fix think-backend upload and get avartar image

dunno how to reliably ensure the mpd service is ordered after each
binds_to address is bound (& so bind(3)able)

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764792743,
+        "lastModified": 1766984802,
-        "narHash": "sha256-MbbiNG/bhqe+4z7ml8TefIs4swSonmiV0CimCntXuCg=",
+        "narHash": "sha256-SYZ/MXVtJEb3sRWxvPL/2HtpSL1CzQgu1o8ASXqCO98=",
         "ref": "refs/heads/main",
-        "rev": "ddc0f9fabf33ad000676a33e97be6b5df12a4560",
+        "rev": "052b66d8dc724c3e519b9003281c2f9a210fc380",
-        "revCount": 11417,
+        "revCount": 11770,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -49,11 +49,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762942435,
+        "lastModified": 1766977667,
-        "narHash": "sha256-zIWGs5FIytTtJN+dhDb8Yx+q4TQI/yczuL539yVcyPE=",
+        "narHash": "sha256-LUALgG4ZpsA0k7pGYzMDto/r6T8aIPlYTok3lGlojjA=",
-        "rev": "0ee328404b12c65e8106bde9e9fab8abf4ecada4",
+        "rev": "3f852546b5d8bd2e9659a81c6b2cc14922e63a94",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0ee328404b12c65e8106bde9e9fab8abf4ecada4.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/3f852546b5d8bd2e9659a81c6b2cc14922e63a94.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764627417,
+        "lastModified": 1766150702,
-        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
+        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
+        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
         "type": "github"
       },
       "original": {
@@ -121,6 +121,26 @@
         "type": "github"
       }
     },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768068402,
+        "narHash": "sha256-bAXnnJZKJiF7Xr6eNW6+PhBf1lg2P1aFUO9+xgWkXfA=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "8bc5473b6bc2b6e1529a9c4040411e1199c43b4c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "import-tree": {
       "locked": {
         "lastModified": 1752730890,
@@ -162,11 +182,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764161084,
+        "lastModified": 1766784396,
-        "narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
+        "narHash": "sha256-rIlgatT0JtwxsEpzq+UrrIJCRfVAXgbYPzose1DmAcM=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "e95de00a471d07435e0527ff4db092c84998698e",
+        "rev": "f0c8e1f6feb562b5db09cee9fb566a2f989e6b55",
         "type": "github"
       },
       "original": {
@@ -190,11 +210,11 @@
     },
     "nixos-facter-modules": {
       "locked": {
-        "lastModified": 1764252389,
+        "lastModified": 1766558141,
-        "narHash": "sha256-3bbuneTKZBkYXlm0bE36kUjiDsasoIC1GWBw/UEJ9T4=",
+        "narHash": "sha256-Ud9v49ZPsoDBFuyJSQ2Mpw1ZgAH/aMwUwwzrVoetNus=",
         "owner": "nix-community",
         "repo": "nixos-facter-modules",
-        "rev": "5ea68886d95218646d11d3551a476d458df00778",
+        "rev": "e796d536e3d83de74267069e179dc620a608ed7d",
         "type": "github"
       },
       "original": {
@@ -205,11 +225,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761656231,
+        "lastModified": 1768395095,
-        "narHash": "sha256-krgZxGAIIIKFJS+UB0l8do3sYUDWJc75M72tepmVMzE=",
+        "narHash": "sha256-ZhuYJbwbZT32QA95tSkXd9zXHcdZj90EzHpEXBMabaw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d7f52a7a640bc54c7bb414cca603835bf8dd4b10",
+        "rev": "13868c071cc73a5e9f610c47d7bb08e5da64fdd5",
         "type": "github"
       },
       "original": {
@@ -224,6 +244,7 @@
         "clan-core": "clan-core",
         "devshell": "devshell",
         "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
         "import-tree": "import-tree",
         "liminix": "liminix",
         "nixpkgs": "nixpkgs",
@@ -238,11 +259,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764483358,
+        "lastModified": 1766894905,
-        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
         "type": "github"
       },
       "original": {

flake.nix

@@ -15,6 +15,10 @@
       inputs.nixpkgs-lib.follows = "nixpkgs";
       url = "github:hercules-ci/flake-parts";
     };
+    home-manager = {
+      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
+    };
     import-tree.url = "github:vic/import-tree";
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     treefmt-nix = {
@@ -44,9 +48,25 @@
           ./machines
           ./routers
           ./inventories
+          ./overlays
+          ./tests
           ./modules/clan/flake-module.nix
           ./modules/nixos/flake-module.nix
         ];
+        perSystem =
+          { pkgs, system, ... }:
+          {
+            _module.args.pkgs = import inputs.nixpkgs {
+              inherit system;
+              overlays = [
+                inputs.self.overlays.packagesOverlay
+              ];
+              config = { };
+            };
+            packages.think = pkgs.think-gtcm;
+            packages.think-be = pkgs.think-backend-gtcm;
+            packages.file-uploader = pkgs.gtcm-file-uploader;
+          };
       }
     );
 }

inventories/default.nix

@@ -1,4 +1,5 @@
 {
+  imports = [ ./personal-computer.nix ];
   clan = {
     inventory = {
 
@@ -11,10 +12,16 @@
         b4l = [
           "rigel"
           "neptune"
+          "rana"
         ];
         phonebox = [
           "neptune"
           "rigel"
+          "almach"
+          "alpheratz"
+          "mirach"
+          "adhil"
+          "buna"
         ];
       };
 
@@ -101,11 +108,8 @@
             input = "self";
           };
           roles.default.tags."phonebox" = { };
-          roles.default.machines.rigel.settings = {
+          roles.default.machines."adhil".settings = {
-            ata-ethernet-iface = "enp2s0";
+            ata-ethernet-iface = "end0";
-          };
-          roles.default.machines.neptune.settings = {
-            ata-ethernet-iface = "enp2s0";
           };
         };
 
@@ -158,13 +162,6 @@
           };
           roles.default.machines.b4l = { };
         };
-        pingvin = {
-          module = {
-            name = "pingvin";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
         paperless = {
           module = {
             name = "paperless";
@@ -172,6 +169,80 @@
           };
           roles.default.machines.b4l = { };
         };
+        pulse-stream = {
+          module = {
+            name = "pulse-stream";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.client-ip-ranges = [
+              "10.0.0.0/24"
+            ];
+          };
+        };
+        jukebox = {
+          module = {
+            name = "jukebox";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings = {
+              binds = [ "wlp1s0" ];
+              disks.m3 = {
+                uuid = "105D-319E";
+                mountOptions = [ "utf8" ];
+              };
+            };
+          };
+        };
+        git-daemon = {
+          module = {
+            name = "git-daemon";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.repositories =
+              let
+                defaults = rec {
+                  write-access = [
+                    "10.0.0.0/24"
+                    "200:d7b1:c5d5:ea7:27ad:6837:40f6:404d/128"
+                  ];
+                  read-access = write-access;
+                };
+                PUBLIC = {
+                  read-access = [
+                    "10.0.0.0/24"
+                    "0200::/7"
+                  ];
+                };
+              in
+              builtins.mapAttrs (_: override: defaults // override) {
+                "9e" = PUBLIC;
+                archive-dl = { };
+                barrytown = { };
+                cleanroom = PUBLIC;
+                community-memory = { };
+                eris = { };
+                ftdi-sd-spi = { };
+                go-go-gadget = { };
+                hacking-the-kindle = { };
+                islands = PUBLIC;
+                kt = { };
+                legba = { };
+                llb = PUBLIC;
+                llc = PUBLIC;
+                lora = { };
+                mute = { };
+                navi = { };
+                notmuch-memoryhole = PUBLIC;
+                pms5003 = { };
+                thinc = PUBLIC;
+                toad = { };
+                yggdrasil-erlang = { };
+              };
+          };
+        };
       };
     };
   };

inventories/personal-computer.nix

@@ -0,0 +1,37 @@
+{
+  clan.inventory = {
+    tags = {
+      kde-desktop = [ "rana" ];
+      personal-computer = [ "rana" ];
+    };
+
+    instances = {
+      emmie-home = {
+        module = {
+          name = "home-user";
+          input = "self";
+        };
+        roles.default.settings = {
+          username = "emmie";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
+        roles.default.machines."rana" = { };
+      };
+      personal-computer = {
+        module = {
+          name = "personal-computer";
+          input = "self";
+        };
+        roles.default.tags."personal-computer" = { };
+      };
+      kde = {
+        module = {
+          name = "kde";
+          input = "clan-core";
+        };
+        roles.default.tags."kde-desktop" = { };
+      };
+    };
+  };
+}

inventory.json

@@ -14,6 +14,15 @@
     },
     "neptune": {
       "installedAt": 1762147067
+    },
+    "adhil": {
+      "installedAt": 1765277591
+    },
+    "buna": {
+      "installedAt": 1765343708
+    },
+    "rana": {
+      "installedAt": 1768294839
     }
   }
 }

machines/adhil/configuration.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "aarch64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.core.settings.name = "adhil";
+  # clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
+
+}

machines/adhil/disko.nix

@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-SD64G_0xfb330ff6";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/almach/configuration.nix

@@ -7,7 +7,7 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   # clan.core.networking.targetHost = "root@";
 
-  clan.meta.name = "almach";
+  clan.core.settings.name = "almach";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
 
 }

machines/alpheratz/configuration.nix

@@ -7,7 +7,7 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   # clan.core.networking.targetHost = "root@";
 
-  clan.meta.name = "alpheratz";
+  clan.core.settings.name = "alpheratz";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
 
 }

machines/b4l/configuration.nix

@@ -19,4 +19,18 @@
   services.nginx.virtualHosts."${config.networking.fqdn}" = {
     enableACME = true;
   };
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
 }

machines/b4l/services/nextcloud.nix

@@ -19,7 +19,7 @@ in
 
   services.nextcloud = {
     hostName = ncDomain;
-    package = pkgs.nextcloud31;
+    package = pkgs.nextcloud32;
 
     settings = {
 

machines/b4l/services/pingvin.nix

@@ -1,45 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-let
-  serviceName = "${config.networking.hostName}-pingvin";
-  domain-name = "${
-    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
-  }.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators."${serviceName}" = {
-    files = {
-      subdomain.secret = false;
-    };
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Pingvin. Default:(share)";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "share" > "$out"/subdomain
-      fi
-    '';
-  };
-
-  services.pingvin-share = {
-    nginx.enable = true;
-    https = true;
-    hostname = domain-name;
-  };
-}

machines/buna/configuration.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.core.settings.name = "buna";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
+
+}

machines/buna/disko.nix

@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/usb-Generic_MassStorageClass_000000001539-0:0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/mirach/configuration.nix

@@ -7,7 +7,7 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   # clan.core.networking.targetHost = "root@";
 
-  clan.meta.name = "mirach";
+  clan.core.settings.name = "mirach";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
 
 }

machines/neptune/configuration.nix

@@ -1,4 +1,9 @@
-{ inputs, config, ... }:
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
 {
   nixpkgs.hostPlatform = {
     system = "x86_64-linux";
@@ -7,7 +12,51 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 
-  clan.meta.name = "neptune";
+  networking.interfaces.enx00e04c106368.useDHCP = true; # recovery
-  clan.meta.description = "Radxa SBC board for testing.";
+
+  clan.core.vars.generators.wireless-credentials = {
+    files = {
+      essid.secret = false;
+      psk.secret = true;
+    };
+    prompts = {
+      essid.persist = true;
+      psk.persist = true;
+    };
+    script = ''
+      cat "$prompts"/essid > $out/essid
+      prompt_psk=$(cat "$prompts"/psk)
+      echo "psk=$prompt_psk" > $out/psk
+    '';
+  };
+
+  networking.wireless =
+    let
+      credentials = config.clan.core.vars.generators.wireless-credentials.files;
+    in
+    {
+      enable = true;
+      secretsFile = credentials.psk.path;
+      networks.${credentials.essid.value}.pskRaw = "ext:psk";
+    };
+
+  networking.interfaces.wlp1s0 = {
+    useDHCP = false;
+    ipv4.addresses = [
+      {
+        address = "10.0.0.9";
+        prefixLength = 24;
+      }
+    ];
+  };
+
+  services.yggdrasil.settings.Peers = lib.mkForce [
+    "tcp://newt.barry.town:1337"
+    "tls://yg-hkg.magicum.net:32333"
+    "tls://astrra.space:55535"
+  ];
+
+  clan.core.settings.name = "neptune";
+  # clan.meta.description = "Radxa SBC board for testing. (With vi)";
 
 }

machines/ramus/configuration.nix

@@ -1,15 +1,35 @@
-{ config, ... }:
+{ self, config, ... }:
 {
   system.stateVersion = "25.11";
   nixpkgs.hostPlatform = {
     system = "x86_64-linux";
   };
 
-  clan.meta.name = "ramus";
+  clan.core.settings.name = "ramus";
-  clan.meta.description = ''
+  # clan.meta.description = ''
-    A Hetzner VPS machine own by Alex.
+  #   A Hetzner VPS machine own by Alex.
-  '';
+  # '';
 
   clan.core.sops.defaultGroups = [ "admins" ];
   clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
+
+  users.users.nginx.extraGroups = [ "acme" ];
+
+  security.acme.acceptTerms = true;
+
+  imports = [ ./think-greater-chiangmai.nix ];
 }

machines/ramus/think-greater-chiangmai.nix

@@ -0,0 +1,139 @@
+{ self, config, ... }:
+let
+  commonSettings = rec {
+    APP_NAME = "Laravel";
+    APP_ENV = "local";
+    APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
+    APP_DEBUG = "false";
+    APP_URL = "http://localhost";
+
+    DB_CONNECTION = "mysql";
+    DB_HOST = "localhost";
+    DB_PORT = 3306;
+    DB_DATABASE = "thinkgtcm";
+    DB_USERNAME = "gtcm";
+
+    R2_SCHEMA_URL = "https://${R2_BUCKET}.${R2_REGION}.your-objectstorage.com/test-large-files/";
+    R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
+    R2_SECRET_ACCESS_KEY._secret =
+      config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
+    R2_REGION = config.clan.core.vars.generators.greaterchiangmai-s3.files.region.value;
+    R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
+    R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;
+
+    R2_BUCKET_NAME = R2_BUCKET;
+
+    LOG_CHANNEL = "stack";
+    LOG_LEVEL = "debug";
+
+    FILESYSTEM_DISK = "local";
+
+    BROADCAST_DRIVER = "log";
+    CACHE_DRIVER = "file";
+    QUEUE_CONNECTION = "sync";
+    SESSION_DRIVER = "file";
+    SESSION_LIFETIME = 120;
+
+    MEMCACHED_HOST = "127.0.0.1";
+
+    REDIS_HOST = "127.0.0.1";
+    REDIS_PORT = 6379;
+
+    UPLOAD_MAX_FILESIZE = "5000M";
+    POST_MAX_SIZE = "5000M";
+
+    TEST_LOCAL = true;
+  };
+
+  baseDomain = "greaterchiangmai.com";
+  domain = "think.${baseDomain}";
+  domainBackend = "think-backend.${baseDomain}";
+in
+{
+  imports = [
+    self.nixosModules.think-gtcm
+    self.nixosModules.think-backend-gtcm
+  ];
+  nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+
+  clan.core.vars.generators.greaterchiangmai = {
+    files = {
+      app_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+    };
+
+    prompts = {
+      app_key.persist = true;
+    };
+
+    script = ''
+      cat $prompts/app_key > $out/app_key
+    '';
+  };
+
+  clan.core.vars.generators.greaterchiangmai-s3 = {
+    files = {
+      access_key_id.secret = false;
+      secret_access_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+      endpoint.secret = false;
+      region.secret = false;
+      bucket.secret = false;
+    };
+
+    prompts = {
+      access_key_id.persist = true;
+      secret_access_key.persist = true;
+      endpoint.persist = true;
+      region.persist = true;
+      bucket.persist = true;
+    };
+
+    script = ''
+      cat $prompts/access_key_id > $out/access_key_id
+      cat $prompts/secret_access_key > $out/secret_access_key
+      cat $prompts/endpoint > $out/endpoint
+      cat $prompts/region > $out/region
+      cat $prompts/bucket > $out/bucket
+    '';
+  };
+
+  services.think-greaterchiangmai = {
+    enable = true;
+    domain = domain;
+    settings = commonSettings;
+  };
+  services.think-backend-greaterchiangmai = {
+    enable = true;
+    domain = domainBackend;
+    settings = commonSettings;
+  };
+
+  security.acme.certs = {
+    "${domain}" = {
+      email = config.clan.core.vars.generators.acme.files.email.value;
+      webroot = "/var/lib/acme/acme-challenge/${domain}";
+    };
+    "${domainBackend}" = {
+      email = config.clan.core.vars.generators.acme.files.email.value;
+      webroot = "/var/lib/acme/acme-challenge/${domainBackend}";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    useACMEHost = domain;
+    acmeRoot = config.security.acme.certs.${domain}.webroot;
+  };
+  services.nginx.virtualHosts.${domainBackend} = {
+    forceSSL = true;
+    useACMEHost = domainBackend;
+    acmeRoot = config.security.acme.certs.${domainBackend}.webroot;
+  };
+}

machines/rana/configuration.nix

@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}

machines/rana/disko.nix

@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/nvme-SAMSUNG_MZVL81T0HFLB-00BLL_S7XKNF0Y966645";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/sirius/configuration.nix

@@ -19,7 +19,6 @@
     system = "x86_64-linux";
   };
 
-  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
   system.stateVersion = "25.11";
 
 }

modules/clan/actual-budget/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "actual-budget";
   manifest.description = "A local-first personal finance app ";
+  manifest.readme = "A local-first personal finance app";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "A default server role.";
 
     perInstance.nixosModule =
       {

modules/clan/git-daemon/default.nix

@@ -0,0 +1,174 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "git-daemon";
+  manifest.description = "a really simple server for git repositories";
+  manifest.readme = "a really simple server for git repositories";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options = with lib; {
+          directory = lib.mkOption {
+            type = types.str;
+            default = "/var/git";
+          };
+          repositories = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      read-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                      write-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            pkgs,
+            lib,
+            config,
+            ...
+          }:
+          {
+            systemd.services.git-init = {
+              serviceConfig = {
+                Type = "oneshot";
+                User = config.services.gitDaemon.user;
+                Group = config.services.gitDaemon.group;
+                ExecStartPre = toString [
+                  "+${pkgs.coreutils}/bin/install"
+                  "--directory"
+                  "--owner=${config.services.gitDaemon.user}"
+                  "--group=${config.services.gitDaemon.group}"
+                  "--mode=0750"
+                  settings.directory
+                ];
+                ExecStart =
+                  let
+                    git-template = pkgs.stdenv.mkDerivation {
+                      name = "git-template";
+                      buildCommand = ''
+                        cp --no-preserve=mode,ownership --recursive \
+                          ${pkgs.git}/share/git-core/templates $out
+                        install -m550 $out/hooks/post-update{.sample,}
+                      '';
+                    };
+                    init-script =
+                      { name, ... }:
+                      pkgs.writeShellScript "git-init-${name}" ''
+                        ${pkgs.git}/bin/git init \
+                          --bare --template=${git-template} --shared=0660 \
+                          ${settings.directory}/${name}.git
+                        ${pkgs.git}/bin/git \
+                          -C ${settings.directory}/${name}.git \
+                          config set receive.denyNonFastforwards false
+                      '';
+                  in
+                  map init-script (lib.attrValues settings.repositories);
+              };
+            };
+
+            services.gitDaemon = {
+              enable = true;
+              user = "git";
+              group = "git";
+              options =
+                let
+                  firewall = pkgs.writeText "git-daemon-firewall.json" (
+                    builtins.toJSON (builtins.attrValues settings.repositories)
+                  );
+                  hook = pkgs.writers.writePython3 "hook.py" { flakeIgnore = [ "E" ]; } ''
+                    import os, sys, enum, pathlib, ipaddress, json
+
+                    class Service(enum.Enum):
+                        UploadPack = enum.auto()
+                        ReceivePack = enum.auto()
+                        UploadArchive = enum.auto()
+
+                        @classmethod
+                        def parse(cls, string):
+                            return {
+                                'upload-pack': cls.UploadPack,
+                                'receive-pack': cls.ReceivePack,
+                                'upload-archive': cls.UploadArchive
+                            }[string]
+
+                        @property
+                        def service(self):
+                            return {
+                                UploadPack: 'read-access',
+                                ReceivePack: 'write-access'
+                            }[self]
+                    UploadPack = Service.UploadPack
+                    ReceivePack = Service.ReceivePack
+
+                    def parse_remote_addr(remote_addr):
+                        if remote_addr.startswith('[') and remote_addr.endswith(']'):
+                            return ipaddress.ip_address(remote_addr[1:-1])
+                        return ipaddress.ip_address(remote_addr)
+
+                    service = Service.parse(sys.argv[1])
+                    repo = pathlib.Path(sys.argv[2]).stem
+                    client = parse_remote_addr(os.environ['REMOTE_ADDR'])
+
+                    with open("${firewall}", 'r') as f:
+                        firewall = json.load(f)
+
+                    for rule in firewall:
+                        if rule["name"] == repo:
+                           for network in rule[service.service]:
+                               if client in ipaddress.ip_network(network):
+                                   sys.exit(0)
+                    print('stairway denied')
+                    sys.exit(1)
+                  '';
+                in
+                toString [
+                  "--enable=upload-pack"
+                  "--enable=receive-pack"
+                  "--disable=upload-archive"
+                  "--access-hook=${hook}"
+                  "--informative-errors"
+                ];
+              exportAll = true;
+              basePath = settings.directory;
+            };
+
+            systemd.services.git-daemon = {
+              requires = [ "git-init.service" ];
+              after = [ "git-init.service" ];
+            };
+
+            networking.firewall.allowedTCPPorts = [ 9418 ];
+          };
+      };
+  };
+}

modules/clan/git-daemon/flake-module.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    git-daemon = module;
+  };
+}

modules/clan/grafana/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "grafana";
   manifest.description = "Platform for data analytics and monitoring";
+  manifest.readme = "Platform for data analytics and monitoring";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "A default server role";
 
     perInstance.nixosModule =
       {

modules/clan/home-profiles/flake-module.nix

@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    home-user = lib.modules.importApply ./home-user { };
+  };
+}

modules/clan/home-profiles/home-user/default.nix

@@ -0,0 +1,64 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "common-user-home-manager";
+  manifest.description = "General users' home-manager profile generator";
+  manifest.readme = "General users' home-manager profile generator";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default role for the user";
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          username = lib.mkOption {
+            type = lib.types.str;
+          };
+          kbLayout = lib.mkOption {
+            type = lib.types.str;
+            default = "us";
+          };
+          kbOptions = lib.mkOption {
+            type = lib.types.str;
+            default = "grp:win_space_toggle";
+          };
+        };
+      };
+    perInstance =
+      { settings, ... }:
+      {
+        nixosModule =
+          { inputs, ... }:
+          let
+            username = settings.username;
+          in
+          {
+            imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+            users.users.${username} = {
+              initialPassword = "";
+              isNormalUser = true;
+              extraGroups = [
+                "audio"
+                "video"
+                "networkmanager"
+              ];
+            };
+
+            services.xserver = {
+              enable = true;
+              xkb.layout = settings.kbLayout;
+              xkb.options = settings.kbOptions;
+            };
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.${username} = ./home.nix;
+            home-manager.extraSpecialArgs = {
+              inherit inputs username;
+            };
+          };
+      };
+  };
+}

modules/clan/home-profiles/home-user/home.nix

@@ -0,0 +1,24 @@
+{
+  osConfig,
+  pkgs,
+  lib,
+  username,
+  ...
+}:
+{
+  home = {
+    inherit username;
+    homeDirectory = lib.mkForce "/home/${username}";
+    stateVersion = osConfig.system.stateVersion;
+    packages = with pkgs; [
+      libreoffice
+      element-desktop
+      brave
+      firefox
+      keepassxc
+      vlc
+      thunderbird
+    ];
+  };
+  programs.home-manager.enable = true;
+}

modules/clan/jukebox/default.nix

@@ -0,0 +1,138 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "jukebox";
+  manifest.description = "mpd server, library on removable disks";
+  manifest.readme = "mpd server, library on removable disks";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          baseDir = lib.mkOption {
+            type = lib.types.str;
+            default = "/mnt/jukebox";
+          };
+          binds = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = [ ];
+          };
+          disks = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      uuid = lib.mkOption {
+                        type = str;
+                      };
+                      mountOptions = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+            description = "disks comprising library";
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            services.pulseaudio.enable = true;
+
+            # workaround cookie permissions
+            services.pulseaudio.tcp.enable = true;
+            services.pulseaudio.tcp.anonymousClients = {
+              allowedIpRanges = [ "127.0.0.1" ];
+              allowAll = true;
+            };
+
+            systemd.tmpfiles.rules = [
+              "d ${settings.baseDir} 0755 root root"
+            ];
+
+            fileSystems =
+              let
+                disk2fs =
+                  {
+                    name,
+                    uuid,
+                    mountOptions,
+                    ...
+                  }:
+                  lib.nameValuePair "${settings.baseDir}/${name}" {
+                    device = "/dev/disk/by-uuid/${uuid}";
+                    fsType = "auto";
+                    options = [
+                      "noauto"
+                      "nofail"
+                    ]
+                    ++ mountOptions;
+                  };
+              in
+              lib.listToAttrs (lib.mapAttrsToList (_: disk2fs) settings.disks);
+
+            services.udev.extraRules =
+              let
+                translate-prefix = path: (lib.removePrefix "-" (lib.replaceStrings [ "/" ] [ "-" ] path));
+                mount-name = name: "${translate-prefix settings.baseDir}-${name}.mount";
+                disk2rule =
+                  { name, uuid, ... }:
+                  lib.concatStringsSep ", " [
+                    ''ACTION=="add"''
+                    ''SUBSYSTEM=="block"''
+                    ''ENV{DEVLINKS}=="*/dev/disk/by-uuid/${uuid}*"''
+                    ''ENV{SYSTEMD_WANTS}="${mount-name name}"''
+                  ];
+              in
+              lib.concatMapStringsSep "\n" disk2rule (lib.attrValues settings.disks);
+
+            services.mpd = {
+              enable = true;
+              openFirewall = true;
+              settings = {
+                bind_to_address = "any";
+                music_directory = settings.baseDir;
+                audio_output = [
+                  {
+                    type = "pulse";
+                    name = "jukebox";
+                    server = "localhost";
+                  }
+                ];
+              };
+            };
+
+            networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
+              allowedTCPPorts = [ config.services.mpd.settings.port ];
+            });
+
+            environment.systemPackages = [ pkgs.mpc ];
+          };
+      };
+  };
+}

modules/clan/jukebox/flake-module.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    jukebox = module;
+  };
+}

modules/clan/nextcloud/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "nextcloud";
   manifest.description = "Nextcloud server, a safe home for all your data";
+  manifest.readme = "Nextcloud server, a safe home for all your data";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
 
     perInstance.nixosModule =
       {

modules/clan/paperless/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "paperless";
   manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.readme = "A community-supported supercharged document management system: scan, index and archive all your documents";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
 
     perInstance.nixosModule =
       {

modules/clan/personal-computer/automatic-timezone.nix

@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  services.automatic-timezoned.enable = true;
+  services.geoclue2 = {
+    enableDemoAgent = lib.mkForce true;
+    geoProviderUrl = "https://beacondb.net/v1/geolocate";
+  };
+}

modules/clan/personal-computer/default.nix

@@ -0,0 +1,21 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "personal-computer";
+  manifest.description = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.readme = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "an only one default role";
+    perInstance.nixosModule =
+      { inputs, lib, ... }:
+      {
+        imports = [
+          (inputs.import-tree.initFilter (
+            p: !lib.hasSuffix "default.nix" p && !lib.hasSuffix "flake-module.nix" p
+          ) ./.)
+        ];
+      };
+  };
+}

modules/clan/personal-computer/desktop-environment.nix

@@ -0,0 +1,4 @@
+{ config, ... }:
+{
+  security.pam.services."sddm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+}

modules/clan/personal-computer/flake-module.nix

@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    personal-computer = lib.modules.importApply ./default.nix { };
+  };
+}

modules/clan/personal-computer/libinput.nix

@@ -0,0 +1,11 @@
+{
+  services = {
+    libinput = {
+      enable = true;
+      touchpad = {
+        disableWhileTyping = true;
+        naturalScrolling = true;
+      };
+    };
+  };
+}

modules/clan/personal-computer/printing.nix

@@ -0,0 +1,62 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  allowManageGroups = [
+    "root"
+    "wheel"
+    "lpadmin"
+  ];
+  polkitAllowGroups = builtins.concatStringsSep "||" (
+    builtins.map (group: ''subject.isInGroup("${group}")'') allowManageGroups
+  );
+
+  printerMember = lib.map (user: user.name) (
+    lib.attrsets.attrsToList (
+      lib.attrsets.filterAttrs (name: value: value.isNormalUser) config.users.users
+    )
+  );
+
+in
+{
+  services.printing = {
+    enable = true;
+    drivers = [
+      pkgs.brlaser
+      pkgs.gutenprint
+    ];
+
+    extraFilesConf = ''
+      SystemGroup ${builtins.concatStringsSep " " allowManageGroups}
+    '';
+  };
+
+  security.polkit = {
+    enable = true;
+
+    extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        var actionMatchs = (
+          action.id.indexOf('org.opensuse.cupspkhelper.mechanism.') === 0
+        );
+        if (actionMatchs) {
+          if (${polkitAllowGroups}) {
+            return polkit.Result.YES
+          }
+        }
+      });
+    '';
+  };
+
+  hardware.sane = {
+    enable = true;
+  };
+
+  users.groups.lpadmin.members = printerMember;
+  users.groups.lp.members = printerMember;
+  users.groups.scanner.members = printerMember;
+
+}

modules/clan/personal-computer/users.nix

@@ -0,0 +1,11 @@
+{ lib, ... }:
+{
+  users.mutableUsers = lib.mkForce true;
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if ((action.id == "org.freedesktop.accounts.change-own-password")) {
+        return polkit.Result.AUTH_SELF;
+      }
+    });
+  '';
+}

modules/clan/personal-computer/wireless.nix

@@ -0,0 +1,4 @@
+{
+  networking.networkmanager.enable = true;
+  hardware.bluetooth.enable = true;
+}

modules/clan/phonebox/default.nix

@@ -1,17 +1,28 @@
-{ clanLib, ... }:
+{
+  clanLib,
+  ...
+}:
 {
   _class = "clan.service";
   manifest.name = "phonebox";
-  manifest.description = "";
+  manifest.description = "A peer to peer phone relay network built on top of yggdrasil.";
+  manifest.readme = "A peer to peer phone relay network built on top of yggdrasil.";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     interface =
       { lib, ... }:
       {
         options.ata-ethernet-iface = lib.mkOption {
           type = lib.types.str;
           description = "An Ethernet interface that connect to ATA box.";
+          default = "enp2s0";
+        };
+        options.ownerName = lib.mkOption {
+          type = lib.types.str;
+          description = "";
+          default = "";
         };
       };
     perInstance =
@@ -21,18 +32,70 @@
         ...
       }:
       {
+
         nixosModule =
           {
             lib,
             config,
+            pkgs,
             ...
           }:
           let
+            asterisk = pkgs.asterisk.overrideAttrs (old: {
+              propagatedNativeBuildInputs = [ pkgs.spandsp3 ];
+            });
+
+            machines = lib.attrNames roles.default.machines;
+
             user = "asterisk";
+            faxDir = "/run/asterisk/fax";
             rtpPortFrom = 10000;
             rtpPortTo = 20000;
             ata-interface = settings.ata-ethernet-iface;
 
+            contactList = builtins.map (machineName: {
+              name = "${clanLib.getPublicValue {
+                flake = config.clan.core.settings.directory;
+                machine = machineName;
+                generator = "phonebox";
+                file = "owner-name";
+                default = null;
+              }}";
+              number = "${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "server-prefix-number";
+                  default = null;
+                }
+              }${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "ata-local-number";
+                  default = null;
+                }
+              }";
+            }) machines;
+
+            createContactListTiff =
+              let
+                contactTXT = lib.concatStringsSep "\n" (
+                  builtins.map (contact: "${contact.number}\t\t: \t\t${contact.name}") contactList
+                );
+              in
+              pkgs.writeShellApplication {
+                name = "create-contact-tiff";
+                text = ''
+                  magick -background white -fill black -pointsize 20 -font DejaVu-Sans label:"${contactTXT}" "$1"
+                  magick "$1" -border 20x50 -bordercolor white "$1"
+                  magick "$1" -resize 1728x -units PixelsPerInch -compress Group4 -density 204x196 -monochrome -depth 1 "$1"
+                '';
+                runtimeInputs = [ pkgs.imagemagick ];
+              };
+
             genServerSIPEndpoint =
               { hostname, address }:
               ''
@@ -78,7 +141,7 @@
                   ln: builtins.concatStringsSep "" (builtins.genList (_: "X") (builtins.stringLength ln));
               in
               ''
-                exten => _${prefixNumber}${replaceWithX localNumber},1,Dial(PJSIP/''${EXTEN:1}@${hostname},30)
+                exten => _${prefixNumber}${replaceWithX localNumber},1,Dial(PJSIP/''${EXTEN:${builtins.toString (builtins.stringLength prefixNumber)}}@${hostname},30)
               '';
 
             getYggdrasilIP =
@@ -95,21 +158,17 @@
                 throw "clanService/yggdrasil is required";
           in
           {
-            clan.core.vars.generators.phonebox = {
+            clan.core.vars.generators.phonebox = builtins.break {
               files = {
                 server-prefix-number.secret = false;
                 ata-local-number.secret = false;
-                ata-password = {
+                owner-name.secret = false;
-                  owner = user;
-                  group = user;
-                  secret = true;
-                };
               };
 
               prompts = {
                 server-prefix-number = {
-                  persist = true;
                   type = "line";
+                  persist = true;
                   description = "Server prefix number: indicate server to connect to [10XX]";
                 };
                 ata-local-number = {
@@ -117,30 +176,20 @@
                   type = "line";
                   description = "Local suffix number: indicate local number on the server [XX00]";
                 };
-                ata-password = {
+                owner-name = {
                   persist = true;
-                  type = "hidden";
+                  type = "line";
-                  description = "Password for SIP registration.";
+                  description = "The owner's name for this unit";
                 };
               };
 
               script = ''
                 cat $prompts/server-prefix-number > $out/server-prefix-number
                 cat $prompts/ata-local-number > $out/ata-local-number
-                cat $prompts/ata-password > $out/ata-password
+                cat $prompts/owner-name > $out/owner-name
               '';
             };
 
-            systemd.services.asterisk.serviceConfig = {
-              LoadCredential = [
-                "sip_password_filepath:${config.clan.core.vars.generators.phonebox.files.ata-password.path}"
-              ];
-
-              Environment = [
-                "SIP_PASSWORD=%d/sip_password_filepath"
-              ];
-            };
-
             networking.interfaces = {
               ${ata-interface} = {
                 useDHCP = false;
@@ -163,8 +212,9 @@
                 domain-needed = true;
                 domain = "localhost";
                 dhcp-range = [
-                  "192.168.254.100,192.168.254.100,255.255.255.0,24h"
+                  "192.168.254.100,192.168.254.100,255.255.255.0,3m"
                 ];
+                dhcp-leasefile = "/dev/null";
                 dhcp-option = [
                   "3,192.168.254.1"
                 ];
@@ -211,9 +261,9 @@
 
             services.asterisk = {
               enable = lib.mkDefault true;
+              package = lib.mkDefault asterisk;
               confFiles =
                 let
-                  machines = lib.attrNames roles.default.machines;
                   nodes = builtins.foldl' (
                     nodes: name:
                     nodes
@@ -260,6 +310,13 @@
                     syslog.local0 => notice,warning,error
                   '';
 
+                  "modules.conf" = ''
+                    [modules]
+                    autoload=yes
+
+                    load => res_fax_spandsp.so
+                  '';
+
                   # Dial plan config
                   "extensions.conf" =
                     let
@@ -277,6 +334,23 @@
                       same  =>     n,Playback(hello-world)
                       same  =>     n,Hangup()
 
+                      exten => 000,1,Answer()
+                      same => n,ReceiveFAX(${faxDir}/echo-''${UNIQUEID}.tiff)
+                      same => n,Set(FAXFILE=${faxDir}/echo-''${UNIQUEID}.tiff)
+                      same => n,Set(FAXECHO=true)
+
+                      exten => 888,1,Answer()
+                      same => n,Set(FAXFILE=${faxDir}/contact.tiff)
+                      same => n,System(${lib.getExe createContactListTiff} ''${FAXFILE})
+                      same => n,Set(FAXECHO=true)
+                      same => n,Playback(vm-goodbye)
+                      same => n,Wait(3)
+
+                      exten => h,1,GotoIf($[''${FAXECHO}]?sendfax)
+                      same => n,Hangup()
+                      same => n(sendfax),Originate(PJSIP/00,app,SendFAX,''${FAXFILE})
+                      same => n,Set(FAXECHO=false)
+
                     ''
                     + (genLocalExtenConf {
                       localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
@@ -337,6 +411,44 @@
                     + serverConf;
                 };
             };
+
+            environment.systemPackages = [
+              createContactListTiff
+            ];
+
+            systemd.tmpfiles.rules = [
+              "d ${faxDir}                            0755 ${user} ${user} - -"
+            ];
+
+            systemd.services.asterisk-watcher = {
+              enable = true;
+              description = "Asterisk Configuration files watcher";
+
+              requires = [ "asterisk.service" ];
+              after = [ "network.target" ];
+              wantedBy = [ "multi-user.target" ];
+              path = with pkgs; [
+                inotify-tools
+                asterisk
+              ];
+              script = ''
+                inotifywait -m -e move /etc/asterisk |
+                while read path action file; do
+                  case "$file" in
+                    pjsip.conf)
+                      echo "restarting pjsip"
+                      asterisk -rx "pjsip reload"
+                      ;;
+                  esac
+                  case "$file" in
+                    extensions.conf)
+                      echo "restarting core"
+                      asterisk -rx "core restart now"
+                      ;;
+                  esac
+                done
+              '';
+            };
           };
       };
   };

modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/owner-name/value

@@ -0,0 +1 @@
+fake_line_value

modules/clan/pingvin/default.nix

@@ -1,23 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "pingvin";
-  manifest.description = "A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient file sharing.";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-
-    perInstance.nixosModule =
-      {
-        config,
-        ...
-      }:
-      {
-        services.pingvin-share = {
-          enable = true;
-        };
-
-        clan.core.state.pingvin-share.folders = [ config.services.pingvin-share.dataDir ];
-      };
-  };
-}

modules/clan/pingvin/flake-module.nix

@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    pingvin = module;
-  };
-
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-pingvin = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/pingvin" = module;
-      };
-    };
-}

modules/clan/pingvin/tests/vm/default.nix

@@ -1,42 +0,0 @@
-{
-  ...
-}:
-{
-  name = "service-pingvin";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        pingvin-test = {
-          module.name = "@clan/pingvin";
-          module.input = "self";
-          roles.default.machines."server".settings = { };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      services.pingvin-share = {
-        hostname = "share.localhost";
-        frontend.port = 3000;
-        backend.port = 8000;
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("pingvin-share-frontend")
-
-    server.succeed("systemctl status pingvin-share-frontend")
-    server.wait_for_open_port(3000)
-    server.wait_for_open_port(8000)
-    server.succeed("curl -H \"Host: share.localhost\" http://127.0.0.1:3000 ")
-  '';
-}

modules/clan/pocket-id/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "pocket-id";
   manifest.description = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
+  manifest.readme = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
 
     perInstance.nixosModule =
       {

modules/clan/pulse-stream/default.nix

@@ -0,0 +1,44 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pulse-stream";
+  manifest.description = "stream audio to attached speakers";
+  manifest.readme = "stream audio to attached speakers";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default role";
+    interface =
+      { lib, ... }:
+      {
+        options.client-ip-ranges = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "ip subnets permitted to stream to the server";
+          default = [ ];
+        };
+      };
+    perInstance =
+      {
+        roles,
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          { ... }:
+          {
+            services.pulseaudio = {
+              enable = true;
+              systemWide = true;
+              tcp = {
+                enable = true;
+                anonymousClients.allowedIpRanges = settings.client-ip-ranges;
+                anonymousClients.allowAll = true;
+              };
+              zeroconf.publish.enable = true;
+            };
+            networking.firewall.allowedTCPPorts = [ 4713 ];
+          };
+      };
+  };
+}

modules/clan/pulse-stream/flake-module.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pulse-stream = module;
+  };
+}

modules/clan/stirling-pdf/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "stirling-pdf";
   manifest.description = "Your locally hosted one-stop-shop for all your PDF needs.";
+  manifest.readme = "Your locally hosted one-stop-shop for all your PDF needs.";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     perInstance.nixosModule =
       {
         lib,

modules/clan/victoriametrics/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "Victoria Metrics";
   manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
+  manifest.readme = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     perInstance.nixosModule =
       {
         config,

modules/clan/vikunja/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "vikunja";
   manifest.description = "The to-do app to organize your life.";
+  manifest.readme = "The to-do app to organize your life.";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     perInstance.nixosModule =
       {
         lib,

modules/clan/yggdrasil/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "yggdrasil";
   manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.readme = "An in scalable routing as an encrypted IPv6 overlay network";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default peer role";
     perInstance.nixosModule =
       {
         lib,

modules/nixos/flake-module.nix

@@ -3,5 +3,11 @@
     common = {
       imports = [ ./common.nix ];
     };
+    think-gtcm = {
+      imports = [ ./think-gtcm.nix ];
+    };
+    think-backend-gtcm = {
+      imports = [ ./think-backend-gtcm.nix ];
+    };
   };
 }

modules/nixos/think-backend-gtcm.nix

@@ -0,0 +1,348 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.think-backend-greaterchiangmai;
+  think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
+  file-uploader = pkgs.gtcm-file-uploader.override { dataDir = cfg.dataDir; };
+
+  nginxNodeProxyConfig = ''
+    proxy_pass http://127.0.0.1:3000;
+
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host $host;
+    proxy_set_header x-webobjects-server-protocol HTTP/1.0;
+    proxy_set_header x-webobjects-remote-host 127.0.0.1;
+    proxy_set_header x-webobjects-server-port $server_port;
+    proxy_set_header x-webobjects-server-name $server_name;
+    proxy_set_header x-webobjects-server-url $scheme://$host;
+    proxy_connect_timeout 90;
+    proxy_send_timeout 90;
+    proxy_read_timeout 90;
+    proxy_buffer_size 64k;
+    proxy_buffers 8 64k;
+    proxy_busy_buffers_size 64k;
+    proxy_temp_file_write_size 64k;
+    client_max_body_size 50m;
+    client_body_buffer_size 128k;
+  '';
+
+  defaultUser = "gtcm";
+  defaultGroup = "gtcm";
+
+  php = pkgs.php83;
+
+  artisan-be = pkgs.writeScriptBin "gtcm-be" ''
+    #! ${pkgs.runtimeShell}
+    cd ${think-backend-gtcm}
+    sudo() {
+      if [[ "$USER" != ${cfg.user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe php} artisan "$@"
+  '';
+
+in
+{
+  options.services.think-backend-greaterchiangmai = {
+    enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/think-backend.greaterchiangmai.com";
+      description = "A place where to store states";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which this runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      defaultText = "${defaultGroup}";
+      description = "Group under which the website runs.";
+    };
+
+    package = lib.mkPackageOption pkgs "think-backend-gtcm" { };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "think-backend.greaterchiangmai.com";
+      example = "forum.example.com";
+      description = "Domain to serve on.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = lib.mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      description = ''
+        Options for settings environment variables
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_NAME = "Laravel";
+          APP_ENV = "local";
+          APP_KEY = "key";
+          APP_DEBUG = true;
+          APP_URL = "http://localhost";
+
+          LOG_CHANNEL = "stack";
+          LOG_DEPRECATIONS_CHANNEL = "null";
+          LOG_LEVEL = "debug";
+
+          DB_CONNECTION = "mysql";
+          DB_HOST = "127.0.0.1";
+          DB_PORT = "3306";
+          DB_DATABASE = "laravel";
+          DB_USERNAME = "root";
+          DB_PASSWORD = "";
+        }
+      '';
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = lib.mkForce {
+      isSystemUser = true;
+      home = cfg.dataDir;
+      createHome = true;
+      homeMode = "755";
+      group = cfg.group;
+    };
+    users.groups.${cfg.group} = { };
+
+    services.phpfpm.pools.think-backend-gtcm = {
+      inherit (cfg) user group;
+      phpPackage = php;
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "listen.mode" = "0600";
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 10;
+        "pm.max_requests" = lib.mkDefault 500;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 1;
+        "pm.max_spare_servers" = lib.mkDefault 3;
+      };
+      phpOptions = ''
+        error_log = syslog
+        log_errors = on
+      '';
+    };
+
+    systemd.services.gtcm-file-uploader = {
+      description = "File upload service for think-backend.greaterchiangmai.com";
+      requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
+      before = [ "phpfpm-think-backend-gtcm.service" ];
+      serviceConfig = {
+        User = cfg.user;
+        WorkingDirectory = "${file-uploader}";
+        ExecStart = "${lib.getExe pkgs.nodejs_20} ${file-uploader}/src/be/index.js";
+        Restart = "on-failure";
+      };
+      path = [ pkgs.nodejs_20 ];
+    };
+
+    environment.systemPackages = [
+      artisan-be
+    ];
+
+    services.think-backend-greaterchiangmai.settings = {
+      APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
+      APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
+      APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
+      APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
+      APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
+    };
+
+    systemd.services.think-backend-gtcm-setup = {
+      description = "think-backend.greaterchiangmai installation";
+      requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
+      before = [ "phpfpm-think-backend-gtcm.service" ];
+      requires = [ "mysql.service" ];
+      after = [ "mysql.service" ];
+      serviceConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        UMask = 77;
+        WorkingDirectory = "${think-backend-gtcm}";
+        RuntimeDirectory = "think-backend-gtcm/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          gtcmEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              lib.escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !lib.elem v [
+              { }
+              null
+            ]
+          )) cfg.settings;
+          gtcmEnv = pkgs.writeText "gtcm-be.env" (gtcmEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${lib.getExe php} artisan key:generate --force
+          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan storage:link
+          ${lib.getExe php} artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0755 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0755 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+
+      "d ${cfg.dataDir}/gtcm-file-uploader/uploads      0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."${cfg.domain}" = {
+        root = "${think-backend-gtcm}/public";
+        locations = {
+          "/" = {
+            index = "index.php";
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+          };
+          "/uploads" = {
+            root = "${cfg.dataDir}/public/uploads";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "/storage" = {
+            root = "${cfg.dataDir}/public/storage";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
+          '';
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+          "^~ /initiate-multipart-upload".extraConfig = nginxNodeProxyConfig;
+          "^~ /get-presigned-url".extraConfig = nginxNodeProxyConfig;
+          "^~ /complete-multipart-upload".extraConfig = nginxNodeProxyConfig;
+          "^~ /generate-presigned-url".extraConfig = nginxNodeProxyConfig;
+          "^~ /enable-bucket-cors".extraConfig = nginxNodeProxyConfig;
+          "^~ /upload".extraConfig = nginxNodeProxyConfig;
+        };
+      };
+    };
+
+    services.mysql = {
+      enable = true;
+      package = lib.mkForce pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.DB_DATABASE ];
+      ensureUsers = [
+        {
+          name = cfg.settings.DB_USERNAME;
+          ensurePermissions = {
+            "${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+  };
+}

modules/nixos/think-gtcm.nix

@@ -0,0 +1,305 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.think-greaterchiangmai;
+  think-gtcm = pkgs.think-gtcm.override { dataDir = cfg.dataDir; };
+  defaultUser = "gtcm";
+  defaultGroup = "gtcm";
+
+  php = pkgs.php83;
+
+  artisan = pkgs.writeScriptBin "gtcm" ''
+    #! ${pkgs.runtimeShell}
+    cd ${think-gtcm}
+    sudo() {
+      if [[ "$USER" != ${cfg.user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe php} artisan "$@"
+  '';
+
+in
+{
+  options.services.think-greaterchiangmai = {
+    enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/think.greaterchiangmai.com";
+      description = "A place where to store states";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which this runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      defaultText = "${defaultGroup}";
+      description = "Group under which the website runs.";
+    };
+
+    package = lib.mkPackageOption pkgs "think-gtcm" { };
+
+    packageBackend = lib.mkPackageOption pkgs "think-backend-gtcm" { };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "think.greaterchiangmai.com";
+      example = "forum.example.com";
+      description = "Domain to serve on.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = lib.mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      description = ''
+        Options for settings environment variables
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_NAME = "Laravel";
+          APP_ENV = "local";
+          APP_KEY = "key";
+          APP_DEBUG = true;
+          APP_URL = "http://localhost";
+
+          LOG_CHANNEL = "stack";
+          LOG_DEPRECATIONS_CHANNEL = "null";
+          LOG_LEVEL = "debug";
+
+          DB_CONNECTION = "mysql";
+          DB_HOST = "127.0.0.1";
+          DB_PORT = "3306";
+          DB_DATABASE = "laravel";
+          DB_USERNAME = "root";
+          DB_PASSWORD = "";
+        }
+      '';
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      home = cfg.dataDir;
+      createHome = true;
+      homeMode = "755";
+      group = cfg.group;
+    };
+    users.groups.${cfg.group} = { };
+
+    services.phpfpm.pools.think-gtcm = {
+      inherit (cfg) user group;
+      phpPackage = php;
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "listen.mode" = "0600";
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 10;
+        "pm.max_requests" = lib.mkDefault 500;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 1;
+        "pm.max_spare_servers" = lib.mkDefault 3;
+      };
+      phpOptions = ''
+        error_log = syslog
+        log_errors = on
+      '';
+    };
+
+    environment.systemPackages = [
+      artisan
+    ];
+
+    services.think-greaterchiangmai.settings = {
+      APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
+      APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
+      APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
+      APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
+      APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
+    };
+
+    systemd.services.think-gtcm-setup = {
+      description = "think.greaterchiangmai installation";
+      requiredBy = [ "phpfpm-think-gtcm.service" ];
+      before = [ "phpfpm-think-gtcm.service" ];
+      requires = [ "mysql.service" ];
+      after = [ "mysql.service" ];
+      serviceConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        UMask = 77;
+        WorkingDirectory = "${think-gtcm}";
+        RuntimeDirectory = "think-gtcm/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          gtcmEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              lib.escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !lib.elem v [
+              { }
+              null
+            ]
+          )) cfg.settings;
+          gtcmEnv = pkgs.writeText "gtcm.env" (gtcmEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${lib.getExe php} artisan key:generate --force
+          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan storage:link
+          ${lib.getExe php} artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."${cfg.domain}" = {
+        root = "${think-gtcm}/public";
+        locations = {
+          "/" = {
+            index = "index.php";
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+          };
+          "/uploads" = {
+            root = "${cfg.dataDir}/public/uploads";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "/storage" = {
+            root = "${cfg.dataDir}/public/storage";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
+          '';
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    services.mysql = {
+      enable = true;
+      package = pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.DB_DATABASE ];
+      ensureUsers = [
+        {
+          name = cfg.settings.DB_USERNAME;
+          ensurePermissions = {
+            "${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+  };
+}

overlays/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  flake.overlays = {
+    packagesOverlay = import ../pkgs/overlay.nix;
+  };
+}

pkgs/gtcm-file-uploader.nix

@@ -0,0 +1,40 @@
+{
+  fetchgit,
+  buildNpmPackage,
+  pkgs,
+  dataDir ? "/var/lib/gtcm-file-uploader",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "6f8c8d7dfaf5a0c1eb2077de1d6fb35ceaf3d4ec";
+    hash = "sha256-2mCdn8xGjWZrANclctGTmxQhkNc43VzlzMTVwVIFJcM=";
+  };
+  src = "${repoSrc}/upload-large-file";
+in
+buildNpmPackage {
+  pname = "gtcm-file-uploader";
+  version = "1.0.0";
+
+  nativeBuildInputs = with pkgs; [
+    nodejs_20
+    breakpointHook
+  ];
+
+  inherit src;
+
+  npmDepsHash = "sha256-JEp2F1CQfuV9fSYZRdRO+BiOE9dy1ReK6doJcqCuxu4=";
+
+  buildPhase = ''
+    npm install
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r * $out
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/gtcm-file-uploader/uploads $out/src/be/uploads
+    runHook postInstall
+  '';
+}

pkgs/overlay.nix

@@ -0,0 +1,5 @@
+final: prev: {
+  think-gtcm = final.callPackage ./think-gtcm.nix { };
+  think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
+  gtcm-file-uploader = final.callPackage ./gtcm-file-uploader.nix { };
+}

pkgs/think-backend-gtcm.nix

@@ -0,0 +1,36 @@
+{
+  fetchgit,
+  php,
+  dataDir ? "/var/lib/think-backend-gtcm",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
+    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+  };
+  src = "${repoSrc}/think-backend.greaterchiangmai.com";
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "think-backend-gtcm";
+  version = "1.0.0";
+
+  inherit src;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+
+    rm -rf $out/storage
+
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/public/storage $out/public/storage
+    ln -s ${dataDir}/public/uploads $out/public/uploads
+    runHook postInstall
+  '';
+
+  composerStrictValidation = false;
+  vendorHash = "sha256-wGfbprSDULBje1s5y3+ZiU/nCwYGDEULobZzyzGZ9bQ=";
+})

pkgs/think-gtcm.nix

@@ -0,0 +1,36 @@
+{
+  fetchgit,
+  php,
+  dataDir ? "/var/lib/think-gtcm",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
+    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+  };
+  src = "${repoSrc}/think.greaterchiangmai.com";
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "think-gtcm";
+  version = "1.0.0";
+
+  inherit src;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+
+    rm -rf $out/storage
+
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/public/storage $out/public/storage
+    ln -s ${dataDir}/public/uploads $out/public/uploads
+    runHook postInstall
+  '';
+
+  composerStrictValidation = false;
+  vendorHash = "sha256-b8+AKUmjQiOdV8UC9GYfJzAHFs9+FRSH91YsxKt0rDA=";
+})

sops/machines/adhil/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+    "type": "age"
+  }
+]

sops/machines/buna/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+    "type": "age"
+  }
+]

sops/machines/rana/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+    "type": "age"
+  }
+]

sops/secrets/adhil-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/adhil-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:DXK8BjWBriLUvOP2jz+48QP87iolYrob32o2D13EID/wiRoJDzz4Txr1AobrHa1NU791coXU2r7gteWA5KjYudXEgQW2opDjPFw=,iv:jLBLq3KqTvuntbLLCCMB8cVTGejetM7oGYV2j9rRlrw=,tag:0h3UtQ4tTDgGxksKmRoSVw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBET3d5UTJRNExVRkppSE5I\ncG02V0lDcGZnTmdLRVBkWUlWS3hUaWVaa1NJCkV3V2pseDFQV3RvR0N4cjNqaEk4\naGRkaDBMQnJIc1BlMCtvVW94M0dkYTAKLS0tIHRySkpXMzJiMzFrUU1UekdPUmVi\nMmZiRXBSc3FXMndVNjRqc2xTSlU3RTAK/erwb450pgiQAdYQlrVe32BEiaFIthl2\nUVQTCHQILnxyfC19ZOmlAnSuhXXrj7XdAQmK40DLb0A52QpFC2EP9w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0dFdWFOdGgrR0hsemYr\nOGpFV1VqQS8vRHA3UURXMEQ2ZDJHcWNCVzBZCitvZTZYdDYzYm8xQzlYNHNVYmRt\nMWNzbitjaUxMSXN5WHp2SVhPY29XY0EKLS0tIGJOSUFBOU1RMHBnQWJsQkg0cFlp\nZ2c5QU5aeDlUMG1KTlMzQ1FPMldTeEUKxyt4xdySOfB8Fa8KjPytjjq0oGgeFBlo\n+uT97/DvDbiBfGaZPaSyJPRP+Mca0yQz9nltCOm7qz68BEjboFKUEw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGU1YU05Y1Zm\nZ0Q4RDB5ZFc4cndmaTVTRXc1MXNmdllocGdVa2xrREQwa1kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPNEJKRkdxc1RkRWJ5d3diQzhuTjBy\nV1VNYXRKV2JXMGpPbWEycUlJSUh3Ci0tLSB2Y2dMV0M2OWwyUVRzZVNCZm91a3FL\nQnlFTjV0dnFhZWkxd2tNOWZScUMwCri3NvW7zXusWvELSRNc4kLfAc6JTbR8q4KS\nqu8E80e4gwng53PpHkmK0pBRYnJbZUf5DPITOy1mrbnNGMh6Nbs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEI3YWUzWWxp\nUSszSGNybG9oMitaUXludExlKzVOVFNNVkJteFpadWhtMDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpiTDJ2VGI5VjZZU0xKdTY4czhiT0RP\nbmZtU1ZQZERLNzk0MHpQM2gzdTVNCi0tLSBheWw4OVk5SzJYbW5ZZWl6SFRraXVK\nKzgrODM2alJON1FqTXczOW5JaWN3CpdplHYscbileaUWp0wSuirTOZUefZNUkbyh\nCqwS2/3JZ2IMhAYLfLoeVRbp7OrncmQF7L3KuvPPaE7WjAYwYug=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRMU0NKM2Fh\nQm9uYzYwQnNSWUdReGV1QXFXaXRORUJobURKOTFBbFoxRm8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpSVVgrL3RicHh2OEgvbC9xSzhjKzNz\nYnRIa0Qyc1I1cUhVZmJkSGk5YU1nCi0tLSBPb3Nud0Q3TjZMMkJvRGZNWklQSlFZ\nNHVndHNjZmljVExmNzNYdzRrZmJRCgwWFdIGjZJfugyk8GSk9zPE/cgERs9E48S9\nVjUEetmVvRPj3jOsseyrF8KF4ZAppo7u10WXKvTZOBTDISpCW0U=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMUoyTlhwOWVSNG1vbGdz\ncDJwc3ZTUjI4OUpLN3lnQWJvME0vbzkyTVJJCkJMbXUwbnVDMG5oNjVJR25wSVZw\nYjEyMWk2Y2pCa2N5ZTlka2tNTFVybXMKLS0tIE45akZVUWdsQmRUWFhuVmdhYTR5\nZ1hKVytCb2pvM0c5UDJlVVBUdXNxS2MKnQXRfa5eXzos/rAa3KUNtzKwXWuyqvU4\naMSGMpzI62JYrzv51od2sJVOPog0jrUsaIFx8rp6nuYsqRZ1fmDzKg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUmdlRldqaFFrZWp5eU5y\nSTRPeTVHdVFOYldkYVdKcFl6dklRMXpVWTE4Ci9KWUhJcnREMzJyNExZSFk0TFJl\nYmlVK1E5ZlFGWlJRZWwreVY3MWtHUzQKLS0tIElDNEl4UXFFNTJyODB6UnhaT3gw\nK1ViUzFLYjFTemcweERlaDNnR0FsaEkKJjG/XkynVLGQVdywXn0cM0db7X7aYrpP\nxYAUaS5SM7Ny0x3sEyP0+KdsWjBuHfi/CVsiTdBJ8CDpwkYSrpw5Lg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVnNpbUV3Z25weGFmTVg5\nOFV6cjl1eHJXemYzbitQNW9tSmNwaWdtQTA4Ci9ueHRSMndKVnJjVTFDQ044NEhs\nUEpuNnpSZDJjZzJuNjFMQ2ZVQWZ2b28KLS0tIE9LMjhPUndWNVBMR3QxQ041Qnc2\nbXR1U1VOWUxPd1ZBMzBxbGEvS2tFK2sKGnpSdS9f3sNFLstp8ONYTRqZVU7ujFAE\nqwTq4BJUlffEc9JXnvS/ZaC7O1yKmz8V5coKSHlbn+IyrZPbx9scaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOGd1emMzZkxPRjU1Ylcr\nRlVXbHBnTVV3eU9QU3NxYzBKYUJ5cVg1SXpjClNOYUZBNXMwdHJEVlNoRjdRZWVC\ndTluVVdtdkZDVDcwaGFGZUM4MEE3WUUKLS0tIGlHVVprTjhYQmJva1dQT0ZrdkE0\nNHZZTnhnWi94eURxR3ZCczlCeWxZVmsKOKXVYQAMftId6wXOsI+G/1/xPuVCLZOh\nrDzvaUbipkBTdZ/DXXvXf2f1fDcIqXXtPJyBD7Yh/6+KIPxf8wjVVA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:54Z",
+		"mac": "ENC[AES256_GCM,data:VpfhhVlfPQB94009yErF8NJl+BbhBgc/dAPNyvqQzqORpXsPa9DXjae+giPkRXhTS+263NIglUbPiNqZedj0d9ep78gj/rCupmYcGSsX0gqwFfwj50xX0qWDgs6Z5b7QytDlDPiNOCYM287Q7XLob7CcvAM46Ulo3vx/QKD76Qc=,iv:SBwlzN4PIEPo/iZl/VpkcgNtxqlyNOjqi5y9UGzWQgI=,tag:0/0mKGEQtGOrXYSsn+inmw==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/adhil-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/secrets/buna-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/buna-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:j5R4ApBy0c5t6wGmT0kRBT8g/G3HY2yVxR3/U1JqQrm6P/mzqJC5JDigGBWAZcdWv7wxQDXlkGi/ipEEhJsk8/if9S1atlMazF4=,iv:g6VPTjS5I+f7lVLcraBGXkI7cvyPgs3wgrfa14iGdvE=,tag:iz+/QqEBPD9EkRE9EL1mLA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac01oOTRpQWFRaEhqM3FK\ndlpQNmU3d09pVHhxTktCeXRPRWVpZ3dzRGx3CnVLckkzQzlzOFdwc2FvTWF5ODVl\nSXJ4di9CcU9wcHhvNmdJczhDSTZMMWsKLS0tIGRrWHNINjRzeFNPZVBtcm52bmZv\nZVFJT3doVi8rY0RyOENRVEdVNjNoOVEKBwhAaM9nRfShEF2B2N4LBaY3WA0Jzib3\nZRXnpnaSVlbnCqJIXU9bYMA/UIQ7b8bRR2xQ0Y+gMabBI0Dzf6TmoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWc2p2NEFFM1NrUllYM0lN\nRUJhQzJXZ3N1ZlpsWmo0L2VneFdnc25KQVUwCkQvdm9leXlMVitQNXN1OHpWM0RI\nZG16bHZVZlZlNHl0UERhWTVpUithalEKLS0tIHo3ZEdtZWo4QmM1SUpuMW8xczg4\nSWFtN2pWS05wdGlQWDZHcFRoWHJUR2sKzy85bPbem51i3FUzhTgk7eEVDbOF3vgR\npbINpu0LikVOrYOgop8cxU94QBWbS1VQd/kCIAYot1jMZs5Xvf9L3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNFT3h4K21F\nam5aMStNRHg3b0dFZm5tYmplSmxFRjBiakJJMExjS2poVEkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprMG5MSzk0YmlGaHpySzZFYk00eFpr\nbllMYmxkMkU1UlNGVWVYWHB2L3VNCi0tLSBCcUdaem9VYStjRmlsOWx3ckFnd3Nq\nR3BRTE9SaE9TQWs4VUZCRmQ3UmgwCj/4vmhRs9W6U9ay6mYFxPd6SvOTvxvYn/Oo\nuY7/N3PVpXxRK/UwovEGqY97AG/dEQk+I0/5AowFGmfPURpqKjo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGRvMUlHeVhn\nU3BhcEV1bU5uZjZqa25ydHhDOFUyNUQ2SzRadzk2ek9YbjggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYS0Rrb1poMTRDNmd2eW5QSWJvU1hB\nYVpTYnF1NmQ0SkNsa0xCNTh4bEYwCi0tLSBZZDhMZ0JsQ0dPQ2VWYXpMZE9Fb2FY\nY25qNFdFbVo0dURyUHd1MDl6NFlvCjFQKnkAmGuTioiY11oEgdD4Ctcw1gFF7xR1\nk9RV6JRXe8YeuWYpQjS17vQVR65TpJukYWm9UYy3NPP4Xu72toc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5HdTZDY3VH\nVnNvNHE2blFqM2pma001OGRWdGYxOHY2UkVhVW44bDdGUVEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjNkdSYlppQU51Wk40QzBlQ2lzaFBR\naWE1NDNOa21uNUNNWFBZWTVtKzJBCi0tLSBOWE1vUDZtVzRLMVdOMXBsNVpwMEc0\nTmwvZGVHd1Z0akJhempkZEdVSmpFCsnAxyLUrUbyMSBvak3VXBSdR5RmmL7eBjnM\nrw+kRLE8NFVwFiCZXgZDBlB2FkVKYvaL/hxsn4LYi3k53U9+vD0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmOUVPQ0RoSG95RUVnK3hC\nTHFEUHA2VWdadlBoNVRFNUl3Z0hOcjVXaVRzCkRXRTczZWRmenVZeHFWVVBEK2Z3\nVXFPWkpDak84akhEaTdkMjFUcmpnVTAKLS0tIGJLZFQ0UUVYeHkrTCsyYjVHcDQw\nUisxV3RVSEEycGhoSkttaEVXaTV0cFkKKo+lqTI+k6WDdPbMNo1owWH4/RoBt9e6\nmGO+sjziFzrZWUXx4RilR2F/3afRA/CdjzPab9I1sut3I6Z7FXNjYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscXI3NGV1R3lNQjE4U3Nj\nb0ZTNndORXlIY3d4bWVWYzRVTzZHWC9sV3owClRWc2tRaytsQkxFazlyOFU4V2RS\nYTEvY2swdDRnMGowdzZESTVVeTNkN2sKLS0tIFk2alJHUkwrMTVsdG1LQ2pReHA5\nTllyMFhML1JJdWQ1NXJkb2U5K3F4K1UKn6OPUfym5f9aacaHq962347dNeTjBfK/\nAMXPZXs6DawU8vko1RqIgzX/7StrITcXGcFfTutmpSa3KjMzuzeb+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1eXVNcklwZnI2dEtRaFdD\nOUVON1Nxd2l4L2xtYUtRSHlXVlc0VzVhZkZVCitxYjJTbDZDQjNHc2JrWmFaaEp0\nR1NMUEllalZxeHRndGxGRTZGSzV4TkEKLS0tIDhNZ2x0amhKdk1IdG16S0RLbWMz\nQSs0eTZ5YVBGdkdxYkhweUdMVVR3QVkKmau0k5SxJD/EURq6Lp4aDMYCoCFLOo/I\nRj5mAP4YGIVTU47HJYNcPcwzgwA6YVqVOiKaG6yyU7u1DsddaZHdiw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaHdMdC9jeDFWdktiV1JC\neDlFbW5QbmxVSStMZTYvak16K255TnZzMFdNCnFuOFlHVlYvQStmYWhITWl6NUN1\nOTdFdjg0OWZhUVd3NjQrcXQrNm9CWFkKLS0tIG9VWGZhUDJGWDNjTVg1bFMvVE5u\nYnkzV3QyczIrK1hLbUV1Q2twaDkxNm8KpHCL8htFz8UeMLsXmDUz/nAdTYsRSka1\nuq+bFkrVexExxqXJVyIXf20ceziFG8t5on8OGHDCOQsst4HEgRqyWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:15Z",
+		"mac": "ENC[AES256_GCM,data:wJ646ZAfUOSwXnkIUDkvm4wz7uaW4U7bCkC/8uFuoTwY16F5+1N7AxaSE453w2cOCJE5qOAXORYj5M7J8o84LjLWYN4+PYjCcU2ulL9rug29fNblqFHG8G1OdHwURep6sGKfvsSCTGgpnA5fYmXucYWIqc27cQ9HDtiHw3Bojas=,iv:L6xUGwjihD08Ahc/3WoA3tZDXvllmNWK90RpK7m+4Pw=,tag:pMynp2rs42lenOYbLQ0c0A==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/buna-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/secrets/rana-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/rana-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:xkoZtvAxTFuTOtBu8Pc7X2aVgOdjFwSFHLuX92DuSLxBX3NW+YP0Qo/0y3dyVjwR/nPHj6N7LjSqHMC2aZLgcR1kYJchyjZ8ISw=,iv:CGJD7bDqMVbp1KxDswK3iizmV8vZiVcBUP5vUc7qqDA=,tag:K967EvYAzD6eOGwSQ4dTew==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUHhPbEROVjkwVFh6TE0r\nUW1KN1U4eTEzN0JQcUJFWjdvT2V2WnpUMlU4ClM0NWJmRzg3aVFRSFgzcllTOE1r\nV3lGVlJ5WkRMYm9xb0xoWGladlpYbVkKLS0tIFpoT0oxMG8reW1rRmdwcmp1NXpv\nb1VJZXZPZzB1dEJxWlJ5SEYwdWpObkUKqDFSxFQ9HSGWMF8K7v8K5BFAub0lbQ3Y\nNHDIy7mZjFinebrjhPzHxlzhdguoSRSDPfaKbnaIUdKY2cwvQC1zrA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyYVBlclRXWGJqcTZuMXNJ\nREJOcEgxc1lJQ2o4TmVlbnU3NkNwMGtjc1NJCktNS0VrbTlndENSaTBtYVRYVUVL\nSFljU2F0V0YwdlFLSHJkeW9IaDRwQjgKLS0tIFRNUFMrWEw1VGhWOEwrQ05EWHQ5\nTUVDcnRpeEtqVHh0QnhyWExGUWp5c2MKs3BRqjoXwok/BRIyIKGXYNTJbE+FIvbX\n40N4B/ZM3DhsAb2+zl/iaogycDx3HvlspljaWy0emzGJYLLBWBonxg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEViaTZla0Fy\nS3FnZjQ4ZkxuWFJuM1JnU2JrRXYzWlVRZVJ0ZHVwMHR6eTAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyZEtIMnNqREpuUk1rd2hWd280ZWFz\nb3c4TlUybzlOTmVOZW55Zi9ia20wCi0tLSB1NVNnbkk0V0lPNVQvcVpUQUNBdXVv\nSkRNRDh6bE1zVm5QdjhtWklhQUZJCjfd9Ce0sS3qEcF0oTfgA70StwrW6t0kyClE\nvGXH1b6caO6GuDqHlTCWtK8wXhPNmMvaHzuKIxRwcTlMjE0LsE8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZDTGpUWllm\nSGFlb2R4YXVDTldQOUpFMlRhMlBqZEZ1NUJLR3oxc3VDVUkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpkMGYzZGFNWlFpY09waFpOUE03TEdJ\nV0VEL2ZBeld5ZlZpTzZITWpDVWFzCi0tLSBSdGpPRzg5R1N1cDhxTWNldUlVOThj\nSy9Jc1BMMnRlWkN3RFlrTUZ0Rks0CvGs24pzjvolDKBG9qh0gRmzSvTHEftC98Ts\n7bKL/7kYENcsvHsRjJk7e2q85b/3NT9ft6O8cG1Poqh32Tka9gM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGlOQS8yQUtx\nTUtUK1V4azcybm1GZk44MTJZa2F0alRwamJtL3RwblVYUzQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo1YXR0SE5XcS9yNFZzZXE2dHNKZFNh\ndC9WaHZTM1I2U1gwNVpiR3U4dG9NCi0tLSB3RG95Mlp3TCtvcHVJTFdnVS9DZVov\nMmU4Sjl4U3V6K3YrYkFOUnlIaTVzCtNFHyDhSOIXGiACkxPD9jV0glmRNqtJGZvf\nphqY7zOPd5OQQNDM5QQdp/P7DDl1CT4QjUPu84TgmFKO4HX7WFI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNNi9WYXVHZ3V1OHJFTzZh\nK3A5aU5yRi8yR2J5aVBlRTV1NW5IREsrSEdZCjFLQUpJWjhTY0FjV24zV3R1VCtk\neldBeU9Fd1FqYnVqYU4rQlNmVUp3TVEKLS0tIFM5WkdlZVJCNWJLWmRtZGE2WVFV\nZ0kwOGthcUxrMlhrM0tseURVTThYbHcK5ouDof7sD7XlbJquDOkv4BxT2DMmok+n\nzfGnlTy0KK/eptfV0CQrGD/QVMVyZpGrecnLDNZOeI7dJT++u5cMyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmTktaWVYzVk4wZ1dHeGlQ\nRkUwVGZvUitPdXQ2dlpoT0xsWjNPZmNYYVdnCkdjVmZPankyQm1QU0o0WU9tei9y\nTDhkNC81SW5GMU4xSXhUTkU2c3VSeVUKLS0tIERSUithQU8zZXZyWkU4MS82OHUv\nYThTQ3VNMUIyV3c3SXZNWUpWU2hFUDgKH1/7Xup8vISgDxJlmatxuAKdjRV3fA1f\nOI+zJCtR94wJvGALufqt5zPEkTkT47Z+ZijoNp6sAxQCCAiNLKO5LA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQVd4cWtKSkhrN01JNzJp\nb3p5dXFxaTJ0ZGdCcmNCTEhOWVpMNm9XY0hJClMzV0dRSnlKNnc3aEpSRnQ4YUNY\nWFBBcjkwVzlEOE1XdUdrMkM1US81aWcKLS0tIDF4U3RCYTNBb1dSdnJHL2E4b0RF\nWjJSVnBReEFBWFZQRktZNkFWUEkyWEkKsepkOgBIbIxNRU1118q+pQb4U6sVUsxi\nKZHu270Xd254fSqUUZ0nfYG8tk5jzzZ9W5Rpb27gA3gGYQ5r5h4zNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSzdyMmJzam5FM0MvRjg3\neTQveHZNaTBXdzJIdklQeEZuUkRVOXNQWWlnCmYvV3pJQWZFNytMOUpFa0o0UjhT\nSWdzanBoK3lhTnpCcENvajJkdW5sa1EKLS0tIHduV0NjQzE4T1VadDcySkFFVWYv\nanNNQjdpalIvNmtGZ2N1aTlzeC9ZcFUKvSsgRyL5u5+Ly42Ua+zDIaJ6O3GOyjZf\nIH6c4edkafCk1nUc2Tr9mBWGp51MX4VV/mLxAVse25u9YztTgcDlnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:54Z",
+		"mac": "ENC[AES256_GCM,data:Bl5dFPtFausLeGxCVbDuaUf8pj5K6JDUPkAqdDT8yOPYWXj88gPjDCt7AIuux9GCUJut6DrrfDs9cpIM9YwBA08EnWthBtjTWvE9qBcLfrCkGxHJ5O4Sff28AJiHq4XBZK4Y85RvjgMxeMX6c9g6taEk/B0QqG5xkvFiMuuwIRw=,iv:W+8iDE+jzCqlIYmLu4dhUsij4czfJceneNdJyRCLmso=,tag:SiyGeJqUh2BZedjmIVtjWQ==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/rana-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

tests/default.nix

@@ -0,0 +1,16 @@
+{ self, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      checks =
+        let
+          checkArgs = {
+            inherit pkgs self;
+          };
+        in
+        {
+          think-gtcm = import ./tests/think-gtcm.nix checkArgs;
+        };
+    };
+}

tests/lib.nix

@@ -0,0 +1,18 @@
+test:
+# These arguments are provided by `flake.nix` on import, see checkArgs
+{ pkgs, self }:
+let
+  inherit (pkgs) lib;
+  # this imports the nixos library that contains our testing framework
+  nixos-lib = import (pkgs.path + "/nixos/lib") { };
+in
+(nixos-lib.runTest {
+  hostPkgs = pkgs;
+  # This speeds up the evaluation by skipping evaluating documentation (optional)
+  defaults.documentation.enable = lib.mkDefault false;
+  # This makes `self` available in the NixOS configuration of our virtual machines.
+  # This is useful for referencing modules or packages from your own flake
+  # as well as importing from other flakes.
+  node.specialArgs = { inherit self; };
+  imports = [ test ];
+}).config.result

tests/tests/think-gtcm.nix

@@ -0,0 +1,102 @@
+(import ../lib.nix) {
+  name = "think-gtcm";
+  nodes =
+    let
+      settings = {
+
+        DB_CONNECTION = "mysql";
+        DB_HOST = "localhost";
+        DB_PORT = 3306;
+        DB_DATABASE = "thinkgtcm";
+        DB_USERNAME = "gtcm";
+        DB_PASSWORD = "";
+
+        APP_NAME = "Laravel";
+        APP_ENV = "local";
+        APP_DEBUG = "false";
+        APP_URL = "http://localhost";
+
+        LOG_CHANNEL = "stack";
+        LOG_LEVEL = "debug";
+
+        BROADCAST_DRIVER = "log";
+        CACHE_DRIVER = "file";
+        FILESYSTEM_DISK = "local";
+        QUEUE_CONNECTION = "sync";
+        SESSION_DRIVER = "file";
+        SESSION_LIFETIME = "120";
+
+        MEMCACHED_HOST = "127.0.0.1";
+
+        REDIS_HOST = "127.0.0.1";
+        REDIS_PASSWORD = "null";
+        REDIS_PORT = "6379";
+
+        MAIL_MAILER = "smtp";
+        MAIL_HOST = "mailpit";
+        MAIL_PORT = "1025";
+        MAIL_USERNAME = "null";
+        MAIL_PASSWORD = "null";
+        MAIL_ENCRYPTION = "null";
+        MAIL_FROM_ADDRESS = "hello@example.com";
+
+        AWS_DEFAULT_REGION = "us-east-1";
+        AWS_USE_PATH_STYLE_ENDPOINT = "false";
+
+        PUSHER_PORT = 443;
+        PUSHER_SCHEME = "https";
+        PUSHER_APP_CLUSTER = "mt1";
+
+        UPLOAD_MAX_FILESIZE = "5000M";
+        POST_MAX_SIZE = "5000M";
+
+        TEST_LOCAL = "false";
+      };
+    in
+    {
+      gtcm1 =
+        { self, ... }:
+        {
+          nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+          imports = [ self.nixosModules.think-gtcm ];
+          services.think-greaterchiangmai = {
+            enable = true;
+            settings = settings // {
+              APP_SERVICES_CACHE = "/run/think-gtcm/cache/services.php";
+              APP_PACKAGES_CACHE = "/run/think-gtcm/cache/packages.php";
+              APP_CONFIG_CACHE = "/run/think-gtcm/cache/config.php";
+              APP_ROUTES_CACHE = "/run/think-gtcm/cache/routes-v7.php";
+              APP_EVENTS_CACHE = "/run/think-gtcm/cache/events.php";
+            };
+          };
+        };
+      backend1 =
+        { self, ... }:
+        {
+          nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+          imports = [ self.nixosModules.think-backend-gtcm ];
+          services.think-backend-greaterchiangmai = {
+            enable = true;
+            settings = settings // {
+              APP_SERVICES_CACHE = "/run/think-backend-gtcm/cache/services.php";
+              APP_PACKAGES_CACHE = "/run/think-backend-gtcm/cache/packages.php";
+              APP_CONFIG_CACHE = "/run/think-backend-gtcm/cache/config.php";
+              APP_ROUTES_CACHE = "/run/think-backend-gtcm/cache/routes-v7.php";
+              APP_EVENTS_CACHE = "/run/think-backend-gtcm/cache/events.php";
+            };
+          };
+        };
+    };
+  # This is the test code that will check if our service is running correctly:
+  testScript = ''
+    start_all()
+
+    gtcm1.wait_for_unit("phpfpm-think-gtcm")
+    gtcm1.wait_for_open_port(80)
+    output = gtcm1.succeed("curl localhost")
+
+    backend1.wait_for_unit("phpfpm-think-backend-gtcm")
+    backend1.wait_for_open_port(80)
+    output = backend1.succeed("curl localhost")
+  '';
+}

vars/per-machine/adhil/openssh/ssh.id_ed25519.pub/value

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWyBu9oHfZ1dUbauMofzaJhPNJAFX7BaNHmA1g8Xu1O 

vars/per-machine/adhil/openssh/ssh.id_ed25519/machines/adhil

@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil

vars/per-machine/adhil/openssh/ssh.id_ed25519/secret

@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:86WcVdVW6U9/Bwgi15CF2g2pQ3N+l7ccGOgAqv4hQsnYZYACWU70dlMOWA/quo7emPYdgzNoBzVS5hoPDMFf3HTF1SfoCjaX/TRU1XAAXqpV/2G+PolLySdK/Vw5AEPWo1CL0S4/2L6FfB0TrXympw4fRNg6fCMS7LtOMsVdFGiU7RyPCIUEteZ3rUPlkIEpzaF66y8Tzfi88K6GSlFn2WTb1nTgrUQwKfvfzdXB3aZLqqzSVYA5p3pA6fzhbvifChVnBBcCkZIfGAApaqbdPBK8U/EPOLJtwQoTmcDilzjW7RJOWA6bIfq5ATJ9Ct6STv+gg+ozceot4LR6raYkGwG2NxQ7XoZEa62I9aLLTQZ07LOM28ZVA/BIfb7Bxj2Pu2Uzu6VE4xewgHS+u8HqvDKA3zXPKYCmnCSWiJLXKaZ5j1fxKcZnYVKlxxPzP6joIhKxPrUmASefcuCyXS5mQqM20sklHxG4SRrjoHHaAGkv7W23rPNq3MO2L8Voy+8u9UAk,iv:f/ddIhwLruDn7cRrSg24X3xcAn6ZaN7Rnp6UU4vUR9A=,tag:8qQIgJZfaNdMeTSx/ChW+g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcGQySFpsQW4wMCtrbnd6\nRFJvL052dWhyM0ljSjVlTG1CVXh3cHN1OFZrCmNBNWVBUFY4ZDU2bW5QMFo0YkVs\nbUp3Qjg5NDRicFc0Z01zZzVvc3hxdHcKLS0tIHBUNVlBVCtvUEZYSGIyRTZOVkxV\nODlNQmpJRllyNFZ0ZkFCdHY1ZExuK0kK/g/StMQx5LPX2Q0S6p7cBUZKImmyY5qJ\nkD3qJda5OF9pHcLTSiFMpgjI1gMiltzvDuzrwfOPgnplCnPgiUYNdA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuUGJzWC9vY0tVRWVSKzZY\nc3phd1Rsd3FtYjhUK0JsRk9HeEdJQUZISzFNCllHalJXbTZ2cTlyWjhMUkdPQXFh\nLzdldUFQcmUwblJtQmRTbzVhL05MZ1EKLS0tIDMvamJlZkM1SHNCTGRpc2lsdVdh\nbFNzb3hneTdCS3M2eVlxWnFOQ08wRUEKEcqMJiBMD8bn+X9yZ1KF8mxmZdo6czf4\ny/SsVodZaSAxsbiUFykapZ9tyOfc3VSp8dn2hlhs2ApeQ1ykunFgug==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBybTlWNzZ1MFdvMjRkTFAw\nYXBDRVBiSDJ6aVdJdVJOVStPQ1VNWEpPeUNNCkxjTWtNUWlnd3NmSTY1OExnMzl0\nOXVqQ1FhdE5BMXFDc0dZSlNKYi8rUzAKLS0tIFJYM2d0UU1tQzZpTVlNaVFtQ1hK\ncENTQ2VDb2ZISTZkaWpkTjA1V3lLWjAKDJXCX4TAwg+9KBZAPX/SSBXaw0ccFfQn\nYUcpls4hvti4qBntRMzHT1Pw5ok84whYKQYSpEnGU/pPgbBhcQovuA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNXR0kxRHBC\nR1RZVzA5TnhZaFJMUVZ2dkhZR2hwMzBRYW9YQWZTSmVZQjQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpHY0x5UEJUSyt4TUZTOEJUKzNRWkNo\nNkVWVlhZMDJTa2tsMHhLamQvM1hNCi0tLSBYdmRMbWZBR25LNzhkSURSZWFOaEhj\nL2VoRGdWc3hrend3VHN0cmxUczFjCp0cKOsgtfY5ArmAIsXFJZDtTsFU8S0ebfze\nmUnY3vVVOjf4XlSaBh9MFpBFSl1vnE+LKn/bYbuzVYmpNdcaMc4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNDZ09JcndH\ndnAra0I5Q2ZzWWRQUVZqVVA0bHhPTG1zKzQ2akJkSXRzWG8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpBTEpZM0tsa1hXSEpkUWFTemZlWDQ3\nWUNpZm4wbnM4dFdhRUdnNWVjeDJzCi0tLSBjTUo3ZUpYaVBnbmhwb3M0V0VtbE1V\nMnZrZTBheFpzUWZjVnd6OGNBemNVCtAPjcJ0hRaSeXZqDgz+dQttECYqakVo5Qzk\nnt07/aWu4xvtnKRn9yjaRq3KEPNEWcbHt2DdJSeVaiJWh+PtC1k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5EblZUVEUy\nODlmQzBWQ3RpeTVkeWFZTGlsZER6eUovdG9QZnFCNHRwbncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpiZS90cnlsZzIxNlBnVGNNQkRjV29W\nRTNYU2crb3RKbGNyaWZjOVdPNjc4Ci0tLSBmNXhXbmFVUWxjV2ZvZ3RvcDBQcWNq\nWXBmenpZZnp2dHpiUExXeUtRLzlrCp5OMLuza2aLmz4cTi9jCaV9JJukeBXPT8Z6\n32bWfx9eSD+MkGssBjmfFqzEvtaD0DkiXbr0upspREXpjrnB4wY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeklFYWdQUjRUcThrSVph\nRnQ0QUtrZVppaldMTUorbGVCUDlodEdYZEdZCml4VUlZVnJHT1VJSW1JK2hDSGNE\nclNvcXdxZjJsbUM1VW1qRFRYZ3dBdm8KLS0tIG5TVUJYZE85ZG9nZDl4OGsrUFBS\nWkxaMjBMblZ1WGpVei9KSnR1MkZnSzQKCL4kgeLf2ZRO0eMcb/2j6nfk0EXYo2+r\nGFTuE6/OlNXV0BIY8vXkubniWdkT0Mm/2nla0nQPiKv/ubterVZF3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBWGxBNVVKNmpxaEZOUHZE\nZVRxN1VPMTI1MDMzZmkrbWNxVHM5ZzVkbkMwCjZFbys0bVdlR1FvbDVmYzdSaUc3\nOXl2aW82T0p4UDlvajN6cERuS1FYaWcKLS0tIE1GdlJRVEppUEE3WGVsTnl1aCtx\nSHdlRWRJVzREakVnVjhPdm0xRXBGaVEK1iyMJmPeA1gySxLlzLVj4Pqb0AaBxH3k\nxKD4b4CTqA+gtv/NUt7rMG8sx0L+zpKrYsq8WWoTVR4iqi7pceKtyw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SEFhZ1IxYVh3R0RIb2lj\nUkpNVHRHV2NOTW9tMm9GSCt3WW9qaXlPSXdNCmlOYXRmTUxjWFBSU0FjV25VcFB4\nc09qNUNzd0dGWFpVaFVVWHBoNUVLeTgKLS0tIFFGRjc0c2dSOGs2TjNsTlhUampv\nb3FXakJNdHljYSs0UlhPUDBJNzFHcUUK+KI+/hjFWn0GDqYCLuF1D6mqm8Zwz2uT\nBnvYErRQp8zhzmJyISb1CWXOHN4iUhC7sAriLBA3CGJsveYiCo+QOQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGT0diZG0vaDhrbjRnYVhh\nMTJMTEd1TWxKcHJnV0s4cEVXWlFmOFAzbWhFCkx2dW1ISWpWbm8zdnE3ZkhRVXBr\nUVV0Sk5IL3BIdDQ1R0NIL2I3YnFwdG8KLS0tIHZmM2dKaDR6RkFzM2ZJNERlU0VW\nTGVkdTErdjIxVWV6SUpKUkJCS2JiTUEKcdc+IzYcGr/WAwvZLtbS4XUW2qxYNsrK\nBfYUB2e7uqyuLVQQtZjY7GeKtldJxmrPg1alpNYKVgb2q5/B03bK+g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:55Z",
+		"mac": "ENC[AES256_GCM,data:829+mmUUq8OwPJ196vFAjFoj9pU/86bCPU3CR321SYQrw8Max6mhlPJtaBsmQhux20Sv9jnd/vZyeJqTVzikE45v1uHcIdzHDzleSP4yRhyZ2EFOx7RMjbXxTGolLokKqlzTPwMIwP/R/93l4WmCLcK3j+xCU7BN8XUZHDvh3Qw=,iv:voxCHN9JYplyXBKyp55swfIQP0hVfJ/fk/FdJNvwpZg=,tag:T/26J+gaftij+BCqQFxGWw==,type:str]",
+		"version": "3.11.0"
+	}
+}

vars/per-machine/adhil/phonebox/ata-local-number/value

@@ -0,0 +1 @@
+00

vars/per-machine/adhil/phonebox/owner-name/value

@@ -0,0 +1 @@
+w-office

vars/per-machine/adhil/phonebox/server-prefix-number/value

@@ -0,0 +1 @@
+60

vars/per-machine/adhil/root-password/password-hash/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/adhil/root-password/password-hash/machines/adhil

@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil

vars/per-machine/adhil/root-password/password-hash/secret

@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:hSpr4CSkRNjfxFJVNsCwakFq8O/upoqsyzctHRUO5NWO1umfGE+le8hT4X/B5Td5y9l7h23r+NaanlMh/5+NmWo/PSbMlHq6owk2ydFgDzikLInnKDv0CesDlgTQcprlunnSzpFVDZ2EVg==,iv:KzdRcz5fungdzaPOpfE5LtmhedYbW2eKmmc9niy7YgI=,tag:uoxGCMhjjggxIjQtG3W+hw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvcVpyTHR1V2l6czYzRE5N\nRDV5ZXF1a0d2ZnBFcGh0MGZzVWp2T2NsY2pJCjRGQWNTY0ZFK0w3aVhWemRMaGEv\nMklWRFEva2lEazRTZFJwT2pDdkdmbGcKLS0tIEZUWVBHREVabjM1bUYyb21pamZ3\nUDlsZU9iNVJ1a3QzRTFtZEV5NVU3MGMKzNUiN8idDGGJLIY7AaJSIqJDqwT/LOYA\n0g+ARFZdv+CxPebnx7SEY7RrzsAeA58BFmzhjBLAUugf0iIAFcyqXw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3d0tEWll4eUR5T3gyelk5\nbjcweHVWSklHbWZRRlFkYW9Mb1c0Yk5Oc2drCldpTER6N3lIcWlFSlgwR1Nrazg5\ndDRsTEtOSllMam00TnhuMVZGVkFkWTgKLS0tIFFlQWgvelZoa3lQcEg4VUM1ODd2\najRzQ3dBdEQyZHR1eEEzRzZZMU1WYmcK54eyhqxKH2Qbaktv4UhSI/T8ABJHZ62Z\nanxVvxex8OR3Fj6gelflZG0y8rcaZXA0F2gRo/T1vQCG9icYPPWIyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxYk42UHR4bm9Lb0M2WU9O\nVnNQTjdIc3JiTG9YK21MRGNiYkJFMGZTR2k4CkZIK0VLTERlU0N5SllEaDl5aHpw\nd0V2R0JMWWFnY1NUb3l1cXczMTdzdEEKLS0tIGZYZUR6Y2Vhakhtcm1mRENMMFF3\nOUJ6VnI4YWxEVU9OdXZ3em16K2FHRnMKPubUsHeGDyj+QsvHsLVBnwXyp44l8Vgq\n0Fc3r0PztNHl6bMtDbfkPfa2BGwpiq0nnylH4CNG2vrMCI1KcVlVvw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGtrdXBJSnFn\nMW9QSFhFR2UxbzB4ek84L1lJY2FlRm5mZCtCMWpOTVNVekEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQplRGhIT1hCbGZKVkhORFNya0RiMVlU\nbUxIWEhyREZKWkkxNWYwOTIxSDZrCi0tLSBkRTgwUUtWbkx0aitCNmQ4bEZuQ0NM\nVU1GanZJblcxcDhYQVBrY0NEWFdNCjOBMkZzoa84TTTNwkeBHO/uQ4lMqswFNfht\nnfsrK4jLoRfyG1Z647Sqmzqx6JZWOtktv6gGJpTY+GlRrpro/i4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEJpRFlXSmJM\ndEQyK0lSY2Y4S2NaRUc3Q3ZaWG0rNTJFb0xCQ2ROVWZxeFUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo5UW5OeU1KWkJzckd5LzlXTWxsZklj\nTlZjMk5ieXk0VFdRSXZQRjU4eWZrCi0tLSBYdFJrdmw3MnNDK3RSYlhSN2Y5bk8x\ndGdGcmwyb1JNWUx0bjFEQzNiMCtJCmOUYLvuuLeJ/4Bqc14oYRtklrAww1X7C08L\nMVWdgwoiw8mkvyLUZM4To2wtPQh81YnfDlnPSBYkuBEUpxmOVHc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEMwVDA0Unh4\nVEZ0V0ttMG9Ra1ZoZWVHYVNTTGxucmUvbHk2WUdtSk5IbmcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp5RkFVdHFwMkQwVW9QenRBcjhsR0Rn\naW5jRVZ4L1FZUGVzcys1TkpQS2swCi0tLSBGdDNOL2dIak1DVCtwZWxyK2ZsZ0gy\nSzJOVVZqL3dSU3B2VXpXdHdTYzlvCrtHMtrr2eC2t1iBDFVAkOXoldo7M8zwvwg5\n7C03KRafD/GzZJ03U0X260TaXJBZ09PaDUT9EFw3xm0hYHKdI2A=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKeVRYc1ptbnpQZVU4cXVi\nVlJSOTREdDJsTXFaRGNGWno4TFUwbDRQMndVCi9ZTmQzaHNOUlIrYzlxT09OTmo5\nNVhhM3FCcjhIOFFWOElIMU9rdjczczgKLS0tIHEreFIyMWxhYTVCRXRMUkFOd0pu\nMlBIc3Zvc1d5bHVhNmkwbWM1aTF5Mk0KPKFFkHbqd9BA2WRm/Gj8OBRAKsfSd7+B\nHAGgjPoGn+ruQK7KwnMoZKbqzO/HP33UlESwYkqKX6Gs2FnMkfEviw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSHlFUjRscjBvQ0RaYmtM\nR1U2OVp0MzlnZ2dCWHVPUzU1cHRZL3B1TEFVCjlSL09aRmIyR3NxaERBb3BKZ25Y\nT2x4VDlVTTEzc0dUUmFrWDdXVDc2bzgKLS0tIDJqdDJvNGZUR0ZPLytnTnozRk5J\neG9vM205WU5HaWxMWUFBTk9TRkkyRE0Kek0LhPNO3jdcBS3c2wCQVFppHlv5xLlK\n5zA1dbm2bQw4ncsZUB7DOngLNaSOqDZi/KUh4B0GMys0ci5otIo6pA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBubjlwaXIrVXZVTytoL3hF\nYTI0SU85WENrUHN3TFBpMTJzN1IvZVBhUFZ3CjNBY292YjN6T0ZwbGliVXN6aVl5\ndTVVRTRDb0xmaFZGcE10TTB0VkplVW8KLS0tIG8wMkdtczArN1pKdW9pdmYwM3pY\nYVZIWWVISWc1b293amRwOW5qTldySEEK1WPptSqttWooaWdE3Q3JnQQ2IaIOV5Lh\nzokdc8fYfYEMbwBhlDRT7HcSxnOWVxpFtxy0coSDfHT0qImxnXPXWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6ajV5aFVCS09jNXpnMUZ3\nOUE2SXdOZVF4ZDdBcUU5RWlrQVBkR3dNTWhZClRhcHhDbm43dE80MmRRM2FLK1NW\nVituNm5VWlA3VmN4blU5ZmhWVFVpYjAKLS0tIHlaRUNSeGxOalZ6YUxLUGxaUHB2\ndUNySmpUK0gvdmxKbk1UV1VmRVpqWTAKhXBWyoRqTWzHXNnH5fLApumygXjK6D3L\nTlM1VIKH3cOZE+NnzxvWKm1mO10OFHJjWIwPgiDXv1piAtaSVV/zuQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:55Z",
+		"mac": "ENC[AES256_GCM,data:ZVGVh+TzqTscOMAdGTv5miO/DcNlP7+7Fp8HpjgKmbae8n5KEyRvCuIYmiQ8yfiYkw3ViUib2qeg+Hp+fRk74HiaJoZxu4R1Q7AY6TdLKq6MFzU92MuUdsmqGgJ5F9ZIhDAJsthP3a9dgFmfnk6dpDeezUji+seiKrTRSa7QDE4=,iv:lXdzn6OF0zCQqwbj7Gg+EMerEPQKtkQJUF5Qz0NzYqI=,tag:HrlM20SRPeG4K9o5s2p6hw==,type:str]",
+		"version": "3.11.0"
+	}
+}

vars/per-machine/adhil/root-password/password-hash/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/adhil/root-password/password/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/adhil/root-password/password/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:ML1H8jSE5Rk5j75mCv37ltTbIJsHICC4JTLC7Rj5iOsAYg96KL5O,iv:x4+0YRzd95bCb1p3L9MF7fnslp+Pc1fSAIIaatAWlgc=,tag:dSK9wN4/UGy2oKP9YTfVXQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCY25nWEV2eFJMUGg3R1da\nUGFBWlpCWGtVd28rYVp5Y0hPZG5ta2QyUWxRCjJQa1d6emxBWFpnRnp5eExnd1Jl\ndUtnQVJLTDN0eUpCMGNmUHFhNjZGaDQKLS0tIEZpaGVwcjZlZ0MzWHQvd0tYcnlR\neGJlUXNadlFSN096M1hoZWJHZDlrbVEKn3LoknNBe3ts23nF3mc2xpVXvtfzTqGQ\nsEFxh2Bc7oPxUwLMYak5e3Ge+s7HrbZy4tBcmomEBqoZlIvxVUkTig==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEK3BBR1BLZXA5SjhRWlNp\nQzVLMVpJcTA4WWVlbzRRVGxLNEJUTGpEbGlJCit0cHBNOE91QWJ1b1BDQ0cyRm01\nQ3JFbTRzZlI5MjNMaG4rTXlMZEdlU0kKLS0tIHMxMEpNakhtR3lEQkV2SzgvRWJE\nOXFCQTJjWmxPQzQzWEhVak9DbmdCaVEKGBWTPff7xvGByMAv8WxXRjj1mDQreQ4/\ne2bmeYbnM2Mo3EnUCgOPGx2fOLGYnllOX3ftlSVMkrvWV3oOPOWHng==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHRNc3hmb0lX\nTmF6elBRMW04NGVuTUgrc1ZyMHF5L2dkVi9yOWhtUlNReFkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp5R3gzdGNRZkowM0NqQjV0NXJZR2ZR\nTmFGQjljbUVMOHF2OHJaSVUrQUIwCi0tLSByV0kxVGNYOHAzMTYvTFFIQ3Bzc1l6\nOFJEUXF6anhvZ1VRN1RrSGpqcGl3CqRvdv3waDtxs7dpyfMsCd9IlEFFF+KrgWzu\nNmfk8wLtwvsUPjZ0BIi4doNTuRyjqI/8bkmZLf138U4m2nV5Iwg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDhtOVAyejdi\nSks0QlF5c1B2eU9MUVFva05kVlhZWGpNSVVydE0rMzRubEkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpGSElXM2dNR3hEVHErUHh4VjFrUENY\nZUY4WUFFa1RwUzVEYVBhekJ1VC93Ci0tLSB1Qm9ybE00aFJuRFg0eG9QY1J5SEdX\nS3ZVNU1IWTV2VktXSnNzWGVXNGVNCqqelr64JT0H7x+Ik+OhqyGQe9H47jy2Fmoh\n8Olq0sTB6y/kWpldCC4Ek23DUhdbhEBwPE2TSgoF+2/1C605bOw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBUcVJJaWRr\nZUo1emJJdzVNaVJ3bGhkd2NjdUs4ckJxYlJ2eVY0Wk1DWFkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpUREVVQlRUMlV4dTE4SGEybTVXcGph\nMHJUQzIwQ3AxSTloZ1hxN0VtQVljCi0tLSBvenNtbkl6QVUyWkNNeGRrdVJnenJ1\nWUdXaDZMVWFnWGJYMWovdkExZ1hnCjl+KhCBKg0NJoBBpSgCuETv+NtWxY41sjmd\nP19vEEk/669AMzntigzLrDqFXI/Hclys70GYa3yKaeaVJMD3Rgc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnSnl4T3ZFaDNRa1FONzQx\nc2NPa0plc3NIUXVDMkFnMFBrbXg3NEwzREZZCkUvSlVwN25xa1NlWjNBS0I2Z0c1\nOHcwNGREODF0RTErckNuNFUrek1maTgKLS0tIHdDWmViKzZTU0g3RlEvUHEzbWxh\nZ1dUc09tbS81UHkzVWhaNit3MVF4QW8K+1ry0afhIOBIKSten5q9y+fyh0KUQil5\nImpr7dryNqoKtREbsSF+r6ciZpdFionAoQ0C4qIY9sWJ7KUfOBBwTA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxa0ZTanRoWTdWak1VNDRH\nZlBrRjRsYW9EMHRTOHpONkdZSm43QU9qODJBClRSV2VESjlKd2RWbTRJWG1mbmZs\nQkNtTEp4WTlLaWdWNlpQM25GcjFDSWsKLS0tIERUc20xTWdoMzFNTHZHcXIwV1VF\nYkM2dE1aMjBWbWlqSmRKVmFWOGh5a0kKFs0UDC0nnudKVz2H7afoLCBObWFBLP7G\nDX+ni9VRFrJoCIgrbHaxN7q+91DSqEDkVLceloEGkoyi5/WBET9JYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZmhtTmtuTEtOTytNT1RQ\nbUE3bDJoa25mWmR0aGZjMVpzbTlYNnRPcmlzCmFhSEVNS1lRWkYwdGZIeUZ0QWRa\nazA5cDA5M3hndDNiSlJHLzNpQjIrZUEKLS0tIHpDWG5saEs3VWlBZ3gwdjZ1NnNw\nSWpUNDJ3R0RsZTVES25sakZJcjBYcFUKYaIEPhk4lRWRBcOS5zoXbjNHJboQg+a+\n4FnlVXx94eKOMjEbQMdaBR0H5qUgZDnz4dOU/D7el4pjDNuF256xhw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqQ0E1d0hpS3J0SDFUU0dS\nTlMyYTJOclRQdXBmZjE5alQ4a0xQMmw2S0FnCi9XVXpEaTdEL2VkYWx3QUlOMy90\ndUVZTUorbDdjZE1TNWJhdWlYQjkweVUKLS0tIE9ENS81dEV2NTZLaUYrVXNJNVh2\nREJaU0JidGtqTUNYRkZJMGwxcTh5MEkKiD/vlux8FINMp6vvgZYLSbU5foT2uRU+\nWNZLQLd4ErvMoBS++7WgTtzf0t4Hq1Z+w4lBJfHWQ7rclqeM8NbXCA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:55Z",
+		"mac": "ENC[AES256_GCM,data:4Hsi7UPyYRYFDApmib0/sH+Kb0zeoUSyRSi4PGSRj0R4e6uFZyjgFHJJCRBQRA8oxN7Wtro/hB2+GSZtAdbxdgbbOr3wBt3cjSk55vVw/E6qySHEe/Q2sj3ZFRoYa19e95f+kMSl/5H9jlHUgKjouima8l6KIDrA84+6uJT/KcA=,iv:WqFzmdVHWlHB0qz1cDqeG/ALu4eqO3mzhUrHSh6cjnY=,tag:aWAdkkANpixGM8xv1wgCtg==,type:str]",
+		"version": "3.11.0"
+	}
+}

vars/per-machine/adhil/root-password/password/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/adhil/state-version/version/value

@@ -0,0 +1 @@
+25.11

vars/per-machine/adhil/tor_tor/hostname/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/adhil/tor_tor/hostname/machines/adhil

@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil

vars/per-machine/adhil/tor_tor/hostname/secret

@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:ZvrP0+EjAy4XwHc0jr8VXSwXLFti3eP2ZmRPbY845KG9RIYC+sd78NMKU/qZVYrkgtl1Exgp822vXuPtfR4H,iv:etoUSTfU3hOXXbujyiV8UmpwloshpJDfMrJbzS9V5Vk=,tag:0Ku6qtrdJEjUgOf8LQUpGw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXSHljd01TMGhnSHZISkFJ\neWhXNVRhc0h0eDEyYm9HL1hDN3VpelZYREVZCkpraVVLa01SZE5yOWd6MVk0eG93\nSnZVVzRUZEdSODN3clRFZVBZSWVmWGcKLS0tIGpDdWZuaXpaN3pERmp6YlhXRXlJ\nanJqbzJLZG9KM0dzcUVHeUUvcTR0ZGcKEmWayOG32AvDhLN6Xd0tL8eHrufB3sxF\nDdN4YWteG93UcjT/QGRRBhJrGWsGeIEytQwVMWCFovjbfjilHku5Lg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOWFOTFlsVXdqQTQ1ZDVV\naGExdGJZYVJwR05TQi9XZDVXT0pkQ0djaUZVCmFJZmJMRG85eDBHYlRFb2hrWDBv\nRnVkZmRlRUZZUVZwVDZBU3grQnhmM3MKLS0tIDhGajVMR0crVFNLcDh1MlQ4aUVV\nS3F5aWtXSDBKS1ZrOEU3M2kwMmJzdkEKnvVaTVUqvK14FwkAdlg0gsMdV3yzhMwV\nAheVVetBg6u2iUG4WGcmUFAguirYk5PkSTT3+1dvqFMKOpzY1urZJw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIWmxvWmlaMm5WWDFqOGlv\nSnZCYUlHV1E4QWJJamRML255SUNrNExTaWxZCk1HK0dvZWE3SC85Y2dUTkNxUWlh\nNlIyM3VwRjFBV0tZaVZvQU5KRHNvaG8KLS0tIGNZNkhQQm1YWm1ERzJGaXkwWUlB\nTTNZNjNIclRBOVViNVpQdEVlNDV1M3cKywBZJfXGPXOlCibhjW+NGedFzNk+0q/I\nldWtqwr+XPBl5WkcsRxJ55Qaku7PQoQBeGt6kTMVSCDEFM04gjLmng==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG85TVdld0U5\nZDNYd2lUVFlJeHcwZmorV1VtdnlsbUpmdUtMelFqQzJwRG8gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPYldqcWNuY2xMVFp1b1I4d3NlbS8x\nUkJqMzVDa2hrTUYyczhyeExoanI4Ci0tLSBWc0c4NWxLMDkyaEJnNDdlWlkzWHY2\ndU94WHFOaEdiYmtRUWlJNGdzbGZzCkyIAhIgbCxBKd0pupKW0gcbExtOYE37KMnA\nocTXXqdOqLu2iLB9mJcXIb9gSqRk1dY11lIFPhI/kqPTeaA6Az8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5Ga2VSYzJ5\nektpNDBKa2NZdEIwN2JsOTRxRmxUS0FOcjVicis1bjRQM2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpmR1ZQRjRFdVFvelFZQ1NWclB0SmtZ\nQ3N0MkJEeE96TjlhTmo1d0ZyL0NrCi0tLSBNVXA2ZHU1eWxVaS8zTU8rQldlMEJr\nNmtXcWUyVkRDZkQzbmRtRkpxRnBZCjDnFAJ+qncC4sR/dI86lAIPN8W5GojRgFg5\nh86SwUAgJUNS0kaoi/DGVosOWIt84A7L2JFvVAaKsY7C7LUuSeY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFJOZW1XNXZz\nZGpVTlFqS0MvSXlUNEowei9sQksyM1hJbXluaXJwcm1kbE0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpmYmlDZmtCSmVBRHlNTEJSbmZZcE8y\naUVCYWFqeGlVeUU3Q2JJVFhwS3FrCi0tLSB6V24wUUljcU5hcHpWcTh0Rk9LaTZ0\nc2RSQ0RCc09TNHlmdWhVcTlJV1R3CvmrzzdzzG0wnGnQE8sER95yqqiRaoctKCq9\nB+iItAwrUiJjt/EhW22rmBHbgwZ60BIZib4oHg/Gndqu0TFJPe0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBa2NWd2tJNjdkTklnSFNP\ndGpBS1ZwdlhRV3p4S3c2ZzFrbDlqcXFzYjBrClIxTlh3SFRwa3BlUlRzUTd1MU5S\neDlRWXhPWXBobXp5d3NXZExmN2lXOUkKLS0tIEZOVkJuWVM1Slg4OGMyYitKaDgv\nVVRvMUZSZjlRc0VIRm03N0hDUlVCV2MKIzPan3cZEY6bMIoCwdUnjcnoEVsDxjnN\n8AAciGYzqqIiAu9GrTQVQl6UIqw+juSM5WnEpu4yFU/qwqSCX121zA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZzdSNTEzb1ovMDhlNWFz\nSWpVbWxTaVhsQ2Z6OFhvTWVPV0hLY0hFM0g4CnJuMWlxN0UzNTFqbmFoM0I2MkZT\ncVFEdTNMWG1JR0liN1dqck44ZmQvczQKLS0tIGgvbGRWdU53S1FiT3MyZFhOR3Q5\nVnJpY0JHUm9PbDhaY0JjcDA0TWNVdHcKxKQSLcPl72nDAT9aFP186G4AFxcVZ5qd\nAlf5gGSHk3cXImHSgJ+kKOCWMgKXblg0tv58erbbZimDzeQI3Bdg0A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2TTFmUUNlTnYvYkV4Z2hk\nNzdCZUQ3T3RBTEhvekRrZUFIcVUyZlhGWENBCmFuUGdqUS9RUzZ5aWxhL3VWc0NV\nZWd0eG1sY1I2VzBSZWc1ZStwd2NUaGcKLS0tIDh2amZwWExVeW53aWJjdm1oRzBS\nZTY0Lzl3c3FjU3ErQ1F3cllZbUg1NVkKGbE/pqX+11PuHsigBcWo6R3wQl0+H0x1\n/l4bAkKf57iUXA2PiXqQNCHF6yenBQuK5BsjaPVvpw4pIZprlmATHA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bit1YUQrd3YraFZLOVpU\nZnBxNlJ5QVFUS242MjNxN1hSNU82VkNWMlNjCjA0U2ZjL21CQ3AzeXBTS2FWZ2FX\neTFkamZFWU5GYitmQlZ6Skpjb0tvdXcKLS0tIFBxMVl4QnlQN2lJcnR0Z3A0eVNU\nQkNINWtMdTRCb2FaT0VMZ2tpcFBUMTQKx32onJZyRr4kfW4uZq5xK6fac6EI+hT+\nZClP5JnLIQep+TLxDSP8iqFlXzBBmjPFS7FF2dHVnq8FTX+O942jdQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:58Z",
+		"mac": "ENC[AES256_GCM,data:mvYRln+d3qEvCvcy+L1kW+iwjsbqS63PsW9JlmAvRmXT4R1SinGU4QW2u7aNVJr/sHIdOItQG/jMhry1v2tJnbYjhMb/QyLo5FEPt+ExQnxZamYgjvr4bEWEF3RC/WctPmRlyureLFrYrPPQYSmFufaeLC9DWhRBCtM1aug1K+s=,iv:9fp0tDJjV5ZNjSiK8ffEqU5gxKSYdb+SE3qdERRP7oM=,tag:ZO4zChR/V//SVg8YGJ1AvQ==,type:str]",
+		"version": "3.11.0"
+	}
+}

vars/per-machine/adhil/tor_tor/hostname/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/adhil/tor_tor/hs_ed25519_secret_key/machines/adhil

@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil