vega on new device

VPN for b4l
Glom NAS machine vega
2025-09-26 12:04:02 +07:00 · 2025-09-25 14:46:26 +07:00 · 2025-09-24 14:20:21 +07:00 · 2025-09-24 09:56:09 +07:00 · 2025-09-24 09:55:25 +07:00 · 2025-09-24 09:37:39 +07:00
184 changed files with 10558 additions and 36 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1752166475,
-        "narHash": "sha256-tM4MVm6ENCmay2XZwlKafUXRr+acZigG2GG9kw7q3Y4=",
+        "lastModified": 1754535625,
+        "narHash": "sha256-RdT3/DskBjwx74cvHJHb/mLSO2XeSHitSYViNmYGU/k=",
        "ref": "refs/heads/main",
-        "rev": "2895c18bba8261fbb91b8b86d33245c6e5c48005",
-        "revCount": 8320,
+        "rev": "f69e28a1333527cdbadb233966a7e19d4b35a1a3",
+        "revCount": 8886,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -43,21 +43,17 @@
          "clan-core",
          "nixpkgs"
        ],
-        "systems": [
-          "clan-core",
-          "systems"
-        ],
        "treefmt-nix": [
          "clan-core",
          "treefmt-nix"
        ]
      },
      "locked": {
-        "lastModified": 1751846468,
-        "narHash": "sha256-h0mpWZIOIAKj4fmLNyI2HDG+c0YOkbYmyJXSj/bQ9s0=",
-        "rev": "a2166c13b0cb3febdaf36391cd2019aa2ccf4366",
+        "lastModified": 1753067306,
+        "narHash": "sha256-jyoEbaXa8/MwVQ+PajUdT63y3gYhgD9o7snO/SLaikw=",
+        "rev": "18dfd42bdb2cfff510b8c74206005f733e38d8b9",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/a2166c13b0cb3febdaf36391cd2019aa2ccf4366.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/18dfd42bdb2cfff510b8c74206005f733e38d8b9.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -92,11 +88,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1752113600,
-        "narHash": "sha256-7LYDxKxZgBQ8LZUuolAQ8UkIB+jb4A2UmiR+kzY9CLI=",
+        "lastModified": 1753140376,
+        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "79264292b7e3482e5702932949de9cbb69fedf6d",
+        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
        "type": "github"
      },
      "original": {
@@ -125,6 +121,21 @@
        "type": "github"
      }
    },
+    "import-tree": {
+      "locked": {
+        "lastModified": 1752730890,
+        "narHash": "sha256-GES8fapSLGz36MMPRVNkSUWXUTtqvGQNXHjRmRLfJUY=",
+        "owner": "vic",
+        "repo": "import-tree",
+        "rev": "6ebb8cb87987b20264c09296166543fd3761d274",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vic",
+        "repo": "import-tree",
+        "type": "github"
+      }
+    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -176,11 +187,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1751949589,
-        "narHash": "sha256-mgFxAPLWw0Kq+C8P3dRrZrOYEQXOtKuYVlo9xvPntt8=",
+        "lastModified": 1754278406,
+        "narHash": "sha256-jvIQTMN5EzoOP5RaGztpVese8a3wqy0M/h6tNzycW28=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "9b008d60392981ad674e04016d25619281550a9d",
+        "rev": "6a489c9482ca676ce23c0bcd7f2e1795383325fa",
        "type": "github"
      },
      "original": {
@@ -195,6 +206,7 @@
        "clan-core": "clan-core",
        "devshell": "devshell",
        "flake-parts": "flake-parts",
+        "import-tree": "import-tree",
        "nixpkgs": "nixpkgs",
        "treefmt-nix": "treefmt-nix"
      }
@@ -207,11 +219,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1751606940,
-        "narHash": "sha256-KrDPXobG7DFKTOteqdSVeL1bMVitDcy7otpVZWDE6MA=",
+        "lastModified": 1754328224,
+        "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "3633fc4acf03f43b260244d94c71e9e14a2f6e0d",
+        "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -15,6 +15,7 @@
      inputs.nixpkgs-lib.follows = "nixpkgs";
      url = "github:hercules-ci/flake-parts";
    };
+    import-tree.url = "github:vic/import-tree";
    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
@@ -38,6 +39,7 @@

          ./machines
          ./inventories
+          ./modules/clan/flake-module.nix
        ];
      }
    );
--- a/fmt.nix
+++ b/fmt.nix
@@ -17,6 +17,8 @@
          global.excludes = [
            "sops/*"
            "vars/*"
+            "*/sops/*"
+            "*/vars/*"

            "*/.gitignore"
            "LICENSE"
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,21 +1,128 @@
-{ inputs, self, ... }:
+{
+  inputs,
+  self,
+  lib,
+  pkgs,
+  ...
+}:
 {
  clan = {
    inventory = {

+      machines = {
+        rigel.deploy.targetHost = "root@rigel.local";
+        vega.deploy.targetHost = "root@vega.local";
+      };
+
+      tags = {
+        glom = [ "vega" ];
+        b4l = [ "rigel" ];
+      };
+
      instances = {
-        emergency-access = {
+        admin = {
          module = {
-            name = "emergency-access";
+            name = "admin";
            input = "clan-core";
          };
          roles.default.tags."all" = { };
+          roles.default.settings.allowedKeys = {
+            "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
+            "davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
+            "vi" =
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387";
+            "kurogeek" =
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
+            "matthewcroughan" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo=";
+            "matthewcroughan-1" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo=";
+            "matthewcroughan-2" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo=";
+          };
        };
-      };

-      services = {
-        admin = {
-          default.config.allowedKeys = [ ];
+        glom-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."vega" = { };
+          roles.peer.tags.glom = { };
+        };
+
+        b4l-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."rigel" = { };
+          roles.peer.tags.b4l = { };
+        };
+
+        pocket-id = {
+          module = {
+            name = "pocket-id";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        nextcloud = {
+          module = {
+            name = "nextcloud";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+          roles.default.machines.vega = { };
+        };
+        stirling-pdf = {
+          module = {
+            name = "stirling-pdf";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        actual-budget = {
+          module = {
+            name = "actual-budget";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        victoriametrics = {
+          module = {
+            name = "victoriametrics";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        vikunja = {
+          module = {
+            name = "vikunja";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        grafana = {
+          module = {
+            name = "grafana";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        pingvin = {
+          module = {
+            name = "pingvin";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        paperless = {
+          module = {
+            name = "paperless";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
        };
      };
    };
--- a/lib/auto-accept-zerotier-members.nix
+++ b/lib/auto-accept-zerotier-members.nix
@@ -0,0 +1,21 @@
+{
+  memberIds,
+}:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  systemd.services.zerotier-accept-external = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "zerotierone.service" ];
+    path = [ config.clan.core.clanPkgs.zerotierone ];
+    serviceConfig.ExecStart = pkgs.writeShellScript "zerotier-inventory-autoaccept" ''
+      ${lib.concatMapStringsSep "\n" (zerotier-id: ''
+        ${config.clan.core.clanPkgs.zerotier-members}/bin/zerotier-members allow ${zerotier-id}
+      '') memberIds}
+    '';
+  };
+}
--- a/machines/b4l/configuration.nix
+++ b/machines/b4l/configuration.nix
@@ -1,14 +1,22 @@
+{ inputs, config, ... }:
 {
  imports = [
-
+    (inputs.import-tree ./services)
  ];
  nixpkgs.hostPlatform = {
    system = "x86_64-linux";
  };
-  boot.loader.grub.devices = [ "/dev/disk/by-id/changeme" ];
+  boot.loader.grub.devices = [ "/dev/disk/by-id/FIXME" ];
  fileSystems = {
-    "/".device = "/dev/changeme";
+    "/".device = "/dev/FIXME";
  };
+  networking.fqdn = "b4l.co.th";
  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];

+  security.acme.defaults.email = "admin@b4l.co.th";
+  security.acme.acceptTerms = true;
+  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+    enableACME = true;
+  };
 }
--- a/machines/b4l/services/actual-budget.nix
+++ b/machines/b4l/services/actual-budget.nix
@@ -0,0 +1,36 @@
+{ config, ... }:
+let
+  abDomain = "${config.clan.core.vars.generators.b4l-actual-budget.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-actual-budget = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Actual Budget app. Default:(budget)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "budget" > $out/subdomain'';
+  };
+
+  services.actual = {
+    settings = {
+      allowedLoginMethods = [
+        "password"
+        "openid"
+      ];
+      trustedProxies = [ "127.0.0.1" ];
+    };
+  };
+  services.nginx.virtualHosts."${abDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.actual.settings.port}";
+    };
+  };
+}
--- a/machines/b4l/services/grafana.nix
+++ b/machines/b4l/services/grafana.nix
@@ -0,0 +1,79 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+let
+  serviceName = "${config.networking.hostName}-grafana";
+  gfDomain = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+
+  settingsFormatIni = pkgs.formats.ini {
+    listToValue = concatMapStringsSep " " (generators.mkValueStringDefault { });
+    mkKeyValue = generators.mkKeyValueDefault {
+      mkValueString = v: if v == null then "" else generators.mkValueStringDefault { } v;
+    } "=";
+  };
+  configFile = settingsFormatIni.generate "config.ini" config.services.grafana.settings;
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      adminpassword.secret = true;
+      subdomain.secret = false;
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Grafana. Default:(grafana)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "grafana" > "$out"/subdomain
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  systemd.services.grafana.serviceConfig.ExecStartPre = [
+    "+${pkgs.writeShellScript "grafana-set-password" ''
+      ${pkgs.grafana}/bin/grafana cli --homepath ${config.services.grafana.dataDir} --config ${configFile} admin reset-admin-password $(cat ${
+        config.clan.core.vars.generators."${serviceName}".files.adminpassword.path
+      })
+    ''}"
+  ];
+
+  services.nginx.virtualHosts."${gfDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grafana.settings.server.http_port}";
+    };
+  };
+
+}
--- a/machines/b4l/services/nextcloud.nix
+++ b/machines/b4l/services/nextcloud.nix
@@ -0,0 +1,35 @@
+{ config, pkgs, ... }:
+let
+  ncDomain = "${config.clan.core.vars.generators.b4l-nextcloud.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-nextcloud = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Nextcloud app. Default:(cloud)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "cloud" > $out/subdomain'';
+  };
+
+  services.nextcloud = {
+    hostName = ncDomain;
+    package = pkgs.nextcloud31;
+
+    settings = {
+
+      overwriteprotocol = "https";
+      trusted_domains = [ ];
+      trusted_proxies = [ ];
+    };
+  };
+  services.nginx.virtualHosts."${ncDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+  };
+}
--- a/machines/b4l/services/paperless.nix
+++ b/machines/b4l/services/paperless.nix
@@ -0,0 +1,67 @@
+{ config, pkgs, ... }:
+let
+  serviceName = "${config.networking.hostName}-paperless";
+  domain-name = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      subdomain.secret = false;
+      adminpassword = {
+        secret = true;
+        owner = config.services.paperless.user;
+        group = config.services.paperless.user;
+      };
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Paperless. Default:(paperless)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "paperless" > "$out"/subdomain
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  environment.systemPackages = [ pkgs.toybox ];
+
+  services.paperless = {
+    passwordFile = config.clan.core.vars.generators."${serviceName}".files.adminpassword.path;
+  };
+
+  services.nginx.virtualHosts."${domain-name}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.paperless.port}";
+    };
+  };
+
+}
--- a/machines/b4l/services/pingvin.nix
+++ b/machines/b4l/services/pingvin.nix
@@ -0,0 +1,45 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+let
+  serviceName = "${config.networking.hostName}-pingvin";
+  domain-name = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      subdomain.secret = false;
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Pingvin. Default:(share)";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "share" > "$out"/subdomain
+      fi
+    '';
+  };
+
+  services.pingvin-share = {
+    nginx.enable = true;
+    https = true;
+    hostname = domain-name;
+  };
+}
--- a/machines/b4l/services/pocket-id.nix
+++ b/machines/b4l/services/pocket-id.nix
@@ -0,0 +1,35 @@
+{ config, ... }:
+let
+  pidDomain = "${config.clan.core.vars.generators.b4l-pocket-id.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-pocket-id = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Pocket-ID app. Default:(auth)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "auth" > $out/subdomain'';
+  };
+
+  services.pocket-id = {
+    settings = {
+      APP_ENV = "production";
+      APP_URL = "https://${pidDomain}";
+      TRUST_PROXY = true;
+    };
+  };
+
+  services.nginx.virtualHosts."${pidDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.pocket-id.settings.PORT}";
+    };
+  };
+}
--- a/machines/b4l/services/stirling-pdf.nix
+++ b/machines/b4l/services/stirling-pdf.nix
@@ -0,0 +1,26 @@
+{ config, ... }:
+let
+  stDomain = "${config.clan.core.vars.generators.b4l-stirling-pdf.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-stirling-pdf = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Stirling PDF app. Default:(pdf)";
+      };
+    };
+    script = ''cat $prompts/subdomain || echo -n "pdf" > $out/subdomain'';
+  };
+
+  services.nginx.virtualHosts."${stDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.stirling-pdf.environment.SERVER_PORT}";
+    };
+  };
+}
--- a/machines/b4l/services/victoriametrics.nix
+++ b/machines/b4l/services/victoriametrics.nix
@@ -0,0 +1,73 @@
+{ config, pkgs, ... }:
+let
+  vmDomain = "${config.clan.core.vars.generators.b4l-victoriametrics.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-victoriametrics = {
+    files.subdomain.secret = false;
+    files.adminuser.secret = false;
+    files.adminpassword.secret = true;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Victoria Metrics app. Default:(metrics)";
+      };
+      adminuser = {
+        persist = true;
+        type = "line";
+        description = "Username for an admin user. Default:(admin)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "metrics" > "$out"/subdomain
+      fi
+
+      prompt_adminuser=$(cat "$prompts"/adminuser)
+      if [[ -n "''${prompt_adminuser-}" ]]; then
+        echo $prompt_adminuser | tr -d "\n" > "$out"/adminuser
+      else
+        echo -n "admin" > "$out"/adminuser
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  services.victoriametrics = {
+    extraOptions = [
+      "-httpAuth.username=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminuser.path}"
+      "-httpAuth.password=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminpassword.path}"
+    ];
+  };
+
+  services.nginx.virtualHosts."${vmDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost${builtins.toString config.services.victoriametrics.listenAddress}";
+    };
+  };
+
+}
--- a/machines/b4l/services/vikunja.nix
+++ b/machines/b4l/services/vikunja.nix
@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  clan.core.vars.generators.b4l-vikunja = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Vikunja todo app. Default:(todo)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo "todo" > $out/subdomain'';
+  };
+  services.vikunja = {
+    frontendHostname = "${config.clan.core.vars.generators.b4l-vikunja.files.subdomain.value}.${config.networking.fqdn}";
+  };
+  services.nginx.virtualHosts."${config.services.vikunja.frontendHostname}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "${config.services.vikunja.frontendScheme}://${config.services.vikunja.frontendHostname}:${builtins.toString config.services.vikunja.port}";
+    };
+  };
+}
--- a/machines/default.nix
+++ b/machines/default.nix
@@ -6,7 +6,11 @@
  clan = {
    meta.name = "NewEdgeClan";
    machines = { };
-    specialArgs = { inherit self; };
+    secrets.age.plugins = [
+      "age-plugin-yubikey"
+      "age-plugin-fido2-hmac"
+    ];
+    specialArgs = { inherit inputs self; };
    inherit self;
  };
 }
--- a/machines/rigel/configuration.nix
+++ b/machines/rigel/configuration.nix
@@ -0,0 +1,13 @@
+{
+  imports = [
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "1b495eede9" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
--- a/machines/rigel/disko.nix
+++ b/machines/rigel/disko.nix
@@ -0,0 +1,50 @@
+# ---
+# schema = "single-disk"
+# [placeholders]
+# mainDisk = "/dev/disk/by-id/mmc-C9A551_0x157f3bd0"
+# ---
+# This file was automatically generated!
+# CHANGING this configuration requires wiping and reinstalling the machine
+{
+
+  boot.loader.grub.efiSupport = true;
+  boot.loader.grub.efiInstallAsRemovable = true;
+  boot.loader.grub.enable = true;
+  disko.devices = {
+    disk = {
+      main = {
+        name = "main-598d9832330c4a02b021deca9caa267b";
+        device = "/dev/disk/by-id/mmc-C9A551_0x157f3bd0";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            "boot" = {
+              size = "1M";
+              type = "EF02"; # for grub MBR
+              priority = 1;
+            };
+            ESP = {
+              type = "EF00";
+              size = "500M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/rigel/facter.json
+++ b/machines/rigel/facter.json
--- a/machines/vega/configuration.nix
+++ b/machines/vega/configuration.nix
@@ -0,0 +1,60 @@
+{
+  inputs,
+  config,
+  ...
+}:
+{
+  imports = [
+    (inputs.import-tree ./services)
+
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "1b495eede9" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.vega-public-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base public domain for Vega machine. Default:(glomglom.fun)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glomglom.fun" > $out/name'';
+  };
+
+  clan.core.vars.generators.vega-internal-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base internal domain for Vega machine. Default:(glom.newedge.house)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glom.newedge.house" > $out/name'';
+  };
+
+  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
+  system.stateVersion = "25.11";
+
+  # security.acme.defaults.email = "admin@b4l.co.th";
+  # security.acme.acceptTerms = true;
+  # services.nginx.virtualHosts."${config.networking.fqdn}" = {
+  #   enableACME = true;
+  # };
+}
--- a/machines/vega/disko.nix
+++ b/machines/vega/disko.nix
@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d14f9e";
+  vdev = [
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5RYRG"
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5S02X"
+  ];
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/vega/facter.json
+++ b/machines/vega/facter.json
--- a/machines/vega/services/nextcloud.nix
+++ b/machines/vega/services/nextcloud.nix
@@ -0,0 +1,34 @@
+{ config, pkgs, ... }:
+let
+  # ncDomain = "${config.clan.core.vars.generators.vega-nextcloud.files.subdomain.value}.${config.networking.fqdn}";
+  ncDomain = "${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.vega-nextcloud = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Nextcloud app. Default:(cloud)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "cloud" > $out/subdomain'';
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  services.nextcloud = {
+    hostName = ncDomain;
+    package = pkgs.nextcloud31;
+  };
+  # services.nginx.virtualHosts."${ncDomain}" = {
+  #   # useACMEHost = "${config.networking.fqdn}";
+  #   # forceSSL = true;
+  # };
+}
--- a/modules/clan/actual-budget/default.nix
+++ b/modules/clan/actual-budget/default.nix
@@ -0,0 +1,26 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "actual-budget";
+  manifest.description = "A local-first personal finance app ";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        ...
+      }:
+      {
+        services.actual = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.actual-budget.folders = [
+          config.systemd.services.actual.serviceConfig.WorkingDirectory
+        ];
+      };
+  };
+}
--- a/modules/clan/actual-budget/flake-module.nix
+++ b/modules/clan/actual-budget/flake-module.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    actual-budget = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.actual-budget = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/actual-budget" = module;
+      };
+    };
+}
--- a/modules/clan/actual-budget/tests/vm/default.nix
+++ b/modules/clan/actual-budget/tests/vm/default.nix
@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-actual-budget";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        actual-budget-test = {
+          module.name = "@clan/actual-budget";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("actual")
+
+    server.succeed("systemctl status actual")
+
+  '';
+}
--- a/modules/clan/flake-module.nix
+++ b/modules/clan/flake-module.nix
@@ -0,0 +1,28 @@
+{ inputs, lib, ... }:
+{
+  imports =
+    let
+      # Get all subdirectories in the current directory
+      dirContents = builtins.readDir ./.;
+
+      # Filter to include only directories that have a flake-module.nix file
+      # and exclude special directories like 'result'
+      validModuleDirs = builtins.filter (
+        name:
+        name != "result"
+        && dirContents.${name} == "directory"
+        && builtins.pathExists (./. + "/${name}/flake-module.nix")
+      ) (builtins.attrNames dirContents);
+
+      # Create import paths for each valid directory
+      imports = (map (name: ./. + "/${name}/flake-module.nix") validModuleDirs) ++ [
+        (import (inputs.clan-core + "/lib/flake-parts/clan-nixos-test.nix") {
+          inherit lib;
+          flake-parts-lib = inputs.flake-parts.lib;
+          self = inputs.clan-core;
+          inputs = inputs.clan-core.clan.self.inputs;
+        })
+      ];
+    in
+    imports;
+}
--- a/modules/clan/grafana/default.nix
+++ b/modules/clan/grafana/default.nix
@@ -0,0 +1,24 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "grafana";
+  manifest.description = "Platform for data analytics and monitoring";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      {
+        services.grafana = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.grafana.folders = [ config.services.grafana.dataDir ];
+      };
+  };
+}
--- a/modules/clan/grafana/flake-module.nix
+++ b/modules/clan/grafana/flake-module.nix
@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    grafana = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.grafana = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/grafana" = module;
+      };
+    };
+}
--- a/modules/clan/grafana/tests/vm/default.nix
+++ b/modules/clan/grafana/tests/vm/default.nix
@@ -0,0 +1,42 @@
+{
+  ...
+}:
+{
+  name = "service-grafana";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        grafana-test = {
+          module.name = "@clan/grafana";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.grafana = {
+        settings = {
+          server.domain = "grafana.localhost";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("grafana")
+
+    server.succeed("systemctl status grafana")
+    server.wait_for_open_port(3000)
+    server.succeed("curl -H \"Host: grafana.localhost\" http://127.0.0.1:3000 ")
+    server.succeed("grafana cli -v")
+  '';
+}
--- a/modules/clan/nextcloud/default.nix
+++ b/modules/clan/nextcloud/default.nix
@@ -0,0 +1,60 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "nextcloud";
+  manifest.description = "Nextcloud server, a safe home for all your data";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        clan.core.vars.generators.nextcloud = {
+          files = {
+            adminpassFile = {
+              owner = "nextcloud";
+              group = "nextcloud";
+              secret = true;
+            };
+          };
+          script = ''
+            xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassFile
+          '';
+          runtimeInputs = [
+            pkgs.xkcdpass
+          ];
+        };
+
+        services.nextcloud = {
+          enable = lib.mkDefault true;
+          hostName = lib.mkDefault "localhost";
+          database.createLocally = lib.mkDefault true;
+          config = {
+            dbtype = lib.mkDefault "pgsql";
+            dbhost = lib.mkDefault "/run/postgresql";
+            dbuser = lib.mkDefault "nextcloud";
+            dbname = lib.mkDefault "nextcloud";
+            adminuser = lib.mkDefault "admin";
+            adminpassFile = lib.mkDefault config.clan.core.vars.generators.nextcloud.files.adminpassFile.path;
+          };
+
+        };
+
+        clan.core.state.nextcloud.folders = [
+          config.services.nextcloud.home
+        ]
+        ++ (
+          if config.services.nextcloud.home != config.services.nextcloud.datadir then
+            [ config.services.nextcloud.datadir ]
+          else
+            [ ]
+        );
+      };
+  };
+}
--- a/modules/clan/nextcloud/flake-module.nix
+++ b/modules/clan/nextcloud/flake-module.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    nextcloud = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.nextcloud = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/nextcloud" = module;
+      };
+    };
+}
--- a/modules/clan/nextcloud/tests/vm/default.nix
+++ b/modules/clan/nextcloud/tests/vm/default.nix
@@ -0,0 +1,36 @@
+{
+  ...
+}:
+{
+  name = "service-nextcloud";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        nextcloud-test = {
+          module.name = "@clan/nextcloud";
+          module.input = "self";
+          roles.default.machines."server" = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.nextcloud = { };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("phpfpm-nextcloud.service")
+
+    # Check that garage is running
+    server.succeed("systemctl status phpfpm-nextcloud.service")
+  '';
+}
--- a/modules/clan/nextcloud/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/nextcloud/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age15md5wyqzn4jwc7pgyjkjhcd6nfuct9gxgrl7x5qxdzgvrh32ruvqmk3wfq",
+    "type": "age"
+  }
+]
--- a/modules/clan/nextcloud/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/nextcloud/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:LtzjjbqrzdiFqw5sEI6nYAjLuWJOqiEcO9T8POnjDHK0l55RAxLLzlc1w2DTRPd46vAFy04IYgPiwwQJj8WuYdgjymXTyVqGvNA=,iv:q/L8DpR9E/NNIW2cNFft/e65xGHK9HN19W8ISd6lgdA=,tag:7XFi8VgfG40I0wSHqasXSQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxMGF5Q3V5T29ub09XL0Mx\nUVBlSUc2TnRkaGxoQW5uMzUzd04xOWFYRkNBClZ3eVU3dEovWDVZSkR0bnRRY3Bn\nOFNQWDFRckFxVlpvTVRsa01ad0NkRDAKLS0tIGd2UDV3cWZTTkF6V3p4Y3ZKOXdo\nY1doTFoyT2dSaG93b0lGb01YaExDTXMKe4wjgOysbF+NKlnmQgard1N6Xhazex7y\nCuvGnbcy2TLxDNhjdgjoOxUV1xQWnwoYOF1QDbL7l2k59iE3lzUG8Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-29T03:24:54Z",
+		"mac": "ENC[AES256_GCM,data:s6W/U0FekNcDdKk9/L54Q0V/XZhrDQwP/moNFbxbucD0sAXzEYMWbWTDNCz6/NVtqr3A++Vk65LFr8bgWuh4uxekXrLDN0Pyb7AJpDkp7IlE6ijT3cQk+OVpcpTt+FgFt3JZLyrmOL/H638sg4c0bptN+Fj8LrNXFdauWCDBlkA=,iv:oiEPi/zvH0m312ezyT0SnUavlX47pduzyz8NIwuCaNs=,tag:e6KkwWAJSZbiliKm4VT6yw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/nextcloud/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/nextcloud/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/nextcloud/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/nextcloud/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/machines/server
+++ b/modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/secret
+++ b/modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:NVuUW3KNwUUs/Cwswvi4kDo8GZM453y/TRlHWut3OA==,iv:7rSqlQxgJCRecmpNrmGZeT03f1eOuO+W8O2QBkoKdXc=,tag:F9WkMVBV8zh4L86sBA4LVQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age15md5wyqzn4jwc7pgyjkjhcd6nfuct9gxgrl7x5qxdzgvrh32ruvqmk3wfq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBic1hPNFdyYzE5UndKNEtj\neDdJc2RuN0Y5WTB2d1h0ZFVJRUpnTnA3TW5JCklqUzFucVNKU3JLeG5JVG1KR05q\ncVg2OFBRNW1RZ0pwWnc2eFlmYzEzZ2MKLS0tIEJod0QvMHBZVlpxMldGdTRmRTNB\nQmVOQ2U2bDd0WTQvRFJnZ2NybFJoTFEKiimfshCLluicTeVyLbFQDm+8JMXBx/n0\n9NwAb4mJwQ8B0qlFsdiXZU4pP02aw7f/NH4hX6BvBBw+SP42plkmfw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFV3FmNlJHeEhKT3NUVG9K\nNXNGdDlsVmtnWng5dGlIaVNRdXlaWVdNdmhrCi9KLzZYVWxpanlLUzJKVDlRSHlM\nRFFtditYZ1lXY3pFeUNXTk9OVitSd3MKLS0tIERVWHFNZitETlRuNEpDS1FxVS9C\nMk5UNlBjTkNRTFc5T0J1TTlZZm1ZOG8KWwGkEKK8nEWib4Va9lrVFnHU0m0zPjFE\n/3eMObt62ngwrmbAq0bNe2gFiC/OhLDf5BixldSgSeu9AenRz3Mdjg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-29T03:24:55Z",
+		"mac": "ENC[AES256_GCM,data:B3LUWx3g6P5R006NrsFMZNc466qFadfnlXS5hitToZrNEf9VN3NlINwi2liYf9JjgSXXVV6IybVoW7LYDFRNRrG2QXfvWEfozVr/JtjvufcmuyM96PbzURUfOKndau1GbJagUO4MH3l3AEvkZnSRR3nIKWGYZDiJTNo8yRIK7nw=,iv:IXdWo8y9jPYgII5HRJ6sRxb3WOcKdifDsZoU4tusDuQ=,tag:xdqph+Y2nMYNDD3hbxCcXA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/users/admin
+++ b/modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/modules/clan/paperless/default.nix
+++ b/modules/clan/paperless/default.nix
@@ -0,0 +1,24 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "paperless";
+  manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        ...
+      }:
+      {
+        services.paperless = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.paperless.folders = [ config.services.paperless.dataDir ];
+      };
+  };
+}
--- a/modules/clan/paperless/flake-module.nix
+++ b/modules/clan/paperless/flake-module.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    paperless = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.paperless = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/paperless" = module;
+      };
+    };
+}
--- a/modules/clan/paperless/tests/vm/default.nix
+++ b/modules/clan/paperless/tests/vm/default.nix
@@ -0,0 +1,38 @@
+{
+  ...
+}:
+{
+  name = "service-paperless";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        paperless-test = {
+          module.name = "@clan/paperless";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.paperless = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("paperless-web")
+
+    server.succeed("systemctl status paperless-web")
+    server.wait_for_open_port(28981)
+    server.succeed("curl http://127.0.0.1:28981")
+  '';
+}
--- a/modules/clan/pingvin/default.nix
+++ b/modules/clan/pingvin/default.nix
@@ -0,0 +1,23 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pingvin";
+  manifest.description = "A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient file sharing.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        ...
+      }:
+      {
+        services.pingvin-share = {
+          enable = true;
+        };
+
+        clan.core.state.pingvin-share.folders = [ config.services.pingvin-share.dataDir ];
+      };
+  };
+}
--- a/modules/clan/pingvin/flake-module.nix
+++ b/modules/clan/pingvin/flake-module.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pingvin = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.pingvin = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/pingvin" = module;
+      };
+    };
+}
--- a/modules/clan/pingvin/tests/vm/default.nix
+++ b/modules/clan/pingvin/tests/vm/default.nix
@@ -0,0 +1,42 @@
+{
+  ...
+}:
+{
+  name = "service-pingvin";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        pingvin-test = {
+          module.name = "@clan/pingvin";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.pingvin-share = {
+        hostname = "share.localhost";
+        frontend.port = 3000;
+        backend.port = 8000;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("pingvin-share-frontend")
+
+    server.succeed("systemctl status pingvin-share-frontend")
+    server.wait_for_open_port(3000)
+    server.wait_for_open_port(8000)
+    server.succeed("curl -H \"Host: share.localhost\" http://127.0.0.1:3000 ")
+  '';
+}
--- a/modules/clan/pocket-id/default.nix
+++ b/modules/clan/pocket-id/default.nix
@@ -0,0 +1,45 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pocket-id";
+  manifest.description = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        clan.core.vars.generators.pocket-id = {
+          files = {
+            encryption-key = {
+              owner = "${config.services.pocket-id.user}";
+              group = "${config.services.pocket-id.group}";
+              secret = true;
+            };
+          };
+          runtimeInputs = [ pkgs.pwgen ];
+          script = ''
+            pwgen -s 32 1 > $out/encryption-key
+          '';
+        };
+
+        clan.core.state.pocket-id.folders = [ config.services.pocket-id.dataDir ];
+
+        services.pocket-id = {
+          enable = lib.mkDefault true;
+          settings = {
+            ENCRYPTION_KEY_FILE = config.clan.core.vars.generators.pocket-id.files.encryption-key.path;
+            PORT = lib.mkDefault 1411;
+            ANALYTICS_DISABLED = lib.mkDefault true;
+            UI_CONFIG_DISABLED = lib.mkDefault true;
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/pocket-id/flake-module.nix
+++ b/modules/clan/pocket-id/flake-module.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pocket-id = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.pocket-id = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/pocket-id" = module;
+      };
+    };
+}
--- a/modules/clan/pocket-id/tests/vm/default.nix
+++ b/modules/clan/pocket-id/tests/vm/default.nix
@@ -0,0 +1,34 @@
+{ ... }:
+{
+  name = "service-pocket-id";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        pocket-id-test = {
+          module.name = "@clan/pocket-id";
+          module.input = "self";
+          roles.default.machines."server" = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.pocket-id = { };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("pocket-id")
+
+    # Check that garage is running
+    server.succeed("systemctl status pocket-id")
+  '';
+}
--- a/modules/clan/pocket-id/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/pocket-id/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1jvhs79a367ynhupy6gndyafg5f6wzrsa3p3r27d8y4zpvlp5vd6qwysnc2",
+    "type": "age"
+  }
+]
--- a/modules/clan/pocket-id/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/pocket-id/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:MheRz91AzSqUV0gz3PHdort06igblp8dVku2GIeXbBiTpG3Dnlqzw6QEvTeRVtZ4ol0gHS8CQQ4Lc4H9IyHGiTfJkSUM7pXY/vM=,iv:mMibIfA6gqvJlbau9sKkjRoYrDcqCpTG0b+jrZCHIkE=,tag:MN5I9AO1U7sJfq/9GxSFCg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1dnVqRXVibTFYeUlsc09J\nQnRSRVE0NklWWFNlbHZaaWJ3dDlEaTJKVkZnCnJEZHhoSzd3T3NEVjFjY0NkRFNq\nL1owbmR0SENSWVQxOXVlNWJFb0JsSEEKLS0tIHhESEI2Y3MzMU9WRzhYNWZhUUd2\nTVpldG5qbDF6UG9jNnBRTnZRdzAweDAKl4FpFTp7NyTHXJEF7tIO0CnsgTY4maJ2\n7KfQRwQuhW73WqVdzJSZ7i/Xapwglx0ISBvSEDgBTiQhFlBLCMEzYg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-29T09:50:44Z",
+		"mac": "ENC[AES256_GCM,data:lZ7SAQkkH441L3Ss9nEI1fm6SgcysIcOBg9it0m80CiNhtittsFNcP7l0ApkIBQLhMsan93bLMG3kcDKzqxld3XDRPUwlJkKElh8Dc8q7qqtOqgKNnsFDcx4Zh3HdiTPywyIBnUMYAul4tVPpEzqh1GSD1GF9fsBxLiwxBwalY4=,iv:wmhz1k5LMNNxuacQj+A5FryJwzqxpXf5AnFoeL1TF4k=,tag:cl5OcxGYvC6DGQDRuhqRRw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/pocket-id/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/pocket-id/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/pocket-id/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/pocket-id/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/machines/server
+++ b/modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/secret
+++ b/modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:o1BHipQXow25uobhojeSIvSaIM4SiOtjfpNBi11E7kRX,iv:mheOssj84dp1+QAG0rpdyaf5O4WWaTWh1y/DC/I9nnA=,tag:M8zSZ4GWwy5rOcOEOBbwIA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jvhs79a367ynhupy6gndyafg5f6wzrsa3p3r27d8y4zpvlp5vd6qwysnc2",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXaXFvL0JES28rUkhNT3Bj\neDVYZlNubC8wV1VGTHN1Vzh6NEV3YWI3L3pJClh2T0FhQURXRkRJSnFVYjVsZkdq\ncWRFL1crVm1EK2NHNUtlc1RMVlZ5aWMKLS0tIFczWUcxTWFMdkhXb2ZTZlRSNDBT\nNmxWak50M1JTV2R3M0FXclRGc0JuVjgKtsxU2a3DNhe9CeJFK+HK7lFhrpV7UuES\nqasLv4crL7+4eJFhmUxVwzT0ubPAuG3CBMbbmrYmAs2CUXWtcmqGMA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0TGwzeUNLbkJ4bFBPVjJy\nd3pLTWRPVytrK1plQ3kzd1ZOMjBtcGJjY25nCk5mNDRxNmJjTHh4a2pBSldvQ0Y5\nUXVPbWZ1WW1QcU03MWtuL29udGFUQ1EKLS0tIHFSY1VZUGJFanhyZmN6WHJKTzEr\nbjBkVDNJUUZNZHhjSDlDZ3Z4Y0d3Q3MKHm3Ar31B2RviANl+tCeNmtYvQp5hVdui\n9Khkd3R6MshF4rZWrWhD9vea1RX9ugJJawCTU3+4zFDEWQ6XQ+tpTw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-29T09:50:44Z",
+		"mac": "ENC[AES256_GCM,data:B3iNE0/ve2EazWNQJ6MhSaa3EAmte5GUJrVjLB7ysIoe+pf7kQy9HE2ObEypFezvbfBYAbXd+XIq8J+jTjh4X11i6/BDNsvFQKuYbTLaK+dqZzeuOQU3ntTQuhyx5qdKyXq5FtHYyJI9XsYvSFRHe2UYy4L5i6LvMoc3ka/vUHI=,iv:mXuhXp63D1UkBJX5U7RY+NqYsU5SkolDABrSDRXegFk=,tag:LJ/BnU9xKMQyr+nAAHnGFA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/users/admin
+++ b/modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/modules/clan/stirling-pdf/default.nix
+++ b/modules/clan/stirling-pdf/default.nix
@@ -0,0 +1,23 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "stirling-pdf";
+  manifest.description = "Your locally hosted one-stop-shop for all your PDF needs.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        ...
+      }:
+      {
+        services.stirling-pdf = {
+          enable = lib.mkDefault true;
+          environment = {
+            SERVER_PORT = lib.mkDefault 8080;
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/stirling-pdf/flake-module.nix
+++ b/modules/clan/stirling-pdf/flake-module.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    stirling-pdf = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.stirling-pdf = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/stirling-pdf" = module;
+      };
+    };
+}
--- a/modules/clan/stirling-pdf/tests/vm/default.nix
+++ b/modules/clan/stirling-pdf/tests/vm/default.nix
@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-stirling-pdf";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        stirling-pdf-test = {
+          module.name = "@clan/stirling-pdf";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("stirling-pdf")
+
+    server.succeed("systemctl status stirling-pdf")
+
+  '';
+}
--- a/modules/clan/victoriametrics/default.nix
+++ b/modules/clan/victoriametrics/default.nix
@@ -0,0 +1,25 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "Victoria Metrics";
+  manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      {
+        services.victoriametrics = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.victoriametrics.folders = lib.mkDefault [
+          "/var/lib/${config.services.victoriametrics.stateDir}"
+        ];
+      };
+  };
+}
--- a/modules/clan/victoriametrics/flake-module.nix
+++ b/modules/clan/victoriametrics/flake-module.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    victoriametrics = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.victoriametrics = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/victoriametrics" = module;
+      };
+    };
+}
--- a/modules/clan/victoriametrics/tests/vm/default.nix
+++ b/modules/clan/victoriametrics/tests/vm/default.nix
@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-victoriametrics";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        victoriametrics-test = {
+          module.name = "@clan/victoriametrics";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("victoriametrics")
+
+    server.succeed("systemctl status victoriametrics")
+
+  '';
+}
--- a/modules/clan/vikunja/default.nix
+++ b/modules/clan/vikunja/default.nix
@@ -0,0 +1,32 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "vikunja";
+  manifest.description = "The to-do app to organize your life.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        ...
+      }:
+      {
+        clan.core.state.vikunja.folders = [
+          config.services.vikunja.settings.files.basepath
+        ]
+        ++ (
+          if config.services.vikunja.settings.database.type == "sqlite" then
+            [ config.services.vikunja.settings.database.path ]
+          else
+            [ ]
+        );
+        services.vikunja = {
+          enable = lib.mkDefault true;
+          frontendScheme = lib.mkDefault "http";
+          frontendHostname = lib.mkDefault "localhost";
+        };
+      };
+  };
+}
--- a/modules/clan/vikunja/flake-module.nix
+++ b/modules/clan/vikunja/flake-module.nix
@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    vikunja = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.vikunja = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/vikunja" = module;
+      };
+    };
+}
--- a/modules/clan/vikunja/tests/vm/default.nix
+++ b/modules/clan/vikunja/tests/vm/default.nix
@@ -0,0 +1,39 @@
+{
+  pkgs,
+  ...
+}:
+{
+  name = "service-vikunja";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        vikunja-test = {
+          module.name = "@clan/vikunja";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.vikunja = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("vikunja")
+
+    # Check that garage is running
+    server.succeed("systemctl status vikunja")
+
+  '';
+}
--- a/shell.nix
+++ b/shell.nix
@@ -8,7 +8,10 @@
    {
      devshells.default = {
        devshell = {
-          packages = [ inputs.clan-core.packages.${system}.clan-cli ];
+          packages = [
+            inputs.clan-core.packages.${system}.clan-cli
+            inputs.clan-core.packages.${system}.generate-test-vars
+          ];
        };
      };
    };
--- a/sops/groups/admins/machines/b4l
+++ b/sops/groups/admins/machines/b4l
@@ -0,0 +1 @@
+../../../machines/b4l
--- a/sops/groups/admins/machines/rigel
+++ b/sops/groups/admins/machines/rigel
@@ -0,0 +1 @@
+../../../machines/rigel
--- a/sops/groups/admins/users/berwn
+++ b/sops/groups/admins/users/berwn
@@ -0,0 +1 @@
+../../../users/berwn
--- a/sops/groups/admins/users/davhau
+++ b/sops/groups/admins/users/davhau
@@ -0,0 +1 @@
+../../../users/davhau
--- a/sops/groups/admins/users/kurogeek
+++ b/sops/groups/admins/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/groups/admins/users/matthewcroughan
+++ b/sops/groups/admins/users/matthewcroughan
@@ -0,0 +1 @@
+../../../users/matthewcroughan
--- a/sops/groups/admins/users/vi
+++ b/sops/groups/admins/users/vi
@@ -0,0 +1 @@
+../../../users/vi
--- a/sops/machines/b4l/key.json
+++ b/sops/machines/b4l/key.json
@@ -3,4 +3,4 @@
    "publickey": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
    "type": "age"
  }
-]
+]
--- a/sops/machines/rigel/key.json
+++ b/sops/machines/rigel/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+    "type": "age"
+  }
+]
--- a/sops/machines/vega/key.json
+++ b/sops/machines/vega/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+    "type": "age"
+  }
+]
--- a/sops/secrets/b4l-age.key/secret
+++ b/sops/secrets/b4l-age.key/secret
@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:wcR+EaC64JexQCShFc1I6mncHGQ+bMfjAOMnoTq3/bOa0T+NCqcDmrxoHGdR2q/TV453uMiokeAm+uggpZNQ9/1Kf5mX2KQsJtE=,iv:FcyIA1uAOISu/+mfTtdQ8lgyieoCObbZ6BMvkmIVoto=,tag:ew7jg+oXP0JUBBfDJoir7A==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsdnlFYjVtdGhHSmczV0Nk\nN0IwL0dLVTdkTWhIK2tmV1E5bE1wZjcyZkVnCkV4VEhlL2lyVkxXMzFQVTZ5dHBY\nSUJWRUh2MjgwZ2RmaVRFVHdmQm00ck0KLS0tIG1oTlE1alJDK0FuNGhDQmcrKzZk\nWDhZNEJIWmd1QkVJc0pLemVOSjhqQ2cKMDYUbT8wQ89mNBJFYp2igHB2aQtxBFtM\nilUU83E0stiVKWHrCnBlmQng4UDr0rPxOWa+JpbR4bSbLPXyKIPtrw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxZmVHaWRsa3Y0TGNIM0dx\ncThRc09ZdU5YVkpWdTdzTlRXa3pjMTRVd3lNCk4waktab2lzNDJhZ0hiOTh5MFVu\nTzR4clA5Mko4Y0o3cFMra0IyTUUydU0KLS0tIC9RWXUvMEduUkp1VXpSdjNUUkQ1\nN1NuTFY4ei9TdkVjK1lUQldOVG9sc1EKFwRbPZyd7TARXkvHD74DGqwvxOjIty+X\nBHFw8H5CWp2FCCQ+9bebMamG3ShzhM21Hju9uVbMXA/WACU/9dAJhg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQ1JCN01wWHVETDM5Q3Y0\nUDNPanFKY2pjeXZJTlFMQWtIYVluMWZCZ1U0CjNwSmEvTkNZbWdmNlRBbXE5Vzhs\nbFdxMDNUclZETlNDeFlZeHBDV0xoR0UKLS0tIGF6ZlpsRWRJajk2dlFKR25RRkdG\nL1FOQWRIcE1XNkJSWkhLSFBIRHhuWVUKEOkLKs2OFUwGMXeo9Fn/3cEZGgMLbXnO\nthqX0FRS22BE092jx2EuxK1HQYo/iTojPwg0LP692R9DZMZ1bKfqQw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOekRKMG5VdWpmcm96WEdK\nTnoyL3piaCtxVnN5b1E2RXh1SzZ1cGU3OFdrCjNNMGUxMDF6NzFUNFpPb0VNa2Q1\nL1VacitPRzU3MHh3dXpTNWxYeGFxeFkKLS0tIHV3TUkxTG5mQ3haZVRSTTB2bFBk\nU0dDaGQ0ZjhEOGdqZTFEQXlPczZWdm8KiDHBQQRL4qTnStFr8nmdhet+7gBELCvd\noRvky46oEsS36L9o477ZH134wrSqAcD0NCOO06hA/jEXNvLFig9yHw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T03:23:25Z",
--- a/sops/secrets/b4l-age.key/users/berwn
+++ b/sops/secrets/b4l-age.key/users/berwn
@@ -0,0 +1 @@
+../../../users/berwn
--- a/sops/secrets/b4l-age.key/users/vi
+++ b/sops/secrets/b4l-age.key/users/vi
@@ -0,0 +1 @@
+../../../users/vi
--- a/sops/secrets/rigel-age.key/secret
+++ b/sops/secrets/rigel-age.key/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:WJO4V1cuzrxw1tg034RNG4f7X2N6pLFE1VIsjkWfUoKSScBbi8e4m62M5WpM6P7f/2/FHxQWRhWcwa3clHXoCCQmNa7j8UIkkik=,iv:qcqQBaJQkpMJimh7xU0u6p9v9uqf1KyvMlePP2k6e78=,tag:5XuWJcODVTRYM6twHEwOxQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWk9KTEJHR0d1WTRDWGFS\naW16L3E1WEFBNFpwSVZ3T0xUMEZBcXBrSGs0Cllua20yVHV2djEzOE55Qk5zKzlp\nQmo3UVMreVFKVTJTVGl4ajdVZ0FZNk0KLS0tIGF0VWVJNGU0M05ZajF1Q1NscHpC\naG1vblk4NmY2KzIzN1V6bWVrYW01OUUKAfMKTPzIhVd0W8yfob9No53RnaNC67Fy\nMohQHZ38caz8LhqFfDzm1vm8xi1F8kcaW6ugcPH532fdDxkS6dfnoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6YnFMZ3F5cjJDa1poTGpD\nRURZYVZNLzByMzgwZytWZDhBaVFIbndmbldzCjlvYnRVTnNwRWVKRG40MWJrQXJz\naENEWWh3TFE4Uit2ODhncWJHZ1hvdk0KLS0tIFlIUmlqVWRlQzRxcFZHMFlzVmJh\nYkdBSzJlT0pnYlRacmhINFRyZzVIdVEKJJL7XFqZafNQmfzwwjVDMw/cPob830oI\nsVQe1HaUK7IujWTCbD8l0uoqsODdaWOMDVwxuiKr+yHY4iwar+rI6w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-25T02:12:20Z",
+		"mac": "ENC[AES256_GCM,data:36VgVubO5xybFuFu7lX73XBlODhUTg2sLfi1e8fqHkPPwtYylgORuXyypsZOTF0LSJS1VbU0NZjU9fvQpjMY2Sl7BxdqQKfz0OG8iuYloHmQM26QQ9TPDYIHvIJrCYIdKJSl83IqLZq+IWbInTha3xrTeH7MlgWII3mJSCPQiPM=,iv:7eR2YYBbApScElcNxg77F7rb6OLuc+2x1IVN56aJADM=,tag:LLfCm1jGkvs56SfkjqRZXQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/sops/secrets/rigel-age.key/users/berwn
+++ b/sops/secrets/rigel-age.key/users/berwn
@@ -0,0 +1 @@
+../../../users/berwn
--- a/sops/secrets/rigel-age.key/users/kurogeek
+++ b/sops/secrets/rigel-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/secrets/vega-age.key/secret
+++ b/sops/secrets/vega-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:3WgicB2mjBGo3YWFG9mVBYnapj1ZoH6ohwxIUcA9byWVTCS0ZKyIJZlPeyvKWEzX9ZnxgLd1DPDfFfppwsnkxYOvEJsBAf0AanI=,iv:OKSKHu3h8Kl/qAlQ1xiYElDjaql0FdIWVPJYicfvH8Y=,tag:Xa9RfEBC8l8VgHbJHTr4jQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCK0NJR2VzVU1xVGZBd3Fh\nU0xEdmFhTllBU1dpMDM4V3NjTjB6dWxoRGdNCmdMS0duUUV1bVdtVmF1Nml5YTRV\naHpLMExzTGxKclJDZkl2UWdFUHRxY2cKLS0tIER1ajBQdEFuTDQvSERQTDZialBp\nN2RJdS9tVk8wb1lMclNrQzBCTWx3UUUKVKrK0KHOAcd0oMlzeCbN9xX35QKG+za2\nMqEmG/duejDVVzxjIcMBhsXD3EytUMw6IJ/dQtGYS3lJUXH0tiq1Iw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:12Z",
+		"mac": "ENC[AES256_GCM,data:Nvb0JIeARvwzDQSiUkqNMsTFQpGLDTtM0v8ZDyYzQY9yloS1AsGtehbWPgq9Rzr6L5I71bubw8LWpa6UnlqQSrC8GLOy+ojvu/KknkNaVrWQFCw0BDJk4ypBUaQk8n3dGjkG8UUvKCy7dkwwkP3nNbsQ8HA9R5zSYHNakZmWpes=,iv:iozu9qC8nY2XCPG5aBPihCjoNIxXV3kKLcoesFYPSj4=,tag:NkqiJVwj35VY5teW7eTtsQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/sops/secrets/vega-age.key/users/kurogeek
+++ b/sops/secrets/vega-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/users/berwn/key.json
+++ b/sops/users/berwn/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+    "type": "age"
+  }
+]
--- a/sops/users/davhau/key.json
+++ b/sops/users/davhau/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+    "type": "age"
+  }
+]
--- a/sops/users/matthewcroughan/key.json
+++ b/sops/users/matthewcroughan/key.json
@@ -0,0 +1,14 @@
+[
+  {
+    "publickey": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+    "type": "age"
+  },
+  {
+    "publickey": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+    "type": "age"
+  },
+  {
+    "publickey": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+    "type": "age"
+  }
+]
--- a/sops/users/vi/key.json
+++ b/sops/users/vi/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+    "type": "age"
+  }
+]
--- a/vars/per-machine/b4l/b4l-actual-budget/subdomain/value
+++ b/vars/per-machine/b4l/b4l-actual-budget/subdomain/value
@@ -0,0 +1 @@
+budget
--- a/vars/per-machine/b4l/b4l-grafana/adminpassword/groups/admins
+++ b/vars/per-machine/b4l/b4l-grafana/adminpassword/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/b4l-grafana/adminpassword/machines/b4l
+++ b/vars/per-machine/b4l/b4l-grafana/adminpassword/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/b4l-grafana/adminpassword/secret
+++ b/vars/per-machine/b4l/b4l-grafana/adminpassword/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:9v56r2ZaEixMv61TGiCOmeAru2v9ZDUJe6v+Y5TdzfV5Rg==,iv:8kvq06/hfad+9af2PW+50l6Pzs99E5E2x8m3AIz5y90=,tag:aemnUje/OlGc6Hdzzkfdmg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaQnd5emFNTEhDeEFBMXM3\ncDB4ZThGb3RDTWVqMG9KQlcySnpTTHFGS0JzCkkxZk5KY0lHelc4V1FDQTRVZmJk\ndldYQnkvMWtWanpsVHJFQ01nMDFRRUUKLS0tIHlRM050cFArcVVEL1R6YVBYMi9z\nWTZLMG82a0MwSEp0RHQ5ZUVXUHUvUEEKwar6u4Hdcz2Wz/AYpK7jY74Ksr6DyhPG\nc8aEAMcICMiO7kQn049JSbUuOKu24cY1zColB0ANwrG0RRX6s2oTsg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdPVWcyRlVS\nblB0RmJ3MjRiazZ0emFkY0RaeUF5cHEzQnRpdHcwTlJWeFEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp4QVRIYVZpNlM0MExNanlNUjdGUkly\nc3dwVWhZWWZWRkFlWXFzT3k4WS9BCi0tLSB0TlBWSjJ0NmVYVmVNUjljR1VPdHZY\ndVJpLzJnTk5mUC9rNXlHZmh1VU84Cl0Lz74FOE6hWFh1BtmeFTBgrCEhf5znSAfI\nDqCy/WNgyLWuqM5TPMu6+S2JDop1xUpCarW+jTNOFKSZe3imPFY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtR0NIYTg0ZUw4dVBaS3Uz\nOVoxZi94Nk9SQkdFWks0YUtDcXpIU1Uzc2wwCkJndUV2eS9hY25JZi9VR203Wjlu\nOXFQYUhwaW5rbFBOczlXU0xPZ3AyVXMKLS0tIEdydy81ODFRbjk4LzRCOUJMTlg3\nWU1VU1Bra1hOajc5R2ZBaVhmWjEyZ1UKMyDHIhC4vT5mjLEq36hDx42okoEcd52i\ncT/wolZOSS/D3oA1Si3cV3ls4UCvJvMTC9VnxjX8UNHw7Qjji8G0eQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWaHBPa0pCNERiMGV3amwv\nNkN0REtUSlZhRGY4WDhJT2hqaFVwT3BvUm44Cmp4dU1aNGpPMStyMjJUOG44NWJG\nNjFKVUlHZWg0SnlUWVVNeVZ4WWJ1TG8KLS0tIFNaMklraktRRXRCaUxzZTVyTVAx\nakcvY05SbFM1NmxwQTZVbi90dkV5dEEKj/ibSS0aqnYPmqpHmmGIbJLoMXwQfvkK\nYL7XFp0s1GzSvXHeZ8o3J0O12A4CDKsI5zgvNFPE24O9oqD4wDFa+A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6cmtaZ3V1VHpTTDhPL3ZW\nSFZhbWtKQ0k3M2hlR3J0b0YyeGRVN1RDUzNzCkNuWmR2MTErMmZJZUYrSzJ1TEVs\nNktOUEF3RjRKb203RC8rNjI5QVlVZlEKLS0tIHQvS01hVjh3ckYrTW0ya2VRVm5N\nQ25wTFRuV21PVHpob0dHVzQ3U2hCZW8KY7sucGDzga1YvOXwHOvkEJbry2rLalfX\nDnM2CyUnDKv84pZsiY4jI/7sFrWl6UITpBEV90RGnPz5Hu0NuOTwqw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBjV1lmS3gw\nL3ZCc2pUblZmbXRZQXBsRFErRG16andwOFNZQ1pzditKR0UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBZ3Q1ZlZ2a0RkMGxtTGpXQk0wNHpG\nRUpFQjV2S2psZERJVUp2MGlqRk9VCi0tLSB5OG5kcXVoWGNRNDZWUjZKQXVZVXkx\nQTZGRjdkU0FNTFBRM2NkKzkrNS80CnBwMVRKUu+WxbYWKYLdXPRAAHS8bNPTlZa1\nd1FJnQJZcTv6RKQMCD1l2RaXGAt8tSkDQ6L6dKFhzkODjKfhCiM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGZhSStlUkIr\nNGdTZldnY1ZZaHpDVFZoeEJ3aFNmR1ZPTmlLa2Z6Q0ltRE0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpMbmorRU1lVEZuSzJtbmxzTTlBU0dr\nMDhsTEZML3F1NmlhcXovN1hYc0owCi0tLSBkVmRyOHkvdFYwL0t3Ti9ubEd4TXlJ\naUtETERJV0ZaL3Z1NTFNVGZ6RURBCksOxShfsYmRCkROmLNqbYACLRSRJRgtkxRM\nJSLcsuO4+TrZMXWxaNjICMPhq+L6AkUUthCl19xhT2+XmvFB0Hc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOR2t1Q2c0aFB3ZUsyLzB0\nbUFkblB3UlpOREpZdzM3dXI4bktVN1FOMjFrCk9rdmNvTHlzajRrZ3FoYXBqMWZL\nbnhLdnhvRm5ETkRETmlqSXF1N1RKazAKLS0tIDlZNXpNME9mQkRQTW1TcDRUd2pL\neW5RV2g4VE5HQ0IreVowZjRLdkNpbzAKzd6eJIpFpXptOANWTVHZNW4efd+nBABA\nvSWpJpDerYev62P3lvq8V1pvypqCjmNf5hKTWG5aAX+mzXqJaK0aFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETkZJTzFSUlNHTVRCdFBS\nTWVLYzYvc29aNDZWVjc1NVZ1aGRtTWhzdlJvCk43RUpGTC9vb2hRaVRlT2xpaGNh\nU2JrWmp0VnB5NGpha3BndE9YTkluZ1kKLS0tIEQyK1dVMzFaaWtSUkI4WnRJMjlY\nbGF5M2tlL1lVVTdQVHRZbVlNcjBGM1kKdy6B+grOB4Bt14aEi4+XfLIQTNIGQX/W\n4v4CGKs+0vYaaCPS87rcuR2z3jf4hkGa4qNMA3+fxE9UZBNiYWI6dw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-08-01T09:25:47Z",
+		"mac": "ENC[AES256_GCM,data:nEaCXu003Y/kwtNrBT+reXOZfTOjhqxUXLvUFa4RFrFREgxIsNkqi80GyDFAaBbgAFA5B71Ozwh8Ml0g3TJ15DsoLkaUgrLR9gXIuh4FoDpFKmvFzUT7nm4Ac003b2bkaMPVNXRU24O+JVgK9U5tmKfqmEkRnlY5MTLFO5EGgnY=,iv:3RpMM6CjtWJSqY8T++2GIV4b3kN724h/ZhuS1U8lJGY=,tag:tkL5+aU06xF4LUeMoq6qoQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/b4l/b4l-grafana/adminpassword/users/kurogeek
+++ b/vars/per-machine/b4l/b4l-grafana/adminpassword/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/b4l/b4l-grafana/subdomain/value
+++ b/vars/per-machine/b4l/b4l-grafana/subdomain/value
@@ -0,0 +1 @@
+grafana
--- a/vars/per-machine/b4l/b4l-nextcloud/subdomain/value
+++ b/vars/per-machine/b4l/b4l-nextcloud/subdomain/value
@@ -0,0 +1 @@
+cloud
--- a/vars/per-machine/b4l/b4l-paperless/adminpassword/groups/admins
+++ b/vars/per-machine/b4l/b4l-paperless/adminpassword/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/b4l-paperless/adminpassword/machines/b4l
+++ b/vars/per-machine/b4l/b4l-paperless/adminpassword/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/b4l-paperless/adminpassword/secret
+++ b/vars/per-machine/b4l/b4l-paperless/adminpassword/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:NsbmiB/AWbAHRotImbG89mQjINxWyCYx5QJExqv9eVpnUg==,iv:VKGzSmYZkKQzG/Fvs3Lk6KBexqKzoVOCk33Lw0ovUjY=,tag:4kWuchFThyRuqIA/tpEL2A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmcjloZHZxamR4Sm9RdW56\nSzc5emNlZzlrVEhxQk5GTmJSU091bXM2UWdzCkVGallpSFkwcHh0TzljdUQzWVVk\nTkovR1pHaGFBSmkvNUlReHNyQTVaY00KLS0tIEpaWHk4NkRzTEtKQlZlRGF1NzJY\nYzcwazhFK3BiYjlGK0xEemFwQUtnblkK7NKnJ7QwJLMytdjDt+UchcP//Lf3P6Ud\nT5Adt5I5MTcPcBTqLNlWvFjoW83fDJ9c8rNdq8Ymy5wycffiekbW6Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNzR0wvNFQ0\nZUVRQVBWd2JOZzlXSVBuUjdtMTNkcHVoMGNOSTEzNExKSHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwprTWQ1UnRRaUN6VE52Z0NzeCtqQWlW\nRmNtbG90U3k1bU44OFduVmdjc3dVCi0tLSBGY1RSaEtEYU1vQUh1L3NCcElhWkM4\nTWhOeTZpNjBjemdLcGUzRk9aN2ZFCrx9cEAAWSRW0BcWmBE15pEQ+ZAANTVF+NeF\njZaqq7RF+cFxX/A7LW9EC7Lht98FerAx6jjhpV1EjFwpS83bjvQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2OUVhRHJKSW4wbXNTUytj\nbE4yN1Jpa2g2S2ZZRTBUSHBLWjJKNHdHSDNBClZybTRab2lxN1dHVjFXUE41YWNX\nWVZDNEp5Y2NUUWJhWERLZjQ0UzdrRGMKLS0tIHNVTTlucVJhejliRnhLb0FsTFh5\nbDB6bFMzclZ0dG1RQnNWc1VYSHBRSmcKaW5he1XOT64NIHG7Iut/7lMeht+kqvg5\nUrhM65sxwUMEU14LTXjrzUtl6+pxMgiaXDxfAvWrJbEnFaf4ZNOo4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsVmRWaHFzWTE1Q2ZNQ1M2\nU2FobFV1WDZHTjNVNjZhbVJodC9MNTBmMEVzCjJTQVl1dWxkYVZ0bWdzcDgyY1dT\nTXRsTEd6Vyt0ZWlWSTlFT0pXandoQW8KLS0tIEtHSDRDSmNteXFqTng4a3FCRmJN\nOXFlbTdySmtLbTJZeXlDa2cxQUNTaGcKUNo8VVjwtQqYHj55FWv3RXtgC4wKV6kl\nwZk9e3X1YeXWj6az2d1qfr8jppFhHNAWEmMxbceMZh1KBApFVV2UWA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSC9IQThMa0RaNVJkTHJR\nZm1XVHFVdlJxMVIrUUlhRjVJdUpFU3JDMmdvCjRYVUh0K2lSZDFNSTJTK0ZSZU16\neGhxTXFBVzFsRlpwcjVGWFVhL282dFkKLS0tIHd2Y3NLWEJiUHNCajlKaE9wQThN\nWE05S2V4cmE3TG9keVFaeVphN0ZtY0EKV1FUztf4KoKFZoqgU8rVSU7v5eblF7Ya\n2rvKTb1GtITo9uijfd2FZpoBIEl2Ej3EijhIDsTKUZ1o+YArletatg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIElLdHRLaVZz\nUlduUi9IQzFWbGFqbWJuaW9hM2JPOTdDc1lwd0RpRkNsVW8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpQczBubDlTWkxNeFUyU2RTNlJ4d2R3\nTHQ0amVjU2VQTndoQlFORzhkYzlvCi0tLSBObWNGNE9uS2xpZ3c5NWtETUpuSW5U\nTU5JVC9tM2cwSzNDaE4raDhhYUxRCuwnhfFV5DowmgqLzFoO+ZoRi1nmK3gkdbMe\n1MTfV/6xr0DYg3ceizb8f5hXOvmeZ+ZfFoUskEXkUqPSycvevk0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHh6ZkFoaVB6\nVS9aT3dhZ3Ewby92WC80S1hNanBPbmF2NDRzTW1SUnYwQ00gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpJK1BCTDJycHFIS1hKanlJYXpvZGp2\ndDBTVVZ5bDhhd0c3cVJTYlcyVGJ3Ci0tLSBYU0lwUVowNmlYQkRMQmhrQlA1U0N3\nS2dFbG9JR3g3QVZuMW5RZm1ubkFBCoHDH5E/OhgJNoF4l2oQEpsV7BbG24PDVMzP\ngKB7gFpMkOBCLaiRPb+3nAgd6w0aHISD6dA4uUw86Lka6mdm62Y=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQU9CU202cmQ3VEF5QVEz\nUVN6SmRkUm04aGRiM2FxcUh6YngxTGFYZkE4CkhqMUE4Ri9Mc0l0NnR0RHJOMnNt\nL3p0OTRhSDZPbGFld1duc1lsakFEOHMKLS0tIE5KY25uWllIbGpkV3lpdGJQSTRj\nZUd5dGJEOXhRY0R6Skw2VFZJT1ZCakUKeRnOh7dQz1oCMOQN2rhAyI46c/Ui+21l\nOH3+knnJV5cXRsb27Ou6pTgKXWn6PJ+2d5qTWL/IZ7q4ga3H63yQnA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZ0hNczFqTHlDWjhtMXBY\neDc3Z0xSYUtpYUFpRkRaR3A0MzZXWXlmZGprCmxTbDQzLzA5T21CRzdaN1ZtWlgx\ncVZ5NHN3bkVIeDZ5Qm40cWk1TnpHU28KLS0tIGdOOG9SRE5VMUc2MWswL1BJT0R3\nN3NWeGcvTUJRSFBXRmZiRm54QmtCMG8K3QbVU6Q7OYpe2GzXTVUbuUx+A8JkHGyX\nMXBrF80AkZd10mEEs0Vs9ZmLKE9u45z+xxpk0lhTxhlRxKFDAsRyYA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-08-06T05:23:42Z",
+		"mac": "ENC[AES256_GCM,data:eK8RPnR3M4KUGFBtJ43UGq0F4hw+CL1NwoCJbzpX8W8i7pPJOXkIEi0Q4bi3ALMbUxHd5mYE5lKZj0VpPaV3f3t3AvcIg2zWamBYps5R108vwmIDd2UFtmCA496sOSJgpTNX13V8X5cK+3uYXYnd4fz9qAupvFpIpkqWqGl4kxU=,iv:/KOE9y1bzpCzI1jmXZ6mfh0jhVhOvpgS7GNIp2QxvhQ=,tag:e5gLfU+9SyxunVeuOVirhw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/b4l/b4l-paperless/adminpassword/users/kurogeek
+++ b/vars/per-machine/b4l/b4l-paperless/adminpassword/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/b4l/b4l-paperless/subdomain/value
+++ b/vars/per-machine/b4l/b4l-paperless/subdomain/value
@@ -0,0 +1 @@
+paperless
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	800500f57e	vega on new device	2025-09-26 12:04:02 +07:00
kurogeek	8b7007b2b8	VPN for b4l	2025-09-25 14:46:26 +07:00
kurogeek	c0f50eb2b5	Glom NAS machine vega	2025-09-24 14:20:21 +07:00
kurogeek	cfbf3a30a0	re-encrypt rigel	2025-09-24 09:56:09 +07:00
kurogeek	6f0d7aa7de	re-encrypt b4l	2025-09-24 09:55:25 +07:00
kurogeek	a5ffcf6773	add age-plugin-fido2-hmac as age-plugins	2025-09-24 09:37:39 +07:00
kurogeek	1ad1dd82ea	rigel machines sops.defaultGroups is admins	2025-09-24 09:23:36 +07:00
kurogeek	45e4389f78	b4l machines sops.defaultGroups is admins	2025-09-24 09:23:24 +07:00
kurogeek	aa2eb91339	Add user matthewcroughan to group admins	2025-09-23 16:03:13 +07:00
kurogeek	99c24c0b10	Add user vi to group admins	2025-09-23 16:03:06 +07:00
kurogeek	8d31f56092	Add user davhau to group admins	2025-09-23 16:03:03 +07:00
kurogeek	950d34a7fe	Add user berwn to group admins	2025-09-23 16:02:57 +07:00
kurogeek	7cb1b483f0	Add user kurogeek to group admins	2025-09-23 16:02:53 +07:00
kurogeek	6c806c1e70	Add machine rigel to group admins	2025-09-23 16:01:59 +07:00
kurogeek	921629216e	Add machine b4l to group admins	2025-09-23 16:01:46 +07:00
kurogeek	83ebe8933f	Add vi to secret	2025-09-23 15:53:02 +07:00
kurogeek	f9ba5260ab	Add user matthewcroughan to secrets	2025-09-23 15:34:08 +07:00
kurogeek	4cf19ff4aa	Add user matthewcroughan to secrets	2025-09-23 15:25:38 +07:00
kurogeek	a3a776722f	Add berwn to secret	2025-09-22 16:11:51 +07:00
kurogeek	e182dcb248	Add berwn to secret	2025-09-22 16:11:34 +07:00
kurogeek	db5e0e55ce	age-plugin-yubikey	2025-09-22 14:37:02 +07:00
kurogeek	aa19ffa9ba	add matthewcroughan to admin	2025-09-22 14:36:45 +07:00
kurogeek	d344790bfe	add vi to admin	2025-09-22 11:59:50 +07:00
kurogeek	3937ce27db	Add user vi to secrets	2025-09-22 11:59:35 +07:00
kurogeek	c78048d53a	add davhau to admin	2025-09-22 11:11:59 +07:00
kurogeek	0fb4199965	add berwn to admin	2025-09-22 11:11:16 +07:00
kurogeek	4dd06992e0	Add user davhau to secrets	2025-09-22 10:29:57 +07:00
kurogeek	dbdaa8ae22	Add user berwn to secrets	2025-09-22 10:27:37 +07:00
kurogeek	7c729a065e	bump clan-core	2025-08-07 10:15:03 +07:00
kurogeek	16a2d980de	paperless service	2025-08-07 10:08:14 +07:00
kurogeek	846d689b2c	pingvin service	2025-08-05 17:16:02 +07:00
kurogeek	cc0aaff3ed	bump nixpkgs	2025-08-05 15:42:25 +07:00
kurogeek	fca02307a0	grafana service	2025-08-04 15:36:07 +07:00
kurogeek	db855963dc	fix wrong instance name	2025-07-31 16:01:03 +07:00
kurogeek	cc628f47b7	rework victoriametrics to be more generic with test	2025-07-31 15:56:46 +07:00
kurogeek	5109c3f4fa	rework stirling-pdf to be more generic with test	2025-07-31 10:40:31 +07:00
kurogeek	c5c8e0050d	rework actual-budget to be more generic with test	2025-07-30 17:28:23 +07:00
kurogeek	bfd0dd1a41	vikunja service backup folders	2025-07-30 15:38:07 +07:00
kurogeek	d606f9e88e	nextcloud service backup folders	2025-07-30 15:37:51 +07:00
kurogeek	5dd4d2c08a	b4l missing secrets are fixed	2025-07-30 10:42:05 +07:00
kurogeek	e70b2ef5c9	b4l-nextcloud vars script is fixed	2025-07-30 10:38:06 +07:00
kurogeek	1077a9309e	b4l nextcloud secret nextcloud -> b4l-nextcloud	2025-07-30 10:37:21 +07:00
kurogeek	f82d1886cc	Update vars via generator b4l-nextcloud for machine b4l	2025-07-30 10:36:34 +07:00
kurogeek	8f3220f8dd	b4l-vikunja vars script is fixed	2025-07-30 10:30:29 +07:00
kurogeek	a12fddd386	b4l vikunja subdomain secret	2025-07-30 10:29:38 +07:00
kurogeek	f4418133f8	Update vars via generator b4l-vikunja for machine b4l	2025-07-30 10:27:39 +07:00
kurogeek	dc19d20d73	rework pocket-id to be more generic	2025-07-30 10:21:32 +07:00
kurogeek	49ed4d78c3	rework nextcloud service	2025-07-29 14:38:22 +07:00
kurogeek	99c3ee6ffe	rigel machine (Zima board) is running NixOS	2025-07-25 11:18:52 +07:00
kurogeek	f72bb82382	admin access to all machines	2025-07-25 08:47:42 +07:00
kurogeek	4fa7edfa1f	vikunja implementation on b4l	2025-07-24 11:39:06 +07:00
kurogeek	1bfda37cba	vikunja clanService	2025-07-24 11:38:39 +07:00
kurogeek	aec9eed0b2	clanService framework with test support	2025-07-23 11:43:27 +07:00
kurogeek	b2b0c74bd6	bump inputs	2025-07-21 09:55:00 +07:00
kurogeek	a9b23c823c	victoriametrics service	2025-07-18 14:09:14 +07:00
kurogeek	872414c995	actual budget service	2025-07-17 15:24:41 +07:00
kurogeek	528ef9ab77	stirling-pdf service	2025-07-16 16:06:37 +07:00
kurogeek	c716a79703	changeme -> FIXME	2025-07-16 14:57:27 +07:00
kurogeek	b5c20ab4de	rm emergency-access, root-password	2025-07-16 14:18:40 +07:00
kurogeek	ba9b6868e4	nextcloud service	2025-07-16 14:17:11 +07:00
kurogeek	0510e56534	enable ACME on main domain	2025-07-16 14:16:42 +07:00
kurogeek	4e7dcebd93	inventory.pocket-id goes into the instances section	2025-07-14 13:48:37 +07:00
kurogeek	64cc66dd2b	Update vars via generator pocket-id for machine b4l	2025-07-14 13:46:06 +07:00
kurogeek	6e80cc43ae	pocket-id service	2025-07-14 13:45:39 +07:00
kurogeek	2789aa74af	b4l fqdn	2025-07-14 11:56:00 +07:00
kurogeek	da9087235e	root password for b4l	2025-07-14 11:03:21 +07:00
kurogeek	749f093f09	Update vars via generator root-password for machine b4l	2025-07-14 11:02:20 +07:00