mob next [ci-skip] [ci skip] [skip ci]

lastFile:machines/b4l/services/gitea.nix

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753024554,
+        "lastModified": 1754535625,
-        "narHash": "sha256-oVriwkUkY3xs7HONbusnaXxyGecMAdi/QLZ2Z7jZKAM=",
+        "narHash": "sha256-RdT3/DskBjwx74cvHJHb/mLSO2XeSHitSYViNmYGU/k=",
         "ref": "refs/heads/main",
-        "rev": "f6284a7ac228789feba4f6b33be49960ee8afe4a",
+        "rev": "f69e28a1333527cdbadb233966a7e19d4b35a1a3",
-        "revCount": 8541,
+        "revCount": 8886,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -49,11 +49,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752589312,
+        "lastModified": 1753067306,
-        "narHash": "sha256-BafZOenlzMYdumG12AzgVLhEVu+GcEa8nYNDSIYe1U0=",
+        "narHash": "sha256-jyoEbaXa8/MwVQ+PajUdT63y3gYhgD9o7snO/SLaikw=",
-        "rev": "496bbf05a2aa7b061ef464254db5804d1c6f45b4",
+        "rev": "18dfd42bdb2cfff510b8c74206005f733e38d8b9",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/496bbf05a2aa7b061ef464254db5804d1c6f45b4.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/18dfd42bdb2cfff510b8c74206005f733e38d8b9.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752718651,
+        "lastModified": 1753140376,
-        "narHash": "sha256-PkaR0qmyP9q/MDN3uYa+RLeBA0PjvEQiM0rTDDBXkL8=",
+        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "d5ad4485e6f2edcc06751df65c5e16572877db88",
+        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
         "type": "github"
       },
       "original": {
@@ -187,11 +187,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752900028,
+        "lastModified": 1754278406,
-        "narHash": "sha256-dPALCtmik9Wr14MGqVXm+OQcv7vhPBXcWNIOThGnB/Q=",
+        "narHash": "sha256-jvIQTMN5EzoOP5RaGztpVese8a3wqy0M/h6tNzycW28=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6b4955211758ba47fac850c040a27f23b9b4008f",
+        "rev": "6a489c9482ca676ce23c0bcd7f2e1795383325fa",
         "type": "github"
       },
       "original": {
@@ -219,11 +219,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752544651,
+        "lastModified": 1754328224,
-        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
+        "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
+        "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4",
         "type": "github"
       },
       "original": {

fmt.nix

@@ -17,6 +17,8 @@
           global.excludes = [
             "sops/*"
             "vars/*"
+            "*/sops/*"
+            "*/vars/*"
 
             "*/.gitignore"
             "LICENSE"

inventories/default.nix

@@ -7,13 +7,6 @@
 }:
 {
   clan = {
-    modules = {
-      pocket-id = ../modules/clan/pocket-id;
-      nextcloud = ../modules/clan/nextcloud;
-      stirling-pdf = ../modules/clan/stirling-pdf;
-      actual-budget = ../modules/clan/actual-budget;
-      victoria-metrics = ../modules/clan/victoria-metrics;
-    };
     inventory = {
 
       machines = {
@@ -62,9 +55,9 @@
           };
           roles.default.machines.b4l = { };
         };
-        victoria-metrics = {
+        victoriametrics = {
           module = {
-            name = "victoria-metrics";
+            name = "victoriametrics";
             input = "self";
           };
           roles.default.machines.b4l = { };
@@ -76,6 +69,34 @@
           };
           roles.default.machines.b4l = { };
         };
+        grafana = {
+          module = {
+            name = "grafana";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        pingvin = {
+          module = {
+            name = "pingvin";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        paperless = {
+          module = {
+            name = "paperless";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
+        gitea = {
+          module = {
+            name = "gitea";
+            input = "self";
+          };
+          roles.default.machines.b4l = { };
+        };
       };
     };
   };

machines/b4l/services/actual-budget.nix

@@ -0,0 +1,36 @@
+{ config, ... }:
+let
+  abDomain = "${config.clan.core.vars.generators.b4l-actual-budget.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-actual-budget = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Actual Budget app. Default:(budget)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "budget" > $out/subdomain'';
+  };
+
+  services.actual = {
+    settings = {
+      allowedLoginMethods = [
+        "password"
+        "openid"
+      ];
+      trustedProxies = [ "127.0.0.1" ];
+    };
+  };
+  services.nginx.virtualHosts."${abDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.actual.settings.port}";
+    };
+  };
+}

machines/b4l/services/gitea.nix

@@ -0,0 +1,2 @@
+{
+}

machines/b4l/services/grafana.nix

@@ -0,0 +1,79 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib;
+let
+  serviceName = "${config.networking.hostName}-grafana";
+  gfDomain = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+
+  settingsFormatIni = pkgs.formats.ini {
+    listToValue = concatMapStringsSep " " (generators.mkValueStringDefault { });
+    mkKeyValue = generators.mkKeyValueDefault {
+      mkValueString = v: if v == null then "" else generators.mkValueStringDefault { } v;
+    } "=";
+  };
+  configFile = settingsFormatIni.generate "config.ini" config.services.grafana.settings;
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      adminpassword.secret = true;
+      subdomain.secret = false;
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Grafana. Default:(grafana)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "grafana" > "$out"/subdomain
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  systemd.services.grafana.serviceConfig.ExecStartPre = [
+    "+${pkgs.writeShellScript "grafana-set-password" ''
+      ${pkgs.grafana}/bin/grafana cli --homepath ${config.services.grafana.dataDir} --config ${configFile} admin reset-admin-password $(cat ${
+        config.clan.core.vars.generators."${serviceName}".files.adminpassword.path
+      })
+    ''}"
+  ];
+
+  services.nginx.virtualHosts."${gfDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grafana.settings.server.http_port}";
+    };
+  };
+
+}

machines/b4l/services/nextcloud.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, ... }:
+let
+  ncDomain = "${config.clan.core.vars.generators.b4l-nextcloud.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-nextcloud = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Nextcloud app. Default:(cloud)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "cloud" > $out/subdomain'';
+  };
+
+  services.nextcloud = {
+    hostName = ncDomain;
+    package = pkgs.nextcloud31;
+
+    settings = {
+
+      overwriteprotocol = "https";
+      trusted_domains = [ ];
+      trusted_proxies = [ ];
+    };
+  };
+  services.nginx.virtualHosts."${ncDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+  };
+}

machines/b4l/services/paperless.nix

@@ -0,0 +1,67 @@
+{ config, pkgs, ... }:
+let
+  serviceName = "${config.networking.hostName}-paperless";
+  domain-name = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      subdomain.secret = false;
+      adminpassword = {
+        secret = true;
+        owner = config.services.paperless.user;
+        group = config.services.paperless.user;
+      };
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Paperless. Default:(paperless)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "paperless" > "$out"/subdomain
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  environment.systemPackages = [ pkgs.toybox ];
+
+  services.paperless = {
+    passwordFile = config.clan.core.vars.generators."${serviceName}".files.adminpassword.path;
+  };
+
+  services.nginx.virtualHosts."${domain-name}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.paperless.port}";
+    };
+  };
+
+}

machines/b4l/services/pingvin.nix

@@ -0,0 +1,45 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+let
+  serviceName = "${config.networking.hostName}-pingvin";
+  domain-name = "${
+    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
+  }.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators."${serviceName}" = {
+    files = {
+      subdomain.secret = false;
+    };
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Pingvin. Default:(share)";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "share" > "$out"/subdomain
+      fi
+    '';
+  };
+
+  services.pingvin-share = {
+    nginx.enable = true;
+    https = true;
+    hostname = domain-name;
+  };
+}

machines/b4l/services/pocket-id.nix

@@ -0,0 +1,35 @@
+{ config, ... }:
+let
+  pidDomain = "${config.clan.core.vars.generators.b4l-pocket-id.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-pocket-id = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Pocket-ID app. Default:(auth)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "auth" > $out/subdomain'';
+  };
+
+  services.pocket-id = {
+    settings = {
+      APP_ENV = "production";
+      APP_URL = "https://${pidDomain}";
+      TRUST_PROXY = true;
+    };
+  };
+
+  services.nginx.virtualHosts."${pidDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.pocket-id.settings.PORT}";
+    };
+  };
+}

machines/b4l/services/stirling-pdf.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+let
+  stDomain = "${config.clan.core.vars.generators.b4l-stirling-pdf.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-stirling-pdf = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Stirling PDF app. Default:(pdf)";
+      };
+    };
+    script = ''cat $prompts/subdomain || echo -n "pdf" > $out/subdomain'';
+  };
+
+  services.nginx.virtualHosts."${stDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.stirling-pdf.environment.SERVER_PORT}";
+    };
+  };
+}

machines/b4l/services/victoriametrics.nix

@@ -0,0 +1,73 @@
+{ config, pkgs, ... }:
+let
+  vmDomain = "${config.clan.core.vars.generators.b4l-victoriametrics.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-victoriametrics = {
+    files.subdomain.secret = false;
+    files.adminuser.secret = false;
+    files.adminpassword.secret = true;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Victoria Metrics app. Default:(metrics)";
+      };
+      adminuser = {
+        persist = true;
+        type = "line";
+        description = "Username for an admin user. Default:(admin)";
+      };
+      adminpassword = {
+        persist = true;
+        type = "hidden";
+        description = "Password for the admin user. Leave empty to auto-generate.";
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.xkcdpass
+      pkgs.coreutils
+    ];
+
+    script = ''
+      prompt_domain=$(cat "$prompts"/subdomain)
+      if [[ -n "''${prompt_domain-}" ]]; then
+        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
+      else
+        echo -n "metrics" > "$out"/subdomain
+      fi
+
+      prompt_adminuser=$(cat "$prompts"/adminuser)
+      if [[ -n "''${prompt_adminuser-}" ]]; then
+        echo $prompt_adminuser | tr -d "\n" > "$out"/adminuser
+      else
+        echo -n "admin" > "$out"/adminuser
+      fi
+
+      prompt_password=$(cat "$prompts"/adminpassword)
+      if [[ -n "''${prompt_password-}" ]]; then
+        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
+      else
+        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
+      fi
+    '';
+  };
+
+  services.victoriametrics = {
+    extraOptions = [
+      "-httpAuth.username=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminuser.path}"
+      "-httpAuth.password=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminpassword.path}"
+    ];
+  };
+
+  services.nginx.virtualHosts."${vmDomain}" = {
+    forceSSL = true;
+    useACMEHost = "${config.networking.fqdn}";
+    locations."/" = {
+      proxyPass = "http://localhost${builtins.toString config.services.victoriametrics.listenAddress}";
+    };
+  };
+
+}

machines/b4l/services/vikunja.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 {
-  clan.core.vars.generators.vikunja = {
+  clan.core.vars.generators.b4l-vikunja = {
     files.subdomain.secret = false;
 
     prompts = {
@@ -11,10 +11,10 @@
       };
     };
 
-    script = ''cat $prompts/subdomain | echo "todo" > $out/subdomain'';
+    script = ''cat $prompts/subdomain || echo "todo" > $out/subdomain'';
   };
   services.vikunja = {
-    frontendHostname = "${config.clan.core.vars.generators.vikunja.files.subdomain.value}.${config.networking.fqdn}";
+    frontendHostname = "${config.clan.core.vars.generators.b4l-vikunja.files.subdomain.value}.${config.networking.fqdn}";
   };
   services.nginx.virtualHosts."${config.services.vikunja.frontendHostname}" = {
     useACMEHost = "${config.networking.fqdn}";

modules/clan/actual-budget/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ ... }:
 {
   _class = "clan.service";
   manifest.name = "actual-budget";
@@ -6,49 +6,21 @@
   manifest.categories = [ "System" ];
 
   roles.default = {
-    interface.options = {
-      domain = lib.mkOption {
-        type = lib.types.str;
-        default = "budget";
-        description = "Sub domain for Actual Budget.";
-      };
-    };
 
-    perInstance =
+    perInstance.nixosModule =
       {
-        settings,
+        lib,
+        config,
         ...
       }:
       {
-        nixosModule =
+        services.actual = {
-          {
+          enable = lib.mkDefault true;
-            config,
+        };
-            ...
+
-          }:
+        clan.core.state.actual-budget.folders = [
-          let
+          config.systemd.services.actual.serviceConfig.WorkingDirectory
-            domain = "${settings.domain}.${config.networking.fqdn}";
+        ];
-          in
-          {
-            services.actual = {
-              enable = true;
-              openFirewall = true;
-              settings = {
-                port = 5006;
-                allowedLoginMethods = [
-                  "password"
-                  "openid"
-                ];
-                trustedProxies = [ "127.0.0.1" ];
-              };
-            };
-            services.nginx.virtualHosts."${domain}" = {
-              forceSSL = true;
-              useACMEHost = "${config.networking.fqdn}";
-              locations."/" = {
-                proxyPass = "http://localhost:${builtins.toString config.services.actual.settings.port}";
-              };
-            };
-          };
       };
   };
 }

modules/clan/actual-budget/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    actual-budget = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.actual-budget = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/actual-budget" = module;
+      };
+    };
+}

modules/clan/actual-budget/tests/vm/default.nix

@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-actual-budget";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        actual-budget-test = {
+          module.name = "@clan/actual-budget";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("actual")
+
+    server.succeed("systemctl status actual")
+
+  '';
+}

modules/clan/gitea/default.nix

@@ -0,0 +1,27 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "gitea";
+  manifest.description = "Git with a cup of tea!";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      {
+        services.gitea = {
+          enable = lib.mkDefault true;
+          dump = {
+            enable = lib.mkDefault true;
+          };
+        };
+
+        clan.core.state.gitea.folders = [ config.services.gitea.dump.backupDir ];
+      };
+  };
+}

modules/clan/gitea/flake-module.nix

@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    gitea = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.gitea = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/gitea" = module;
+      };
+    };
+}

modules/clan/gitea/tests/vm/default.nix

@@ -0,0 +1,50 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+{
+  name = "service-gitea";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        gitea-test = {
+          module.name = "@clan/gitea";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.gitea = {
+        dump.file = "test-dump";
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      gitea = nodes.server.config.services.gitea;
+    in
+    ''
+      start_all()
+
+      server.wait_for_unit("gitea")
+
+      server.succeed("systemctl status gitea")
+      server.wait_for_open_port(3000)
+      server.succeed("curl http://127.0.0.1:3000")
+
+      server.succeed("${lib.getExe pkgs.gitea} dump -h")
+      server.succeed("systemctl start gitea-dump")
+      server.wait_for_file("${gitea.dump.backupDir}/${gitea.dump.file}")
+    '';
+}

modules/clan/grafana/default.nix

@@ -0,0 +1,24 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "grafana";
+  manifest.description = "Platform for data analytics and monitoring";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      {
+        services.grafana = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.grafana.folders = [ config.services.grafana.dataDir ];
+      };
+  };
+}

modules/clan/grafana/flake-module.nix

@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    grafana = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.grafana = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/grafana" = module;
+      };
+    };
+}

modules/clan/grafana/tests/vm/default.nix

@@ -0,0 +1,42 @@
+{
+  ...
+}:
+{
+  name = "service-grafana";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        grafana-test = {
+          module.name = "@clan/grafana";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.grafana = {
+        settings = {
+          server.domain = "grafana.localhost";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("grafana")
+
+    server.succeed("systemctl status grafana")
+    server.wait_for_open_port(3000)
+    server.succeed("curl -H \"Host: grafana.localhost\" http://127.0.0.1:3000 ")
+    server.succeed("grafana cli -v")
+  '';
+}

modules/clan/nextcloud/default.nix

@@ -1,3 +1,4 @@
+{ ... }:
 {
   _class = "clan.service";
   manifest.name = "nextcloud";
@@ -5,79 +6,55 @@
   manifest.categories = [ "System" ];
 
   roles.default = {
-    interface =
-      { lib, pkgs, ... }:
-      {
-        options = {
-          domain = lib.mkOption {
-            type = lib.types.str;
-            default = "cloud";
-            description = "Sub domain for Nextcloud to run.";
-          };
-          package = lib.mkOption {
-            type = lib.types.package;
-            description = "Which package to use for the Nextcloud instance.";
-          };
-        };
-      };
 
-    perInstance =
+    perInstance.nixosModule =
       {
-        settings,
+        config,
+        pkgs,
+        lib,
         ...
       }:
       {
-        nixosModule =
+        clan.core.vars.generators.nextcloud = {
-          {
+          files = {
-            config,
+            adminpassFile = {
-            pkgs,
+              owner = "nextcloud";
-            ...
+              group = "nextcloud";
-          }:
+              secret = true;
-          let
-            domain = "${settings.domain}.${config.networking.fqdn}";
-            nextcloudUser = "nextcloud";
-          in
-          {
-            clan.core.vars.generators.nextcloud = {
-              files = {
-                adminpassFile = {
-                  owner = nextcloudUser;
-                  group = nextcloudUser;
-                  secret = true;
-                };
-              };
-              script = ''
-                xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassFile
-              '';
-              runtimeInputs = [
-                pkgs.xkcdpass
-              ];
-            };
-            services.nextcloud = {
-              enable = true;
-              hostName = domain;
-              package = pkgs.nextcloud31;
-              database.createLocally = true;
-              config = {
-                dbtype = "pgsql";
-                dbhost = "/run/postgresql";
-                dbuser = nextcloudUser;
-                dbname = nextcloudUser;
-                adminuser = "admin";
-                adminpassFile = config.clan.core.vars.generators.nextcloud.files.adminpassFile.path;
-              };
-
-              settings = {
-                overwriteprotocol = "https";
-                trusted_domains = [ ];
-                trusted_proxies = [ ];
-              };
-            };
-            services.nginx.virtualHosts."${domain}" = {
-              useACMEHost = "${config.networking.fqdn}";
-              forceSSL = true;
             };
           };
+          script = ''
+            xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassFile
+          '';
+          runtimeInputs = [
+            pkgs.xkcdpass
+          ];
+        };
+
+        services.nextcloud = {
+          enable = lib.mkDefault true;
+          hostName = lib.mkDefault "localhost";
+          database.createLocally = lib.mkDefault true;
+          config = {
+            dbtype = lib.mkDefault "pgsql";
+            dbhost = lib.mkDefault "/run/postgresql";
+            dbuser = lib.mkDefault "nextcloud";
+            dbname = lib.mkDefault "nextcloud";
+            adminuser = lib.mkDefault "admin";
+            adminpassFile = lib.mkDefault config.clan.core.vars.generators.nextcloud.files.adminpassFile.path;
+          };
+
+        };
+
+        clan.core.state.nextcloud.folders = [
+          config.services.nextcloud.home
+        ]
+        ++ (
+          if config.services.nextcloud.home != config.services.nextcloud.datadir then
+            [ config.services.nextcloud.datadir ]
+          else
+            [ ]
+        );
       };
   };
 }

modules/clan/nextcloud/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    nextcloud = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.nextcloud = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/nextcloud" = module;
+      };
+    };
+}

modules/clan/nextcloud/tests/vm/default.nix

@@ -0,0 +1,36 @@
+{
+  ...
+}:
+{
+  name = "service-nextcloud";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        nextcloud-test = {
+          module.name = "@clan/nextcloud";
+          module.input = "self";
+          roles.default.machines."server" = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.nextcloud = { };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("phpfpm-nextcloud.service")
+
+    # Check that garage is running
+    server.succeed("systemctl status phpfpm-nextcloud.service")
+  '';
+}

modules/clan/nextcloud/tests/vm/sops/machines/server/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age15md5wyqzn4jwc7pgyjkjhcd6nfuct9gxgrl7x5qxdzgvrh32ruvqmk3wfq",
+    "type": "age"
+  }
+]

modules/clan/nextcloud/tests/vm/sops/secrets/server-age.key/secret

@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:LtzjjbqrzdiFqw5sEI6nYAjLuWJOqiEcO9T8POnjDHK0l55RAxLLzlc1w2DTRPd46vAFy04IYgPiwwQJj8WuYdgjymXTyVqGvNA=,iv:q/L8DpR9E/NNIW2cNFft/e65xGHK9HN19W8ISd6lgdA=,tag:7XFi8VgfG40I0wSHqasXSQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxMGF5Q3V5T29ub09XL0Mx\nUVBlSUc2TnRkaGxoQW5uMzUzd04xOWFYRkNBClZ3eVU3dEovWDVZSkR0bnRRY3Bn\nOFNQWDFRckFxVlpvTVRsa01ad0NkRDAKLS0tIGd2UDV3cWZTTkF6V3p4Y3ZKOXdo\nY1doTFoyT2dSaG93b0lGb01YaExDTXMKe4wjgOysbF+NKlnmQgard1N6Xhazex7y\nCuvGnbcy2TLxDNhjdgjoOxUV1xQWnwoYOF1QDbL7l2k59iE3lzUG8Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-29T03:24:54Z",
+		"mac": "ENC[AES256_GCM,data:s6W/U0FekNcDdKk9/L54Q0V/XZhrDQwP/moNFbxbucD0sAXzEYMWbWTDNCz6/NVtqr3A++Vk65LFr8bgWuh4uxekXrLDN0Pyb7AJpDkp7IlE6ijT3cQk+OVpcpTt+FgFt3JZLyrmOL/H638sg4c0bptN+Fj8LrNXFdauWCDBlkA=,iv:oiEPi/zvH0m312ezyT0SnUavlX47pduzyz8NIwuCaNs=,tag:e6KkwWAJSZbiliKm4VT6yw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

modules/clan/nextcloud/tests/vm/sops/secrets/server-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/nextcloud/tests/vm/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}

modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:NVuUW3KNwUUs/Cwswvi4kDo8GZM453y/TRlHWut3OA==,iv:7rSqlQxgJCRecmpNrmGZeT03f1eOuO+W8O2QBkoKdXc=,tag:F9WkMVBV8zh4L86sBA4LVQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age15md5wyqzn4jwc7pgyjkjhcd6nfuct9gxgrl7x5qxdzgvrh32ruvqmk3wfq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBic1hPNFdyYzE5UndKNEtj\neDdJc2RuN0Y5WTB2d1h0ZFVJRUpnTnA3TW5JCklqUzFucVNKU3JLeG5JVG1KR05q\ncVg2OFBRNW1RZ0pwWnc2eFlmYzEzZ2MKLS0tIEJod0QvMHBZVlpxMldGdTRmRTNB\nQmVOQ2U2bDd0WTQvRFJnZ2NybFJoTFEKiimfshCLluicTeVyLbFQDm+8JMXBx/n0\n9NwAb4mJwQ8B0qlFsdiXZU4pP02aw7f/NH4hX6BvBBw+SP42plkmfw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFV3FmNlJHeEhKT3NUVG9K\nNXNGdDlsVmtnWng5dGlIaVNRdXlaWVdNdmhrCi9KLzZYVWxpanlLUzJKVDlRSHlM\nRFFtditYZ1lXY3pFeUNXTk9OVitSd3MKLS0tIERVWHFNZitETlRuNEpDS1FxVS9C\nMk5UNlBjTkNRTFc5T0J1TTlZZm1ZOG8KWwGkEKK8nEWib4Va9lrVFnHU0m0zPjFE\n/3eMObt62ngwrmbAq0bNe2gFiC/OhLDf5BixldSgSeu9AenRz3Mdjg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-29T03:24:55Z",
+		"mac": "ENC[AES256_GCM,data:B3LUWx3g6P5R006NrsFMZNc466qFadfnlXS5hitToZrNEf9VN3NlINwi2liYf9JjgSXXVV6IybVoW7LYDFRNRrG2QXfvWEfozVr/JtjvufcmuyM96PbzURUfOKndau1GbJagUO4MH3l3AEvkZnSRR3nIKWGYZDiJTNo8yRIK7nw=,iv:IXdWo8y9jPYgII5HRJ6sRxb3WOcKdifDsZoU4tusDuQ=,tag:xdqph+Y2nMYNDD3hbxCcXA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

modules/clan/nextcloud/tests/vm/vars/per-machine/server/nextcloud/adminpassFile/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/paperless/default.nix

@@ -0,0 +1,24 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "paperless";
+  manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        ...
+      }:
+      {
+        services.paperless = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.paperless.folders = [ config.services.paperless.dataDir ];
+      };
+  };
+}

modules/clan/paperless/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    paperless = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.paperless = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/paperless" = module;
+      };
+    };
+}

modules/clan/paperless/tests/vm/default.nix

@@ -0,0 +1,38 @@
+{
+  ...
+}:
+{
+  name = "service-paperless";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        paperless-test = {
+          module.name = "@clan/paperless";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.paperless = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("paperless-web")
+
+    server.succeed("systemctl status paperless-web")
+    server.wait_for_open_port(28981)
+    server.succeed("curl http://127.0.0.1:28981")
+  '';
+}

modules/clan/pingvin/default.nix

@@ -0,0 +1,23 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pingvin";
+  manifest.description = "A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient file sharing.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+
+    perInstance.nixosModule =
+      {
+        config,
+        ...
+      }:
+      {
+        services.pingvin-share = {
+          enable = true;
+        };
+
+        clan.core.state.pingvin-share.folders = [ config.services.pingvin-share.dataDir ];
+      };
+  };
+}

modules/clan/pingvin/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pingvin = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.pingvin = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/pingvin" = module;
+      };
+    };
+}

modules/clan/pingvin/tests/vm/default.nix

@@ -0,0 +1,42 @@
+{
+  ...
+}:
+{
+  name = "service-pingvin";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        pingvin-test = {
+          module.name = "@clan/pingvin";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.pingvin-share = {
+        hostname = "share.localhost";
+        frontend.port = 3000;
+        backend.port = 8000;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("pingvin-share-frontend")
+
+    server.succeed("systemctl status pingvin-share-frontend")
+    server.wait_for_open_port(3000)
+    server.wait_for_open_port(8000)
+    server.succeed("curl -H \"Host: share.localhost\" http://127.0.0.1:3000 ")
+  '';
+}

modules/clan/pocket-id/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ ... }:
 {
   _class = "clan.service";
   manifest.name = "pocket-id";
@@ -6,64 +6,40 @@
   manifest.categories = [ "System" ];
 
   roles.default = {
-    interface.options = {
-      domain = lib.mkOption {
-        type = lib.types.str;
-        default = "auth";
-        description = "";
-      };
-    };
 
-    perInstance =
+    perInstance.nixosModule =
       {
-        settings,
+        config,
+        pkgs,
+        lib,
         ...
       }:
       {
-        nixosModule =
+        clan.core.vars.generators.pocket-id = {
-          {
+          files = {
-            config,
+            encryption-key = {
-            pkgs,
+              owner = "${config.services.pocket-id.user}";
-            ...
+              group = "${config.services.pocket-id.group}";
-          }:
+              secret = true;
-          let
-            domain = "${settings.domain}.${config.networking.fqdn}";
-          in
-          {
-            clan.core.vars.generators.pocket-id = {
-              files = {
-                encryption-key = {
-                  owner = "${config.services.pocket-id.user}";
-                  group = "${config.services.pocket-id.group}";
-                  secret = true;
-                };
-              };
-              runtimeInputs = [ pkgs.pwgen ];
-              script = ''
-                pwgen -s 32 1 > $out/encryption-key
-              '';
             };
-            services.pocket-id = {
-              enable = true;
-              settings = {
-                ENCRYPTION_KEY_FILE = config.clan.core.vars.generators.pocket-id.files.encryption-key.path;
-                APP_ENV = "production";
-                APP_URL = "https://${domain}";
-                TRUST_PROXY = true;
-                PORT = 1411;
-
-                UI_CONFIG_DISABLED = true;
-              };
-            };
-            services.nginx.virtualHosts."${domain}" = {
-              forceSSL = true;
-              enableACME = true;
-              locations."/" = {
-                proxyPass = "http://localhost:${builtins.toString config.services.pocket-id.settings.PORT}";
-              };
-            };
-
           };
+          runtimeInputs = [ pkgs.pwgen ];
+          script = ''
+            pwgen -s 32 1 > $out/encryption-key
+          '';
+        };
+
+        clan.core.state.pocket-id.folders = [ config.services.pocket-id.dataDir ];
+
+        services.pocket-id = {
+          enable = lib.mkDefault true;
+          settings = {
+            ENCRYPTION_KEY_FILE = config.clan.core.vars.generators.pocket-id.files.encryption-key.path;
+            PORT = lib.mkDefault 1411;
+            ANALYTICS_DISABLED = lib.mkDefault true;
+            UI_CONFIG_DISABLED = lib.mkDefault true;
+          };
+        };
       };
   };
 }

modules/clan/pocket-id/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pocket-id = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.pocket-id = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/pocket-id" = module;
+      };
+    };
+}

modules/clan/pocket-id/tests/vm/default.nix

@@ -0,0 +1,34 @@
+{ ... }:
+{
+  name = "service-pocket-id";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        pocket-id-test = {
+          module.name = "@clan/pocket-id";
+          module.input = "self";
+          roles.default.machines."server" = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.pocket-id = { };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("pocket-id")
+
+    # Check that garage is running
+    server.succeed("systemctl status pocket-id")
+  '';
+}

modules/clan/pocket-id/tests/vm/sops/machines/server/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1jvhs79a367ynhupy6gndyafg5f6wzrsa3p3r27d8y4zpvlp5vd6qwysnc2",
+    "type": "age"
+  }
+]

modules/clan/pocket-id/tests/vm/sops/secrets/server-age.key/secret

@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:MheRz91AzSqUV0gz3PHdort06igblp8dVku2GIeXbBiTpG3Dnlqzw6QEvTeRVtZ4ol0gHS8CQQ4Lc4H9IyHGiTfJkSUM7pXY/vM=,iv:mMibIfA6gqvJlbau9sKkjRoYrDcqCpTG0b+jrZCHIkE=,tag:MN5I9AO1U7sJfq/9GxSFCg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1dnVqRXVibTFYeUlsc09J\nQnRSRVE0NklWWFNlbHZaaWJ3dDlEaTJKVkZnCnJEZHhoSzd3T3NEVjFjY0NkRFNq\nL1owbmR0SENSWVQxOXVlNWJFb0JsSEEKLS0tIHhESEI2Y3MzMU9WRzhYNWZhUUd2\nTVpldG5qbDF6UG9jNnBRTnZRdzAweDAKl4FpFTp7NyTHXJEF7tIO0CnsgTY4maJ2\n7KfQRwQuhW73WqVdzJSZ7i/Xapwglx0ISBvSEDgBTiQhFlBLCMEzYg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-29T09:50:44Z",
+		"mac": "ENC[AES256_GCM,data:lZ7SAQkkH441L3Ss9nEI1fm6SgcysIcOBg9it0m80CiNhtittsFNcP7l0ApkIBQLhMsan93bLMG3kcDKzqxld3XDRPUwlJkKElh8Dc8q7qqtOqgKNnsFDcx4Zh3HdiTPywyIBnUMYAul4tVPpEzqh1GSD1GF9fsBxLiwxBwalY4=,iv:wmhz1k5LMNNxuacQj+A5FryJwzqxpXf5AnFoeL1TF4k=,tag:cl5OcxGYvC6DGQDRuhqRRw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

modules/clan/pocket-id/tests/vm/sops/secrets/server-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/pocket-id/tests/vm/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}

modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:o1BHipQXow25uobhojeSIvSaIM4SiOtjfpNBi11E7kRX,iv:mheOssj84dp1+QAG0rpdyaf5O4WWaTWh1y/DC/I9nnA=,tag:M8zSZ4GWwy5rOcOEOBbwIA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jvhs79a367ynhupy6gndyafg5f6wzrsa3p3r27d8y4zpvlp5vd6qwysnc2",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXaXFvL0JES28rUkhNT3Bj\neDVYZlNubC8wV1VGTHN1Vzh6NEV3YWI3L3pJClh2T0FhQURXRkRJSnFVYjVsZkdq\ncWRFL1crVm1EK2NHNUtlc1RMVlZ5aWMKLS0tIFczWUcxTWFMdkhXb2ZTZlRSNDBT\nNmxWak50M1JTV2R3M0FXclRGc0JuVjgKtsxU2a3DNhe9CeJFK+HK7lFhrpV7UuES\nqasLv4crL7+4eJFhmUxVwzT0ubPAuG3CBMbbmrYmAs2CUXWtcmqGMA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0TGwzeUNLbkJ4bFBPVjJy\nd3pLTWRPVytrK1plQ3kzd1ZOMjBtcGJjY25nCk5mNDRxNmJjTHh4a2pBSldvQ0Y5\nUXVPbWZ1WW1QcU03MWtuL29udGFUQ1EKLS0tIHFSY1VZUGJFanhyZmN6WHJKTzEr\nbjBkVDNJUUZNZHhjSDlDZ3Z4Y0d3Q3MKHm3Ar31B2RviANl+tCeNmtYvQp5hVdui\n9Khkd3R6MshF4rZWrWhD9vea1RX9ugJJawCTU3+4zFDEWQ6XQ+tpTw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-29T09:50:44Z",
+		"mac": "ENC[AES256_GCM,data:B3iNE0/ve2EazWNQJ6MhSaa3EAmte5GUJrVjLB7ysIoe+pf7kQy9HE2ObEypFezvbfBYAbXd+XIq8J+jTjh4X11i6/BDNsvFQKuYbTLaK+dqZzeuOQU3ntTQuhyx5qdKyXq5FtHYyJI9XsYvSFRHe2UYy4L5i6LvMoc3ka/vUHI=,iv:mXuhXp63D1UkBJX5U7RY+NqYsU5SkolDABrSDRXegFk=,tag:LJ/BnU9xKMQyr+nAAHnGFA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

modules/clan/pocket-id/tests/vm/vars/per-machine/server/pocket-id/encryption-key/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/stirling-pdf/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ ... }:
 {
   _class = "clan.service";
   manifest.name = "stirling-pdf";
@@ -6,43 +6,18 @@
   manifest.categories = [ "System" ];
 
   roles.default = {
-    interface.options = {
+    perInstance.nixosModule =
-      domain = lib.mkOption {
-        type = lib.types.str;
-        default = "pdf";
-        description = "Sub domain or Stirling PDF service";
-      };
-    };
-
-    perInstance =
       {
-        settings,
+        lib,
         ...
       }:
       {
-        nixosModule =
+        services.stirling-pdf = {
-          {
+          enable = lib.mkDefault true;
-            config,
+          environment = {
-            ...
+            SERVER_PORT = lib.mkDefault 8080;
-          }:
-          let
-            domain = "${settings.domain}.${config.networking.fqdn}";
-          in
-          {
-            services.stirling-pdf = {
-              enable = true;
-              environment = {
-                SERVER_PORT = 8080;
-              };
-            };
-            services.nginx.virtualHosts."${domain}" = {
-              forceSSL = true;
-              useACMEHost = "${config.networking.fqdn}";
-              locations."/" = {
-                proxyPass = "http://localhost:${builtins.toString config.services.stirling-pdf.environment.SERVER_PORT}";
-              };
-            };
           };
+        };
       };
   };
 }

modules/clan/stirling-pdf/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    stirling-pdf = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.stirling-pdf = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/stirling-pdf" = module;
+      };
+    };
+}

modules/clan/stirling-pdf/tests/vm/default.nix

@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-stirling-pdf";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        stirling-pdf-test = {
+          module.name = "@clan/stirling-pdf";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("stirling-pdf")
+
+    server.succeed("systemctl status stirling-pdf")
+
+  '';
+}

modules/clan/victoria-metrics/default.nix

@@ -1,47 +0,0 @@
-{
-  _class = "clan.service";
-  manifest.name = "Victoria Metrics";
-  manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-    perInstance = {
-      nixosModule =
-        {
-          config,
-          pkgs,
-          ...
-        }:
-        let
-          defaultUser = "victoriametrics";
-        in
-        {
-          clan.core.vars.generators.victoria-metrics = {
-            files = {
-              username = {
-                secret = false;
-              };
-              password = {
-                secret = true;
-                owner = defaultUser;
-                group = defaultUser;
-              };
-            };
-            script = ''
-              echo "admin" > "$out"/username
-              xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/password
-            '';
-            runtimeInputs = [ pkgs.xkcdpass ];
-          };
-          services.victoriametrics = {
-            enable = true;
-            extraOptions = [
-              "-httpAuth.username=file://${config.clan.core.vars.generators.victoria-metrics.files.username.path}"
-              "-httpAuth.password=file://${config.clan.core.vars.generators.victoria-metrics.files.password.path}"
-            ];
-          };
-        };
-    };
-  };
-
-}

modules/clan/victoriametrics/default.nix

@@ -0,0 +1,25 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "Victoria Metrics";
+  manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      {
+        services.victoriametrics = {
+          enable = lib.mkDefault true;
+        };
+
+        clan.core.state.victoriametrics.folders = lib.mkDefault [
+          "/var/lib/${config.services.victoriametrics.stateDir}"
+        ];
+      };
+  };
+}

modules/clan/victoriametrics/flake-module.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    victoriametrics = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.victoriametrics = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/victoriametrics" = module;
+      };
+    };
+}

modules/clan/victoriametrics/tests/vm/default.nix

@@ -0,0 +1,34 @@
+{
+  ...
+}:
+{
+  name = "service-victoriametrics";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        victoriametrics-test = {
+          module.name = "@clan/victoriametrics";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("victoriametrics")
+
+    server.succeed("systemctl status victoriametrics")
+
+  '';
+}

modules/clan/vikunja/default.nix

@@ -9,9 +9,19 @@
     perInstance.nixosModule =
       {
         lib,
+        config,
         ...
       }:
       {
+        clan.core.state.vikunja.folders = [
+          config.services.vikunja.settings.files.basepath
+        ]
+        ++ (
+          if config.services.vikunja.settings.database.type == "sqlite" then
+            [ config.services.vikunja.settings.database.path ]
+          else
+            [ ]
+        );
         services.vikunja = {
           enable = lib.mkDefault true;
           frontendScheme = lib.mkDefault "http";

shell.nix

@@ -8,7 +8,10 @@
     {
       devshells.default = {
         devshell = {
-          packages = [ inputs.clan-core.packages.${system}.clan-cli ];
+          packages = [
+            inputs.clan-core.packages.${system}.clan-cli
+            inputs.clan-core.packages.${system}.generate-test-vars
+          ];
         };
       };
     };

vars/per-machine/b4l/b4l-actual-budget/subdomain/value

@@ -0,0 +1 @@
+budget

vars/per-machine/b4l/b4l-grafana/adminpassword/machines/b4l

@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l

vars/per-machine/b4l/b4l-grafana/adminpassword/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:9v56r2ZaEixMv61TGiCOmeAru2v9ZDUJe6v+Y5TdzfV5Rg==,iv:8kvq06/hfad+9af2PW+50l6Pzs99E5E2x8m3AIz5y90=,tag:aemnUje/OlGc6Hdzzkfdmg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZUFaNW9GNXZSMnVjTG5v\nKzJlVWxzMnRSbC93a3BHc0t1YVlhQmRGOEZFCkFFK2NQNXJqdWd6cjFxaFRRR2Vy\nZE5tdkcwRXV6ZzVrdGdkcndCQ01KM3MKLS0tIEtDOG5qOG9MWWN4RnZuVGF5ajJN\nMjk0TkJvR3duZHhGTjQ2WVpqRmkrOWsKjPbLas4eDUXdhZyE29AXklDDM+czo2b7\nqvOAY2c+TyMatGpMRMPogUqGC9mj5jTZe+ZfHcxIfytDXbOgldRPow==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtZ3NrbEEyMUpoQTRFL2ZT\nMXNrUTZsSWV3aWRMdGZUNXV2azAwOUJ3cFFRClNmMCtVTXF0VU9PM0NxTWtWSXBh\nMDVlc3BpS3ZVSUlEQit4c21IZy85QW8KLS0tIEMvWWhYM3VyTWk0TnRJbHhublpa\nZEhKSitydFdMbmVWZ01mdlVtSWV6S2sKY7L+wbtpIlo00xQukuj1Fv4iKpC3BftP\n4+55dUhp9cc7VxqV/3TkfPxeyr95OltVZOHhhwSnEzcyCP9XQ16DIw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-08-01T09:25:47Z",
+		"mac": "ENC[AES256_GCM,data:nEaCXu003Y/kwtNrBT+reXOZfTOjhqxUXLvUFa4RFrFREgxIsNkqi80GyDFAaBbgAFA5B71Ozwh8Ml0g3TJ15DsoLkaUgrLR9gXIuh4FoDpFKmvFzUT7nm4Ac003b2bkaMPVNXRU24O+JVgK9U5tmKfqmEkRnlY5MTLFO5EGgnY=,iv:3RpMM6CjtWJSqY8T++2GIV4b3kN724h/ZhuS1U8lJGY=,tag:tkL5+aU06xF4LUeMoq6qoQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/b4l/b4l-grafana/adminpassword/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/b4l/b4l-grafana/subdomain/value

@@ -0,0 +1 @@
+grafana

vars/per-machine/b4l/b4l-nextcloud/subdomain/value

@@ -0,0 +1 @@
+cloud

vars/per-machine/b4l/b4l-paperless/adminpassword/machines/b4l

@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l

vars/per-machine/b4l/b4l-paperless/adminpassword/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:NsbmiB/AWbAHRotImbG89mQjINxWyCYx5QJExqv9eVpnUg==,iv:VKGzSmYZkKQzG/Fvs3Lk6KBexqKzoVOCk33Lw0ovUjY=,tag:4kWuchFThyRuqIA/tpEL2A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxS3F6cmZQN0V0bXpSbnhJ\nQUVwa2U5cGVVLytJWjdKWnErN0tNNjFhaEJvCjRZMFFSNEdFMlY5Q2J2R0pURUt2\nMkpuWUNrT01waFVGSnhxeEF2VGhPT1kKLS0tIGNpdU4weCtza25kWExHVHJlTThw\ncXBEK2Z6RWs1ZVdjbjdPK051Yk5JVEEKrWBxciIubjp2CfLdSMuSoRaWoFEzh2Ni\nQgsFK4B/1k1nAt7hT6ihRHdaZLRGR3oZljD6obQuZt/CQX4XK/vhpA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMzN5cTlrdlZhaTNxaUQ4\neHhCQWR5QVBKMEVnclFtQ2dUYzZKTitJWHdJCkFOTXVldjRJSVhmb29MY0RHcEk4\ncGtYMHZUcUIzcE0zVlp6cE0rNUlYMVUKLS0tIFhuckdZb2tFcFNIcm9tQjVyckJm\nZFVleEp4cG1GMUdOT2lhcTNKanZGR0EKwAHiw87p1/k+cOlC7TdM5ba7IrQ5nGSQ\nAWPSFjc3sX86aAQzkY/SBeQulj1tC3i4ryg09xUFg+oSPDXexpGp8g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-08-06T05:23:42Z",
+		"mac": "ENC[AES256_GCM,data:eK8RPnR3M4KUGFBtJ43UGq0F4hw+CL1NwoCJbzpX8W8i7pPJOXkIEi0Q4bi3ALMbUxHd5mYE5lKZj0VpPaV3f3t3AvcIg2zWamBYps5R108vwmIDd2UFtmCA496sOSJgpTNX13V8X5cK+3uYXYnd4fz9qAupvFpIpkqWqGl4kxU=,iv:/KOE9y1bzpCzI1jmXZ6mfh0jhVhOvpgS7GNIp2QxvhQ=,tag:e5gLfU+9SyxunVeuOVirhw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/b4l/b4l-paperless/adminpassword/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/b4l/b4l-paperless/subdomain/value

@@ -0,0 +1 @@
+paperless

vars/per-machine/b4l/b4l-pingvin/subdomain/value

@@ -0,0 +1 @@
+share

vars/per-machine/b4l/b4l-pocket-id/subdomain/value

@@ -0,0 +1 @@
+auth

vars/per-machine/b4l/b4l-stirling-pdf/subdomain/value

@@ -0,0 +1 @@
+pdf

vars/per-machine/b4l/b4l-victoriametrics/adminpassword/machines/b4l

@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l

vars/per-machine/b4l/b4l-victoriametrics/adminpassword/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:YpPv9DuLRdwX2CrLIU0Zr14KcrfaK2MW6N7VYBpIvw==,iv:DS2qhq/BMAVXqaGqYDH1cK3mv2nSWHbN6O+KCe/jXBk=,tag:mRvbZv/qSsAWVKmdqxrzpQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDeHFRMXFwd3JMakozY3po\nWUo1eDZRMmVkWGVPemZURk5tUUpKay9tc0ZRCjN6UWZ3OVBIQlRReFJUelEwN25y\nZlNqWGVJZjZtaUFKT3lLOW9CcElOMjQKLS0tIEVUSE16aWhYZHdSemViY3AvRWlN\nMnQ5Yk1rODZLOUpaZWovV0RPTEt5UHMKg9GsMtLAfX5y1yWULgdbj8GrXyYhMIMr\n+G4sLcp+HJjsIo0DFvlp0TJUeRuOTVi5XXw+IsFhFTsSqjV/YFFzjw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBamVSSDNuczB3UTJ1Vmoy\nbnM1Q0VDVlQwYU9NQ29vL3FCbjFsSitLWmxBCld6MlAvV3JNZjlsRjVqaUpzZExp\nUWtRS1o5VDQ2RXl1bHNPWmVLTEVGT0EKLS0tIHhkdmdiNUxBTkNPNldLNnZZOUdl\nTWtyaGFsa0NnMy9lQm5mR3FEMXN0TVkKgWedpfvq46qOOdgeFH76OkO7QQyVor/w\n30Rv1n9cqfNdqBog/gPvI/sTPqFfXPpnFJjYZLNG/rnJjPHAM0+hhA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-07-31T08:48:18Z",
+		"mac": "ENC[AES256_GCM,data:gXIh/MEkCPoL1tfGYIVQs6e335glFCz1AW0EAdVRX8VVxUk9vwNgf577Sd5fHDBuQsYrqMonRPwRYEACLtjaK37+mk1qa+A2gpg4OfhUJF1inrWXZoTY9SSH2LtlAWddcxDDAKA7n0Itqv0FkQuqVmmr3j3XzMf9fTMgAcgscDA=,iv:RZPNYp/6otR67smbNE+fcQqzO61+NEjp1sIHRTUpTl0=,tag:2Jx1M/Y+ODYRaOtps3KY2w==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/b4l/b4l-victoriametrics/adminpassword/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/b4l/b4l-victoriametrics/adminuser/value

@@ -0,0 +1 @@
+admin

vars/per-machine/b4l/b4l-victoriametrics/subdomain/value

@@ -0,0 +1 @@
+metrics

vars/per-machine/b4l/b4l-vikunja/subdomain/value

@@ -0,0 +1 @@
+todo

vars/per-machine/b4l/nextcloud/subdomain/value

@@ -0,0 +1 @@
+cloud

vars/per-machine/b4l/pocket-id/encryption-key/secret

@@ -1,18 +1,18 @@
 {
-	"data": "ENC[AES256_GCM,data:yZrojwRKV30K+fdy6htnj/d8cHlphZw02vbeFIq6ETur,iv:ihIwFQ9p0kxhTnooSPg0eVYI4cy9k2Kf/VSI+36IfwU=,tag:/lEQKm0IrnReyr6AzLt4Lw==,type:str]",
+	"data": "ENC[AES256_GCM,data:Z+f/21lCA4byBi52MuwK8K0xs5KkjyZDGJo0pQL1c2pM,iv:pfqOkBOch2n8PhFQxQorC3sY4O5ri1t5lul1UOOPmxg=,tag:L1T5b8MRkNxElXf3jIcEAA==,type:str]",
 	"sops": {
 		"age": [
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjSkwwU1dTekhvYUYrV2tU\nOWhTb3NlWWVOeVJvUTVkdGE2V3IyRDlqMWhBCjJqUU5XSWxsVFVteGoycHBjOHlI\nbXpuMHo1R2VxQWVPUHR5MTBlalhVK1kKLS0tIHBFeVRDN1BycUNFa3ZTUDE3S3Jw\nNExYbjBSOUtUQkpOUUFXbHVSOVBjcUUKVP7K2EuoSmUOznpP0+Jdfwd2tfYxADg9\nIbV3lCTeimo5pOBDrVWEmgHfeZFdV892sI062MmP/EqX7iqu34hi/g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwc2VJTWlGUEJnWlBvVHFn\neGFqUE93TmNLQ1NJZnZ1eGYyNGpWUkw1R1RRClV5T0dMVGlQK2VrTlpCQlJBV1ps\nTDFCdmE4cTdUMjZucVVGcGNmUUErWTQKLS0tIHkwODdJMWQxVFFubUV5ZTFneDFS\ndURNay9hWk81QTI5QS9RWS9HVWhNelkK0GXmKGfL2cfsziBKu6pllmHRQno6K0FA\nzHky0yt2H1w1svDfFw2+FyKHfHAwaQs+X2qXXlvIZ7jwtPj+wQXubQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmd0VmNS9MOEZxTXRtQlVT\ncVpZcUZNRmg0dzI1SGcybUtLNCsxNGViRjBVCkpLUlJXdTJvUlJ2d2o3eVNQelZR\nek9RSHVjSFlZbFBLRnhQS2lCTWlHWmMKLS0tIHk2dGlHZnVpVFJocFVsb1Vza25k\ncllSSkxXaGFzdDBVU3lwcE5LSEdvVzgKAjySzos4BQvf87Sk7m6Fn2b1kJzuaHuS\nlg9+ScPBjDGWVj8Ye1DKuJB44WD0nVCyECjUVNFbjhJh0bMLcIbOEQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoU1BqKy9HZnVrQ2ZudjBK\nWFVNQ0xPUHBOaFB2bEZvRVA0bEVQb1VYM3o0Ck95blBwckUxY3BZVkZZdHdINXlH\nYkZGdHNVQnE3ZmFja0xPaml1Y0tVWE0KLS0tIEVpNmlGanp6L1dRZGd1VVUxclZs\na3dBWmdIcFExbldFeW0zc2ZwRDVCckUKTjmYGY1RqzcijNepBd0wzDuWuywYN6oS\nQGVUhY1Tm2H+SUtIsnuNWkNsLC8LnDBIfx4DCWCYbLrC3HYmalpqPQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-07-14T06:46:06Z",
+		"lastmodified": "2025-07-30T02:42:06Z",
-		"mac": "ENC[AES256_GCM,data:Arm0JtsTlkiyfCva7MoAVQD/tMUqlS+UZprT/5IYiJli36HISEVlpr8Mc+i9Diia4wxyzq+wQqIrI/d5FG0e4FPcTi4r5X3ZyjyG6j4X+vqpIj/y6WBYjU9izXIDP5rHm7+knyhaXqzo6zXjbfvOuUG8NqdXcybA1O60xBkpq0I=,iv:j7+rlWlXtrhWlykkdygh+Luerr2xrtclgtmSQv8B9ug=,tag:nN/UaJrl/9LCS7IkIHJnrQ==,type:str]",
+		"mac": "ENC[AES256_GCM,data:rD5yrd5omOzzfmsA1NJgRrlP2fJEG0B7p3PrIdPJRKm3RmSHXsN7nBDfbIxMLOjU81V1z2kImnVI6kAqDeQefK6VIaqZT5h6tBMFJmUoqx55KX1PYfgICZ8wRB7nZp2LcEgtrgRnd1sjr4SbHW4s1BUxmE74WCzlDagasqqXM1s=,iv:p1KRZzDJEk3XAk+bVIYqEljqxO9p4Jx/537pQpoRnAA=,tag:WG+JVYlpCyHBXc2xycjZAQ==,type:str]",
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.10.2"
 	}