update to nixos 25.11

nix/apps/does-it-build/default.nix

@@ -1,8 +1,7 @@
-{ pkgs, nixpkgs-next, lib, config, my-projects-versions, ... }:
+{ pkgs, lib, config, my-projects-versions, ... }:
 let
   does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) {
-    # needs a recent rust version.
-    pkgs = nixpkgs-next;
+    inherit pkgs;
   };
   does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: {
     DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build.commit;

nix/apps/matrix/default.nix

@@ -0,0 +1,36 @@
+{ pkgs, ... }: {
+  services.matrix-continuwuity = {
+    enable = true;
+    settings = {
+      global = {
+        server_name = "noratrieb.dev";
+        allow_registration = false;
+        allow_encryption = true;
+        allow_federation = true;
+        trusted_servers = [ "matrix.org" ];
+        well_known = {
+          server = "matrix.noratrieb.dev:443";
+          client = "https://matrix.noratrieb.dev";
+          support_page = "https://noratrieb.dev";
+        };
+      };
+    };
+  };
+  environment.systemPackages = [ pkgs.matrix-continuwuity ];
+  services.caddy.virtualHosts."matrix.noratrieb.dev" = {
+    extraConfig = ''
+      encode zstd gzip
+
+      reverse_proxy * http://localhost:6167
+    '';
+  };
+  services.caddy.virtualHosts."matrix.noratrieb.dev:8448" = {
+    extraConfig = ''
+      encode zstd gzip
+
+      reverse_proxy * http://localhost:6167
+    '';
+  };
+  networking.firewall.allowedTCPPorts = [ 8448 ];
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 6167 ];
+}

nix/apps/website/default.nix

@@ -12,6 +12,12 @@
       logFormat = "";
       extraConfig = ''
         encode zstd gzip
+
+        reverse_proxy /.well-known/matrix/* https://matrix.noratrieb.dev {
+          header_up Host matrix.noratrieb.dev
+        }
+        
+
         header -Last-Modified
 
         header /blog/css/* Cache-Control "max-age=31540000, immutable"

nix/hive.nix

@@ -2,8 +2,7 @@
   meta =
     let
       nixpkgs-version = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
-      nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.05".commit}.tar.gz");
-      nixpkgs-next = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.11".commit}.tar.gz") { };
+      nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.11".commit}.tar.gz");
     in
     {
       # Override to pin the Nixpkgs version (recommended). This option
@@ -16,7 +15,6 @@
       specialArgs = {
         my-projects-versions = builtins.fromJSON (builtins.readFile ./my-projects.json);
 
-        inherit nixpkgs-next;
         inherit nixpkgs-path;
 
         networkingConfig = {
@@ -205,6 +203,9 @@
       ./modules/caddy
       ./modules/garage
       ./modules/snowflake-proxy
+
+      # apps
+      ./apps/matrix
     ];
 
     system.stateVersion = "23.11";

nix/modules/caddy/default.nix

@@ -6,7 +6,7 @@ let
       "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
     ];
-    hash = "sha256-onWUF2Ecd+LFprqY52U1AEvKhBIwKmI6eibeK03LpWM=";
+    hash = "sha256-ERccS8hBcjttV92MgJkgLBNY1RWRztYujby80MH52Xo=";
   };
 in
 {

nix/modules/dns/noratrieb.dev.nix

@@ -63,6 +63,8 @@ let
 
         garage = combine [ vps1 vps2 vps3 vps4 ];
 
+        matrix = vps2;
+
         # --- apps
         docker = vps1;
         hugo-chat = vps1 // {

nix/modules/garage/default.nix

@@ -20,7 +20,7 @@ in
   };
   services.garage = {
     enable = true;
-    package = pkgs.garage_2_1_0;
+    package = pkgs.garage_2;
     settings = {
       metadata_dir = "/var/lib/garage/meta";
       data_dir = "/var/lib/garage/data";

nix/nixpkgs.json

@@ -1,10 +1,6 @@
 {
-  "nixos-25.05": {
-    "lastUpdated": "2026-01-31T13:55:04.757Z",
-    "commit": "ac62194c3917d5f474c1a844b6fd6da2db95077d"
-  },
   "nixos-25.11": {
-    "lastUpdated": "2026-01-31T13:55:04.922Z",
-    "commit": "fa83fd837f3098e3e678e6cf017b2b36102c7211"
+    "lastUpdated": "2026-02-14T15:07:37.351Z",
+    "commit": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a"
   }
 }