diff --git a/flake.lock b/flake.lock index 20f7d18..3a9fcaa 100644 --- a/flake.lock +++ b/flake.lock @@ -257,16 +257,16 @@ ] }, "locked": { - "lastModified": 1726989464, - "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=", + "lastModified": 1733050161, + "narHash": "sha256-lYnT+EYE47f5yY3KS/Kd4pJ6CO9fhCqumkYYkQ3TK20=", "owner": "nix-community", "repo": "home-manager", - "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176", + "rev": "62d536255879be574ebfe9b87c4ac194febf47c5", "type": "github" }, "original": { "owner": "nix-community", - "ref": "release-24.05", + "ref": "release-24.11", "repo": "home-manager", "type": "github" } @@ -336,20 +336,35 @@ }, "nixpkgs": { "locked": { - "lastModified": 1731797254, - "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=", + "lastModified": 1732981179, + "narHash": "sha256-F7thesZPvAMSwjRu0K8uFshTk3ZZSNAsXTIFvXBT+34=", "owner": "nixos", "repo": "nixpkgs", - "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59", + "rev": "62c435d93bf046a5396f3016472e8f7c8e2aed65", "type": "github" }, "original": { "owner": "nixos", - "ref": "nixos-24.05", + "ref": "nixos-24.11", "repo": "nixpkgs", "type": "github" } }, + "nixpkgs-24_05": { + "locked": { + "lastModified": 1733016324, + "narHash": "sha256-8qwPSE2g1othR1u4uP86NXxm6i7E9nHPyJX3m3lx7Q4=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "7e1ca67996afd8233d9033edd26e442836cc2ad6", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-24.05", + "type": "indirect" + } + }, "nixpkgs-lib": { "locked": { "lastModified": 1730504152, @@ -362,6 +377,21 @@ "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz" } }, + "nixpkgs_2": { + "locked": { + "lastModified": 1733015953, + "narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-unstable", + "type": "indirect" + } + }, "root": { "inputs": { "agenix": "agenix", @@ -384,12 +414,8 @@ "inputs": { "blobs": "blobs", "flake-compat": "flake-compat_2", - "nixpkgs": [ - "unstable" - ], - "nixpkgs-24_05": [ - "nixpkgs" - ], + "nixpkgs": "nixpkgs_2", + "nixpkgs-24_05": "nixpkgs-24_05", "utils": "utils_2" }, "locked": { diff --git a/flake.nix b/flake.nix index 611d0e1..e5f1586 100644 --- a/flake.nix +++ b/flake.nix @@ -1,14 +1,14 @@ { inputs = { # Track channels with commits tested and built by hydra - nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05"; + nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11"; unstable.url = "github:nixos/nixpkgs/nixos-unstable"; fork.url = "github:teutat3s/nixpkgs/init-matrix-authentication-service-module"; nix-darwin.url = "github:lnl7/nix-darwin/master"; nix-darwin.inputs.nixpkgs.follows = "nixpkgs"; - home-manager.url = "github:nix-community/home-manager/release-24.05"; + home-manager.url = "github:nix-community/home-manager/release-24.11"; home-manager.inputs.nixpkgs.follows = "nixpkgs"; flake-parts.url = "github:hercules-ci/flake-parts"; @@ -38,8 +38,6 @@ element-stickers.inputs.nixpkgs.follows = "nixpkgs"; simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-24.05"; - simple-nixos-mailserver.inputs.nixpkgs-24_05.follows = "nixpkgs"; - simple-nixos-mailserver.inputs.nixpkgs.follows = "unstable"; }; outputs = @@ -108,9 +106,9 @@ nvfetcher shellcheck shfmt - inputs.unstable.legacyPackages.${system}.treefmt2 + treefmt2 nixos-generators - inputs.unstable.legacyPackages.${system}.opentofu + opentofu terraform-backend-git terraform-ls jq @@ -132,7 +130,7 @@ system: deployLib: deployLib.deployChecks self.deploy ) inputs.deploy-rs.lib; - formatter."x86_64-linux" = inputs.unstable.legacyPackages."x86_64-linux".nixfmt-rfc-style; + formatter."x86_64-linux" = inputs.nixpkgs.legacyPackages."x86_64-linux".nixfmt-rfc-style; deploy.nodes = self.lib.deploy.mkDeployNodes self.nixosConfigurations { nachtigall = { diff --git a/hosts/nachtigall/configuration.nix b/hosts/nachtigall/configuration.nix index 62dc644..11daca5 100644 --- a/hosts/nachtigall/configuration.nix +++ b/hosts/nachtigall/configuration.nix @@ -73,22 +73,24 @@ owner = "matrix-synapse"; }; - age.secrets."matrix-synapse-sliding-sync-secret" = { - file = "${flake.self}/secrets/matrix-synapse-sliding-sync-secret.age"; - mode = "400"; - owner = "matrix-synapse"; - }; - age.secrets."matrix-authentication-service-secret-config.yml" = { file = "${flake.self}/secrets/matrix-authentication-service-secret-config.yml.age"; mode = "400"; owner = "matrix-authentication-service"; }; + # matrix-appservice-irc + age.secrets."matrix-appservice-irc-mediaproxy-signing-key" = { + file = "${flake.self}/secrets/matrix-appservice-irc-mediaproxy-signing-key.jwk.age"; + mode = "400"; + owner = "matrix-appservice-irc"; + }; + pub-solar-os.matrix = { enable = true; + appservice-irc.mediaproxy.signingKeyPath = + config.age.secrets."matrix-appservice-irc-mediaproxy-signing-key".path; synapse = { - sliding-sync.enable = false; signing_key_path = config.age.secrets."matrix-synapse-signing-key".path; extra-config-files = [ config.age.secrets."matrix-synapse-secret-config.yaml".path diff --git a/hosts/nachtigall/default.nix b/hosts/nachtigall/default.nix index 100759a..bacc72f 100644 --- a/hosts/nachtigall/default.nix +++ b/hosts/nachtigall/default.nix @@ -10,11 +10,9 @@ ./wireguard.nix ./backups.nix "${flake.inputs.fork}/nixos/modules/services//matrix/matrix-authentication-service.nix" - "${flake.inputs.unstable}/nixos/modules/services/web-apps/mastodon.nix" ]; disabledModules = [ "services/matrix/matrix-authentication-service.nix " - "services/web-apps/mastodon.nix" ]; } diff --git a/hosts/underground/configuration.nix b/hosts/underground/configuration.nix index ff1c809..49efdfe 100644 --- a/hosts/underground/configuration.nix +++ b/hosts/underground/configuration.nix @@ -42,8 +42,17 @@ owner = "matrix-authentication-service"; }; + # matrix-appservice-irc + age.secrets."matrix-appservice-irc-mediaproxy-signing-key" = { + file = "${flake.self}/secrets/staging-matrix-appservice-irc-mediaproxy-signing-key.jwk.age"; + mode = "400"; + owner = "matrix-appservice-irc"; + }; + pub-solar-os.matrix = { enable = true; + appservice-irc.mediaproxy.signingKeyPath = + config.age.secrets."matrix-appservice-irc-mediaproxy-signing-key".path; synapse = { extra-config-files = [ config.age.secrets."staging-matrix-synapse-secret-config.yaml".path diff --git a/modules/forgejo/default.nix b/modules/forgejo/default.nix index 744d618..0de30ba 100644 --- a/modules/forgejo/default.nix +++ b/modules/forgejo/default.nix @@ -65,6 +65,7 @@ services.forgejo = { enable = true; + package = pkgs.forgejo; user = "gitea"; group = "gitea"; database = { @@ -75,7 +76,7 @@ }; stateDir = "/var/lib/forgejo"; lfs.enable = true; - mailerPasswordFile = config.age.secrets.forgejo-mailer-password.path; + secrets.mailer.PASSWD = config.age.secrets.forgejo-mailer-password.path; settings = { DEFAULT.APP_NAME = "pub.solar git server"; diff --git a/modules/keycloak/default.nix b/modules/keycloak/default.nix index 38da6cf..d924717 100644 --- a/modules/keycloak/default.nix +++ b/modules/keycloak/default.nix @@ -50,7 +50,8 @@ hostname = "auth.${config.pub-solar-os.networking.domain}"; http-host = "127.0.0.1"; http-port = 8080; - proxy = "edge"; + proxy-headers = "xforwarded"; + http-enabled = true; }; themes = { "pub.solar" = diff --git a/modules/matrix-irc/default.nix b/modules/matrix-irc/default.nix index 1b4fa82..c026d8c 100644 --- a/modules/matrix-irc/default.nix +++ b/modules/matrix-irc/default.nix @@ -16,111 +16,128 @@ let synapseClientPort = "${toString listenerWithClient.port}"; in { - services.matrix-appservice-irc = { - enable = true; - localpart = "irc_bot"; - port = 8010; - registrationUrl = "http://localhost:8010"; - settings = { - homeserver = { - domain = "${config.pub-solar-os.networking.domain}"; - url = "http://127.0.0.1:${synapseClientPort}"; - media_url = "https://matrix.${config.pub-solar-os.networking.domain}"; - enablePresence = false; + options.pub-solar-os = { + matrix.appservice-irc.mediaproxy = { + signingKeyPath = lib.mkOption { + description = "Path to file containing the IRC appservice mediaproxy signing key"; + type = lib.types.str; + default = "/var/lib/matrix-appservice-irc/media-signingkey.jwk"; }; - ircService = { - ident = { - address = "::"; - enabled = false; - port = 1113; + }; + }; + config = { + services.matrix-appservice-irc = { + enable = true; + localpart = "irc_bot"; + port = 8010; + registrationUrl = "http://localhost:8010"; + settings = { + homeserver = { + domain = "${config.pub-solar-os.networking.domain}"; + url = "http://127.0.0.1:${synapseClientPort}"; + enablePresence = false; }; - logging = { - # set to debug for debugging - level = "warn"; - maxFiles = 5; - toCosole = true; - }; - matrixHandler = { - eventCacheSize = 4096; - }; - metrics = { - enabled = true; - remoteUserAgeBuckets = [ - "1h" - "1d" - "1w" - ]; - }; - provisioning = { - enabled = false; - requestTimeoutSeconds = 300; - }; - servers = - let - commonConfig = { - allowExpiredCerts = false; - botConfig = { - enabled = false; - joinChannelsIfNoUsers = false; - nick = "MatrixBot"; - }; - dynamicChannels = { - createAlias = true; - enabled = true; - federate = true; - joinRule = "public"; - published = true; - }; - ircClients = { - allowNickChanges = true; - concurrentReconnectLimit = 50; - idleTimeout = 10800; - lineLimit = 3; - maxClients = 30; - nickTemplate = "$DISPLAY[m]"; - reconnectIntervalMs = 5000; - }; - matrixClients = { - joinAttempts = -1; - }; - membershipLists = { - enabled = true; - floodDelayMs = 10000; - global = { - ircToMatrix = { - incremental = true; - initial = true; - }; - matrixToIrc = { - incremental = true; - initial = true; + ircService = { + ident = { + address = "::"; + enabled = false; + port = 1113; + }; + logging = { + # set to debug for debugging + level = "warn"; + maxFiles = 5; + toCosole = true; + }; + matrixHandler = { + eventCacheSize = 4096; + }; + mediaProxy = { + signingKeyPath = config.pub-solar-os.matrix.appservice-irc.mediaproxy.signingKeyPath; + # keep media for 2 weeks + ttlSeconds = 1209600; + bindPort = 11111; + publicUrl = "https:///matrix.${config.pub-solar-os.networking.domain}/media"; + }; + metrics = { + enabled = true; + remoteUserAgeBuckets = [ + "1h" + "1d" + "1w" + ]; + }; + provisioning = { + enabled = false; + requestTimeoutSeconds = 300; + }; + servers = + let + commonConfig = { + allowExpiredCerts = false; + botConfig = { + enabled = false; + joinChannelsIfNoUsers = false; + nick = "MatrixBot"; + }; + dynamicChannels = { + createAlias = true; + enabled = true; + federate = true; + joinRule = "public"; + published = true; + }; + ircClients = { + allowNickChanges = true; + concurrentReconnectLimit = 50; + idleTimeout = 10800; + lineLimit = 3; + maxClients = 30; + nickTemplate = "$DISPLAY[m]"; + reconnectIntervalMs = 5000; + }; + matrixClients = { + joinAttempts = -1; + }; + membershipLists = { + enabled = true; + floodDelayMs = 10000; + global = { + ircToMatrix = { + incremental = true; + initial = true; + }; + matrixToIrc = { + incremental = true; + initial = true; + }; }; }; + port = 6697; + privateMessages = { + enabled = true; + federate = true; + }; + sasl = false; + sendConnectionMessages = true; + ssl = true; }; - port = 6697; - privateMessages = { - enabled = true; - federate = true; + in + { + "irc.libera.chat" = lib.attrsets.recursiveUpdate commonConfig { + name = "libera"; + dynamicChannels.groupId = "+libera.chat:localhost"; + dynamicChannels.aliasTemplate = "#_libera_$CHANNEL"; + matrixClients.displayName = "$NICK (LIBERA-IRC)"; + }; + "irc.scratch-network.net" = lib.attrsets.recursiveUpdate commonConfig { + name = "scratch"; + matrixClients.displayName = "$NICK (SCRATCH-IRC)"; + dynamicChannels.aliasTemplate = "#_scratch_$CHANNEL"; + dynamicChannels.groupId = "+scratch-network.net:localhost"; }; - sasl = false; - sendConnectionMessages = true; - ssl = true; }; - in - { - "irc.libera.chat" = lib.attrsets.recursiveUpdate commonConfig { - name = "libera"; - dynamicChannels.groupId = "+libera.chat:localhost"; - dynamicChannels.aliasTemplate = "#_libera_$CHANNEL"; - matrixClients.displayName = "$NICK (LIBERA-IRC)"; - }; - "irc.scratch-network.net" = lib.attrsets.recursiveUpdate commonConfig { - name = "scratch"; - matrixClients.displayName = "$NICK (SCRATCH-IRC)"; - dynamicChannels.aliasTemplate = "#_scratch_$CHANNEL"; - dynamicChannels.groupId = "+scratch-network.net:localhost"; - }; - }; + }; }; }; }; diff --git a/modules/matrix/default.nix b/modules/matrix/default.nix index 53fbb9a..d1b2fc2 100644 --- a/modules/matrix/default.nix +++ b/modules/matrix/default.nix @@ -32,11 +32,6 @@ in type = lib.types.str; default = "${config.services.matrix-synapse.dataDir}/homeserver.signing.key"; }; - - sliding-sync.enable = lib.mkEnableOption { - description = "Whether to enable a sliding-sync proxy, no longer needed with synapse version 1.114+"; - default = false; - }; }; matrix-authentication-service = { @@ -339,18 +334,6 @@ in }; }; - services.matrix-sliding-sync = { - enable = config.pub-solar-os.matrix.synapse.sliding-sync.enable; - settings = { - SYNCV3_SERVER = "https://${publicDomain}"; - SYNCV3_BINDADDR = "127.0.0.1:8011"; - # The bind addr for Prometheus metrics, which will be accessible at - # /metrics at this address - SYNCV3_PROM = "127.0.0.1:9100"; - }; - environmentFile = config.age.secrets."matrix-synapse-sliding-sync-secret".path; - }; - pub-solar-os.backups.restic.matrix-synapse = { paths = [ "/var/lib/matrix-synapse" diff --git a/modules/nextcloud/default.nix b/modules/nextcloud/default.nix index 662d1ce..9cda818 100644 --- a/modules/nextcloud/default.nix +++ b/modules/nextcloud/default.nix @@ -27,7 +27,7 @@ home = "/var/lib/nextcloud"; enable = true; - package = pkgs.nextcloud29; + package = pkgs.nextcloud30; https = true; secretFile = config.age.secrets."nextcloud-secrets".path; # secret maxUploadSize = "1G"; @@ -45,7 +45,6 @@ dbuser = "nextcloud"; dbtype = "pgsql"; dbname = "nextcloud"; - dbtableprefix = "oc_"; }; settings = { diff --git a/modules/nginx-matrix/default.nix b/modules/nginx-matrix/default.nix index 1d82c10..f6274d8 100644 --- a/modules/nginx-matrix/default.nix +++ b/modules/nginx-matrix/default.nix @@ -120,6 +120,13 @@ in extraConfig = commonHeaders; }; + # For IRC appservice media proxy + "/media" = { + priority = 100; + proxyPass = "http://127.0.0.1:${toString (config.services.matrix-appservice-irc.settings.ircService.mediaProxy.bindPort)}"; + extraConfig = commonHeaders; + }; + # Forward to the auth service "~ ^/_matrix/client/(.*)/(login|logout|refresh)" = { priority = 100; diff --git a/overlays/default.nix b/overlays/default.nix index 33f0e1d..af9faa9 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -16,8 +16,6 @@ element-stickerpicker = prev.callPackage ./pkgs/element-stickerpicker { inherit (inputs) element-stickers maunium-stickerpicker; }; - mastodon = unstable.mastodon; - matrix-authentication-service = unstable.matrix-authentication-service; } ) ]; diff --git a/secrets/matrix-appservice-irc-mediaproxy-signing-key.jwk.age b/secrets/matrix-appservice-irc-mediaproxy-signing-key.jwk.age new file mode 100644 index 0000000..f38c861 Binary files /dev/null and b/secrets/matrix-appservice-irc-mediaproxy-signing-key.jwk.age differ diff --git a/secrets/matrix-synapse-sliding-sync-secret.age b/secrets/matrix-synapse-sliding-sync-secret.age deleted file mode 100644 index 088e91b..0000000 --- a/secrets/matrix-synapse-sliding-sync-secret.age +++ /dev/null @@ -1,45 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 iDKjwg GPTqfaZZC6ze7BUkT1uF4VslvE29BFKm0+AlJk+DKQQ -GxI7erqw8p3GrCArh5vZOiTmYh40DVisCphNyFhNTqM --> ssh-ed25519 uYcDNw oo52Nh9BCO5NNF0YyzracKfvMifSiREsxyQqiRZ6WTs -JvqwRX5yOMtEYgWyc7dIQs85wDghMRHQCIi6t5QxIwo --> ssh-rsa f5THog -w+B5hc0E9u1fFWNNPaTtPmJfPJWUBbRwHYK/T69g2ORNfaBYynl0LL4vSUs8o9Gw -rwBY+cLpth6e4tS819H5C7HtvT47KR3KF8JLxVjA2mbVO83+BnWFjThjYB452CdI -KZvQQPhkSH/43YF6pjxnQjNWB/wroScyjGVtUamcij7YHxt71z0AAnyqE5PgWEc6 -6/ao5gLfTKhcWpxkTTz8LHn05s9IppXywDrvpwtJaU8LKgJT2H6Epsaci348lG+I -tAZYODhQqP+yKl92DZbuQQCjxH5CJfhdBs2ZR63hQPj9OrIFRjLg4V+1gdcxzAuz -9FwwIeLq3uxWXPdwTRR8RUsHEGhKMcVty4PkW0vlt+VwZrZBhdz3k+ApVG7Jvclz -MPZYLzKC0DiODqPuA23ye6suFRCHXYfq3ZyCIIN6wOci0X0crSr9ZXW4M8R7aWaZ -XDeZRaUgvd54WI0HZhVWBvJQyswgUXf+/RkS4aI8IgnNV801x12h+mTdWX9BC/cD -YRIWBnGkfTX4WM4OEE2VEgqSDuKl/90o2LFIquIIJULVd2Vs5C2S8FhJcsT7+HmL -TFWnLeIfGbw7RDUeH0c/Bbg9NK11SZF0/VdRZcBQ/zIXBMBlL1EZsH1HfIfhKISN -PyHFB5kfmuVIBhDXgtDdgjKfDmQL9/9Aq1U4ZMBcUKA --> ssh-rsa kFDS0A -KysKtr7wrKKJ8w+Dj7qjJstyXtKIw9weFi9oVwJkMvy2utn+JARs7puh7KC27TXC -slZJrHf4vx+y8qSjRS0W4z8CPl8/auiYOilepT9JoxwGUP7J/nTr5SCofgWcdZm5 -FtgHoCcABjzcF+mrKUofuqrx6oYSDCS0JkV2tClQI6ybXnjRwIIicLmBN9UDHCuU -9ZOesYp5XrJyBoD3Zv51b19xJyOfuWAUQvlNPRH2TpgvisutpESU/o869z5AMn4Z -BfDD/0oR1ALbk/sB3r13Xi6oJZAB2AbggoQRlwvPeWc3MdS+bFNV2o2ue0ov6Fkd -U5C/GnJVlyE0cv9I+YvxtLT6T/Gf/yoUZGfB7xD5QkHpMIEmKxUYqGNBB/NcnFMY -Tal8jMDtZDEk+uk0MahE7GsL6Z3xrkKTevG+Rr3j+beFYie2RJbNwwUyQ1lL3EoA -Rx1AMk+nYlvxVHiciYJNh9nffgAXXwO255IkWvYzmuPBEP1LmqadA4fQPf5Rgj3u -DuOX3hJ+rIyRIoDXOZio3SDf+bb380xCxF+7efJ27Ep0sFviAq5qKeptbyt51Dp8 -tlbeYAylhVbV9Zgd+EozwE7Btlfqt3sbUij/0Iy+BdOYSPLmvx3oKybpipZ0i3fo -KR/bZHlMKF1Ipd5L7zEwh5aTjImuomoyRyZG3NWdv44 --> piv-p256 vRzPNw A7FwWUuml/VyHcOmha3R/DOg1RvnRXcwjaJJH/sgmsBR -+CP1/qY8sHbR7nkFl1T5HPsjYLRPDCSR01DEJaim96o --> piv-p256 zqq/iw AgYhaJWqe+QbVCHkXsU7AQhWhte/fjwVbOgmHVRPHsEE -7jNmDI62i/9RakJhbo3MP0qMgXYGlhAW9BKo8HLWQYc --> ssh-ed25519 YFSOsg cGPMyhqcd20TDBeMkSDJ8hQ/vE9cuDgVi1hfcwAKVjw -U9GRSr607w5oUGr0rC6XqdWMD65JidY/Ri3Ex1dmGXI --> ssh-ed25519 iHV63A cW7bblsvL1TwI6lp8KjPfUwB5EzWilLhc6Z2geE3SQw -PzBdZ/LXA7iGI7ZjErredqC7ehHsr5MCY3qENv0nZI8 --> ssh-ed25519 BVsyTA AGDqp6Rrp2vStBU9+eJMGf5O4SZQIASE63n8vbf8PEs -SFakjoivQrFkSUBGZ9sISKVhAxNOpc2RxugiBTSK9/k --> ssh-ed25519 +3V2lQ MmMv45CQFAdgkV/B7InOY22iXzvIU8TY41SV5Jxx7RQ -vNIRE5wSXVzy4miZLV90T1TEOhOjYQT12GWtZpsTxJ8 ---- EBBXvYr1OpETpgXOsUfJn6h1e4rXF+olz6DbhDUWCcw -. -s~Hͯk 2 9 Bz?3TJ`gPior" ws-K6f -0XΌvX&8 g=zrHjh> \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 3678d9b..9bf2f9d 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -67,12 +67,14 @@ in "matrix-mautrix-telegram-env-file.age".publicKeys = nachtigallKeys ++ adminKeys; "matrix-synapse-signing-key.age".publicKeys = nachtigallKeys ++ adminKeys; "matrix-synapse-secret-config.yaml.age".publicKeys = nachtigallKeys ++ adminKeys; - "matrix-synapse-sliding-sync-secret.age".publicKeys = nachtigallKeys ++ adminKeys; "matrix-authentication-service-secret-config.yml.age".publicKeys = nachtigallKeys ++ adminKeys; + "matrix-appservice-irc-mediaproxy-signing-key.jwk.age".publicKeys = nachtigallKeys ++ adminKeys; "staging-matrix-synapse-secret-config.yaml.age".publicKeys = undergroundKeys ++ adminKeys; "staging-matrix-authentication-service-secret-config.yml.age".publicKeys = undergroundKeys ++ adminKeys; + "staging-matrix-appservice-irc-mediaproxy-signing-key.jwk.age".publicKeys = + undergroundKeys ++ adminKeys; "nextcloud-secrets.age".publicKeys = nachtigallKeys ++ adminKeys; "nextcloud-admin-pass.age".publicKeys = nachtigallKeys ++ adminKeys; diff --git a/secrets/staging-matrix-appservice-irc-mediaproxy-signing-key.jwk.age b/secrets/staging-matrix-appservice-irc-mediaproxy-signing-key.jwk.age new file mode 100644 index 0000000..8b4a65e Binary files /dev/null and b/secrets/staging-matrix-appservice-irc-mediaproxy-signing-key.jwk.age differ