The centralized-only garage policy in `hosts-common.nix` (`hosting-provider`
apex + `tenant = group`, both `mkDefault`) dropped the local-identity path
that the incus tests rely on via the shared `incusModel`. `apps-tf`'s
pixelfed then requested a `<group>-pixelfed` bucket at the centralized apex
that the co-located local `garage` ancilliary never creates, so its S3 setup
stalled and nginx never served :443 (1800s timeout).

Override `external.garage` back to the local identity path in `incusModel`,
mirroring the single-app `test-*-service` checks: `tenant = ""` keeps
bucket/key names un-prefixed and `domain` points at the node's own
`garage.localhost`.

Verified: `apps-tf` green on fediversity-ci (1208.77s, pixelfed reaches :443).

Assisted-by: Claude:claude-opus-4-8

@@ -350,4 +409,0 @@
-                  restoreCmd = ''
-                    tee /var/lib/redis-mastodon/dump.rdb > /dev/null
-                  '';
-                };

@@ -0,0 +5,4 @@
+}:
+{
+  applications.valkey = {
+    description = "The group's valkey cache node (the `external` redis provider's daemon): one `valkey@<namespace>` instance per redis-routed application in its group, each on its own namespace-derived port. Isolation is physical (one process per namespace). Each instance's bootstrap password is generated here; the central OpenBao valkey-database engine rotates the per-instance `app` user.";

@@ -0,0 +51,4 @@
+
+  qemuNodeMemory = 2048;
+  requiredMemory =
+    lib.throwIf (2560 < qemuNodeMemory)

@@ -0,0 +36,4 @@
+## `ssl` cross-node-trust machinery (`security.pki.certificateFiles`).
+##
+## FUTURE: self-signed is a stop-gap. Prefer OpenBao's PKI secrets engine as a
+## proper internal CA once that is stood up.

@@ -21,0 +25,4 @@
+  # preferred future CA). When on, the engine connects over TLS and trusts the
+  # valkey cert via `valkeyCaCert`.
+  valkeyTls = config.services.openbao-spire-auth.valkeyTls;
+  valkeyCaCert = config.services.openbao-spire-auth.valkeyCaCert;

@@ -340,1 +411,4 @@
               contracts.streamingBackup.defaultProviderName = "restic";
+              # The redis cache moved to the shared valkey node (persisted there
+              # via RDB/AOF; offsite backup deferred to operator-side garage /
+              # #911), so it is no longer backed up per-app here -- only postgres.

@@ -165,3 +165,3 @@
     #   raise Exception("cannot detect the uploaded image on mastodon page.")
 
-for db in ["redis", "postgres"]:
+for db in ["postgres"]:

@@ -88,4 +91,0 @@
-        };
-        # Use self-signed certs in tests; the `ssl` resource's `applicationSide`
-        # (wired in `hosts-common.nix`) owns the provider and nginx cert/key.
-        environments.garage.resources."tls".ssl.routing.contracts.ssl.defaultProviderName = "self-signed";

@@ -0,0 +31,4 @@
+    "mastodon"
+    "peertube"
+    "pixelfed"
+  ];

@@ -0,0 +4,4 @@
+## *outside* any single operator's knowledge (in the hosting-provider group, like
+## openbao), so from an operator's vantage point the cache is an external service
+## it is merely pointed at. This provider holds none of the daemon: it is a pure
+## cross-node function of static facts.

@@ -0,0 +89,4 @@
+    "uni-mastodon" = 7012;
+    "uni-peertube" = 6906;
+    "uni-pixelfed" = 7251;
+  };