buna machine

clanService/phonebox: asterisk restart core when extensions.conf changed
adhil machine
2025-12-10 13:14:14 +07:00 · 2025-12-10 13:01:31 +07:00 · 2025-12-10 11:38:03 +07:00 · 2025-12-10 11:08:12 +07:00 · 2025-12-10 11:06:52 +07:00 · 2025-12-01 00:00:00 +00:00
129 changed files with 7810 additions and 7 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -20,7 +20,7 @@
        ]
      },
      "locked": {
-        "lastModified": 1764792743,
+        "lastModified": 1764799743,
        "narHash": "sha256-MbbiNG/bhqe+4z7ml8TefIs4swSonmiV0CimCntXuCg=",
        "ref": "refs/heads/main",
        "rev": "ddc0f9fabf33ad000676a33e97be6b5df12a4560",
--- a/flake.nix
+++ b/flake.nix
@@ -44,9 +44,24 @@
          ./machines
          ./routers
          ./inventories
+          ./overlays
+          ./tests
          ./modules/clan/flake-module.nix
          ./modules/nixos/flake-module.nix
        ];
+        perSystem =
+          { pkgs, system, ... }:
+          {
+            _module.args.pkgs = import inputs.nixpkgs {
+              inherit system;
+              overlays = [
+                inputs.self.overlays.packagesOverlay
+              ];
+              config = { };
+            };
+            packages.think = pkgs.think-gtcm;
+            packages.think-be = pkgs.think-backend-gtcm;
+          };
      }
    );
 }
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -16,6 +16,10 @@
          "neptune"
          "rigel"
          "almach"
+          "alpheratz"
+          "mirach"
+          "adhil"
+          "buna"
        ];
      };

@@ -102,6 +106,9 @@
            input = "self";
          };
          roles.default.tags."phonebox" = { };
+          roles.default.machines."adhil".settings = {
+            ata-ethernet-iface = "end0";
+          };
        };

        pocket-id = {
@@ -167,6 +174,32 @@
          };
          roles.default.machines.b4l = { };
        };
+        pulse-stream = {
+          module = {
+            name = "pulse-stream";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.client-ip-ranges = [
+              "10.0.0.0/24"
+            ];
+          };
+        };
+        jukebox = {
+          module = {
+            name = "jukebox";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings = {
+              binds = [ "wlp1s0" ];
+              disks.m3 = {
+                uuid = "105D-319E";
+                mountOptions = [ "utf8" ];
+              };
+            };
+          };
+        };
      };
    };
  };
--- a/inventory.json
+++ b/inventory.json
@@ -14,6 +14,12 @@
    },
    "neptune": {
      "installedAt": 1762147067
+    },
+    "adhil": {
+      "installedAt": 1765277591
+    },
+    "buna": {
+      "installedAt": 1765343708
    }
  }
-}
+}
--- a/machines/adhil/configuration.nix
+++ b/machines/adhil/configuration.nix
@@ -0,0 +1,13 @@
+{ ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "aarch64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.meta.name = "adhil";
+  clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
+
+}
--- a/machines/adhil/disko.nix
+++ b/machines/adhil/disko.nix
@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-SD64G_0xfb330ff6";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/adhil/facter.json
+++ b/machines/adhil/facter.json
--- a/machines/b4l/configuration.nix
+++ b/machines/b4l/configuration.nix
@@ -19,4 +19,18 @@
  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    enableACME = true;
  };
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
 }
--- a/machines/buna/configuration.nix
+++ b/machines/buna/configuration.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.meta.name = "buna";
+  clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
+
+}
--- a/machines/buna/disko.nix
+++ b/machines/buna/disko.nix
@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/usb-Generic_MassStorageClass_000000001539-0:0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/buna/facter.json
+++ b/machines/buna/facter.json
--- a/machines/neptune/configuration.nix
+++ b/machines/neptune/configuration.nix
@@ -1,4 +1,9 @@
-{ inputs, config, ... }:
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
 {
  nixpkgs.hostPlatform = {
    system = "x86_64-linux";
@@ -7,7 +12,51 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";

+  networking.interfaces.enx00e04c106368.useDHCP = true; # recovery
+
+  clan.core.vars.generators.wireless-credentials = {
+    files = {
+      essid.secret = false;
+      psk.secret = true;
+    };
+    prompts = {
+      essid.persist = true;
+      psk.persist = true;
+    };
+    script = ''
+      cat "$prompts"/essid > $out/essid
+      prompt_psk=$(cat "$prompts"/psk)
+      echo "psk=$prompt_psk" > $out/psk
+    '';
+  };
+
+  networking.wireless =
+    let
+      credentials = config.clan.core.vars.generators.wireless-credentials.files;
+    in
+    {
+      enable = true;
+      secretsFile = credentials.psk.path;
+      networks.${credentials.essid.value}.pskRaw = "ext:psk";
+    };
+
+  networking.interfaces.wlp1s0 = {
+    useDHCP = false;
+    ipv4.addresses = [
+      {
+        address = "10.0.0.9";
+        prefixLength = 24;
+      }
+    ];
+  };
+
+  services.yggdrasil.settings.Peers = lib.mkForce [
+    "tcp://newt.barry.town:1337"
+    "tls://yg-hkg.magicum.net:32333"
+    "tls://astrra.space:55535"
+  ];
+
  clan.meta.name = "neptune";
-  clan.meta.description = "Radxa SBC board for testing.";
+  clan.meta.description = "Radxa SBC board for testing. (With vi)";

 }
--- a/machines/ramus/configuration.nix
+++ b/machines/ramus/configuration.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ self, config, ... }:
 {
  system.stateVersion = "25.11";
  nixpkgs.hostPlatform = {
@@ -12,4 +12,24 @@

  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
+
+  users.users.nginx.extraGroups = [ "acme" ];
+
+  security.acme.acceptTerms = true;
+
+  imports = [ ./think-greater-chiangmai.nix ];
 }
--- a/machines/ramus/think-greater-chiangmai.nix
+++ b/machines/ramus/think-greater-chiangmai.nix
@@ -0,0 +1,136 @@
+{ self, config, ... }:
+let
+  commonSettings = {
+    APP_NAME = "Laravel";
+    APP_ENV = "local";
+    APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
+    APP_DEBUG = "false";
+    APP_URL = "http://localhost";
+
+    DB_CONNECTION = "mysql";
+    DB_HOST = "localhost";
+    DB_PORT = 3306;
+    DB_DATABASE = "thinkgtcm";
+    DB_USERNAME = "gtcm";
+
+    R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
+    R2_SECRET_ACCESS_KEY._secret =
+      config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
+    R2_REGION = config.clan.core.vars.generators.greaterchiangmai-s3.files.region.value;
+    R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
+    R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;
+
+    LOG_CHANNEL = "stack";
+    LOG_LEVEL = "debug";
+
+    FILESYSTEM_DISK = "local";
+
+    BROADCAST_DRIVER = "log";
+    CACHE_DRIVER = "file";
+    QUEUE_CONNECTION = "sync";
+    SESSION_DRIVER = "file";
+    SESSION_LIFETIME = 120;
+
+    MEMCACHED_HOST = "127.0.0.1";
+
+    REDIS_HOST = "127.0.0.1";
+    REDIS_PORT = 6379;
+
+    UPLOAD_MAX_FILESIZE = "5000M";
+    POST_MAX_SIZE = "5000M";
+
+    TEST_LOCAL = true;
+  };
+
+  baseDomain = "greaterchiangmai.com";
+  domain = "think.${baseDomain}";
+  domainBackend = "think-backend.${baseDomain}";
+in
+{
+  imports = [
+    self.nixosModules.think-gtcm
+    self.nixosModules.think-backend-gtcm
+  ];
+  nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+
+  clan.core.vars.generators.greaterchiangmai = {
+    files = {
+      app_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+    };
+
+    prompts = {
+      app_key.persist = true;
+    };
+
+    script = ''
+      cat $prompts/app_key > $out/app_key
+    '';
+  };
+
+  clan.core.vars.generators.greaterchiangmai-s3 = {
+    files = {
+      access_key_id.secret = false;
+      secret_access_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+      endpoint.secret = false;
+      region.secret = false;
+      bucket.secret = false;
+    };
+
+    prompts = {
+      access_key_id.persist = true;
+      secret_access_key.persist = true;
+      endpoint.persist = true;
+      region.persist = true;
+      bucket.persist = true;
+    };
+
+    script = ''
+      cat $prompts/access_key_id > $out/access_key_id
+      cat $prompts/secret_access_key > $out/secret_access_key
+      cat $prompts/endpoint > $out/endpoint
+      cat $prompts/region > $out/region
+      cat $prompts/bucket > $out/bucket
+    '';
+  };
+
+  services.think-greaterchiangmai = {
+    enable = true;
+    domain = domain;
+    settings = commonSettings;
+  };
+  services.think-backend-greaterchiangmai = {
+    enable = true;
+    domain = domainBackend;
+    settings = commonSettings;
+  };
+
+  security.acme.certs = {
+    "${domain}" = {
+      email = config.clan.core.vars.generators.acme.files.email.value;
+      webroot = "/var/lib/acme/acme-challenge/${domain}";
+    };
+    "${domainBackend}" = {
+      email = config.clan.core.vars.generators.acme.files.email.value;
+      webroot = "/var/lib/acme/acme-challenge/${domainBackend}";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    useACMEHost = domain;
+    acmeRoot = config.security.acme.certs.${domain}.webroot;
+  };
+  services.nginx.virtualHosts.${domainBackend} = {
+    forceSSL = true;
+    useACMEHost = domainBackend;
+    acmeRoot = config.security.acme.certs.${domainBackend}.webroot;
+  };
+}
--- a/modules/clan/jukebox/default.nix
+++ b/modules/clan/jukebox/default.nix
@@ -0,0 +1,133 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "jukebox";
+  manifest.description = "mpd server, library on removable disks";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          baseDir = lib.mkOption {
+            type = lib.types.str;
+            default = "/mnt/jukebox";
+          };
+          binds = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = [ ];
+          };
+          disks = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      uuid = lib.mkOption {
+                        type = str;
+                      };
+                      mountOptions = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+            description = "disks comprising library";
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            services.pulseaudio.enable = true;
+
+            # workaround cookie permissions
+            services.pulseaudio.tcp.enable = true;
+            services.pulseaudio.tcp.anonymousClients = {
+              allowedIpRanges = [ "127.0.0.1" ];
+              allowAll = true;
+            };
+
+            systemd.tmpfiles.rules = [
+              "d ${settings.baseDir} 0755 root root"
+            ];
+
+            fileSystems =
+              let
+                disk2fs =
+                  {
+                    name,
+                    uuid,
+                    mountOptions,
+                    ...
+                  }:
+                  lib.nameValuePair "${settings.baseDir}/${name}" {
+                    device = "/dev/disk/by-uuid/${uuid}";
+                    fsType = "auto";
+                    options = [
+                      "noauto"
+                      "nofail"
+                    ]
+                    ++ mountOptions;
+                  };
+              in
+              lib.listToAttrs (lib.mapAttrsToList (_: disk2fs) settings.disks);
+
+            services.udev.extraRules =
+              let
+                translate-prefix = path: (lib.removePrefix "-" (lib.replaceStrings [ "/" ] [ "-" ] path));
+                mount-name = name: "${translate-prefix settings.baseDir}-${name}.mount";
+                disk2rule =
+                  { name, uuid, ... }:
+                  lib.concatStringsSep ", " [
+                    ''ACTION=="add"''
+                    ''SUBSYSTEM=="block"''
+                    ''ENV{DEVLINKS}=="*/dev/disk/by-uuid/${uuid}*"''
+                    ''ENV{SYSTEMD_WANTS}="${mount-name name}"''
+                  ];
+              in
+              lib.concatMapStringsSep "\n" disk2rule (lib.attrValues settings.disks);
+
+            services.mpd = {
+              enable = true;
+              musicDirectory = settings.baseDir;
+              network.listenAddress = "any";
+              extraConfig = ''
+                audio_output {
+                  type "pulse"
+                  name "jukebox"
+                  server "localhost"
+                }
+              '';
+            };
+
+            networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
+              allowedTCPPorts = [ config.services.mpd.network.port ];
+            });
+
+            environment.systemPackages = [ pkgs.mpc ];
+          };
+      };
+  };
+}
--- a/modules/clan/jukebox/flake-module.nix
+++ b/modules/clan/jukebox/flake-module.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    jukebox = module;
+  };
+}
--- a/modules/clan/phonebox/default.nix
+++ b/modules/clan/phonebox/default.nix
@@ -26,6 +26,7 @@
          {
            lib,
            config,
+            pkgs,
            ...
          }:
          let
@@ -79,7 +80,7 @@
                  ln: builtins.concatStringsSep "" (builtins.genList (_: "X") (builtins.stringLength ln));
              in
              ''
-                exten => _${prefixNumber}${replaceWithX localNumber},1,Dial(PJSIP/''${EXTEN:1}@${hostname},30)
+                exten => _${prefixNumber}${replaceWithX localNumber},1,Dial(PJSIP/''${EXTEN:${builtins.toString (builtins.stringLength prefixNumber)}}@${hostname},30)
              '';

            getYggdrasilIP =
@@ -141,8 +142,9 @@
                domain-needed = true;
                domain = "localhost";
                dhcp-range = [
-                  "192.168.254.100,192.168.254.100,255.255.255.0,24h"
+                  "192.168.254.100,192.168.254.100,255.255.255.0,3m"
                ];
+                dhcp-leasefile = "/dev/null";
                dhcp-option = [
                  "3,192.168.254.1"
                ];
@@ -315,6 +317,36 @@
                    + serverConf;
                };
            };
+
+            systemd.services.asterisk-watcher = {
+              enable = true;
+              description = "Asterisk Configuration files watcher";
+
+              requires = [ "asterisk.service" ];
+              after = [ "network.target" ];
+              wantedBy = [ "multi-user.target" ];
+              path = with pkgs; [
+                inotify-tools
+                asterisk
+              ];
+              script = ''
+                inotifywait -m -e move /etc/asterisk |
+                while read path action file; do
+                  case "$file" in
+                    pjsip.conf)
+                      echo "restarting pjsip"
+                      asterisk -rx "pjsip reload"
+                      ;;
+                  esac
+                  case "$file" in
+                    extensions.conf)
+                      echo "restarting core"
+                      asterisk -rx "core restart now"
+                      ;;
+                  esac
+                done
+              '';
+            };
          };
      };
  };
--- a/modules/clan/pulse-stream/default.nix
+++ b/modules/clan/pulse-stream/default.nix
@@ -0,0 +1,42 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pulse-stream";
+  manifest.description = "stream audio to attached speakers";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    interface =
+      { lib, ... }:
+      {
+        options.client-ip-ranges = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "ip subnets permitted to stream to the server";
+          default = [ ];
+        };
+      };
+    perInstance =
+      {
+        roles,
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          { ... }:
+          {
+            services.pulseaudio = {
+              enable = true;
+              systemWide = true;
+              tcp = {
+                enable = true;
+                anonymousClients.allowedIpRanges = settings.client-ip-ranges;
+                anonymousClients.allowAll = true;
+              };
+              zeroconf.publish.enable = true;
+            };
+            networking.firewall.allowedTCPPorts = [ 4713 ];
+          };
+      };
+  };
+}
--- a/modules/clan/pulse-stream/flake-module.nix
+++ b/modules/clan/pulse-stream/flake-module.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pulse-stream = module;
+  };
+}
--- a/modules/nixos/flake-module.nix
+++ b/modules/nixos/flake-module.nix
@@ -3,5 +3,11 @@
    common = {
      imports = [ ./common.nix ];
    };
+    think-gtcm = {
+      imports = [ ./think-gtcm.nix ];
+    };
+    think-backend-gtcm = {
+      imports = [ ./think-backend-gtcm.nix ];
+    };
  };
 }
--- a/modules/nixos/think-backend-gtcm.nix
+++ b/modules/nixos/think-backend-gtcm.nix
@@ -0,0 +1,292 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.think-backend-greaterchiangmai;
+  think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
+  defaultUser = "gtcm";
+  defaultGroup = "gtcm";
+
+  php = pkgs.php83;
+
+  artisan-be = pkgs.writeScriptBin "gtcm-be" ''
+    #! ${pkgs.runtimeShell}
+    cd ${think-backend-gtcm}
+    sudo() {
+      if [[ "$USER" != ${cfg.user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe php} artisan "$@"
+  '';
+
+in
+{
+  options.services.think-backend-greaterchiangmai = {
+    enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/think-backend.greaterchiangmai.com";
+      description = ''A place where to store states'';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which this runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      defaultText = "${defaultGroup}";
+      description = "Group under which the website runs.";
+    };
+
+    package = lib.mkPackageOption pkgs "think-backend-gtcm" { };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "think-backend.greaterchiangmai.com";
+      example = "forum.example.com";
+      description = "Domain to serve on.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = lib.mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      description = ''
+        Options for settings environment variables
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_NAME = "Laravel";
+          APP_ENV = "local";
+          APP_KEY = "key";
+          APP_DEBUG = true;
+          APP_URL = "http://localhost";
+
+          LOG_CHANNEL = "stack";
+          LOG_DEPRECATIONS_CHANNEL = "null";
+          LOG_LEVEL = "debug";
+
+          DB_CONNECTION = "mysql";
+          DB_HOST = "127.0.0.1";
+          DB_PORT = "3306";
+          DB_DATABASE = "laravel";
+          DB_USERNAME = "root";
+          DB_PASSWORD = "";
+        }
+      '';
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = lib.mkForce {
+      isSystemUser = true;
+      home = cfg.dataDir;
+      createHome = true;
+      homeMode = "755";
+      group = cfg.group;
+    };
+    users.groups.${cfg.group} = { };
+
+    services.phpfpm.pools.think-backend-gtcm = {
+      inherit (cfg) user group;
+      phpPackage = php;
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "listen.mode" = "0600";
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 10;
+        "pm.max_requests" = lib.mkDefault 500;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 1;
+        "pm.max_spare_servers" = lib.mkDefault 3;
+      };
+      phpOptions = ''
+        error_log = syslog
+        log_errors = on
+      '';
+    };
+
+    environment.systemPackages = [
+      artisan-be
+    ];
+
+    services.think-backend-greaterchiangmai.settings = {
+      APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
+      APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
+      APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
+      APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
+      APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
+    };
+
+    systemd.services.think-backend-gtcm-setup = {
+      description = "think-backend.greaterchiangmai installation";
+      requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
+      before = [ "phpfpm-think-backend-gtcm.service" ];
+      requires = [ "mysql.service" ];
+      after = [ "mysql.service" ];
+      serviceConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        UMask = 77;
+        WorkingDirectory = "${think-backend-gtcm}";
+        RuntimeDirectory = "think-backend-gtcm/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          gtcmEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              lib.escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !lib.elem v [
+              { }
+              null
+            ]
+          )) cfg.settings;
+          gtcmEnv = pkgs.writeText "gtcm-be.env" (gtcmEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${lib.getExe php} artisan key:generate --force
+          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."${cfg.domain}" = {
+        root = "${think-backend-gtcm}/public";
+        locations = {
+          "/" = {
+            index = "index.php";
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+          };
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
+          '';
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    services.mysql = {
+      enable = true;
+      package = lib.mkForce pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.DB_DATABASE ];
+      ensureUsers = [
+        {
+          name = cfg.settings.DB_USERNAME;
+          ensurePermissions = {
+            "${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+  };
+}
--- a/modules/nixos/think-gtcm.nix
+++ b/modules/nixos/think-gtcm.nix
@@ -0,0 +1,295 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.think-greaterchiangmai;
+  think-gtcm = pkgs.think-gtcm.override { dataDir = cfg.dataDir; };
+  defaultUser = "gtcm";
+  defaultGroup = "gtcm";
+
+  php = pkgs.php83;
+
+  artisan = pkgs.writeScriptBin "gtcm" ''
+    #! ${pkgs.runtimeShell}
+    cd ${think-gtcm}
+    sudo() {
+      if [[ "$USER" != ${cfg.user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe php} artisan "$@"
+  '';
+
+in
+{
+  options.services.think-greaterchiangmai = {
+    enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/think.greaterchiangmai.com";
+      description = ''A place where to store states'';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which this runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      defaultText = "${defaultGroup}";
+      description = "Group under which the website runs.";
+    };
+
+    package = lib.mkPackageOption pkgs "think-gtcm" { };
+
+    packageBackend = lib.mkPackageOption pkgs "think-backend-gtcm" { };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "think.greaterchiangmai.com";
+      example = "forum.example.com";
+      description = "Domain to serve on.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = lib.mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      description = ''
+        Options for settings environment variables
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_NAME = "Laravel";
+          APP_ENV = "local";
+          APP_KEY = "key";
+          APP_DEBUG = true;
+          APP_URL = "http://localhost";
+
+          LOG_CHANNEL = "stack";
+          LOG_DEPRECATIONS_CHANNEL = "null";
+          LOG_LEVEL = "debug";
+
+          DB_CONNECTION = "mysql";
+          DB_HOST = "127.0.0.1";
+          DB_PORT = "3306";
+          DB_DATABASE = "laravel";
+          DB_USERNAME = "root";
+          DB_PASSWORD = "";
+        }
+      '';
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      home = cfg.dataDir;
+      createHome = true;
+      homeMode = "755";
+      group = cfg.group;
+    };
+    users.groups.${cfg.group} = { };
+
+    services.phpfpm.pools.think-gtcm = {
+      inherit (cfg) user group;
+      phpPackage = php;
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "listen.mode" = "0600";
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 10;
+        "pm.max_requests" = lib.mkDefault 500;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 1;
+        "pm.max_spare_servers" = lib.mkDefault 3;
+      };
+      phpOptions = ''
+        error_log = syslog
+        log_errors = on
+      '';
+    };
+
+    environment.systemPackages = [
+      artisan
+    ];
+
+    services.think-greaterchiangmai.settings = {
+      APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
+      APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
+      APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
+      APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
+      APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
+    };
+
+    systemd.services.think-gtcm-setup = {
+      description = "think.greaterchiangmai installation";
+      requiredBy = [ "phpfpm-think-gtcm.service" ];
+      before = [ "phpfpm-think-gtcm.service" ];
+      requires = [ "mysql.service" ];
+      after = [ "mysql.service" ];
+      serviceConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        UMask = 77;
+        WorkingDirectory = "${think-gtcm}";
+        RuntimeDirectory = "think-gtcm/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          gtcmEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              lib.escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !lib.elem v [
+              { }
+              null
+            ]
+          )) cfg.settings;
+          gtcmEnv = pkgs.writeText "gtcm.env" (gtcmEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${lib.getExe php} artisan key:generate --force
+          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."${cfg.domain}" = {
+        root = "${think-gtcm}/public";
+        locations = {
+          "/" = {
+            index = "index.php";
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+          };
+
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
+          '';
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    services.mysql = {
+      enable = true;
+      package = pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.DB_DATABASE ];
+      ensureUsers = [
+        {
+          name = cfg.settings.DB_USERNAME;
+          ensurePermissions = {
+            "${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+  };
+}
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  flake.overlays = {
+    packagesOverlay = import ../pkgs/overlay.nix;
+  };
+}
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -0,0 +1,4 @@
+final: prev: {
+  think-gtcm = final.callPackage ./think-gtcm.nix { };
+  think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
+}
--- a/pkgs/think-backend-gtcm.nix
+++ b/pkgs/think-backend-gtcm.nix
@@ -0,0 +1,32 @@
+{
+  fetchgit,
+  php,
+  dataDir ? "/var/lib/think-backend-gtcm",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
+    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+  };
+  src = "${repoSrc}/think-backend.greaterchiangmai.com";
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "think-backend-gtcm";
+  version = "1.0.0";
+
+  inherit src;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+    rm -rf $out/storage
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    runHook postInstall
+  '';
+
+  composerStrictValidation = false;
+  vendorHash = "sha256-eXm1x3E9KHWojaT2RU4inMdZqQVcWdLCKlvzhOlIZrc=";
+})
--- a/pkgs/think-gtcm.nix
+++ b/pkgs/think-gtcm.nix
@@ -0,0 +1,32 @@
+{
+  fetchgit,
+  php,
+  dataDir ? "/var/lib/think-gtcm",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
+    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+  };
+  src = "${repoSrc}/think.greaterchiangmai.com";
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "think-gtcm";
+  version = "1.0.0";
+
+  inherit src;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+    rm -rf $out/storage
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    runHook postInstall
+  '';
+
+  composerStrictValidation = false;
+  vendorHash = "sha256-QV3hR3U3GwCqrCRxfkazmJwDpO1vFyMfA6YqUb4bjMI=";
+})
--- a/sops/machines/adhil/key.json
+++ b/sops/machines/adhil/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+    "type": "age"
+  }
+]
--- a/sops/machines/buna/key.json
+++ b/sops/machines/buna/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+    "type": "age"
+  }
+]
--- a/sops/secrets/adhil-age.key/groups/admins
+++ b/sops/secrets/adhil-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/adhil-age.key/secret
+++ b/sops/secrets/adhil-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:DXK8BjWBriLUvOP2jz+48QP87iolYrob32o2D13EID/wiRoJDzz4Txr1AobrHa1NU791coXU2r7gteWA5KjYudXEgQW2opDjPFw=,iv:jLBLq3KqTvuntbLLCCMB8cVTGejetM7oGYV2j9rRlrw=,tag:0h3UtQ4tTDgGxksKmRoSVw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBET3d5UTJRNExVRkppSE5I\ncG02V0lDcGZnTmdLRVBkWUlWS3hUaWVaa1NJCkV3V2pseDFQV3RvR0N4cjNqaEk4\naGRkaDBMQnJIc1BlMCtvVW94M0dkYTAKLS0tIHRySkpXMzJiMzFrUU1UekdPUmVi\nMmZiRXBSc3FXMndVNjRqc2xTSlU3RTAK/erwb450pgiQAdYQlrVe32BEiaFIthl2\nUVQTCHQILnxyfC19ZOmlAnSuhXXrj7XdAQmK40DLb0A52QpFC2EP9w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0dFdWFOdGgrR0hsemYr\nOGpFV1VqQS8vRHA3UURXMEQ2ZDJHcWNCVzBZCitvZTZYdDYzYm8xQzlYNHNVYmRt\nMWNzbitjaUxMSXN5WHp2SVhPY29XY0EKLS0tIGJOSUFBOU1RMHBnQWJsQkg0cFlp\nZ2c5QU5aeDlUMG1KTlMzQ1FPMldTeEUKxyt4xdySOfB8Fa8KjPytjjq0oGgeFBlo\n+uT97/DvDbiBfGaZPaSyJPRP+Mca0yQz9nltCOm7qz68BEjboFKUEw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGU1YU05Y1Zm\nZ0Q4RDB5ZFc4cndmaTVTRXc1MXNmdllocGdVa2xrREQwa1kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPNEJKRkdxc1RkRWJ5d3diQzhuTjBy\nV1VNYXRKV2JXMGpPbWEycUlJSUh3Ci0tLSB2Y2dMV0M2OWwyUVRzZVNCZm91a3FL\nQnlFTjV0dnFhZWkxd2tNOWZScUMwCri3NvW7zXusWvELSRNc4kLfAc6JTbR8q4KS\nqu8E80e4gwng53PpHkmK0pBRYnJbZUf5DPITOy1mrbnNGMh6Nbs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEI3YWUzWWxp\nUSszSGNybG9oMitaUXludExlKzVOVFNNVkJteFpadWhtMDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpiTDJ2VGI5VjZZU0xKdTY4czhiT0RP\nbmZtU1ZQZERLNzk0MHpQM2gzdTVNCi0tLSBheWw4OVk5SzJYbW5ZZWl6SFRraXVK\nKzgrODM2alJON1FqTXczOW5JaWN3CpdplHYscbileaUWp0wSuirTOZUefZNUkbyh\nCqwS2/3JZ2IMhAYLfLoeVRbp7OrncmQF7L3KuvPPaE7WjAYwYug=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRMU0NKM2Fh\nQm9uYzYwQnNSWUdReGV1QXFXaXRORUJobURKOTFBbFoxRm8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpSVVgrL3RicHh2OEgvbC9xSzhjKzNz\nYnRIa0Qyc1I1cUhVZmJkSGk5YU1nCi0tLSBPb3Nud0Q3TjZMMkJvRGZNWklQSlFZ\nNHVndHNjZmljVExmNzNYdzRrZmJRCgwWFdIGjZJfugyk8GSk9zPE/cgERs9E48S9\nVjUEetmVvRPj3jOsseyrF8KF4ZAppo7u10WXKvTZOBTDISpCW0U=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMUoyTlhwOWVSNG1vbGdz\ncDJwc3ZTUjI4OUpLN3lnQWJvME0vbzkyTVJJCkJMbXUwbnVDMG5oNjVJR25wSVZw\nYjEyMWk2Y2pCa2N5ZTlka2tNTFVybXMKLS0tIE45akZVUWdsQmRUWFhuVmdhYTR5\nZ1hKVytCb2pvM0c5UDJlVVBUdXNxS2MKnQXRfa5eXzos/rAa3KUNtzKwXWuyqvU4\naMSGMpzI62JYrzv51od2sJVOPog0jrUsaIFx8rp6nuYsqRZ1fmDzKg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUmdlRldqaFFrZWp5eU5y\nSTRPeTVHdVFOYldkYVdKcFl6dklRMXpVWTE4Ci9KWUhJcnREMzJyNExZSFk0TFJl\nYmlVK1E5ZlFGWlJRZWwreVY3MWtHUzQKLS0tIElDNEl4UXFFNTJyODB6UnhaT3gw\nK1ViUzFLYjFTemcweERlaDNnR0FsaEkKJjG/XkynVLGQVdywXn0cM0db7X7aYrpP\nxYAUaS5SM7Ny0x3sEyP0+KdsWjBuHfi/CVsiTdBJ8CDpwkYSrpw5Lg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVnNpbUV3Z25weGFmTVg5\nOFV6cjl1eHJXemYzbitQNW9tSmNwaWdtQTA4Ci9ueHRSMndKVnJjVTFDQ044NEhs\nUEpuNnpSZDJjZzJuNjFMQ2ZVQWZ2b28KLS0tIE9LMjhPUndWNVBMR3QxQ041Qnc2\nbXR1U1VOWUxPd1ZBMzBxbGEvS2tFK2sKGnpSdS9f3sNFLstp8ONYTRqZVU7ujFAE\nqwTq4BJUlffEc9JXnvS/ZaC7O1yKmz8V5coKSHlbn+IyrZPbx9scaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOGd1emMzZkxPRjU1Ylcr\nRlVXbHBnTVV3eU9QU3NxYzBKYUJ5cVg1SXpjClNOYUZBNXMwdHJEVlNoRjdRZWVC\ndTluVVdtdkZDVDcwaGFGZUM4MEE3WUUKLS0tIGlHVVprTjhYQmJva1dQT0ZrdkE0\nNHZZTnhnWi94eURxR3ZCczlCeWxZVmsKOKXVYQAMftId6wXOsI+G/1/xPuVCLZOh\nrDzvaUbipkBTdZ/DXXvXf2f1fDcIqXXtPJyBD7Yh/6+KIPxf8wjVVA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:54Z",
+		"mac": "ENC[AES256_GCM,data:VpfhhVlfPQB94009yErF8NJl+BbhBgc/dAPNyvqQzqORpXsPa9DXjae+giPkRXhTS+263NIglUbPiNqZedj0d9ep78gj/rCupmYcGSsX0gqwFfwj50xX0qWDgs6Z5b7QytDlDPiNOCYM287Q7XLob7CcvAM46Ulo3vx/QKD76Qc=,iv:SBwlzN4PIEPo/iZl/VpkcgNtxqlyNOjqi5y9UGzWQgI=,tag:0/0mKGEQtGOrXYSsn+inmw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/adhil-age.key/users/kurogeek
+++ b/sops/secrets/adhil-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/secrets/buna-age.key/groups/admins
+++ b/sops/secrets/buna-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/buna-age.key/secret
+++ b/sops/secrets/buna-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:j5R4ApBy0c5t6wGmT0kRBT8g/G3HY2yVxR3/U1JqQrm6P/mzqJC5JDigGBWAZcdWv7wxQDXlkGi/ipEEhJsk8/if9S1atlMazF4=,iv:g6VPTjS5I+f7lVLcraBGXkI7cvyPgs3wgrfa14iGdvE=,tag:iz+/QqEBPD9EkRE9EL1mLA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac01oOTRpQWFRaEhqM3FK\ndlpQNmU3d09pVHhxTktCeXRPRWVpZ3dzRGx3CnVLckkzQzlzOFdwc2FvTWF5ODVl\nSXJ4di9CcU9wcHhvNmdJczhDSTZMMWsKLS0tIGRrWHNINjRzeFNPZVBtcm52bmZv\nZVFJT3doVi8rY0RyOENRVEdVNjNoOVEKBwhAaM9nRfShEF2B2N4LBaY3WA0Jzib3\nZRXnpnaSVlbnCqJIXU9bYMA/UIQ7b8bRR2xQ0Y+gMabBI0Dzf6TmoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWc2p2NEFFM1NrUllYM0lN\nRUJhQzJXZ3N1ZlpsWmo0L2VneFdnc25KQVUwCkQvdm9leXlMVitQNXN1OHpWM0RI\nZG16bHZVZlZlNHl0UERhWTVpUithalEKLS0tIHo3ZEdtZWo4QmM1SUpuMW8xczg4\nSWFtN2pWS05wdGlQWDZHcFRoWHJUR2sKzy85bPbem51i3FUzhTgk7eEVDbOF3vgR\npbINpu0LikVOrYOgop8cxU94QBWbS1VQd/kCIAYot1jMZs5Xvf9L3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNFT3h4K21F\nam5aMStNRHg3b0dFZm5tYmplSmxFRjBiakJJMExjS2poVEkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprMG5MSzk0YmlGaHpySzZFYk00eFpr\nbllMYmxkMkU1UlNGVWVYWHB2L3VNCi0tLSBCcUdaem9VYStjRmlsOWx3ckFnd3Nq\nR3BRTE9SaE9TQWs4VUZCRmQ3UmgwCj/4vmhRs9W6U9ay6mYFxPd6SvOTvxvYn/Oo\nuY7/N3PVpXxRK/UwovEGqY97AG/dEQk+I0/5AowFGmfPURpqKjo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGRvMUlHeVhn\nU3BhcEV1bU5uZjZqa25ydHhDOFUyNUQ2SzRadzk2ek9YbjggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYS0Rrb1poMTRDNmd2eW5QSWJvU1hB\nYVpTYnF1NmQ0SkNsa0xCNTh4bEYwCi0tLSBZZDhMZ0JsQ0dPQ2VWYXpMZE9Fb2FY\nY25qNFdFbVo0dURyUHd1MDl6NFlvCjFQKnkAmGuTioiY11oEgdD4Ctcw1gFF7xR1\nk9RV6JRXe8YeuWYpQjS17vQVR65TpJukYWm9UYy3NPP4Xu72toc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5HdTZDY3VH\nVnNvNHE2blFqM2pma001OGRWdGYxOHY2UkVhVW44bDdGUVEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjNkdSYlppQU51Wk40QzBlQ2lzaFBR\naWE1NDNOa21uNUNNWFBZWTVtKzJBCi0tLSBOWE1vUDZtVzRLMVdOMXBsNVpwMEc0\nTmwvZGVHd1Z0akJhempkZEdVSmpFCsnAxyLUrUbyMSBvak3VXBSdR5RmmL7eBjnM\nrw+kRLE8NFVwFiCZXgZDBlB2FkVKYvaL/hxsn4LYi3k53U9+vD0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmOUVPQ0RoSG95RUVnK3hC\nTHFEUHA2VWdadlBoNVRFNUl3Z0hOcjVXaVRzCkRXRTczZWRmenVZeHFWVVBEK2Z3\nVXFPWkpDak84akhEaTdkMjFUcmpnVTAKLS0tIGJLZFQ0UUVYeHkrTCsyYjVHcDQw\nUisxV3RVSEEycGhoSkttaEVXaTV0cFkKKo+lqTI+k6WDdPbMNo1owWH4/RoBt9e6\nmGO+sjziFzrZWUXx4RilR2F/3afRA/CdjzPab9I1sut3I6Z7FXNjYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscXI3NGV1R3lNQjE4U3Nj\nb0ZTNndORXlIY3d4bWVWYzRVTzZHWC9sV3owClRWc2tRaytsQkxFazlyOFU4V2RS\nYTEvY2swdDRnMGowdzZESTVVeTNkN2sKLS0tIFk2alJHUkwrMTVsdG1LQ2pReHA5\nTllyMFhML1JJdWQ1NXJkb2U5K3F4K1UKn6OPUfym5f9aacaHq962347dNeTjBfK/\nAMXPZXs6DawU8vko1RqIgzX/7StrITcXGcFfTutmpSa3KjMzuzeb+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1eXVNcklwZnI2dEtRaFdD\nOUVON1Nxd2l4L2xtYUtRSHlXVlc0VzVhZkZVCitxYjJTbDZDQjNHc2JrWmFaaEp0\nR1NMUEllalZxeHRndGxGRTZGSzV4TkEKLS0tIDhNZ2x0amhKdk1IdG16S0RLbWMz\nQSs0eTZ5YVBGdkdxYkhweUdMVVR3QVkKmau0k5SxJD/EURq6Lp4aDMYCoCFLOo/I\nRj5mAP4YGIVTU47HJYNcPcwzgwA6YVqVOiKaG6yyU7u1DsddaZHdiw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaHdMdC9jeDFWdktiV1JC\neDlFbW5QbmxVSStMZTYvak16K255TnZzMFdNCnFuOFlHVlYvQStmYWhITWl6NUN1\nOTdFdjg0OWZhUVd3NjQrcXQrNm9CWFkKLS0tIG9VWGZhUDJGWDNjTVg1bFMvVE5u\nYnkzV3QyczIrK1hLbUV1Q2twaDkxNm8KpHCL8htFz8UeMLsXmDUz/nAdTYsRSka1\nuq+bFkrVexExxqXJVyIXf20ceziFG8t5on8OGHDCOQsst4HEgRqyWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:15Z",
+		"mac": "ENC[AES256_GCM,data:wJ646ZAfUOSwXnkIUDkvm4wz7uaW4U7bCkC/8uFuoTwY16F5+1N7AxaSE453w2cOCJE5qOAXORYj5M7J8o84LjLWYN4+PYjCcU2ulL9rug29fNblqFHG8G1OdHwURep6sGKfvsSCTGgpnA5fYmXucYWIqc27cQ9HDtiHw3Bojas=,iv:L6xUGwjihD08Ahc/3WoA3tZDXvllmNWK90RpK7m+4Pw=,tag:pMynp2rs42lenOYbLQ0c0A==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/buna-age.key/users/kurogeek
+++ b/sops/secrets/buna-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/tests/default.nix
+++ b/tests/default.nix
@@ -0,0 +1,16 @@
+{ self, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      checks =
+        let
+          checkArgs = {
+            inherit pkgs self;
+          };
+        in
+        {
+          think-gtcm = import ./tests/think-gtcm.nix checkArgs;
+        };
+    };
+}
--- a/tests/lib.nix
+++ b/tests/lib.nix
@@ -0,0 +1,18 @@
+test:
+# These arguments are provided by `flake.nix` on import, see checkArgs
+{ pkgs, self }:
+let
+  inherit (pkgs) lib;
+  # this imports the nixos library that contains our testing framework
+  nixos-lib = import (pkgs.path + "/nixos/lib") { };
+in
+(nixos-lib.runTest {
+  hostPkgs = pkgs;
+  # This speeds up the evaluation by skipping evaluating documentation (optional)
+  defaults.documentation.enable = lib.mkDefault false;
+  # This makes `self` available in the NixOS configuration of our virtual machines.
+  # This is useful for referencing modules or packages from your own flake
+  # as well as importing from other flakes.
+  node.specialArgs = { inherit self; };
+  imports = [ test ];
+}).config.result
--- a/tests/tests/think-gtcm.nix
+++ b/tests/tests/think-gtcm.nix
@@ -0,0 +1,102 @@
+(import ../lib.nix) {
+  name = "think-gtcm";
+  nodes =
+    let
+      settings = {
+
+        DB_CONNECTION = "mysql";
+        DB_HOST = "localhost";
+        DB_PORT = 3306;
+        DB_DATABASE = "thinkgtcm";
+        DB_USERNAME = "gtcm";
+        DB_PASSWORD = "";
+
+        APP_NAME = "Laravel";
+        APP_ENV = "local";
+        APP_DEBUG = "false";
+        APP_URL = "http://localhost";
+
+        LOG_CHANNEL = "stack";
+        LOG_LEVEL = "debug";
+
+        BROADCAST_DRIVER = "log";
+        CACHE_DRIVER = "file";
+        FILESYSTEM_DISK = "local";
+        QUEUE_CONNECTION = "sync";
+        SESSION_DRIVER = "file";
+        SESSION_LIFETIME = "120";
+
+        MEMCACHED_HOST = "127.0.0.1";
+
+        REDIS_HOST = "127.0.0.1";
+        REDIS_PASSWORD = "null";
+        REDIS_PORT = "6379";
+
+        MAIL_MAILER = "smtp";
+        MAIL_HOST = "mailpit";
+        MAIL_PORT = "1025";
+        MAIL_USERNAME = "null";
+        MAIL_PASSWORD = "null";
+        MAIL_ENCRYPTION = "null";
+        MAIL_FROM_ADDRESS = "hello@example.com";
+
+        AWS_DEFAULT_REGION = "us-east-1";
+        AWS_USE_PATH_STYLE_ENDPOINT = "false";
+
+        PUSHER_PORT = 443;
+        PUSHER_SCHEME = "https";
+        PUSHER_APP_CLUSTER = "mt1";
+
+        UPLOAD_MAX_FILESIZE = "5000M";
+        POST_MAX_SIZE = "5000M";
+
+        TEST_LOCAL = "false";
+      };
+    in
+    {
+      gtcm1 =
+        { self, ... }:
+        {
+          nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+          imports = [ self.nixosModules.think-gtcm ];
+          services.think-greaterchiangmai = {
+            enable = true;
+            settings = settings // {
+              APP_SERVICES_CACHE = "/run/think-gtcm/cache/services.php";
+              APP_PACKAGES_CACHE = "/run/think-gtcm/cache/packages.php";
+              APP_CONFIG_CACHE = "/run/think-gtcm/cache/config.php";
+              APP_ROUTES_CACHE = "/run/think-gtcm/cache/routes-v7.php";
+              APP_EVENTS_CACHE = "/run/think-gtcm/cache/events.php";
+            };
+          };
+        };
+      backend1 =
+        { self, ... }:
+        {
+          nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+          imports = [ self.nixosModules.think-backend-gtcm ];
+          services.think-backend-greaterchiangmai = {
+            enable = true;
+            settings = settings // {
+              APP_SERVICES_CACHE = "/run/think-backend-gtcm/cache/services.php";
+              APP_PACKAGES_CACHE = "/run/think-backend-gtcm/cache/packages.php";
+              APP_CONFIG_CACHE = "/run/think-backend-gtcm/cache/config.php";
+              APP_ROUTES_CACHE = "/run/think-backend-gtcm/cache/routes-v7.php";
+              APP_EVENTS_CACHE = "/run/think-backend-gtcm/cache/events.php";
+            };
+          };
+        };
+    };
+  # This is the test code that will check if our service is running correctly:
+  testScript = ''
+    start_all()
+
+    gtcm1.wait_for_unit("phpfpm-think-gtcm")
+    gtcm1.wait_for_open_port(80)
+    output = gtcm1.succeed("curl localhost")
+
+    backend1.wait_for_unit("phpfpm-think-backend-gtcm")
+    backend1.wait_for_open_port(80)
+    output = backend1.succeed("curl localhost")
+  '';
+}
--- a/vars/per-machine/adhil/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/adhil/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWyBu9oHfZ1dUbauMofzaJhPNJAFX7BaNHmA1g8Xu1O 
--- a/vars/per-machine/adhil/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/adhil/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/adhil/openssh/ssh.id_ed25519/machines/adhil
+++ b/vars/per-machine/adhil/openssh/ssh.id_ed25519/machines/adhil
@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil
--- a/vars/per-machine/adhil/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/adhil/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:86WcVdVW6U9/Bwgi15CF2g2pQ3N+l7ccGOgAqv4hQsnYZYACWU70dlMOWA/quo7emPYdgzNoBzVS5hoPDMFf3HTF1SfoCjaX/TRU1XAAXqpV/2G+PolLySdK/Vw5AEPWo1CL0S4/2L6FfB0TrXympw4fRNg6fCMS7LtOMsVdFGiU7RyPCIUEteZ3rUPlkIEpzaF66y8Tzfi88K6GSlFn2WTb1nTgrUQwKfvfzdXB3aZLqqzSVYA5p3pA6fzhbvifChVnBBcCkZIfGAApaqbdPBK8U/EPOLJtwQoTmcDilzjW7RJOWA6bIfq5ATJ9Ct6STv+gg+ozceot4LR6raYkGwG2NxQ7XoZEa62I9aLLTQZ07LOM28ZVA/BIfb7Bxj2Pu2Uzu6VE4xewgHS+u8HqvDKA3zXPKYCmnCSWiJLXKaZ5j1fxKcZnYVKlxxPzP6joIhKxPrUmASefcuCyXS5mQqM20sklHxG4SRrjoHHaAGkv7W23rPNq3MO2L8Voy+8u9UAk,iv:f/ddIhwLruDn7cRrSg24X3xcAn6ZaN7Rnp6UU4vUR9A=,tag:8qQIgJZfaNdMeTSx/ChW+g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcGQySFpsQW4wMCtrbnd6\nRFJvL052dWhyM0ljSjVlTG1CVXh3cHN1OFZrCmNBNWVBUFY4ZDU2bW5QMFo0YkVs\nbUp3Qjg5NDRicFc0Z01zZzVvc3hxdHcKLS0tIHBUNVlBVCtvUEZYSGIyRTZOVkxV\nODlNQmpJRllyNFZ0ZkFCdHY1ZExuK0kK/g/StMQx5LPX2Q0S6p7cBUZKImmyY5qJ\nkD3qJda5OF9pHcLTSiFMpgjI1gMiltzvDuzrwfOPgnplCnPgiUYNdA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuUGJzWC9vY0tVRWVSKzZY\nc3phd1Rsd3FtYjhUK0JsRk9HeEdJQUZISzFNCllHalJXbTZ2cTlyWjhMUkdPQXFh\nLzdldUFQcmUwblJtQmRTbzVhL05MZ1EKLS0tIDMvamJlZkM1SHNCTGRpc2lsdVdh\nbFNzb3hneTdCS3M2eVlxWnFOQ08wRUEKEcqMJiBMD8bn+X9yZ1KF8mxmZdo6czf4\ny/SsVodZaSAxsbiUFykapZ9tyOfc3VSp8dn2hlhs2ApeQ1ykunFgug==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBybTlWNzZ1MFdvMjRkTFAw\nYXBDRVBiSDJ6aVdJdVJOVStPQ1VNWEpPeUNNCkxjTWtNUWlnd3NmSTY1OExnMzl0\nOXVqQ1FhdE5BMXFDc0dZSlNKYi8rUzAKLS0tIFJYM2d0UU1tQzZpTVlNaVFtQ1hK\ncENTQ2VDb2ZISTZkaWpkTjA1V3lLWjAKDJXCX4TAwg+9KBZAPX/SSBXaw0ccFfQn\nYUcpls4hvti4qBntRMzHT1Pw5ok84whYKQYSpEnGU/pPgbBhcQovuA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNXR0kxRHBC\nR1RZVzA5TnhZaFJMUVZ2dkhZR2hwMzBRYW9YQWZTSmVZQjQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpHY0x5UEJUSyt4TUZTOEJUKzNRWkNo\nNkVWVlhZMDJTa2tsMHhLamQvM1hNCi0tLSBYdmRMbWZBR25LNzhkSURSZWFOaEhj\nL2VoRGdWc3hrend3VHN0cmxUczFjCp0cKOsgtfY5ArmAIsXFJZDtTsFU8S0ebfze\nmUnY3vVVOjf4XlSaBh9MFpBFSl1vnE+LKn/bYbuzVYmpNdcaMc4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNDZ09JcndH\ndnAra0I5Q2ZzWWRQUVZqVVA0bHhPTG1zKzQ2akJkSXRzWG8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpBTEpZM0tsa1hXSEpkUWFTemZlWDQ3\nWUNpZm4wbnM4dFdhRUdnNWVjeDJzCi0tLSBjTUo3ZUpYaVBnbmhwb3M0V0VtbE1V\nMnZrZTBheFpzUWZjVnd6OGNBemNVCtAPjcJ0hRaSeXZqDgz+dQttECYqakVo5Qzk\nnt07/aWu4xvtnKRn9yjaRq3KEPNEWcbHt2DdJSeVaiJWh+PtC1k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5EblZUVEUy\nODlmQzBWQ3RpeTVkeWFZTGlsZER6eUovdG9QZnFCNHRwbncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpiZS90cnlsZzIxNlBnVGNNQkRjV29W\nRTNYU2crb3RKbGNyaWZjOVdPNjc4Ci0tLSBmNXhXbmFVUWxjV2ZvZ3RvcDBQcWNq\nWXBmenpZZnp2dHpiUExXeUtRLzlrCp5OMLuza2aLmz4cTi9jCaV9JJukeBXPT8Z6\n32bWfx9eSD+MkGssBjmfFqzEvtaD0DkiXbr0upspREXpjrnB4wY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeklFYWdQUjRUcThrSVph\nRnQ0QUtrZVppaldMTUorbGVCUDlodEdYZEdZCml4VUlZVnJHT1VJSW1JK2hDSGNE\nclNvcXdxZjJsbUM1VW1qRFRYZ3dBdm8KLS0tIG5TVUJYZE85ZG9nZDl4OGsrUFBS\nWkxaMjBMblZ1WGpVei9KSnR1MkZnSzQKCL4kgeLf2ZRO0eMcb/2j6nfk0EXYo2+r\nGFTuE6/OlNXV0BIY8vXkubniWdkT0Mm/2nla0nQPiKv/ubterVZF3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBWGxBNVVKNmpxaEZOUHZE\nZVRxN1VPMTI1MDMzZmkrbWNxVHM5ZzVkbkMwCjZFbys0bVdlR1FvbDVmYzdSaUc3\nOXl2aW82T0p4UDlvajN6cERuS1FYaWcKLS0tIE1GdlJRVEppUEE3WGVsTnl1aCtx\nSHdlRWRJVzREakVnVjhPdm0xRXBGaVEK1iyMJmPeA1gySxLlzLVj4Pqb0AaBxH3k\nxKD4b4CTqA+gtv/NUt7rMG8sx0L+zpKrYsq8WWoTVR4iqi7pceKtyw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SEFhZ1IxYVh3R0RIb2lj\nUkpNVHRHV2NOTW9tMm9GSCt3WW9qaXlPSXdNCmlOYXRmTUxjWFBSU0FjV25VcFB4\nc09qNUNzd0dGWFpVaFVVWHBoNUVLeTgKLS0tIFFGRjc0c2dSOGs2TjNsTlhUampv\nb3FXakJNdHljYSs0UlhPUDBJNzFHcUUK+KI+/hjFWn0GDqYCLuF1D6mqm8Zwz2uT\nBnvYErRQp8zhzmJyISb1CWXOHN4iUhC7sAriLBA3CGJsveYiCo+QOQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGT0diZG0vaDhrbjRnYVhh\nMTJMTEd1TWxKcHJnV0s4cEVXWlFmOFAzbWhFCkx2dW1ISWpWbm8zdnE3ZkhRVXBr\nUVV0Sk5IL3BIdDQ1R0NIL2I3YnFwdG8KLS0tIHZmM2dKaDR6RkFzM2ZJNERlU0VW\nTGVkdTErdjIxVWV6SUpKUkJCS2JiTUEKcdc+IzYcGr/WAwvZLtbS4XUW2qxYNsrK\nBfYUB2e7uqyuLVQQtZjY7GeKtldJxmrPg1alpNYKVgb2q5/B03bK+g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:55Z",
+		"mac": "ENC[AES256_GCM,data:829+mmUUq8OwPJ196vFAjFoj9pU/86bCPU3CR321SYQrw8Max6mhlPJtaBsmQhux20Sv9jnd/vZyeJqTVzikE45v1uHcIdzHDzleSP4yRhyZ2EFOx7RMjbXxTGolLokKqlzTPwMIwP/R/93l4WmCLcK3j+xCU7BN8XUZHDvh3Qw=,iv:voxCHN9JYplyXBKyp55swfIQP0hVfJ/fk/FdJNvwpZg=,tag:T/26J+gaftij+BCqQFxGWw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/adhil/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/adhil/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/adhil/phonebox/ata-local-number/value
+++ b/vars/per-machine/adhil/phonebox/ata-local-number/value
@@ -0,0 +1 @@
+00
--- a/vars/per-machine/adhil/phonebox/server-prefix-number/value
+++ b/vars/per-machine/adhil/phonebox/server-prefix-number/value
@@ -0,0 +1 @@
+60
--- a/vars/per-machine/adhil/root-password/password-hash/groups/admins
+++ b/vars/per-machine/adhil/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/adhil/root-password/password-hash/machines/adhil
+++ b/vars/per-machine/adhil/root-password/password-hash/machines/adhil
@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil
--- a/vars/per-machine/adhil/root-password/password-hash/secret
+++ b/vars/per-machine/adhil/root-password/password-hash/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:hSpr4CSkRNjfxFJVNsCwakFq8O/upoqsyzctHRUO5NWO1umfGE+le8hT4X/B5Td5y9l7h23r+NaanlMh/5+NmWo/PSbMlHq6owk2ydFgDzikLInnKDv0CesDlgTQcprlunnSzpFVDZ2EVg==,iv:KzdRcz5fungdzaPOpfE5LtmhedYbW2eKmmc9niy7YgI=,tag:uoxGCMhjjggxIjQtG3W+hw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvcVpyTHR1V2l6czYzRE5N\nRDV5ZXF1a0d2ZnBFcGh0MGZzVWp2T2NsY2pJCjRGQWNTY0ZFK0w3aVhWemRMaGEv\nMklWRFEva2lEazRTZFJwT2pDdkdmbGcKLS0tIEZUWVBHREVabjM1bUYyb21pamZ3\nUDlsZU9iNVJ1a3QzRTFtZEV5NVU3MGMKzNUiN8idDGGJLIY7AaJSIqJDqwT/LOYA\n0g+ARFZdv+CxPebnx7SEY7RrzsAeA58BFmzhjBLAUugf0iIAFcyqXw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3d0tEWll4eUR5T3gyelk5\nbjcweHVWSklHbWZRRlFkYW9Mb1c0Yk5Oc2drCldpTER6N3lIcWlFSlgwR1Nrazg5\ndDRsTEtOSllMam00TnhuMVZGVkFkWTgKLS0tIFFlQWgvelZoa3lQcEg4VUM1ODd2\najRzQ3dBdEQyZHR1eEEzRzZZMU1WYmcK54eyhqxKH2Qbaktv4UhSI/T8ABJHZ62Z\nanxVvxex8OR3Fj6gelflZG0y8rcaZXA0F2gRo/T1vQCG9icYPPWIyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxYk42UHR4bm9Lb0M2WU9O\nVnNQTjdIc3JiTG9YK21MRGNiYkJFMGZTR2k4CkZIK0VLTERlU0N5SllEaDl5aHpw\nd0V2R0JMWWFnY1NUb3l1cXczMTdzdEEKLS0tIGZYZUR6Y2Vhakhtcm1mRENMMFF3\nOUJ6VnI4YWxEVU9OdXZ3em16K2FHRnMKPubUsHeGDyj+QsvHsLVBnwXyp44l8Vgq\n0Fc3r0PztNHl6bMtDbfkPfa2BGwpiq0nnylH4CNG2vrMCI1KcVlVvw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGtrdXBJSnFn\nMW9QSFhFR2UxbzB4ek84L1lJY2FlRm5mZCtCMWpOTVNVekEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQplRGhIT1hCbGZKVkhORFNya0RiMVlU\nbUxIWEhyREZKWkkxNWYwOTIxSDZrCi0tLSBkRTgwUUtWbkx0aitCNmQ4bEZuQ0NM\nVU1GanZJblcxcDhYQVBrY0NEWFdNCjOBMkZzoa84TTTNwkeBHO/uQ4lMqswFNfht\nnfsrK4jLoRfyG1Z647Sqmzqx6JZWOtktv6gGJpTY+GlRrpro/i4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEJpRFlXSmJM\ndEQyK0lSY2Y4S2NaRUc3Q3ZaWG0rNTJFb0xCQ2ROVWZxeFUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo5UW5OeU1KWkJzckd5LzlXTWxsZklj\nTlZjMk5ieXk0VFdRSXZQRjU4eWZrCi0tLSBYdFJrdmw3MnNDK3RSYlhSN2Y5bk8x\ndGdGcmwyb1JNWUx0bjFEQzNiMCtJCmOUYLvuuLeJ/4Bqc14oYRtklrAww1X7C08L\nMVWdgwoiw8mkvyLUZM4To2wtPQh81YnfDlnPSBYkuBEUpxmOVHc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEMwVDA0Unh4\nVEZ0V0ttMG9Ra1ZoZWVHYVNTTGxucmUvbHk2WUdtSk5IbmcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp5RkFVdHFwMkQwVW9QenRBcjhsR0Rn\naW5jRVZ4L1FZUGVzcys1TkpQS2swCi0tLSBGdDNOL2dIak1DVCtwZWxyK2ZsZ0gy\nSzJOVVZqL3dSU3B2VXpXdHdTYzlvCrtHMtrr2eC2t1iBDFVAkOXoldo7M8zwvwg5\n7C03KRafD/GzZJ03U0X260TaXJBZ09PaDUT9EFw3xm0hYHKdI2A=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKeVRYc1ptbnpQZVU4cXVi\nVlJSOTREdDJsTXFaRGNGWno4TFUwbDRQMndVCi9ZTmQzaHNOUlIrYzlxT09OTmo5\nNVhhM3FCcjhIOFFWOElIMU9rdjczczgKLS0tIHEreFIyMWxhYTVCRXRMUkFOd0pu\nMlBIc3Zvc1d5bHVhNmkwbWM1aTF5Mk0KPKFFkHbqd9BA2WRm/Gj8OBRAKsfSd7+B\nHAGgjPoGn+ruQK7KwnMoZKbqzO/HP33UlESwYkqKX6Gs2FnMkfEviw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSHlFUjRscjBvQ0RaYmtM\nR1U2OVp0MzlnZ2dCWHVPUzU1cHRZL3B1TEFVCjlSL09aRmIyR3NxaERBb3BKZ25Y\nT2x4VDlVTTEzc0dUUmFrWDdXVDc2bzgKLS0tIDJqdDJvNGZUR0ZPLytnTnozRk5J\neG9vM205WU5HaWxMWUFBTk9TRkkyRE0Kek0LhPNO3jdcBS3c2wCQVFppHlv5xLlK\n5zA1dbm2bQw4ncsZUB7DOngLNaSOqDZi/KUh4B0GMys0ci5otIo6pA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBubjlwaXIrVXZVTytoL3hF\nYTI0SU85WENrUHN3TFBpMTJzN1IvZVBhUFZ3CjNBY292YjN6T0ZwbGliVXN6aVl5\ndTVVRTRDb0xmaFZGcE10TTB0VkplVW8KLS0tIG8wMkdtczArN1pKdW9pdmYwM3pY\nYVZIWWVISWc1b293amRwOW5qTldySEEK1WPptSqttWooaWdE3Q3JnQQ2IaIOV5Lh\nzokdc8fYfYEMbwBhlDRT7HcSxnOWVxpFtxy0coSDfHT0qImxnXPXWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6ajV5aFVCS09jNXpnMUZ3\nOUE2SXdOZVF4ZDdBcUU5RWlrQVBkR3dNTWhZClRhcHhDbm43dE80MmRRM2FLK1NW\nVituNm5VWlA3VmN4blU5ZmhWVFVpYjAKLS0tIHlaRUNSeGxOalZ6YUxLUGxaUHB2\ndUNySmpUK0gvdmxKbk1UV1VmRVpqWTAKhXBWyoRqTWzHXNnH5fLApumygXjK6D3L\nTlM1VIKH3cOZE+NnzxvWKm1mO10OFHJjWIwPgiDXv1piAtaSVV/zuQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:55Z",
+		"mac": "ENC[AES256_GCM,data:ZVGVh+TzqTscOMAdGTv5miO/DcNlP7+7Fp8HpjgKmbae8n5KEyRvCuIYmiQ8yfiYkw3ViUib2qeg+Hp+fRk74HiaJoZxu4R1Q7AY6TdLKq6MFzU92MuUdsmqGgJ5F9ZIhDAJsthP3a9dgFmfnk6dpDeezUji+seiKrTRSa7QDE4=,iv:lXdzn6OF0zCQqwbj7Gg+EMerEPQKtkQJUF5Qz0NzYqI=,tag:HrlM20SRPeG4K9o5s2p6hw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/adhil/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/adhil/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/adhil/root-password/password/groups/admins
+++ b/vars/per-machine/adhil/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/adhil/root-password/password/secret
+++ b/vars/per-machine/adhil/root-password/password/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:ML1H8jSE5Rk5j75mCv37ltTbIJsHICC4JTLC7Rj5iOsAYg96KL5O,iv:x4+0YRzd95bCb1p3L9MF7fnslp+Pc1fSAIIaatAWlgc=,tag:dSK9wN4/UGy2oKP9YTfVXQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCY25nWEV2eFJMUGg3R1da\nUGFBWlpCWGtVd28rYVp5Y0hPZG5ta2QyUWxRCjJQa1d6emxBWFpnRnp5eExnd1Jl\ndUtnQVJLTDN0eUpCMGNmUHFhNjZGaDQKLS0tIEZpaGVwcjZlZ0MzWHQvd0tYcnlR\neGJlUXNadlFSN096M1hoZWJHZDlrbVEKn3LoknNBe3ts23nF3mc2xpVXvtfzTqGQ\nsEFxh2Bc7oPxUwLMYak5e3Ge+s7HrbZy4tBcmomEBqoZlIvxVUkTig==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEK3BBR1BLZXA5SjhRWlNp\nQzVLMVpJcTA4WWVlbzRRVGxLNEJUTGpEbGlJCit0cHBNOE91QWJ1b1BDQ0cyRm01\nQ3JFbTRzZlI5MjNMaG4rTXlMZEdlU0kKLS0tIHMxMEpNakhtR3lEQkV2SzgvRWJE\nOXFCQTJjWmxPQzQzWEhVak9DbmdCaVEKGBWTPff7xvGByMAv8WxXRjj1mDQreQ4/\ne2bmeYbnM2Mo3EnUCgOPGx2fOLGYnllOX3ftlSVMkrvWV3oOPOWHng==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHRNc3hmb0lX\nTmF6elBRMW04NGVuTUgrc1ZyMHF5L2dkVi9yOWhtUlNReFkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp5R3gzdGNRZkowM0NqQjV0NXJZR2ZR\nTmFGQjljbUVMOHF2OHJaSVUrQUIwCi0tLSByV0kxVGNYOHAzMTYvTFFIQ3Bzc1l6\nOFJEUXF6anhvZ1VRN1RrSGpqcGl3CqRvdv3waDtxs7dpyfMsCd9IlEFFF+KrgWzu\nNmfk8wLtwvsUPjZ0BIi4doNTuRyjqI/8bkmZLf138U4m2nV5Iwg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDhtOVAyejdi\nSks0QlF5c1B2eU9MUVFva05kVlhZWGpNSVVydE0rMzRubEkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpGSElXM2dNR3hEVHErUHh4VjFrUENY\nZUY4WUFFa1RwUzVEYVBhekJ1VC93Ci0tLSB1Qm9ybE00aFJuRFg0eG9QY1J5SEdX\nS3ZVNU1IWTV2VktXSnNzWGVXNGVNCqqelr64JT0H7x+Ik+OhqyGQe9H47jy2Fmoh\n8Olq0sTB6y/kWpldCC4Ek23DUhdbhEBwPE2TSgoF+2/1C605bOw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBUcVJJaWRr\nZUo1emJJdzVNaVJ3bGhkd2NjdUs4ckJxYlJ2eVY0Wk1DWFkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpUREVVQlRUMlV4dTE4SGEybTVXcGph\nMHJUQzIwQ3AxSTloZ1hxN0VtQVljCi0tLSBvenNtbkl6QVUyWkNNeGRrdVJnenJ1\nWUdXaDZMVWFnWGJYMWovdkExZ1hnCjl+KhCBKg0NJoBBpSgCuETv+NtWxY41sjmd\nP19vEEk/669AMzntigzLrDqFXI/Hclys70GYa3yKaeaVJMD3Rgc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnSnl4T3ZFaDNRa1FONzQx\nc2NPa0plc3NIUXVDMkFnMFBrbXg3NEwzREZZCkUvSlVwN25xa1NlWjNBS0I2Z0c1\nOHcwNGREODF0RTErckNuNFUrek1maTgKLS0tIHdDWmViKzZTU0g3RlEvUHEzbWxh\nZ1dUc09tbS81UHkzVWhaNit3MVF4QW8K+1ry0afhIOBIKSten5q9y+fyh0KUQil5\nImpr7dryNqoKtREbsSF+r6ciZpdFionAoQ0C4qIY9sWJ7KUfOBBwTA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxa0ZTanRoWTdWak1VNDRH\nZlBrRjRsYW9EMHRTOHpONkdZSm43QU9qODJBClRSV2VESjlKd2RWbTRJWG1mbmZs\nQkNtTEp4WTlLaWdWNlpQM25GcjFDSWsKLS0tIERUc20xTWdoMzFNTHZHcXIwV1VF\nYkM2dE1aMjBWbWlqSmRKVmFWOGh5a0kKFs0UDC0nnudKVz2H7afoLCBObWFBLP7G\nDX+ni9VRFrJoCIgrbHaxN7q+91DSqEDkVLceloEGkoyi5/WBET9JYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZmhtTmtuTEtOTytNT1RQ\nbUE3bDJoa25mWmR0aGZjMVpzbTlYNnRPcmlzCmFhSEVNS1lRWkYwdGZIeUZ0QWRa\nazA5cDA5M3hndDNiSlJHLzNpQjIrZUEKLS0tIHpDWG5saEs3VWlBZ3gwdjZ1NnNw\nSWpUNDJ3R0RsZTVES25sakZJcjBYcFUKYaIEPhk4lRWRBcOS5zoXbjNHJboQg+a+\n4FnlVXx94eKOMjEbQMdaBR0H5qUgZDnz4dOU/D7el4pjDNuF256xhw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqQ0E1d0hpS3J0SDFUU0dS\nTlMyYTJOclRQdXBmZjE5alQ4a0xQMmw2S0FnCi9XVXpEaTdEL2VkYWx3QUlOMy90\ndUVZTUorbDdjZE1TNWJhdWlYQjkweVUKLS0tIE9ENS81dEV2NTZLaUYrVXNJNVh2\nREJaU0JidGtqTUNYRkZJMGwxcTh5MEkKiD/vlux8FINMp6vvgZYLSbU5foT2uRU+\nWNZLQLd4ErvMoBS++7WgTtzf0t4Hq1Z+w4lBJfHWQ7rclqeM8NbXCA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:55Z",
+		"mac": "ENC[AES256_GCM,data:4Hsi7UPyYRYFDApmib0/sH+Kb0zeoUSyRSi4PGSRj0R4e6uFZyjgFHJJCRBQRA8oxN7Wtro/hB2+GSZtAdbxdgbbOr3wBt3cjSk55vVw/E6qySHEe/Q2sj3ZFRoYa19e95f+kMSl/5H9jlHUgKjouima8l6KIDrA84+6uJT/KcA=,iv:WqFzmdVHWlHB0qz1cDqeG/ALu4eqO3mzhUrHSh6cjnY=,tag:aWAdkkANpixGM8xv1wgCtg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/adhil/root-password/password/users/kurogeek
+++ b/vars/per-machine/adhil/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/adhil/state-version/version/value
+++ b/vars/per-machine/adhil/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/adhil/tor_tor/hostname/groups/admins
+++ b/vars/per-machine/adhil/tor_tor/hostname/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/adhil/tor_tor/hostname/machines/adhil
+++ b/vars/per-machine/adhil/tor_tor/hostname/machines/adhil
@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil
--- a/vars/per-machine/adhil/tor_tor/hostname/secret
+++ b/vars/per-machine/adhil/tor_tor/hostname/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:ZvrP0+EjAy4XwHc0jr8VXSwXLFti3eP2ZmRPbY845KG9RIYC+sd78NMKU/qZVYrkgtl1Exgp822vXuPtfR4H,iv:etoUSTfU3hOXXbujyiV8UmpwloshpJDfMrJbzS9V5Vk=,tag:0Ku6qtrdJEjUgOf8LQUpGw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXSHljd01TMGhnSHZISkFJ\neWhXNVRhc0h0eDEyYm9HL1hDN3VpelZYREVZCkpraVVLa01SZE5yOWd6MVk0eG93\nSnZVVzRUZEdSODN3clRFZVBZSWVmWGcKLS0tIGpDdWZuaXpaN3pERmp6YlhXRXlJ\nanJqbzJLZG9KM0dzcUVHeUUvcTR0ZGcKEmWayOG32AvDhLN6Xd0tL8eHrufB3sxF\nDdN4YWteG93UcjT/QGRRBhJrGWsGeIEytQwVMWCFovjbfjilHku5Lg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOWFOTFlsVXdqQTQ1ZDVV\naGExdGJZYVJwR05TQi9XZDVXT0pkQ0djaUZVCmFJZmJMRG85eDBHYlRFb2hrWDBv\nRnVkZmRlRUZZUVZwVDZBU3grQnhmM3MKLS0tIDhGajVMR0crVFNLcDh1MlQ4aUVV\nS3F5aWtXSDBKS1ZrOEU3M2kwMmJzdkEKnvVaTVUqvK14FwkAdlg0gsMdV3yzhMwV\nAheVVetBg6u2iUG4WGcmUFAguirYk5PkSTT3+1dvqFMKOpzY1urZJw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIWmxvWmlaMm5WWDFqOGlv\nSnZCYUlHV1E4QWJJamRML255SUNrNExTaWxZCk1HK0dvZWE3SC85Y2dUTkNxUWlh\nNlIyM3VwRjFBV0tZaVZvQU5KRHNvaG8KLS0tIGNZNkhQQm1YWm1ERzJGaXkwWUlB\nTTNZNjNIclRBOVViNVpQdEVlNDV1M3cKywBZJfXGPXOlCibhjW+NGedFzNk+0q/I\nldWtqwr+XPBl5WkcsRxJ55Qaku7PQoQBeGt6kTMVSCDEFM04gjLmng==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG85TVdld0U5\nZDNYd2lUVFlJeHcwZmorV1VtdnlsbUpmdUtMelFqQzJwRG8gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPYldqcWNuY2xMVFp1b1I4d3NlbS8x\nUkJqMzVDa2hrTUYyczhyeExoanI4Ci0tLSBWc0c4NWxLMDkyaEJnNDdlWlkzWHY2\ndU94WHFOaEdiYmtRUWlJNGdzbGZzCkyIAhIgbCxBKd0pupKW0gcbExtOYE37KMnA\nocTXXqdOqLu2iLB9mJcXIb9gSqRk1dY11lIFPhI/kqPTeaA6Az8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5Ga2VSYzJ5\nektpNDBKa2NZdEIwN2JsOTRxRmxUS0FOcjVicis1bjRQM2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpmR1ZQRjRFdVFvelFZQ1NWclB0SmtZ\nQ3N0MkJEeE96TjlhTmo1d0ZyL0NrCi0tLSBNVXA2ZHU1eWxVaS8zTU8rQldlMEJr\nNmtXcWUyVkRDZkQzbmRtRkpxRnBZCjDnFAJ+qncC4sR/dI86lAIPN8W5GojRgFg5\nh86SwUAgJUNS0kaoi/DGVosOWIt84A7L2JFvVAaKsY7C7LUuSeY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFJOZW1XNXZz\nZGpVTlFqS0MvSXlUNEowei9sQksyM1hJbXluaXJwcm1kbE0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpmYmlDZmtCSmVBRHlNTEJSbmZZcE8y\naUVCYWFqeGlVeUU3Q2JJVFhwS3FrCi0tLSB6V24wUUljcU5hcHpWcTh0Rk9LaTZ0\nc2RSQ0RCc09TNHlmdWhVcTlJV1R3CvmrzzdzzG0wnGnQE8sER95yqqiRaoctKCq9\nB+iItAwrUiJjt/EhW22rmBHbgwZ60BIZib4oHg/Gndqu0TFJPe0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBa2NWd2tJNjdkTklnSFNP\ndGpBS1ZwdlhRV3p4S3c2ZzFrbDlqcXFzYjBrClIxTlh3SFRwa3BlUlRzUTd1MU5S\neDlRWXhPWXBobXp5d3NXZExmN2lXOUkKLS0tIEZOVkJuWVM1Slg4OGMyYitKaDgv\nVVRvMUZSZjlRc0VIRm03N0hDUlVCV2MKIzPan3cZEY6bMIoCwdUnjcnoEVsDxjnN\n8AAciGYzqqIiAu9GrTQVQl6UIqw+juSM5WnEpu4yFU/qwqSCX121zA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZzdSNTEzb1ovMDhlNWFz\nSWpVbWxTaVhsQ2Z6OFhvTWVPV0hLY0hFM0g4CnJuMWlxN0UzNTFqbmFoM0I2MkZT\ncVFEdTNMWG1JR0liN1dqck44ZmQvczQKLS0tIGgvbGRWdU53S1FiT3MyZFhOR3Q5\nVnJpY0JHUm9PbDhaY0JjcDA0TWNVdHcKxKQSLcPl72nDAT9aFP186G4AFxcVZ5qd\nAlf5gGSHk3cXImHSgJ+kKOCWMgKXblg0tv58erbbZimDzeQI3Bdg0A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2TTFmUUNlTnYvYkV4Z2hk\nNzdCZUQ3T3RBTEhvekRrZUFIcVUyZlhGWENBCmFuUGdqUS9RUzZ5aWxhL3VWc0NV\nZWd0eG1sY1I2VzBSZWc1ZStwd2NUaGcKLS0tIDh2amZwWExVeW53aWJjdm1oRzBS\nZTY0Lzl3c3FjU3ErQ1F3cllZbUg1NVkKGbE/pqX+11PuHsigBcWo6R3wQl0+H0x1\n/l4bAkKf57iUXA2PiXqQNCHF6yenBQuK5BsjaPVvpw4pIZprlmATHA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bit1YUQrd3YraFZLOVpU\nZnBxNlJ5QVFUS242MjNxN1hSNU82VkNWMlNjCjA0U2ZjL21CQ3AzeXBTS2FWZ2FX\neTFkamZFWU5GYitmQlZ6Skpjb0tvdXcKLS0tIFBxMVl4QnlQN2lJcnR0Z3A0eVNU\nQkNINWtMdTRCb2FaT0VMZ2tpcFBUMTQKx32onJZyRr4kfW4uZq5xK6fac6EI+hT+\nZClP5JnLIQep+TLxDSP8iqFlXzBBmjPFS7FF2dHVnq8FTX+O942jdQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:58Z",
+		"mac": "ENC[AES256_GCM,data:mvYRln+d3qEvCvcy+L1kW+iwjsbqS63PsW9JlmAvRmXT4R1SinGU4QW2u7aNVJr/sHIdOItQG/jMhry1v2tJnbYjhMb/QyLo5FEPt+ExQnxZamYgjvr4bEWEF3RC/WctPmRlyureLFrYrPPQYSmFufaeLC9DWhRBCtM1aug1K+s=,iv:9fp0tDJjV5ZNjSiK8ffEqU5gxKSYdb+SE3qdERRP7oM=,tag:ZO4zChR/V//SVg8YGJ1AvQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/adhil/tor_tor/hostname/users/kurogeek
+++ b/vars/per-machine/adhil/tor_tor/hostname/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/machines/adhil
+++ b/vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/machines/adhil
@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil
--- a/vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/secret
+++ b/vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:D6SkcZq7hD3C0JaMQttHcEPVoP+DhrXMlnJVR82YLlrnCJLaV3zM1II2C+j7rveg3qwp2r1aXvHAQ11Q3i54yCc6xobVmAnnX02I67jE5Om6WBBIpDrIzDcUdzEpnap6,iv:pQs/3vcLvKF/tYHuW1kJegJ8XgCUGgsCXTLMm97t7R8=,tag:dabcB7XEXtzC45SThbSjoQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkVkNxTW5nNkxaV0VIcFZt\nZHZjN3BPdGwvWmRXQm9ucE1PODNKN0dTYzJjCkpWVFlrUitxY0ZYMllGcnY3WVdR\nNGJNbnFZNGRoQ08yOG1JNlZ2S0tpTTQKLS0tIFQ0dWJ5T2d1SWltUllmYlRMNGVw\nYmNLWHhzSjFyY1pXRjJSUlRrM3VXdncK6B9VifT3N5M2Yk4lH8IpM6Am23nQoPju\nWxKi1kEkIyw4xPJ9RMpNeVFlbHU9eS3YBXQFIICgb0+InqCnIOJotA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNWW9iTXVRTnBvZ0dRZ2p2\nN3k4Wmp6NmhtVGRMTVlmVkhLSW5sV3BNMnljCk5YTXNLMHRyQnJpTVNJdGNFeTYw\ndFpQWFp0QjlUZkp4dVdTUHBiOGdwd0EKLS0tIDNhVUk2UFRubmFBemxpSUVkbGx2\nODd4Z1l0WmJibmgwQ0h5Y2FQNWl0T1kKOZGt5jhM67zfekWUG6LnWx/5vgCZZO7s\ngX7Kc0chDX9UjiwqiL6o0VuicFDi24/e6GB5ayPuptpZQQXe7OPXDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2M21rZzlSdXBNc3QzQzRo\nK3pmQ0xKL2N3L0FtdWZPUW9BUGxyWG5jSjJZCjR4RlRwZThEVXFNbWI1MHU5WHdv\nM1NZcWM5RXp2dW84REtNSWpOaS9QalUKLS0tIGZtK1hGU2lIb1FXRVJLcFRoc0tk\ndnBsaUJ4SG9MS2JzbitCYVhBdTBLYXcKrrACkYy7j4PJsTJK/eVfon2QyPx0O6Dj\nprmfNlja63oQ6grrvT1SA3xjLnSepdUnG5fmm1OUhRvgTA88d1HV9w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5mU3l5NHNC\naVFRd2hCOXVMTnN6dHF3YUdoKzJXN1NGZVNCR2hFL3B6UUUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpFTm9lK1AvR0NJSTF3UHlaMnpXbW1o\nNWY0N216RnBmV2o0dkxOOTZKNm9FCi0tLSBtd3J2VWJUKzhXZnY5MmJyYnNjMWZY\nQ0F1cDF6ZHc1amFGUzZWbms4QjkwCuW0viurnY6z4/OkSBjHkTkwF2gsYbZ9nWcf\n/DkGELdBLmLSW0LL2vcbGAEOKg9VQCkVRgf0e4oR9YVn56l6v9k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFwdnpabnVL\ncWpvY3E2R0h2WEJrMS85c3JSU0JrcGtNb3VoNTNGdXhxQzAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpoeGJoM1hvTlZGR1ovaytwM0U4UGpv\nYTBWMm1hRUVacFgvYk0zQUsvTjBFCi0tLSBFQUsxcjM2QWFpR3lkU0Zta3pabGhD\nN2c1YWN6UFRSUlIzVnRxZEx2SzhjCvItTLJXR69oy/RhNNnGEQd4sVk7DKO1pnJT\nIBvUHE4nFCIXRVOkrg4bJhu+OxXZCSoa+L3ov7Vt4PeqJwT0UPI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdtcHQyR2J0\nWFFMbFlQUkUrd0pKRmJzRmVIUE16S05tR1VvUDJVQmozZ0UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo1UExWc1RrNHFacXNaM0RXZUIzNkR0\nMW52QkJZWC9BK0NjYVFLTk9CRVI0Ci0tLSBBSmtRb3BBeStiUjBkdFBudlBxdCtS\ndUZOeXFWRkhLcmR5Q2tQT0FKRVV3CjrKM1T6gU8jew7W/XWSRYmO9+NGvgz0AVWg\nRbi3fVVLIPyzipZQ2gbT7ddNPVRaohx6montYboKwok3Fv7vF30=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5a0FoZVZvbDVwdmNrNXpE\nMWRsUUhHNWN4ZGJRbEp3VUJqb1AxRkFlTEhrCjMzY2hFK3NpK2ZGbTM2cG52eGRw\nQlZCenVHQ1ZveVBOaHU5U0k2WHk5YUkKLS0tIDBybnAwV2swMGlMVlJCaUFlaHkv\nalhNTGtjM1NyVnlxZE5VQ0VzcVVaSFEKQ0ciXrOFqWTUnOnPFuoke6d1n0sQBKz4\ndsmAms5cg9QZCX4w/rycaUZHSdMCjMoshi46lyrlpL6X061BYBYVnw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrMTVubloxajN6djRoVTRt\nR2Y1SFVtcVR0Q05wcldjZlYzcGhxOEtNQ0dnCjdzRTRkNHpJSUJlT2N3UXVJU3Z0\nN3pwcFNYZmMxanVmWkJQTGl1bkQvTUUKLS0tIEtOa3ZQb1BlbkVKTTZQU0NPM0lU\nbTNGTXAxVS92azVuczd5eCttK1RjME0KXFxpBwKsu/o8N9vie+r+IGCPfyZYNXtl\nMUdEN/Noa3qxUFXMW/KkKinq3h7vgOORm3VKo+f1ABpTO8W9xnnhmw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2TUdBKzhwUVNnWG5XTDRP\nRzVWdXBZT01yd3BJeDhtTS8vNDhRS0tCWlZFCjBVOTY3ODZ6MVRNUEtlb2Jta1kz\najlyLzhXWkFpbmNsQnljOWpjcWF5QjAKLS0tIDIyWENUODdZc0VjU0t1TXY3THJK\ndFVmOGJ6RkpPNXptaGtjSVBNdXhNMUUKGAKzc6cu8Ry0GcZBTezYD1gT6yu1oRnR\n2z1ig4Y96e1ucklEt5dPgOMWQ/mY13WGGVCV6RatIKKd3uhmcgRFXQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnVzZ4OWUwanBnUEROd3c1\ncWVsaXdXRVZhTW50Sjhnd29DcmM3Sm5ZQzNFCkMzTFNaMlM3dWVWWFNPTU4rTDdE\ndnhNNW5jcHN6SnlOVVAvNWRrNllZVkUKLS0tIFd5UHh4bHVqM3NwU1ZhM0xMV3hi\nQVRVa3ZEOFRKd3VVRWdod2o0RFdEejQKVk7x/M18oJyRcVBvMRxkumQAQBdc960J\nrdSJmyB1QOqr7/YpZiHnG7YOX6eL4+KaEZxEyAbecaWPIpETM1SGCA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:58Z",
+		"mac": "ENC[AES256_GCM,data:YAIlotw3wXAe71LcY8N6Q5WigtvqhUOGlGr2zhvoXwN/CkmjIFRDn2VGWAcz2vHZBED2RQpWF1+o82ZhfZ5mdniq/Cm1TSjY2B+o61KYliZCkzUn321rpdr7vp32VsCN5kWMSwZiCvVsKu6MHSlF5eRfkw6MZD+gyC2Yv6ZJCIM=,iv:0ilFzPpFIlWDyd2xtE9qIdXQ4v3wh5tz7xBh7VpmW3A=,tag:V9kILdld6zpqSjJ3IbNSyw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/users/kurogeek
+++ b/vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/adhil/yggdrasil/address/value
+++ b/vars/per-machine/adhil/yggdrasil/address/value
@@ -0,0 +1 @@
+200:2f7f:2ddb:aad:a321:47cd:c221:e35b
--- a/vars/per-machine/adhil/yggdrasil/privateKey/groups/admins
+++ b/vars/per-machine/adhil/yggdrasil/privateKey/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/adhil/yggdrasil/privateKey/machines/adhil
+++ b/vars/per-machine/adhil/yggdrasil/privateKey/machines/adhil
@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil
--- a/vars/per-machine/adhil/yggdrasil/privateKey/secret
+++ b/vars/per-machine/adhil/yggdrasil/privateKey/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:osik1H8jlmY2rRRflEcyu+RvrJjT/mL3D6NM50ZgH2YDU5Gxs9/74KQAi0P73d/r+UkuEoKMjKk3bk9j05f52kNlFtn/B4HJWLCFSTbphTuK78ydEgFK3Lrphvw21Rc2Uwr8sofuLlaTF/cvmJR+iHjCHQgA7ZY=,iv:xt1Ncrv1Zei30j2b0Ct8bfBfCI5W2mI64ohj1ZXbP4k=,tag:G+QIBbl9/0fLt1Ku1XQKFQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0Tkk1bWhzQm0wMkdXS1Nm\najN4UUd1c0R2Zzc1WU1yQStwbk83WGtvNEhBCldqQ2ErL2xZUk1pVnVHZ2VPc3Ra\nS3NQUld4VjIvcXNJSlJGcE1OMGNUVlkKLS0tIHY2K2hZRVBvNVhyNkFkU2E2K3Vz\nMjlYanEvYndYUkNQSm1rZGFGampQWjQKZLQ5WYK1JvaiG88eR1kkJ78jludWEKto\njhebvZugdohiUFpNN2JSliZn+m2R66edbcPPIyAzd0QWLoGIZfXFog==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvU1BQek5GSENhbm80aE1V\nOVp6NVRMai9JYWtyeElLYjE1SVJBWmQ3eEh3CjBucUlZSVdTZ0VZZGdkWkRhdkpY\nQlMxUUx1aWF2YnJGbUsxSVRQd3VOYU0KLS0tIExubHhxTU1WYzZLL2ZBL2lESUhp\nMTdFZ25JRFpvVWpYVkFKbTVwaHVIc00KoNXFsay94a7IuBFGcSC36zrHq+1qkqzU\npMt4tMKtIJqX8siQ4Tbxj0jLaSQHXikYse4XfpTwkbe0dSun0sW5/A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsa3lmNytSVWlYa25ob2pj\nS3RwZmt1SnUvWEhRU0tyRkRNWWovSDk4cFRVCmloVm1ldEhpM093L0FPT1ZmS1JR\naExJZTl4aEtCUW4yUklsV1JYRnNKZ1EKLS0tIGVrZjNOVW5tdUV2cjZYSitTV0Fu\nOEdVZVlDNHpRalZnZzRPSnBLTjhLZDAKk/pPofS8/pV2p2+UZ0OCLle0bNXbvoo/\nutQ6jZn/f38EO+EbQR2jkYqXNgZYxPAkKlWdTrXv2ea0mbDNo/+m8Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGY0TVVKNUJs\nYk13NHpFUkVxTngyWTB1ZG5VWW83YmpvZzV4RG9xUFltSEUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQoxbWlEdzFYdkhDejRZdTM5aUVKS2J5\naDRVMFo1ZGV0NEZoYTBuRUh3QVFRCi0tLSB6V2lOdlZYRCt0NDdoUHQyYTZDMWNT\nekU4Y245R2JSb2xOeHNoVjlFck9RCoKgFI8RJ84wjXW5/hGxDbyPmQzd3ydjbqaQ\nm/z4/VBxTdNXoTrH00/98FspT00G+nJ7C5k1uZPJ206Xk+e4b1Y=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNVR3d2alpN\nSS82VjZhM0p5YmdycGZNbWlnTERXNFBEMDNaM1Q2ZG01bTggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpmUjMxeWZHTFdjNmpoQW5QS2NLenNr\nMzFoNFpSQ1dzQUVzSVNsck4rbTJrCi0tLSB1VVVDZkNsLzdhekl3VkZzcU5nd1N4\ncTdURVdhRHFFU1hyUnNvUGhtTFl3CgCyILErH6Y85aAw22GOCrb3CasMfmgSINQ0\nDK3UBwcWWsNh+GPvTj3JZf1j7hgKCy7YVfheyfQkIbsZL6ux1oU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDBka1Q4Qklw\nNmQ0VytHQVJkSHVydVhIRVBDY0l5NU9uZngwY2tNU0taeGMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpoekh5YVZTMmR3NzFUaERBNHNxVGZv\nVUt2U3A4Rm5yM25aRi8rV0liWHBjCi0tLSBYMld6NGUwL2k1UXVjMGRSY1VldjNx\ncDhaUG9QR1RPNlhGRVpxeEdrc2U4Cq4cTeOmldkIs7Gs82k2fNsGeZ+PjQ22OdWV\nQIc3ofwSLNqN3pOys45op4qh5zWaAKnIMMJxYa3ityARs767atc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUVZMaUNTNzJGQThwM2RY\nRDdRM0hLdldKdWNNZjJIOFlURGkvSXlJUVM4CnZGeUthOVFhMEQ4VVJpN2tnRGFU\nK0NuMGE0UjFMR3dXOU1DRGhqMXZzY0kKLS0tIHNTS05BVVB3WnUzUnlYT0s5cEJx\nbHFrNHppM3NFTzlzYm9OSTdpQ3NFazgK0dIxxn1aU7ge8pwQofF7RrYhfOVThkVD\nKa58EdqIrMHUkMAHV49CvA2eQkOxyXMg8b7Bodj7qXAb+7vvewMW1A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Rk9uMW56VU14TWdEWW90\nTTlqUlg3NTRlSStGQXV4ZG0yOG9kVUQzM3drCmV5aW52Z1RkMlR0cjV5akhNc2dG\nY1lnalkxL0hHVldpOWl5VmxYOEZFVHcKLS0tIER0MUpaaVVaL1IwM1pyUDhvc1Fi\nSm5nM05Ja3JUblhhbWVlMEVMRDQzMVkKNXBvnSWF1SZ7k5gUkrPQmHoi8N8w5+p3\nmxK3j2cTp3s7WRXhmZQrOJ/LpvMz4+QODa/z7xbrOEF4nZEV7Ze0qw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ekxRZFJJTDIrV1Y2Lytz\nVUpabXJ2QnNielh3SkNnZndzTzUrbmIveTFjCnlRWUk1ck1GY3ZKZGQ2dkR6SkZY\ndFMybzZjOFJLN2lNbWdvcjUyQ2VFb3MKLS0tIDhWZDVpSW5XRi9rbHQ1YmN3Mnk0\ncUJmK0t3dTZPa0xoNGJFeTRnaEdjdm8K1vaXnIor5DC7KkOBjDhyXp8/ZCiinZ9y\nIQnKuljWn0YMQgQPzv7TAiySIqyqusv8TKW6lALJW2iTvH4K4h2gQQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBidW0zaWcyMVBLNWt0cjY2\nYkFpWlA3QVcxeForazNRK0lDUlplK3YvRjJVCmdNZEhyNG1zakZDT0VGUUtzejFX\nYVVZdkpwRFpxWFVjM2NVMDdWVWFIelEKLS0tIGlEMnp1WFM1bXprTEpkcEhmcTVn\nTnFEbHBraTFBMVlWRnl2ZTl6dGhyOGcKO4W7xBNmTzvGfYjSvQzJ2VWWXYktupu9\nHmlOG8W5G6pL2XOTpnKWu8eANgP1p7KC1cGZ6H1xYMbygQBCZ6L1sA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:58Z",
+		"mac": "ENC[AES256_GCM,data:abr00+D9BW7cOSMlQT8UO1sU2tea3N/Z1XdfRGa9vu9bEVDxh/KP1vDk3hYn/KCsmq3pSA/OPpvCX2TExipFriQge+wv1Yq49nAUG93NblQ91Jk7oOB83o7ha+9zAuMo8ozD4/uPHLy8XQWRD+FLMvR/dReR0JDl8R6VOVIDRdc=,iv:HW/TnbVF5y0lKaO4uNbebdfyPks/mxtjSQ+5KamUSWg=,tag:khMUxUtjD/K3bWWlZ2bOVw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/adhil/yggdrasil/privateKey/users/kurogeek
+++ b/vars/per-machine/adhil/yggdrasil/privateKey/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/adhil/yggdrasil/publicKey/value
+++ b/vars/per-machine/adhil/yggdrasil/publicKey/value
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA6EBpEnqpLm9cGR7vDlJhhb6GvxhUdidzSUAkjZXfj2s=
+-----END PUBLIC KEY-----
--- a/vars/per-machine/alpheratz/phonebox/ata-local-number/value
+++ b/vars/per-machine/alpheratz/phonebox/ata-local-number/value
@@ -0,0 +1 @@
+00
--- a/vars/per-machine/alpheratz/phonebox/server-prefix-number/value
+++ b/vars/per-machine/alpheratz/phonebox/server-prefix-number/value
@@ -0,0 +1 @@
+40
--- a/vars/per-machine/alpheratz/yggdrasil/address/value
+++ b/vars/per-machine/alpheratz/yggdrasil/address/value
@@ -0,0 +1 @@
+200:8ca8:7950:11b9:4bdb:35c5:c2fd:4e08
--- a/vars/per-machine/alpheratz/yggdrasil/privateKey/groups/admins
+++ b/vars/per-machine/alpheratz/yggdrasil/privateKey/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/alpheratz/yggdrasil/privateKey/machines/alpheratz
+++ b/vars/per-machine/alpheratz/yggdrasil/privateKey/machines/alpheratz
@@ -0,0 +1 @@
+../../../../../../sops/machines/alpheratz
--- a/vars/per-machine/alpheratz/yggdrasil/privateKey/secret
+++ b/vars/per-machine/alpheratz/yggdrasil/privateKey/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:pIN0ug57t0Nc4YE6o447R6zXwmCl3QALfbVyBUg9gxCUqZLQFgEzJ2ab8Z/3DJ2dw1/W2GV9BhpeeeDdlhIWN/IGbyOaF+dvmYdNY8llHfLWQKrVVJtrQWI8SOvrrhBeE4KeKbRGJ788UP9FWcoJTjLJOfDA66s=,iv:gyf8xE0dODThkZI8hSKMDAlklljVzeVfWLsfRtQVO+w=,tag:wVIvYKgb47iPqlzcybvDNg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1aFVkRWljZEo2QmRsQTIv\nTVFIQktOb0J3YW5pcGx3ZTFxYTBRb2lxQ0Z3ClhiTzZ5ME9mUDJ2S3VFY1hZOW1M\nUy9NbU1jby94cWQxQmwwZjhqRTdaSlkKLS0tIHVRbjkxUkxXUHFEcUZmVENsblgv\ncHpuRFc5ZHJ0WEJOejU5dUJhTjBkMVUKT2Oxa/KNjxqK7FMNq68R1YXfML58kshg\n8oTEvgd+/0ahXNpVARpAXzDjyvAfkywjjGNnmsoI9KynDyf8u7idLA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17c9908f08w2w0ajprep4p60a7hd27cznrnxmq4mxwznvgzjuhymsxttd3d",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOSmcwNmw4T0ZaVGlBVnVW\nb1B2cmNEaEYyMGlXTkZqamFiYlhrMWFRbGcwCmkrS3U1MmRBMklnZVV3M3dXMnVj\nc0FhYlYyc0dud2U1dnJNRU9NTk1Pd1EKLS0tIG9kVnZEMHNWbE9iTm9Ebi8zekpM\nYzZUanBPOXEycnV0Y1JwNTdKZjlOdVkKshbBc5SlSBkkS78f8kI24eynfdxoIad8\n+9mMgij3Uii1FSg3xi2Jv/E6hEPiQI74rI1Iwhxaao6T+jMxwEYe5A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSnlxSGlreDBOTnZYdDlW\nZExCR2dMUGdZbUFkNDYyaHJCNXZGUHZhVTJzClRCbmZGZm9ESUV4SEFZdkRSYlpa\ncUdOSmhNanVsYlJLN3pNV2UvZm5uZ1EKLS0tIGx3RGx4KzhXYzAvV0tOdWxtcXBl\ndW93bnY3WStnMjFYV2RQYU5Ea2kwd00KLkX2Cxs2sWAKkt3mR7xFtLj1wFKoSPpn\nDtBvAW9XvQlo/t9QIl5AxqaUbQ2PmwAgmrl2VwAnsRalqxZBUeZh0Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDhyeE1VYWVI\nVTlLY3NVWHJEdG1yZGNnUlVpdXdHdWxzY3FxaVRLaFc3bjAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp4Rlk1bU1JTXhWdDZHeHlkejU5dVFR\nUi9xcS9pQmRWVHZMMDdxWnRBcGprCi0tLSB3V2VxNHRPL1RQTXRjdU42K3pxb0gx\naTNFTmlzNzNjTTVPKzlscnhSYU5VCvtKkp1N0t6rl/Ay9ZZd6sCUuOTIG5qJ0/T8\nyMA23n82bz6FG4FZW4hgF11emGufuA5SAQ8xrVx7/38JNqlPjwk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEtObkRSRVJ0\nVlV2aXdnNEE4Z0FST2JmVFRkMXd6bGJ4WGRTeGtMWFBJa3MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpuQ21mNlVLQ0hsLzQwNUVaclRtc0pR\nR2RGMUovbitpZVBMcStlRkxXNFpzCi0tLSBRNlBxWFA4dFdJelhtRUFMdlU1UzY2\nNnVDSzIzc3ZjVWxXUWtXMDNsUCtNCrVf/NrMeerp/HJ8Da8XkoGD5m1y+WeZPVri\n77WVJ1H/fVLwB1P9IZjrkptBuAg96mlTufKcLlC0d9faTEK2Cxw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHQ5a3c4Wm4w\nTEZFcnJIQ3poK3FKcitZcDd1dnFLbVFVWFRlcWQ0YVRGQkkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpuQlBEVDIzRUtJRUZlNmpHODMvUUp4\naDRVN0x3ckJxMzlYWndRZkw0V3VBCi0tLSBUd3hoYVZHOFZHMGhrWlY4bGFvZ3U3\nSklHT1ZlZHZhV2lXWk52d2hYNTRnCkA6xETztzqzuLQZYuZWLMDllrX3+fg8rz14\n6lWVtSvEZ2Ua86M91MhgNl4wzmAXwekBdO9QNpUKXM34m51q7KM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLS3FPNWpDUnFqNlYvYWRh\nbTV3TEdaajNwSDB3b2poT25Xc1JzdmZOeWtRCmpXOGZWbnNJZ25ndFIyNTRFTXJG\nT09SRW00K01VTkI2dklUeU9FdUsyWG8KLS0tIE10M1paalVrSXRNTC93QWp1WHdO\nR044R0ZhaWtFVDBGc2JWL0FlanZ4bTgK4Nen+J3zC9JphPYB0MZo9YdmTr5a+hYd\nMCLHuJaFKCriyD3/dB5yXcZI52ww1ifKnA/MZi/+Fb4R5fPfM5mHlg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0eFVaYTM2QXFRTVo1UjA4\nWEtSemxNN3lOVmNRUVRCN2NXczZpVjJuVVgwCmZzNXlhRW5NQXo2ZzlOOC90ZDN3\nbXhSQmNIWUtOenE2VWcvb1ZERncwanMKLS0tIGV1Q3NCaDREWDVFV01vKy84MHBx\nKzErU21KMEpzUE9jTmJkc1d5SU1vOXMKm38yZboub8ke3e0MgCAFFGlUZQjJcUqh\n7UwEWk69+4FcFkUv7Ub9q5sni2HJE1i7YOgTTb3EN5xYLcCRhk9oAg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjeFhKS3hYMXdpczZ1RVpt\na3IxN011ekxuY3dVY25iVGJlMEJOSW53WFRjCmYvRklCZUgrcG1sUVpXQWl2RHVH\nM3MzeTlnenBXNUxXN1R1RDZDbTdaTmsKLS0tIE5GcGVNenF6MEp6Rk5WLzFGdEhD\ndFBLMjVvNk5DYzNXME8vNk9KNXNwdEEKFGorF1OE9DeaUPIJiwoForDrKVdpQP0E\nDDlcqHG2ZvGbuy3Q68u8pVDZlt3UaTmS6sA0z8evdiOHKpITwtvo3g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuSU1RL2czOTkxeHJkQ1hk\nNmtOd3NkRk1SakNFWU5vZ2xoQkVra2dWUVdnCi9oanAySDVsWXh5aXk3YUwxS25X\nU3dNVDBPRmJyU3dub1B3ZktVNHg0dVkKLS0tIEs4NWNRRmZoVGZHbERJeXpINi9R\nVWl0TXlveHpxYUdXOWQwdlM4TmxFb1UKnK3fW7pD7woO/pW7mQzDwfVpczM0Iu8L\nR6ZBW4FBIdNelVY6kcy7RT6owgss3PkEGqsKP/oGTE/9LmX3MKKgmA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-07T04:26:52Z",
+		"mac": "ENC[AES256_GCM,data:I7smVVcJB6iwilj1KM+h2Ukw7mzmITmyYyhGkWO8nLCcWBs07NMSEQKTNO36UmMUXJQPlHz755VxDVROUtC+cmP+sclIArDdSr1rVX0Yp2ot983C1Zw+JvQ43b4AIFFc/dAJCBQO28j7qPxr1H42LbC7pxWKNZ6SvL3NI0ze8wo=,iv:h3MLCK8GJ/MLB9GqGtyOOgBvxh6SLvj1YWdt0munXBc=,tag:OY0Uxop9OqUobgHtSNpQeA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/alpheratz/yggdrasil/privateKey/users/kurogeek
+++ b/vars/per-machine/alpheratz/yggdrasil/privateKey/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/alpheratz/yggdrasil/publicKey/value
+++ b/vars/per-machine/alpheratz/yggdrasil/publicKey/value
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAuavDV/cjWhJlHR6BWPu1IJztsbucWYelslnCMZAwKfk=
+-----END PUBLIC KEY-----
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpoELc7KUBZapdah4iw1ynBfkqw3QCZsLC5/2qL30DO 
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519/machines/buna
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:PkLUYZPDYiwkVadZeEF0KqlLm4AldsjdxhrXt7R3eyucOBXkH0z9sm270LMFr4s4H9zyyR+YyoPFF+N+WwNW/hpr2XcQ3hmPwGUt6xyeoKX44MNRibkbzOvcKTy6lG08IlzBEfnAdwAfLJPetKJwvKaq+CeJKibtDhyzKRTjyEVjdSHVEU1bGyPekmnFRMi0U3c/OYehK0kez0XBSZKWov9y8zeDwGGGi6BZau4FKXydl2Tvl/qfQs/MN6KzdgjcNi8Puu1vdHjmseumIZu7CnqM8+Hyi4W6q/jL88fZhLBcqpJuHKiXvSEsnuZdltxNalYhyumh2dzzAoY/dmJSXQTEzkSoUTfmmCmP8DJRoBVrQzpnMuu6uqqIJLZmT/pqFsiiugOz3Qn/cvHCQtDmhDX8gURAEIzYYOWw0H1T0Lh3FFwKAOt7bIrnnujFL8h6z3aRbBXqTIkyruQG10hH+zyeF67C+4Nwx+RmAWM4p98RYY3LQkc0zqquaaQSCvrahYmX,iv:Eqh0b87ZQfkQ7ocQ+x8VG+kEWi97j6VM8CKbVp6nBWg=,tag:R3/Lo+UJf6w7MUeB5mQcUQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UDhxNUY4bm9idWhHbDU2\nTlFOS3lnbDI4bkNmMXFORjVsTXhOVHhtSDFJCk5JamM1MkhWcUk3Yml6UHNNWWM4\nbW9NMjRpaUVlem0vZ2Y0bG42UmIrc3cKLS0tIFptODNuVHdpWGVNUStGZDREWGhR\nRUdRWWJXVWxMMHRwcXdwOUxCYzNBSkkKGydSG7ARgXGQP7jxX0+UeaqaZEeU9x55\nzyJGTaTW8XL9rCojeFVeKIjATmc+hCQgaQnYxtYgufcvGcMi+4OQZg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzYlVla09VNXVELzloREVt\nNG8rZGFDdzZEcGF6eExFbWd4OEZIcW1qM25JClMyd3dCVEJzaTVVRTF0Rlp2K24v\nZ0FmRkRzNUtIRWE3cXVwMWRyUTdMdG8KLS0tIHptODc4R2xvdE02Q3ROM1pmSSsy\nclpjZi9IRkRXaEJkeU5KSjhwZWpnK0EKW8JOuRMnJuq+VkVpP6xS3eO2p54vJN1x\nGbVpvSz0EMpy/HNrcZg5JkQ2RaCL4eFzU5OuAqaorCG42yVjGKYmYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGpFdkRBQW1x\nWml5ZURVNkNRUFlRUVltcUlWNmsxTWtpRjF6amtORGVCVlkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpscjNlblVGb2Exdkx0Y2k5a2NTQzVk\nZlJweTdMeEpJSEYyWHBqQXJVQjlvCi0tLSBEV0h1dVJpaG93YnlPdVAyNlpDdmw0\nMVVrdE9WWW53SkRTS1JNeE9jUjQ4CvCB2lynRtsXVep3c8by1ZZIJeBlSS3lig0I\ngnkn0IrTOvRzTcZzTUFzhdMHDtcxb2NwoCfvQi3hqWZlfASipe0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE80M1lUN0Rs\nbUF3M2M5OWxqeURnVkRWNDVoT2RJZ1NQK0MvMi9FUjI2SGMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwoxbGMzak9IY1F5dFJ3WW0vUnE0alM3\nb2FmTGVRSUNIeVkyUmY3Uk9Oa1pvCi0tLSB1MmpTQno1OHJsUGhBQ00wVU5XUTBm\nMzZQVDhDRCtQbVVJOC9mWXM4ajZzCtWLZ6RxyZXdFoyR9wJnXsRwaGKLj4cLheQY\n6zRRBd6N8B/tQL9MxZlwSZGsunAom2dLcxelq+xV2Poj/gD1Un8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFGTnZZUCtR\namhnSndqd2xTaS94eFhGK2NXN1krbDVUbjkySHBHSXczaWcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpIM3ovcFRhbXR1K202bFNnaVBlMVdU\nYzNkWlN1dm52ZWFrWkt2b0MzL2tzCi0tLSBMTCtFUGJsVTYrRTlCL3pWcXVTMlZn\nc3NrNzZ6WUFEeHB6MlRXcjZ3TUlrCq84B6Yl9pQvsMtXBZZOii9vcSa3PQ7JLh10\nDr8YguAqPPhFz5tMWMPAcTHZj/VKxtXiteIg+zWD2kzoTHR3a1Q=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRcVdHR0liK3ZFZkhEdDYz\nUDZkQTJLK1EyL2FMQS9uQnM0N0czNlhlK0NRCm9TZTllN0lKMWZaU0VKdjU0Y25L\nUWU5TGhYaFQ0VmJ0eUVzMFNTcnhhd3cKLS0tIC9MTDA0Z05qakhlT1dEVlBwSEJC\nTTJkQVU4UWFTclg4RXVJNDBqYUg3M0kK6FsQIJR/GAAnVQISKP3dHfk/ZtPT56ve\n2t5TKdBa0fdO+8VD51L0MmgyZM7LHkALXx2EVS5WoOSwlRFLdhzIpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFeGUwNjJGV0drcTJDTDJJ\nd3FHU25zN3VkdStmeGcwRlhUY2JyNkoveXd3CjZ1dDNxWGUxeDdRSHBqWlZxK3Jo\nYzF4UmhSUk85TEkzdU5RYWFnZVg0QTQKLS0tIGRhc25oODdmTkpoSE9nbFhoQk1X\nc09vRmhxZkdEN0xOWWtQTDQ4aXMrZTAKrIYAGi+PUht6y6PpEGOre5XP+Y8g4lo6\nS9yArdxgeVQcDKagImpEHKlGSrOl5bYQPLotPxB11ALDlyHKnM5/Pg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNWUvMitXL0dVWk5xNXNv\nV3dKZzlJS2Jkc3FxWGVNcnMxb3g5SjVIQ1I4CkFLY1JvY0c2ZkpRSHdRQ284L0Fq\nL3dxRUEzeFJzMzQxYVNYOHpwVmxqQ3cKLS0tIENUUTFtWlpONUxld1lJR1RncXc2\ndGlHOE9Yb1llQzEyMjZ3M3pnWjZQdXMKJfL79dpS0q6QmMT83PH3QlwWXQn1b1d0\niNATdTBAtySx3gGvRjAbvtRp+eI+esOHsNxjD30Ea6QMY2XvH/oSzA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3dFlaOWkxY1QxU3didkhX\nR0Jobzdnc0EydzVDekxLam0yNnc1LzlUZEZjCm1HdUVzOGd1cTdNVFpjV3hNK3Zv\nSkg4eVRyMTRRR3FZQUJGMnlkUjF5TG8KLS0tIE9zVG5wb3VoeC9OTU95VlA0ZFJr\nMnRQTmdHbUcxZXQvNU5sRk9OUGZhazQKLsT2DzWwfp/1xgHpfVkp3JPVgSId0q/+\n7ioCCo1P7JUXjTEoeva5KW134a3bKumZcQxHyyQSrzqpLdvJK/hVqw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOFplZ3lxTnd0MmtVMzlx\nTjc3UFdSVWhnMEFxeG1iMGJqKzlhaElEUEdFCmt3cVpKajVyZ0FCSGVoUGY5aGJx\ncVNMVnZ4OVMyTUhMamFMazdhVmtKdWsKLS0tIDAxc3hwTGlxM0gzeDBudzdpelE3\nSWZnVVVEUDlsY3FSQXovQ1E4ZTc4QzgK7ww1he1haJFK90YI7NDiQNVDh119RNUS\nzbo4/tP3JBXqvP0rOMk+sRk1Yt8lz0QoPvR9Ji+naEjDqHSgtYJxoA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:15Z",
+		"mac": "ENC[AES256_GCM,data:2m+g/V6q4vY4PfH22MUg+G4Tpg7eWe3oIQ/BYxky42OCoXtPXdynI8Y65XRxicqmrjBTNXJgpU78my2VYkRrWfrvaoz1M+LnUQqjJ7R+qvFOmqrgHWPK0jKIMCSNdv8q1pYaVWBgFqX8rJ+xoOK1IjC4Ya+EfiXfDHI6ER2Ls/c=,iv:L4Cw0zM0x0WL4CCVOUaxAimmZqfnTDz3JUcAjGwy1gM=,tag:JYm8EHT4AdHinc/YqC4Hgw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/phonebox/ata-local-number/value
+++ b/vars/per-machine/buna/phonebox/ata-local-number/value
@@ -0,0 +1 @@
+00
--- a/vars/per-machine/buna/phonebox/server-prefix-number/value
+++ b/vars/per-machine/buna/phonebox/server-prefix-number/value
@@ -0,0 +1 @@
+70
--- a/vars/per-machine/buna/root-password/password-hash/groups/admins
+++ b/vars/per-machine/buna/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/root-password/password-hash/machines/buna
+++ b/vars/per-machine/buna/root-password/password-hash/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/root-password/password-hash/secret
+++ b/vars/per-machine/buna/root-password/password-hash/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:HUFNDbXwKe5lLHeqp2SnTYHMgFKqYv9y4rtK5Xzx+ulWUuwYzCoa+Zmobc+JKD9j4mdRhP8uT0W6BpaqF6E1v5aSeXzrUcFVcZOESVcwcQsR1MBAyiMIbnmBBlcDnWgBjXr5/vYvbYq3Ng==,iv:VMNsNwwVKlBAvFT5fNDZZqjS2lceJMKoj2SY1MLUDKY=,tag:YvRdMqtBu3pSn9mDwEF9kQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGOERET2ZycS81R0UwTDJQ\nMUV0cFFHNHFiS1l4dktSRlJzK3hnd3d0NXlzCllPY0VwMUIxOTNjWndnZEZQcFcw\nUGRzamkyKzZPRXk4K0pFZmFBTGVLUnMKLS0tIGRMZGYxcHVuTWd6MVR4QnZTa0Jz\nY05Td1l1ZDlqU0ZLdU91REVLOUlkakEK2d6T5m0qvMKneu6rn1jy2TdqZNfgovYU\nrKA2WCK4Xp81OoRNIJODFutyF40Nk6vgLHRL7qUExV8UpVWT8FpFkA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZK3prNUpPNEdwSjVqc1py\nbkM1UDl6aElIWnJGQmo0Z1gyS2JIZzhnUm5ZCkJkdDRzazZMYzV6UVlHZkFNWkdW\nWjUvY1ZsVjZwdWdiOUp2c1lVbnR5dDgKLS0tIGVlUkFOTHREWFFzVTI1TmQ3NEVP\nZW04azdCNC9JdFFJTU0yT2tUL3JnRVEK/TZDrOpgTRFm4y7kcflVWFgjTbeWm9ZU\nGBXOyPtjYsfdsOIpLPEnhWFsg00dOvf44IZgfueU8WvZEFMuLBfewQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFcvbUtwN2R5\nZjdNY1BucFBnZ29OQ28rckhyYkt1UTNrUnRCQUVSMlp1MGsgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQptd01yN1cvQm1PZUVJZ002NTlZWjZv\nWVhETUllUmdTVjRYU3JSSHFOcXRzCi0tLSBRY3FUeHpsV3I0bm92TlJ3T0RZVzlS\nUUt0YXUzTU54ekpBVUEvWi9vQzZBCmNS+wVKtwAWMfZqmngiX+G+ULKEmMcvyQ3w\n3HLPOgTTWJnydOKGbueXwWO1y6K3yuQLhlsVW+1H4NfwP68nllI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGk2ZkdUUE45\nb1kvc0p5Z2xKdDNSdStqdHd6bkJsYng0aEI1RjVJQldpaEEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp0TnRIbEx2aDVOdlQ0aU9HZ1cyeEk1\nOVBxdmdhWkwzbVFoVU1mWTdzVXlvCi0tLSBGdEcrbzdZakFQTEVCQ1FHbm0zMWdL\nK3VKTGhEUm5zbzJFSnJZYk5UdXNRCiL3C1R0+wuhAgMH6RepLBwrUOiZ1C/+NAwh\nVDB8/TM0Qp69y9aAq3Ew5l99NC9FWCRMQHRN9YYX73sPhB9Zaq4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFVYdUN1OTlW\nSjJwMWk2NGV0OCtGdFhxWU5pWlY3ZUZncVhFc0hXZ2t3RDggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpDVHFrK2FqNi8zbE9mTmVxWnI0dzh6\ncmRreDNsQlNsbnBNRUpHOXlwalNRCi0tLSB6d0hLQ0dFVUtSczEvYzd1bHNSMFBv\nVVQvUlFiNlMxdCtuMERJQXBDZDlRCgQ7voqoNSiZg6PZiACkApqVnPUawhjPeeyM\nvU49g0E/FdnI6vz7GQNqLWyZiQFEUVyPrlWRGQHD27vuXjervKs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0eVdJQVBnN0xYUDZ5cXZG\ndUV6dzZQR0NFMW44WExiREFHcXFGcnNBVDNnCkY2eVNXYVVLOXlOblJhenJYTnJ5\nRHNIMFNnUHhxdzlhZEd5aGh1UHQxcjQKLS0tIFplaFVLeDZicGgxa21TaDVUVUUv\ncTVNU3NWTTBrbFNsajBSV1ArajBUUzAKAlS1fEYUjzMnVoK1gfscHp0b6BHHc+ly\nhD9NPYHNNr6LYVEWVfm3k/655ie+xmVjKIMnKeXqAheGnKiL1O9faw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPMlM5dTVRUWhNSjNrUFZQ\nRzREOVo5dkRPYy9PMTZ2enlCRG1qamFCTG5BClpvUVgrbWNwSVBacHNjcWgrbWs4\nZ1BoUjVJNkRXbllGbUFRcWt6R2Uzb00KLS0tIGtaYjBaaER0Rnd5OUovb2szRXcy\nbU1HWmpRKzFFbWZRL3FlWUs5a0FIckkK/7Zzw6b7t+/rjLqFS1vqoBNYwnzxJzmW\nKxevyzQzFFYGlqvxNdlzUSLGrMsO4arBp5tUtDoYRhDRTMk87dm27Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvUUFPbFhza1h0cUlMVVpp\nQ29pMjJYenBISTNudkIvZTJRZTZlVTBlVWxjCjFnNFFiUHFiZzdXcGpzc2FVY1d2\nWno2RkZxMjFEcXpnVHZpZWN2dk9jZTgKLS0tIFRJMUh5UWhMQWRxRnprTlpOL1Zy\nd05jZjdvYitoM3NSUEVQdFFCOGV0OW8K1Csda6v4SBJxumulxTAeZNRzCx6zKd3H\nauX8HLeY6RV4LXIvfSOEBCj5Kxl6uBwouTM7ejteQnUSdpAX8MhFBg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMVJSQmVDTnVZZDhHbzBR\nczVXWU10cnQ1TDBUL0RPNTFJMkE4NDcwWWdvCnZuS05sWXI2SzZ0UVlKSi9wazI2\nSlVMMDlla0RyRDcyUzBaYzdoSDZIeDgKLS0tIEduT0xsbTdxS1hwSWJxdEZMY3VI\ndGlXTzhGTHNiTmdHVG9GekJuWm1uSEEKwNZ74I5yL81Duv6b5PmJbfgF00zomAQ+\nDEDwxiMALnj4SZef5pbUsBb/mlBsROnlSKe5mbWXSnNza8dFXjNEIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwWTJBWFRORmFUOUQxOWRx\nclFlYk9VdTEvV29NVU1aU1ZER1haTEczK1RjCk9WUVhTV3E0aUwrY3JRQkllSXZD\nQUhLRks1MENLVnJ0b0hzR2RpcEVDbUUKLS0tIHN6aU5pMUY0dDBSQ0t3QlBSQmds\nWVB6Y3FMODdqNkF3YXhYcVBld0p2ZlUKF9eOP2K2c7gTMK2tofDmRTnB/NkrIHuR\nrc6oJRppPuBRsFDpFxC2AxFF6v7pCA4CrUOp+c/tVotmJXIYpKVLGg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:16Z",
+		"mac": "ENC[AES256_GCM,data:QTza2kJWhmDahZijNcPvDP8S96uYLmoPkRQebktZmd+68fMUuUFpsKV/Tnd0fVflnS5fgvgLRDJ6+VPBFuztX0lC5WYdU092/EaEWGgn3PQO8fXHxwf3QYwDPIRrl9wqE9UGpTMtSJZ/22M4Shwq2zRa/mvsP0ig18aHMn7JRGc=,iv:arDHHuXdvaq99uH9QR557JO6z96f3UszNBzJCVNuB7U=,tag:TCNn1EJ8rcJY9sa4kXqBQA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/buna/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/root-password/password/groups/admins
+++ b/vars/per-machine/buna/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/root-password/password/secret
+++ b/vars/per-machine/buna/root-password/password/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:wVYG3Ah0iMDKWIGReEQwMqwlfWJQ9cRtpZWpVjOA7q4t5UguOfn0,iv:VCIur6/C3YU4qZhowjgCHMd/kXRp6rNq2D6KpJCz9vw=,tag:oBbdkuzgmCtTzrBuDNmaYA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQzEzeSt5ZVRGazE5cDkz\nN0xkV3hkc3lQZDdJU1Jpc3h3MzJDcjZTbUFJClF5dFJJQWQxZ1MwaGp4SmVadCtt\nQTRabHBMcXlmd1FOVzdlejF1QmRRbkUKLS0tIE04Z3p0VWlua3hpRTB2YldZSVgy\nbG5pRUxCMTFGTUJoVG1yZWtXMy9PQTAKTclKeE9zWIluBBb3d5fnZz5TN7xIq1Fn\nnf+8aRYNG5ywfLtkebAppHEmt3mxoNWIAXGBb41xfCB1/7lbSks2fw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXcURqY0QwU0JYN1RnMHBE\nbmxobU16dnlFMjYveTR5SlNMZEhJQ0RFSHkwCkVSRVQ5dnJ4enVLNXYrQW1MUEts\nQXZxWVFvSk1jRVVNWDdLT3pvcWFxc0kKLS0tIHVpT2htWXRySHQ1UWRaZHhJcXN1\nb0tPL2VWMmNDdms5Zk0vUUwwTm9wcEkKO0pe/v87nq+y886cvoW7mBx1f5jMx1kS\nPRj8MLOS0Zwd5Q8G9vV3T3SQQRjmJJNkpLVrJ3kMRJTniWQxcG9f7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDdoSk15Uytz\nNUpXZ1Ztc2FEUmI5aDhRTnAwZWJTWjJLSnpiMWd0aDFYRG8gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3ZkZWdFdyR0s3SVN6emorTEdVeDVU\nbEcrRmlybFNZRXU5RXl2Z1Q5UVgwCi0tLSBjT3loaU5ySWNHbEpseWhrNEhDblRN\neE05eFBUTGlwVW9jRjIzdGprS3RBCt57I6biEsOwRk33gJM3WC6Zl1raFj/eJmfq\nN83XTZz636jJVjd9yvV6Fo+eqCQ42Ix0ho8gV/OU2SfrfWBYimU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDBVdFpkQ1Z3\nNzZaOG9xdnBQWnhOYnRZMEFsc1ZzTCtSY0IzMGViT3hCQlkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpTd0trdmZ1S2EwMEl5Q1NTZHZ5SUJY\nWk9iK2JYUlFlOEp4RkNiS0oxci9JCi0tLSB4K2VqRzFBWWtXSHRmWU9YMzdBb2pN\nZjRmK2ZpM0huUTdUK1ZBV3hOS3dnCiY5pE32xeZ2hqP3XhfSqabB87B5ebA9Vw00\nEzE/JiaOoozG63FTU37jA7lK+bmROg6gKctP2Gjq2PmWOSgd7Us=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEJiOEUyVVVL\nOHMwNTBjdEpBOXpwekg0TXBNVEo3QTVmbWJadEpZbFVsalEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpoMFJNVjVmMnZJRk9QUHR4VWg3elNj\nWXlBTTlLdTJqekdBWERPY0gvMzVNCi0tLSBLVXRTcjEycFBtT3VJTEJTVmpXcWk3\nRlQ0a3h5OXg5b3pRMkcwUkhnRXJFCo2H+7Kn+hdKKhh6GftMLTDNKcbF/uySBupD\nYrxCpjDlCGQ49esMtiAA5M8pc/boWvFxv8+tCzFZHTwVDtX5ZQw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6blAzbkh5eW4yeUFSdTZt\nZnNQY1BQbGpGNkg4bUFmYVRUaytlblUzS0g0CkJ3ZFVaS0xnTmZqY290c3h4NHFG\nS1pQSE11MDZwUWRkbWlLZHIrNXZPZDQKLS0tIDJTemljUldlWXpRRGFLczM0YXFO\nVUJFYko4eGJEcUxBRGpiS0ZHMUpNanMKN9NdEY3toItXRz0joahH507SsKP+9gwu\n7D8C1BR0xStpVWidMuDJVfaDcFLx2CBItfujDP59rnHyVO1wzTHGHg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5T214czl3Myt2YVlLU0Ir\nZkJjN3g2REdFRXFGM01QWGFub3lvR095clRNCktyWWdCbXlyV3M3b21WbkFxeDRq\nbXd3TzM2R1lBSXdRUHFVbFpSSW5pODgKLS0tIFFLK0MvMjBqZXJEZEJKcHNHN0lm\nd3VPZkZtYStuZXpzMVh6UHNzdXUyQXMKhH/hG4abdwjU2m0Aeg2Yn0yDVAbWI74/\noWziRJmEfn3hHAsvuI2rleuwaZN/02b0nmFkxNiW+KIBew5v95uaMA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2SVNCNGhOb0UzSnRpYVdU\nbXAxakM3eHNPelpGMzhuT1NmbG5HN0YzbzBnCmNlS1JIWVBFZmg1MDVEaVdpUlpi\nblB6Z3UvK1FWRGFlUjNwTjg5eFUyRlkKLS0tIEpCS0NCdmVzTnZFZVNlSDJIbFg4\nc0dIRkZMRW1yTGJrWUJTZkwwWUFPNXMKAuqzuQhSNn83KRsdN1+Zd2uETABH4cih\nNfpVzuHeym3W5tFlXvPTaJaOqSTetqaD6ayyY7kOyMQ51MyPV8kdBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZGxMNEZjWEU2UU8yY1dQ\nQ3RUUG4xWkNYN29PQzh3clBXTWpidFUvempBCmR0RmRYTTk3VU5QdjQxQmdmRy82\ndUNGblFVTGVQTXhhdnZ5Z1BZL1lXL1EKLS0tIGtUa21tcDN3UzZqNjIwVFFtQVB6\nU0RybXR2QktlbnN1SURJUVUyVUJ6ZjQKOvgrZh29Q9AE0o9LBNqlPDCV5iKm3yll\ngN57wE397mQaAGKI1E1B1CytWv+WHCetQ8A/pZD8nSNt5hmcfD51pg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:16Z",
+		"mac": "ENC[AES256_GCM,data:ebGwPKurcY2IMoOpHpDCxSa1nVRgK2pZJQjMh8WhJOi59D9vYQ4mS0hTh1SE/qpOyEiX7j64OaS/tdpTKrdplC9dzcHfK2Hp8fc4Gj7PdZrJ1ncLm8lX6miJKWhJWssBFzHYL3qM5/mpxkFVfoW4r4l0sCzARnsGLqU62YGogIo=,iv:qu8ehbFE7smCFeAX6kdv0Y5zrM7OkQ5ZLZbneB4HTRo=,tag:Vha+16n8Wkw70b3TaUWsJA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/root-password/password/users/kurogeek
+++ b/vars/per-machine/buna/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/state-version/version/value
+++ b/vars/per-machine/buna/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/buna/tor_tor/hostname/groups/admins
+++ b/vars/per-machine/buna/tor_tor/hostname/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/tor_tor/hostname/machines/buna
+++ b/vars/per-machine/buna/tor_tor/hostname/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/tor_tor/hostname/secret
+++ b/vars/per-machine/buna/tor_tor/hostname/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:nBZW1255aoPIrRZ3dtuX+w6YZ33xv1lQbJ+9xZjGhltSD3eTJd+1Z94BwBxHPx1ajbdgKMu1Phl15kf2jdPc,iv:H1cGV5jtq70CG6/x0VH92VMV6wsuhsEL/pa8xdre648=,tag:SCcZCxhMWwFmbV1K67wfFQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJbGhXR093MDM1UjRFemY0\nU1pQVjFtbW5qcTkwcUpiOHdMdDFKZGwyVTJ3Ck1Pa09oUW1jTkxsRStXNFdyN1gw\ncEVqeEVjdHRiV0JLL2tkWGpZbW9SQjAKLS0tICtENWtSNmpiTWZMY3NLMVprR0ti\nd1lTTkJGSzJrVXJQRG5PZkQvQXovWGsKBvhYXS5qUTlOx3rEmcSUWQJUPNZWYAzX\nxyAMnKH3t2wAGFGIydK3u1Kk6/aryva2RlR0qkeFTOJo8XdEapn1gQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiYkNMRjRYMnhJVW5pYjZW\nOEhaV082Y0tLTFJPcVhjRmJ3RXE0Q0dDZmlJCkUvOU5wa1FycGdDN1JaVEcvdXlU\ndklYQ3I5STVMdjZmR2RCT0J0WDBMTncKLS0tIDlPSlJmeFVMYTE3cGdZYUZxT3ZB\nUkZmT3NZMXQ0aEtCMlJORVhKbldGOGsKt+eX316NazElenilH5fpVC0e0GOPYxQZ\nm5CgXkIJ1o/7rdgGNqFMt8jNeodrW/P/ccIXdrAYplKGWzdgpdP53A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDkwSzl5Z3F2\nVTFBdWQ1amtYQ2V0ZzVvVk1CcTdEdWh2eW0zNjN5ODUwMzAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpOWmFjeHlpMUxMMTA5bHkyR2l6TW9M\nSGJzV2pIdU1ONkt2eVlkRlRrOW5zCi0tLSB2bHpoWjNYMG15R2UwMWFpMTNrcVZM\naXJ6WHU1T2w3ZlBmMUhrdmtuYXJzCgTFhE4mRloPJUFMWTagharFirjpbBrXcPly\nTV4TmN6aVS8O99E8vER8SlQhdh8UNlzlkEump11OkY/VTXps2EE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdqZUQvMDg1\nb3Q1YnNCMkd4aWtZN3BQVC9HZG14dnV4c3RhdVB1MW9QZ28gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpKaHNkV2ZtbEVnQWkydktZUkRaMmNN\nbFhXT0xjdFdRbXppS3RJUlBXVFRnCi0tLSBnUGZLeGFVQjg2VlNFVEZieGhoSVJi\nSzI3bHZLU0x4Nmw5cU5KU2RJemhJCpHVu1OwWFdMyr6Jnc1q9l2DNemh6QSHFNoC\ngwirKvEFDr/h+S0tAjQ3a+p+lyB2z/NwfcAxKxge0rVaqlzQV5Y=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGNGdWdlcGl4\nRUtONWpudXVkbkNac2IrTlpUS1h6Ui9IaHVSMzJLcS9MblUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo1UklzVUVlTjNmN3l3OGpvY0VCbUt1\nUkZ3MUhGZ3BzVFZVMUY2cm9DbkYwCi0tLSBQdmpoTVVNUWR2Nm8wWXJxbHFrc0gr\naFhNZEFOeUtZdHQ3cmlnR204QVo0CoVwRw8Et40ww+QWIniqZErzDPMzw+ZQWVAm\nJY3eUHCJEB8cxw81X94FY6X4zFCzSAU11uziQ6Zy5MxeI45zpFs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVktxL2NHblVmR1dRa1o2\nc1AxV3NRMG5pU2FvQmpqblE2dDVxWVBEb1VNCmJtQVJING9uRkJaSHZjZmIwVzhB\nQUhWN1VKcm9XWmJlWXFxUDh3L3FQT28KLS0tIGVTeWI5bHlNVlVVcEc1QjBqWnJI\nY0FpRWNaV1NoMlVoR0puTWpJZzZOc0kKTPG8WWQlVk5LRWqpX5/Cl0QXpIAaI4cH\nAbJesM/031Qyd8O7icc5/13f/1AEnZh+JVjTP/tA84PY1PYc6yWHug==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Z2pmOGN1Y2ZEdWxHVWto\nUWpZa0YxR2pmM3B0YmJuSjRvYjNoNFhIaEZFCjVVUEJMZjl2SHZpZk1WM0ZSaEE5\nSlUwVWNqZGJuY3RoLzI2bnFlVmxJcW8KLS0tIGExb1hidVNBaDgvaHd5bFdBdGRR\nV2VWRjlPSHAzeWI3aXdoTW5UYjRWVmsKDGeuIU229Au6ngCh/dWaR4ng4O0WSRFO\n9FZvdKl6g8vD3r0+lpgXiCvIr42v2/A3rl4nLiZsAEDCbPZK0apU5Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6ejI2cjQwRXJ6Zi9VaGFK\nWG1STXpvWlY3OGhtdEtmL05QbHRCRTlNWHdjCk5GYmhua3BqYkx4U1NlbDVzbE5R\nWnl1R0laK05KRjZNeHhmMjAyYzlaL0UKLS0tIFpyQTJFakV6cnlMVEx0ZnFTSDIw\naDFUbG9CaTRleHlrRE94bElJeDdpTjgKiLLlk7RiUM340JGKNFCXgL0JVC4tM+uJ\n6IDq9FJY4ZOBTxaVJFsHlQrmlTt9xFgXPMxOxCh1PsKOtVAYMh9aQw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOOStKRmkrekhPR3dveUhP\nRGlxZndPdzhiZGpHOGxXU2VGOERIeGJZR0hZCnRCSHRoZjc0THd1WVZnSlJVRUE3\nbXNDTlJ3am5yVm01a3Zpd28rTGxLeTgKLS0tIGlzcm90bWVYWFQ4Rm4za3VvOHFO\nbEFHbnlvVXZRN1VsUWFneE9POTJXdzgKblsgLi/zSv4Xi2wMc99eAJx4VC1RiZFu\nlaKuWzYVtHx1DjAMTBB3Wt7CwGi5AQ/+/XMkHHTrsHRGniYnnRJBjQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4TUU1eXp2OE92d2NJWTF6\nTzJxRmY1V2hGUExMNGh4WHJKU3BueFJJZkZzClJld3dYTXhnQzliQXNiZnpCbVZY\nR1NUSmpzdkpwbHBIV2tha2F2TzY1aHcKLS0tIEM1ZFFzWW5sV2xlcm8zRjBpY0xE\nWXpTQWpPWGNpUysybUpLYUlNWXZrdmcKinHmBWXWPUxhpkVJbkBIkSUH8Nk8Q/5q\nEMyvyfVz2qB1An72lbtMvOqOr56nv+zH/tqVTKRyGOrc6vYvPARCNg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:18Z",
+		"mac": "ENC[AES256_GCM,data:A+gL1a5gZ3d/2PnSF3jdqy8S/xXYaDjK9KmANqSmZz4eQunTR/ZnCr/8+unhhAAEa8enBQ6J7lTf85RZOrRx4tcaJSAjAB+SIOEwroxTH5BqWpz3IBYgG0A+17qO3jVPi7PlZKYUxgqXla8zQxUu6Fd7T0UR2h9+e/PzobOgRAs=,iv:7yoOZDV3zQBgZdANIpLKGNh38AHDp7V2RgmavN2L3W4=,tag:DGLwR6fIHsZqNPUEv4dqeQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/tor_tor/hostname/users/kurogeek
+++ b/vars/per-machine/buna/tor_tor/hostname/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/machines/buna
+++ b/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/secret
+++ b/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:mTb/2kC2usRAMm4cSI6y6K61LpM8ZsyXCy6ieZy5ws7MzTyB9N1a2avOAwXFQrwD+RgTyamKETUwVjCl5WIXSA1vW/J/blA2wVutgNADvNYSz09bTA3IuFc9ItiWigUd,iv:IvH+aFyUtRVTnpQ5rfghe9IoaHpCXSelyZATP1wPKHY=,tag:LA9UqoKtlfLEnKgQdPd4gg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzc0N6ZHZCSysyNHFrOVJT\nMDZZTkFZRXlMWVc3b0xPYVVXalE2MlZNSFJRCkEwWEliMzQzb0VvRzMzVmEvaFpU\nZTNkNGg1V20xMlpqMVVTZXVONDFsSGMKLS0tIFJsRmhGRlFZNFN1VEhoeDF0LzJQ\neDI1Q3h1bEVjczNCNDFiNkRNd2NPZ1EKruzTFzD+tX4UQPUjtGkuG0MS3hxwhcyt\n+PKV2SGKy9+fJZtKVbPg+4NYLblLNoYAMHmUV94zkrAezpLTjcgRtw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZUGhINmtsODAwM3AzamRt\nS0NobGJrWGl3QnlYRVJFS2xIbjB0L0lPWDNBCnM1VDIzYVVHdXI5VWR2M3g4K3NM\ncnVMaWxsdnhTMCs5UjVKSjM0NjFISEkKLS0tIGt5V01Udko3WnFYbFRxYmxray83\nU1dRc1R3VDRiUmdDdDljOEc3RmZKd0kKHB7k0XWqlmoIRP06c3GMicN1mxD/1tEz\nH/z5bV2IlrcFPPEvP12O68s3Z71d8IVpM3cNcMmfwSiwUKVMIwqgsQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFVMbFhLdWNy\nM3NTUlMzYzlkNUhPZlEvMkxqVVBpaXhNU3c0WGRkTU96amcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprUm4yU2NYQUpGZDMrRE4rcFcvSFdW\nRzBnNFRobHZFMnJiNjkvR0drSVE4Ci0tLSB3OS9TWDJCRnhnTEZiRTFWUndSdS9J\nalFhKzA5N1pTbEFJUGNiZXI4ajZFCvzg/DL62+f4RnkGTXl4eAFGNiN93GBmWTVc\nKrbzZ8c4VMVw/LvIh3okE9tyEn3CGqjllpPHmdgZF9PCTGQiG3c=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5mekZOSjBY\nUlFlYmVEVGZhL1hITjhTd1ZJQk1tRDZkc2U5OVkyaUkzQzAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp0S3Z6WVROeUh6anZNSWVkYVpncFRS\nYytwbCs0UzgwSHBqV3BQZnZzd2dzCi0tLSA5UHZPaFhuVVg4SFdobXBYdUdlZWhV\neWdZYTZFZHJXdW55U2NScWlqbjAwClQYHoBqkfsvVCRf4uCyQXtJbwGtTTT2CQUH\nC2Gkm9pb9y8ErRkGAoQ3a07Qb23VstZMCS0FNgFWxCB9RbaBDCM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9tdUkvUG1L\nMGdHZHlKUXBMYUkyWGJZdXJYMXNaRGhweGt4bUY0RElKRDQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4WmNFekJTdnN1YnlZcEVteExENUpa\nK0srb0xqZ3dDQm5pbWIzSFkrbEtrCi0tLSAyQU9iQzIyd3VDM1JLRWJ4dlpSL0dm\ndUlkMVg5cHg4T2dPYTJFbWtJK1djCqAndzWTabog3ueB8pSzYgwxAHGIEiyTXk6C\nb3g7ZecdxS8nKI4xOWX/4mdYlPdQ2eHrsPcKE7e//L3ecpAA9Yw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUkxwSkw0b3B3RkxmVDNT\nVUc4Z3NrV0haTzh5K2VIempYOEIrQ2JuVlRVClBGNzRuTGgzZnB2UE45U2JET1dq\nVFlGQzhyQ0NHaVJXMHFmM0tHUTAzZGsKLS0tIGZvblBpMG9mL3BDVkErYjQxSzR2\nK3N5MjV5NU1lbXE0bnk1citzYTdnaWMKCVQ+iRAG0Ms1meWaMzFPGF56B1fHGCJO\n0iDhYr+pAZ8NULqQpdhFPZEs7kB8xH6B7o6dK2yRoueYI0m2v7kzbQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIcEgrbElib012OTc5Z3RQ\ndVRLZjBKZWh0Rk84RkRKclZQWDNEclByeUhBClFrK3Z1WVhKek1OdW1lek95eXQr\nZ2pPdlFHdkF4a1hwdDcveThTcm52ZXcKLS0tIHVnbFJHc1NZRitFWFVWeTlPRTd5\naThraTJFN0hTcHp2Sk5ha08yYkFjbXcKK0V5kgRml5JWJSp3VcaUMjLwpcb8s5+O\nwpru1iiXAaTMKuLNZ7BXVwNedjsiARZtbdWRFjGluYQUUgG7Xec77A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHVHdlNytKd2hwWWQyRTNm\nUXZNeUdsOUdicjlkK1NzWU93dUM3Tm1EY1hrCjNGWG9Pb0s5WTRiV0xKeVkvUXVj\naHlGK3hDUFUyM01TRkttdWFCVVpNRkEKLS0tIGJTT2kydGk2eG1XUXd2WU5TSE1r\nZXpYMXVkYmVzWmh0cDZTTVVuS2lRNmMKAkLHi0SOuQJDi3F7HuXgZ7izi234Tc31\nQhMuda9EjoR9dniPg62CKk7OFEyvOP2Qo3Hu0sFgEwBYhF5eS+97jg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGdXBzcnhOdFhZRzRKTG5z\nQmUzQkErNVpBOWRITkFwOGp0ZDVDNXpMRUY0Ckt6VExySGlFSFBlUDA4Tis5N1Nu\nbloyZ2NBTmt5WUFtQnRYTzVTdENPSkEKLS0tIGxLdzRHbUFnUzB3bFBDc1EzdHJW\nL2JUdzMrMkVTdE5XaUdxc2MyTGNCdGsKIaGLQbswF/BQhnlTUrm4n3zArMoiS2sj\nAITrHb2F2WluU229kyxNDpmY3hhiKGspO6JXqRDA5diDdrBxhzcxhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpK0pId3JYVjFjRnBoQ1Nz\nd08vZXMxeUp5R1hrN25RaWFwbGI0eGNZM3hnCm5vTzZDbnRnS1J2dmRvME5Oc3pT\nWmtETkRibGZRbC96VGswNmY4L2hQRVUKLS0tIFBJZ3BDbzBabTAvQ2VXdHJrUEtM\neXA3Rmg3K3VsQTBMM3VTTDRYZkNOZU0KoBr3prcGnyQ2Xw+dJUc55xwan383rCA9\nfy6Jnq7H0FDHaJdVkVk/Wn47hcMfNss2i5JK2tzArxkEV6R2A2/IqA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:18Z",
+		"mac": "ENC[AES256_GCM,data:OxiHEbN1VW8dkbv7K28fk5nHq/E1/1MzbOW3VySv7URSl6+I7ntYCWBZyMNWOSNcqUM7n1pGIQWV67RhrIpkQq4L50rEOOdHzGYgUZrc0OeYVQSC6NdV1FRnQOtWYOnFWpBKUFXQvZRr1D65wmfQsDJtXAgmJMIj8PV9EO+AjDI=,iv:00WJVfTK3Wdz0NinbNZiqJihM4ybeJ+owFUzUfwuu8c=,tag:UQG74Vl4G7d46Rsjl4bzqQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/users/kurogeek
+++ b/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/yggdrasil/address/value
+++ b/vars/per-machine/buna/yggdrasil/address/value
@@ -0,0 +1 @@
+203:928f:ccc9:31a2:8502:6132:7691:59fe
--- a/vars/per-machine/buna/yggdrasil/privateKey/groups/admins
+++ b/vars/per-machine/buna/yggdrasil/privateKey/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/yggdrasil/privateKey/machines/buna
+++ b/vars/per-machine/buna/yggdrasil/privateKey/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	6f9791746e	buna machine	2025-12-10 13:14:14 +07:00
kurogeek	d093103d86	clanService/phonebox: asterisk restart core when extensions.conf changed	2025-12-10 13:01:31 +07:00
kurogeek	1f7ce58067	adhil machine	2025-12-10 11:38:03 +07:00
kurogeek	b3d61ef94e	nix fmt	2025-12-10 11:08:12 +07:00
kurogeek	3b2b4ff2a4	clanService/phonebox: asterisk auto reload when pjsip.conf changed	2025-12-10 11:06:52 +07:00
vi	e26caa3429	jukebox: reassign mpd access control to the firewall dunno how to reliably ensure the mpd service is ordered after each binds_to address is bound (& so bind(3)able)	2025-12-01 00:00:00 +00:00
vi	6604ec303d	neptune: try wifi-only for a bit	2025-12-01 00:00:00 +00:00
vi	c628dd76dd	init jukebox module for neptune fax machine now also stereo	2025-12-01 00:00:00 +00:00
vi	f8f8731303	neptune: lan hosts can stream audio to speakers	2025-12-01 00:00:00 +00:00
vi	3eeb11571d	neptune: static v4 address for (usb nic) uplink	2025-12-01 00:00:00 +00:00
vi	beffa195bf	neptune: use oriental yggdrasil peers	2025-12-09 11:49:47 +07:00
kurogeek	6f85d03d30	update neptune desciption	2025-12-08 13:20:40 +07:00
kurogeek	77f5647d35	clanService/phonebox: fix 'no address available	2025-12-08 12:37:31 +07:00
kurogeek	7caebda927	change clan-core locked.lastModified	2025-12-08 09:51:27 +07:00
kurogeek	6d92bcade3	mirach is a phonebox	2025-12-08 09:47:01 +07:00
kurogeek	03f575edfe	phonebox: wrong strip extension is fixed	2025-12-08 09:33:58 +07:00
kurogeek	08dc583686	alpheratz is a phonebox	2025-12-07 11:29:31 +07:00
kurogeek	eda331d61f	add almach to phonebox	2025-12-07 11:24:50 +07:00
kurogeek	b89e62b727	think.greaterchiangmai.com is running on ramus	2025-12-06 11:26:18 +07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWyBu9oHfZ1dUbauMofzaJhPNJAFX7BaNHmA1g8Xu1O`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpoELc7KUBZapdah4iw1ynBfkqw3QCZsLC5/2qL30DO`