fix think-backend upload and get avartar image

bump nixpkgs
rm clanService/pingvin
2026-01-20 14:22:02 +07:00 · 2026-01-15 11:35:36 +07:00 · 2026-01-15 11:35:12 +07:00 · 2026-01-15 10:26:57 +07:00 · 2026-01-15 09:59:37 +07:00 · 2026-01-01 00:00:00 +00:00
127 changed files with 11046 additions and 198 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764799743,
-        "narHash": "sha256-MbbiNG/bhqe+4z7ml8TefIs4swSonmiV0CimCntXuCg=",
+        "lastModified": 1766984802,
+        "narHash": "sha256-SYZ/MXVtJEb3sRWxvPL/2HtpSL1CzQgu1o8ASXqCO98=",
        "ref": "refs/heads/main",
-        "rev": "ddc0f9fabf33ad000676a33e97be6b5df12a4560",
-        "revCount": 11417,
+        "rev": "052b66d8dc724c3e519b9003281c2f9a210fc380",
+        "revCount": 11770,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -49,11 +49,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1762942435,
-        "narHash": "sha256-zIWGs5FIytTtJN+dhDb8Yx+q4TQI/yczuL539yVcyPE=",
-        "rev": "0ee328404b12c65e8106bde9e9fab8abf4ecada4",
+        "lastModified": 1766977667,
+        "narHash": "sha256-LUALgG4ZpsA0k7pGYzMDto/r6T8aIPlYTok3lGlojjA=",
+        "rev": "3f852546b5d8bd2e9659a81c6b2cc14922e63a94",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0ee328404b12c65e8106bde9e9fab8abf4ecada4.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/3f852546b5d8bd2e9659a81c6b2cc14922e63a94.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -88,11 +88,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764627417,
-        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
+        "lastModified": 1766150702,
+        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
+        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
        "type": "github"
      },
      "original": {
@@ -121,6 +121,26 @@
        "type": "github"
      }
    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768068402,
+        "narHash": "sha256-bAXnnJZKJiF7Xr6eNW6+PhBf1lg2P1aFUO9+xgWkXfA=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "8bc5473b6bc2b6e1529a9c4040411e1199c43b4c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
    "import-tree": {
      "locked": {
        "lastModified": 1752730890,
@@ -162,11 +182,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764161084,
-        "narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
+        "lastModified": 1766784396,
+        "narHash": "sha256-rIlgatT0JtwxsEpzq+UrrIJCRfVAXgbYPzose1DmAcM=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "e95de00a471d07435e0527ff4db092c84998698e",
+        "rev": "f0c8e1f6feb562b5db09cee9fb566a2f989e6b55",
        "type": "github"
      },
      "original": {
@@ -190,11 +210,11 @@
    },
    "nixos-facter-modules": {
      "locked": {
-        "lastModified": 1764252389,
-        "narHash": "sha256-3bbuneTKZBkYXlm0bE36kUjiDsasoIC1GWBw/UEJ9T4=",
+        "lastModified": 1766558141,
+        "narHash": "sha256-Ud9v49ZPsoDBFuyJSQ2Mpw1ZgAH/aMwUwwzrVoetNus=",
        "owner": "nix-community",
        "repo": "nixos-facter-modules",
-        "rev": "5ea68886d95218646d11d3551a476d458df00778",
+        "rev": "e796d536e3d83de74267069e179dc620a608ed7d",
        "type": "github"
      },
      "original": {
@@ -205,11 +225,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1761656231,
-        "narHash": "sha256-krgZxGAIIIKFJS+UB0l8do3sYUDWJc75M72tepmVMzE=",
+        "lastModified": 1768395095,
+        "narHash": "sha256-ZhuYJbwbZT32QA95tSkXd9zXHcdZj90EzHpEXBMabaw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d7f52a7a640bc54c7bb414cca603835bf8dd4b10",
+        "rev": "13868c071cc73a5e9f610c47d7bb08e5da64fdd5",
        "type": "github"
      },
      "original": {
@@ -224,6 +244,7 @@
        "clan-core": "clan-core",
        "devshell": "devshell",
        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
        "import-tree": "import-tree",
        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
@@ -238,11 +259,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764483358,
-        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "lastModified": 1766894905,
+        "narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -15,6 +15,10 @@
      inputs.nixpkgs-lib.follows = "nixpkgs";
      url = "github:hercules-ci/flake-parts";
    };
+    home-manager = {
+      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
+    };
    import-tree.url = "github:vic/import-tree";
    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
    treefmt-nix = {
@@ -61,6 +65,7 @@
            };
            packages.think = pkgs.think-gtcm;
            packages.think-be = pkgs.think-backend-gtcm;
+            packages.file-uploader = pkgs.gtcm-file-uploader;
          };
      }
    );
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,4 +1,5 @@
 {
+  imports = [ ./personal-computer.nix ];
  clan = {
    inventory = {

@@ -11,6 +12,7 @@
        b4l = [
          "rigel"
          "neptune"
+          "rana"
        ];
        phonebox = [
          "neptune"
@@ -19,6 +21,7 @@
          "alpheratz"
          "mirach"
          "adhil"
+          "buna"
        ];
      };

@@ -159,13 +162,6 @@
          };
          roles.default.machines.b4l = { };
        };
-        pingvin = {
-          module = {
-            name = "pingvin";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
        paperless = {
          module = {
            name = "paperless";
@@ -199,6 +195,54 @@
            };
          };
        };
+        git-daemon = {
+          module = {
+            name = "git-daemon";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.repositories =
+              let
+                defaults = rec {
+                  write-access = [
+                    "10.0.0.0/24"
+                    "200:d7b1:c5d5:ea7:27ad:6837:40f6:404d/128"
+                  ];
+                  read-access = write-access;
+                };
+                PUBLIC = {
+                  read-access = [
+                    "10.0.0.0/24"
+                    "0200::/7"
+                  ];
+                };
+              in
+              builtins.mapAttrs (_: override: defaults // override) {
+                "9e" = PUBLIC;
+                archive-dl = { };
+                barrytown = { };
+                cleanroom = PUBLIC;
+                community-memory = { };
+                eris = { };
+                ftdi-sd-spi = { };
+                go-go-gadget = { };
+                hacking-the-kindle = { };
+                islands = PUBLIC;
+                kt = { };
+                legba = { };
+                llb = PUBLIC;
+                llc = PUBLIC;
+                lora = { };
+                mute = { };
+                navi = { };
+                notmuch-memoryhole = PUBLIC;
+                pms5003 = { };
+                thinc = PUBLIC;
+                toad = { };
+                yggdrasil-erlang = { };
+              };
+          };
+        };
      };
    };
  };
--- a/inventories/personal-computer.nix
+++ b/inventories/personal-computer.nix
@@ -0,0 +1,37 @@
+{
+  clan.inventory = {
+    tags = {
+      kde-desktop = [ "rana" ];
+      personal-computer = [ "rana" ];
+    };
+
+    instances = {
+      emmie-home = {
+        module = {
+          name = "home-user";
+          input = "self";
+        };
+        roles.default.settings = {
+          username = "emmie";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
+        roles.default.machines."rana" = { };
+      };
+      personal-computer = {
+        module = {
+          name = "personal-computer";
+          input = "self";
+        };
+        roles.default.tags."personal-computer" = { };
+      };
+      kde = {
+        module = {
+          name = "kde";
+          input = "clan-core";
+        };
+        roles.default.tags."kde-desktop" = { };
+      };
+    };
+  };
+}
--- a/inventory.json
+++ b/inventory.json
@@ -17,6 +17,12 @@
    },
    "adhil": {
      "installedAt": 1765277591
+    },
+    "buna": {
+      "installedAt": 1765343708
+    },
+    "rana": {
+      "installedAt": 1768294839
    }
  }
 }
--- a/machines/adhil/configuration.nix
+++ b/machines/adhil/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "adhil";
-  clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
+  clan.core.settings.name = "adhil";
+  # clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";

 }
--- a/machines/almach/configuration.nix
+++ b/machines/almach/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "almach";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "almach";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";

 }
--- a/machines/alpheratz/configuration.nix
+++ b/machines/alpheratz/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "alpheratz";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "alpheratz";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";

 }
--- a/machines/b4l/services/nextcloud.nix
+++ b/machines/b4l/services/nextcloud.nix
@@ -19,7 +19,7 @@ in

  services.nextcloud = {
    hostName = ncDomain;
-    package = pkgs.nextcloud31;
+    package = pkgs.nextcloud32;

    settings = {

--- a/machines/b4l/services/pingvin.nix
+++ b/machines/b4l/services/pingvin.nix
@@ -1,45 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-let
-  serviceName = "${config.networking.hostName}-pingvin";
-  domain-name = "${
-    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
-  }.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators."${serviceName}" = {
-    files = {
-      subdomain.secret = false;
-    };
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Pingvin. Default:(share)";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "share" > "$out"/subdomain
-      fi
-    '';
-  };
-
-  services.pingvin-share = {
-    nginx.enable = true;
-    https = true;
-    hostname = domain-name;
-  };
-}
--- a/machines/buna/configuration.nix
+++ b/machines/buna/configuration.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.core.settings.name = "buna";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
+
+}
--- a/machines/buna/disko.nix
+++ b/machines/buna/disko.nix
@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/usb-Generic_MassStorageClass_000000001539-0:0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/buna/facter.json
+++ b/machines/buna/facter.json
--- a/machines/mirach/configuration.nix
+++ b/machines/mirach/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "mirach";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "mirach";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";

 }
--- a/machines/neptune/configuration.nix
+++ b/machines/neptune/configuration.nix
@@ -56,7 +56,7 @@
    "tls://astrra.space:55535"
  ];

-  clan.meta.name = "neptune";
-  clan.meta.description = "Radxa SBC board for testing. (With vi)";
+  clan.core.settings.name = "neptune";
+  # clan.meta.description = "Radxa SBC board for testing. (With vi)";

 }
--- a/machines/ramus/configuration.nix
+++ b/machines/ramus/configuration.nix
@@ -5,10 +5,10 @@
    system = "x86_64-linux";
  };

-  clan.meta.name = "ramus";
-  clan.meta.description = ''
-    A Hetzner VPS machine own by Alex.
-  '';
+  clan.core.settings.name = "ramus";
+  # clan.meta.description = ''
+  #   A Hetzner VPS machine own by Alex.
+  # '';

  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
--- a/machines/ramus/think-greater-chiangmai.nix
+++ b/machines/ramus/think-greater-chiangmai.nix
@@ -1,6 +1,6 @@
 { self, config, ... }:
 let
-  commonSettings = {
+  commonSettings = rec {
    APP_NAME = "Laravel";
    APP_ENV = "local";
    APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
@@ -13,6 +13,7 @@ let
    DB_DATABASE = "thinkgtcm";
    DB_USERNAME = "gtcm";

+    R2_SCHEMA_URL = "https://${R2_BUCKET}.${R2_REGION}.your-objectstorage.com/test-large-files/";
    R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
    R2_SECRET_ACCESS_KEY._secret =
      config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
@@ -20,6 +21,8 @@ let
    R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
    R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;

+    R2_BUCKET_NAME = R2_BUCKET;
+
    LOG_CHANNEL = "stack";
    LOG_LEVEL = "debug";

--- a/machines/rana/configuration.nix
+++ b/machines/rana/configuration.nix
@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
--- a/machines/rana/disko.nix
+++ b/machines/rana/disko.nix
@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/nvme-SAMSUNG_MZVL81T0HFLB-00BLL_S7XKNF0Y966645";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/rana/facter.json
+++ b/machines/rana/facter.json
--- a/machines/sirius/configuration.nix
+++ b/machines/sirius/configuration.nix
@@ -19,7 +19,6 @@
    system = "x86_64-linux";
  };

-  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
  system.stateVersion = "25.11";

 }
--- a/modules/clan/actual-budget/default.nix
+++ b/modules/clan/actual-budget/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "actual-budget";
  manifest.description = "A local-first personal finance app ";
+  manifest.readme = "A local-first personal finance app";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "A default server role.";

    perInstance.nixosModule =
      {
--- a/modules/clan/git-daemon/default.nix
+++ b/modules/clan/git-daemon/default.nix
@@ -0,0 +1,174 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "git-daemon";
+  manifest.description = "a really simple server for git repositories";
+  manifest.readme = "a really simple server for git repositories";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options = with lib; {
+          directory = lib.mkOption {
+            type = types.str;
+            default = "/var/git";
+          };
+          repositories = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      read-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                      write-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            pkgs,
+            lib,
+            config,
+            ...
+          }:
+          {
+            systemd.services.git-init = {
+              serviceConfig = {
+                Type = "oneshot";
+                User = config.services.gitDaemon.user;
+                Group = config.services.gitDaemon.group;
+                ExecStartPre = toString [
+                  "+${pkgs.coreutils}/bin/install"
+                  "--directory"
+                  "--owner=${config.services.gitDaemon.user}"
+                  "--group=${config.services.gitDaemon.group}"
+                  "--mode=0750"
+                  settings.directory
+                ];
+                ExecStart =
+                  let
+                    git-template = pkgs.stdenv.mkDerivation {
+                      name = "git-template";
+                      buildCommand = ''
+                        cp --no-preserve=mode,ownership --recursive \
+                          ${pkgs.git}/share/git-core/templates $out
+                        install -m550 $out/hooks/post-update{.sample,}
+                      '';
+                    };
+                    init-script =
+                      { name, ... }:
+                      pkgs.writeShellScript "git-init-${name}" ''
+                        ${pkgs.git}/bin/git init \
+                          --bare --template=${git-template} --shared=0660 \
+                          ${settings.directory}/${name}.git
+                        ${pkgs.git}/bin/git \
+                          -C ${settings.directory}/${name}.git \
+                          config set receive.denyNonFastforwards false
+                      '';
+                  in
+                  map init-script (lib.attrValues settings.repositories);
+              };
+            };
+
+            services.gitDaemon = {
+              enable = true;
+              user = "git";
+              group = "git";
+              options =
+                let
+                  firewall = pkgs.writeText "git-daemon-firewall.json" (
+                    builtins.toJSON (builtins.attrValues settings.repositories)
+                  );
+                  hook = pkgs.writers.writePython3 "hook.py" { flakeIgnore = [ "E" ]; } ''
+                    import os, sys, enum, pathlib, ipaddress, json
+
+                    class Service(enum.Enum):
+                        UploadPack = enum.auto()
+                        ReceivePack = enum.auto()
+                        UploadArchive = enum.auto()
+
+                        @classmethod
+                        def parse(cls, string):
+                            return {
+                                'upload-pack': cls.UploadPack,
+                                'receive-pack': cls.ReceivePack,
+                                'upload-archive': cls.UploadArchive
+                            }[string]
+
+                        @property
+                        def service(self):
+                            return {
+                                UploadPack: 'read-access',
+                                ReceivePack: 'write-access'
+                            }[self]
+                    UploadPack = Service.UploadPack
+                    ReceivePack = Service.ReceivePack
+
+                    def parse_remote_addr(remote_addr):
+                        if remote_addr.startswith('[') and remote_addr.endswith(']'):
+                            return ipaddress.ip_address(remote_addr[1:-1])
+                        return ipaddress.ip_address(remote_addr)
+
+                    service = Service.parse(sys.argv[1])
+                    repo = pathlib.Path(sys.argv[2]).stem
+                    client = parse_remote_addr(os.environ['REMOTE_ADDR'])
+
+                    with open("${firewall}", 'r') as f:
+                        firewall = json.load(f)
+
+                    for rule in firewall:
+                        if rule["name"] == repo:
+                           for network in rule[service.service]:
+                               if client in ipaddress.ip_network(network):
+                                   sys.exit(0)
+                    print('stairway denied')
+                    sys.exit(1)
+                  '';
+                in
+                toString [
+                  "--enable=upload-pack"
+                  "--enable=receive-pack"
+                  "--disable=upload-archive"
+                  "--access-hook=${hook}"
+                  "--informative-errors"
+                ];
+              exportAll = true;
+              basePath = settings.directory;
+            };
+
+            systemd.services.git-daemon = {
+              requires = [ "git-init.service" ];
+              after = [ "git-init.service" ];
+            };
+
+            networking.firewall.allowedTCPPorts = [ 9418 ];
+          };
+      };
+  };
+}
--- a/modules/clan/git-daemon/flake-module.nix
+++ b/modules/clan/git-daemon/flake-module.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    git-daemon = module;
+  };
+}
--- a/modules/clan/grafana/default.nix
+++ b/modules/clan/grafana/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "grafana";
  manifest.description = "Platform for data analytics and monitoring";
+  manifest.readme = "Platform for data analytics and monitoring";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "A default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/home-profiles/flake-module.nix
+++ b/modules/clan/home-profiles/flake-module.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    home-user = lib.modules.importApply ./home-user { };
+  };
+}
--- a/modules/clan/home-profiles/home-user/default.nix
+++ b/modules/clan/home-profiles/home-user/default.nix
@@ -0,0 +1,64 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "common-user-home-manager";
+  manifest.description = "General users' home-manager profile generator";
+  manifest.readme = "General users' home-manager profile generator";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default role for the user";
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          username = lib.mkOption {
+            type = lib.types.str;
+          };
+          kbLayout = lib.mkOption {
+            type = lib.types.str;
+            default = "us";
+          };
+          kbOptions = lib.mkOption {
+            type = lib.types.str;
+            default = "grp:win_space_toggle";
+          };
+        };
+      };
+    perInstance =
+      { settings, ... }:
+      {
+        nixosModule =
+          { inputs, ... }:
+          let
+            username = settings.username;
+          in
+          {
+            imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+            users.users.${username} = {
+              initialPassword = "";
+              isNormalUser = true;
+              extraGroups = [
+                "audio"
+                "video"
+                "networkmanager"
+              ];
+            };
+
+            services.xserver = {
+              enable = true;
+              xkb.layout = settings.kbLayout;
+              xkb.options = settings.kbOptions;
+            };
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.${username} = ./home.nix;
+            home-manager.extraSpecialArgs = {
+              inherit inputs username;
+            };
+          };
+      };
+  };
+}
--- a/modules/clan/home-profiles/home-user/home.nix
+++ b/modules/clan/home-profiles/home-user/home.nix
@@ -0,0 +1,24 @@
+{
+  osConfig,
+  pkgs,
+  lib,
+  username,
+  ...
+}:
+{
+  home = {
+    inherit username;
+    homeDirectory = lib.mkForce "/home/${username}";
+    stateVersion = osConfig.system.stateVersion;
+    packages = with pkgs; [
+      libreoffice
+      element-desktop
+      brave
+      firefox
+      keepassxc
+      vlc
+      thunderbird
+    ];
+  };
+  programs.home-manager.enable = true;
+}
--- a/modules/clan/jukebox/default.nix
+++ b/modules/clan/jukebox/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "jukebox";
  manifest.description = "mpd server, library on removable disks";
+  manifest.readme = "mpd server, library on removable disks";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    interface =
      { lib, ... }:
      {
@@ -111,19 +113,22 @@

            services.mpd = {
              enable = true;
-              musicDirectory = settings.baseDir;
-              network.listenAddress = "any";
-              extraConfig = ''
-                audio_output {
-                  type "pulse"
-                  name "jukebox"
-                  server "localhost"
-                }
-              '';
+              openFirewall = true;
+              settings = {
+                bind_to_address = "any";
+                music_directory = settings.baseDir;
+                audio_output = [
+                  {
+                    type = "pulse";
+                    name = "jukebox";
+                    server = "localhost";
+                  }
+                ];
+              };
            };

            networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
-              allowedTCPPorts = [ config.services.mpd.network.port ];
+              allowedTCPPorts = [ config.services.mpd.settings.port ];
            });

            environment.systemPackages = [ pkgs.mpc ];
--- a/modules/clan/nextcloud/default.nix
+++ b/modules/clan/nextcloud/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "nextcloud";
  manifest.description = "Nextcloud server, a safe home for all your data";
+  manifest.readme = "Nextcloud server, a safe home for all your data";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/paperless/default.nix
+++ b/modules/clan/paperless/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "paperless";
  manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.readme = "A community-supported supercharged document management system: scan, index and archive all your documents";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/personal-computer/automatic-timezone.nix
+++ b/modules/clan/personal-computer/automatic-timezone.nix
@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  services.automatic-timezoned.enable = true;
+  services.geoclue2 = {
+    enableDemoAgent = lib.mkForce true;
+    geoProviderUrl = "https://beacondb.net/v1/geolocate";
+  };
+}
--- a/modules/clan/personal-computer/default.nix
+++ b/modules/clan/personal-computer/default.nix
@@ -0,0 +1,21 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "personal-computer";
+  manifest.description = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.readme = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "an only one default role";
+    perInstance.nixosModule =
+      { inputs, lib, ... }:
+      {
+        imports = [
+          (inputs.import-tree.initFilter (
+            p: !lib.hasSuffix "default.nix" p && !lib.hasSuffix "flake-module.nix" p
+          ) ./.)
+        ];
+      };
+  };
+}
--- a/modules/clan/personal-computer/desktop-environment.nix
+++ b/modules/clan/personal-computer/desktop-environment.nix
@@ -0,0 +1,4 @@
+{ config, ... }:
+{
+  security.pam.services."sddm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+}
--- a/modules/clan/personal-computer/flake-module.nix
+++ b/modules/clan/personal-computer/flake-module.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    personal-computer = lib.modules.importApply ./default.nix { };
+  };
+}
--- a/modules/clan/personal-computer/libinput.nix
+++ b/modules/clan/personal-computer/libinput.nix
@@ -0,0 +1,11 @@
+{
+  services = {
+    libinput = {
+      enable = true;
+      touchpad = {
+        disableWhileTyping = true;
+        naturalScrolling = true;
+      };
+    };
+  };
+}
--- a/modules/clan/personal-computer/printing.nix
+++ b/modules/clan/personal-computer/printing.nix
@@ -0,0 +1,62 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  allowManageGroups = [
+    "root"
+    "wheel"
+    "lpadmin"
+  ];
+  polkitAllowGroups = builtins.concatStringsSep "||" (
+    builtins.map (group: ''subject.isInGroup("${group}")'') allowManageGroups
+  );
+
+  printerMember = lib.map (user: user.name) (
+    lib.attrsets.attrsToList (
+      lib.attrsets.filterAttrs (name: value: value.isNormalUser) config.users.users
+    )
+  );
+
+in
+{
+  services.printing = {
+    enable = true;
+    drivers = [
+      pkgs.brlaser
+      pkgs.gutenprint
+    ];
+
+    extraFilesConf = ''
+      SystemGroup ${builtins.concatStringsSep " " allowManageGroups}
+    '';
+  };
+
+  security.polkit = {
+    enable = true;
+
+    extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        var actionMatchs = (
+          action.id.indexOf('org.opensuse.cupspkhelper.mechanism.') === 0
+        );
+        if (actionMatchs) {
+          if (${polkitAllowGroups}) {
+            return polkit.Result.YES
+          }
+        }
+      });
+    '';
+  };
+
+  hardware.sane = {
+    enable = true;
+  };
+
+  users.groups.lpadmin.members = printerMember;
+  users.groups.lp.members = printerMember;
+  users.groups.scanner.members = printerMember;
+
+}
--- a/modules/clan/personal-computer/users.nix
+++ b/modules/clan/personal-computer/users.nix
@@ -0,0 +1,11 @@
+{ lib, ... }:
+{
+  users.mutableUsers = lib.mkForce true;
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if ((action.id == "org.freedesktop.accounts.change-own-password")) {
+        return polkit.Result.AUTH_SELF;
+      }
+    });
+  '';
+}
--- a/modules/clan/personal-computer/wireless.nix
+++ b/modules/clan/personal-computer/wireless.nix
@@ -0,0 +1,4 @@
+{
+  networking.networkmanager.enable = true;
+  hardware.bluetooth.enable = true;
+}
--- a/modules/clan/phonebox/default.nix
+++ b/modules/clan/phonebox/default.nix
@@ -1,11 +1,16 @@
-{ clanLib, ... }:
+{
+  clanLib,
+  ...
+}:
 {
  _class = "clan.service";
  manifest.name = "phonebox";
-  manifest.description = "";
+  manifest.description = "A peer to peer phone relay network built on top of yggdrasil.";
+  manifest.readme = "A peer to peer phone relay network built on top of yggdrasil.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    interface =
      { lib, ... }:
      {
@@ -14,6 +19,11 @@
          description = "An Ethernet interface that connect to ATA box.";
          default = "enp2s0";
        };
+        options.ownerName = lib.mkOption {
+          type = lib.types.str;
+          description = "";
+          default = "";
+        };
      };
    perInstance =
      {
@@ -22,6 +32,7 @@
        ...
      }:
      {
+
        nixosModule =
          {
            lib,
@@ -30,11 +41,61 @@
            ...
          }:
          let
+            asterisk = pkgs.asterisk.overrideAttrs (old: {
+              propagatedNativeBuildInputs = [ pkgs.spandsp3 ];
+            });
+
+            machines = lib.attrNames roles.default.machines;
+
            user = "asterisk";
+            faxDir = "/run/asterisk/fax";
            rtpPortFrom = 10000;
            rtpPortTo = 20000;
            ata-interface = settings.ata-ethernet-iface;

+            contactList = builtins.map (machineName: {
+              name = "${clanLib.getPublicValue {
+                flake = config.clan.core.settings.directory;
+                machine = machineName;
+                generator = "phonebox";
+                file = "owner-name";
+                default = null;
+              }}";
+              number = "${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "server-prefix-number";
+                  default = null;
+                }
+              }${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "ata-local-number";
+                  default = null;
+                }
+              }";
+            }) machines;
+
+            createContactListTiff =
+              let
+                contactTXT = lib.concatStringsSep "\n" (
+                  builtins.map (contact: "${contact.number}\t\t: \t\t${contact.name}") contactList
+                );
+              in
+              pkgs.writeShellApplication {
+                name = "create-contact-tiff";
+                text = ''
+                  magick -background white -fill black -pointsize 20 -font DejaVu-Sans label:"${contactTXT}" "$1"
+                  magick "$1" -border 20x50 -bordercolor white "$1"
+                  magick "$1" -resize 1728x -units PixelsPerInch -compress Group4 -density 204x196 -monochrome -depth 1 "$1"
+                '';
+                runtimeInputs = [ pkgs.imagemagick ];
+              };
+
            genServerSIPEndpoint =
              { hostname, address }:
              ''
@@ -97,26 +158,35 @@
                throw "clanService/yggdrasil is required";
          in
          {
-            clan.core.vars.generators.phonebox = {
+            clan.core.vars.generators.phonebox = builtins.break {
              files = {
                server-prefix-number.secret = false;
                ata-local-number.secret = false;
+                owner-name.secret = false;
              };

              prompts = {
                server-prefix-number = {
                  type = "line";
+                  persist = true;
                  description = "Server prefix number: indicate server to connect to [10XX]";
                };
                ata-local-number = {
+                  persist = true;
                  type = "line";
                  description = "Local suffix number: indicate local number on the server [XX00]";
                };
+                owner-name = {
+                  persist = true;
+                  type = "line";
+                  description = "The owner's name for this unit";
+                };
              };

              script = ''
                cat $prompts/server-prefix-number > $out/server-prefix-number
                cat $prompts/ata-local-number > $out/ata-local-number
+                cat $prompts/owner-name > $out/owner-name
              '';
            };

@@ -191,9 +261,9 @@

            services.asterisk = {
              enable = lib.mkDefault true;
+              package = lib.mkDefault asterisk;
              confFiles =
                let
-                  machines = lib.attrNames roles.default.machines;
                  nodes = builtins.foldl' (
                    nodes: name:
                    nodes
@@ -240,6 +310,13 @@
                    syslog.local0 => notice,warning,error
                  '';

+                  "modules.conf" = ''
+                    [modules]
+                    autoload=yes
+
+                    load => res_fax_spandsp.so
+                  '';
+
                  # Dial plan config
                  "extensions.conf" =
                    let
@@ -257,6 +334,23 @@
                      same  =>     n,Playback(hello-world)
                      same  =>     n,Hangup()

+                      exten => 000,1,Answer()
+                      same => n,ReceiveFAX(${faxDir}/echo-''${UNIQUEID}.tiff)
+                      same => n,Set(FAXFILE=${faxDir}/echo-''${UNIQUEID}.tiff)
+                      same => n,Set(FAXECHO=true)
+
+                      exten => 888,1,Answer()
+                      same => n,Set(FAXFILE=${faxDir}/contact.tiff)
+                      same => n,System(${lib.getExe createContactListTiff} ''${FAXFILE})
+                      same => n,Set(FAXECHO=true)
+                      same => n,Playback(vm-goodbye)
+                      same => n,Wait(3)
+
+                      exten => h,1,GotoIf($[''${FAXECHO}]?sendfax)
+                      same => n,Hangup()
+                      same => n(sendfax),Originate(PJSIP/00,app,SendFAX,''${FAXFILE})
+                      same => n,Set(FAXECHO=false)
+
                    ''
                    + (genLocalExtenConf {
                      localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
@@ -318,6 +412,14 @@
                };
            };

+            environment.systemPackages = [
+              createContactListTiff
+            ];
+
+            systemd.tmpfiles.rules = [
+              "d ${faxDir}                            0755 ${user} ${user} - -"
+            ];
+
            systemd.services.asterisk-watcher = {
              enable = true;
              description = "Asterisk Configuration files watcher";
@@ -338,6 +440,12 @@
                      asterisk -rx "pjsip reload"
                      ;;
                  esac
+                  case "$file" in
+                    extensions.conf)
+                      echo "restarting core"
+                      asterisk -rx "core restart now"
+                      ;;
+                  esac
                done
              '';
            };
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/owner-name/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/owner-name/value
@@ -0,0 +1 @@
+fake_line_value
--- a/modules/clan/pingvin/default.nix
+++ b/modules/clan/pingvin/default.nix
@@ -1,23 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "pingvin";
-  manifest.description = "A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient file sharing.";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-
-    perInstance.nixosModule =
-      {
-        config,
-        ...
-      }:
-      {
-        services.pingvin-share = {
-          enable = true;
-        };
-
-        clan.core.state.pingvin-share.folders = [ config.services.pingvin-share.dataDir ];
-      };
-  };
-}
--- a/modules/clan/pingvin/flake-module.nix
+++ b/modules/clan/pingvin/flake-module.nix
@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    pingvin = module;
-  };
-
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-pingvin = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/pingvin" = module;
-      };
-    };
-}
--- a/modules/clan/pingvin/tests/vm/default.nix
+++ b/modules/clan/pingvin/tests/vm/default.nix
@@ -1,42 +0,0 @@
-{
-  ...
-}:
-{
-  name = "service-pingvin";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        pingvin-test = {
-          module.name = "@clan/pingvin";
-          module.input = "self";
-          roles.default.machines."server".settings = { };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      services.pingvin-share = {
-        hostname = "share.localhost";
-        frontend.port = 3000;
-        backend.port = 8000;
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("pingvin-share-frontend")
-
-    server.succeed("systemctl status pingvin-share-frontend")
-    server.wait_for_open_port(3000)
-    server.wait_for_open_port(8000)
-    server.succeed("curl -H \"Host: share.localhost\" http://127.0.0.1:3000 ")
-  '';
-}
--- a/modules/clan/pocket-id/default.nix
+++ b/modules/clan/pocket-id/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "pocket-id";
  manifest.description = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
+  manifest.readme = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/pulse-stream/default.nix
+++ b/modules/clan/pulse-stream/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "pulse-stream";
  manifest.description = "stream audio to attached speakers";
+  manifest.readme = "stream audio to attached speakers";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default role";
    interface =
      { lib, ... }:
      {
--- a/modules/clan/stirling-pdf/default.nix
+++ b/modules/clan/stirling-pdf/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "stirling-pdf";
  manifest.description = "Your locally hosted one-stop-shop for all your PDF needs.";
+  manifest.readme = "Your locally hosted one-stop-shop for all your PDF needs.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/clan/victoriametrics/default.nix
+++ b/modules/clan/victoriametrics/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "Victoria Metrics";
  manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
+  manifest.readme = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        config,
--- a/modules/clan/vikunja/default.nix
+++ b/modules/clan/vikunja/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "vikunja";
  manifest.description = "The to-do app to organize your life.";
+  manifest.readme = "The to-do app to organize your life.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "yggdrasil";
  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.readme = "An in scalable routing as an encrypted IPv6 overlay network";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default peer role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/nixos/think-backend-gtcm.nix
+++ b/modules/nixos/think-backend-gtcm.nix
@@ -7,6 +7,30 @@
 let
  cfg = config.services.think-backend-greaterchiangmai;
  think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
+  file-uploader = pkgs.gtcm-file-uploader.override { dataDir = cfg.dataDir; };
+
+  nginxNodeProxyConfig = ''
+    proxy_pass http://127.0.0.1:3000;
+
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host $host;
+    proxy_set_header x-webobjects-server-protocol HTTP/1.0;
+    proxy_set_header x-webobjects-remote-host 127.0.0.1;
+    proxy_set_header x-webobjects-server-port $server_port;
+    proxy_set_header x-webobjects-server-name $server_name;
+    proxy_set_header x-webobjects-server-url $scheme://$host;
+    proxy_connect_timeout 90;
+    proxy_send_timeout 90;
+    proxy_read_timeout 90;
+    proxy_buffer_size 64k;
+    proxy_buffers 8 64k;
+    proxy_busy_buffers_size 64k;
+    proxy_temp_file_write_size 64k;
+    client_max_body_size 50m;
+    client_body_buffer_size 128k;
+  '';
+
  defaultUser = "gtcm";
  defaultGroup = "gtcm";

@@ -33,7 +57,7 @@ in
    dataDir = lib.mkOption {
      type = lib.types.path;
      default = "/var/lib/think-backend.greaterchiangmai.com";
-      description = ''A place where to store states'';
+      description = "A place where to store states";
    };

    user = lib.mkOption {
@@ -142,6 +166,19 @@ in
      '';
    };

+    systemd.services.gtcm-file-uploader = {
+      description = "File upload service for think-backend.greaterchiangmai.com";
+      requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
+      before = [ "phpfpm-think-backend-gtcm.service" ];
+      serviceConfig = {
+        User = cfg.user;
+        WorkingDirectory = "${file-uploader}";
+        ExecStart = "${lib.getExe pkgs.nodejs_20} ${file-uploader}/src/be/index.js";
+        Restart = "on-failure";
+      };
+      path = [ pkgs.nodejs_20 ];
+    };
+
    environment.systemPackages = [
      artisan-be
    ];
@@ -226,6 +263,7 @@ in
          # migrate & seed db
          ${lib.getExe php} artisan key:generate --force
          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan storage:link
          ${lib.getExe php} artisan config:cache
        '';
    };
@@ -233,8 +271,8 @@ in
    systemd.tmpfiles.rules = [
      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
-      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
-      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0755 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0755 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
@@ -244,6 +282,8 @@ in
      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+
+      "d ${cfg.dataDir}/gtcm-file-uploader/uploads      0700 ${cfg.user} ${cfg.group} - -"
    ];

    networking.firewall.allowedTCPPorts = [
@@ -265,12 +305,28 @@ in
            index = "index.php";
            tryFiles = "$uri $uri/ /index.php?$query_string";
          };
+          "/uploads" = {
+            root = "${cfg.dataDir}/public/uploads";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "/storage" = {
+            root = "${cfg.dataDir}/public/storage";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
          "~ \\.php$".extraConfig = ''
            fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
          '';
          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
            extraConfig = "expires 365d;";
          };
+          "^~ /initiate-multipart-upload".extraConfig = nginxNodeProxyConfig;
+          "^~ /get-presigned-url".extraConfig = nginxNodeProxyConfig;
+          "^~ /complete-multipart-upload".extraConfig = nginxNodeProxyConfig;
+          "^~ /generate-presigned-url".extraConfig = nginxNodeProxyConfig;
+          "^~ /enable-bucket-cors".extraConfig = nginxNodeProxyConfig;
+          "^~ /upload".extraConfig = nginxNodeProxyConfig;
        };
      };
    };
--- a/modules/nixos/think-gtcm.nix
+++ b/modules/nixos/think-gtcm.nix
@@ -33,7 +33,7 @@ in
    dataDir = lib.mkOption {
      type = lib.types.path;
      default = "/var/lib/think.greaterchiangmai.com";
-      description = ''A place where to store states'';
+      description = "A place where to store states";
    };

    user = lib.mkOption {
@@ -228,6 +228,7 @@ in
          # migrate & seed db
          ${lib.getExe php} artisan key:generate --force
          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan storage:link
          ${lib.getExe php} artisan config:cache
        '';
    };
@@ -267,7 +268,16 @@ in
            index = "index.php";
            tryFiles = "$uri $uri/ /index.php?$query_string";
          };
-
+          "/uploads" = {
+            root = "${cfg.dataDir}/public/uploads";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "/storage" = {
+            root = "${cfg.dataDir}/public/storage";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
          "~ \\.php$".extraConfig = ''
            fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
          '';
--- a/pkgs/gtcm-file-uploader.nix
+++ b/pkgs/gtcm-file-uploader.nix
@@ -0,0 +1,40 @@
+{
+  fetchgit,
+  buildNpmPackage,
+  pkgs,
+  dataDir ? "/var/lib/gtcm-file-uploader",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "6f8c8d7dfaf5a0c1eb2077de1d6fb35ceaf3d4ec";
+    hash = "sha256-2mCdn8xGjWZrANclctGTmxQhkNc43VzlzMTVwVIFJcM=";
+  };
+  src = "${repoSrc}/upload-large-file";
+in
+buildNpmPackage {
+  pname = "gtcm-file-uploader";
+  version = "1.0.0";
+
+  nativeBuildInputs = with pkgs; [
+    nodejs_20
+    breakpointHook
+  ];
+
+  inherit src;
+
+  npmDepsHash = "sha256-JEp2F1CQfuV9fSYZRdRO+BiOE9dy1ReK6doJcqCuxu4=";
+
+  buildPhase = ''
+    npm install
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r * $out
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/gtcm-file-uploader/uploads $out/src/be/uploads
+    runHook postInstall
+  '';
+}
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -1,4 +1,5 @@
 final: prev: {
  think-gtcm = final.callPackage ./think-gtcm.nix { };
  think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
+  gtcm-file-uploader = final.callPackage ./gtcm-file-uploader.nix { };
 }
--- a/pkgs/think-backend-gtcm.nix
+++ b/pkgs/think-backend-gtcm.nix
@@ -21,12 +21,16 @@ php.buildComposerProject2 (finalAttrs: {
    runHook preInstall
    mkdir -p $out
    cp -R * $out
+
    rm -rf $out/storage
+
    ln -s ${dataDir}/.env $out/.env
    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/public/storage $out/public/storage
+    ln -s ${dataDir}/public/uploads $out/public/uploads
    runHook postInstall
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-eXm1x3E9KHWojaT2RU4inMdZqQVcWdLCKlvzhOlIZrc=";
+  vendorHash = "sha256-wGfbprSDULBje1s5y3+ZiU/nCwYGDEULobZzyzGZ9bQ=";
 })
--- a/pkgs/think-gtcm.nix
+++ b/pkgs/think-gtcm.nix
@@ -21,12 +21,16 @@ php.buildComposerProject2 (finalAttrs: {
    runHook preInstall
    mkdir -p $out
    cp -R * $out
+
    rm -rf $out/storage
+
    ln -s ${dataDir}/.env $out/.env
    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/public/storage $out/public/storage
+    ln -s ${dataDir}/public/uploads $out/public/uploads
    runHook postInstall
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-QV3hR3U3GwCqrCRxfkazmJwDpO1vFyMfA6YqUb4bjMI=";
+  vendorHash = "sha256-b8+AKUmjQiOdV8UC9GYfJzAHFs9+FRSH91YsxKt0rDA=";
 })
--- a/sops/machines/buna/key.json
+++ b/sops/machines/buna/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+    "type": "age"
+  }
+]
--- a/sops/machines/rana/key.json
+++ b/sops/machines/rana/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+    "type": "age"
+  }
+]
--- a/sops/secrets/buna-age.key/groups/admins
+++ b/sops/secrets/buna-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/buna-age.key/secret
+++ b/sops/secrets/buna-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:j5R4ApBy0c5t6wGmT0kRBT8g/G3HY2yVxR3/U1JqQrm6P/mzqJC5JDigGBWAZcdWv7wxQDXlkGi/ipEEhJsk8/if9S1atlMazF4=,iv:g6VPTjS5I+f7lVLcraBGXkI7cvyPgs3wgrfa14iGdvE=,tag:iz+/QqEBPD9EkRE9EL1mLA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac01oOTRpQWFRaEhqM3FK\ndlpQNmU3d09pVHhxTktCeXRPRWVpZ3dzRGx3CnVLckkzQzlzOFdwc2FvTWF5ODVl\nSXJ4di9CcU9wcHhvNmdJczhDSTZMMWsKLS0tIGRrWHNINjRzeFNPZVBtcm52bmZv\nZVFJT3doVi8rY0RyOENRVEdVNjNoOVEKBwhAaM9nRfShEF2B2N4LBaY3WA0Jzib3\nZRXnpnaSVlbnCqJIXU9bYMA/UIQ7b8bRR2xQ0Y+gMabBI0Dzf6TmoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWc2p2NEFFM1NrUllYM0lN\nRUJhQzJXZ3N1ZlpsWmo0L2VneFdnc25KQVUwCkQvdm9leXlMVitQNXN1OHpWM0RI\nZG16bHZVZlZlNHl0UERhWTVpUithalEKLS0tIHo3ZEdtZWo4QmM1SUpuMW8xczg4\nSWFtN2pWS05wdGlQWDZHcFRoWHJUR2sKzy85bPbem51i3FUzhTgk7eEVDbOF3vgR\npbINpu0LikVOrYOgop8cxU94QBWbS1VQd/kCIAYot1jMZs5Xvf9L3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNFT3h4K21F\nam5aMStNRHg3b0dFZm5tYmplSmxFRjBiakJJMExjS2poVEkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprMG5MSzk0YmlGaHpySzZFYk00eFpr\nbllMYmxkMkU1UlNGVWVYWHB2L3VNCi0tLSBCcUdaem9VYStjRmlsOWx3ckFnd3Nq\nR3BRTE9SaE9TQWs4VUZCRmQ3UmgwCj/4vmhRs9W6U9ay6mYFxPd6SvOTvxvYn/Oo\nuY7/N3PVpXxRK/UwovEGqY97AG/dEQk+I0/5AowFGmfPURpqKjo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGRvMUlHeVhn\nU3BhcEV1bU5uZjZqa25ydHhDOFUyNUQ2SzRadzk2ek9YbjggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYS0Rrb1poMTRDNmd2eW5QSWJvU1hB\nYVpTYnF1NmQ0SkNsa0xCNTh4bEYwCi0tLSBZZDhMZ0JsQ0dPQ2VWYXpMZE9Fb2FY\nY25qNFdFbVo0dURyUHd1MDl6NFlvCjFQKnkAmGuTioiY11oEgdD4Ctcw1gFF7xR1\nk9RV6JRXe8YeuWYpQjS17vQVR65TpJukYWm9UYy3NPP4Xu72toc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5HdTZDY3VH\nVnNvNHE2blFqM2pma001OGRWdGYxOHY2UkVhVW44bDdGUVEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjNkdSYlppQU51Wk40QzBlQ2lzaFBR\naWE1NDNOa21uNUNNWFBZWTVtKzJBCi0tLSBOWE1vUDZtVzRLMVdOMXBsNVpwMEc0\nTmwvZGVHd1Z0akJhempkZEdVSmpFCsnAxyLUrUbyMSBvak3VXBSdR5RmmL7eBjnM\nrw+kRLE8NFVwFiCZXgZDBlB2FkVKYvaL/hxsn4LYi3k53U9+vD0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmOUVPQ0RoSG95RUVnK3hC\nTHFEUHA2VWdadlBoNVRFNUl3Z0hOcjVXaVRzCkRXRTczZWRmenVZeHFWVVBEK2Z3\nVXFPWkpDak84akhEaTdkMjFUcmpnVTAKLS0tIGJLZFQ0UUVYeHkrTCsyYjVHcDQw\nUisxV3RVSEEycGhoSkttaEVXaTV0cFkKKo+lqTI+k6WDdPbMNo1owWH4/RoBt9e6\nmGO+sjziFzrZWUXx4RilR2F/3afRA/CdjzPab9I1sut3I6Z7FXNjYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscXI3NGV1R3lNQjE4U3Nj\nb0ZTNndORXlIY3d4bWVWYzRVTzZHWC9sV3owClRWc2tRaytsQkxFazlyOFU4V2RS\nYTEvY2swdDRnMGowdzZESTVVeTNkN2sKLS0tIFk2alJHUkwrMTVsdG1LQ2pReHA5\nTllyMFhML1JJdWQ1NXJkb2U5K3F4K1UKn6OPUfym5f9aacaHq962347dNeTjBfK/\nAMXPZXs6DawU8vko1RqIgzX/7StrITcXGcFfTutmpSa3KjMzuzeb+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1eXVNcklwZnI2dEtRaFdD\nOUVON1Nxd2l4L2xtYUtRSHlXVlc0VzVhZkZVCitxYjJTbDZDQjNHc2JrWmFaaEp0\nR1NMUEllalZxeHRndGxGRTZGSzV4TkEKLS0tIDhNZ2x0amhKdk1IdG16S0RLbWMz\nQSs0eTZ5YVBGdkdxYkhweUdMVVR3QVkKmau0k5SxJD/EURq6Lp4aDMYCoCFLOo/I\nRj5mAP4YGIVTU47HJYNcPcwzgwA6YVqVOiKaG6yyU7u1DsddaZHdiw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaHdMdC9jeDFWdktiV1JC\neDlFbW5QbmxVSStMZTYvak16K255TnZzMFdNCnFuOFlHVlYvQStmYWhITWl6NUN1\nOTdFdjg0OWZhUVd3NjQrcXQrNm9CWFkKLS0tIG9VWGZhUDJGWDNjTVg1bFMvVE5u\nYnkzV3QyczIrK1hLbUV1Q2twaDkxNm8KpHCL8htFz8UeMLsXmDUz/nAdTYsRSka1\nuq+bFkrVexExxqXJVyIXf20ceziFG8t5on8OGHDCOQsst4HEgRqyWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:15Z",
+		"mac": "ENC[AES256_GCM,data:wJ646ZAfUOSwXnkIUDkvm4wz7uaW4U7bCkC/8uFuoTwY16F5+1N7AxaSE453w2cOCJE5qOAXORYj5M7J8o84LjLWYN4+PYjCcU2ulL9rug29fNblqFHG8G1OdHwURep6sGKfvsSCTGgpnA5fYmXucYWIqc27cQ9HDtiHw3Bojas=,iv:L6xUGwjihD08Ahc/3WoA3tZDXvllmNWK90RpK7m+4Pw=,tag:pMynp2rs42lenOYbLQ0c0A==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/buna-age.key/users/kurogeek
+++ b/sops/secrets/buna-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/secrets/rana-age.key/groups/admins
+++ b/sops/secrets/rana-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/rana-age.key/secret
+++ b/sops/secrets/rana-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:xkoZtvAxTFuTOtBu8Pc7X2aVgOdjFwSFHLuX92DuSLxBX3NW+YP0Qo/0y3dyVjwR/nPHj6N7LjSqHMC2aZLgcR1kYJchyjZ8ISw=,iv:CGJD7bDqMVbp1KxDswK3iizmV8vZiVcBUP5vUc7qqDA=,tag:K967EvYAzD6eOGwSQ4dTew==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUHhPbEROVjkwVFh6TE0r\nUW1KN1U4eTEzN0JQcUJFWjdvT2V2WnpUMlU4ClM0NWJmRzg3aVFRSFgzcllTOE1r\nV3lGVlJ5WkRMYm9xb0xoWGladlpYbVkKLS0tIFpoT0oxMG8reW1rRmdwcmp1NXpv\nb1VJZXZPZzB1dEJxWlJ5SEYwdWpObkUKqDFSxFQ9HSGWMF8K7v8K5BFAub0lbQ3Y\nNHDIy7mZjFinebrjhPzHxlzhdguoSRSDPfaKbnaIUdKY2cwvQC1zrA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyYVBlclRXWGJqcTZuMXNJ\nREJOcEgxc1lJQ2o4TmVlbnU3NkNwMGtjc1NJCktNS0VrbTlndENSaTBtYVRYVUVL\nSFljU2F0V0YwdlFLSHJkeW9IaDRwQjgKLS0tIFRNUFMrWEw1VGhWOEwrQ05EWHQ5\nTUVDcnRpeEtqVHh0QnhyWExGUWp5c2MKs3BRqjoXwok/BRIyIKGXYNTJbE+FIvbX\n40N4B/ZM3DhsAb2+zl/iaogycDx3HvlspljaWy0emzGJYLLBWBonxg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEViaTZla0Fy\nS3FnZjQ4ZkxuWFJuM1JnU2JrRXYzWlVRZVJ0ZHVwMHR6eTAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyZEtIMnNqREpuUk1rd2hWd280ZWFz\nb3c4TlUybzlOTmVOZW55Zi9ia20wCi0tLSB1NVNnbkk0V0lPNVQvcVpUQUNBdXVv\nSkRNRDh6bE1zVm5QdjhtWklhQUZJCjfd9Ce0sS3qEcF0oTfgA70StwrW6t0kyClE\nvGXH1b6caO6GuDqHlTCWtK8wXhPNmMvaHzuKIxRwcTlMjE0LsE8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZDTGpUWllm\nSGFlb2R4YXVDTldQOUpFMlRhMlBqZEZ1NUJLR3oxc3VDVUkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpkMGYzZGFNWlFpY09waFpOUE03TEdJ\nV0VEL2ZBeld5ZlZpTzZITWpDVWFzCi0tLSBSdGpPRzg5R1N1cDhxTWNldUlVOThj\nSy9Jc1BMMnRlWkN3RFlrTUZ0Rks0CvGs24pzjvolDKBG9qh0gRmzSvTHEftC98Ts\n7bKL/7kYENcsvHsRjJk7e2q85b/3NT9ft6O8cG1Poqh32Tka9gM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGlOQS8yQUtx\nTUtUK1V4azcybm1GZk44MTJZa2F0alRwamJtL3RwblVYUzQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo1YXR0SE5XcS9yNFZzZXE2dHNKZFNh\ndC9WaHZTM1I2U1gwNVpiR3U4dG9NCi0tLSB3RG95Mlp3TCtvcHVJTFdnVS9DZVov\nMmU4Sjl4U3V6K3YrYkFOUnlIaTVzCtNFHyDhSOIXGiACkxPD9jV0glmRNqtJGZvf\nphqY7zOPd5OQQNDM5QQdp/P7DDl1CT4QjUPu84TgmFKO4HX7WFI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNNi9WYXVHZ3V1OHJFTzZh\nK3A5aU5yRi8yR2J5aVBlRTV1NW5IREsrSEdZCjFLQUpJWjhTY0FjV24zV3R1VCtk\neldBeU9Fd1FqYnVqYU4rQlNmVUp3TVEKLS0tIFM5WkdlZVJCNWJLWmRtZGE2WVFV\nZ0kwOGthcUxrMlhrM0tseURVTThYbHcK5ouDof7sD7XlbJquDOkv4BxT2DMmok+n\nzfGnlTy0KK/eptfV0CQrGD/QVMVyZpGrecnLDNZOeI7dJT++u5cMyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmTktaWVYzVk4wZ1dHeGlQ\nRkUwVGZvUitPdXQ2dlpoT0xsWjNPZmNYYVdnCkdjVmZPankyQm1QU0o0WU9tei9y\nTDhkNC81SW5GMU4xSXhUTkU2c3VSeVUKLS0tIERSUithQU8zZXZyWkU4MS82OHUv\nYThTQ3VNMUIyV3c3SXZNWUpWU2hFUDgKH1/7Xup8vISgDxJlmatxuAKdjRV3fA1f\nOI+zJCtR94wJvGALufqt5zPEkTkT47Z+ZijoNp6sAxQCCAiNLKO5LA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQVd4cWtKSkhrN01JNzJp\nb3p5dXFxaTJ0ZGdCcmNCTEhOWVpMNm9XY0hJClMzV0dRSnlKNnc3aEpSRnQ4YUNY\nWFBBcjkwVzlEOE1XdUdrMkM1US81aWcKLS0tIDF4U3RCYTNBb1dSdnJHL2E4b0RF\nWjJSVnBReEFBWFZQRktZNkFWUEkyWEkKsepkOgBIbIxNRU1118q+pQb4U6sVUsxi\nKZHu270Xd254fSqUUZ0nfYG8tk5jzzZ9W5Rpb27gA3gGYQ5r5h4zNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSzdyMmJzam5FM0MvRjg3\neTQveHZNaTBXdzJIdklQeEZuUkRVOXNQWWlnCmYvV3pJQWZFNytMOUpFa0o0UjhT\nSWdzanBoK3lhTnpCcENvajJkdW5sa1EKLS0tIHduV0NjQzE4T1VadDcySkFFVWYv\nanNNQjdpalIvNmtGZ2N1aTlzeC9ZcFUKvSsgRyL5u5+Ly42Ua+zDIaJ6O3GOyjZf\nIH6c4edkafCk1nUc2Tr9mBWGp51MX4VV/mLxAVse25u9YztTgcDlnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:54Z",
+		"mac": "ENC[AES256_GCM,data:Bl5dFPtFausLeGxCVbDuaUf8pj5K6JDUPkAqdDT8yOPYWXj88gPjDCt7AIuux9GCUJut6DrrfDs9cpIM9YwBA08EnWthBtjTWvE9qBcLfrCkGxHJ5O4Sff28AJiHq4XBZK4Y85RvjgMxeMX6c9g6taEk/B0QqG5xkvFiMuuwIRw=,iv:W+8iDE+jzCqlIYmLu4dhUsij4czfJceneNdJyRCLmso=,tag:SiyGeJqUh2BZedjmIVtjWQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/rana-age.key/users/kurogeek
+++ b/sops/secrets/rana-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/vars/per-machine/adhil/phonebox/owner-name/value
+++ b/vars/per-machine/adhil/phonebox/owner-name/value
@@ -0,0 +1 @@
+w-office
--- a/vars/per-machine/almach/phonebox/owner-name/value
+++ b/vars/per-machine/almach/phonebox/owner-name/value
@@ -0,0 +1 @@
+usa-1
--- a/vars/per-machine/alpheratz/phonebox/owner-name/value
+++ b/vars/per-machine/alpheratz/phonebox/owner-name/value
@@ -0,0 +1 @@
+usa-2
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpoELc7KUBZapdah4iw1ynBfkqw3QCZsLC5/2qL30DO 
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519/machines/buna
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:PkLUYZPDYiwkVadZeEF0KqlLm4AldsjdxhrXt7R3eyucOBXkH0z9sm270LMFr4s4H9zyyR+YyoPFF+N+WwNW/hpr2XcQ3hmPwGUt6xyeoKX44MNRibkbzOvcKTy6lG08IlzBEfnAdwAfLJPetKJwvKaq+CeJKibtDhyzKRTjyEVjdSHVEU1bGyPekmnFRMi0U3c/OYehK0kez0XBSZKWov9y8zeDwGGGi6BZau4FKXydl2Tvl/qfQs/MN6KzdgjcNi8Puu1vdHjmseumIZu7CnqM8+Hyi4W6q/jL88fZhLBcqpJuHKiXvSEsnuZdltxNalYhyumh2dzzAoY/dmJSXQTEzkSoUTfmmCmP8DJRoBVrQzpnMuu6uqqIJLZmT/pqFsiiugOz3Qn/cvHCQtDmhDX8gURAEIzYYOWw0H1T0Lh3FFwKAOt7bIrnnujFL8h6z3aRbBXqTIkyruQG10hH+zyeF67C+4Nwx+RmAWM4p98RYY3LQkc0zqquaaQSCvrahYmX,iv:Eqh0b87ZQfkQ7ocQ+x8VG+kEWi97j6VM8CKbVp6nBWg=,tag:R3/Lo+UJf6w7MUeB5mQcUQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UDhxNUY4bm9idWhHbDU2\nTlFOS3lnbDI4bkNmMXFORjVsTXhOVHhtSDFJCk5JamM1MkhWcUk3Yml6UHNNWWM4\nbW9NMjRpaUVlem0vZ2Y0bG42UmIrc3cKLS0tIFptODNuVHdpWGVNUStGZDREWGhR\nRUdRWWJXVWxMMHRwcXdwOUxCYzNBSkkKGydSG7ARgXGQP7jxX0+UeaqaZEeU9x55\nzyJGTaTW8XL9rCojeFVeKIjATmc+hCQgaQnYxtYgufcvGcMi+4OQZg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzYlVla09VNXVELzloREVt\nNG8rZGFDdzZEcGF6eExFbWd4OEZIcW1qM25JClMyd3dCVEJzaTVVRTF0Rlp2K24v\nZ0FmRkRzNUtIRWE3cXVwMWRyUTdMdG8KLS0tIHptODc4R2xvdE02Q3ROM1pmSSsy\nclpjZi9IRkRXaEJkeU5KSjhwZWpnK0EKW8JOuRMnJuq+VkVpP6xS3eO2p54vJN1x\nGbVpvSz0EMpy/HNrcZg5JkQ2RaCL4eFzU5OuAqaorCG42yVjGKYmYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGpFdkRBQW1x\nWml5ZURVNkNRUFlRUVltcUlWNmsxTWtpRjF6amtORGVCVlkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpscjNlblVGb2Exdkx0Y2k5a2NTQzVk\nZlJweTdMeEpJSEYyWHBqQXJVQjlvCi0tLSBEV0h1dVJpaG93YnlPdVAyNlpDdmw0\nMVVrdE9WWW53SkRTS1JNeE9jUjQ4CvCB2lynRtsXVep3c8by1ZZIJeBlSS3lig0I\ngnkn0IrTOvRzTcZzTUFzhdMHDtcxb2NwoCfvQi3hqWZlfASipe0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE80M1lUN0Rs\nbUF3M2M5OWxqeURnVkRWNDVoT2RJZ1NQK0MvMi9FUjI2SGMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwoxbGMzak9IY1F5dFJ3WW0vUnE0alM3\nb2FmTGVRSUNIeVkyUmY3Uk9Oa1pvCi0tLSB1MmpTQno1OHJsUGhBQ00wVU5XUTBm\nMzZQVDhDRCtQbVVJOC9mWXM4ajZzCtWLZ6RxyZXdFoyR9wJnXsRwaGKLj4cLheQY\n6zRRBd6N8B/tQL9MxZlwSZGsunAom2dLcxelq+xV2Poj/gD1Un8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFGTnZZUCtR\namhnSndqd2xTaS94eFhGK2NXN1krbDVUbjkySHBHSXczaWcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpIM3ovcFRhbXR1K202bFNnaVBlMVdU\nYzNkWlN1dm52ZWFrWkt2b0MzL2tzCi0tLSBMTCtFUGJsVTYrRTlCL3pWcXVTMlZn\nc3NrNzZ6WUFEeHB6MlRXcjZ3TUlrCq84B6Yl9pQvsMtXBZZOii9vcSa3PQ7JLh10\nDr8YguAqPPhFz5tMWMPAcTHZj/VKxtXiteIg+zWD2kzoTHR3a1Q=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRcVdHR0liK3ZFZkhEdDYz\nUDZkQTJLK1EyL2FMQS9uQnM0N0czNlhlK0NRCm9TZTllN0lKMWZaU0VKdjU0Y25L\nUWU5TGhYaFQ0VmJ0eUVzMFNTcnhhd3cKLS0tIC9MTDA0Z05qakhlT1dEVlBwSEJC\nTTJkQVU4UWFTclg4RXVJNDBqYUg3M0kK6FsQIJR/GAAnVQISKP3dHfk/ZtPT56ve\n2t5TKdBa0fdO+8VD51L0MmgyZM7LHkALXx2EVS5WoOSwlRFLdhzIpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFeGUwNjJGV0drcTJDTDJJ\nd3FHU25zN3VkdStmeGcwRlhUY2JyNkoveXd3CjZ1dDNxWGUxeDdRSHBqWlZxK3Jo\nYzF4UmhSUk85TEkzdU5RYWFnZVg0QTQKLS0tIGRhc25oODdmTkpoSE9nbFhoQk1X\nc09vRmhxZkdEN0xOWWtQTDQ4aXMrZTAKrIYAGi+PUht6y6PpEGOre5XP+Y8g4lo6\nS9yArdxgeVQcDKagImpEHKlGSrOl5bYQPLotPxB11ALDlyHKnM5/Pg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNWUvMitXL0dVWk5xNXNv\nV3dKZzlJS2Jkc3FxWGVNcnMxb3g5SjVIQ1I4CkFLY1JvY0c2ZkpRSHdRQ284L0Fq\nL3dxRUEzeFJzMzQxYVNYOHpwVmxqQ3cKLS0tIENUUTFtWlpONUxld1lJR1RncXc2\ndGlHOE9Yb1llQzEyMjZ3M3pnWjZQdXMKJfL79dpS0q6QmMT83PH3QlwWXQn1b1d0\niNATdTBAtySx3gGvRjAbvtRp+eI+esOHsNxjD30Ea6QMY2XvH/oSzA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3dFlaOWkxY1QxU3didkhX\nR0Jobzdnc0EydzVDekxLam0yNnc1LzlUZEZjCm1HdUVzOGd1cTdNVFpjV3hNK3Zv\nSkg4eVRyMTRRR3FZQUJGMnlkUjF5TG8KLS0tIE9zVG5wb3VoeC9OTU95VlA0ZFJr\nMnRQTmdHbUcxZXQvNU5sRk9OUGZhazQKLsT2DzWwfp/1xgHpfVkp3JPVgSId0q/+\n7ioCCo1P7JUXjTEoeva5KW134a3bKumZcQxHyyQSrzqpLdvJK/hVqw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOFplZ3lxTnd0MmtVMzlx\nTjc3UFdSVWhnMEFxeG1iMGJqKzlhaElEUEdFCmt3cVpKajVyZ0FCSGVoUGY5aGJx\ncVNMVnZ4OVMyTUhMamFMazdhVmtKdWsKLS0tIDAxc3hwTGlxM0gzeDBudzdpelE3\nSWZnVVVEUDlsY3FSQXovQ1E4ZTc4QzgK7ww1he1haJFK90YI7NDiQNVDh119RNUS\nzbo4/tP3JBXqvP0rOMk+sRk1Yt8lz0QoPvR9Ji+naEjDqHSgtYJxoA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:15Z",
+		"mac": "ENC[AES256_GCM,data:2m+g/V6q4vY4PfH22MUg+G4Tpg7eWe3oIQ/BYxky42OCoXtPXdynI8Y65XRxicqmrjBTNXJgpU78my2VYkRrWfrvaoz1M+LnUQqjJ7R+qvFOmqrgHWPK0jKIMCSNdv8q1pYaVWBgFqX8rJ+xoOK1IjC4Ya+EfiXfDHI6ER2Ls/c=,iv:L4Cw0zM0x0WL4CCVOUaxAimmZqfnTDz3JUcAjGwy1gM=,tag:JYm8EHT4AdHinc/YqC4Hgw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/buna/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/phonebox/ata-local-number/value
+++ b/vars/per-machine/buna/phonebox/ata-local-number/value
@@ -0,0 +1 @@
+00
--- a/vars/per-machine/buna/phonebox/owner-name/value
+++ b/vars/per-machine/buna/phonebox/owner-name/value
@@ -0,0 +1 @@
+whitehouse
--- a/vars/per-machine/buna/phonebox/server-prefix-number/value
+++ b/vars/per-machine/buna/phonebox/server-prefix-number/value
@@ -0,0 +1 @@
+70
--- a/vars/per-machine/buna/root-password/password-hash/groups/admins
+++ b/vars/per-machine/buna/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/root-password/password-hash/machines/buna
+++ b/vars/per-machine/buna/root-password/password-hash/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/root-password/password-hash/secret
+++ b/vars/per-machine/buna/root-password/password-hash/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:HUFNDbXwKe5lLHeqp2SnTYHMgFKqYv9y4rtK5Xzx+ulWUuwYzCoa+Zmobc+JKD9j4mdRhP8uT0W6BpaqF6E1v5aSeXzrUcFVcZOESVcwcQsR1MBAyiMIbnmBBlcDnWgBjXr5/vYvbYq3Ng==,iv:VMNsNwwVKlBAvFT5fNDZZqjS2lceJMKoj2SY1MLUDKY=,tag:YvRdMqtBu3pSn9mDwEF9kQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGOERET2ZycS81R0UwTDJQ\nMUV0cFFHNHFiS1l4dktSRlJzK3hnd3d0NXlzCllPY0VwMUIxOTNjWndnZEZQcFcw\nUGRzamkyKzZPRXk4K0pFZmFBTGVLUnMKLS0tIGRMZGYxcHVuTWd6MVR4QnZTa0Jz\nY05Td1l1ZDlqU0ZLdU91REVLOUlkakEK2d6T5m0qvMKneu6rn1jy2TdqZNfgovYU\nrKA2WCK4Xp81OoRNIJODFutyF40Nk6vgLHRL7qUExV8UpVWT8FpFkA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZK3prNUpPNEdwSjVqc1py\nbkM1UDl6aElIWnJGQmo0Z1gyS2JIZzhnUm5ZCkJkdDRzazZMYzV6UVlHZkFNWkdW\nWjUvY1ZsVjZwdWdiOUp2c1lVbnR5dDgKLS0tIGVlUkFOTHREWFFzVTI1TmQ3NEVP\nZW04azdCNC9JdFFJTU0yT2tUL3JnRVEK/TZDrOpgTRFm4y7kcflVWFgjTbeWm9ZU\nGBXOyPtjYsfdsOIpLPEnhWFsg00dOvf44IZgfueU8WvZEFMuLBfewQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFcvbUtwN2R5\nZjdNY1BucFBnZ29OQ28rckhyYkt1UTNrUnRCQUVSMlp1MGsgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQptd01yN1cvQm1PZUVJZ002NTlZWjZv\nWVhETUllUmdTVjRYU3JSSHFOcXRzCi0tLSBRY3FUeHpsV3I0bm92TlJ3T0RZVzlS\nUUt0YXUzTU54ekpBVUEvWi9vQzZBCmNS+wVKtwAWMfZqmngiX+G+ULKEmMcvyQ3w\n3HLPOgTTWJnydOKGbueXwWO1y6K3yuQLhlsVW+1H4NfwP68nllI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGk2ZkdUUE45\nb1kvc0p5Z2xKdDNSdStqdHd6bkJsYng0aEI1RjVJQldpaEEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp0TnRIbEx2aDVOdlQ0aU9HZ1cyeEk1\nOVBxdmdhWkwzbVFoVU1mWTdzVXlvCi0tLSBGdEcrbzdZakFQTEVCQ1FHbm0zMWdL\nK3VKTGhEUm5zbzJFSnJZYk5UdXNRCiL3C1R0+wuhAgMH6RepLBwrUOiZ1C/+NAwh\nVDB8/TM0Qp69y9aAq3Ew5l99NC9FWCRMQHRN9YYX73sPhB9Zaq4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFVYdUN1OTlW\nSjJwMWk2NGV0OCtGdFhxWU5pWlY3ZUZncVhFc0hXZ2t3RDggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpDVHFrK2FqNi8zbE9mTmVxWnI0dzh6\ncmRreDNsQlNsbnBNRUpHOXlwalNRCi0tLSB6d0hLQ0dFVUtSczEvYzd1bHNSMFBv\nVVQvUlFiNlMxdCtuMERJQXBDZDlRCgQ7voqoNSiZg6PZiACkApqVnPUawhjPeeyM\nvU49g0E/FdnI6vz7GQNqLWyZiQFEUVyPrlWRGQHD27vuXjervKs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0eVdJQVBnN0xYUDZ5cXZG\ndUV6dzZQR0NFMW44WExiREFHcXFGcnNBVDNnCkY2eVNXYVVLOXlOblJhenJYTnJ5\nRHNIMFNnUHhxdzlhZEd5aGh1UHQxcjQKLS0tIFplaFVLeDZicGgxa21TaDVUVUUv\ncTVNU3NWTTBrbFNsajBSV1ArajBUUzAKAlS1fEYUjzMnVoK1gfscHp0b6BHHc+ly\nhD9NPYHNNr6LYVEWVfm3k/655ie+xmVjKIMnKeXqAheGnKiL1O9faw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPMlM5dTVRUWhNSjNrUFZQ\nRzREOVo5dkRPYy9PMTZ2enlCRG1qamFCTG5BClpvUVgrbWNwSVBacHNjcWgrbWs4\nZ1BoUjVJNkRXbllGbUFRcWt6R2Uzb00KLS0tIGtaYjBaaER0Rnd5OUovb2szRXcy\nbU1HWmpRKzFFbWZRL3FlWUs5a0FIckkK/7Zzw6b7t+/rjLqFS1vqoBNYwnzxJzmW\nKxevyzQzFFYGlqvxNdlzUSLGrMsO4arBp5tUtDoYRhDRTMk87dm27Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvUUFPbFhza1h0cUlMVVpp\nQ29pMjJYenBISTNudkIvZTJRZTZlVTBlVWxjCjFnNFFiUHFiZzdXcGpzc2FVY1d2\nWno2RkZxMjFEcXpnVHZpZWN2dk9jZTgKLS0tIFRJMUh5UWhMQWRxRnprTlpOL1Zy\nd05jZjdvYitoM3NSUEVQdFFCOGV0OW8K1Csda6v4SBJxumulxTAeZNRzCx6zKd3H\nauX8HLeY6RV4LXIvfSOEBCj5Kxl6uBwouTM7ejteQnUSdpAX8MhFBg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMVJSQmVDTnVZZDhHbzBR\nczVXWU10cnQ1TDBUL0RPNTFJMkE4NDcwWWdvCnZuS05sWXI2SzZ0UVlKSi9wazI2\nSlVMMDlla0RyRDcyUzBaYzdoSDZIeDgKLS0tIEduT0xsbTdxS1hwSWJxdEZMY3VI\ndGlXTzhGTHNiTmdHVG9GekJuWm1uSEEKwNZ74I5yL81Duv6b5PmJbfgF00zomAQ+\nDEDwxiMALnj4SZef5pbUsBb/mlBsROnlSKe5mbWXSnNza8dFXjNEIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwWTJBWFRORmFUOUQxOWRx\nclFlYk9VdTEvV29NVU1aU1ZER1haTEczK1RjCk9WUVhTV3E0aUwrY3JRQkllSXZD\nQUhLRks1MENLVnJ0b0hzR2RpcEVDbUUKLS0tIHN6aU5pMUY0dDBSQ0t3QlBSQmds\nWVB6Y3FMODdqNkF3YXhYcVBld0p2ZlUKF9eOP2K2c7gTMK2tofDmRTnB/NkrIHuR\nrc6oJRppPuBRsFDpFxC2AxFF6v7pCA4CrUOp+c/tVotmJXIYpKVLGg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:16Z",
+		"mac": "ENC[AES256_GCM,data:QTza2kJWhmDahZijNcPvDP8S96uYLmoPkRQebktZmd+68fMUuUFpsKV/Tnd0fVflnS5fgvgLRDJ6+VPBFuztX0lC5WYdU092/EaEWGgn3PQO8fXHxwf3QYwDPIRrl9wqE9UGpTMtSJZ/22M4Shwq2zRa/mvsP0ig18aHMn7JRGc=,iv:arDHHuXdvaq99uH9QR557JO6z96f3UszNBzJCVNuB7U=,tag:TCNn1EJ8rcJY9sa4kXqBQA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/buna/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/root-password/password/groups/admins
+++ b/vars/per-machine/buna/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/root-password/password/secret
+++ b/vars/per-machine/buna/root-password/password/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:wVYG3Ah0iMDKWIGReEQwMqwlfWJQ9cRtpZWpVjOA7q4t5UguOfn0,iv:VCIur6/C3YU4qZhowjgCHMd/kXRp6rNq2D6KpJCz9vw=,tag:oBbdkuzgmCtTzrBuDNmaYA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQzEzeSt5ZVRGazE5cDkz\nN0xkV3hkc3lQZDdJU1Jpc3h3MzJDcjZTbUFJClF5dFJJQWQxZ1MwaGp4SmVadCtt\nQTRabHBMcXlmd1FOVzdlejF1QmRRbkUKLS0tIE04Z3p0VWlua3hpRTB2YldZSVgy\nbG5pRUxCMTFGTUJoVG1yZWtXMy9PQTAKTclKeE9zWIluBBb3d5fnZz5TN7xIq1Fn\nnf+8aRYNG5ywfLtkebAppHEmt3mxoNWIAXGBb41xfCB1/7lbSks2fw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXcURqY0QwU0JYN1RnMHBE\nbmxobU16dnlFMjYveTR5SlNMZEhJQ0RFSHkwCkVSRVQ5dnJ4enVLNXYrQW1MUEts\nQXZxWVFvSk1jRVVNWDdLT3pvcWFxc0kKLS0tIHVpT2htWXRySHQ1UWRaZHhJcXN1\nb0tPL2VWMmNDdms5Zk0vUUwwTm9wcEkKO0pe/v87nq+y886cvoW7mBx1f5jMx1kS\nPRj8MLOS0Zwd5Q8G9vV3T3SQQRjmJJNkpLVrJ3kMRJTniWQxcG9f7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDdoSk15Uytz\nNUpXZ1Ztc2FEUmI5aDhRTnAwZWJTWjJLSnpiMWd0aDFYRG8gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3ZkZWdFdyR0s3SVN6emorTEdVeDVU\nbEcrRmlybFNZRXU5RXl2Z1Q5UVgwCi0tLSBjT3loaU5ySWNHbEpseWhrNEhDblRN\neE05eFBUTGlwVW9jRjIzdGprS3RBCt57I6biEsOwRk33gJM3WC6Zl1raFj/eJmfq\nN83XTZz636jJVjd9yvV6Fo+eqCQ42Ix0ho8gV/OU2SfrfWBYimU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDBVdFpkQ1Z3\nNzZaOG9xdnBQWnhOYnRZMEFsc1ZzTCtSY0IzMGViT3hCQlkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpTd0trdmZ1S2EwMEl5Q1NTZHZ5SUJY\nWk9iK2JYUlFlOEp4RkNiS0oxci9JCi0tLSB4K2VqRzFBWWtXSHRmWU9YMzdBb2pN\nZjRmK2ZpM0huUTdUK1ZBV3hOS3dnCiY5pE32xeZ2hqP3XhfSqabB87B5ebA9Vw00\nEzE/JiaOoozG63FTU37jA7lK+bmROg6gKctP2Gjq2PmWOSgd7Us=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEJiOEUyVVVL\nOHMwNTBjdEpBOXpwekg0TXBNVEo3QTVmbWJadEpZbFVsalEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpoMFJNVjVmMnZJRk9QUHR4VWg3elNj\nWXlBTTlLdTJqekdBWERPY0gvMzVNCi0tLSBLVXRTcjEycFBtT3VJTEJTVmpXcWk3\nRlQ0a3h5OXg5b3pRMkcwUkhnRXJFCo2H+7Kn+hdKKhh6GftMLTDNKcbF/uySBupD\nYrxCpjDlCGQ49esMtiAA5M8pc/boWvFxv8+tCzFZHTwVDtX5ZQw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6blAzbkh5eW4yeUFSdTZt\nZnNQY1BQbGpGNkg4bUFmYVRUaytlblUzS0g0CkJ3ZFVaS0xnTmZqY290c3h4NHFG\nS1pQSE11MDZwUWRkbWlLZHIrNXZPZDQKLS0tIDJTemljUldlWXpRRGFLczM0YXFO\nVUJFYko4eGJEcUxBRGpiS0ZHMUpNanMKN9NdEY3toItXRz0joahH507SsKP+9gwu\n7D8C1BR0xStpVWidMuDJVfaDcFLx2CBItfujDP59rnHyVO1wzTHGHg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5T214czl3Myt2YVlLU0Ir\nZkJjN3g2REdFRXFGM01QWGFub3lvR095clRNCktyWWdCbXlyV3M3b21WbkFxeDRq\nbXd3TzM2R1lBSXdRUHFVbFpSSW5pODgKLS0tIFFLK0MvMjBqZXJEZEJKcHNHN0lm\nd3VPZkZtYStuZXpzMVh6UHNzdXUyQXMKhH/hG4abdwjU2m0Aeg2Yn0yDVAbWI74/\noWziRJmEfn3hHAsvuI2rleuwaZN/02b0nmFkxNiW+KIBew5v95uaMA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2SVNCNGhOb0UzSnRpYVdU\nbXAxakM3eHNPelpGMzhuT1NmbG5HN0YzbzBnCmNlS1JIWVBFZmg1MDVEaVdpUlpi\nblB6Z3UvK1FWRGFlUjNwTjg5eFUyRlkKLS0tIEpCS0NCdmVzTnZFZVNlSDJIbFg4\nc0dIRkZMRW1yTGJrWUJTZkwwWUFPNXMKAuqzuQhSNn83KRsdN1+Zd2uETABH4cih\nNfpVzuHeym3W5tFlXvPTaJaOqSTetqaD6ayyY7kOyMQ51MyPV8kdBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZGxMNEZjWEU2UU8yY1dQ\nQ3RUUG4xWkNYN29PQzh3clBXTWpidFUvempBCmR0RmRYTTk3VU5QdjQxQmdmRy82\ndUNGblFVTGVQTXhhdnZ5Z1BZL1lXL1EKLS0tIGtUa21tcDN3UzZqNjIwVFFtQVB6\nU0RybXR2QktlbnN1SURJUVUyVUJ6ZjQKOvgrZh29Q9AE0o9LBNqlPDCV5iKm3yll\ngN57wE397mQaAGKI1E1B1CytWv+WHCetQ8A/pZD8nSNt5hmcfD51pg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:16Z",
+		"mac": "ENC[AES256_GCM,data:ebGwPKurcY2IMoOpHpDCxSa1nVRgK2pZJQjMh8WhJOi59D9vYQ4mS0hTh1SE/qpOyEiX7j64OaS/tdpTKrdplC9dzcHfK2Hp8fc4Gj7PdZrJ1ncLm8lX6miJKWhJWssBFzHYL3qM5/mpxkFVfoW4r4l0sCzARnsGLqU62YGogIo=,iv:qu8ehbFE7smCFeAX6kdv0Y5zrM7OkQ5ZLZbneB4HTRo=,tag:Vha+16n8Wkw70b3TaUWsJA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/root-password/password/users/kurogeek
+++ b/vars/per-machine/buna/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/state-version/version/value
+++ b/vars/per-machine/buna/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/buna/tor_tor/hostname/groups/admins
+++ b/vars/per-machine/buna/tor_tor/hostname/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/tor_tor/hostname/machines/buna
+++ b/vars/per-machine/buna/tor_tor/hostname/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/tor_tor/hostname/secret
+++ b/vars/per-machine/buna/tor_tor/hostname/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:nBZW1255aoPIrRZ3dtuX+w6YZ33xv1lQbJ+9xZjGhltSD3eTJd+1Z94BwBxHPx1ajbdgKMu1Phl15kf2jdPc,iv:H1cGV5jtq70CG6/x0VH92VMV6wsuhsEL/pa8xdre648=,tag:SCcZCxhMWwFmbV1K67wfFQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJbGhXR093MDM1UjRFemY0\nU1pQVjFtbW5qcTkwcUpiOHdMdDFKZGwyVTJ3Ck1Pa09oUW1jTkxsRStXNFdyN1gw\ncEVqeEVjdHRiV0JLL2tkWGpZbW9SQjAKLS0tICtENWtSNmpiTWZMY3NLMVprR0ti\nd1lTTkJGSzJrVXJQRG5PZkQvQXovWGsKBvhYXS5qUTlOx3rEmcSUWQJUPNZWYAzX\nxyAMnKH3t2wAGFGIydK3u1Kk6/aryva2RlR0qkeFTOJo8XdEapn1gQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiYkNMRjRYMnhJVW5pYjZW\nOEhaV082Y0tLTFJPcVhjRmJ3RXE0Q0dDZmlJCkUvOU5wa1FycGdDN1JaVEcvdXlU\ndklYQ3I5STVMdjZmR2RCT0J0WDBMTncKLS0tIDlPSlJmeFVMYTE3cGdZYUZxT3ZB\nUkZmT3NZMXQ0aEtCMlJORVhKbldGOGsKt+eX316NazElenilH5fpVC0e0GOPYxQZ\nm5CgXkIJ1o/7rdgGNqFMt8jNeodrW/P/ccIXdrAYplKGWzdgpdP53A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDkwSzl5Z3F2\nVTFBdWQ1amtYQ2V0ZzVvVk1CcTdEdWh2eW0zNjN5ODUwMzAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpOWmFjeHlpMUxMMTA5bHkyR2l6TW9M\nSGJzV2pIdU1ONkt2eVlkRlRrOW5zCi0tLSB2bHpoWjNYMG15R2UwMWFpMTNrcVZM\naXJ6WHU1T2w3ZlBmMUhrdmtuYXJzCgTFhE4mRloPJUFMWTagharFirjpbBrXcPly\nTV4TmN6aVS8O99E8vER8SlQhdh8UNlzlkEump11OkY/VTXps2EE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdqZUQvMDg1\nb3Q1YnNCMkd4aWtZN3BQVC9HZG14dnV4c3RhdVB1MW9QZ28gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpKaHNkV2ZtbEVnQWkydktZUkRaMmNN\nbFhXT0xjdFdRbXppS3RJUlBXVFRnCi0tLSBnUGZLeGFVQjg2VlNFVEZieGhoSVJi\nSzI3bHZLU0x4Nmw5cU5KU2RJemhJCpHVu1OwWFdMyr6Jnc1q9l2DNemh6QSHFNoC\ngwirKvEFDr/h+S0tAjQ3a+p+lyB2z/NwfcAxKxge0rVaqlzQV5Y=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGNGdWdlcGl4\nRUtONWpudXVkbkNac2IrTlpUS1h6Ui9IaHVSMzJLcS9MblUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo1UklzVUVlTjNmN3l3OGpvY0VCbUt1\nUkZ3MUhGZ3BzVFZVMUY2cm9DbkYwCi0tLSBQdmpoTVVNUWR2Nm8wWXJxbHFrc0gr\naFhNZEFOeUtZdHQ3cmlnR204QVo0CoVwRw8Et40ww+QWIniqZErzDPMzw+ZQWVAm\nJY3eUHCJEB8cxw81X94FY6X4zFCzSAU11uziQ6Zy5MxeI45zpFs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVktxL2NHblVmR1dRa1o2\nc1AxV3NRMG5pU2FvQmpqblE2dDVxWVBEb1VNCmJtQVJING9uRkJaSHZjZmIwVzhB\nQUhWN1VKcm9XWmJlWXFxUDh3L3FQT28KLS0tIGVTeWI5bHlNVlVVcEc1QjBqWnJI\nY0FpRWNaV1NoMlVoR0puTWpJZzZOc0kKTPG8WWQlVk5LRWqpX5/Cl0QXpIAaI4cH\nAbJesM/031Qyd8O7icc5/13f/1AEnZh+JVjTP/tA84PY1PYc6yWHug==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Z2pmOGN1Y2ZEdWxHVWto\nUWpZa0YxR2pmM3B0YmJuSjRvYjNoNFhIaEZFCjVVUEJMZjl2SHZpZk1WM0ZSaEE5\nSlUwVWNqZGJuY3RoLzI2bnFlVmxJcW8KLS0tIGExb1hidVNBaDgvaHd5bFdBdGRR\nV2VWRjlPSHAzeWI3aXdoTW5UYjRWVmsKDGeuIU229Au6ngCh/dWaR4ng4O0WSRFO\n9FZvdKl6g8vD3r0+lpgXiCvIr42v2/A3rl4nLiZsAEDCbPZK0apU5Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6ejI2cjQwRXJ6Zi9VaGFK\nWG1STXpvWlY3OGhtdEtmL05QbHRCRTlNWHdjCk5GYmhua3BqYkx4U1NlbDVzbE5R\nWnl1R0laK05KRjZNeHhmMjAyYzlaL0UKLS0tIFpyQTJFakV6cnlMVEx0ZnFTSDIw\naDFUbG9CaTRleHlrRE94bElJeDdpTjgKiLLlk7RiUM340JGKNFCXgL0JVC4tM+uJ\n6IDq9FJY4ZOBTxaVJFsHlQrmlTt9xFgXPMxOxCh1PsKOtVAYMh9aQw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOOStKRmkrekhPR3dveUhP\nRGlxZndPdzhiZGpHOGxXU2VGOERIeGJZR0hZCnRCSHRoZjc0THd1WVZnSlJVRUE3\nbXNDTlJ3am5yVm01a3Zpd28rTGxLeTgKLS0tIGlzcm90bWVYWFQ4Rm4za3VvOHFO\nbEFHbnlvVXZRN1VsUWFneE9POTJXdzgKblsgLi/zSv4Xi2wMc99eAJx4VC1RiZFu\nlaKuWzYVtHx1DjAMTBB3Wt7CwGi5AQ/+/XMkHHTrsHRGniYnnRJBjQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4TUU1eXp2OE92d2NJWTF6\nTzJxRmY1V2hGUExMNGh4WHJKU3BueFJJZkZzClJld3dYTXhnQzliQXNiZnpCbVZY\nR1NUSmpzdkpwbHBIV2tha2F2TzY1aHcKLS0tIEM1ZFFzWW5sV2xlcm8zRjBpY0xE\nWXpTQWpPWGNpUysybUpLYUlNWXZrdmcKinHmBWXWPUxhpkVJbkBIkSUH8Nk8Q/5q\nEMyvyfVz2qB1An72lbtMvOqOr56nv+zH/tqVTKRyGOrc6vYvPARCNg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:18Z",
+		"mac": "ENC[AES256_GCM,data:A+gL1a5gZ3d/2PnSF3jdqy8S/xXYaDjK9KmANqSmZz4eQunTR/ZnCr/8+unhhAAEa8enBQ6J7lTf85RZOrRx4tcaJSAjAB+SIOEwroxTH5BqWpz3IBYgG0A+17qO3jVPi7PlZKYUxgqXla8zQxUu6Fd7T0UR2h9+e/PzobOgRAs=,iv:7yoOZDV3zQBgZdANIpLKGNh38AHDp7V2RgmavN2L3W4=,tag:DGLwR6fIHsZqNPUEv4dqeQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/tor_tor/hostname/users/kurogeek
+++ b/vars/per-machine/buna/tor_tor/hostname/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/machines/buna
+++ b/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/secret
+++ b/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:mTb/2kC2usRAMm4cSI6y6K61LpM8ZsyXCy6ieZy5ws7MzTyB9N1a2avOAwXFQrwD+RgTyamKETUwVjCl5WIXSA1vW/J/blA2wVutgNADvNYSz09bTA3IuFc9ItiWigUd,iv:IvH+aFyUtRVTnpQ5rfghe9IoaHpCXSelyZATP1wPKHY=,tag:LA9UqoKtlfLEnKgQdPd4gg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzc0N6ZHZCSysyNHFrOVJT\nMDZZTkFZRXlMWVc3b0xPYVVXalE2MlZNSFJRCkEwWEliMzQzb0VvRzMzVmEvaFpU\nZTNkNGg1V20xMlpqMVVTZXVONDFsSGMKLS0tIFJsRmhGRlFZNFN1VEhoeDF0LzJQ\neDI1Q3h1bEVjczNCNDFiNkRNd2NPZ1EKruzTFzD+tX4UQPUjtGkuG0MS3hxwhcyt\n+PKV2SGKy9+fJZtKVbPg+4NYLblLNoYAMHmUV94zkrAezpLTjcgRtw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZUGhINmtsODAwM3AzamRt\nS0NobGJrWGl3QnlYRVJFS2xIbjB0L0lPWDNBCnM1VDIzYVVHdXI5VWR2M3g4K3NM\ncnVMaWxsdnhTMCs5UjVKSjM0NjFISEkKLS0tIGt5V01Udko3WnFYbFRxYmxray83\nU1dRc1R3VDRiUmdDdDljOEc3RmZKd0kKHB7k0XWqlmoIRP06c3GMicN1mxD/1tEz\nH/z5bV2IlrcFPPEvP12O68s3Z71d8IVpM3cNcMmfwSiwUKVMIwqgsQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFVMbFhLdWNy\nM3NTUlMzYzlkNUhPZlEvMkxqVVBpaXhNU3c0WGRkTU96amcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprUm4yU2NYQUpGZDMrRE4rcFcvSFdW\nRzBnNFRobHZFMnJiNjkvR0drSVE4Ci0tLSB3OS9TWDJCRnhnTEZiRTFWUndSdS9J\nalFhKzA5N1pTbEFJUGNiZXI4ajZFCvzg/DL62+f4RnkGTXl4eAFGNiN93GBmWTVc\nKrbzZ8c4VMVw/LvIh3okE9tyEn3CGqjllpPHmdgZF9PCTGQiG3c=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5mekZOSjBY\nUlFlYmVEVGZhL1hITjhTd1ZJQk1tRDZkc2U5OVkyaUkzQzAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp0S3Z6WVROeUh6anZNSWVkYVpncFRS\nYytwbCs0UzgwSHBqV3BQZnZzd2dzCi0tLSA5UHZPaFhuVVg4SFdobXBYdUdlZWhV\neWdZYTZFZHJXdW55U2NScWlqbjAwClQYHoBqkfsvVCRf4uCyQXtJbwGtTTT2CQUH\nC2Gkm9pb9y8ErRkGAoQ3a07Qb23VstZMCS0FNgFWxCB9RbaBDCM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9tdUkvUG1L\nMGdHZHlKUXBMYUkyWGJZdXJYMXNaRGhweGt4bUY0RElKRDQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4WmNFekJTdnN1YnlZcEVteExENUpa\nK0srb0xqZ3dDQm5pbWIzSFkrbEtrCi0tLSAyQU9iQzIyd3VDM1JLRWJ4dlpSL0dm\ndUlkMVg5cHg4T2dPYTJFbWtJK1djCqAndzWTabog3ueB8pSzYgwxAHGIEiyTXk6C\nb3g7ZecdxS8nKI4xOWX/4mdYlPdQ2eHrsPcKE7e//L3ecpAA9Yw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUkxwSkw0b3B3RkxmVDNT\nVUc4Z3NrV0haTzh5K2VIempYOEIrQ2JuVlRVClBGNzRuTGgzZnB2UE45U2JET1dq\nVFlGQzhyQ0NHaVJXMHFmM0tHUTAzZGsKLS0tIGZvblBpMG9mL3BDVkErYjQxSzR2\nK3N5MjV5NU1lbXE0bnk1citzYTdnaWMKCVQ+iRAG0Ms1meWaMzFPGF56B1fHGCJO\n0iDhYr+pAZ8NULqQpdhFPZEs7kB8xH6B7o6dK2yRoueYI0m2v7kzbQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIcEgrbElib012OTc5Z3RQ\ndVRLZjBKZWh0Rk84RkRKclZQWDNEclByeUhBClFrK3Z1WVhKek1OdW1lek95eXQr\nZ2pPdlFHdkF4a1hwdDcveThTcm52ZXcKLS0tIHVnbFJHc1NZRitFWFVWeTlPRTd5\naThraTJFN0hTcHp2Sk5ha08yYkFjbXcKK0V5kgRml5JWJSp3VcaUMjLwpcb8s5+O\nwpru1iiXAaTMKuLNZ7BXVwNedjsiARZtbdWRFjGluYQUUgG7Xec77A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHVHdlNytKd2hwWWQyRTNm\nUXZNeUdsOUdicjlkK1NzWU93dUM3Tm1EY1hrCjNGWG9Pb0s5WTRiV0xKeVkvUXVj\naHlGK3hDUFUyM01TRkttdWFCVVpNRkEKLS0tIGJTT2kydGk2eG1XUXd2WU5TSE1r\nZXpYMXVkYmVzWmh0cDZTTVVuS2lRNmMKAkLHi0SOuQJDi3F7HuXgZ7izi234Tc31\nQhMuda9EjoR9dniPg62CKk7OFEyvOP2Qo3Hu0sFgEwBYhF5eS+97jg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGdXBzcnhOdFhZRzRKTG5z\nQmUzQkErNVpBOWRITkFwOGp0ZDVDNXpMRUY0Ckt6VExySGlFSFBlUDA4Tis5N1Nu\nbloyZ2NBTmt5WUFtQnRYTzVTdENPSkEKLS0tIGxLdzRHbUFnUzB3bFBDc1EzdHJW\nL2JUdzMrMkVTdE5XaUdxc2MyTGNCdGsKIaGLQbswF/BQhnlTUrm4n3zArMoiS2sj\nAITrHb2F2WluU229kyxNDpmY3hhiKGspO6JXqRDA5diDdrBxhzcxhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpK0pId3JYVjFjRnBoQ1Nz\nd08vZXMxeUp5R1hrN25RaWFwbGI0eGNZM3hnCm5vTzZDbnRnS1J2dmRvME5Oc3pT\nWmtETkRibGZRbC96VGswNmY4L2hQRVUKLS0tIFBJZ3BDbzBabTAvQ2VXdHJrUEtM\neXA3Rmg3K3VsQTBMM3VTTDRYZkNOZU0KoBr3prcGnyQ2Xw+dJUc55xwan383rCA9\nfy6Jnq7H0FDHaJdVkVk/Wn47hcMfNss2i5JK2tzArxkEV6R2A2/IqA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:18Z",
+		"mac": "ENC[AES256_GCM,data:OxiHEbN1VW8dkbv7K28fk5nHq/E1/1MzbOW3VySv7URSl6+I7ntYCWBZyMNWOSNcqUM7n1pGIQWV67RhrIpkQq4L50rEOOdHzGYgUZrc0OeYVQSC6NdV1FRnQOtWYOnFWpBKUFXQvZRr1D65wmfQsDJtXAgmJMIj8PV9EO+AjDI=,iv:00WJVfTK3Wdz0NinbNZiqJihM4ybeJ+owFUzUfwuu8c=,tag:UQG74Vl4G7d46Rsjl4bzqQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/users/kurogeek
+++ b/vars/per-machine/buna/tor_tor/hs_ed25519_secret_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/yggdrasil/address/value
+++ b/vars/per-machine/buna/yggdrasil/address/value
@@ -0,0 +1 @@
+203:928f:ccc9:31a2:8502:6132:7691:59fe
--- a/vars/per-machine/buna/yggdrasil/privateKey/groups/admins
+++ b/vars/per-machine/buna/yggdrasil/privateKey/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/buna/yggdrasil/privateKey/machines/buna
+++ b/vars/per-machine/buna/yggdrasil/privateKey/machines/buna
@@ -0,0 +1 @@
+../../../../../../sops/machines/buna
--- a/vars/per-machine/buna/yggdrasil/privateKey/secret
+++ b/vars/per-machine/buna/yggdrasil/privateKey/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:PS56x/wCTeEipSJrUoX+zqvVEVwPG23YQS70/4UyCNJsekPY5ihAvlYpO+QxDCi7H11+iN40kPAUaiqQdVsUwHqD1Zk4Kjwjhel6oZThzm1ks2zuqdkMnWGP2kbrrGkfPTCXy/fIcwUv87cmZ3z74FIr8bMB/m0=,iv:X8XVEgDdlB3wLeunFmqfX3b+sulBlAcOQSg1uCsVkks=,tag:d3Sae54ZLMWiXeXOjod40A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSMzhESU5wTXZUdzZmVjBs\nKzZ0VThIdk1UVE5hMW1vOWRlQWIrTHJWMVJZCjRKSStLRmNpU0J5Yzk3d2VmMG83\nWW10Uk9MdlhCbTl2NTFEWmRiUDRlK1UKLS0tIGJLYkNmV1huZ3o3QkZTbGZrRjA3\nMllyeHkzYjhvampicTI0cjBuL3NWNFUKO3TnqMQAJrckWl/D2qDulByN4KwANxLc\nZqu5nYpNLuifTLvOeUclC3e4A86nfIKSgfQipt0YPPZJa8Yye1dYQw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtZFRVNkdqeGJyM05qUzU3\ndHg5VGdrNTJLc2VubFloVTFmL0c1YjN3NWlBCmZLRTd0M1BvU0cyTitTUCtuZDg4\nY2NPQ0lSY2dvNDdaMFB0S2F0SzUxZHcKLS0tIHczeHNjWk9hSWhMVTRhYUdhU05t\nMXVyVFl2S25BSlJhUjRJYlI4U2NPbGcKDaCzSolkmNPMxsSvwfQHgtRruvxfmUv4\nCMKNZsRIjDKof9Rj70C6w9iTDCTOXIci0rPMMbSj2Ap49yCP+OgNCg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE4raUZPRGxU\nbVZwNjZZTGdWSC80ZXVqWFBjcFNFQVZYRGhhdVZLVUZ0MFkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQptVEdpa2l2SExOUEo3bzl5V0wrbWhG\nRXdHNG43WUhObTNrVzlJNk9oTW5vCi0tLSBIa0NRbVhtNWxXZk1DZEJuVUhwRVFh\nRzdiWFcrVlZqeUwwRFBScmVYandvCltCVs4xl0/dg6ph/XUNwtoVobDXVO/9k/Te\nFy4R/qnhRpFd5gDP4hbNq+sEdaoGOObQqAsGRZriZGilrXGbR2s=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEg2aGRvTWNQ\naldtRjF2NVhKUnJyWW1TdnFHMEdxNUNxdTdLWWNwZlFUd28gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpGOEhJOU82UUM1OWVaTXNpaEpoSHFD\nV0dob2QzZUhZeWo1ZmUxNThCUXhZCi0tLSB1bkJaOGdWelV4TXlsaXdCUU9ZdDlX\ndE13QlYrdTFqeVI2TVhCRlZFczZ3ClY8nEc0QdJ6peqyDLn0ZXi/6A/nIiKgBQ1A\nnrJX5b6IS4HB8a5tSRed3DzbhoVVoalSeQKG+yXvAvXwm3PgBdE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBUUjRuSmdx\nUVh2OVE0SXBzL2J5ZDd6TnVOR0l4eXdaS0tic0hWS1lOVEUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpabnUzamdLWXNLMlBXV3FUcVgwWk5G\nTktPZzR1VnV0VWQ4eGZiSUxkd0JVCi0tLSAyeDhyK3VwUEpiYXBWWXZYeHdlL1l4\nUnRHdXQ4czJjWFJIc0pKUkptMXU4CqKc5fse+/E9Mw7fMX7SD488+7do0IuDlMz9\nmwjqMxjprWlchrglecQSiQWHLXWLtjLlI8srU0lPOHWs6EVBwFs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUVzVkUGxkdE43UkozN0ow\nTzQwZSt1bmZDaDN2QzNqakdWem00OGd2RjA4CjE0L21IZ25oNGNDcmJ1amRQdTF5\nS3p5NDI2TE9CRVZMamxic0pJZ0ltN0kKLS0tIGkvM3hGRE1ITkxDQjlEV3lUWktv\ncXpLUzE3WHQzQlNxMTZhL2pBRnBleTQKR9J8ua83wbKBg/kq6lHP0LKbjrXlApfD\n1fjoGSaPQPgXvGcjtnF3vRvDuygQhek9tHqv5q0PHTUmEyZe5V9EPA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxWWpPWkpaQXN4aU44OTc3\nWDFaZ1c4Q2NlOFVzL0hqQlJLSUUxd05MR1E4CnhkYXJOUUlrNDYrM1pkM3ZPZkRG\nVG9wUlNUYjJQRlNmNkdkQW5EQThOdmcKLS0tIGhZYkVGb2k2V3E2Q1puQytiajZD\nNGx4dzJrYzNVR2ZNOUhxbzhndlpGRG8KnVaq2Qke7iE3w+qscVH59xUc5uLodNQV\nOpWOEKWHCsC9zqBnqmIhUhKFAvthTqokVA+fuGam0rJh/XUvZUkrHw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbnRmWmlOaEwzVVpqbmRU\nYnFDT1lUc2FoWjNaT09PaFJpLy84NHZ6UWhnCnZ3Ui84QVBubEN5cmVSRStMY3JH\nbldsUnpNYjZuVE00OWI1NlJoVWFiYWcKLS0tIHBYbmw3V2xSUlRRa1B2TDhGUmQw\nMERUNGVLU1ZkWjU5K2ViTmpsRVc4WEUK3GCKMuBTWLNyGyYEWfUfFkB8xKc3hbw2\n9xz5b/LKQqikuvVq/AUAqeED2MPUViH5/g6zZKzm7PreA1PXWcLsnw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYajRCZ2VNYTJZSVdQajR6\nb2xXQ25OSDcyTjZpaHhaRllQejJqdHJVRlNnCkRtUU1TSFU5cVU1a0gvS0lub1NO\nT1J2dGltNmxzVzkxaWUwQnNTODNZRXcKLS0tIG5jbUdBNnR4K2QrZlF1aGEvcUdT\nZmJEN09wRVlsZDAyQ3QxbGlTS0xBdTAKox6DCYahvAmh2jxaZN4WiQyQjTBDNtSZ\nF34MrMBoFetQq7BIaQed0w+gERRT6x3762s0ueV6MdrU9s9roQda7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtb2Z3d09oRnUyMjlQZXQx\nSjNieURIRFVBMWl3OVQwWEN2cEYrV2R1STF3CjR3bnpCVWpmTHJub2Y3VlZ5cENE\na3p4SWEyQlozRXhkS0tLVXJFUkt2dTgKLS0tIEhYMnF0SDRITm1tMUkwZTRaMnNF\nN1Bqc3hUaGpHN2ExaUczNFF6NEdWOHMKixz7WiXZdBW3wzCy9fqRi6ZsspTNLORk\n9Vj6zZTp4pwr+i4soOVOfNgw/cMUIxU4zOxViB6iBbrMVzNHz7Hnaw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:19Z",
+		"mac": "ENC[AES256_GCM,data:sQoTbaw9vnvjVoWaNY1YbZNOTHz07tG89lb0KBBIa9nLkZWMs6cPx9L4tOSDR7xZc8mZ8HxoYF2zaAirzaxXnMg+q8MzAcTl/awgo1Vz8vE9OauYE2pwBCkG/Z7flKcACBaBP35l9aR2+Piv99EcEG8gVC+YMv3v4BPqt9aZkJw=,iv:t97BqNPqjMuqlT4Anb1myTyBSP8O3CZV6Y+XStSi1/8=,tag:/kJf5I0PHwxD2HVnj1O9QA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/buna/yggdrasil/privateKey/users/kurogeek
+++ b/vars/per-machine/buna/yggdrasil/privateKey/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/buna/yggdrasil/publicKey/value
+++ b/vars/per-machine/buna/yggdrasil/publicKey/value
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAFtcDM2zl16/Z7NiW6mAWX+cxLqkQrQ+QV3dpStv9JCs=
+-----END PUBLIC KEY-----
--- a/vars/per-machine/mirach/phonebox/owner-name/value
+++ b/vars/per-machine/mirach/phonebox/owner-name/value
@@ -0,0 +1 @@
+usa-3
--- a/vars/per-machine/neptune/phonebox/owner-name/value
+++ b/vars/per-machine/neptune/phonebox/owner-name/value
@@ -0,0 +1 @@
+vi
--- a/vars/per-machine/ramus/greaterchiangmai-s3/endpoint/value
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/endpoint/value
@@ -1 +1 @@
-fsn1.your-objectstorage.com
+https://fsn1.your-objectstorage.com
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	cfc967fac9	fix think-backend upload and get avartar image	2026-01-20 14:22:02 +07:00
kurogeek	f3d282b763	bump nixpkgs	2026-01-15 11:35:36 +07:00
kurogeek	a37a0cc7d1	rm clanService/pingvin	2026-01-15 11:35:12 +07:00
kurogeek	a629fa123a	no clanService warnings	2026-01-15 10:26:57 +07:00
kurogeek	d3c7baf551	rana machine: emmie personal laptop	2026-01-15 09:59:37 +07:00
vi	162ba62cb2	neptune: git-daemon: global read access to islands and thinc	2026-01-01 00:00:00 +00:00
kurogeek	5af1fa25b9	think-greaterchiangmai file uploader	2026-01-12 13:07:56 +07:00
kurogeek	87fe4ff8bc	clan.meta.name -> clan.core.settings.name	2026-01-09 15:23:24 +07:00
kurogeek	49449d70e6	clanService/phonebox: update-vars	2026-01-09 14:33:19 +07:00
kurogeek	c724a8ee2b	think-greaterchiangmai missing R2_SCHEMA_URL is fixed	2026-01-07 13:15:39 +07:00
kurogeek	ca9a8d458c	clanService/phonebox: phonebook feature	2025-12-30 10:10:16 +07:00
kurogeek	90c739991d	bump clan-core	2025-12-29 16:55:23 +07:00
vi	4e83773e21	init git-daemon module	2025-12-01 00:00:00 +00:00
kurogeek	322d1bd612	clanService/phonebox: use FAXFILE variable	2025-12-26 16:53:07 +07:00
kurogeek	ec4c3897e2	clanService:phonebox: fax echo feature	2025-12-16 10:28:16 +07:00
kurogeek	39bfcd0080	nix fmt	2025-12-12 18:27:30 +07:00
kurogeek	6f9791746e	buna machine	2025-12-10 13:14:14 +07:00
kurogeek	d093103d86	clanService/phonebox: asterisk restart core when extensions.conf changed	2025-12-10 13:01:31 +07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpoELc7KUBZapdah4iw1ynBfkqw3QCZsLC5/2qL30DO`