7 files changed, 27 insertions, 30 deletions
diff --git a/nix/writeElispBin/default.nix b/nix/writeElispBin/default.nix
index e23c55a0a4..ee3dc7a3ed 100644
--- a/nix/writeElispBin/default.nix
+++ b/nix/writeElispBin/default.nix
@@ -1,6 +1,6 @@
 { depot, pkgs, ... }:
 
-{ name, src, deps ? (_: [ ]), emacs ? pkgs.emacs27-nox }:
+{ name, src, deps ? (_: [ ]), emacs ? pkgs.emacs28-nox }:
 
 let
   inherit (pkgs) emacsPackages emacsPackagesFor;
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix
index 3fc708e690..5de8481878 100644
--- a/ops/machines/whitby/default.nix
+++ b/ops/machines/whitby/default.nix
@@ -604,25 +604,18 @@ in
   services.keycloak = {
     enable = true;
     httpPort = "5925"; # "kycl"
-    frontendUrl = "https://auth.tvl.fyi/auth/";
+
+    settings = {
+      hostname = "auth.tvl.fyi";
+      http-relative-path = "/auth";
+      proxy = "edge";
+    };
 
     database = {
       type = "postgresql";
       passwordFile = "/run/agenix/keycloak-db";
       createLocally = false;
     };
-
-    # Configure Keycloak to look at forwarded headers from the reverse
-    # proxy.
-    extraConfig = {
-      "subsystem=undertow" = {
-        "server=default-server" = {
-          "http-listener=default" = {
-            proxy-address-forwarding = "true";
-          };
-        };
-      };
-    };
   };
 
   # Allow Keycloak access to the LDAP module by forcing in the JVM
diff --git a/third_party/nixpkgs/default.nix b/third_party/nixpkgs/default.nix
index a260fdef4f..0f388df694 100644
--- a/third_party/nixpkgs/default.nix
+++ b/third_party/nixpkgs/default.nix
@@ -31,6 +31,10 @@ let
     # This is too hard to debug right now, let’s hope somebody else solves it for us.
     alacritty-stable = stableNixpkgs.alacritty;
 
+    # emacs27 is gone from unstable, but people should upgrade at
+    # their own pace.
+    emacs27 = builtins.trace "emacs27 is deprecated, please migrate to emacs28"
+      stableNixpkgs.emacs27;
   };
 
   # Overlay to expose the nixpkgs commits we are using to other Nix code.
diff --git a/third_party/sources/sources.json b/third_party/sources/sources.json
index 1dbce752c0..441a88048d 100644
--- a/third_party/sources/sources.json
+++ b/third_party/sources/sources.json
@@ -5,10 +5,10 @@
         "homepage": "",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "d0ef2cfa729bab6adacf6461d48a4fb83618c047",
-        "sha256": "0lbbnv28jaiswxxbnn4w8fgcp55zlppf6h7zfkwwwpr55fxp6nfb",
+        "rev": "34d35051f15a98eddc78378e31ebbf9a82fc1f47",
+        "sha256": "083j3nc0slzblmgaw89bmz3498gc9ixqlrmv0vry7z5z49cwk337",
         "type": "tarball",
-        "url": "https://github.com/nix-community/emacs-overlay/archive/d0ef2cfa729bab6adacf6461d48a4fb83618c047.tar.gz",
+        "url": "https://github.com/nix-community/emacs-overlay/archive/34d35051f15a98eddc78378e31ebbf9a82fc1f47.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixpkgs": {
@@ -17,10 +17,10 @@
         "homepage": "",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5181d5945eda382ff6a9ca3e072ed6ea9b547fee",
-        "sha256": "1hljcdmvl2kwlq68pyhlc2g5dswdgb6by9m1pppcdm3a86fhinvh",
+        "rev": "1ffba9f2f683063c2b14c9f4d12c55ad5f4ed887",
+        "sha256": "1zx5zvpvqrgk5mfxzmwf8gd270lz7dkfk563sccp1xlhac15cipg",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/5181d5945eda382ff6a9ca3e072ed6ea9b547fee.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/1ffba9f2f683063c2b14c9f4d12c55ad5f4ed887.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixpkgs-stable": {
@@ -29,10 +29,10 @@
         "homepage": "",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2f06b87f64bc06229e05045853e0876666e1b023",
-        "sha256": "1d7zg96xw4qsqh7c89pgha9wkq3rbi9as3k3d88jlxy2z0ns0cy2",
+        "rev": "9887f024766aa27704d1f89f623efd1d063da92a",
+        "sha256": "07fgr087sir8ra1v9icp2011f1s2iqlclyinxy0jrlawyz9rz4h2",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/2f06b87f64bc06229e05045853e0876666e1b023.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/9887f024766aa27704d1f89f623efd1d063da92a.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "rustsec-advisory-db": {
@@ -41,10 +41,10 @@
         "homepage": "https://rustsec.org",
         "owner": "RustSec",
         "repo": "advisory-db",
-        "rev": "ce150ef8cbed58f21f235c267cd5f501ffa56756",
-        "sha256": "11fmzfnawg2prjl4s8z1p7xans3pnpb4gy91v0qcq3fskhsldahr",
+        "rev": "b2ba503c747d041d02eeef6b9477664aefcc97fb",
+        "sha256": "1dkx8mz8bpxqf750ckhmpa4xjr29b8x8xrydw770lfnd4k3nhxj6",
         "type": "tarball",
-        "url": "https://github.com/RustSec/advisory-db/archive/ce150ef8cbed58f21f235c267cd5f501ffa56756.tar.gz",
+        "url": "https://github.com/RustSec/advisory-db/archive/b2ba503c747d041d02eeef6b9477664aefcc97fb.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }
diff --git a/users/tazjin/nixos/camden/default.nix b/users/tazjin/nixos/camden/default.nix
index b8b8e25fc3..4f046d8ec1 100644
--- a/users/tazjin/nixos/camden/default.nix
+++ b/users/tazjin/nixos/camden/default.nix
@@ -138,7 +138,7 @@ lib.fix (self: {
       bat
       curl
       direnv
-      emacs27-nox
+      emacs28-nox
       fswebcam
       git
       gnupg
diff --git a/users/tazjin/nixos/frog/default.nix b/users/tazjin/nixos/frog/default.nix
index 8e356dd41e..6a9848fbe0 100644
--- a/users/tazjin/nixos/frog/default.nix
+++ b/users/tazjin/nixos/frog/default.nix
@@ -227,7 +227,7 @@ lib.fix (self: {
       curl
       direnv
       dnsutils
-      emacs27 # mostly for emacsclient
+      emacs28 # mostly for emacsclient
       exa
       fd
       file
diff --git a/users/wpcarro/emacs/default.nix b/users/wpcarro/emacs/default.nix
index 2353643326..d445644800 100644
--- a/users/wpcarro/emacs/default.nix
+++ b/users/wpcarro/emacs/default.nix
@@ -3,7 +3,7 @@
 # TODO(wpcarro): See if it's possible to expose emacsclient on PATH, so that I
 # don't need to depend on wpcarros-emacs and emacs in my NixOS configurations.
 let
-  inherit (depot.third_party.nixpkgs) emacsPackagesFor emacs27;
+  inherit (depot.third_party.nixpkgs) emacsPackagesFor emacs28;
   inherit (depot.users) wpcarro;
   inherit (lib) mapAttrsToList;
   inherit (lib.strings) concatStringsSep makeBinPath;
@@ -21,7 +21,7 @@ let
     ])
   );
 
-  emacsWithPackages = (emacsPackagesFor emacs27).emacsWithPackages;
+  emacsWithPackages = (emacsPackagesFor emacs28).emacsWithPackages;
 
   wpcarrosEmacs = emacsWithPackages (epkgs:
     (with epkgs.tvlPackages; [