Update mastodon to 4.7.5

Flake lock file updates:

• Updated input 'colmena':
    'github:nix-community/colmena/fc7d67ed1cd52af91415f92ba92b543bc7245f25' (2026-10-30)
  → 'github:nix-community/colmena/d135c22028d382878f394ea5f42cd6baeae30f85' (2026-11-06)
• Updated input 'colmena/nixpkgs':
    'github:nixos/nixpkgs/3ec636362e1816bc2f0888fa0fa2c69f1bc9e504' (2026-10-23)
  → 'github:nixos/nixpkgs/0bb2eedc20e4739f29e8045034f2828ad7054f8f' (2026-11-01)
• Updated input 'colmena/stable':
    'github:nixos/nixpkgs/89844ad35df40e876cb6d0a3a319fbf65ea4b984' (2026-10-26)
  → 'github:nixos/nixpkgs/7adf2d937f2992ce3cccf465348a7667e8ba47b8' (2026-11-02)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/64aec40e18595d342f25f120069f2cb63c3947b4' (2026-11-01)
  → 'github:NixOS/nixpkgs/daeef707f1d32744253b7878d2dde9abec45eab3' (2026-11-06)
• Updated input 'nixpkgs-master':
    'github:NixOS/nixpkgs/c3e80179921b4aa4952aa0e9c3b6ec55f3fdc098' (2026-11-02)
  → 'github:NixOS/nixpkgs/32cfc943fe34fdec30ccd670443929c1fadb3ade' (2026-11-06)
• Updated input 'nixpkgs-unstable':
    'github:NixOS/nixpkgs/577e5b3393ab727c2cd3768ef981a7ba7d8c120d' (2026-11-02)
  → 'github:NixOS/nixpkgs/7dd597af6a9776394693e4d0fed85dd5ea8d56da' (2026-11-06)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/60182817ee048ac94b4c68ea76d5ef2e8aac730d' (2026-10-26)
  → 'github:Mic92/sops-nix/b18e01ce148eb3efff5de2f2d3181ca53b2b2a54' (2026-11-02)

.sops.yaml

@@ -0,0 +1,96 @@
+keys:
+  - &admin_age_fi age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
+  - &host_age_coturn age1vnrtarxwmqxflh2sxe2s49ldfzkve268hx62x4ltv38h3emv8dqspu028l
+  - &host_age_forgejo age1d5y8dx3e8pksvxr8fv8f02v0y7qg7kuwpxpmxksp7xlvrcpfju5sdz6guk
+  - &host_age_ikiwiki age1st5axcrn2s09effsjp6gl89rnwd967y007pzpzamlqydrpf7yeeqjwtnx0
+  - &host_age_jellyfin age10huhyn3va02zjysyanf8fd6lpfvjv3k3u6qymanz9jtcmfp3kqfskth7yt
+  - &host_age_keycloak age15kluaw2krucmc0j98zfk0s5tkwqer0ax6jva458zukzrgnqjqc9q7s88yd
+  - &host_age_lifeline age1pmx78vda0c2qnn8epvkavl26e2939uj65608fdq959ds60d58ucsqwxsua
+  - &host_age_mail-1 age1hny8kwx0uymselgas25q558ruxxdv7lgtu9d5rnd6x9w3nysk4zqumzzrp
+  - &host_age_mastodon age1r60mmmeulm33h0trc0y870dml5hzhglyjv4wecyjy2858pg8u47s793r30
+  - &host_age_matrix age1g60l5mu08xrwfw7uptwcwde8kp9dacs4ltqv2ndjskpy8z5sqakqssxxq5
+  - &host_age_metrics age1lrtengtdc0nzpagr8fkp5mwqda66jqr0s2h3wsxcdscmalp8n3js3r0e3n
+  - &host_age_metrics-nekomesh age1rh7zgp445t39c7tmh84r30e9edju8gmtn84u7rjwhmyntzkugucq5x0xse
+  - &host_age_nextcloud age1lvlmct30jtg7p4qpf8evtjlld6g74q2ckh803hd3ynr7cz7zlceq84flwu
+  - &host_age_searx age17h3js5v8s5vezcankky6kqxcrvtfxanmvhp3axmnqs4y9s2lr9yqvc6zrn
+  - &host_age_torrent age1m37wtvp7fpavaygn2jc6kq2gtuvgvf0jgwwhd3p5862djv5segqs97mg7c
+  - &host_age_valkyrie age1guqc5pnajp2whkla6vws4yqnpe5hq4z89w6te3n5yql5pugzfqlqczjlee
+creation_rules:
+  - path_regex: config/hosts/coturn/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_coturn
+  - path_regex: config/hosts/forgejo/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_forgejo
+  - path_regex: config/hosts/ikiwiki/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_ikiwiki
+  - path_regex: config/hosts/jellyfin/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_jellyfin
+  - path_regex: config/hosts/keycloak/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_keycloak
+  - path_regex: config/hosts/lifeline/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_lifeline
+  - path_regex: config/hosts/mail-1/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_mail-1
+  - path_regex: config/hosts/mastodon/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_mastodon
+  - path_regex: config/hosts/matrix/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_matrix
+  - path_regex: config/hosts/metrics/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_metrics
+  - path_regex: config/hosts/metrics-nekomesh/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_metrics-nekomesh
+  - path_regex: config/hosts/nextcloud/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_nextcloud
+  - path_regex: config/hosts/searx/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_searx
+  - path_regex: config/hosts/torrent/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_torrent
+  - path_regex: config/hosts/valkyrie/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_valkyrie
+stores:
+  yaml:
+    indent: 2

config/common/default.nix

@@ -35,6 +35,7 @@
     parted
     tmux
     nano
+    ssh-to-age
     tcpdump
   ];
 

config/hosts/coturn/coturn.nix

@@ -5,7 +5,7 @@
     min-port = 49200;
     max-port = 49500;
     use-auth-secret = true;
-    static-auth-secret-file = "/secrets/static-auth-secret.secret";
+    static-auth-secret-file = "/run/secrets/static-auth-secret";
     realm = "turn.nekover.se";
     cert = "${config.security.acme.certs."turn.nekover.se".directory}/fullchain.pem";
     pkey = "${config.security.acme.certs."turn.nekover.se".directory}/key.pem";
@@ -42,4 +42,11 @@
       total-quota=1200
     '';
   };
+
+  sops.secrets."static-auth-secret" = {
+    mode = "0440";
+    owner = "turnserver";
+    group = "turnserver";
+    restartUnits = [ "coturn.service" ];
+  };
 }

config/hosts/coturn/default.nix

@@ -4,5 +4,6 @@
     ./configuration.nix
     ./acme.nix
     ./coturn.nix
+    ./sops.nix
   ];
 }

config/hosts/coturn/secrets.nix

@@ -1,11 +0,0 @@
-{ keyCommandEnv,... }:
-{
-  deployment.keys."static-auth-secret.secret" = {
-    keyCommand = keyCommandEnv ++ [ "pass" "coturn/static-auth-secret" ];
-    destDir = "/secrets";
-    user = "turnserver";
-    group = "turnserver";
-    permissions = "0640";
-    uploadAt = "pre-activation";
-  };
-}

config/hosts/coturn/secrets.yaml

@@ -0,0 +1,25 @@
+static-auth-secret: ENC[AES256_GCM,data:af5cjUSeiCEtYki85h+XoJW5FKY4X18i6zOBZnH64Ju/LwA/yUemA8co17TG5cQnc/sw1pz6LySL2DOq/Gj42g==,iv:Yne84/VLN0jCSulA5OQ0UKbQWkqWBmHYogDuAngAp48=,tag:wJ/4yGnbypjTo/akV3P9ZA==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLMXRScDR1NzhzZGRXYUZQ
+        ZGpRYUlOUWZTVHQvdUlrSG5SRWM2ME9sdUVZCldCZkZ0SXdqUjBVNlRnckg3N0dS
+        S0s2NkRnQys2SGJKSTdiUWlnbTg1dkEKLS0tIGthb0FESjAyMjlEbnV4S0lPOHda
+        S1ZBOWdTSmNRQXMvUGJnd05sK1Q2Qk0KHseEBDVLeSWHdgrYyITRuJyp3orrjwwS
+        04ORMniHR7ymHzRPvm3oX/jkFD0iJEmk8clgm/Gcn2AQ7xXeJO7Vnw==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmemxWRnFLMFVEcVZCb3BT
+        MStWU21kcnF5enpleWt3dFdaMHo3RzJGaENNClU2M2tmdE0zd2pXWUJHQkV5Mkhi
+        a0lIbHJmWDN6UXhVeTZId3RhcEd5TWcKLS0tIFRlSUNQN0pGYmtiOGxJS0pJY0tQ
+        YjFzS205QklRZWdPbklIRzVzbFFPT2sKCXra+DUchbomy9pe2HJAbhAF1mstgUcv
+        NalettWmuLXe2B0WjC9fAy2AAJS6kysEbUh960suzSPLTqTce0MGfA==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1vnrtarxwmqxflh2sxe2s49ldfzkve268hx62x4ltv38h3emv8dqspu028l
+  lastmodified: "2026-05-16T23:13:15Z"
+  mac: ENC[AES256_GCM,data:PxX20JAaYhj3DE1KjakVmVucL7jjZU0vh5vnSNmKLgqedJiV2ZqEXpF4s1WPgYTY723aLiWDLw/8kTF/VmvMs8zOdGSkIhojWIWFE6I2yq1MjlawXuUhGpe6C1XGQ+w0KTqzyJLxyIsUSH24GqPHmLRMStE7bYdr0a4lRBHEyqE=,iv:6tXoqhG1XqDAz4SZSIxFCi01Be76/dV4vFPwv3lkcps=,tag:ytLoh7gJ+Iuqv5AwhDElrw==,type:str]
+  unencrypted_suffix: _unencrypted
+  version: 3.13.0

config/hosts/coturn/sops.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}

config/hosts/forgejo/default.nix

@@ -5,5 +5,6 @@
     ./forgejo.nix
     ./redis.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }

config/hosts/forgejo/forgejo.nix

@@ -4,6 +4,7 @@
     enable = true;
     package = pkgs.forgejo;
     database.type = "postgres";
+    lfs.enable = true;
 
     settings = {
       DEFAULT = {
@@ -17,6 +18,7 @@
         ROOT_URL = "https://git.nekover.se/";
         # LOCAL_ROOT_URL is apparently what Forgejo uses to access itself.
         # Doesn't need to be set.
+        OFFLINE_MODE = true;
       };
       admin = {
         DISABLE_REGULAR_ORG_CREATION = false;
@@ -34,11 +36,10 @@
         DEFAULT_USER_VISIBILITY = "limited";
         DEFAULT_KEEP_EMAIL_PRIVATE = true;
         ENABLE_BASIC_AUTHENTICATION = false;
-      };
-      repo = {
-        DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
+        ENABLE_NOTIFY_MAIL = true;
       };
       repository = {
+        DEFAULT_REPO_UNITS = "repo.code";
         ENABLE_PUSH_CREATE_USER = true;
         ENABLE_PUSH_CREATE_ORG = true;
       };
@@ -60,6 +61,13 @@
         HOST = "redis+socket:///run/redis-forgejo/redis.sock";
       };
     };
-    secrets.mailer.PASSWD = "/secrets/forgejo-mailer-password.secret";
+    secrets.mailer.PASSWD = "/run/secrets/forgejo-mailer-password";
+  };
+
+  sops.secrets."forgejo-mailer-password" = {
+    mode = "0440";
+    owner = "forgejo";
+    group = "forgejo";
+    restartUnits = [ "forgejo.service" ];
   };
 }

config/hosts/forgejo/nginx.nix

@@ -29,7 +29,8 @@
       };
 
       extraConfig = ''
-        set_real_ip_from 10.202.41.100;
+        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/forgejo/secrets.nix

@@ -1,13 +0,0 @@
-{ keyCommandEnv, ... }:
-{
-  deployment.keys = {
-    "forgejo-mailer-password.secret" = {
-      keyCommand = keyCommandEnv ++ [ "pass" "mail/forgejo-nekover-se" ];
-      destDir = "/secrets";
-      user = "forgejo";
-      group = "forgejo";
-      permissions = "0640";
-      uploadAt = "pre-activation";
-    };
-  };
-}

config/hosts/forgejo/secrets.yaml

@@ -0,0 +1,25 @@
+forgejo-mailer-password: ENC[AES256_GCM,data:bFUrFyE/reeTtKZCrb1T1CG8Ng9QbDwZo9AdxU67i8uNmKcn93k3dqY70tSqBTAc9hpsXyW3UTKnPpk+ffb0mw==,iv:p16td5KV0rTmrrtX8FMojotEa+2oiFmVizkc6mt9QyI=,tag:czg/IlNLkx75m2iSddUkUw==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFNjVaNlFWeG9vMW4vM2R3
+        bWQyVk9jN1VkUUczbTBzUmdpZ2NyWlV4aVFjCmZwa0lDcXUzVDM4d1Mwa1B4Qm9q
+        WjVKMXJBRVNtc0JzcmE0Y20zdCtzM3cKLS0tIEJWanpwZHdPMGJiL0lkME9yVGQ1
+        a3ZvRGV3VENIbmlubG16MWF3SkdyQ00KZj5vuzVyCqbLH5gnQjhRpOfHtIB3RVZC
+        m+VdnnAFIfShrxwfOekVavffaHmG3PWS7RUKoeZNSdtz1ScuwfazPw==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYOEdadnQvSW1mcE9hSmFL
+        aFlqdHpTejNZRXJCbTh4WjQyQXVobitaa2hFCjV1RU9UOGlqaXhIckNLMmYwb0s2
+        eHY2VVpiQThzQUNuS1FLbFd3V2NGZk0KLS0tIGdOK3VEOUlNcldBQ1haRHhVS0cw
+        N3ZoNWlVK2trVkJLQlhnaHFueFdqVEkK800paYmP1opnW7o2V8f2zzWNR5tOVYGs
+        fl+SA7hE7uTpRrrGfuZq0jQgWOaeAbJ3+PzRuSrVlrXdWIyipcZM2Q==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1d5y8dx3e8pksvxr8fv8f02v0y7qg7kuwpxpmxksp7xlvrcpfju5sdz6guk
+  lastmodified: "2026-05-17T00:50:59Z"
+  mac: ENC[AES256_GCM,data:I3a9s9i6sFVTRQIAj94YZNyxQsDIWIvRhy9M/e6iMYpvoQyxFvMD3xAE0NQ1uX1QgMoi+6njTc8AmTXFJvSfoiqtVfHQH+HkLPMR27DZUY6kgZGMvUVswioSKfaF8fZxGEyWRPAuTDlynfOsGpr4Tqt5U8NBiYL1FDD6CPALaiY=,iv:RUbSPPTR6cTWwzvbnQRA/f9AjjjOpQUiEBrWvxqCpTQ=,tag:GcGsBgxWU/AXm06FkUI1LA==,type:str]
+  unencrypted_suffix: _unencrypted
+  version: 3.13.0

config/hosts/forgejo/sops.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}

config/hosts/hydra/configuration.nix

@@ -1,51 +0,0 @@
-{ ... }:
-{
-  boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/vda";
-    };
-
-    binfmt.emulatedSystems = [
-      "armv6l-linux"
-      "armv7l-linux"
-      "aarch64-linux"
-    ];
-  };
-
-  networking = {
-    hostName = "hydra";
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 8443 ];
-    };
-  };
-
-  users.users.builder = {
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK/plZfxF/RtB+pJsUYx9HUgRcB56EoO0uj+j3AGzZta root@cherry"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKeIiHkHA5c6/jZx+BB28c5wchdzlFI7R1gbvNmPyoOg root@kiara"
-    ];
-  };
-
-  nix = {
-    settings = {
-      trusted-users = [ "builder" ];
-      allowed-uris = "http:// https://";
-    };
-    buildMachines = [
-      {
-        hostName = "localhost";
-        systems = [
-          "x86_64-linux"
-          "armv6l-linux"
-          "armv7l-linux"
-          "aarch64-linux"
-        ];
-      }
-    ];
-  };
-
-  system.stateVersion = "23.05";
-}

config/hosts/hydra/default.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./configuration.nix
-    ./hydra.nix
-    ./nix-serve.nix
-    ./nginx.nix
-  ];
-}

config/hosts/hydra/hydra.nix

@@ -1,14 +0,0 @@
-{ ... }:
-{
-  services.hydra = {
-    enable = true;
-    hydraURL = "https://hydra.nekover.se";
-    listenHost = "localhost";
-    port = 3001;
-    useSubstitutes = true;
-    notificationSender = "hydra@robot.grzb.de";
-    extraConfig = "
-      binary_cache_public_uri = https://nix-cache.nekover.se
-    ";
-  };
-}

config/hosts/hydra/nginx.nix

@@ -1,42 +0,0 @@
-{ ... }:
-{
-  services.nginx = {
-    enable = true;
-    virtualHosts = {
-      "hydra.nekover.se" = {
-        forceSSL = true;
-        enableACME = true;
-        listen = [{
-          addr = "0.0.0.0";
-          port = 80;
-        }];
-        locations."/" = {
-          proxyPass = "http://localhost:3001";
-        };
-        extraConfig = ''
-          listen 0.0.0.0:8443 http2 ssl proxy_protocol;
-
-          set_real_ip_from 10.202.41.100;
-          real_ip_header proxy_protocol;
-        '';
-      };
-      "nix-cache.nekover.se" = {
-        forceSSL = true;
-        enableACME = true;
-        listen = [        {
-          addr = "0.0.0.0";
-          port = 80;
-        }];
-        locations."/" = {
-          proxyPass = "http://localhost:5005";
-        };
-        extraConfig = ''
-          listen 0.0.0.0:8443 http2 ssl proxy_protocol;
-
-          set_real_ip_from 10.202.41.100;
-          real_ip_header proxy_protocol;
-        '';
-      };
-    };
-  };
-}

config/hosts/hydra/nix-serve.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  services.nix-serve = {
-    enable = true;
-    port = 5005;
-    bindAddress = "localhost";
-    secretKeyFile = "/secrets/signing-key.secret";
-  };
-}

config/hosts/hydra/secrets.nix

@@ -1,11 +0,0 @@
-{ keyCommandEnv, ... }:
-{
-  deployment.keys."signing-key.secret" = {
-    keyCommand = keyCommandEnv ++ [ "pass" "hydra/signing-key" ];
-    destDir = "/secrets";
-    user = "root";
-    group = "root";
-    permissions = "0640";
-    uploadAt = "pre-activation";
-  };
-}

config/hosts/ikiwiki/default.nix

@@ -4,5 +4,6 @@
     ./configuration.nix
     ./ikiwiki.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }