From 0e876052c900252800d7bfffa58f1f0dd6067df4 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Tue, 15 Oct 2024 23:16:34 +0200
Subject: [PATCH] mastodon: update to version 4.3.0 from nixos-unstable

https://github.com/mastodon/mastodon/releases/tag/v4.3.0
https://github.com/NixOS/nixpkgs/pull/337545/files
---
 modules/mastodon/default.nix                  |  18 +++++++
 overlays/default.nix                          |   1 +
 ...ve-record-encryption-deterministic-key.age |  43 +++++++++++++++++
 ...-record-encryption-key-derivation-salt.age |  44 ++++++++++++++++++
 ...n-active-record-encryption-primary-key.age | Bin 0 -> 2434 bytes
 secrets/mastodon-extra-env-secrets.age        | Bin 2655 -> 2878 bytes
 secrets/secrets.nix                           |   3 ++
 7 files changed, 109 insertions(+)
 create mode 100644 secrets/mastodon-active-record-encryption-deterministic-key.age
 create mode 100644 secrets/mastodon-active-record-encryption-key-derivation-salt.age
 create mode 100644 secrets/mastodon-active-record-encryption-primary-key.age

diff --git a/modules/mastodon/default.nix b/modules/mastodon/default.nix
index 47d93f4..01acf7a 100644
--- a/modules/mastodon/default.nix
+++ b/modules/mastodon/default.nix
@@ -7,6 +7,21 @@
 }:
 
 {
+  age.secrets."mastodon-active-record-encryption-deterministic-key" = {
+    file = "${flake.self}/secrets//mastodon-active-record-encryption-deterministic-key.age";
+    mode = "400";
+    owner = config.services.mastodon.user;
+  };
+  age.secrets."mastodon-active-record-encryption-key-derivation-salt" = {
+    file = "${flake.self}/secrets//mastodon-active-record-encryption-key-derivation-salt.age";
+    mode = "400";
+    owner = config.services.mastodon.user;
+  };
+  age.secrets."mastodon-active-record-encryption-primary-key" = {
+    file = "${flake.self}/secrets//mastodon-active-record-encryption-primary-key.age";
+    mode = "400";
+    owner = config.services.mastodon.user;
+  };
   age.secrets."mastodon-secret-key-base" = {
     file = "${flake.self}/secrets/mastodon-secret-key-base.age";
     mode = "400";
@@ -54,6 +69,9 @@
     webProcesses = 2;
     # Threads per process used by the mastodon-web service
     webThreads = 5;
+    activeRecordEncryptionDeterministicKeyFile = "/run/agenix/mastodon-active-record-encryption-deterministic-key";
+    activeRecordEncryptionKeyDerivationSaltFile = "/run/agenix/mastodon-active-record-encryption-key-derivation-salt";
+    activeRecordEncryptionPrimaryKeyFile = "/run/agenix/mastodon-active-record-encryption-primary-key";
     secretKeyBaseFile = "/run/agenix/mastodon-secret-key-base";
     otpSecretFile = "/run/agenix/mastodon-otp-secret";
     vapidPrivateKeyFile = "/run/agenix/mastodon-vapid-private-key";
diff --git a/overlays/default.nix b/overlays/default.nix
index af9faa9..50ede5d 100644
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -16,6 +16,7 @@
                 element-stickerpicker = prev.callPackage ./pkgs/element-stickerpicker {
                   inherit (inputs) element-stickers maunium-stickerpicker;
                 };
+                mastodon = unstable.mastodon;
               }
             )
           ];
diff --git a/secrets/mastodon-active-record-encryption-deterministic-key.age b/secrets/mastodon-active-record-encryption-deterministic-key.age
new file mode 100644
index 0000000..3fa0863
--- /dev/null
+++ b/secrets/mastodon-active-record-encryption-deterministic-key.age
@@ -0,0 +1,43 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg 1hTwlkE1sBAeCz0gf7XU6o0iMX9NXcqs4dFKrmerV1Y
+QTRSr5Ab6redaWHmSkGv3QBDOTCoN+0bqZnWTkUXw+k
+-> ssh-ed25519 uYcDNw FJ3Jxz2Y1uz7cZwYw+IfO3MQjoXkO4OU+CIeMDa9Mk0
+MgTZesZpxk788OBPM1forUuxIYFKkpsnp7NsEzmx9M4
+-> ssh-rsa f5THog
+JH7iLrQWeElqdYWVwQJIVh7KjBx2TmfqUekwkI0FA9ikqaWM9byewNkT+juu7egY
+eZol4fyx9WLVVNI0P+Gc64mi1K3DzW6IzJT5PN24TSOeVggj0buKRLBPZeSroCL8
+mfIRPJF5esA0j2ohGOzZLA1cpeHCkAVU6tGq5iXI7w883AOhZDZHtEJWJHE+QMZG
+9ZaSnGPLeAiC9xFjxxUQRuxUAE7nOjqoflcEPcm1/OkZoauqsJGzvNl2L+b1D1Oz
+wgSTTSVxsNH6MDKmuxZgjPLUpU9rbi1/ylfI+caW8SJ1ygu2yYhTh+KyXiDjtj03
++ZZYBjOw9bR12qiQx1it0OaxJU8YPGAlBIN+PZQIQrV7j1KwGUfsYXFmHGdRehK9
+7bVcDMeIEPYorQWiOL59zolwQ1u0Y5oFPJBiXxDwpVKEwen/VzYCtJwCDb4eIfsS
+AWLARmnRR2KIOJn6SgcoqBl8OfPntPjWr3KjvfXXrH1wo56Ba/5c4her1S/wQNh1
+MuMLE61WgCcR5Pn14gtuzMh4cqt2UN4kHLQi2KluRSa9v02WhWOCyf8AJFInANo5
+tdvM0asCAAE0vTPqk1/gwrsIAdATjC50lCyJsmUZQs6iMuL1voihWfZ154CtRS48
+ji8wKDlOuIalbzq9/kQUa6vM1kaHqq8LoLtw5wHFLJQ
+-> ssh-rsa kFDS0A
+QkIAoXUvfop74tdybgxTC6l4RSJD+QcSnCMadA4fQhfgvxftXXAMERPVmWS8L8Rr
+fnkb7WOsLKe5uFwDBAi/stjNugtjxPE6j4Hbv0LxyMh2KzsczRKQjdcEN4IVjHMi
+EZoePsshDJ1ND/SBhfSqQ/Y3N7g9sEU3K3oTE70hGX+0MOxQYz/vhw5VfjwwfihL
+n4Btjn/kmUALlWtox599tvNfy+Tjq583UdZNQMHakI4bust1FOatIdJEz4qHVb7C
+XJ0QnqlJPqY/V8KF5IOh5at37U2raAp/54RDAAziXjLnbeiCIFGFpPNNH4c1XMRe
+MNcDJQo9VxfDreVAWUEjaQSv0xK3bv64A/RelDCvgQA9+4MBDZO9i9PRkC/dUf1C
+0UzNT0pQPR/8TmAo2S/XcPYGaQif6g+OL0dvNivKNjhpx5AUxR+nImuIRL5c4H/P
+x37O6iZbg38B2g6l4oS9kOEALr3zithv7k/J9tC/5kOtXDcnDo5nuLDV1+maASnk
+a1mKGF+NnJNj9HfN9Tf5v1HYSgOHjH1RXZWaSUqQEaaIJ7jKg/hZroXUDGEZxU0E
+0u9rzeoQNXNLvTJtZjO79EWLlp8C+CryfVgJLBELe6yY4FcLR6TbB9t1bWT3VOnf
+s62sU5fpsgQgQ1Wv4JyEPt1Vy93JNPQGrbnI0euFQhc
+-> piv-p256 vRzPNw AmLneGaB8PWxhNVQakxubRiTfQI8ztGWXsZv+eirFURz
+N5bR+P/vKP0hgnejhIBEMG3c3fbnpTeZOsL4FTQdIiA
+-> piv-p256 zqq/iw AzQcsc5Tdm4R+yYGO0TDiDyEkXlsdqhZm5hp4mAj1CPG
+Nxc2z1uW63Cl3N4cQ2T3g1/fju/bVHc2BwA8VGtL/Z0
+-> ssh-ed25519 YFSOsg iKhgZjb+wldSbt6GK6RXHVOmmHIy/q1kvwR/sirvQ3w
+0IIhK9FhVl6CsdDS6e1oqlha2DfeUZ/Bs9MNooPFTpY
+-> ssh-ed25519 iHV63A u5F2ywZTiWhB19r3ey9JTzho7za06Cq8UISh4G1ApGQ
+NpuI82VTuaZdqGKyftNIrYhr5KAkh56sf84J9aw51+s
+-> ssh-ed25519 BVsyTA kDelsR5/FRuItCOMX6m6H7vyLlZRYyMrb32Eve3lMEY
+sNGS7R6zqSLT7xNJAJWmzWfWL0uj5QnJ+Gbh49YfpKQ
+-> ssh-ed25519 +3V2lQ idYZrubfci3W4Yn+3pEblXOQCf1UoyA7cxKnFmfh3Bc
+OMI1yg67nxUBH1xj9NikqFVeCTqAWa+69DYvB4T4uiQ
+--- 7HlnH19UqRCTjysYSSUJGrdsK4ZduF8+k4nSK/3JDq8
+}sˆðDéµYá–ÀMÔŽzS’Å~ºùÂ…«.Qc¯¶d("û)#š¾þý*HdºÓ…Œ%/s¬g—hé]½m}
\ No newline at end of file
diff --git a/secrets/mastodon-active-record-encryption-key-derivation-salt.age b/secrets/mastodon-active-record-encryption-key-derivation-salt.age
new file mode 100644
index 0000000..01bb53a
--- /dev/null
+++ b/secrets/mastodon-active-record-encryption-key-derivation-salt.age
@@ -0,0 +1,44 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg dNFZ+e+a0AjH6Gs5POmZVl9bSXREvkqx1lSdmOq5IRI
+ZPEuKmVDwWgPL0qfDsMtslNJ7RG55MPTQjlBL2iEJdk
+-> ssh-ed25519 uYcDNw qDCVM6EndKJxZUXOUg0d4ElU9vlMGS9mJxELjezs8H0
+clZ8JJ24IPAd74jKyOcUvKeeanxm/Cy4b3B5mrvg9ds
+-> ssh-rsa f5THog
+rjdgXMdt8KqI1qJA0hWkF3SyjsaDz0f7AwUzcTY7hk5ULa98mCRe26tmWbTiil5D
+gchbehmLRy1JTzahUw+1xLH/iZzo3RqXCvzjrBoPCM/iucHJZPHpLNoOTtL//zXR
+0lZusQaUZ/lQrjCwyMwACJ9DKv4QiCIUfgYBzZGq6oLMYiWpEHfZQ7tWiROAO4/T
+cCCvLtM2LQ5Q5vZ5cCdBQLxrAZz+OnPgXQRAoLqH5WLMIqleUhkoVh8JoIzww+UG
+c2OKazF2dL4djnujrTQfS1uWirfmkpNW+TKrKKq6q0+cLOMjc/eLjOfBvgD+yZuO
+TxnkRRbOGNuc8hA+9FL3A/yfYk/TH78eQ27aiiV6yaX3qK9KcPp1/vUe+m4XguXE
+8LRemmCVazYuYKXzh4jr+ecppVokKep3tzb/eKSjw55xx/PIcG3AV4UjuN3Vvtdx
+BkP4/S/jn7tEBlNc1DmkrgmuUF5iwPR0CTMG1I6gxUkjyxWyPKntq6wegPT4QMRE
+eePq6SjKOOH06u4W1z4HM1ipMOK1VJrozQabnmZnhbE2+Gfy76N+Fe0sjG2iK/pg
+J8v/KT6BrhR0PYvGJirnZD0MvIlSZA+xI/FpKav/Y2195Bb+LEJY+nJoxepdj8ev
+d7N+J6g5Yt6SN9BJS0QTmtatFlTnfsU8nAYCEVB1Uxc
+-> ssh-rsa kFDS0A
+PnAXBG7IsVdWs3TEthQFSDglnQdZlmBzhYWq5er7Q32i06BGw0OJp5c7VNi6zLFd
+EOSYtdZ8SaK/CL7m3LROmv8NraVst2ml7zKeYPZ5/xHLVBb57SWkFYZIalMpZDr3
+IVRxHifZVS6hgdCa5MWUotOsdzbStUSSh6G7TCrP/LnCeh/abOXLkvqLj9NrHeAH
+UOb+Sxay3y5jUc3OBPGWw0LzGFa8S0vKhqGYIIMUcFBoenQ68/WYMMt9Lc5nD9yA
+fiH0ytkhZVkPd1+0MQ99dpCgUOcK7SOG/jUDIOhVJ8OQMoqovaML0Kmz6+Csj8l3
+l+iMd19D8CCK16dLGDi3LdvDaanIHq7H8vOW5ihWgV313aLYWdYJDIKhyn90XO0b
+SjF7dFuPxsIb+8r8/hk8xPdGu1cB3ryfEUaccQF1f0q3jBaM1RZ5Jfu/0fVHDnOj
+9c1lMC2MvwBOFFrNo9GzKjq6ezLBb58i8fV5+LZTVOgMa25BusCpnHW+KerjpGb1
+/2RK8WoXoviGAAaPuIp0ttD21oj7Ba7ZjalzO328cTlK/J6wp6qxoJOC9FuXBZCf
+M91kGWavS8Y941kRZJBD14VhLQeIjzRphnR64r03kv8HyIDSAmNc2sDOoqji1G4Q
+Fxs1oKVnSxmnGWazjmxtOtbDMhJjJlLyVEJOxgHXmz0
+-> piv-p256 vRzPNw A8qqho2hbHfodtF8D4JFu039UlMDhXhIy1lzqOBkIpIB
+CY5cHkLTHhhNIq1s6iFVGyKyIMemO/my/GmnWS2we08
+-> piv-p256 zqq/iw A23triY0bM1tpn20GXCvGCcWny9dkQDY6tP7du/HmJty
+vXVsqP2j6Kf0mwb29jSY/qn1FFnmQLWVEcL002MT6U0
+-> ssh-ed25519 YFSOsg KZ5TnAoRXHKCIEg1eoMO28saKhKmG08lCoCKNnWaOTM
+FOOqg8s2cVDPAiIVmYI2UkmpXWimQE4Sy+gCwH7oYEw
+-> ssh-ed25519 iHV63A mlcNQxplVIGOPIte0u+vibNIQtV1FCzC5IUmz7183SY
+5IlGvhYYU510PkdyzdNGgFfS9f2rkU1dMJ2Spt3RGls
+-> ssh-ed25519 BVsyTA s5BCUQJfI9Oo8XclNEp9ZJxklF/OwVECb7vFReVQ+SA
+0U2S5Y2den/c/5wNt3RI69AaURAZoEIxjoL1cBtomxM
+-> ssh-ed25519 +3V2lQ ot8xMJdVEzGv0W17UMaOvDp5ltMV1t8zrXhkpRjwrEo
+M8ky+nhQo/rgBZ2gzD1rf++MIJXzrkh9RmGOvL4cqV8
+--- 5RnhwI3yXutsCzaH+lUK221P8Drag4a4LWW0vMJKyis
+P£v ^V÷ä]zù;>Ev»-䊽Uª¨}üpb€ð2žÆ3W?Ôo¬!m»ç¶×
+ËNÌ	7™—"•Ÿ'•â}qk
\ No newline at end of file
diff --git a/secrets/mastodon-active-record-encryption-primary-key.age b/secrets/mastodon-active-record-encryption-primary-key.age
new file mode 100644
index 0000000000000000000000000000000000000000..dc287344236cfdeba3a1ec7feb41a533ce03f237
GIT binary patch
literal 2434
zcmZXVIm`SA0mgSh5dvzVh~?WTNcfv%a?E54CHH+zu1Ok6GC3yqeKmdrJ3-ib3&AaH
z6+2rS8yhPN8^yw2d@UAq{RBTAo-4}J4{4i>M?b&1_J`e=Ln{J&_|e-m6(7>)1;-Kc
z?ZqnPmcKzLXt=5+rneW~SE;x9SH-&##Wc^@;M#FE1yH5?16pA~yRK=NVA+C;%>EqQ
z$Y8Lf>)3wT3Qe~z5t&O#I?b<V_hs4=B&@!@ZFC1yQfX&cSi#~Tn)yR{Ciko3XB4d+
zDdi&Ly<)o<z5&OG(`U70(a9K2`;;R^n#v{uH4$8J85Nz(C!-{960Z7!Hcru7hC5=H
z1Dk0ukEZfdPU|HoS7Zd?2i~$TLme(Q7z}uAq!^3GLnn7BK24aBY4-iVdwKV9I|C-_
ziDc9a-zoobIR>RD=9rslN30pju}r25;wY5*TOc>LS0$H?GD1^|d!bTMZOx<r$mM&A
zLwLwRXs={v1uZV}3I%4&*23-$`}IQTXh!OwIx0;N^Gt`;%Y~u)6qyF00G=mH+1X~j
zlt-kjZJNNFtSSxW<t|6op$DpWSu8D6-Qh$gb~`crVpWA@o75@A&H;#81f2b&MIftb
z4A~>;3blt5Evsz-*Bc{TU(&X#{mQe+SP=+owY-MaMq!Sq<rzA_pg}{{mJpjgA$Gel
z#E4{H72U0coH3}yJtX&L^cuc$D-}DtB0qT(xy2Gzn$OccfVqDjh+@f%@*qm=)jsjq
zt*9X}Mup0R1#OpGBF(qXgCyA1OV15i?|P{7jT-vHMMpqsQP0WTS<s5jlm`~)8zImM
zOJWC5cWs1cBh%-I`k@pd=#n}|GFccqf^imX=J+ab^l&K;+0F_(+V(wBq+S~@C^F50
zpUw@HHZGA4OD94;UPB1v@vx*jJRuyruRR+BSRa;MB$E&K-L_~#OD7qlx?`0#t$v)9
z!)_Vt+_+VHkf6>Cdan(khnnEv5O_d)4`A#Bp+>hP*&Wi3ti$VIEH$3yA>`Ggzb1rb
zH?FHdJtF;gjw_zEVG3{^)lNg#xQ^TIc2w?32`pb<qi`9ovO4OLti2RbuBq%6x6?XX
zJ0Gfpuuz_zp6;Lnc)^q+6ED4=^%An=WQ+?|Hb}xD=kGZ@xsK;|O@ttd&gFZe<%=A5
zeyq^EILEm>00Zum8=f~M-*Ag%Fhl6X^%lNMyi0z<PPB2?6|#-w)tT1ASxIr*dpy&`
zIT(${VgO}hUgj3@I>(imJwwMEUIw^$N+46d)RZrIOrV|?YQE^^u4DZfKZvxd!P4yQ
z$>2wzu=P4X>RGX>154Qr8Q@cDHWIoeB%9=FyM@;sRkG@4R@Ot>+CXyXmCl92-7`zN
z0d=<`l2MZAgzvOTp;Y+Z!RI;)g(t)W!`sm<)<IgV!nxUu@;0FH{!BGgTm*ptUmYN&
za{17_gSxEj^I4h`|M2Y*0)xn8F^8!Fm*rh(Sub~OyjYOQ3NXguX_OgNAaYU&ILn@^
z#4g#-lUJ;}^8%%igc`y(@%Je)ahS%2E7b_8A#4Qd#4<+)3CAIYm><U#J%BBK%2V^0
zJ8fTH_lm~ryGWqd$4ufRQx|A{jBp#3{R|=xJjuL7tf|qy)sa11`iC_GQx!ih<dvt_
zyQAVYVd*EXm+Q;Atb~0rBnV`Kb$=}zhnW5@t)XfM>+Qb!R($hLP6JqR+U@L4I=4+<
z4`g7<$RBprdFaS|S-oqt5Dv|UOm_tT$#MT$KlB%zcw6tM`9A#=i9C_kj*9_{gI57<
zgb!bjxB_XL(W?vJP!*-(jj7Bb34ow2UhszDyC!{d=(*sm1{-R85pBj9ojmivJ{>V8
z*SP;-ox=dV-dTN!ZB2iHIKFi-UY(+q-r_r2>oFaYB<xv3h@x;4C>a8<gs?mXU%P>l
zmKSS$GLmNV0?IsZ{zwL8+2l)m^=g;UzUb!{9~$tsG39TkoPZ(>O9CkE?F-g=_Kp@2
z$l5eK?AU16uiG7Z(n%w9fKV$nxh+u>+0DEM!KskQd8eA}c*6F4JTFDM^;kEv%m01o
zOY{hodZSwo7s2Gnl}$%YE<?x^sp{)Mh4)P_<B;vMI6=t56aqj^TNY2@EGts7-kV7~
z+-_ivZlXvJ-yUtlb%Tm#1<7Jx)<%2N;ZSdlI{2m(roM|qN`aTQgNgjB+%FG4t;j{K
zWbRaxBWkSV-8J{}KnnFjQK-!482IWF`T&WL>qp(8bV&_LGP+KN41bvhqTZ#p-k9dx
zF4v5Jz=#~Yaa6N9218zVxhdMSYl&r9r5-Uu)EjX2+cheoh!Mim@9Kab-&ZC}u2t^@
z4E(4#18Q}Ma;=#HK79D_Rvv42#%Zk+NoOXV4Wj-7ywyVL+(D5Am6B*rRivE^y8+++
z{Hq`BfBnJlj~{c%ufJdZ;vd;>zVg$*{rT_4!u{)G>094uzm|OV>2Lq|y`O7e|I07o
cKYjku?>_z6$DjS-ldJvD@BZXh-~7(M0q%bx9smFU

literal 0
HcmV?d00001

diff --git a/secrets/mastodon-extra-env-secrets.age b/secrets/mastodon-extra-env-secrets.age
index dba14bbec575be03cacae8976c2d0474d403a962..14ad42713dc4552370b4f661043838718a37b4cb 100644
GIT binary patch
literal 2878
zcmZ9OjqfA{dB-KnwYOL8wNVVT;IEtkbvS2tW@l!H9zEt|XJ&VHW@l#S-L|?r?=QQv
zJFh!~v_M}BVrh)^4bj9P7!_YmQ$$KjX;O%2P}EvuuP4{2gr13(M2{+o{j~{+<uCZ;
z`+UF8_j#6qchcK9dAlv6Z1d(U55RiRJNX9(MG>C#TnIr1_(4STaT6Rk6x#W|L9(K^
zFdDVpYTiyv0Ap<QeQ5@*bWsrcL`ZG5aZjg;+#O54ZbU0#!!7e+owgnc(1{$I;0ob7
zM1`w?%K815(kjcL#pYlrHTyk31!lptVg=gFsoAzB7aUN;X~slFN@8eCu($>jJrEyF
zLAY|KK-e!rgpL$vfb6$!5O+?Ydr7J*>>Q900~x(Y%ZufKkEmQ0^row+Eg&=|F!Q=C
zt$D%}nzIEpmp46DWP>uTs!|r$n!!s@7JE2G1n!Kr1Uz?|vBdNQUDjo4VobQTDLI(~
zTI$HH5Wpk$yupW|IYK;wm}}rt9M$#2bcJF$6q(tfKE#g4Nw4$;zb&T;1kQK7IyEQ2
zcIeZ>+N+#xhC54=8+YT;R2b~AO&<eFbSS3S#vZvFCZ+&1@8#<y;Ssr#>>YVzB(Q0%
zi*Cu$(y{^4$v}^DautR1RD=Lwhi8e<pUdKYn&~ClI>xB(p%MpZV3uH_qT;|3Ky{<u
z%6YVq%?Z-a$t3Q^=*0Fxiwcb(1+az{Rn-Z(3ER!p)x6h*&CZY{TSrGJfyPrJ(Kgf3
zMq7`^%!E(Pwgd;WGM8XzDOnRAM1&R12<@Ppbj_9)7rh-4WtKLK?7hSLNiI|!0i!mt
zu~clCQSLNbH8l`ok>oBidJ^G#sMXiPrjcrPP_AZrPeDY31$EouE054DjvsqAK(?Zw
z0Tuv4MYfp@qiKcj<=ja?nq;#bYa>t?jfM;yFYTVr2q3P}4Y2FfeZN2{(a&+uGzlh7
zDP%ZgnMH?)X;<|Fi`ejG)3~+Oj8-_q>=>@8dqrT6F%xl1UeC4=V|yAQ&xk6<NQL!k
z9uyc~B_(ABH=NB(@PvU=6Y27tcA`x%PpRH`i4Iav!uUDFVMU%YWmBvwLmCUUjWV_b
z2T3bLTer!JU(IpC(2G9N<M=dz32KPZcxNe1+V2Ndu`<iJ*-ppvP*eSo^}yWCC*)*f
z@5_E9^cU*^?d#qkn45NQ>LZ-0G5Ej>X*yP<!+okH5F%)9%bG%ir1=z{x2VXK$#^p>
zn@u^iO>K~r1!z@b;`Js`hT0<OX!ulcsX@K45^xCTfg#6;18>++2P85RVUm;;URQiK
z8*LHaT|k&XBnX)Fc0-J*C^>T0b&w}5(ohCp!z*vk4+v*s(Ds^PLJRXXb86d%0T**u
zH>;$-8IpRYP+rfAiP^H1)@s(NjH|X5g4dl84i(-h_FXcxi*Xy|88T#sxLF)l1fv34
z?oCa+WanEu=oR}hnAbkD7UH;Vi#iLZF{s2fvahtPYMFr}(eA>@Vaql2aHZC>wj6em
z<S$0jJRbqQDGY&;3I(f~$c->C4@-kxlNqi{&K%i5NHCh~8w?@lWgrd$8q1{Eq7s=5
zN{yPu>$WG$%p&YGMTWF8Wu>tbBl>L3l>5w&Y;!PT0&UMUhTgQTD#Mh#?xJOlb0G*Q
zJj-mo-X2ias*+VJQBgwFs}nrM`qhLURD5O`3xrY8kv9gqttv*fq2rNVrald2d^lYw
zc82t3I>)g&IX70R&Ph_dLLm!p25B&?)|^F?g6C4&Oxx{e`F1d-_mibnxvd)L=B_9#
z!|eGr+l3IiaKuHPPGc0@iA#!J5f<N%DV>E_hvtBZw<uS^|K@lb)hD+Qf*#aLCmmKl
z5u?(gAyiMOJF`F3+0Z1%y2Y!b#-D(yQZ7~iw<hKZ7ID2HDPgpbK@{L(SZdNUA2AhZ
zs<{(r1ZB&0$`>mo14(;9{6AK=+kw#`YYhu#JeYw5*B{_pD-%tBZkb)*Nrz5_W=nIL
zj+SUk_Z_X5@(#6_P;JESHz*0@xU9KDYan3DNQ=^R7AOlqc4=C!lNa~%#T#ldi+K?o
z1cb`jO*?@}vu1XrBd@S*2~#E?Z3bOdLv0bRV8q;IEYX`-{C3Q`QO(vfV#`xh4p@52
zC<6iZXD!z>IfAtEB#)BuOKB0OqcCxhi`_`TXj`!+;bz)Z<-W%2kr!#CD=Diz)5X4}
z`$Cb@!ycLJHhU>C%ZynHtZl?RHpS%~+yo;Fr%2f9&tPz;t?J_cJp0xEfYggtB@T9d
z3gTwV*a|pBU!}Pf)j`~6Hl)AC40&O7+l@A@%4Vtzd#u1<SW%R;oB6BS*U-+gwuioX
z>6V`@#?6e_C2TyAfKBsKZ2+u8seB-fbPA*=A*895+pRbKoqpKy9;MZ?i5Oid0|Fz%
z<_t*3JxGihx{oW>T-w768Q_*<%GErm8$~oUW~COyyQ#O<n*4B*Cr=)f3GL`(((vUC
z>PDG5)ApkwAXlldH|Rok^)XnXDc}M=(R<{f{pZd;9R1O^uRr+A{oklm3;o{0JHp-R
zKKSenpE>vW$>R83pZ)LSA3u1@S04G{&tBdC*PC9EyylMI`@-=sdf=6-Uq1fKHTfrA
zxb20DgQvRt2TyeG{mI$4-}KhkTz}%j&wus7@|!=dkKBCetBhYfclw&^&i~iXzVvhJ
z^r@?lJ$>}<?|d=jZn*v3PX$+8a_Z>s|KTmjIpaeQ|I6P(!Ob7M|E~Lg?frj~efrNY
zKK8~xyA?cfhj`6(&%XIDzOJ9U<t-=fqtX2p4}Rm?)Au}d)xZDX{r8=+Pb|ly*C9{7
z{4e)cKX%X0?>_Uk)0h0mr-&bZ>@xoKyH5n(bw6PIyNS!cduRIGn{E#NZo&NH_kQ=C
z=U$#a^PboJY4M*|=!SCTnMYrC;dfpO{D{{tJ#+cR$#4DfNc+%x|KW?t<-ZAC_V&BH
zBl+F8{_}TUuikUwsc(_rKl<8tU48D@$1b^W!*$m_|J^rSbzk=-7<%C15&usL{N0~_
z_$D0q#Yb)|uYWRl^wBqbz}$9^f3<qzN#NY2+TzzwJo(6{?l|>z`rxQ>;ge5X`|2b2
zp1=2N$3FVk4;=j^!d!Uh$EVsW?)~y#J$mGhv&aAb*y;D2`rzuy_kI7j&-lw%p1kei
z(SQ3~{i?yY-uM&h1FPGg{*m^+%Z@$s*)!ih{ZHV1&pofr-^M@w7<&7I$M3xH>?N07
zycGWE)y0+Xc-e29JO+F3yz9bMx1QHO{EGfr`kOD@c+G7GGV{~(KYjX^^UwYdxJ&g4

literal 2655
zcmZ9N`Rg<V9mkOlbdW^DE``2=gg8CU&OMt@%{{xbJA2GMs4%-TJLk^1I~O4pm>C92
zMW~RJqIeV{`9nk+rU^c1i9{HvLFx}mClqQFef{AP@-KMt`MfVT@Xz?!w(5&RlxNrE
zRRA?GaOR6Abse7ZJp{+$@kzwVaT}a;B!@u+j$pCvh_EwVqQ_Dusfk=9)Z7^CWmH6-
z0SQh&2QnAjce>Z>Eodp!L5g!Br!YH|sFVu{Q*=$Qs4B-Pgye&?qrK&n_5_vOVCS|9
zku_MNk;a(Zr(}+^R49xOy~H^S3!xY$X4x9ZWgKVqi7BO9*=$xcH6!g{As5|&MPwB;
zOAQNloh+y%eU4Vu?#T|<q&xt2kV0_QA|~KfGmx7}<nPHUCe;mC5hLI7VzsZ`te;O?
zXWBz0Dv>aM%+}>J5O!OZ1OdeqYln8W6%y^WvZt_gNoM9i^Z8tlp`$fpFmH<bhmx?6
zz3(<2V@gyf8(ZD+*ou^aU{Gh|XmATW9d}SYZQ>DPck;fBoJpA%h_%)ctxMwl*gS{|
zJa`4M6|77yqj_Jq+zMEG&;X)MCg9$%-mvrxVm&<W5pc2bV4v^dQfVrZqKm583^=i0
zt|r^jq~7d0uxJm*92meojG!UQiA#3a!*Zti%Pw;I#Gm-OEBP>1M$KNG!4nZ<6G%wL
zi&2xP?LIcbZm3W|Sc%#wDyfF!aC0|WGdn31^>oAP8|={M*}?9kDh$c4p}Jtbj;Lc@
zK*(UTFs^SQRR^lX0~?~$6vOC*c-<>~G3}#lpnH8kSbIX7?S**_sYFB2eumR?IE5Fb
zJh)&vkd!3?n@P`bbPkfo?y##i6tb4wqie2%V6mio4b5PknmAR_={YTINu^y9+koca
zGRrzr50(ILY}5_C=xQ1#Qps1$dL_rZXkv|0QWE18@4FJJOJ$gj7nC|ynQFc*y*->C
z9g;RzE+D#Ymd{g^o3u{obg^9G7<y`h(P6c~%9NjoTX5h*0@OF9#~>UU20l9U;BFKJ
zUhb&C;FTE^#4~{!71kjM*Xay4XDhSN&0|N$Q>RK6BpYQQ_I_&K^Kl|@>WBuG%+Xug
z*h2OaXPVX=F?QFrU`6eWHt{Kp$>fe4uSXcUNysT>@@TP8AU-R2w^thno&s_KCWn1W
z>wOf1_;Ks#5F^g>sRl`94@<pa#&im2=J;?#SG3XVH7{?Gb_ydw#e<U+Xcp70;GN2+
z(;E|QsYz&qK5K1yu}%niRQveefjJ%PNV{LP<Jg_AmWa9GhXZ%;lr9JM{ft`IVh&aX
zM>;bX!4f&xwL!7tGi>A-;VvqeXtq$SU2C?kK}@&J$muYuR^0<Z%RtQ9klYeHMTTSd
zSdqf?RPIb#XVV~*cAb=jbsltDT~kq~b7VMk(dxh^hDDNA*!eDCD>#zS#!^%`Rtaea
zRl%K<i!igLJ6D+Khb_K?nXx9rVFVH*DMmWt$V}QXg=_;S!T^u8BSFwG3+>s!4imQI
zJ#-b5$%1IJ!LSFWo<SRw*PwMdB8wE%-2on0EYw1-bcq2dkF~ic6KT3e)?_p9B}1g<
zIWD!+X-m7?!z#*^Io1v>#c(UFDsaX^)G!8lbw|k@7Xa#rOY4Mo5#Lw}NZJn7(J$np
zBrws%l~(Xw!UU&CY{2YxJTn4ct*V7YEkgnxhhQH9LODkwrjAF<I>~pMW#_gk(PO;r
z4t$+pyMwJOr)@P(_ytu})lr$m0Uk`CLec|<uV_HQ)v68*6cs=h(i+WELw}LWemW89
zEe@4?Hy0=I!db$j_xiYqnllB06DQ4jSe{ltovkc^L8N+HY>DNNbA$~W@g~O@v4(KW
z7geg6_%vf%5CybV>MZt!8;rSb5sUn(F>QHoDsxa3aZ*emLR_KUoMW~BXANZuMW?Jn
znfqx;(vCyHR;?Mc#tzgR#d~XI^>DqSMF}a*$xNDufFaTgW>_EAgj%Of$W#dx6USQ7
zDu$g?2I(oLEmX=7i0|j~+=kkMx~PMb1y~))VFcq|sHc1+cQKKe^q%ogKQ8*-xI3*T
zWmOMRzXC7^4sz2;=Nu0A9lzmD2eE?kUI<viIxdGfwN{k*vf=pp+^U_UMUp|F^ofyn
z^)!UECEt1JSb;4?!DZ&CH+;VwxLqIjtfH_-rB1iNfrw_(7>zS^(OX8gwxiLp?OTvh
zcx$H6E4QyPiJ2|!DfU4cW7NGypG?ey%i!B;>FulyZQGuRjle|RdGyv&W{t5{ku2dg
z-!w*mk?$RO*UckRqt_0|$Wep_Ryg(WQbGB^#N{TB(8U3pyuaAzZUa#RNmnP!nS`$V
zxZsdg=`IhYvC;iXEahD9(Ro=UTI{I0k}DgP2HdrEG;Mm)Xqu6$9HF*rHXp~Z?L=MS
z1c!#q6=umMrN;wj&YU@!?{=;)gaS8ewS_z+V7ZC?ow}YPO?z|<m4=rP!rK#BUICY1
z|K+Cy=ee()dE~**{2aUO3xE0W<F8(MOM3D7?_Tl3o9wT@^us&M{RT^~xas^m9=-IN
zSDn4gy868Ip`YF{)nB@Vx#aCPFSzHak6-%Y@5fL4Qz_58bAG))d}{LcbFaI%zVrB#
z_uT)n$Nu*0h2jGby(B-?D8IeQyW#b-x8C=w8>!F!>Ec(YfA_b4|GQ7W{Eh!ybqV<Q
z`yRLox#is-H6QxJ6;D3$$KP?ky!g&1iSvF_yqSIe$|r7jrmubavfD4X;Lqg^)lZPK
zS6=hqi$3z|-S<BK$>*Or`|h<r_}s&gcmG@0e&_1%-Tl=U&cFG}2jic8^qrgUy8I&l
zTc5b_v9H{9qkZdNbz6J6`1%_+-*nkO9(d~)FHEm{?z$&#c>2fBD&x0b8NYVh!v(Rq
Y^rqFLFTMu+>()2ky72jD?)~=oe|wRVg#Z8m

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index da61f63..1bf6251 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -43,6 +43,9 @@ in
   "delite-wg-private-key.age".publicKeys = deliteKeys ++ adminKeys;
   "blue-shell-wg-private-key.age".publicKeys = blueshellKeys ++ adminKeys;
 
+  "mastodon-active-record-encryption-deterministic-key.age".publicKeys = nachtigallKeys ++ adminKeys;
+  "mastodon-active-record-encryption-key-derivation-salt.age".publicKeys = nachtigallKeys ++ adminKeys;
+  "mastodon-active-record-encryption-primary-key.age".publicKeys = nachtigallKeys ++ adminKeys;
   "mastodon-secret-key-base.age".publicKeys = nachtigallKeys ++ adminKeys;
   "mastodon-otp-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
   "mastodon-vapid-private-key.age".publicKeys = nachtigallKeys ++ adminKeys;