From 9624a019bd131d71cf775f69666610578dec8c6c Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Tue, 1 Apr 2025 22:58:44 -0400
Subject: [PATCH 1/9] feat: streams module (WIP)

---
 aether/config.nix           |   2 +
 flake.lock                  |  32 ++++++++-
 flake.nix                   |  15 +++-
 modules/streams/default.nix | 135 ++++++++++++++++++++++++++++++++++++
 modules/streams/options.nix |  91 ++++++++++++++++++++++++
 modules/streams/package.nix |  69 ++++++++++++++++++
 6 files changed, 342 insertions(+), 2 deletions(-)
 create mode 100644 modules/streams/default.nix
 create mode 100644 modules/streams/options.nix
 create mode 100644 modules/streams/package.nix

diff --git a/aether/config.nix b/aether/config.nix
index bc9b490..16617e3 100644
--- a/aether/config.nix
+++ b/aether/config.nix
@@ -65,5 +65,7 @@
     federation.ENABLED = true;
   };
 
+  aether.streams.subdomain = "social";
+
   system.stateVersion = "24.05";
 }
diff --git a/flake.lock b/flake.lock
index 0e34e11..82a012b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -93,7 +93,9 @@
         "agenix": "agenix",
         "forgejo-tokyo-night": "forgejo-tokyo-night",
         "nixpkgs": "nixpkgs",
-        "rpi5-kernel": "rpi5-kernel"
+        "rpi5-kernel": "rpi5-kernel",
+        "streams-addons": "streams-addons",
+        "streams-src": "streams-src"
       }
     },
     "rpi5-kernel": {
@@ -117,6 +119,34 @@
         "type": "gitlab"
       }
     },
+    "streams-addons": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1734638608,
+        "narHash": "sha256-Tgh2/AQjVX5O17a/LARjoTS72s2Yi7O3F8G0quiaCzU=",
+        "rev": "7f635aa21a85e865e3798c97b2745674d3deb1c0",
+        "type": "tarball",
+        "url": "https://codeberg.org/api/v1/repos/streams/streams-addons/archive/7f635aa21a85e865e3798c97b2745674d3deb1c0.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://codeberg.org/streams/streams-addons/archive/release.tar.gz"
+      }
+    },
+    "streams-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1743540017,
+        "narHash": "sha256-JFmYawpEsvaj25A5k6C5zIy0CAKzC52/yIQEc89dy9E=",
+        "rev": "6a36b893a4695970d5d657885e105e1939950c3b",
+        "type": "tarball",
+        "url": "https://codeberg.org/api/v1/repos/streams/streams/archive/6a36b893a4695970d5d657885e105e1939950c3b.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://codeberg.org/streams/streams/archive/release.tar.gz"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/flake.nix b/flake.nix
index bd59b40..4b2756e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -13,15 +13,28 @@ inputs = {
 
   forgejo-tokyo-night.url = "https://git.tokinanpa.dev/toki/forgejo-tokyo-night/archive/main.tar.gz";
   forgejo-tokyo-night.flake = false;
+
+  streams-src.url = "https://codeberg.org/streams/streams/archive/release.tar.gz";
+  streams-src.flake = false;
+
+  streams-addons.url = "https://codeberg.org/streams/streams-addons/archive/release.tar.gz";
+  streams-addons.flake = false;
 };
 
-outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, ... }:
+outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, streams-src, streams-addons, ... }:
   let
     inherit (nixpkgs) lib;
 
     # Extra config applied to each module
     # (Mostly used for injecting flake inputs)
     extraConfig = {
+      streams = {
+        aether.streams._internal.streams-src = lib.mkDefault streams-src;
+        aether.streams._internal.vendorHash =
+          lib.mkDefault "sha256-pfbQeudVDhGpEIl1BoBeHbajtU9Z2+oY62D8GRqodTI=";
+        aether.streams.addonRepos = [ streams-addons ];
+      };
+
       deploy-rpi5 = {
         aether.deploy.rpi5._internal.kernelPackages = lib.mkDefault
           rpi5-kernel.legacyPackages.aarch64-linux.linuxPackages_rpi5;
diff --git a/modules/streams/default.nix b/modules/streams/default.nix
new file mode 100644
index 0000000..5d03de8
--- /dev/null
+++ b/modules/streams/default.nix
@@ -0,0 +1,135 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.aether.streams;
+
+  useSubdomain = !(builtins.isNull cfg.subdomain);
+  domain = lib.optionalString useSubdomain "${cfg.subdomain}."
+           + config.aether.domain;
+in {
+  imports = [ ./options.nix ];
+
+  environment.systemPackages = [ pkgs.php ];
+
+  services.phpfpm.pools.streams = {
+    user = cfg.user;
+    settings = {
+      "listen.owner" = config.services.nginx.user;
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 5;
+      "php_admin_value[error_log]" = "stderr";
+      "php_admin_flag[log_errors]" = true;
+      "catch_workers_output" = true;
+    };
+    phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
+  };
+
+  services.nginx.enable = true;
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = config.aether.https;
+    enableACME = config.aether.https;
+
+    root = cfg.package;
+
+    extraConfig = ''
+      index index.php;
+      client_max_body_size 512M;
+
+      
+      # Rewrite to front controller as default rule.
+      location / {
+        if (!-e $request_filename) {
+          rewrite ^(.*)$ /index.php?req=$1;
+        }
+      }
+
+      # Make sure webfinger and other well-known services aren't blocked
+      # by denying dot files and rewrite request to the front controller.
+      location ^~ /.well-known/ {
+        allow all;
+        if (!-e $request_filename) {
+          rewrite ^(.*)$ /index.php?req=$1;
+        }
+      }
+
+      # Tell where fastcgi lives.
+      location ~ \.php$ {
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass unix:${config.services.phpfpm.pools.streams.socket};
+        include ${config.services.nginx.package}/conf/fastcgi.conf;
+      }
+
+      # Block these file types.
+      location ~* \.(tpl|tgz|log|out)$ {
+        deny all;
+      }
+
+      # Block dot files.
+      location ~ /\. {
+        deny all;
+      }
+
+      # Deny access to store.
+      location ~ /store {
+        deny all;
+      }
+
+      # Deny access to util.
+      location ~ /util {
+        deny all;
+      }
+    '';
+  };
+
+  security.acme.acceptTerms = config.aether.https;
+  security.acme.defaults.email = config.aether.acmeEmail;
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/streams - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/store - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/cache - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/cache/smarty3 - ${cfg.user} ${cfg.user} - -"
+  ];
+
+  services.postgresql = {
+    enable = true;
+    ensureUsers = [{
+      name = cfg.user;
+      ensureDBOwnership = true;
+    }];
+    ensureDatabases = [ cfg.user ];
+  };
+
+  systemd.timers.streams-daemon = {
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    timerConfig.OnCalendar = "*:0/10";
+  };
+  systemd.services.streams-daemon = {
+    serviceConfig = {
+      Type = "oneshot";
+      User = cfg.user;
+    };
+    path = [ pkgs.php ];
+    script = ''
+      cd ${cfg.package}
+      php src/Daemon/Run.php Cron >/dev/null 2>&1
+    '';
+  };
+
+  users.users = lib.mkIf cfg.createUser {
+    ${cfg.user} = {
+      home = "/var/lib/streams";
+      group = cfg.user;
+      isSystemUser = true;
+    };
+  };
+  users.groups = lib.mkIf cfg.createUser {
+    ${cfg.user} = {};
+  };
+}
diff --git a/modules/streams/options.nix b/modules/streams/options.nix
new file mode 100644
index 0000000..c96ed81
--- /dev/null
+++ b/modules/streams/options.nix
@@ -0,0 +1,91 @@
+args@{ config, lib, pkgs, ... }:
+{
+  imports = [ ../options.nix ];
+
+  options.aether = {
+    streams = {
+      # INTERNAL
+      _internal.streams-src = lib.mkOption {
+        type = lib.types.pathInStore;
+        description = ''
+          The source repository of (streams).
+        '';
+      };
+
+      _internal.vendorHash = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          The vendor hash to use when finding PHP dependencies.
+        '';
+      };
+
+      # OPTIONS
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.callPackage ./package.nix {
+          src = config.aether.streams._internal.streams-src;
+          vendorHash = config.aether.streams._internal.vendorHash;
+          inherit (config.aether.streams) addonRepos themeRepos;
+        };
+        description = ''
+          The (streams) package to use.
+
+          The derivation must be built in a precise way to be compatible with
+          this module; see the package.nix file for details.
+        '';
+      };
+
+      subdomain = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "streams";
+        description = ''
+          The subdomain to host the (streams) instance under.
+
+          If null, then (streams) is hosted at the domain itself.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "streams";
+        description = ''
+          The user to run (streams) with.
+        '';
+      };
+
+      createUser = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to create the (streams) user automatically.
+        '';
+      };
+
+      addonRepos = lib.mkOption {
+        type = lib.types.listOf lib.types.pathInStore;
+        default = [];
+        defaultText = "[ <streams-addons> ]";
+        description = ''
+          A list of repositories containing addons.
+
+          The official addon repository is provided by default.
+        '';
+      };
+
+      themeRepos = lib.mkOption {
+        type = lib.types.listOf lib.types.pathInStore;
+        default = [];
+        description = ''
+          A list of repositories containing themes.
+        '';
+      };
+    };
+  };
+
+  config.assertions = lib.mkIf config.aether.https [
+    {
+      assertion = !(builtins.isNull config.aether.acmeEmail);
+      message = "HTTPS support requires providing a contact email";
+    }
+  ];
+}
diff --git a/modules/streams/package.nix b/modules/streams/package.nix
new file mode 100644
index 0000000..94fb786
--- /dev/null
+++ b/modules/streams/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  php,
+
+  src,
+  vendorHash,
+  addonRepos ? [],
+  themeRepos ? []
+}:
+
+php.buildComposerProject {
+  pname = "streams";
+  version = "25.4.2";
+  inherit src vendorHash;
+
+  postInstall = ''
+    # Override composerInstallHook's output location
+    rm -rf $out
+    cp -r . $out
+
+    # Ugly hack: These locations need to be writable,
+    # so link them to outside of the Nix store
+    ln -s /var/lib/streams/store $out/store
+    ln -s /var/lib/streams/cache $out/cache
+    ln -s /var/lib/streams/config.php $out/.htconfig.php
+
+    # Install addons and themes
+
+    mkdir $out/addon
+    for repo in ${lib.concatStringsSep " " addonRepos}; do
+        filelist=(`ls $repo`)
+        for a in "''${filelist[@]}" ; do
+            if [ $a = 'version.php' ]; then
+                if [ ! -x $out/addon/version.php ]; then
+                    ln -s $repo/version.php $out/addon/version.php
+                fi
+            fi
+            base=`basename $a`
+            if [ $base = '.git' ]; then
+                continue;
+            fi
+            if [ ! -d $repo/$base ]; then
+                continue;
+            fi
+            if [ -x $out/addon/$base ]; then
+                continue;
+            fi
+            ln -s $repo/$base $out/addon/$base
+        done
+    done
+
+    for repo in ${lib.concatStringsSep " " themeRepos}; do
+        filelist=(`ls $repo`)
+        for a in "''${filelist[@]}" ; do
+            base=`basename $a`
+            if [ $base = '.git' ]; then
+                continue;
+            fi
+            if [ ! -d $repo/$base ]; then
+                continue;
+            fi
+            if [ -x $out/view/theme/$base ]; then
+                continue;
+            fi
+            ln -s $repo/$base $out/view/theme/$base
+        done
+    done
+  '';
+}

From c0a33e111a91d94b563c6fa96c17722c55db938d Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Wed, 2 Apr 2025 05:52:23 -0400
Subject: [PATCH 2/9] fix: always require ACME email

---
 modules/forgejo/options.nix |  9 +--------
 modules/options.nix         | 10 +++++++---
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/modules/forgejo/options.nix b/modules/forgejo/options.nix
index 102255d..6a4d101 100644
--- a/modules/forgejo/options.nix
+++ b/modules/forgejo/options.nix
@@ -1,4 +1,4 @@
-args@{ config, lib, ... }:
+{ config, lib, ... }:
 {
   imports = [ ../options.nix ];
 
@@ -49,11 +49,4 @@ args@{ config, lib, ... }:
       };
     };
   };
-
-  config.assertions = lib.mkIf config.aether.https [
-    {
-      assertion = !(builtins.isNull config.aether.acmeEmail);
-      message = "HTTPS support requires providing a contact email";
-    }
-  ];
 }
diff --git a/modules/options.nix b/modules/options.nix
index a482a52..09ca8bd 100644
--- a/modules/options.nix
+++ b/modules/options.nix
@@ -9,13 +9,17 @@
     https = lib.mkOption {
       type = lib.types.boolByOr;
       default = true;
-      description = "Whether to force HTTPS connections for websites.";
+      description = ''
+        Whether to force HTTPS connections for websites.
+
+        This option is ignored if the service strictly requires HTTPS.
+      '';
     };
 
     acmeEmail = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
+      type = lib.types.str;
       default = null;
-      description = "Email address for ACME.";
+      description = "Email address to provide to the ACME service.";
     };
   };
 }

From b66ac7683bce3284411ba1de84a93e0a67e71474 Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Wed, 2 Apr 2025 05:55:01 -0400
Subject: [PATCH 3/9] feat: add mastodon module

---
 README.md                             | 18 ++++++++++--
 aether/config.nix                     | 11 ++++++-
 aether/mastodon/increase_limits.patch | 41 ++++++++++++++++++++++++++
 modules/mastodon/default.nix          | 37 +++++++++++++++++++++++
 modules/mastodon/options.nix          | 42 +++++++++++++++++++++++++++
 5 files changed, 146 insertions(+), 3 deletions(-)
 create mode 100644 aether/mastodon/increase_limits.patch
 create mode 100644 modules/mastodon/default.nix
 create mode 100644 modules/mastodon/options.nix

diff --git a/README.md b/README.md
index 7bda54c..60a3aeb 100644
--- a/README.md
+++ b/README.md
@@ -31,14 +31,28 @@ module has options, they can be found in the `options.nix` file inside the
 module directory. More general options used by multiple modules are documented
 in `modules/options.nix`.
 
-### Module Checklist
+### Modules
+
+Modules listed here may be unimplemented or unfinished.
+
+#### Basic
 
 - [x] `basic` - Basic Internet support
 - [x] `ssh` - SSH support
-- [ ] `site` - Static site hosting
 - [x] `fail2ban` - IP moderation
+
+#### Public Sites
+
+- [ ] `site` - Static site hosting
 - [x] `forgejo` - Code forge
+
+#### Social
+
+- [x] `mastodon` - Mastodon server instance
 - [ ] `mail` - Mail server
+
+#### Storage
+
 - [ ] `cachix` - Nix build caching
 - [ ] `backup` - Automated backup system
 
diff --git a/aether/config.nix b/aether/config.nix
index bc9b490..df8203a 100644
--- a/aether/config.nix
+++ b/aether/config.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, aether, forgejo-tokyo-night, ... }:
+{ pkgs, aether, forgejo-tokyo-night, ... }:
 {
   networking.hostName = "toki-aether";
   time.timeZone = "America/New_York";
@@ -65,5 +65,14 @@
     federation.ENABLED = true;
   };
 
+  aether.mastodon.subdomain = "social";
+  services.mastodon = {
+    package = pkgs.mastodon.override {
+      patches = [ ./mastodon/increase_limits.patch ];
+    };
+    extraConfig.SINGLE_USER_MODE = "true";
+    streamingProcesses = 3;
+  };
+
   system.stateVersion = "24.05";
 }
diff --git a/aether/mastodon/increase_limits.patch b/aether/mastodon/increase_limits.patch
new file mode 100644
index 0000000..33178e4
--- /dev/null
+++ b/aether/mastodon/increase_limits.patch
@@ -0,0 +1,41 @@
+diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
+index bda2edb..1be1ce2 100644
+--- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js
++++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
+@@ -28,7 +28,7 @@ const mapStateToProps = state => ({
+   anyMedia: state.getIn(['compose', 'media_attachments']).size > 0,
+   isInReply: state.getIn(['compose', 'in_reply_to']) !== null,
+   lang: state.getIn(['compose', 'language']),
+-  maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 500),
++  maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 1000000),
+ });
+ 
+ const mapDispatchToProps = (dispatch) => ({
+diff --git a/app/validators/poll_validator.rb b/app/validators/poll_validator.rb
+index a327277..5d3134d 100644
+--- a/app/validators/poll_validator.rb
++++ b/app/validators/poll_validator.rb
+@@ -1,8 +1,8 @@
+ # frozen_string_literal: true
+ 
+ class PollValidator < ActiveModel::Validator
+-  MAX_OPTIONS      = 4
+-  MAX_OPTION_CHARS = 50
++  MAX_OPTIONS      = 100
++  MAX_OPTION_CHARS = 1000
+   MAX_EXPIRATION   = 1.month.freeze
+   MIN_EXPIRATION   = 5.minutes.freeze
+ 
+diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
+index dc841de..f0f1b25 100644
+--- a/app/validators/status_length_validator.rb
++++ b/app/validators/status_length_validator.rb
+@@ -1,7 +1,7 @@
+ # frozen_string_literal: true
+ 
+ class StatusLengthValidator < ActiveModel::Validator
+-  MAX_CHARS = 500
++  MAX_CHARS = 1000000
+   URL_PLACEHOLDER_CHARS = 23
+   URL_PLACEHOLDER = 'x' * 23
+ 
diff --git a/modules/mastodon/default.nix b/modules/mastodon/default.nix
new file mode 100644
index 0000000..5b4495f
--- /dev/null
+++ b/modules/mastodon/default.nix
@@ -0,0 +1,37 @@
+{ config, lib, ... }:
+let
+  cfg = config.aether.mastodon;
+  mastodon = config.services.mastodon;
+
+  useSubdomain = !(builtins.isNull cfg.subdomain);
+  domain = lib.optionalString useSubdomain "${cfg.subdomain}."
+           + config.aether.domain;
+in {
+  imports = [ ./options.nix ];
+
+  services.mastodon = {
+    enable = true;
+    user = cfg.user;
+    group = mastodon.user;
+    localDomain = domain;
+    configureNginx = true;
+    smtp.fromAddress = cfg.email;
+  };
+
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = config.aether.acmeEmail;
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  users.users = lib.mkIf (cfg.createUser && mastodon.user != "mastodon") {
+    ${mastodon.user} = {
+      home = mastodon.package;
+      useDefaultShell = true;
+      group = mastodon.group;
+      isSystemUser = true;
+    };
+  };
+  users.groups = lib.mkIf (cfg.createUser && mastodon.group != "mastodon") {
+    ${mastodon.group} = {};
+  };
+}
diff --git a/modules/mastodon/options.nix b/modules/mastodon/options.nix
new file mode 100644
index 0000000..259df26
--- /dev/null
+++ b/modules/mastodon/options.nix
@@ -0,0 +1,42 @@
+{ config, lib, ... }:
+{
+  imports = [ ../options.nix ];
+
+  options.aether = {
+    mastodon = {
+      subdomain = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "mastodon";
+        description = ''
+          The subdomain to host Mastodon under.
+
+          If null, then Mastodon is hosted at the domain itself.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "mastodon";
+        description = ''
+          The user to run Mastodon with.
+        '';
+      };
+
+      createUser = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to create the Mastodon user automatically.
+        '';
+      };
+
+      email = lib.mkOption {
+        type = lib.types.str;
+        default = config.aether.acmeEmail;
+        description = ''
+          The email address used by Mastodon to send emails from.
+        '';
+      };
+    };
+  };
+}

From 69cefa72617e5f2f216daffebe98ee5482bc2712 Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Wed, 2 Apr 2025 05:56:55 -0400
Subject: [PATCH 4/9] chore: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0e34e11..c563597 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1736955230,
+        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1736344531,
-        "narHash": "sha256-8YVQ9ZbSfuUk2bUf2KRj60NRraLPKPS0Q4QFTbc+c2c=",
+        "lastModified": 1743448293,
+        "narHash": "sha256-bmEPmSjJakAp/JojZRrUvNcDX2R5/nuX6bm+seVaGhs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bffc22eb12172e6db3c5dde9e3e5628f8e3e7912",
+        "rev": "77b584d61ff80b4cef9245829a6f1dfad5afdfa3",
         "type": "github"
       },
       "original": {

From a48005eec46f9402b19d885c0a86baebca7c5d2c Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Wed, 2 Apr 2025 06:11:31 -0400
Subject: [PATCH 5/9] compat: update mastodon patches

---
 aether/mastodon/increase_limits.patch | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/aether/mastodon/increase_limits.patch b/aether/mastodon/increase_limits.patch
index 33178e4..bfef011 100644
--- a/aether/mastodon/increase_limits.patch
+++ b/aether/mastodon/increase_limits.patch
@@ -11,21 +11,21 @@ index bda2edb..1be1ce2 100644
  });
  
  const mapDispatchToProps = (dispatch) => ({
-diff --git a/app/validators/poll_validator.rb b/app/validators/poll_validator.rb
-index a327277..5d3134d 100644
---- a/app/validators/poll_validator.rb
-+++ b/app/validators/poll_validator.rb
+diff --git a/app/validators/poll_options_validator.rb b/app/validators/poll_options_validator.rb
+index 0ac84f9..9393de8 100644
+--- a/app/validators/poll_options_validator.rb
++++ b/app/validators/poll_options_validator.rb
 @@ -1,8 +1,8 @@
  # frozen_string_literal: true
  
- class PollValidator < ActiveModel::Validator
+ class PollOptionsValidator < ActiveModel::Validator
 -  MAX_OPTIONS      = 4
 -  MAX_OPTION_CHARS = 50
 +  MAX_OPTIONS      = 100
-+  MAX_OPTION_CHARS = 1000
-   MAX_EXPIRATION   = 1.month.freeze
-   MIN_EXPIRATION   = 5.minutes.freeze
++  MAX_OPTION_CHARS = 500
  
+   def validate(poll)
+     poll.errors.add(:options, I18n.t('polls.errors.too_few_options')) unless poll.options.size > 1
 diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
 index dc841de..f0f1b25 100644
 --- a/app/validators/status_length_validator.rb

From 7501370ae92a9f18946e6096d056fda8ef4afd7b Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Sun, 6 Apr 2025 02:33:03 -0400
Subject: [PATCH 6/9] refactor(deploy-rpi5): switch to `nixos-hardware` module

---
 deploy/rpi5/default.nix | 20 +++-----------
 flake.lock              | 60 ++++++++++++++---------------------------
 flake.nix               | 17 +++++-------
 3 files changed, 30 insertions(+), 67 deletions(-)

diff --git a/deploy/rpi5/default.nix b/deploy/rpi5/default.nix
index 8a3cfbf..502ae6c 100644
--- a/deploy/rpi5/default.nix
+++ b/deploy/rpi5/default.nix
@@ -1,20 +1,6 @@
 { config, lib, ... }:
 {
-  options.aether.deploy.rpi5 = {
-    _internal.kernelPackages = lib.mkOption {
-      type = lib.types.raw;
-      description = ''
-        Kernel package to use for Raspberry Pi 5 support.
-      '';
-    };
-  };
-
-  config =
-    let cfg = config.aether.deploy.rpi5;
-    in {
-      nixpkgs.system = "aarch64-linux";
-      boot.kernelPackages = cfg._internal.kernelPackages;
-      boot.loader.systemd-boot.enable = true;
-      boot.loader.efi.canTouchEfiVariables = false;
-    };
+  nixpkgs.system = "aarch64-linux";
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
 }
diff --git a/flake.lock b/flake.lock
index c563597..899858d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -23,20 +23,6 @@
         "type": "github"
       }
     },
-    "flake-compat": {
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "revCount": 57,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
-      }
-    },
     "forgejo-tokyo-night": {
       "flake": false,
       "locked": {
@@ -72,13 +58,28 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1743420942,
+        "narHash": "sha256-b/exDDQSLmENZZgbAEI3qi9yHkuXAXCPbormD8CSJXo=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "de6fc5551121c59c01e2a3d45b277a6d05077bc4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743448293,
-        "narHash": "sha256-bmEPmSjJakAp/JojZRrUvNcDX2R5/nuX6bm+seVaGhs=",
+        "lastModified": 1743583204,
+        "narHash": "sha256-F7n4+KOIfWrwoQjXrL2wD9RhFYLs2/GGe/MQY1sSdlE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "77b584d61ff80b4cef9245829a6f1dfad5afdfa3",
+        "rev": "2c8d3f48d33929642c1c12cd243df4cc7d2ce434",
         "type": "github"
       },
       "original": {
@@ -92,29 +93,8 @@
       "inputs": {
         "agenix": "agenix",
         "forgejo-tokyo-night": "forgejo-tokyo-night",
-        "nixpkgs": "nixpkgs",
-        "rpi5-kernel": "rpi5-kernel"
-      }
-    },
-    "rpi5-kernel": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1704485878,
-        "narHash": "sha256-i7UH31IZyil99EUB5qnQJAiszFkea1B1yZf5pQEDIYg=",
-        "owner": "vriska",
-        "repo": "nix-rpi5",
-        "rev": "ac9942532e1dc2f825ad2aa3a6d31bfbd3b42eed",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "vriska",
-        "repo": "nix-rpi5",
-        "type": "gitlab"
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index bd59b40..24356df 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,9 +3,7 @@ description = "Aether - web server configuration";
 
 inputs = {
   nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-  
-  rpi5-kernel.url = "gitlab:vriska/nix-rpi5";
-  rpi5-kernel.inputs.nixpkgs.follows = "nixpkgs";
+  nixos-hardware.url = "github:NixOS/nixos-hardware";
 
   agenix.url = "github:ryantm/agenix";
   agenix.inputs.nixpkgs.follows = "nixpkgs";
@@ -15,7 +13,7 @@ inputs = {
   forgejo-tokyo-night.flake = false;
 };
 
-outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, ... }:
+outputs = inputs@{ self, nixpkgs, nixos-hardware, agenix, ... }:
   let
     inherit (nixpkgs) lib;
 
@@ -23,8 +21,7 @@ outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, ... }:
     # (Mostly used for injecting flake inputs)
     extraConfig = {
       deploy-rpi5 = {
-        aether.deploy.rpi5._internal.kernelPackages = lib.mkDefault
-          rpi5-kernel.legacyPackages.aarch64-linux.linuxPackages_rpi5;
+        imports = [ nixos-hardware.nixosModules.raspberry-pi-5 ];
       };
     };
 
@@ -47,11 +44,11 @@ outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, ... }:
       (name: ./deploy/${lib.removePrefix "deploy-" name});
 
     modulesWithCfg = builtins.mapAttrs (k: v: {
-      imports = [ v ];
-    } // extraConfig.${k} or {}) modules;
+      imports = [ v (extraConfig.${k} or {}) ];
+    }) modules;
     deploymentsWithCfg = builtins.mapAttrs (k: v: {
-      imports = [ v ];
-    } // extraConfig.${k} or {}) deployments;
+      imports = [ v (extraConfig.${k} or {}) ];
+    }) deployments;
   in {
     nixosModules =
       modulesWithCfg // deploymentsWithCfg // {

From 59a300c376e48ebbc739f09e8a4c99039211a304 Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Sun, 6 Apr 2025 02:33:38 -0400
Subject: [PATCH 7/9] chore: modify SSH key

---
 aether/secrets/secrets.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/aether/secrets/secrets.nix b/aether/secrets/secrets.nix
index d078f3d..42b10f4 100644
--- a/aether/secrets/secrets.nix
+++ b/aether/secrets/secrets.nix
@@ -9,14 +9,14 @@ let
     "EtbDcTMZ8qF0JKgVjir6X1hPxodDEiXy4XTGqqDKpyqwhMSPmTdgQFCeJEOrPhSc85vB6SJ" +
     "dVSC7YVRqIDpebiWFelen1PwsAMdL09bQKA2R3GMqJN/n6XlapKf8U= kiana@toki-earth";
   fire-key =
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDemOeWGP40M495KAuylZfRHXKKr9av0QH" +
-    "YjQwuG5EKzoy+KH0EAtBM3MbDLX5+bCd4O4oB9H/ZWxDZFfaitTPf1nrBMA89GWAxiGwVT3" +
-    "U2kQL2KUIP9rXjH/KLwocqnqsljRka1McF0mijtpMhNR0jpXAOfZboHFWRE07kRacvXmhkl" +
-    "tcJhXiCGMYmUfFT/HroxSgV+1BM9csYItzHlHFhoB2laEQOoTE5jLxkTkqZ55W0V9QUlM1N" +
-    "830fvhv9z/I6PQcIPXttB4nm+339r2qA3qncRkF7j0+JIXbUkIxK7nQhv25EyFUS8WplnI7" +
-    "mbb2T9JWVeLsAO24WrAApbPxmu+ItKq003Qi4a/0+v6D2PCXm+YoxJlM5aHh8FZdXoIhMv7" +
-    "6j3lk0P0sN9Sr09gjoWkV+/rSN+3ZLCJBGS5a3LpBk3HC2ZP/mvfsd1LTDhYQBJSW0LiBZO" +
-    "5aRuKZrTbyY9+i75cTWjnJuvZyBDn3giSYMiVhIAcZg5dU0ySG4M28= kiana@toki-fire";
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDpUgBuz7ti5ZVhkfr3s3EDWnPsZTplntF" +
+    "D1rEudrs1RnJV/XtG9iIiI9L0BSyyMcAMNLVhw+IJmBzTH5PS8ZWZ6vTDXMgu+6FYohyGhI" +
+    "nLtqNxAnrAJj/j6RrIWqNVTk6cPW6R7WJ+DHiV0Vvin5yTBT0liBq6OcI0gnmgMD2mVMEYc" +
+    "lgaWdGscJxpm5Kk6sCOMjTqxgQD2S6aUM27JhO2ESKj/iXmwoXWOnVN11ULP+4zcKPJ2rE/" +
+    "c/V6l/vIIvrXhKlhWpAl7m7+mhsvUVlfBAJwf2zqFVENNt48pAdchCzU9BOdvUabEyLtHkt" +
+    "GzygZi8oYYjlnjShf+CwfKBk4Zu1GVKs50V9jnpnNjUwkcddky4B72BgMs88XCgx0sVdfod" +
+    "fU7ngMnv/UV4YrzJ4vItLJ5hxq+pnytG33/y3JCOe8/xSk3za83S5dVr5cML7H1Hn0V1g0e" +
+    "apeWJD+iTHMQ6DnwLC8rCCt9wof0b+IB6IOlTUD6XzgaLcjLOxWMcE= kiana@toki-fire";
   keys = [ earth-key fire-key ];
 in {
   inherit keys;

From 3990a012ae1aaad765eda7122653c274cb18eb32 Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Wed, 8 Oct 2025 23:08:45 -0400
Subject: [PATCH 8/9] tweak: disable mastodon module

---
 aether/config.nix | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/aether/config.nix b/aether/config.nix
index df8203a..8db7488 100644
--- a/aether/config.nix
+++ b/aether/config.nix
@@ -23,13 +23,19 @@
   # Aether modules
 
   imports = [
-    aether.all
     aether.deploy-rpi5
+
+    aether.basic
+    aether.fail2ban
+    aether.forgejo
+    aether.ssh
   ];
 
   aether.domain = "tokinanpa.dev";
   aether.acmeEmail = "kiana.a.sheibani@gmail.com";
 
+  # Forgejo
+
   aether.forgejo.theme = "${forgejo-tokyo-night}/public/assets";
   aether.forgejo.templates = ./forgejo-templates;
   services.forgejo.settings = {
@@ -65,14 +71,16 @@
     federation.ENABLED = true;
   };
 
-  aether.mastodon.subdomain = "social";
-  services.mastodon = {
-    package = pkgs.mastodon.override {
-      patches = [ ./mastodon/increase_limits.patch ];
-    };
-    extraConfig.SINGLE_USER_MODE = "true";
-    streamingProcesses = 3;
-  };
+  # Mastodon
+
+  # aether.mastodon.subdomain = "social";
+  # services.mastodon = {
+  #   package = pkgs.mastodon.override {
+  #     patches = [ ./mastodon/increase_limits.patch ];
+  #   };
+  #   extraConfig.SINGLE_USER_MODE = "true";
+  #   streamingProcesses = 3;
+  # };
 
   system.stateVersion = "24.05";
 }

From 108ab3fd4f795724cbedede33bb9606df64b3205 Mon Sep 17 00:00:00 2001
From: Kiana Sheibani <kiana.a.sheibani@gmail.com>
Date: Wed, 8 Oct 2025 23:09:53 -0400
Subject: [PATCH 9/9] chore: bump inputs

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 899858d..76e19ea 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1736955230,
-        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
+        "lastModified": 1754433428,
+        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
+        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
         "type": "github"
       },
       "original": {
@@ -45,11 +45,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703113217,
-        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
         "type": "github"
       },
       "original": {
@@ -60,11 +60,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1743420942,
-        "narHash": "sha256-b/exDDQSLmENZZgbAEI3qi9yHkuXAXCPbormD8CSJXo=",
+        "lastModified": 1759582739,
+        "narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "de6fc5551121c59c01e2a3d45b277a6d05077bc4",
+        "rev": "3441b5242af7577230a78ffb03542add264179ab",
         "type": "github"
       },
       "original": {
@@ -75,11 +75,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743583204,
-        "narHash": "sha256-F7n4+KOIfWrwoQjXrL2wD9RhFYLs2/GGe/MQY1sSdlE=",
+        "lastModified": 1759831965,
+        "narHash": "sha256-vgPm2xjOmKdZ0xKA6yLXPJpjOtQPHfaZDRtH+47XEBo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2c8d3f48d33929642c1c12cd243df4cc7d2ce434",
+        "rev": "c9b6fb798541223bbb396d287d16f43520250518",
         "type": "github"
       },
       "original": {