebd28a2f7942b1c18b40122f1fc93813daaa0.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/a624ba5621d5c26715954592cb76ab26dc4a30d4.patch";
       hash = "sha256-Vj2vaxJf6Fyuew4yTZ8T8rH7sVmey3zkmlYX++L4DzQ=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/a2ab3f541cbc2ab73fd32da1864fc889e0e0513e.patch";
-      hash = "sha256-BZPpWyRRSkVPVygyNYrdX115Bj6usVR4gIzsbG0zgRs=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/b9723c99cf7397b124c207367208e571f0a56972.patch";
+      hash = "sha256-QWrAHRSAUG5swVxV19Y1yg5tupnEafHzJf6j7se95A8=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/4311fff076c79335fd2a76b4abfe4f43e03a84ab.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/16b08f1d6bcc9ffd1e3316a11dc8c2def1926245.patch";
       hash = "sha256-zWDnO/KLpl0aBaxS2DTt0W7WCeR29gU4N//5gZvJcwg=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/0d68ecf75dec23d23f1ad063d3200f9b2f6158c3.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/49e3973158dcb33257a12dd15d86b685b8435728.patch";
       hash = "sha256-ygSdBo/9UKp9LAHNvpjvqcRF5uFpRWaqOH86gLnxYwU=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/d54affc10782bec9965ad4d913f66bc0aab91ac5.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/bec0e6dd37df9799edb14b4d8d0e63692b66cf31.patch";
       hash = "sha256-haFsOBTGWWbhEvbWWVf9Sawdw/CCUa3ZVRCz3AHNlF4=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/a12b2ad57af11c8be5eb1a2fbd776d5da209bbfa.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/23f608619f1c8392dae995982c7595972147a9c8.patch";
       hash = "sha256-+oUPXiHicgK1/r1lovl4IH6jZ7rDUWwBuVCDywzCPCk=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/aae6e1b1fd5073ffdb6e6cdcbdbe9bae01808f84.patch";
-      hash = "sha256-4IdH4YHyBfzbb+sdtn/EB9l+7zOl9QDzh/qdA15wFoQ=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/3c66a42d0ad7f3416c8c130cf90364ac3acbb86d.patch";
+      hash = "sha256-N4yijNnCfeBb8CVsVK8L/ncRyWcvDZD9gkHaUMR1WaA=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/b07f5f89d4411e71e0a616ccffebb2140452e728.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/d37eb7f3eb4c38d00c8c4040bbba764036fb8019.patch";
       hash = "sha256-SUOgcCBXlfsyMHKYvkkvgiOkW1uzLruI+jy5uf9f5kA=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/ba37843ec23cca1e537d462374f479371c4115fb.patch";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/21e5b2ac22cff0b84549cb357b73186cc33a4872.patch";
       hash = "sha256-mweLZ82np2r/kbbDJscwOomHgruULHxxlu9zhR51PNQ=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/13c9fa62fa1d07a89c34a96352e9e05f464e2e81.patch";
-      hash = "sha256-TrDCWaBVAwPi5umG0FcQVdONTl2LtJ1oWi/rwgz3Y3U=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/89273da276cd987c01d0be3c4a0d598497167fd6.patch";
+      hash = "sha256-6aLwW6uJu1dXHenCnpta3nta6vZ+ZWH5pxhMGM0nLr8=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/40ae5aed66ac0dd2dfc70c5111d439db6b8e988e.patch";
-      hash = "sha256-33l5CWQ5TSzXtBMJs68nmyya0l96WTCW/ZxRwCkbswM=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/af4cbbbc185c432c6a18c1efb84222e48c44356c.patch";
+      hash = "sha256-zBWsmMawNT1/1Kh4uZ7RpbIL03Gri7wsRMec/EYb/3Q=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/9b54b27bf76b155e9866a0deb52d26df35a1e101.patch";
-      hash = "sha256-HIU/DuRJPRi+nQL3hWSHN6PQAoXDL0CPV91IoArhpOE=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/277428127e505120acbe3299d41b27c68fe78c83.patch";
+      hash = "sha256-srvagWbsqZQbOtk2Wfyk5LoBhoqeW0fSZXgDm0q6UEg=";
     })
     (fetchpatch {
-      url = "https://github.com/glitch-soc/mastodon/pull/2462/commits/11900689bf510f19fd21376367da4d0b6371bf2a.patch";
-      hash = "sha256-/Krv3fWX7IYotZJ2I/uKLqIOOB3F/OSkcWdYaUbZEI0=";
+      url =
+        "https://github.com/glitch-soc/mastodon/pull/2462/commits/e48512b008f406a1f19336e71c44d33362df2606.patch";
+      hash = "sha256-wPPZkkeieMbO0jeO9VXqQyW+F+D7WmcFoXSVHGY03bM=";
     })
   ];
   files = [
     {
       src = fetchurl {
-        url = "https://github.com/glitch-soc/mastodon/raw/11900689bf510f19fd21376367da4d0b6371bf2a/app%2Fjavascript%2Fimages%2Fmailer-new%2Fheading%2Freaction.png";
+        url =
+          "https://github.com/glitch-soc/mastodon/raw/e48512b008f406a1f19336e71c44d33362df2606/app%2Fjavascript%2Fimages%2Fmailer-new%2Fheading%2Freaction.png";
         hash = "sha256-6QLPNTSigxXryjO0IbvZFOQjWrnwrQHr5Mb0ZJllMLk=";
       };
       name = "app/javascript/images/mailer-new/heading/reaction.png";
     }
     {
       src = fetchurl {
-        url = "https://github.com/glitch-soc/mastodon/raw/11900689bf510f19fd21376367da4d0b6371bf2a/app%2Fjavascript%2Fimages%2Fmailer%2Ficon_add.png";
+        url =
+          "https://github.com/glitch-soc/mastodon/raw/e48512b008f406a1f19336e71c44d33362df2606/app%2Fjavascript%2Fimages%2Fmailer%2Ficon_add.png";
         hash = "sha256-UYDdj5GKsg1cfVTx04hwsEURk6iKZfQCMAA2UFT0SJA=";
       };
       name = "app/javascript/images/mailer/icon_add.png";

pkgs/glitch-soc/source.nix

@@ -4,8 +4,8 @@
   src = fetchFromGitHub {
     owner = "glitch-soc";
     repo = "mastodon";
-    rev = "7c81666f7f8d7c0321d12899680f6e0b5bf3757a";
-    hash = "sha256-myxCbzi6mDwSzlRULW2695ggPUGOEAn6K2PWQ/tuov4=";
+    rev = "e7aeacccb147174f5fb527c02036a2cd5f82cef6";
+    hash = "sha256-nnIjDDWZPBeMB6ezpsOZgdxtb+f8LRhx6X0RNTRMDB8=";
   };
   inherit patches;
   nativeBuildInputs = [ gawk gnused ];
@@ -18,6 +18,6 @@
       sed -i -Ee 's|^  checksum: ([^/]*)$|  checksum: '$cacheKey'/\1|g;' yarn.lock
     '';
 }) // {
-  version = "unstable-2024-05-14";
-  yarnHash = "sha256-tw5EiPWNpzGjjLkTx++W82bA5ZZiJCzU1BELgXU+d1M=";
+  version = "unstable-2024-05-29";
+  yarnHash = "sha256-haLT8KnJr1r4VPjeXfR5nm0yUbAbeB+D9reOXrdfwCY=";
 }

pkgs/glitch-soc/update-emoji-patch.sh

@@ -8,13 +8,13 @@ echo -e "# autogenerated file\n{fetchpatch, fetchurl}: {\n  patches = [" > emoji
 curl 'https://api.github.com/repos/glitch-soc/mastodon/pulls/2462/commits' | jq -r 'map(.sha) | .[]' | while read sha; do
 	url="https://github.com/glitch-soc/mastodon/pull/2462/commits/$sha.patch"
 	hash="$(nix-prefetch fetchpatch --url "$url")"
-	echo -e '    (fetchpatch {\n      url = "'$url'";\n      hash = "'$hash'";\n    })' >> emoji.nix
+	echo -e '    (fetchpatch {\n      url =\n        "'$url'";\n      hash = "'$hash'";\n    })' >> emoji.nix
 done
 echo -e '  ];\n  files = [' >> emoji.nix
 curl 'https://api.github.com/repos/glitch-soc/mastodon/pulls/2462/files?per_page=100' | jq -c 'map(select(has("patch")|not) | {name:.filename,url:.raw_url}) | .[]' | while read json; do
 	name="$(jq -r '.name' <<<"$json")"
 	url="$(jq -r '.url' <<<"$json")"
 	hash="$(nix-prefetch fetchurl --url "$url")"
-	echo -e '    {\n      src = fetchurl {\n        url = "'$url'";\n        hash = "'$hash'";\n      };\n      name = "'$name'";\n    }' >> emoji.nix
+	echo -e '    {\n      src = fetchurl {\n        url =\n          "'$url'";\n        hash = "'$hash'";\n      };\n      name = "'$name'";\n    }' >> emoji.nix
 done
 echo -e '  ];\n}' >> emoji.nix

secrets.nix

@@ -94,4 +94,10 @@ in {
     scylla.publicKey
     zorigami.publicKey
   ]); # TODO: we're not getting ssh keys for the generated disk image, so we need to embed it at disk image build time
+  "secrets/acme-zorigami-zajeba.li.age".publicKeys = meta.users.ar
+    ++ [ meta.hosts.zorigami.publicKey ];
+  "secrets/automata.of-a.cat-matrix_key.pem.age".publicKeys = meta.users.ar
+    ++ [ meta.hosts.zorigami.publicKey ];
+  "secrets/automata.of-a.cat-matrix_env.age".publicKeys = meta.users.ar
+    ++ [ meta.hosts.zorigami.publicKey ];
 }

secrets/acme-zorigami-zajeba.li.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 kY4Rgg qZRPbk9d9AHVVQfrsee+nPmCPfTc3cYMkIBy2lmbRBg
+KzBbIvpyFjQUYe7dtX1t0XV5wG5uwlEriXg+YrCvQ0w
+-> ssh-ed25519 grc4Uw bQii+4HNWJCp61FotQgZmGJm0slw/qmdk58+5ZmSXBU
+PE+2xj+WXqpf6ii5ePFX7gzomyEC/4VN5TKs2oJay+8
+-> ssh-ed25519 DLT88w 1TKVTSJ+CRKLG7GtcH9PXoQzXiNsINvkkzMN7cd0tkM
+SKmAoLbKZIsfkM0XmpERUKJd2J3eeT2gk98lA5QwxdI
+--- pR/aFqnbRFfJQ186q78Ep89Cx6uSDkuKnrAgaX21CKY
+¶5—Al%¤E‘JZ|t©¸ˆ†ãRÒ 	óG9—…tÇmɤNêB
…¤ôðË`¨ƒÚNeøvPC… 5
F³ÅÍÁ<C38D>.ö‰vö

secrets/automata.of-a.cat-matrix_env.age

@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 kY4Rgg anzcoH0kLJb2Azom1hBIT1eVbzv1yctL3l6c8gfjwzk
+DDhgP/3+hIROP4d8xQ2apBDB6WTmXb3Q9AcEYdIeUIM
+-> ssh-ed25519 grc4Uw La7w09KGxP8xifVbikW83CJdhMA5ufgZLX6e0kQ6Gl0
+fxyMY6lq+OpU6HmUxr9SgZ4JDbWgWN9LAjSbFklU5o4
+-> ssh-ed25519 DLT88w v4qUHpFJK918iuY3IyRxIOZpWbpaL6OpRKBVU7pEET4
+/nRHMyt5B3wfnqWhk+116qBvXlQlRZ4MDuzBscKQ3Xg
+--- DKfwaXi8Uhc6mWjkIR1drR8QrsnjG7Z1233qyOker2g
+C™;$y”J
+ý‹-©QÛØý1<C3BD>ùs}ÔÖ
žà½5Ç<35>ÂXÎCÉ<43>¤DG)ãY…O×g=&ô¥
+ÌP‘}RwÞ‡
+ëd*Ÿ¤Y–‰Ãìs“˜jN¡®š„sL0Û<30>kV•MPeé‹

secrets/automata.of-a.cat-matrix_key.pem.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 kY4Rgg Gf4ZeBJ6c6YqrBXiaL26rwKfnHklKQgjobQ0PcrB0m4
+EFj/+2bzZa/3HDv4kRBKmc9A79lljtxvH8eHOBbarYg
+-> ssh-ed25519 grc4Uw 65LBccbQNOiDt/ItwGAG4Zrwv9yhWIgDJisGA22sbmU
+38LT/tEb7hWBlcDSV8yY3Wozg3w5wc0Gc69Uf1SSTvw
+-> ssh-ed25519 DLT88w xkiPn6h1P5X0el8S1mxvdGzbzqkzMeX1EugI5jhyB00
+/jn34J6c1NLerwVcCySZ6u4O0LKsCtnAlItCvKx9ziM
+--- WwJnBwgvC3tYkIWTQqUHjuzXAGblCw3Lvldic9Rp9K8
+7R)<29>!í+•ãÎUQê˜ÕGÐZÌf&è€ÞÿÚß•²DfŠPâ¿·)ñ…¯-.pìðòv_¯dáQçÅ+ÒG~|t1ÞÀ¢®}M…-êþ!s©hEL{Ú˜†ioØß<Ó–É,mI3«ÀD*Cw²O©÷uîTу:·VÖÅÑÄÉϱî_[(ñPy­$¥xX;ÂñS<C3B1>‚G–Ûߺ“ge
+üÙ{îA