add missing token

flake.nix

@@ -23,7 +23,8 @@
     in
     {
       formatter.${system} = pkgs.nixfmt-tree;
-      apps.nixos-diff = {
+      apps = {
+        nixos-diff = {
           type = "app";
           program = "${pkgs.writeShellScript "nixos-diff.sh" ''
             ${pkgs.git}/bin/git checkout flake.lock
@@ -33,6 +34,19 @@
             ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
           ''}";
         };
+        deploy = {
+          type = "app";
+          program = "${pkgs.writeShellScript "deploy.sh" ''
+            set -e
+            host="''${1:?usage: nix run .#apps.deploy -- <host>}"
+            ${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
+            set -e
+            cd /etc/nixos
+            nix run .#apps.nixos-diff && nixos-rebuild switch
+            EOF
+          ''}";
+        };
+      };
       devShells.${system}.default = pkgs.mkShell {
         packages = [
           (agenix.packages.${system}.default)
@@ -256,6 +270,12 @@
                 group = "forgejo";
                 mode = "0440";
               };
+              forgejo-oauth2-jwt-token = {
+                file = ./secrets/forgejo-oauth2-jwt-token.age;
+                owner = "forgejo";
+                group = "forgejo";
+                mode = "0440";
+              };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
                 owner = "root";