mob next [ci-skip] [ci skip] [skip ci]

lastFile:routers/yada-house/device.nix

.gitignore

@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-
+run-vm-*

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753024554,
-        "narHash": "sha256-oVriwkUkY3xs7HONbusnaXxyGecMAdi/QLZ2Z7jZKAM=",
+        "lastModified": 1754535625,
+        "narHash": "sha256-RdT3/DskBjwx74cvHJHb/mLSO2XeSHitSYViNmYGU/k=",
         "ref": "refs/heads/main",
-        "rev": "f6284a7ac228789feba4f6b33be49960ee8afe4a",
-        "revCount": 8541,
+        "rev": "f69e28a1333527cdbadb233966a7e19d4b35a1a3",
+        "revCount": 8886,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -49,11 +49,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752589312,
-        "narHash": "sha256-BafZOenlzMYdumG12AzgVLhEVu+GcEa8nYNDSIYe1U0=",
-        "rev": "496bbf05a2aa7b061ef464254db5804d1c6f45b4",
+        "lastModified": 1753067306,
+        "narHash": "sha256-jyoEbaXa8/MwVQ+PajUdT63y3gYhgD9o7snO/SLaikw=",
+        "rev": "18dfd42bdb2cfff510b8c74206005f733e38d8b9",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/496bbf05a2aa7b061ef464254db5804d1c6f45b4.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/18dfd42bdb2cfff510b8c74206005f733e38d8b9.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752718651,
-        "narHash": "sha256-PkaR0qmyP9q/MDN3uYa+RLeBA0PjvEQiM0rTDDBXkL8=",
+        "lastModified": 1753140376,
+        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "d5ad4485e6f2edcc06751df65c5e16572877db88",
+        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
         "type": "github"
       },
       "original": {
@@ -136,6 +136,19 @@
         "type": "github"
       }
     },
+    "liminix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1760087246,
+        "narHash": "sha256-HRUkAS5XDuM7yDnz+TIMAre7kFOuqyHL/y26wTbH6Sg=",
+        "path": "/home/kurogeek/Desktop/gitea/dan/liminix",
+        "type": "path"
+      },
+      "original": {
+        "path": "/home/kurogeek/Desktop/gitea/dan/liminix",
+        "type": "path"
+      }
+    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -187,11 +200,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752900028,
-        "narHash": "sha256-dPALCtmik9Wr14MGqVXm+OQcv7vhPBXcWNIOThGnB/Q=",
+        "lastModified": 1754278406,
+        "narHash": "sha256-jvIQTMN5EzoOP5RaGztpVese8a3wqy0M/h6tNzycW28=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6b4955211758ba47fac850c040a27f23b9b4008f",
+        "rev": "6a489c9482ca676ce23c0bcd7f2e1795383325fa",
         "type": "github"
       },
       "original": {
@@ -207,6 +220,7 @@
         "devshell": "devshell",
         "flake-parts": "flake-parts",
         "import-tree": "import-tree",
+        "liminix": "liminix",
         "nixpkgs": "nixpkgs",
         "treefmt-nix": "treefmt-nix"
       }
@@ -219,11 +233,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752544651,
-        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
+        "lastModified": 1754328224,
+        "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
+        "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4",
         "type": "github"
       },
       "original": {

flake.nix

@@ -21,6 +21,11 @@
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    liminix = {
+      # url = "git+https://gti.telent.net/dan/liminix?ref=refs/heads/main&rev=29fbb5461d034c4c59b88cbe04937b04ecad18e0";
+      url = "path:/home/kurogeek/Desktop/gitea/dan/liminix";
+      flake = false;
+    };
   };
   outputs =
     {
@@ -33,11 +38,30 @@
         systems = [
           "x86_64-linux"
         ];
+
+        flake.legacyPackages.qemu-router = import "${inputs.liminix}/default.nix" {
+          liminix-config = import "${inputs.liminix}/examples/hello-from-qemu.nix";
+          device = (import "${inputs.liminix}/devices/qemu-aarch64/default.nix");
+        };
+        flake.legacyPackages.yada-router = import "${inputs.liminix}/default.nix" {
+          liminix-config = import ./routers/yada-house/configuration.nix { inherit inputs; };
+          device = (import ./routers/yada-house/device.nix { inherit inputs; });
+        };
+        flake.legacyPackages.qemu-flake = import "${inputs.liminix}/default.nix" {
+          liminix-config = import ./routers/qemu/configuration.nix { inherit inputs; };
+          device = (import ./routers/qemu/device.nix { inherit inputs; });
+        };
+        flake.legacyPackages.vanilla = import "${inputs.liminix}/default.nix" {
+          liminix-config = import ./routers/vanilla/configuration.nix { inherit inputs; };
+          device = (import "${inputs.liminix}/devices/gl-mt300a/default.nix");
+        };
+
         imports = [
           ./fmt.nix
           ./shell.nix
 
           ./machines
+          ./routers
           ./inventories
           ./modules/clan/flake-module.nix
         ];

inventories/default.nix

@@ -1,21 +1,10 @@
-{
-  inputs,
-  self,
-  lib,
-  pkgs,
-  ...
-}:
 {
   clan = {
-    modules = {
-      stirling-pdf = ../modules/clan/stirling-pdf;
-      actual-budget = ../modules/clan/actual-budget;
-      victoria-metrics = ../modules/clan/victoria-metrics;
-    };
     inventory = {
 
-      machines = {
-        rigel.deploy.targetHost = "root@rigel.local";
+      tags = {
+        glom = [ "vega" ];
+        b4l = [ "rigel" ];
       };
 
       instances = {
@@ -26,11 +15,39 @@
           };
           roles.default.tags."all" = { };
           roles.default.settings.allowedKeys = {
+            "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
+            "davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
+            "vi" =
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387";
             "kurogeek" =
               "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
+            "matthewcroughan" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo=";
+            "matthewcroughan-1" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo=";
+            "matthewcroughan-2" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo=";
           };
         };
 
+        glom-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."vega" = { };
+          roles.peer.tags.glom = { };
+        };
+
+        b4l-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."rigel" = { };
+          roles.peer.tags.b4l = { };
+        };
+
         pocket-id = {
           module = {
             name = "pocket-id";
@@ -44,7 +61,6 @@
             input = "self";
           };
           roles.default.machines.b4l = { };
-
         };
         stirling-pdf = {
           module = {
@@ -60,9 +76,9 @@
           };
           roles.default.machines.b4l = { };
         };
-        victoria-metrics = {
+        victoriametrics = {
           module = {
-            name = "victoria-metrics";
+            name = "victoriametrics";
             input = "self";
           };
           roles.default.machines.b4l = { };
@@ -74,6 +90,27 @@
           };
           roles.default.machines.b4l = { };
         };
+        grafana = {
+          module = {
+            name = "grafana";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        pingvin = {
+          module = {
+            name = "pingvin";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        paperless = {
+          module = {
+            name = "paperless";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
       };
     };
   };

lib/auto-accept-zerotier-members.nix

@@ -0,0 +1,21 @@
+{
+  memberIds,
+}:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  systemd.services.zerotier-accept-external = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "zerotierone.service" ];
+    path = [ config.clan.core.clanPkgs.zerotierone ];
+    serviceConfig.ExecStart = pkgs.writeShellScript "zerotier-inventory-autoaccept" ''
+      ${lib.concatMapStringsSep "\n" (zerotier-id: ''
+        ${config.clan.core.clanPkgs.zerotier-members}/bin/zerotier-members allow ${zerotier-id}
+      '') memberIds}
+    '';
+  };
+}

machines/b4l/configuration.nix

@@ -12,6 +12,7 @@
   };
   networking.fqdn = "b4l.co.th";
   system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
 
   security.acme.defaults.email = "admin@b4l.co.th";
   security.acme.acceptTerms = true;

machines/b4l/services/actual-budget.nix

@@ -0,0 +1,36 @@
+{ config, ... }:
+let
+  abDomain = "${config.clan.core.vars.generators.b4l-actual-budget.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-actual-budget = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Actual Budget app. Default:(budget)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "budget" > $out/subdomain'';
+  };
+
+  services.actual = {
+    settings = {
+      allowedLoginMethods = [
+        "password"
+        "openid"
+      ];
+      trustedProxies = [ "127.0.0.1" ];
+    };
+  };
+  services.nginx.virtualHosts."${abDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.actual.settings.port}";
+    };
+  };
+}

machines/b4l/services/grafana.nix

@@ -0,0 +1,79 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+let
+  serviceName = "${config.networking.hostName}-grafana";
+  gfDomain = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+
+  settingsFormatIni = pkgs.formats.ini {
+    listToValue = concatMapStringsSep " " (generators.mkValueStringDefault { });
+    mkKeyValue = generators.mkKeyValueDefault {
+      mkValueString = v: if v == null then "" else generators.mkValueStringDefault { } v;
+    } "=";
+  };
+  configFile = settingsFormatIni.generate "config.ini" config.services.grafana.settings;
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      adminpassword.secret = true;
+      subdomain.secret = false;
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Grafana. Default:(grafana)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "grafana" > "$out"/subdomain
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  systemd.services.grafana.serviceConfig.ExecStartPre = [
+    "+${pkgs.writeShellScript "grafana-set-password" ''
+      ${pkgs.grafana}/bin/grafana cli --homepath ${config.services.grafana.dataDir} --config ${configFile} admin reset-admin-password $(cat ${
+        config.clan.core.vars.generators."${serviceName}".files.adminpassword.path
+      })
+    ''}"
+  ];
+
+  services.nginx.virtualHosts."${gfDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grafana.settings.server.http_port}";
+    };
+  };
+
+}

machines/b4l/services/paperless.nix

@@ -0,0 +1,67 @@
+{ config, pkgs, ... }:
+let
+  serviceName = "${config.networking.hostName}-paperless";
+  domain-name = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      subdomain.secret = false;
+      adminpassword = {
+        secret = true;
+        owner = config.services.paperless.user;
+        group = config.services.paperless.user;
+      };
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Paperless. Default:(paperless)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "paperless" > "$out"/subdomain
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  environment.systemPackages = [ pkgs.toybox ];
+
+  services.paperless = {
+    passwordFile = config.clan.core.vars.generators."${serviceName}".files.adminpassword.path;
+  };
+
+  services.nginx.virtualHosts."${domain-name}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.paperless.port}";
+    };
+  };
+
+}

machines/b4l/services/pingvin.nix

@@ -0,0 +1,45 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+let
+  serviceName = "${config.networking.hostName}-pingvin";
+  domain-name = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      subdomain.secret = false;
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Pingvin. Default:(share)";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "share" > "$out"/subdomain
+      fi
+    '';
+  };
+
+  services.pingvin-share = {
+    nginx.enable = true;
+    https = true;
+    hostname = domain-name;
+  };
+}

machines/b4l/services/stirling-pdf.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+let
+  stDomain = "${config.clan.core.vars.generators.b4l-stirling-pdf.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-stirling-pdf = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Stirling PDF app. Default:(pdf)";
+      };
+    };
+    script = ''cat $prompts/subdomain || echo -n "pdf" > $out/subdomain'';
+  };
+
+  services.nginx.virtualHosts."${stDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.stirling-pdf.environment.SERVER_PORT}";
+    };
+  };
+}

machines/b4l/services/victoriametrics.nix

@@ -0,0 +1,73 @@
+{ config, pkgs, ... }:
+let
+  vmDomain = "${config.clan.core.vars.generators.b4l-victoriametrics.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-victoriametrics = {
+    files.subdomain.secret = false;
+    files.adminuser.secret = false;
+    files.adminpassword.secret = true;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Victoria Metrics app. Default:(metrics)";
+      };
+      adminuser = {
+        persist = true;
+        type = "line";
+        description = "Username for an admin user. Default:(admin)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "metrics" > "$out"/subdomain
+      fi
+
+      prompt_adminuser=$(cat "$prompts"/adminuser)
+      if [[ -n "''${prompt_adminuser-}" ]]; then
+        echo $prompt_adminuser | tr -d "\n" > "$out"/adminuser
+      else
+        echo -n "admin" > "$out"/adminuser
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  services.victoriametrics = {
+    extraOptions = [
+      "-httpAuth.username=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminuser.path}"
+      "-httpAuth.password=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminpassword.path}"
+    ];
+  };
+
+  services.nginx.virtualHosts."${vmDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost${builtins.toString config.services.victoriametrics.listenAddress}";
+    };
+  };
+
+}

machines/default.nix

@@ -6,6 +6,10 @@
   clan = {
     meta.name = "NewEdgeClan";
     machines = { };
+    secrets.age.plugins = [
+      "age-plugin-yubikey"
+      "age-plugin-fido2-hmac"
+    ];
     specialArgs = { inherit inputs self; };
     inherit self;
   };

machines/rigel/configuration.nix

@@ -1,3 +1,16 @@
+{ config, ... }:
 {
+  imports = [
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
   system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 }

machines/vega/configuration.nix

@@ -0,0 +1,62 @@
+{
+  inputs,
+  config,
+  ...
+}:
+{
+  imports = [
+    (inputs.import-tree ./services)
+
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.vega-public-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base public domain for Vega machine. Default:(glomglom.fun)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glomglom.fun" > $out/name'';
+  };
+
+  clan.core.vars.generators.vega-internal-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base internal domain for Vega machine. Default:(glom.newedge.house)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glom.newedge.house" > $out/name'';
+  };
+
+  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
+  system.stateVersion = "25.11";
+
+  # security.acme.defaults.email = "admin@b4l.co.th";
+  # security.acme.acceptTerms = true;
+  # services.nginx.virtualHosts."${config.networking.fqdn}" = {
+  #   enableACME = true;
+  # };
+}

machines/vega/disko.nix

@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d14f9e";
+  vdev = [
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5RYRG"
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5S02X"
+  ];
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}

machines/vega/services/samba.nix

@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    GLOM.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "Glom Vega";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}

modules/clan/actual-budget/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ ... }:
 {
   _class = "clan.service";
   manifest.name = "actual-budget";
@@ -6,49 +6,21 @@
   manifest.categories = [ "System" ];
 
   roles.default = {
-    interface.options = {
-      domain = lib.mkOption {
-        type = lib.types.str;
-        default = "budget";
-        description = "Sub domain for Actual Budget.";
-      };
-    };
 
-    perInstance =
+    perInstance.nixosModule =
       {
-        settings,
+        lib,
+        config,
         ...
       }:
       {
-        nixosModule =
-          {
-            config,
-            ...
-          }:
-          let
-            domain = "${settings.domain}.${config.networking.fqdn}";
-          in
-          {
-            services.actual = {
-              enable = true;
-              openFirewall = true;
-              settings = {
-                port = 5006;
-                allowedLoginMethods = [
-                  "password"
-                  "openid"
-                ];
-                trustedProxies = [ "127.0.0.1" ];
-              };
-            };
-            services.nginx.virtualHosts."${domain}" = {
-              forceSSL = true;
-              useACMEHost = "${config.networking.fqdn}";
-              locations."/" = {
-                proxyPass = "http://localhost:${builtins.toString config.services.actual.settings.port}";
-              };
-            };
-          };
+        services.actual = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.actual-budget.folders = [
+          config.systemd.services.actual.serviceConfig.WorkingDirectory
+        ];
       };
   };
 }

modules/clan/actual-budget/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    actual-budget = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.actual-budget = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/actual-budget" = module;
+      };
+    };
+}

modules/clan/actual-budget/tests/vm/default.nix

@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-actual-budget";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        actual-budget-test = {
+          module.name = "@clan/actual-budget";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("actual")
+
+    server.succeed("systemctl status actual")
+
+  '';
+}

modules/clan/grafana/default.nix

@@ -0,0 +1,24 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "grafana";
+  manifest.description = "Platform for data analytics and monitoring";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      {
+        services.grafana = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.grafana.folders = [ config.services.grafana.dataDir ];
+      };
+  };
+}

modules/clan/grafana/flake-module.nix

@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    grafana = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.grafana = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/grafana" = module;
+      };
+    };
+}

modules/clan/grafana/tests/vm/default.nix

@@ -0,0 +1,42 @@
+{
+  ...
+}:
+{
+  name = "service-grafana";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        grafana-test = {
+          module.name = "@clan/grafana";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.grafana = {
+        settings = {
+          server.domain = "grafana.localhost";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("grafana")
+
+    server.succeed("systemctl status grafana")
+    server.wait_for_open_port(3000)
+    server.succeed("curl -H \"Host: grafana.localhost\" http://127.0.0.1:3000 ")
+    server.succeed("grafana cli -v")
+  '';
+}

modules/clan/nextcloud/default.nix

@@ -45,6 +45,16 @@
           };
 
         };
+
+        clan.core.state.nextcloud.folders = [
+          config.services.nextcloud.home
+        ]
+        ++ (
+          if config.services.nextcloud.home != config.services.nextcloud.datadir then
+            [ config.services.nextcloud.datadir ]
+          else
+            [ ]
+        );
       };
   };
 }

modules/clan/paperless/default.nix

@@ -0,0 +1,24 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "paperless";
+  manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        ...
+      }:
+      {
+        services.paperless = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.paperless.folders = [ config.services.paperless.dataDir ];
+      };
+  };
+}

modules/clan/paperless/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    paperless = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.paperless = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/paperless" = module;
+      };
+    };
+}

modules/clan/paperless/tests/vm/default.nix

@@ -0,0 +1,38 @@
+{
+  ...
+}:
+{
+  name = "service-paperless";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        paperless-test = {
+          module.name = "@clan/paperless";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.paperless = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("paperless-web")
+
+    server.succeed("systemctl status paperless-web")
+    server.wait_for_open_port(28981)
+    server.succeed("curl http://127.0.0.1:28981")
+  '';
+}

modules/clan/pingvin/default.nix

@@ -0,0 +1,23 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pingvin";
+  manifest.description = "A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient file sharing.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        ...
+      }:
+      {
+        services.pingvin-share = {
+          enable = true;
+        };
+
+        clan.core.state.pingvin-share.folders = [ config.services.pingvin-share.dataDir ];
+      };
+  };
+}

modules/clan/pingvin/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pingvin = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.pingvin = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/pingvin" = module;
+      };
+    };
+}

modules/clan/pingvin/tests/vm/default.nix

@@ -0,0 +1,42 @@
+{
+  ...
+}:
+{
+  name = "service-pingvin";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        pingvin-test = {
+          module.name = "@clan/pingvin";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.pingvin-share = {
+        hostname = "share.localhost";
+        frontend.port = 3000;
+        backend.port = 8000;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("pingvin-share-frontend")
+
+    server.succeed("systemctl status pingvin-share-frontend")
+    server.wait_for_open_port(3000)
+    server.wait_for_open_port(8000)
+    server.succeed("curl -H \"Host: share.localhost\" http://127.0.0.1:3000 ")
+  '';
+}

modules/clan/stirling-pdf/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ ... }:
 {
   _class = "clan.service";
   manifest.name = "stirling-pdf";
@@ -6,43 +6,18 @@
   manifest.categories = [ "System" ];
 
   roles.default = {
-    interface.options = {
-      domain = lib.mkOption {
-        type = lib.types.str;
-        default = "pdf";
-        description = "Sub domain or Stirling PDF service";
-      };
-    };
-
-    perInstance =
+    perInstance.nixosModule =
       {
-        settings,
+        lib,
         ...
       }:
       {
-        nixosModule =
-          {
-            config,
-            ...
-          }:
-          let
-            domain = "${settings.domain}.${config.networking.fqdn}";
-          in
-          {
-            services.stirling-pdf = {
-              enable = true;
-              environment = {
-                SERVER_PORT = 8080;
-              };
-            };
-            services.nginx.virtualHosts."${domain}" = {
-              forceSSL = true;
-              useACMEHost = "${config.networking.fqdn}";
-              locations."/" = {
-                proxyPass = "http://localhost:${builtins.toString config.services.stirling-pdf.environment.SERVER_PORT}";
-              };
-            };
+        services.stirling-pdf = {
+          enable = lib.mkDefault true;
+          environment = {
+            SERVER_PORT = lib.mkDefault 8080;
           };
+        };
       };
   };
 }

modules/clan/stirling-pdf/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    stirling-pdf = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.stirling-pdf = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/stirling-pdf" = module;
+      };
+    };
+}

modules/clan/stirling-pdf/tests/vm/default.nix

@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-stirling-pdf";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        stirling-pdf-test = {
+          module.name = "@clan/stirling-pdf";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("stirling-pdf")
+
+    server.succeed("systemctl status stirling-pdf")
+
+  '';
+}

modules/clan/victoria-metrics/default.nix

@@ -1,47 +0,0 @@
-{
-  _class = "clan.service";
-  manifest.name = "Victoria Metrics";
-  manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-    perInstance = {
-      nixosModule =
-        {
-          config,
-          pkgs,
-          ...
-        }:
-        let
-          defaultUser = "victoriametrics";
-        in
-        {
-          clan.core.vars.generators.victoria-metrics = {
-            files = {
-              username = {
-                secret = false;
-              };
-              password = {
-                secret = true;
-                owner = defaultUser;
-                group = defaultUser;
-              };
-            };
-            script = ''
-              echo "admin" > "$out"/username
-              xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/password
-            '';
-            runtimeInputs = [ pkgs.xkcdpass ];
-          };
-          services.victoriametrics = {
-            enable = true;
-            extraOptions = [
-              "-httpAuth.username=file://${config.clan.core.vars.generators.victoria-metrics.files.username.path}"
-              "-httpAuth.password=file://${config.clan.core.vars.generators.victoria-metrics.files.password.path}"
-            ];
-          };
-        };
-    };
-  };
-
-}

modules/clan/victoriametrics/default.nix

@@ -0,0 +1,25 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "Victoria Metrics";
+  manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      {
+        services.victoriametrics = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.victoriametrics.folders = lib.mkDefault [
+          "/var/lib/${config.services.victoriametrics.stateDir}"
+        ];
+      };
+  };
+}

modules/clan/victoriametrics/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    victoriametrics = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.victoriametrics = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/victoriametrics" = module;
+      };
+    };
+}

modules/clan/victoriametrics/tests/vm/default.nix

@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-victoriametrics";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        victoriametrics-test = {
+          module.name = "@clan/victoriametrics";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("victoriametrics")
+
+    server.succeed("systemctl status victoriametrics")
+
+  '';
+}

modules/clan/vikunja/default.nix

@@ -9,9 +9,19 @@
     perInstance.nixosModule =
       {
         lib,
+        config,
         ...
       }:
       {
+        clan.core.state.vikunja.folders = [
+          config.services.vikunja.settings.files.basepath
+        ]
+        ++ (
+          if config.services.vikunja.settings.database.type == "sqlite" then
+            [ config.services.vikunja.settings.database.path ]
+          else
+            [ ]
+        );
         services.vikunja = {
           enable = lib.mkDefault true;
           frontendScheme = lib.mkDefault "http";

routers/default.nix

@@ -0,0 +1,25 @@
+{ inputs, ... }:
+{
+  flake.legacyPackages = {
+    qemu-router = import "${inputs.liminix}/default.nix" {
+      liminix-config = import "${inputs.liminix}/examples/hello-from-qemu.nix";
+      device = (import "${inputs.liminix}/devices/qemu-aarch64/default.nix");
+    };
+    yada-router = import "${inputs.liminix}/default.nix" {
+      liminix-config = import ./routers/yada-house/configuration.nix { inherit inputs; };
+      device = (import ./routers/yada-house/device.nix { inherit inputs; });
+    };
+    qemu-flake = import "${inputs.liminix}/default.nix" {
+      liminix-config = import ./routers/qemu/configuration.nix { inherit inputs; };
+      device = (import ./routers/qemu/device.nix { inherit inputs; });
+    };
+    vanilla = import "${inputs.liminix}/default.nix" {
+      liminix-config = import ./routers/vanilla/configuration.nix { inherit inputs; };
+      device = (import "${inputs.liminix}/devices/gl-mt300a/default.nix");
+    };
+    fax-router = import "${inputs.liminix}/default.nix" {
+      device = (import "${inputs.liminix}/devices/gl-ar750");
+      liminix-config = import ./fax-router/configuration.nix { inherit inputs; };
+    };
+  };
+}

routers/fax-router/configuration.nix

@@ -0,0 +1,46 @@
+# This is an example that uses the "gateway" profile to create a
+# "typical home wireless router" configuration suitable for a Gl.inet
+# gl-ar750 router. It should be fairly simple to edit it for other
+# devices: mostly you will need to attend to the number of wlan and lan
+# interfaces
+{ inputs }:
+{ config, pkgs, ... }:
+let
+  inherit (pkgs.liminix.services) target;
+  svc = config.system.service;
+in
+rec {
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/ntp"
+    "${inputs.liminix}/modules/vlan"
+  ];
+
+  services.dhcpv4 =
+    let
+      iface = svc.network.link.build { ifname = "eth1"; };
+    in
+    svc.network.dhcp.client.build { interface = iface; };
+
+  services.defaultroute4 = svc.network.route.build {
+    via = "$(output ${services.dhcpv4} ip)";
+    target = "default";
+    dependencies = [ services.dhcpv4 ];
+  };
+
+  services.packet_forwarding = svc.network.forward.build { };
+
+  services.ntp = config.system.service.ntp.build {
+    pools = {
+      "pool.ntp.org" = [ "iburst" ];
+    };
+  };
+
+  boot.tftp = {
+    serverip = "192.168.8.148";
+    ipaddr = "192.168.8.251";
+  };
+
+  defaultProfile.packages = [ pkgs.hello ];
+}

routers/fax-router/router-secrets.nix

@@ -0,0 +1,17 @@
+{
+  wpa_passphrase = "you bring light in";
+  ssid = "liminix";
+  l2tp = {
+    name = "abcde@a.1";
+    password = "NotMyIspPassword";
+  };
+  root = {
+    #  mkpasswd -m sha512crypt
+    passwd = "$6$6pt0mpbgcB7kC2RJ$kSBoCYGyi1.qxt7dqmexLj1l8E6oTZJZmfGyJSsMYMW.jlsETxdgQSdv6ptOYDM7DHAwf6vLG0pz3UD31XBfC1";
+    openssh.authorizedKeys.keys = [ ];
+  };
+
+  lan = {
+    prefix = "10.8.0";
+  };
+}

routers/qemu/configuration.nix

@@ -0,0 +1,49 @@
+{ inputs }:
+{ config, pkgs, ... }:
+let
+  svc = config.system.service;
+
+in
+rec {
+  imports = [
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/dnsmasq"
+    "${inputs.liminix}/modules/ssh"
+  ];
+
+  hostname = "hello";
+
+  # configure the internal network (LAN) with an address
+  services.int = svc.network.address.build {
+    interface = config.hardware.networkInterfaces.lan;
+    family = "inet";
+    address = "10.3.0.1";
+    prefixLength = 16;
+  };
+
+  services.sshd = svc.ssh.build { };
+
+  users.root = {
+    # the password is "secret". Use mkpasswd -m sha512crypt to
+    # create this hashed password string
+    passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
+  };
+
+  services.dns =
+    let
+      interface = services.int;
+    in
+    svc.dnsmasq.build {
+      inherit interface;
+      ranges = [
+        "10.3.0.10,10.3.0.240"
+        "::,constructor:$(output ${interface} ifname),ra-stateless"
+      ];
+
+      domain = "example.org";
+    };
+
+  defaultProfile.packages = with pkgs; [
+    figlet
+  ];
+}

routers/qemu/device.nix

@@ -0,0 +1,58 @@
+# This "device" generates images that can be used with the QEMU
+# emulator. The default output is a directory containing separate
+# kernel ("Image" format) and root filesystem (squashfs or jffs2)
+# images
+{ inputs }:
+{
+  system = {
+    crossSystem = {
+      config = "aarch64-unknown-linux-musl";
+    };
+  };
+
+  description = ''
+    QEMU Aarch64
+    ************
+
+    This target produces an image for
+    the `QEMU "virt" platform <https://www.qemu.org/docs/master/system/arm/virt.html>`_ using a 64 bit CPU type.
+
+    ARM targets differ from MIPS in that the kernel format expected
+    by QEMU is an "Image" (raw binary file) rather than an ELF
+    file, but this is taken care of by :command:`run.sh`. Check the
+    documentation for the :ref:`qemu` target for more information.
+
+  '';
+
+  # this device is described by the "qemu" device
+  installer = "vmroot";
+
+  module =
+    { config, lim, ... }:
+    {
+      imports = [
+        "${inputs.liminix}/modules/arch/aarch64.nix"
+        "${inputs.liminix}/devices/families/qemu.nix"
+      ];
+      kernel = {
+        config = {
+          VIRTUALIZATION = "y";
+          PCI_HOST_GENERIC = "y";
+
+          SERIAL_AMBA_PL011 = "y";
+          SERIAL_AMBA_PL011_CONSOLE = "y";
+        };
+      };
+      boot.commandLine = [
+        "console=ttyAMA0,38400"
+      ];
+      hardware =
+        let
+          addr = lim.parseInt "0x40010000";
+        in
+        {
+          loadAddress = addr;
+          entryPoint = addr;
+        };
+    };
+}

routers/vanilla/configuration.nix

@@ -0,0 +1,41 @@
+{ inputs }:
+{ config, pkgs, ... }:
+let
+  inherit (pkgs.liminix.services) target;
+  svc = config.system.service;
+in
+rec {
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/ntp"
+    "${inputs.liminix}/modules/vlan"
+  ];
+
+  services.dhcpv4 =
+    let
+      iface = svc.network.link.build { ifname = "eth1"; };
+    in
+    svc.network.dhcp.client.build { interface = iface; };
+
+  services.defaultroute4 = svc.network.route.build {
+    via = "$(output ${services.dhcpv4} ip)";
+    target = "default";
+    dependencies = [ services.dhcpv4 ];
+  };
+
+  services.packet_forwarding = svc.network.forward.build { };
+
+  services.ntp = config.system.service.ntp.build {
+    pools = {
+      "pool.ntp.org" = [ "iburst" ];
+    };
+  };
+
+  boot.tftp = {
+    serverip = "192.168.8.148";
+    ipaddr = "192.168.8.251";
+  };
+
+  defaultProfile.packages = [ pkgs.hello ];
+}

routers/vanilla/device.nix

@@ -0,0 +1,86 @@
+# This "device" generates images that can be used with the QEMU
+# emulator. The default output is a directory containing separate
+# kernel (uncompressed vmlinux) and initrd (squashfs) images
+{ inputs }:
+{
+  system = {
+    crossSystem = {
+      config = "mips-unknown-linux-musl";
+      gcc = {
+        abi = "32";
+        arch = "mips32"; # maybe mips_24kc-
+      };
+    };
+  };
+
+  description = ''
+    QEMU MIPS
+    *********
+
+    This target produces an image for
+    QEMU, the "generic and open source machine emulator and
+    virtualizer".
+
+    MIPS QEMU emulates a "Malta" board, which was an ATX form factor
+    evaluation board made by MIPS Technologies, but mostly in Liminix
+    we use paravirtualized devices (Virtio) instead of emulating
+    hardware.
+
+    Building an image for QEMU results in a :file:`result/` directory
+    containing ``run.sh`` ``vmlinux``, and ``rootfs`` files. To invoke
+    the emulator, run ``run.sh``.
+
+    The configuration includes two emulated "hardware" ethernet
+    devices and the kernel :code:`mac80211_hwsim` module to
+    provide an emulated wlan device. To read more about how
+    to connect to this network, refer to :ref:`qemu-networking`
+    in the Development manual.
+
+  '';
+  module =
+    {
+      config,
+      lib,
+      lim,
+      ...
+    }:
+    {
+      imports = [
+        "${inputs.liminix}/modules/arch/mipseb.nix"
+        "${inputs.liminix}/devices/families/qemu.nix"
+      ];
+      kernel = {
+        config = {
+          MIPS_MALTA = "y";
+          CPU_MIPS32_R2 = "y";
+
+          POWER_RESET = "y";
+          POWER_RESET_SYSCON = "y";
+
+          SERIAL_8250 = "y";
+          SERIAL_8250_CONSOLE = "y";
+        };
+      };
+      hardware =
+        # from arch/mips/mti-malta/Platform:load-$(CONFIG_MIPS_MALTA)  += 0xffffffff80100000
+        let
+          addr = lim.parseInt "0x80100000";
+        in
+        {
+          loadAddress = addr;
+          entryPoint = addr;
+
+          # Unlike the arm qemu targets, we need a static dts when
+          # running u-boot-using tests, qemu dumpdtb command doesn't
+          # work for this board. I am not at all sure this dts is
+          # *correct* but it does at least boot
+          dts = lib.mkForce {
+            src = "${config.system.outputs.kernel.modulesupport}/arch/mips/boot/dts/mti/malta.dts";
+            includePaths = [
+              "${config.system.outputs.kernel.modulesupport}/arch/mips/boot/dts/"
+            ];
+          };
+
+        };
+    };
+}

routers/yada-house/configuration.nix

@@ -0,0 +1,54 @@
+{ inputs }:
+
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  svc = config.system.service;
+
+in
+rec {
+  imports = [
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/dnsmasq"
+    "${inputs.liminix}/modules/ssh"
+  ];
+
+  hostname = "hello";
+
+  # configure the internal network (LAN) with an address
+  services.int = svc.network.address.build {
+    interface = config.hardware.networkInterfaces.lan2;
+    family = "inet";
+    address = "192.168.8.1";
+    prefixLength = 24;
+  };
+
+  services.sshd = svc.ssh.build { };
+
+  users.root = {
+    # the password is "secret". Use mkpasswd -m sha512crypt to
+    # create this hashed password string
+    passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
+  };
+
+  services.dns =
+    let
+      interface = services.int;
+    in
+    svc.dnsmasq.build {
+      inherit interface;
+      ranges = [
+        "192.168.8.1,192.168.8.240"
+        "::,constructor:$(output ${interface} ifname),ra-stateless"
+      ];
+
+      domain = "example.org";
+    };
+
+  # defaultProfile.packages = with pkgs; [
+  #   figlet
+  # ];
+}

routers/yada-house/device.nix

@@ -0,0 +1,127 @@
+# GL.iNet GL-MT6000
+{ inputs }:
+{
+  system = {
+    crossSystem = {
+      config = "aarch64-unknown-linux-musl";
+      gcc = {
+        arch = "armv8-a";
+      };
+    };
+  };
+
+  description = ''
+    Device configuration for Yada/White house router.
+  '';
+
+  module =
+    {
+      pkgs,
+      config,
+      lib,
+      lim,
+      ...
+    }:
+    let
+      inherit (pkgs) openwrt_24_10;
+      # mac80211 = pkgs.kmodloader.override {
+      #   targets = [ "rt2800soc" ];
+      #   inherit (config.system.outputs) kernel;
+      # };
+    in
+    {
+      imports = [
+        "${inputs.liminix}/modules/outputs/mtdimage.nix"
+        "${inputs.liminix}/modules/outputs/squashfs.nix"
+        "${inputs.liminix}/modules/outputs/tftpboot.nix"
+        "${inputs.liminix}/modules/outputs/vmroot.nix"
+        "${inputs.liminix}/modules/arch/aarch64.nix"
+        # "${inputs.liminix}/modules/base.nix"
+        "${inputs.liminix}/modules/vlan"
+      ];
+      boot.tftp = {
+        serverip = "192.168.1.254";
+        ipaddr = "192.168.1.1";
+        loadAddress = lim.parseInt "0x46000000";
+      };
+      boot.imageFormat = "fit";
+      boot.loader.fit.enable = true;
+      rootfsType = "squashfs";
+      hardware = {
+        loadAddress = lim.parseInt "0x48080000";
+        entryPoint = lim.parseInt "0x48080000";
+
+        flash = {
+          address = lim.parseInt "0x41e00000";
+          size = lim.parseInt "0x4000";
+          eraseBlockSize = 65536;
+        };
+        rootDevice = "/dev/root";
+
+        dts = {
+          src = "${openwrt_24_10.src}/target/linux/mediatek/dts/mt7986a-glinet-gl-mt6000.dts";
+          includePaths = [
+            "${openwrt_24_10.src}/target/linux/mediatek/dts"
+            "${config.system.outputs.kernel.modulesupport}/arch/arm64/boot/dts/mediatek/"
+          ];
+        };
+        networkInterfaces =
+          let
+            inherit (config.system.service.network) link;
+            inherit (config.system.service) vlan;
+          in
+          rec {
+            eth0 = link.build { ifname = "eth0"; };
+            wan = link.build { ifname = "eth1"; };
+
+            lan1 = vlan.build {
+              ifname = "lan1@eth0";
+              primary = eth0;
+              vid = "1";
+            };
+            lan2 = vlan.build {
+              ifname = "lan2@eth0";
+              primary = eth0;
+              vid = "2";
+            };
+            lan3 = vlan.build {
+              ifname = "lan3@eth0";
+              primary = eth0;
+              vid = "3";
+            };
+            lan4 = vlan.build {
+              ifname = "lan4@eth0";
+              primary = eth0;
+              vid = "4";
+            };
+            lan5 = vlan.build {
+              ifname = "lan5@eth0";
+              primary = eth0;
+              vid = "5";
+            };
+
+            # wlan = link.build {
+            #   ifname = "wlan0";
+            #   dependencies = [ mac80211 ];
+            # };
+          };
+      };
+
+      kernel = {
+        src = openwrt_24_10.kernelSrc;
+        version = openwrt_24_10.kernelVersion;
+        extraPatchPhase = ''
+          echo ==================================================
+          ls ${openwrt_24_10.src}/config
+          echo ==================================================
+          patch ${openwrt_24_10.src}/package/boot/uboot-mediatek/patches/436-add-glinet-mt6000.patch
+          echo --------------------------------------------------
+          ls ${openwrt_24_10.src}/config
+          echo --------------------------------------------------
+          ${openwrt_24_10.applyPatches.mediatek}
+        '';
+        config = {
+        };
+      };
+    };
+}

routers/yada-house/dts/mt7986a.dtsi

@@ -0,0 +1,645 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/clock/mt7986-clk.h>
+#include <dt-bindings/reset/mt7986-resets.h>
+#include <dt-bindings/phy/phy.h>
+
+/ {
+	compatible = "mediatek,mt7986a";
+	interrupt-parent = <&gic>;
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		cpu0: cpu@0 {
+			compatible = "arm,cortex-a53";
+			reg = <0x0>;
+			device_type = "cpu";
+			enable-method = "psci";
+			#cooling-cells = <2>;
+		};
+
+		cpu1: cpu@1 {
+			compatible = "arm,cortex-a53";
+			reg = <0x1>;
+			device_type = "cpu";
+			enable-method = "psci";
+			#cooling-cells = <2>;
+		};
+
+		cpu2: cpu@2 {
+			compatible = "arm,cortex-a53";
+			reg = <0x2>;
+			device_type = "cpu";
+			enable-method = "psci";
+			#cooling-cells = <2>;
+		};
+
+		cpu3: cpu@3 {
+			compatible = "arm,cortex-a53";
+			reg = <0x3>;
+			device_type = "cpu";
+			enable-method = "psci";
+			#cooling-cells = <2>;
+		};
+	};
+
+	clk40m: oscillator-40m {
+		compatible = "fixed-clock";
+		clock-frequency = <40000000>;
+		#clock-cells = <0>;
+		clock-output-names = "clkxtal";
+	};
+
+	psci {
+		compatible = "arm,psci-0.2";
+		method = "smc";
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+		secmon_reserved: secmon@43000000 {
+			reg = <0 0x43000000 0 0x30000>;
+			no-map;
+		};
+
+		wmcpu_emi: wmcpu-reserved@4fc00000 {
+			no-map;
+			reg = <0 0x4fc00000 0 0x00100000>;
+		};
+
+		wo_emi0: wo-emi@4fd00000 {
+			reg = <0 0x4fd00000 0 0x40000>;
+			no-map;
+		};
+
+		wo_emi1: wo-emi@4fd40000 {
+			reg = <0 0x4fd40000 0 0x40000>;
+			no-map;
+		};
+
+		wo_ilm0: wo-ilm@151e0000 {
+			reg = <0 0x151e0000 0 0x8000>;
+			no-map;
+		};
+
+		wo_ilm1: wo-ilm@151f0000 {
+			reg = <0 0x151f0000 0 0x8000>;
+			no-map;
+		};
+
+		wo_data: wo-data@4fd80000 {
+			reg = <0 0x4fd80000 0 0x240000>;
+			no-map;
+		};
+
+		wo_dlm0: wo-dlm@151e8000 {
+			reg = <0 0x151e8000 0 0x2000>;
+			no-map;
+		};
+
+		wo_dlm1: wo-dlm@151f8000 {
+			reg = <0 0x151f8000 0 0x2000>;
+			no-map;
+		};
+
+		wo_boot: wo-boot@15194000 {
+			reg = <0 0x15194000 0 0x1000>;
+			no-map;
+		};
+
+	};
+
+	soc {
+		compatible = "simple-bus";
+		ranges;
+		#address-cells = <2>;
+		#size-cells = <2>;
+
+		gic: interrupt-controller@c000000 {
+			compatible = "arm,gic-v3";
+			reg = <0 0x0c000000 0 0x10000>,  /* GICD */
+			      <0 0x0c080000 0 0x80000>,  /* GICR */
+			      <0 0x0c400000 0 0x2000>,   /* GICC */
+			      <0 0x0c410000 0 0x1000>,   /* GICH */
+			      <0 0x0c420000 0 0x2000>;   /* GICV */
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+		};
+
+		infracfg: infracfg@10001000 {
+			compatible = "mediatek,mt7986-infracfg", "syscon";
+			reg = <0 0x10001000 0 0x1000>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+		};
+
+		wed_pcie: wed-pcie@10003000 {
+			compatible = "mediatek,mt7986-wed-pcie",
+				     "syscon";
+			reg = <0 0x10003000 0 0x10>;
+		};
+
+		topckgen: topckgen@1001b000 {
+			compatible = "mediatek,mt7986-topckgen", "syscon";
+			reg = <0 0x1001B000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		watchdog: watchdog@1001c000 {
+			compatible = "mediatek,mt7986-wdt";
+			reg = <0 0x1001c000 0 0x1000>;
+			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+			#reset-cells = <1>;
+			status = "disabled";
+		};
+
+		apmixedsys: apmixedsys@1001e000 {
+			compatible = "mediatek,mt7986-apmixedsys";
+			reg = <0 0x1001E000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		pio: pinctrl@1001f000 {
+			compatible = "mediatek,mt7986a-pinctrl";
+			reg = <0 0x1001f000 0 0x1000>,
+			      <0 0x11c30000 0 0x1000>,
+			      <0 0x11c40000 0 0x1000>,
+			      <0 0x11e20000 0 0x1000>,
+			      <0 0x11e30000 0 0x1000>,
+			      <0 0x11f00000 0 0x1000>,
+			      <0 0x11f10000 0 0x1000>,
+			      <0 0x1000b000 0 0x1000>;
+			reg-names = "gpio", "iocfg_rt", "iocfg_rb", "iocfg_lt",
+				    "iocfg_lb", "iocfg_tr", "iocfg_tl", "eint";
+			gpio-controller;
+			#gpio-cells = <2>;
+			gpio-ranges = <&pio 0 0 100>;
+			interrupt-controller;
+			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&gic>;
+			#interrupt-cells = <2>;
+		};
+
+		pwm: pwm@10048000 {
+			compatible = "mediatek,mt7986-pwm";
+			reg = <0 0x10048000 0 0x1000>;
+			#pwm-cells = <2>;
+			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_PWM_SEL>,
+				 <&infracfg CLK_INFRA_PWM_STA>,
+				 <&infracfg CLK_INFRA_PWM1_CK>,
+				 <&infracfg CLK_INFRA_PWM2_CK>;
+			clock-names = "top", "main", "pwm1", "pwm2";
+			status = "disabled";
+		};
+
+		sgmiisys0: syscon@10060000 {
+			compatible = "mediatek,mt7986-sgmiisys_0",
+				     "syscon";
+			reg = <0 0x10060000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		sgmiisys1: syscon@10070000 {
+			compatible = "mediatek,mt7986-sgmiisys_1",
+				     "syscon";
+			reg = <0 0x10070000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		trng: rng@1020f000 {
+			compatible = "mediatek,mt7986-rng",
+				     "mediatek,mt7623-rng";
+			reg = <0 0x1020f000 0 0x100>;
+			clocks = <&infracfg CLK_INFRA_TRNG_CK>;
+			clock-names = "rng";
+			status = "disabled";
+		};
+
+		crypto: crypto@10320000 {
+			compatible = "inside-secure,safexcel-eip97";
+			reg = <0 0x10320000 0 0x40000>;
+			interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "ring0", "ring1", "ring2", "ring3";
+			clocks = <&infracfg CLK_INFRA_EIP97_CK>;
+			assigned-clocks = <&topckgen CLK_TOP_EIP_B_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>;
+			status = "disabled";
+		};
+
+		uart0: serial@11002000 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11002000 0 0x400>;
+			interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART0_SEL>,
+				 <&infracfg CLK_INFRA_UART0_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_UART0_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_XTAL>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			status = "disabled";
+		};
+
+		uart1: serial@11003000 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11003000 0 0x400>;
+			interrupts = <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART1_SEL>,
+				 <&infracfg CLK_INFRA_UART1_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&infracfg CLK_INFRA_UART1_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_F26M_SEL>;
+			status = "disabled";
+		};
+
+		uart2: serial@11004000 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11004000 0 0x400>;
+			interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART2_SEL>,
+				 <&infracfg CLK_INFRA_UART2_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&infracfg CLK_INFRA_UART2_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_F26M_SEL>;
+			status = "disabled";
+		};
+
+		i2c0: i2c@11008000 {
+			compatible = "mediatek,mt7986-i2c";
+			reg = <0 0x11008000 0 0x90>,
+			      <0 0x10217080 0 0x80>;
+			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <5>;
+			clocks = <&infracfg CLK_INFRA_I2C0_CK>,
+				 <&infracfg CLK_INFRA_AP_DMA_CK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi0: spi@1100a000 {
+			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x1100a000 0 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_MPLL_D2>,
+				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&infracfg CLK_INFRA_SPI0_CK>,
+				 <&infracfg CLK_INFRA_SPI0_HCK_CK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+			status = "disabled";
+		};
+
+		spi1: spi@1100b000 {
+			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x1100b000 0 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_MPLL_D2>,
+				 <&topckgen CLK_TOP_SPIM_MST_SEL>,
+				 <&infracfg CLK_INFRA_SPI1_CK>,
+				 <&infracfg CLK_INFRA_SPI1_HCK_CK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+			status = "disabled";
+		};
+
+		thermal: thermal@1100c800 {
+			compatible = "mediatek,mt7986-thermal";
+			reg = <0 0x1100c800 0 0x800>;
+			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_THERM_CK>,
+				 <&infracfg CLK_INFRA_ADC_26M_CK>;
+			clock-names = "therm", "auxadc";
+			nvmem-cells = <&thermal_calibration>;
+			nvmem-cell-names = "calibration-data";
+			#thermal-sensor-cells = <1>;
+			mediatek,auxadc = <&auxadc>;
+			mediatek,apmixedsys = <&apmixedsys>;
+		};
+
+		auxadc: adc@1100d000 {
+			compatible = "mediatek,mt7986-auxadc";
+			reg = <0 0x1100d000 0 0x1000>;
+			clocks = <&infracfg CLK_INFRA_ADC_26M_CK>;
+			clock-names = "main";
+			#io-channel-cells = <1>;
+			status = "disabled";
+		};
+
+		ssusb: usb@11200000 {
+			compatible = "mediatek,mt7986-xhci",
+				     "mediatek,mtk-xhci";
+			reg = <0 0x11200000 0 0x2e00>,
+			      <0 0x11203e00 0 0x0100>;
+			reg-names = "mac", "ippc";
+			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_IUSB_SYS_CK>,
+				 <&infracfg CLK_INFRA_IUSB_CK>,
+				 <&infracfg CLK_INFRA_IUSB_133_CK>,
+				 <&infracfg CLK_INFRA_IUSB_66M_CK>,
+				 <&topckgen CLK_TOP_U2U3_XHCI_SEL>;
+			clock-names = "sys_ck",
+				      "ref_ck",
+				      "mcu_ck",
+				      "dma_ck",
+				      "xhci_ck";
+			phys = <&u2port0 PHY_TYPE_USB2>,
+			       <&u3port0 PHY_TYPE_USB3>,
+			       <&u2port1 PHY_TYPE_USB2>;
+			status = "disabled";
+		};
+
+		mmc0: mmc@11230000 {
+			compatible = "mediatek,mt7986-mmc";
+			reg = <0 0x11230000 0 0x1000>,
+			      <0 0x11c20000 0 0x1000>;
+			interrupts = <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
+			assigned-clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
+					  <&topckgen CLK_TOP_EMMC_250M_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_MPLL>,
+						 <&topckgen CLK_TOP_NET1PLL_D5_D2>;
+			clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
+				 <&infracfg CLK_INFRA_MSDC_HCK_CK>,
+				 <&infracfg CLK_INFRA_MSDC_CK>,
+				 <&infracfg CLK_INFRA_MSDC_133M_CK>,
+				 <&infracfg CLK_INFRA_MSDC_66M_CK>;
+			clock-names = "source", "hclk", "source_cg", "bus_clk",
+				      "sys_cg";
+			status = "disabled";
+		};
+
+		pcie: pcie@11280000 {
+			compatible = "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			reg = <0x00 0x11280000 0x00 0x4000>;
+			reg-names = "pcie-mac";
+			ranges = <0x82000000 0x00 0x20000000 0x00
+				  0x20000000 0x00 0x10000000>;
+			device_type = "pci";
+			#address-cells = <3>;
+			#size-cells = <2>;
+			interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			clocks = <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
+				 <&infracfg CLK_INFRA_IPCIE_CK>,
+				 <&infracfg CLK_INFRA_IPCIER_CK>,
+				 <&infracfg CLK_INFRA_IPCIEB_CK>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m", "top_133m";
+
+			phys = <&pcie_port PHY_TYPE_PCIE>;
+			phy-names = "pcie-phy";
+
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc 0>,
+					<0 0 0 2 &pcie_intc 1>,
+					<0 0 0 3 &pcie_intc 2>,
+					<0 0 0 4 &pcie_intc 3>;
+			status = "disabled";
+
+			pcie_intc: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		pcie_phy: t-phy {
+			compatible = "mediatek,mt7986-tphy",
+				     "mediatek,generic-tphy-v2";
+			ranges;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			pcie_port: pcie-phy@11c00000 {
+				reg = <0 0x11c00000 0 0x20000>;
+				clocks = <&clk40m>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+		};
+
+		efuse: efuse@11d00000 {
+			compatible = "mediatek,mt7986-efuse", "mediatek,efuse";
+			reg = <0 0x11d00000 0 0x1000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			thermal_calibration: calib@274 {
+				reg = <0x274 0xc>;
+			};
+		};
+
+		usb_phy: t-phy@11e10000 {
+			compatible = "mediatek,mt7986-tphy",
+				     "mediatek,generic-tphy-v2";
+			ranges = <0 0 0x11e10000 0x1700>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			status = "disabled";
+
+			u2port0: usb-phy@0 {
+				reg = <0x0 0x700>;
+				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
+					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
+				clock-names = "ref", "da_ref";
+				#phy-cells = <1>;
+			};
+
+			u3port0: usb-phy@700 {
+				reg = <0x700 0x900>;
+				clocks = <&topckgen CLK_TOP_USB3_PHY_SEL>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+
+			u2port1: usb-phy@1000 {
+				reg = <0x1000 0x700>;
+				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
+					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
+				clock-names = "ref", "da_ref";
+				#phy-cells = <1>;
+			};
+		};
+
+		ethsys: syscon@15000000 {
+			 compatible = "mediatek,mt7986-ethsys",
+				      "syscon";
+			 reg = <0 0x15000000 0 0x1000>;
+			 #clock-cells = <1>;
+			 #reset-cells = <1>;
+		};
+
+		wed0: wed@15010000 {
+			compatible = "mediatek,mt7986-wed",
+				     "syscon";
+			reg = <0 0x15010000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
+					<&wo_data>, <&wo_boot>;
+			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+					      "wo-data", "wo-boot";
+			mediatek,wo-ccif = <&wo_ccif0>;
+		};
+
+		wed1: wed@15011000 {
+			compatible = "mediatek,mt7986-wed",
+				     "syscon";
+			reg = <0 0x15011000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
+					<&wo_data>, <&wo_boot>;
+			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+					      "wo-data", "wo-boot";
+			mediatek,wo-ccif = <&wo_ccif1>;
+		};
+
+		eth: ethernet@15100000 {
+			compatible = "mediatek,mt7986-eth";
+			reg = <0 0x15100000 0 0x80000>;
+			interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 199 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&ethsys CLK_ETH_FE_EN>,
+				 <&ethsys CLK_ETH_GP2_EN>,
+				 <&ethsys CLK_ETH_GP1_EN>,
+				 <&ethsys CLK_ETH_WOCPU1_EN>,
+				 <&ethsys CLK_ETH_WOCPU0_EN>,
+				 <&sgmiisys0 CLK_SGMII0_TX250M_EN>,
+				 <&sgmiisys0 CLK_SGMII0_RX250M_EN>,
+				 <&sgmiisys0 CLK_SGMII0_CDR_REF>,
+				 <&sgmiisys0 CLK_SGMII0_CDR_FB>,
+				 <&sgmiisys1 CLK_SGMII1_TX250M_EN>,
+				 <&sgmiisys1 CLK_SGMII1_RX250M_EN>,
+				 <&sgmiisys1 CLK_SGMII1_CDR_REF>,
+				 <&sgmiisys1 CLK_SGMII1_CDR_FB>,
+				 <&topckgen CLK_TOP_NETSYS_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_500M_SEL>;
+			clock-names = "fe", "gp2", "gp1", "wocpu1", "wocpu0",
+				      "sgmii_tx250m", "sgmii_rx250m",
+				      "sgmii_cdr_ref", "sgmii_cdr_fb",
+				      "sgmii2_tx250m", "sgmii2_rx250m",
+				      "sgmii2_cdr_ref", "sgmii2_cdr_fb",
+				      "netsys0", "netsys1";
+			assigned-clocks = <&topckgen CLK_TOP_NETSYS_2X_SEL>,
+					  <&topckgen CLK_TOP_SGM_325M_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>,
+						 <&apmixedsys CLK_APMIXED_SGMPLL>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			mediatek,ethsys = <&ethsys>;
+			mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
+			mediatek,wed-pcie = <&wed_pcie>;
+			mediatek,wed = <&wed0>, <&wed1>;
+			status = "disabled";
+		};
+
+		wo_ccif0: syscon@151a5000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151a5000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		wo_ccif1: syscon@151ad000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151ad000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		wifi: wifi@18000000 {
+			compatible = "mediatek,mt7986-wmac";
+			reg = <0 0x18000000 0 0x1000000>,
+			      <0 0x10003000 0 0x1000>,
+			      <0 0x11d10000 0 0x1000>;
+			resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>;
+			reset-names = "consys";
+			clocks = <&topckgen CLK_TOP_CONN_MCUSYS_SEL>,
+				 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
+			clock-names = "mcu", "ap2conn";
+			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wmcpu_emi>;
+		};
+	};
+
+	thermal-zones {
+		cpu_thermal: cpu-thermal {
+			polling-delay-passive = <1000>;
+			polling-delay = <1000>;
+			thermal-sensors = <&thermal 0>;
+
+			trips {
+				cpu_trip_crit: crit {
+					temperature = <125000>;
+					hysteresis = <2000>;
+					type = "critical";
+				};
+
+				cpu_trip_hot: hot {
+					temperature = <120000>;
+					hysteresis = <2000>;
+					type = "hot";
+				};
+
+				cpu_trip_active_high: active-high {
+					temperature = <115000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_med: active-med {
+					temperature = <85000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_low: active-low {
+					temperature = <60000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+			};
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+	};
+};

routers/yada-house/kconf-from-openwrt.txt

@@ -0,0 +1,103 @@
+ARM="y";
+SYS_HAS_NONCACHED_MEMORY="y";
+POSITION_INDEPENDENT="y";
+ARCH_MEDIATEK="y";
+TEXT_BASE="0x41e00000";
+SYS_MALLOC_F_LEN="0x4000";
+NR_DRAM_BANKS="1";
+ENV_SIZE="0x80000";
+ENV_OFFSET="0x400000";
+DEFAULT_DEVICE_TREE="mt7986a-glinet-gl-mt6000";
+OF_LIBFDT_OVERLAY="y";
+TARGET_MT7986="y";
+SYS_LOAD_ADDR="0x46000000";
+PRE_CON_BUF_ADDR="0x4007EF00";
+DEBUG_UART_BASE="0x11002000";
+DEBUG_UART_CLOCK="40000000";
+DEBUG_UART="y";
+AHCI="y";
+FIT="y";
+AUTOBOOT_KEYED="y";
+AUTOBOOT_MENU_SHOW="y";
+DEFAULT_FDT_FILE="mediatek/mt7986a-glinet-gl-mt6000.dtb";
+LOGLEVEL="7";
+PRE_CONSOLE_BUFFER="y";
+LOG="y";
+BOARD_LATE_INIT="y";
+HUSH_PARSER="y";
+SYS_PROMPT="MT7986> ";
+CMD_CPU="y";
+CMD_LICENSE="y";
+CMD_BOOTMENU="y";
+CMD_ASKENV="y";
+CMD_ERASEENV="y";
+CMD_ENV_FLAGS="y";
+CMD_STRINGS="y";
+CMD_DM="y";
+CMD_GPIO="y";
+CMD_PWM="y";
+CMD_GPT="y";
+CMD_MMC="y";
+CMD_PART="y";
+CMD_USB="y";
+CMD_TFTPSRV="y";
+CMD_RARP="y";
+CMD_CDP="y";
+CMD_SNTP="y";
+CMD_LINK_LOCAL="y";
+CMD_DHCP="y";
+CMD_DNS="y";
+CMD_PING="y";
+CMD_CACHE="y";
+CMD_PSTORE="y";
+CMD_PSTORE_MEM_ADDR="0x42ff0000";
+CMD_UUID="y";
+CMD_HASH="y";
+CMD_SMC="y";
+OF_EMBED="y";
+ENV_OVERWRITE="y";
+ENV_IS_IN_MMC="y";
+SYS_RELOC_GD_ENV_ADDR="y";
+USE_DEFAULT_ENV_FILE="y";
+DEFAULT_ENV_FILE="defenvs/glinet_gl-mt6000_env";
+ENV_VARS_UBOOT_RUNTIME_CONFIG="y";
+VERSION_VARIABLE="y";
+NETCONSOLE="y";
+USE_IPADDR="y";
+IPADDR="192.168.1.1";
+USE_SERVERIP="y";
+SERVERIP="192.168.1.254";
+NET_RANDOM_ETHADDR="y";
+BUTTON="y";
+BUTTON_GPIO="y";
+CLK="y";
+GPIO_HOG="y";
+LED="y";
+LED_BLINK="y";
+LED_GPIO="y";
+SUPPORT_EMMC_BOOT="y";
+MMC_HS200_SUPPORT="y";
+MMC_MTK="y";
+PHY_FIXED="y";
+MEDIATEK_ETH="y";
+PHY="y";
+PHY_MTK_TPHY="y";
+PINCTRL="y";
+PINCONF="y";
+PINCTRL_MT7986="y";
+POWER_DOMAIN="y";
+MTK_POWER_DOMAIN="y";
+DM_REGULATOR="y";
+DM_REGULATOR_FIXED="y";
+DM_REGULATOR_GPIO="y";
+DM_PWM="y";
+PWM_MTK="y";
+RAM="y";
+DM_SERIAL="y";
+SERIAL_RX_BUFFER="y";
+MTK_SERIAL="y";
+USB="y";
+USB_XHCI_HCD="y";
+USB_XHCI_MTK="y";
+USB_STORAGE="y";
+HEXDUMP="y";

routers/yada-house/mt7986a-glinet-gl-mt6000.dts

@@ -0,0 +1,356 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	model = "GL.iNet GL-MT6000";
+	compatible = "glinet,gl-mt6000", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		label-mac-device = &gmac1;
+		led-boot = &led_blue;
+		led-failsafe = &led_blue;
+		led-running = &led_white;
+		led-upgrade = &led_white;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=PARTLABEL=rootfs rootwait";
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "1.8vd";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_blue: led-0 {
+			label = "blue:run";
+			gpios = <&pio 38 GPIO_ACTIVE_LOW>;
+		};
+
+		led_white: led-1 {
+			label = "white:system";
+			gpios = <&pio 37 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	usb_vbus: regulator-usb-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		nvmem-cells = <&macaddr_factory_a 2>;
+		nvmem-cell-names = "mac-address";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_a 0>;
+		nvmem-cell-names = "mac-address";
+		phy-mode = "2500base-x";
+		phy-handle = <&phy1>;
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy1: phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <1>;
+			reset-assert-us = <100000>;
+			reset-deassert-us = <100000>;
+			reset-gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			interrupt-parent = <&pio>;
+			interrupts = <46 IRQ_TYPE_LEVEL_LOW>;
+			realtek,aldps-enable;
+		};
+
+		phy7: ethernet-phy@7 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <7>;
+			reset-assert-us = <100000>;
+			reset-deassert-us = <100000>;
+			reset-gpios = <&pio 19 GPIO_ACTIVE_LOW>;
+			interrupt-parent = <&pio>;
+			interrupts = <47 IRQ_TYPE_LEVEL_LOW>;
+			realtek,aldps-enable;
+		};
+
+		switch: switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 18 GPIO_ACTIVE_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&pio>;
+			interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					label = "lan2";
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan3";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan4";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan5";
+				};
+
+				port@5 {
+					reg = <5>;
+					label = "lan1";
+					phy-handle = <&phy7>;
+					phy-mode = "2500base-x";
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pio {
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <MTK_DRIVE_4mA>;
+		};
+	};
+
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <MTK_DRIVE_6mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <MTK_DRIVE_6mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&usb_vbus>;
+	status = "okay";
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	status = "okay";
+};
+
+&mmc0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <8>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	status = "okay";
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+			partitions {
+				block-partition-env {
+					partname = "u-boot-env";
+
+					nvmem-layout {
+						compatible = "u-boot,env";
+					};
+				};
+
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1000>;
+						};
+
+						macaddr_factory_a: macaddr@a {
+							compatible = "mac-base";
+							reg = <0xa 0x6>;
+							#nvmem-cell-cells = <1>;
+						};
+					};
+				};
+			};
+		};
+	};
+};

sops/groups/admins/machines/b4l

@@ -0,0 +1 @@
+../../../machines/b4l

sops/groups/admins/machines/rigel

@@ -0,0 +1 @@
+../../../machines/rigel

sops/groups/admins/users/berwn

@@ -0,0 +1 @@
+../../../users/berwn

sops/groups/admins/users/davhau

@@ -0,0 +1 @@
+../../../users/davhau

sops/groups/admins/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/groups/admins/users/matthewcroughan

@@ -0,0 +1 @@
+../../../users/matthewcroughan

sops/groups/admins/users/vi

@@ -0,0 +1 @@
+../../../users/vi

sops/machines/vega/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+    "type": "age"
+  }
+]

sops/secrets/b4l-age.key/secret

@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:wcR+EaC64JexQCShFc1I6mncHGQ+bMfjAOMnoTq3/bOa0T+NCqcDmrxoHGdR2q/TV453uMiokeAm+uggpZNQ9/1Kf5mX2KQsJtE=,iv:FcyIA1uAOISu/+mfTtdQ8lgyieoCObbZ6BMvkmIVoto=,tag:ew7jg+oXP0JUBBfDJoir7A==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsdnlFYjVtdGhHSmczV0Nk\nN0IwL0dLVTdkTWhIK2tmV1E5bE1wZjcyZkVnCkV4VEhlL2lyVkxXMzFQVTZ5dHBY\nSUJWRUh2MjgwZ2RmaVRFVHdmQm00ck0KLS0tIG1oTlE1alJDK0FuNGhDQmcrKzZk\nWDhZNEJIWmd1QkVJc0pLemVOSjhqQ2cKMDYUbT8wQ89mNBJFYp2igHB2aQtxBFtM\nilUU83E0stiVKWHrCnBlmQng4UDr0rPxOWa+JpbR4bSbLPXyKIPtrw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxZmVHaWRsa3Y0TGNIM0dx\ncThRc09ZdU5YVkpWdTdzTlRXa3pjMTRVd3lNCk4waktab2lzNDJhZ0hiOTh5MFVu\nTzR4clA5Mko4Y0o3cFMra0IyTUUydU0KLS0tIC9RWXUvMEduUkp1VXpSdjNUUkQ1\nN1NuTFY4ei9TdkVjK1lUQldOVG9sc1EKFwRbPZyd7TARXkvHD74DGqwvxOjIty+X\nBHFw8H5CWp2FCCQ+9bebMamG3ShzhM21Hju9uVbMXA/WACU/9dAJhg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQ1JCN01wWHVETDM5Q3Y0\nUDNPanFKY2pjeXZJTlFMQWtIYVluMWZCZ1U0CjNwSmEvTkNZbWdmNlRBbXE5Vzhs\nbFdxMDNUclZETlNDeFlZeHBDV0xoR0UKLS0tIGF6ZlpsRWRJajk2dlFKR25RRkdG\nL1FOQWRIcE1XNkJSWkhLSFBIRHhuWVUKEOkLKs2OFUwGMXeo9Fn/3cEZGgMLbXnO\nthqX0FRS22BE092jx2EuxK1HQYo/iTojPwg0LP692R9DZMZ1bKfqQw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOekRKMG5VdWpmcm96WEdK\nTnoyL3piaCtxVnN5b1E2RXh1SzZ1cGU3OFdrCjNNMGUxMDF6NzFUNFpPb0VNa2Q1\nL1VacitPRzU3MHh3dXpTNWxYeGFxeFkKLS0tIHV3TUkxTG5mQ3haZVRSTTB2bFBk\nU0dDaGQ0ZjhEOGdqZTFEQXlPczZWdm8KiDHBQQRL4qTnStFr8nmdhet+7gBELCvd\noRvky46oEsS36L9o477ZH134wrSqAcD0NCOO06hA/jEXNvLFig9yHw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T03:23:25Z",

sops/secrets/b4l-age.key/users/berwn

@@ -0,0 +1 @@
+../../../users/berwn

sops/secrets/b4l-age.key/users/vi

@@ -0,0 +1 @@
+../../../users/vi

sops/secrets/rigel-age.key/secret

@@ -4,7 +4,11 @@
 		"age": [
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQzVPVHBBb3l6RzFtNUwv\nSGVkQ1BuMnFiREVjY0lJbnppUjRxNnNBQlZVCkdqN2lGMmp1OFZUNG1tbmFZRklk\nL0xzMEdvemtSQnNGOVNjOXEyM21NYlkKLS0tIEdwWEZpY3JZK1phRU8rSmExVENR\nWkZnRjhKZ2duNDZkVnpHQU1FakpGYzAK/wnN9n5MMUnzDJC7PWrOcO+TbiuTbSPX\n5BKJbuBLw3Qokbh8fT9VUX8UsExw+UaaPnXPcbYX4xhBhiZ0RTmyMw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWk9KTEJHR0d1WTRDWGFS\naW16L3E1WEFBNFpwSVZ3T0xUMEZBcXBrSGs0Cllua20yVHV2djEzOE55Qk5zKzlp\nQmo3UVMreVFKVTJTVGl4ajdVZ0FZNk0KLS0tIGF0VWVJNGU0M05ZajF1Q1NscHpC\naG1vblk4NmY2KzIzN1V6bWVrYW01OUUKAfMKTPzIhVd0W8yfob9No53RnaNC67Fy\nMohQHZ38caz8LhqFfDzm1vm8xi1F8kcaW6ugcPH532fdDxkS6dfnoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6YnFMZ3F5cjJDa1poTGpD\nRURZYVZNLzByMzgwZytWZDhBaVFIbndmbldzCjlvYnRVTnNwRWVKRG40MWJrQXJz\naENEWWh3TFE4Uit2ODhncWJHZ1hvdk0KLS0tIFlIUmlqVWRlQzRxcFZHMFlzVmJh\nYkdBSzJlT0pnYlRacmhINFRyZzVIdVEKJJL7XFqZafNQmfzwwjVDMw/cPob830oI\nsVQe1HaUK7IujWTCbD8l0uoqsODdaWOMDVwxuiKr+yHY4iwar+rI6w==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-25T02:12:20Z",

sops/secrets/rigel-age.key/users/berwn

@@ -0,0 +1 @@
+../../../users/berwn

sops/secrets/vega-age.key/secret

@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:3WgicB2mjBGo3YWFG9mVBYnapj1ZoH6ohwxIUcA9byWVTCS0ZKyIJZlPeyvKWEzX9ZnxgLd1DPDfFfppwsnkxYOvEJsBAf0AanI=,iv:OKSKHu3h8Kl/qAlQ1xiYElDjaql0FdIWVPJYicfvH8Y=,tag:Xa9RfEBC8l8VgHbJHTr4jQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCK0NJR2VzVU1xVGZBd3Fh\nU0xEdmFhTllBU1dpMDM4V3NjTjB6dWxoRGdNCmdMS0duUUV1bVdtVmF1Nml5YTRV\naHpLMExzTGxKclJDZkl2UWdFUHRxY2cKLS0tIER1ajBQdEFuTDQvSERQTDZialBp\nN2RJdS9tVk8wb1lMclNrQzBCTWx3UUUKVKrK0KHOAcd0oMlzeCbN9xX35QKG+za2\nMqEmG/duejDVVzxjIcMBhsXD3EytUMw6IJ/dQtGYS3lJUXH0tiq1Iw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:12Z",
+		"mac": "ENC[AES256_GCM,data:Nvb0JIeARvwzDQSiUkqNMsTFQpGLDTtM0v8ZDyYzQY9yloS1AsGtehbWPgq9Rzr6L5I71bubw8LWpa6UnlqQSrC8GLOy+ojvu/KknkNaVrWQFCw0BDJk4ypBUaQk8n3dGjkG8UUvKCy7dkwwkP3nNbsQ8HA9R5zSYHNakZmWpes=,iv:iozu9qC8nY2XCPG5aBPihCjoNIxXV3kKLcoesFYPSj4=,tag:NkqiJVwj35VY5teW7eTtsQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

sops/secrets/vega-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/users/berwn/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+    "type": "age"
+  }
+]

sops/users/davhau/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+    "type": "age"
+  }
+]

sops/users/matthewcroughan/key.json

@@ -0,0 +1,14 @@
+[
+  {
+    "publickey": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+    "type": "age"
+  },
+  {
+    "publickey": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+    "type": "age"
+  },
+  {
+    "publickey": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+    "type": "age"
+  }
+]

sops/users/vi/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+    "type": "age"
+  }
+]

vars/per-machine/b4l/b4l-actual-budget/subdomain/value

@@ -0,0 +1 @@
+budget

vars/per-machine/b4l/b4l-grafana/adminpassword/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/b4l/b4l-grafana/adminpassword/machines/b4l

@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l

vars/per-machine/b4l/b4l-grafana/adminpassword/secret

@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:9v56r2ZaEixMv61TGiCOmeAru2v9ZDUJe6v+Y5TdzfV5Rg==,iv:8kvq06/hfad+9af2PW+50l6Pzs99E5E2x8m3AIz5y90=,tag:aemnUje/OlGc6Hdzzkfdmg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaQnd5emFNTEhDeEFBMXM3\ncDB4ZThGb3RDTWVqMG9KQlcySnpTTHFGS0JzCkkxZk5KY0lHelc4V1FDQTRVZmJk\ndldYQnkvMWtWanpsVHJFQ01nMDFRRUUKLS0tIHlRM050cFArcVVEL1R6YVBYMi9z\nWTZLMG82a0MwSEp0RHQ5ZUVXUHUvUEEKwar6u4Hdcz2Wz/AYpK7jY74Ksr6DyhPG\nc8aEAMcICMiO7kQn049JSbUuOKu24cY1zColB0ANwrG0RRX6s2oTsg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdPVWcyRlVS\nblB0RmJ3MjRiazZ0emFkY0RaeUF5cHEzQnRpdHcwTlJWeFEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp4QVRIYVZpNlM0MExNanlNUjdGUkly\nc3dwVWhZWWZWRkFlWXFzT3k4WS9BCi0tLSB0TlBWSjJ0NmVYVmVNUjljR1VPdHZY\ndVJpLzJnTk5mUC9rNXlHZmh1VU84Cl0Lz74FOE6hWFh1BtmeFTBgrCEhf5znSAfI\nDqCy/WNgyLWuqM5TPMu6+S2JDop1xUpCarW+jTNOFKSZe3imPFY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtR0NIYTg0ZUw4dVBaS3Uz\nOVoxZi94Nk9SQkdFWks0YUtDcXpIU1Uzc2wwCkJndUV2eS9hY25JZi9VR203Wjlu\nOXFQYUhwaW5rbFBOczlXU0xPZ3AyVXMKLS0tIEdydy81ODFRbjk4LzRCOUJMTlg3\nWU1VU1Bra1hOajc5R2ZBaVhmWjEyZ1UKMyDHIhC4vT5mjLEq36hDx42okoEcd52i\ncT/wolZOSS/D3oA1Si3cV3ls4UCvJvMTC9VnxjX8UNHw7Qjji8G0eQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWaHBPa0pCNERiMGV3amwv\nNkN0REtUSlZhRGY4WDhJT2hqaFVwT3BvUm44Cmp4dU1aNGpPMStyMjJUOG44NWJG\nNjFKVUlHZWg0SnlUWVVNeVZ4WWJ1TG8KLS0tIFNaMklraktRRXRCaUxzZTVyTVAx\nakcvY05SbFM1NmxwQTZVbi90dkV5dEEKj/ibSS0aqnYPmqpHmmGIbJLoMXwQfvkK\nYL7XFp0s1GzSvXHeZ8o3J0O12A4CDKsI5zgvNFPE24O9oqD4wDFa+A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6cmtaZ3V1VHpTTDhPL3ZW\nSFZhbWtKQ0k3M2hlR3J0b0YyeGRVN1RDUzNzCkNuWmR2MTErMmZJZUYrSzJ1TEVs\nNktOUEF3RjRKb203RC8rNjI5QVlVZlEKLS0tIHQvS01hVjh3ckYrTW0ya2VRVm5N\nQ25wTFRuV21PVHpob0dHVzQ3U2hCZW8KY7sucGDzga1YvOXwHOvkEJbry2rLalfX\nDnM2CyUnDKv84pZsiY4jI/7sFrWl6UITpBEV90RGnPz5Hu0NuOTwqw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBjV1lmS3gw\nL3ZCc2pUblZmbXRZQXBsRFErRG16andwOFNZQ1pzditKR0UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBZ3Q1ZlZ2a0RkMGxtTGpXQk0wNHpG\nRUpFQjV2S2psZERJVUp2MGlqRk9VCi0tLSB5OG5kcXVoWGNRNDZWUjZKQXVZVXkx\nQTZGRjdkU0FNTFBRM2NkKzkrNS80CnBwMVRKUu+WxbYWKYLdXPRAAHS8bNPTlZa1\nd1FJnQJZcTv6RKQMCD1l2RaXGAt8tSkDQ6L6dKFhzkODjKfhCiM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGZhSStlUkIr\nNGdTZldnY1ZZaHpDVFZoeEJ3aFNmR1ZPTmlLa2Z6Q0ltRE0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpMbmorRU1lVEZuSzJtbmxzTTlBU0dr\nMDhsTEZML3F1NmlhcXovN1hYc0owCi0tLSBkVmRyOHkvdFYwL0t3Ti9ubEd4TXlJ\naUtETERJV0ZaL3Z1NTFNVGZ6RURBCksOxShfsYmRCkROmLNqbYACLRSRJRgtkxRM\nJSLcsuO4+TrZMXWxaNjICMPhq+L6AkUUthCl19xhT2+XmvFB0Hc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOR2t1Q2c0aFB3ZUsyLzB0\nbUFkblB3UlpOREpZdzM3dXI4bktVN1FOMjFrCk9rdmNvTHlzajRrZ3FoYXBqMWZL\nbnhLdnhvRm5ETkRETmlqSXF1N1RKazAKLS0tIDlZNXpNME9mQkRQTW1TcDRUd2pL\neW5RV2g4VE5HQ0IreVowZjRLdkNpbzAKzd6eJIpFpXptOANWTVHZNW4efd+nBABA\nvSWpJpDerYev62P3lvq8V1pvypqCjmNf5hKTWG5aAX+mzXqJaK0aFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETkZJTzFSUlNHTVRCdFBS\nTWVLYzYvc29aNDZWVjc1NVZ1aGRtTWhzdlJvCk43RUpGTC9vb2hRaVRlT2xpaGNh\nU2JrWmp0VnB5NGpha3BndE9YTkluZ1kKLS0tIEQyK1dVMzFaaWtSUkI4WnRJMjlY\nbGF5M2tlL1lVVTdQVHRZbVlNcjBGM1kKdy6B+grOB4Bt14aEi4+XfLIQTNIGQX/W\n4v4CGKs+0vYaaCPS87rcuR2z3jf4hkGa4qNMA3+fxE9UZBNiYWI6dw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-08-01T09:25:47Z",
+		"mac": "ENC[AES256_GCM,data:nEaCXu003Y/kwtNrBT+reXOZfTOjhqxUXLvUFa4RFrFREgxIsNkqi80GyDFAaBbgAFA5B71Ozwh8Ml0g3TJ15DsoLkaUgrLR9gXIuh4FoDpFKmvFzUT7nm4Ac003b2bkaMPVNXRU24O+JVgK9U5tmKfqmEkRnlY5MTLFO5EGgnY=,iv:3RpMM6CjtWJSqY8T++2GIV4b3kN724h/ZhuS1U8lJGY=,tag:tkL5+aU06xF4LUeMoq6qoQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/b4l/b4l-grafana/adminpassword/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/b4l/b4l-grafana/subdomain/value

@@ -0,0 +1 @@
+grafana

vars/per-machine/b4l/b4l-paperless/adminpassword/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/b4l/b4l-paperless/adminpassword/machines/b4l

@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l

vars/per-machine/b4l/b4l-paperless/adminpassword/secret

@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:NsbmiB/AWbAHRotImbG89mQjINxWyCYx5QJExqv9eVpnUg==,iv:VKGzSmYZkKQzG/Fvs3Lk6KBexqKzoVOCk33Lw0ovUjY=,tag:4kWuchFThyRuqIA/tpEL2A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmcjloZHZxamR4Sm9RdW56\nSzc5emNlZzlrVEhxQk5GTmJSU091bXM2UWdzCkVGallpSFkwcHh0TzljdUQzWVVk\nTkovR1pHaGFBSmkvNUlReHNyQTVaY00KLS0tIEpaWHk4NkRzTEtKQlZlRGF1NzJY\nYzcwazhFK3BiYjlGK0xEemFwQUtnblkK7NKnJ7QwJLMytdjDt+UchcP//Lf3P6Ud\nT5Adt5I5MTcPcBTqLNlWvFjoW83fDJ9c8rNdq8Ymy5wycffiekbW6Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNzR0wvNFQ0\nZUVRQVBWd2JOZzlXSVBuUjdtMTNkcHVoMGNOSTEzNExKSHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwprTWQ1UnRRaUN6VE52Z0NzeCtqQWlW\nRmNtbG90U3k1bU44OFduVmdjc3dVCi0tLSBGY1RSaEtEYU1vQUh1L3NCcElhWkM4\nTWhOeTZpNjBjemdLcGUzRk9aN2ZFCrx9cEAAWSRW0BcWmBE15pEQ+ZAANTVF+NeF\njZaqq7RF+cFxX/A7LW9EC7Lht98FerAx6jjhpV1EjFwpS83bjvQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2OUVhRHJKSW4wbXNTUytj\nbE4yN1Jpa2g2S2ZZRTBUSHBLWjJKNHdHSDNBClZybTRab2lxN1dHVjFXUE41YWNX\nWVZDNEp5Y2NUUWJhWERLZjQ0UzdrRGMKLS0tIHNVTTlucVJhejliRnhLb0FsTFh5\nbDB6bFMzclZ0dG1RQnNWc1VYSHBRSmcKaW5he1XOT64NIHG7Iut/7lMeht+kqvg5\nUrhM65sxwUMEU14LTXjrzUtl6+pxMgiaXDxfAvWrJbEnFaf4ZNOo4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsVmRWaHFzWTE1Q2ZNQ1M2\nU2FobFV1WDZHTjNVNjZhbVJodC9MNTBmMEVzCjJTQVl1dWxkYVZ0bWdzcDgyY1dT\nTXRsTEd6Vyt0ZWlWSTlFT0pXandoQW8KLS0tIEtHSDRDSmNteXFqTng4a3FCRmJN\nOXFlbTdySmtLbTJZeXlDa2cxQUNTaGcKUNo8VVjwtQqYHj55FWv3RXtgC4wKV6kl\nwZk9e3X1YeXWj6az2d1qfr8jppFhHNAWEmMxbceMZh1KBApFVV2UWA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSC9IQThMa0RaNVJkTHJR\nZm1XVHFVdlJxMVIrUUlhRjVJdUpFU3JDMmdvCjRYVUh0K2lSZDFNSTJTK0ZSZU16\neGhxTXFBVzFsRlpwcjVGWFVhL282dFkKLS0tIHd2Y3NLWEJiUHNCajlKaE9wQThN\nWE05S2V4cmE3TG9keVFaeVphN0ZtY0EKV1FUztf4KoKFZoqgU8rVSU7v5eblF7Ya\n2rvKTb1GtITo9uijfd2FZpoBIEl2Ej3EijhIDsTKUZ1o+YArletatg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIElLdHRLaVZz\nUlduUi9IQzFWbGFqbWJuaW9hM2JPOTdDc1lwd0RpRkNsVW8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpQczBubDlTWkxNeFUyU2RTNlJ4d2R3\nTHQ0amVjU2VQTndoQlFORzhkYzlvCi0tLSBObWNGNE9uS2xpZ3c5NWtETUpuSW5U\nTU5JVC9tM2cwSzNDaE4raDhhYUxRCuwnhfFV5DowmgqLzFoO+ZoRi1nmK3gkdbMe\n1MTfV/6xr0DYg3ceizb8f5hXOvmeZ+ZfFoUskEXkUqPSycvevk0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHh6ZkFoaVB6\nVS9aT3dhZ3Ewby92WC80S1hNanBPbmF2NDRzTW1SUnYwQ00gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpJK1BCTDJycHFIS1hKanlJYXpvZGp2\ndDBTVVZ5bDhhd0c3cVJTYlcyVGJ3Ci0tLSBYU0lwUVowNmlYQkRMQmhrQlA1U0N3\nS2dFbG9JR3g3QVZuMW5RZm1ubkFBCoHDH5E/OhgJNoF4l2oQEpsV7BbG24PDVMzP\ngKB7gFpMkOBCLaiRPb+3nAgd6w0aHISD6dA4uUw86Lka6mdm62Y=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQU9CU202cmQ3VEF5QVEz\nUVN6SmRkUm04aGRiM2FxcUh6YngxTGFYZkE4CkhqMUE4Ri9Mc0l0NnR0RHJOMnNt\nL3p0OTRhSDZPbGFld1duc1lsakFEOHMKLS0tIE5KY25uWllIbGpkV3lpdGJQSTRj\nZUd5dGJEOXhRY0R6Skw2VFZJT1ZCakUKeRnOh7dQz1oCMOQN2rhAyI46c/Ui+21l\nOH3+knnJV5cXRsb27Ou6pTgKXWn6PJ+2d5qTWL/IZ7q4ga3H63yQnA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZ0hNczFqTHlDWjhtMXBY\neDc3Z0xSYUtpYUFpRkRaR3A0MzZXWXlmZGprCmxTbDQzLzA5T21CRzdaN1ZtWlgx\ncVZ5NHN3bkVIeDZ5Qm40cWk1TnpHU28KLS0tIGdOOG9SRE5VMUc2MWswL1BJT0R3\nN3NWeGcvTUJRSFBXRmZiRm54QmtCMG8K3QbVU6Q7OYpe2GzXTVUbuUx+A8JkHGyX\nMXBrF80AkZd10mEEs0Vs9ZmLKE9u45z+xxpk0lhTxhlRxKFDAsRyYA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-08-06T05:23:42Z",
+		"mac": "ENC[AES256_GCM,data:eK8RPnR3M4KUGFBtJ43UGq0F4hw+CL1NwoCJbzpX8W8i7pPJOXkIEi0Q4bi3ALMbUxHd5mYE5lKZj0VpPaV3f3t3AvcIg2zWamBYps5R108vwmIDd2UFtmCA496sOSJgpTNX13V8X5cK+3uYXYnd4fz9qAupvFpIpkqWqGl4kxU=,iv:/KOE9y1bzpCzI1jmXZ6mfh0jhVhOvpgS7GNIp2QxvhQ=,tag:e5gLfU+9SyxunVeuOVirhw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/b4l/b4l-paperless/adminpassword/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/b4l/b4l-paperless/subdomain/value

@@ -0,0 +1 @@
+paperless

vars/per-machine/b4l/b4l-pingvin/subdomain/value

@@ -0,0 +1 @@
+share

vars/per-machine/b4l/b4l-stirling-pdf/subdomain/value

@@ -0,0 +1 @@
+pdf

vars/per-machine/b4l/b4l-victoriametrics/adminpassword/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/b4l/b4l-victoriametrics/adminpassword/machines/b4l

@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l

vars/per-machine/b4l/b4l-victoriametrics/adminpassword/secret

@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:YpPv9DuLRdwX2CrLIU0Zr14KcrfaK2MW6N7VYBpIvw==,iv:DS2qhq/BMAVXqaGqYDH1cK3mv2nSWHbN6O+KCe/jXBk=,tag:mRvbZv/qSsAWVKmdqxrzpQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWWVWYXM1TTAwZmUyMUor\nS0dTeThyRWVWQWZPQ0lFR0M2ME9rQkZod0VFClNvT2JMMnl4TWIvTjA2QklTV3I0\ncDVpd3dhZjVrZmxKeUg3NXRpVGMrVEEKLS0tIEVNL0RvQXB2cS9JZkdlWm0vVWdF\ndFI1ejJkYkNhOW5VU1JZYmdvVllBUDAKCcnA63zxZRfSq6praFJU7u09J9RzPD0Z\nF4FAzBwTCcPA9BPt6e/pAitumSEOTzjuaUmblbXRD7EzBqPERUkXjg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDFoaThlaTJ6\nOFdLS3VrbWgyY0ZvaDVoc3hncktEQ1kzbVRqL0lOV3k1aG8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwppdnV6ZUd6T08wcFdMYXorbGZtWm4w\ncWE5dkVMZmU3cHN6WUZJcXIwTnU0Ci0tLSA4bm93OXBJV1ZzRjNtNTlaODlxaGNU\nWDlwMkN0cXJhRE1OMWF0YURvQno4CgrJXizOnwb2miZwh9AdOo45MVPaWLkb578I\nYYB0ZumzERCh42r22ObshmRMJJ3Xnq8YmukRHJgvEji9DlxSu78=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmaER5OFdjT2tDcHBRL0Rv\nME9XQWJvVjJuU054dWxDbDJtZ1hib3dPdjNvCkVzM2JhR0Q5Ykh3c2s3c1NJTEs1\ncVRRNi9vTUE0QUlEaCtZUHlXbGlVcFkKLS0tIDRXUDFFWnV4U0h5L2FMMnVGZ2hX\nZG5URXB4U2l6S0JyUG1UTG90cDMwa2MKOqPY/J0/D6PxrJbezM8gBEkfnVSJvjab\nxMnFX5IIL4+styO9Gu5sB9CM9tkf3px7BxGIaSHkDsBU2IgZWO8AMw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLcnBhVEk2L1N2dTZmSEVS\nblRqMVlJZDBDaVZ3K01xZzNNak9Wb2dLTVVFCnMvOGJHM0Z3OW1oWDhIZHFhM3dK\naFVGdTRaSTBVSS9MMWQwMHdraXdIbDAKLS0tIEdiWjdiVmhFZm1YSzhFdFVBUDNm\namZJaU52aTY1MXpscHo3Q1dIUWhNd3cKL0Tw/Cr3AfzQKYH9JzcMLvhBrcHnTDUI\nMUn95VCc9saD4Oqq+IUB2RaK3y97CMgFnv236u+BwYQ+QgRsSBziLQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQOUs5LytTZExvVTFuSi9a\nVXNnOHNEM1RaYmJJalhORWNDcTAvcFRzc0RVCllRbTJJRVdiM0FMdjFZVkl2SUUz\nOWRnQmlrWnJLQWNLN3JOYzR0RTAxWE0KLS0tIHVjc3BhWXM4Q3F6ZW1tR3p1TG1M\nS0NwU0ZEcW9kUHgwRFQrQU1TRHlTQVEKXNyup8YhTAKrpkOkoV6EUX5O4wClEXVI\nKxGGxjxZq9bNnoJ30F0/OYZraEa0z9NzUPMUHFK0zUCmAtwMLX4gRg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGt5SU9OM09s\nWmxFbGkrT1hGVkJoRHU3VTh5M2NoM2EwTXlSTmZsUHQvVjQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjR1MwR0YxVTQvc3p1QWQ4OGg0ZmRQ\nR2lCeTlqeFlTTW1YSEt5MG5vMlI4Ci0tLSBad3ZQYzYxaXZ4Wjkzd2VSOXFQaVlk\nU2JFYmI0SUt0amhUWXg0V2RwL3pNCmmqyW0tlBhk7Ul5gIZAeS6Qp2BSPo9/qE8w\naCyZKUwco/xgFFSY4Aog3qlwaGyFg6x4sKaAbctE8kNy8HlCyjQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhPY1VPajdx\neFM0bXdDSHBKTklRNUZzdGxqOG5ZQmtUdDZVb3U2SkVtVDQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpKQ2NoVFRQdW8va2RKc3B3T0ZnVEZM\nNElLekI3MjhxUXVMSTBqNHhkYWhJCi0tLSA5WmVidmM1aG9iUUZYVGFHeEVobmJ2\nbzRwQU9NSjh0UmIzUkM4R1NFZnJjCusMZwh5Hiq+Tu3oa4CPdG7Pmavl7xl17PZP\n48gUig98UJJJsQTLqktljBKtoZPKVPzKkwf8HrgmA1s36VsXrhc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZVFE2OVA4bXBkL1NaaURD\nV3BSdGkxTnlaSXlPbVBhQ3FJcCttQWtpZEZzCmgzNE1xYUtVUnlKZ09wOXhIZ0tS\nVWg4WGpKT3U2MlRYOG5OMlRhaDJPWVkKLS0tIEExUGx6ckp6bkp5NkQvMlZmeGlI\ndkh6ZjRibmJTOTByRzlYNzh4WUptdDgKad29xfd3n43XY+x3yZhpYUV7bYHOufiA\nOQdqkdYkNfbmLX66WobF+cAiekfq00tzkOJpV/OJukMOjCfyMv/qNA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZM3M2TnI2NW5yWnhyZkJ2\nSnQwZlV5WS9hc0FaSEl6NC9GM2F2WWFwb1JVCmVSbUFWbzM0VjBQbXIzQ1pwWEwz\nSktxVVYzN0dkRHhPL1MzQ3ljUnRoNUUKLS0tIE1Tay9TaUZ4eEdrMThkZEVVSFlt\naHBtU2RGcnhtdytWWTlSUzBNRllITFUKs6mnVWoWASUEK65VyDpkhVtPKPGKKKbN\nXvBSKZE5odvM4x9aohZB7dGC/geLTZ16+HdxEy7rISadlB1Uqzjn+w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-31T08:48:18Z",
+		"mac": "ENC[AES256_GCM,data:gXIh/MEkCPoL1tfGYIVQs6e335glFCz1AW0EAdVRX8VVxUk9vwNgf577Sd5fHDBuQsYrqMonRPwRYEACLtjaK37+mk1qa+A2gpg4OfhUJF1inrWXZoTY9SSH2LtlAWddcxDDAKA7n0Itqv0FkQuqVmmr3j3XzMf9fTMgAcgscDA=,iv:RZPNYp/6otR67smbNE+fcQqzO61+NEjp1sIHRTUpTl0=,tag:2Jx1M/Y+ODYRaOtps3KY2w==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/b4l/b4l-victoriametrics/adminpassword/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/b4l/b4l-victoriametrics/adminuser/value

@@ -0,0 +1 @@
+admin

vars/per-machine/b4l/b4l-victoriametrics/subdomain/value

@@ -0,0 +1 @@
+metrics

vars/per-machine/b4l/nextcloud/adminpassFile/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/b4l/nextcloud/adminpassFile/secret

@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:OgzVf3R/puWxEQ49D+Ex5Ldqh+WBFu/8dGnTEA9GY7Qm,iv:X1DFwWVkf5vqYpH6XxLCpN0LSqriaw2f0s1VDoNAMu4=,tag:V4Aic2ttraDvOiZDu5RcCw==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnS1dPSm9GN2VNbDhGYnZK\nMnkzWE9wbTZXTmk0aTB4RmZyWmV5bkZ2SkVJCmpQdXJwWHVxaS8yTUZSdXJiSUtx\nakRVU3JlZzJnTnBWVjA2RUlVQytFVk0KLS0tIGhwYWdycUIrYVE3MHd1bDdBUWlB\nYmtTaXhSQ2FmS2VlRVpTOEtNbGtObGcK6LXf0aHZhh3MvRUKn6cTKH9ZkgWQD1JB\ng0G1SWeQNq1gwlZB/1IofCokJCdUZesX11yAHstk084gGOVYVsmDtg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFdLQWx1TGFS\nQ1JYUWZKY1ZnQkEwZTJIMVpTTUpNM2FYdFRaZzdzcXRVMncgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpKNTBneFZWMy9oTHd4V3VDZXJYMmR1\ncklkVkJXTnFkVzJwVGxnSDJqRm1ZCi0tLSBzdDZwRVI0VnlNVGo1SUJPL2Y2eHlr\nQ3BWV2RtajRwUVlRUUdOeEdOQWxBCqi/B3bUN0XMP7zf8uoUpufc8iEj8Lo0ktW4\nxUaqv7KUkk+ANAYDSB2jq+HtQLMWip5+p7Jet/4rRiL2Y26IPho=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcmJlZFVvTHZDdGtCV3ZV\ndys5TXJVbkFhcnhDZS9ESDBRc0FPV2NIaDEwClhJbzRENWtEdUoyOW9xTE1KNExD\neUdUNTZFcFFvZXZWNjlVNnJQZ3ZaOUEKLS0tIHFhNXpydS9HVVpGUGxxZWxZRjhx\nUEpUYVhPZkFVMEIydUtnNS8zNlplQTAKyONTjik4yiJHjIz4XlLCL8Pn6zQCWJ+8\nH16EvR2IKvfWIbOVghJCgIdzR98ilvbBAmfO4b0d/7BRBdcRsX5d1A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMHpmR0ZhV1NMS2p5MWhn\nU29iZWdDNEhTNW5TdTFCTXQvRlNVKzY5a3h3CkZRcS93ZktKMk1hRGV2ZDlyekpD\nd1NVeklZaGxDY1dnUU1YN3Yyck83SzQKLS0tIHpjbkU3MGNNZzgrNVh6VVJvMHNq\nemt0SzBxYmNJRUdUeStMOXhuS2N1WEEKoyoLi3NffN6yYcumGuu6jgDDVdlkUR9y\nzIwwM68DbC/clKH0bKhPd7YX9ipdKfMv/dcIjUtxoLELJnrCY3FMLQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCV1FQeWhpVm9FZzNtc3dh\ncXhsZnVVT09jTXFYZEw3bWFlbVhhemRhV2xZCm9SaVplN3lKQ2NlM2RGVUNGeE1N\nV1ZYRkExUDUwY3NnS0J6VmVCNkVHMUUKLS0tIHM4U3RqdUNDYzBNditIUTZLMGR2\nUHFGTnJ5K0hKaEZiTjdJMlF1MVB3d1UK9GwDc1dVTUpowFoiQvYJqXigHMRLNURY\n2D7UKQX5wwwKfAwFwP6HQdxX4WWsNefaxUSzW53zqnbJn0kkqi1Mhg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOYkJhMjh4Z3hkZHNtOU9l\nRVhnb1FCc3Nqbmd6enowNThGb0JoNzMyQUZFCi9menFkbXFFNzZZUEEyaVBrYyts\nMllmSGRhdkFRNWMzWFI2cEhUdFI3ZDgKLS0tIEs3TjJjRkJXcGJremd1TzhVN29F\neTh4ZzgwenhlRHdDQ29XTzlJNEVKV0EKYImcALRS2gUcPIkF34+QTPppcAHAYHF6\nLDsTbJsEcGV/OQ7GwFW0seC/aSMNkb7psB/xUhAMgIhnsgJbinOrtA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTNGhqN1lRQTlxM1F3YnQx\nMlRWOVh3UTlZaHpPWWwrcFdGRHJ3V213Q1RBCklLTDNqY0VSQWpNS2pXTHNYbE0w\nS3N1Mm5KdWsyVDJ1THF2bUVXNVBHNVkKLS0tIGxsazZIUS9hTXIyc0k0d0RUdzhn\nQmk0OThqanorcDJZRjFFaXZ0ODZ5UzgKyi9Cdvmp+dzGQ0AXv+VtGLtEI+rOCKgV\nv+44GG3qjUy/kMWE+HJr/4g7SCevDwZohqFIJCFnM3WBttpJc+UF6g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIENTTEY5NXU0\neGZISEZHTERlWU9Pa2ZrWHBxU1FTRUF6Vkg3Q3BlVlUyV1kgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpvS3EwMWN0dG8wS0FNcVhMenJTODZB\nWmJUQVJRWXYzWGxRSlhBRk1YblJ3Ci0tLSBIMXJ6dGN3NlpnYVJTY1ZZSXBQbyt0\neGRrbk8yaXd3VHdUUDJ0eVhnRHlJCh6lamysjjrZN7h9nVyy4pmprp00l1n4m8kR\nTNXGQ7Y+kB62eUfQBsCN8L22+3TIX43Tg+CJ2r0LABdZyJZq7MM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExaaVN4Y1lE\nM2NPbXI4ZmxkS3FsSlRnTkJ3OTg5NWZ4VkREMVRtdzkxVU0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3WXZuMitNQzhJbjhROVR5SmhBS2RM\nSU5pdndFTkVjTVFoWUZKMGFuOVFZCi0tLSBtV0JKRmpxaTlxSThZdG0raUpBWWQx\ncnY5QWQ1UzdyT1B3YlRqYnBxMDljCh5LHx6qX+47VWBTxRp0J3Ww6gs2tDe80oXv\njzh2HHGWVtGfsxwEg8AcnR89LZXBq9MXKYFVLJxvsmIYF6Kh63k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0M1UyMjZZcDlSMFFiUzhl\nY1I0TzBFYnRaWUF6V1JVMUx3blJaWlJxWnpnClpkdi92U2lnaGVJOG5sWm5tWVd3\nTXZNV2tORUg5L2t0b2F4N0lFai9Tc1UKLS0tIEs5bklPZUlUTkhHdTBZcCt3eEky\nZHpDc1JTa2MwNEgwWWhPUTJFdFI1RHMKp1OjwDOnP/Q2NpHVooO8XLexz58BgAhX\ngsAcoy7AngaYbRUSOaSX69Pwc8WmBNJOC2dPf20/W+Phxze7NNLvLg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bENxMEZpQnVGN2J1bjJo\nSmt5eUVxZEdmb21LbjFENUtzU21nNXQ4VEg4CjZqS3ltY0s1cVd4aExnNkdSWHho\nZUNIaGNOcldCMmQ2RnB6SjNONkxITWcKLS0tIGVETy93UWh1bnlnbWRpelNJZ3pu\nVWlGenFBQ3BDQ0lKWW9YYlVnUmErYXMKY1j01WnlFey13mf+HIPb2rN8SSkIlC4Y\nxxESnu/pFUrn5t5CmD0mKhkZTkEWeYKiXvlHhwWP1vE613jNbPi+PA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T09:48:21Z",

vars/per-machine/b4l/openssh/ssh.id_ed25519/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/b4l/openssh/ssh.id_ed25519/secret

@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:DWmQdG4FDFczm/aCY7WT/p4ysuF6aY/7nprvN8frhEnD6tuu++IEfE2XVNpEDka91rYf4XZrGXrVK8nWdi5AEbFIvXJC1JaZD4dTkBE1F4aJSSXsL3PxBZ1pIUWsLQ9QZ9pzuhVPgGuCS75+44pAGCtYnOPwNPOH1PeMEKVCeEwMKmQKPpqFKz9SpqOZFmzS+qgjm3Jic9dCcsiJoDHobmE3Olp+PZ9mJksOUG75ATXJ3zJ/8gUt39pAJUy2jYHscEECNMc/PuJg4dSZua5M0y+J9vwB6MVhAiyuPj8Ac7SMwbTB8l65Tko9GWR6CknF+4z8ky/EtbY/2hO18tkVLegRwM7UvqFWxXFIC79KCiC1+/pG5BUdOhIzlYwohn9BZjWgdzcy6Sg9cSgJWuDC7rX94vTcV65If7is5bGvAsNB2L5CCoPfq+dU3KNsFwo7mlFOyA69NLYqZEV3EhKdqn4uj5Y9qGqvCz8ew0Y2NP7BgkpsR1qyFqYoIYPhRlC4Iy14,iv:jUBLVPSN+FkcRdkKq8l99udzTOHEio8KZSc4pBOYHgc=,tag:Ml3Fr8Qj2ZjwpE6CYju5Lg==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1UVBhV254a0V5YVpJT1d5\ndW54RlNQWnV4WW93ZlNJai9UQkcxY3UvZ3pFCi9Cd0Yya3lpbWxkbVBMRUprSjB3\ndlpiYksvTUNLcGRWM1JHQVpveXg5QUEKLS0tIDhtS3gyTGwvTFNKemxIRjhrZUE4\neDhpNWZISmY4VU8wUXRsZ3UycjhGbzQKJuS6ipirrxFNNFN/S6O1uB1/W8ZTLhBb\nUygnYFcSAUGU4sg0/GCfYhJL8M0QCKWUdkIGHD0rBf3DLaCSHluQQg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGR0aG5TYzBy\nZW9DQWJNOU9UbW9TbW11b1N4c2U1NnZlMmdNQm5zWGRrREkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwprTzRHRFpuZ2xURmhGc0J5cHFTSjR4\nemU0UEY3cS94Q1NZbGt2dkVIakNZCi0tLSA2alF3SFIrTy9XbmJQUExnUFc0SjMy\nUjl6NGZxblZUUS94WFRIMEZsV0Z3CrvC1icmymgdpQsC+8m8mrKTbRG4HHmfKCEd\nIizhBO1pS/6a3pyXyEPiiJbaUQwhny3K8j8/CsY2adldIfvZfrc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZWc0RjBSVzhFSWpIUThG\nTEY3eURDSnhtMVdPOUZBZWY3UWFjdmsydFQ0ClF4dGUrM2FLZWtuNWVmVVFodUZY\nYm5aNy82UktHOGoyOENXMVYyMGJWc28KLS0tIE1qRDY5L3AxSnMwZ1J4STZRcUt5\nWjJad1dpVTY0Z042aUFKWE93eHlJbmMKBWKpYztqSKuOLPx1hXE9BqEQbdZJwQF/\nrWpAzjVvVHnVA/CfqXOMzGqQKc98lIZeJEBGxRWNHZBMbf4QrE8eIg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwOUl3bzl1dVdzQzV3L3Av\nRTJRN0x2YythVDNHNWE5UEE5SFUyT2FGR21rClNVZFMxSk5IYjByN1YzZXBTOWY3\nVG0rU1d2T0xjSmNPWkR4UFErT1U1UXMKLS0tIEttNU5wS0tyTmcrRmxVL054ZTYx\nbkJVWTRieUhHL3IzZFdwbVllVTRHNXcKUyxic3yJZDutMB42VmisFc5tz0ZlLXO6\nCm7R5q1TSx4ME26oCJ+KoHhLUiILhdcSYQt5T6MZ45s4bh3Wno+amg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4d1FRYSt0czRoZjBWYXRl\ndjIraUdKV1E0RUtFVStmSVYzT0FZU3MxTWw0CnVDcXYrUXQyVmVlSmNtWVNTbDF5\nZGRrU0JCV1ZhVkt6YUpOU1dKZ2N2QTQKLS0tIDdsamZGNGZ6T2dpVWhvdVI2b1JJ\nUm5DTFN6dExhL28yRjk3djZ2a3N2amcKm0Tm6wE6BJ4tKvwAAGdlSTGCwZD12ME7\n02UJt2KC8RcNWwWuBngkKSDRim8LMwanl3vFjPkXVCsubyRLCdnaxg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpc1dYazgrM3FlWk51SFRE\nTEZJU0Q0VFpEOVZOb0w5dDFUbGxMdEZlTEFVCjR4UTRYcjdPWmxVUHh6c1NGeWto\na0M0OUNIc21LTXVaQ1pHMnlJYk8yWUUKLS0tIHRsOHJDSDQ4ek0rcXpaeGk4WW5V\nTjNnMGhHRVBnNkFaQ2FrNTdSTW1hbHMK+1CItA4KzGvtGsZZdqRqyUQgXCtWeNva\nYKBoeLRSfxkeiGlFvr/7AjaQHSfZ0H+oXVcvFgqFrIlyWr5lLcPWTg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdjAyazRKS2ZRdEErL2pl\nYTBpWkF6TUxqNFhVUExDYWZSemF6dG9Sb0E4Ci90aTRpSElSVlk0Y2c0bk1TMDht\ncjlnUXp2ZXlIQTVoMVNxZjI5QmtmSE0KLS0tIGxSNUNIZ3liYkdFaUcwK2FzeWVH\nOEpBMlNKUzByN1NyS2Z6SjZDRndtU2MKS4HPEtj9X65jrGJ4VnpxB41fDzNBUy9U\nQ8UtUJ/OaUk4gmft32No+rdWqwSr9doWMRey9eKb4aDQ5zWuflnSpA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDlVa2xyaUdk\nZ3lGY3hwNXROTkpZM2tPMVVKU3U5WWp0dVhDK2EzL3dBWEEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZworT2tLS0RXVjRBcTNzRHIzN2IyNGlq\nMWhvSXJGTTJ1S1J1ejdSblNGUjJjCi0tLSAyYzFQRUttM3ppK0VDWUd1R25MYXVQ\ncEsvYk9uVkoyZy9wTWYzdW5RaXFNCq+QqTvrf+NuD9aZlxMbzz1CvnmtuZNfCmKC\nwqq0Pmzrev+LIoJWDrKEFve2GDS8YWvgWRCEh5Dw5UAM37jUu+k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFoWEQ1ellK\nSDR2TU5NZ3hPRkIrMDJnYTZaQ1UzZU9Mc1BQWGs1U0tpQUEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQoyUzU1Y3ZGbmlBdXN3UFdmS0FMbm5I\na2JESkh3U1VMSzZMVVRaQlh6SzVZCi0tLSByVnVLcE1pVThLVHRGM040VElxZU9a\nMy9aTExBZktxdGgrK0loUGdzUnJNChdlMJ/9GbNzjTgRE5T1T4KChFlMAplnnSEj\nXm6QO14w9zGNjE9R6SMdwmJxJsJVF84p7j0JqyDxYqsHn0lXFHI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaldRZ2RSK1htdFgyZ0JC\ndEU4VXU2WDhCVjBVbWtGTkxiZDVQMHBBOUg4CmZKKzBxMTVaUDRyckNSQndrTFND\nVkloa1JwNU5xdU1pY1U2QTJRZks2Q0UKLS0tIHB3cThzRllPc24xZnd6YktURmJD\nNUVBVVVFTFNTS0RoQk00blNFVXcycDAKMIgk/feI8cCpVi889HGYE7N2UHoNsRgs\nQ9oylsSj2exEurM2bOobzbD+hlqKOvmjY6Op62dUE7Q96lfraJMBzw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSdU5Ed29QYURvMnhqdk9m\naWlxN29OVjNkNHJ6YURzRTVRa3ZNbnhyY3hvCmFuVVhCbjYzOU9NMklsRXRRN0sr\nN2RpaDNZRWsxZnhpVytqLzdpOW9TQXMKLS0tIHBhYWhqZ3cyYzZTNnJacnNQcmlZ\nZEluckNoeURqek5jcFRjSUJJU1ljYU0KOEhr7W3KlrWTHuItIjN15r9fFmLAwXMM\nx+7+JAgvVPDb55iImZpGS6IIE3F/FBiKPAdTQhuez0rS+qCuxkrhPg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-25T01:45:44Z",

vars/per-machine/b4l/pocket-id/encryption-key/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/b4l/pocket-id/encryption-key/secret

@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:Z+f/21lCA4byBi52MuwK8K0xs5KkjyZDGJo0pQL1c2pM,iv:pfqOkBOch2n8PhFQxQorC3sY4O5ri1t5lul1UOOPmxg=,tag:L1T5b8MRkNxElXf3jIcEAA==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWeWpYQnBLTEVOWGhSZXU0\nUTVFaGlTQTBTU1dLcWdQMGV5cC8xVmdUdURZCkdCWUNiVmxhRUVDY2VHTktBVGph\nWjNpOTJhc29WVUdrL2psTHJIZ1l1NkEKLS0tIEg4MVdRRFg2dnAxRkFwVGhQbXE1\nODErMnZaejFXb0tZamJtNHFrZkkyV0kKkaF7WmEsHzKNyQS9wBmvVtSP5ChUgwPi\np5NUIYLAk+WUHTVenyOXEIZwsV8acEiKu6A+dTTzg1dhYpa1jgBKBw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEFyT29VRy83\nYVhYT2FQeUNoakd0WStsYTQ3Zi85OVZvaGJBdFdyUmd3aWMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpWWmc0OGJtRm00ODA3RlpXQnJObTBs\nZWhteUFjL0RjdEJzZzZWTXFqdlkwCi0tLSBpUHJNRTE3MlA5TVNTZDJwaUVmZkNZ\nLzJLOWlJWGNDbWNDMUYvTmRXc1BNCs6EOq9tLCBfd4ZkeNuqKlX+T/q3bRYwclyN\ndsWNJ2QZ8/Wj4m0xbC4tFfdCIoRxd282hTSurw65R/8dY4zFCw0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwc2VJTWlGUEJnWlBvVHFn\neGFqUE93TmNLQ1NJZnZ1eGYyNGpWUkw1R1RRClV5T0dMVGlQK2VrTlpCQlJBV1ps\nTDFCdmE4cTdUMjZucVVGcGNmUUErWTQKLS0tIHkwODdJMWQxVFFubUV5ZTFneDFS\ndURNay9hWk81QTI5QS9RWS9HVWhNelkK0GXmKGfL2cfsziBKu6pllmHRQno6K0FA\nzHky0yt2H1w1svDfFw2+FyKHfHAwaQs+X2qXXlvIZ7jwtPj+wQXubQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZzA4VEs3OEcrRk5VOWdM\nbVNjUXNkUGl3YTRCcHkzOUxna1kvWlJwYVhvCmIyS3k3QWhTdXh6cG9KbUEvVmJM\nNlNrVDFUSC9kU3dpdHJQU3paK1VMVjgKLS0tIHdQTU11TE42eGNsOVFhT1A3Mlln\nVVZrRy9udlhFaXNYWS9qd2FZYmRkeG8KDOai9pGX3gLSObePJ/E/+nJiPpqgkkjK\nGvJjKIb7LGdugIZ6h6HECwFcAbYl3UY/VWQL4YkqC5Yq0WqBx7svIA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoU1BqKy9HZnVrQ2ZudjBK\nWFVNQ0xPUHBOaFB2bEZvRVA0bEVQb1VYM3o0Ck95blBwckUxY3BZVkZZdHdINXlH\nYkZGdHNVQnE3ZmFja0xPaml1Y0tVWE0KLS0tIEVpNmlGanp6L1dRZGd1VVUxclZs\na3dBWmdIcFExbldFeW0zc2ZwRDVCckUKTjmYGY1RqzcijNepBd0wzDuWuywYN6oS\nQGVUhY1Tm2H+SUtIsnuNWkNsLC8LnDBIfx4DCWCYbLrC3HYmalpqPQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXbWJ2RzhjbXMzVVVxVG5K\nbzZGcnpCRUNtUzdHdHNaUHlicElhd281S1R3CitCMzdLbWtqUmpCTDVsOWtBTWxX\ndnRMQ0IzTEhPYjFyampzUm4xdFZBQmMKLS0tIEswRXdFSXdWa0FUMktiSkVYaXhF\nWDhZd3NzMkRZY1lLdWxoQlBuV1RaVFkKRdr7k3q2ftRwphuwXhXZnRKgI0EjpIXK\nZAlx1gnXRem30kPgBkdIVvtcS1EiQF402DUzFbDfiSCoTWtfyZJygQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2VEd0YkI2b2JLMDZ3THRV\naDVJYTRuMk0vS25OMmkwUE9KaVN2NTlkQ1NnCkxlMzNyNU1OQVE3S25OTm4rRTlD\nU0ZNaFRwWWRDdVJldWRFTWg0b3FJWmcKLS0tIG5tZDNoZUt6L2VoUjR3T001SEVG\nYThnQjZXcHV0NFduWDlXUGZ6Y3JRbW8K8t6TjUETVS0FPdoBmY1skyU8zzd0lHtk\nQw0W4A7mknt5s2yyRR+2awRGiW7NWlVRknHFrQuZwkO8wz3he3yNWQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1uSkVhWHRQ\nNUtvclEzaHYzRjVucGs5bEVKZXBhOUdGNUt2ZnVzaW5EbFUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpzcER2WjVzdkl1MFcxYmtvSHBXOERp\nOU9uTE40ZlVURXluQ1VrR0ZGd1ZBCi0tLSB2d0dhbGh2T29FenRQalk5QjdzRFRn\nTyt5UHptUndUWUdMdG85K2xxYnNVCiZEJdH+i+G9WkRgwE9KTWaDb/EGwXocn/dI\nvmMc/fXcGtA9RE29ym4dJxA2lOlmFMXR92S/cT7svZOkLoVorQI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhkYUIvdnRu\nYUd6ZlBSdUhBMzFZM2YyUXg2bWhzNUdlb0ZHWVJud2dtM2MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp6aDZBYXByZ043My9QTlIvRkp1RUxJ\nQ2QwYk9xdmRWeGNPN1RQTFpOVVlBCi0tLSBtRXNLYmkxdGZnc0tSdGptMDgvTXN2\nUjBkazlxbFFmZlFhVFhCZWkxZWxJCvKlVcCcatRxSpLPNSbWW1zXY/ZcitGVOMXi\nv4wYGqGRIMPtxSbehqN8XYnPjrbnUwpQo8yxs46SpjR0qd2Ecrc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnM2hxZFZleFI1OTVId3g3\nTXJCQ0NyMXZjbG9TUEN5OVRxdG5BcUJtTHhJCnZQbnB6Yk5MQTBKcHU5RjdoSFBv\nSDI4cmJpdmNKdDFoMStHYjNTckt1T00KLS0tIFY5bXhURlNwMUdtUGVtWmY1WXVE\ncktQTnN4MXFNc2hUaFJSZlZFMmNXOXMKvqXhj8TQGznCONlhqcdqBTvVxX9Uut4E\naj8c4NI49bbBJ0WNvcv+INWI4oP0Sht4WXn1KSa2gVwLgi4z4ZQr5A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaW9PelBoVzd6bWZLS080\nL2JWVndGeEtjZlhtWm5PZVNSWHpFZDZ1ZkM4CmZQWmkvVVZCaTBxZ2ZzYVl2a3Rt\na0toL00xZ08vNHJzbTJZaExNVXlUcEEKLS0tIDBzVjdBVEpvRzMvdkhkTzFsbnhr\nbGQxZzNYbDdmam9ySUVtVWNEbzRKZTgKkb9xV2KTfJB8Arj4ktjwggRxE0ZJT63z\nF/Dk0uHQHzUcNYEXVyCLz9C+TQpj297qbawQ1ZpVCw5N4EViqhe1qA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-30T02:42:06Z",

vars/per-machine/b4l/root-password/password-hash/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/b4l/root-password/password-hash/secret

@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:yrBL5S3EZfwsGstoEwUxWQ1uR6Vm2WwXSRdKvWKQi3uL213CyQg4SQtzKXY7oXAS3iejFZUJh4hkFdhv1y24QYKbmbIuPjFqYK52D/XpQPrvtrtmJ4USfTkHL9Vd30ubGkFUCxYJL9Cpwg==,iv:9nmEnMO8mqXpzJUfEjx17AMQDe+0deK7jokXpl0UHxQ=,tag:SPXYD3ERXCmfUN35G7KzUw==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvQURJQmZVRGhYOUovNmVl\nMW9vdk9Nem1LOGttQXFQMk04Vy91UWJkd1RNCndCemlzLzBra3BmTVdlRW9lV2xX\nWGFuL2FCS3BxK3B5OStMMGpndlBRNE0KLS0tIDBkYnVNa01IMjNoTzBTT0k4Y2hv\nd21NZFNMcHFwR0tQaHNTQTFVQjdHcUUKPM7bIpw2uUIahH+0LJOPg0BZ2d/x2jDK\nAm3pPnLl4W7z+kA6ReIa3B+/3XhYRv9t0YowfcFA+7dI9OldGoikBw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGREcXd2eU1q\nelA3aHVxWTVWVzNrYnFjUkJTQURJUXh3aUFNSnVLUTZ6M2sgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpseTNMOHVkMVQxcHEvcHUvTlY1YWlt\nY2ZTUEF0dFpBRjBxcHg5Y0RLVHVZCi0tLSB5eTJQRUdzQ1N1dzlVYWRUcm1jQit3\nV2V3SVZlOXRVRzJIa3FYVldtSjk0Cvxf9HS28JPObz3+y1+e9w1HueQCWri65BVh\n4R7MNNwjSJ6+Eha1tItQcyIiiI4hMcFJVbI6ReZVpJ24agTdOcQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1RnBEOXYyNzdlYXhVNkJY\nUDRHSEl5enhYNlY1d0tVRW9uWi9YVm5rVFdvCmkrWGdMTVJZRlc2YXY0ckZnMU4w\nNTN5NjB2cTVadWpvWjBmaUdSaXpjc00KLS0tIGVweTh0azhFVXhneC9tdWZ2OE5C\nS3Iyc0hSc2FsVyswczBzM2g1citxTjAKLiMWl5VYLIg6M3cSbR56lxXQMFptCqXS\ns9Jl/l/ew+J2onwBvxZy/mbZvQq2eVSXNlWJynBqDHRVT0pTAUQikg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlWUNEcnJlUXQ3eVYzY25L\nbTM2VzFRQ2IvVEVWQjRHOU0rVlRmelA1NmpjCmRLUnhHdGIzRUhjVzY2cXRxd2Ja\nWjV4QXpNSWM1cE9zNHhVSFZJcDZwNEEKLS0tIEpITE1uT2hwNnZSRk5lcXNVRHZo\nU3ZEb20wQzg0ODhSTHNhSnQwbkRORE0KHCUialMfX6t7z3GDyDnklSBpwlunXmLK\nVesI0CsuptsWyEaN6nYU0di1OfLDz7iWQWNw/tFAw++23g/GdjbfUQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLTUpFc1lzT3ZkY2RZYmg2\nUmNCbGtFdWVVaFJURjR1aXh2dmhPbklVanlrCkt4aDVRTlBOL3RQUHJHTDJhQjJ1\nbzVYbFh5ZEE3eExjdndYeFFoTXdSbDgKLS0tIG1SeHk4RE1TUjZucVFuaU0zWmM2\nNC9abU9INEdjcDZtcXhhSksxeDBleXcKTMH6P04s/2PxCRRc+Cb7QqtTMG9cIjaF\no6Ip1Uf0X4yJuSYTKkdMysJDaLYWusUu0KNXyTOouH0wjNZwAeytNg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuRURVY3pQQTJpTjFmcjVO\nRC95ZjdGM2dJQWx3bVpDSkYzYlBzNzRGc2tRClFBN1hKMVhGbUNSQXNxMzBqeW5O\nNHRpMVVYNk1GRk4zSml6aS9NV2laS0kKLS0tIHRzWTd1NWxPTHVJaDQxOHlaMFlu\nQ1BZZSswMy9IZkJkOG5EbGp4cWFhd3MKuC4crWCVb0Tjv5Ngp/KVzNSsl+ZweHbP\nGrubzZ+PjQ0o78WpF7r1fTWnHxIxxxu70DVOqDHhGqBJYvVfw0x9cg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0WnhNNCtpVXRRK3B3SzFk\nMG0yNGJXaUNMU1VXRUJIdnJzQTE4QXNzQ2tRCnFoRHZOeHFzTGx5TTVHcnNBYTJl\nbnc5T2xvWG1PYk9LYitSblFCaWNKanMKLS0tIEJjb045NU5lTTdqYUg2L2crTDNi\nZVJaM3BCSVMrb2FFS2x1eHF6a3lNZzAKxQkwSQevtxLWhusZoAY7DjHhkQUQpobu\nIqBzKyjiV0roL0w9H9wHU85FuIQ6N9W2UixvypG+LQLndsWmycZPtA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHY3WTE2ZVhm\nenFyWWlvcUwvdm5QZlp3UUlmSHJRM1lDdEVRRDFzUjR6QXcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBUXk3YUIrUnFraEVEMlBnK3k1a3l1\nSHpOWHM5K2lKRW9SbERDTHU1TG44Ci0tLSBoY2h1THNjRXNnQ2t3RXlsTVdVTGJS\nSDc2c3BQRXBleWp5TC9uWWhUc3h3Ct5mF7XcKzEk/MUO1QBFajmkr0iLWgC92Q3j\nnEbLpkbeBmzIVttWfKbjBuYeLcxL3v4e2+g1kVfNhxdoNwpmhsE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNNWGsyVGdq\nck9Sc3MrT3J3bmxzUmNUUy9ycmpwcHR6dHM3cDQreVBWSHcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpNc1VscFkrMVNENUh3L0k5d1VXZDNI\nd2tvY21yQSttVS9UYXk5ejZlQW1NCi0tLSBmY2luUUoyUzluUWJOYVh5Z0svNDBq\nZXpRS0IyTUhrWXlldGd0bFdLazVzCtHTDdfwnsMq1LrqQZOXnSTFvuYrBR6YwmPP\nZIuT0eoE+QF9fOeh6auVoJGVMs8FM10irnp+0Vno3KRoUu3jwXE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPZnhDOUxpeXc1TS9tYkJm\ndkNaTUVaNnM5bmNhZ0d3YjZ2SVRCWkdzK3hrCmpqWXFqRTZvSWMxV3V5Z0E0cVhU\nSktYakx4R3lJWXF5ZHllRTJLbEFDTWsKLS0tIHdvbVVTQXBub0xoVnJ6dSt6d1Bv\nL3BSSExoZUVFK1dTMnVMT00rUktIb2cK9kTBk4izlLQc67rdep89IedPALV0CQWP\nPKCOaPCD1MvSWI80thpzvAb+5ZxWP0ZFAE6tA4hktbVDv3Y4IRfTmg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0RzdiTFZPc3RLVmppRkIr\nSFlNZlFVRmNNU0JjMTJ2OXQwQmpGRG16a1FrClg4VlVUc2h0cE5zVlBTMWl2V0VV\nM1BYcnl6MEVFUjEwVE5xNnNEL0FGN1UKLS0tIGRZdTVoNFVwN0VpQ2c2UGpGcUkw\neWd2Q3k5cHZvSVhlVjkrcG91MTNlSVEKwu3rIsUwcyGS6xsFgM1zJz1qsJtdNisN\n4bTGA6ZxSrQYkgMZqOeS2Ka1PLH+3cvg7G4N5Z/hShyf0cjTMAexFg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T04:02:20Z",

vars/per-machine/b4l/root-password/password/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/b4l/root-password/password/secret

@@ -2,9 +2,41 @@
 	"data": "ENC[AES256_GCM,data:7zPJY5ubDS33FfryNbnEfrWeQDpom6I8QMbISAU=,iv:QqPnPb2yr4Sns1LL04Z0ADngbDSUPbOmaXcASafK7LU=,tag:7nI+ToEzaY26lCJEAr9x2g==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxUHB3NFd5YUNQa1ZrZHVj\nK0FoclZHNThUcy9WRU50QUE3aFpab0FyUmx3CldXU1BybkJDSzAxemZLdjRlNkts\nRUZkUzlmNFI1UzgyMmVhUitSSUNxNGcKLS0tIG40MGtMTUYwYXp4OTRld0xLQkNS\nalhSVWFDRmhRbnJWNUlWdEZRVGE0N2MKjhvfLFO+7W5QokrJI0Vq8zwcYWGJic8Q\n4FbDilsckWB76tAFEJiMvFNWLsVo7/2stncG3M74P+Ofb/QZZNfrrA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG96SlBBTjF5\nd3hISFV4Q3ZWd2pETmQwZExDMjAvM2dYYWo3TWdkTjFyazQgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp1UFlsU3pFMFVLTlhWdVU2MS9FTll0\nRHhWQlJxeEJDcG1BWXZqbTkrekpjCi0tLSB6R21kZWc4ZUFXVDhvMEM4bFExK2Yw\nNWprQXVRZHdsZlBQRjY2VGpKN2RRCpra4Ny0t+LGbVEzLXrVfa++ezfA6R1WqfvK\nalPzO2tYwGxHODsvffdOVay+GWz9jiUHB5rIx7ycv2hIZeGht20=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4NGVBV3pEYXB0dTJMdDAr\nM3p2Mk5FNVp3emNVSG5jeXRwZkhIQXNtY1M4CitpZkpsRVpiU0VlcjZkTDhYaTlL\nVG9MRWl2YW5NMStpL2tvdHFWc2x3bEUKLS0tIHFNMXhkUmRId1RJZTRxU2VUVGJK\nSS9lTWs1bmgxS1dadjlBV1JVNXpXTVEKUqHfVGQJsGCxkACDJdvgghKhGKo9MALv\nZ2IZ3kzDJ4pCFDIbhiYC+6iINdUQQJ5XUTKSLiBcPsBXrSaqnRSqwg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcXhCcE5BR1NrbkU0UU45\nRGF0Q2xvSkNoMzVubWdNWXE0QVhMbW5welZVCkdSTzl6MDhRY3o4blJuVnEzdmw3\nZGJld1JJNUhjMU16MlVFQzliR1dNVmcKLS0tIG9BdmpXeGE2TDEwWmphRjRRRWo3\nd1o1Qis2bTJhbmF3SXZOMHJGeURJNWMKK4Ro7QIApt108zraMDVUnHd3wPViukei\n4g+1Fy8pDxIRlrvuZn9nhplM0YH8gWXfpcFnZomIX4FiVF2b8t8/CA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRElwNlFtZ0FBWHp4Y3Qr\nVDV0V1B4a3l1U3creDBMbHNKWVQrRUMzbVhZClYxWUV2bndzZG8vdDdpOVJQMmZh\neERuKzB4Y0xDSXRtNEtjUytVR1h5RVEKLS0tIEhMTk0yVjV0N0p5V09KZk1hRGx4\nSS9RM1kxQXN6NUtLTTM4TVlsUkVxUzAKuMiyMlIdcpYg/KrKK9XAdcEvKPbplBFf\nJVA2eoTlQsxDnR0Y13YeoDXp+fq2FslB5CU0KCDYetSnvuyPBkN4rQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqekl1RndGM0Exb29YekZV\nMDJXRStXV25Vd01qZk5hMnE5UGpjSDBuZ0RNCjZtSXRWWFdmVDZtclQ2U3ZqbWJD\nNHk0eXJLN2tVaENxbXVYK3d6S1lVOTQKLS0tIG1yR01md2lUT3F3dCtVbTErejFQ\nTUVZS09Fcmp0QzcvMmUvRFZiaFVHREEKafj5XAx7v7SsJJOgw8C1/TAYt+tb3z7n\n3vQ7ebsXSBKfDEI283w1tu91rQklKk21RfilSBUpC8J2vnXejuPvEA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDgxQjRkMmZ2\naFgzNFk1L0NJcHhrSndrdEF0bkN3S2NhT0VYTWdqTFVZUzggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3ZjZ3RnhMVWQ0QXN2b2t2YllOeVg3\nOUZWQWZCTUR2K0VmRllxNElhU0c4Ci0tLSBINFJGcHVQN09mOTlXcDBQR0lGQis2\nczJVNFJEaTZtNXQxZlJwaHZEOTc4CnNookjAFy/zPxEZF9RoWXs6SH1w98SnquxC\n3KDqNeA1JZkeKFOY3lsSkpUIkRuq8AdbXxVa890ejUYLYkU/jr0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9qS3ljOXJJ\nUlNDRUJkWktIckg4T2tuS1VRS1BVd3d4cloxb1kvbUxrbkEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpSRkFabkhYRm9HTnNUUXorWHNHZTNV\nalQ1U0l5MXJ6L0hjbXdqdmVmRjdNCi0tLSBSRkw5eDNDT3NTSXNlT1NZVFFJVkND\ndG5DNzNFc29iQmNOc1ZLYklObWlZCkyPPZko4pJqOTW1uWDMbyNsVIyKZmNy4Mz1\n66fWH4Q+rZhwah8VNb1eSCXYvSj2ZyM+/yvN4JQMHhfVcWLWYgQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEMi9uSnlJbW1HZlNnSEpv\nMjhneEk5dm9IcHIxZjVuNWR0MnVWbURCWWtzCk41dE44VVBJWTJCUTFEY0ZlS3oz\nekVFeEhzakJjaUhMVVlGc0JselZNa0UKLS0tIGdManZCdkZ5OU54R2pJZlhWTGlN\nZzF1QjVyK3pCeld6NldTRkxVN1VYRDQKMHRLCQdf1Rlwdb2APiZrJpYZok7KnBeH\nGazo6O1ahtOSAs+mFHSYBMwik99Ss1YBVSGsRm1Iu3vGIn4fEzXCvA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4S0I0UFl1R29la0ZuMFJD\nb2ZLREVlZ3Z0UDRZbGtwWmJsTHhXUXJqbENzCmthdEM4S2g4K1pxOXh3WVd3czFj\nVStCS2JKMk9XZ2NtelZMMDBWRUFya0UKLS0tIDhkSWo4WStRSWpxalFoTUs1UmVZ\nanBtcXJoM0FGaDNYZ3lPUGovcEZNM0EKbhP5BR7wntLaFHayF4Phyj5LN5mllda3\nSDptf8ivTxxec6WFBDnX5WTWdb2UAdpTR7/eLJkMMGeSMa7+Gqn9FQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T04:02:20Z",