mob next [ci-skip] [ci skip] [skip ci]

lastFile:routers/default.nix

flake.lock

@@ -72,11 +72,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781517972,
+        "lastModified": 1772411144,
-        "narHash": "sha256-G8bIXFqifs/y62GNPwg20Ksf71raYwzmyN99gf1tXak=",
+        "narHash": "sha256-WhXudztwPNnKXaqGX4DOqNfHzHdBSiGCvKGHM20pscw=",
         "ref": "refs/heads/main",
-        "rev": "7fc62d0c25c7a97d7027a9c248e21c97c9b3acc1",
+        "rev": "92cc85bc24eb31ce5725e1e72753129810ce3fe9",
-        "revCount": 14604,
+        "revCount": 13201,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -101,11 +101,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778718524,
+        "lastModified": 1772273147,
-        "narHash": "sha256-pXLoI6Ax0EnUK6r34UM1vibVC7CfTu6j72R2692ZzPs=",
+        "narHash": "sha256-Wzhoc6ifjTDZi8aVRH3fuLJPdd4ouNTTwwVhgoMcMek=",
-        "rev": "12c552ad547d87254f33f33bddd1a2cdbeac754d",
+        "rev": "d5de7a8d9e5726e678c94e62fe8ac3a809fee5da",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/12c552ad547d87254f33f33bddd1a2cdbeac754d.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/d5de7a8d9e5726e678c94e62fe8ac3a809fee5da.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -140,11 +140,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781152676,
+        "lastModified": 1771881364,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "narHash": "sha256-A5uE/hMium5of/QGC6JwF5TGoDAfpNtW00T0s9u/PN8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "a4cb7bf73f264d40560ba527f9280469f1f081c6",
         "type": "github"
       },
       "original": {
@@ -294,11 +294,11 @@
         "std": "std"
       },
       "locked": {
-        "lastModified": 1782964989,
+        "lastModified": 1779175997,
-        "narHash": "sha256-pU2Gye+1f+nvFleBTgXdeQfrQnKaJEuO2LT7PnsJ1p0=",
+        "narHash": "sha256-Ps/4s3jwaZdLVEpO+1cRs54VbPbgMeXJUqa4CWSPJSY=",
         "owner": "kurogeek",
         "repo": "frappix",
-        "rev": "ac5e2814fc1aca188080bf6b50504cd329790e56",
+        "rev": "0f1b4bcfb8c3b976e808a57e491d10857a1a45ac",
         "type": "github"
       },
       "original": {
@@ -353,11 +353,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781557312,
+        "lastModified": 1768068402,
-        "narHash": "sha256-QOIRYSUFSq7L5mY3dZymaVhcnne3tPgoR9riB0WocjA=",
+        "narHash": "sha256-bAXnnJZKJiF7Xr6eNW6+PhBf1lg2P1aFUO9+xgWkXfA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c03e4752899e55705dfa63979abd885c582a5c48",
+        "rev": "8bc5473b6bc2b6e1529a9c4040411e1199c43b4c",
         "type": "github"
       },
       "original": {
@@ -484,11 +484,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781242433,
+        "lastModified": 1772379624,
-        "narHash": "sha256-bchLZZ3sRn740zyvD2icZSnNoTaanN0nw7l6fjVXO+E=",
+        "narHash": "sha256-NG9LLTWlz4YiaTAiRGChbrzbVxBfX+Auq4Ab/SWmk4A=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "aabb2037edfc0f210723b72cd5f528aab5dd3f0b",
+        "rev": "52d061516108769656a8bd9c6e811c677ec5b462",
         "type": "github"
       },
       "original": {
@@ -522,11 +522,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746801636,
+        "lastModified": 1714086354,
-        "narHash": "sha256-dlcKfIXp/eqFHzFm+DzseXAWWlpVwyk9cTvCKGtVKkw=",
+        "narHash": "sha256-yKVQMxL9p7zCWUhnGhDzRVT8sDgHoI3V595lBK0C2YA=",
         "owner": "nix-community",
         "repo": "nixago",
-        "rev": "8cc33f973ab3a891d8a41391e73ef451a783960b",
+        "rev": "5133633e9fe6b144c8e00e3b212cdbd5a173b63d",
         "type": "github"
       },
       "original": {
@@ -552,11 +552,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1781359544,
+        "lastModified": 1778458615,
-        "narHash": "sha256-iUuzKQcyXvopYDDzFpMK5eQKP3WIJExYny2kJtbgUcE=",
+        "narHash": "sha256-cY07EsdhBJ8tFXPzDYevgqxRev9ZLxFonuq9wmq5kwg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9f11f828c213641c2369a9f1fa31fe31557e3156",
+        "rev": "c6e5ca3c836a5f4dd9af9f2c1fc1c38f0fac988a",
         "type": "github"
       },
       "original": {
@@ -581,6 +581,30 @@
         "type": "github"
       }
     },
+    "openwrt-imagebuilder": {
+      "inputs": {
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1777544882,
+        "narHash": "sha256-QqrZLvCSg4w2jmLGXs/4KJVXZeogxIeuX0Hw4o5qWwU=",
+        "owner": "astro",
+        "repo": "nix-openwrt-imagebuilder",
+        "rev": "149d0e41bc9ed257290c87a8fdb18c4071e37e07",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "nix-openwrt-imagebuilder",
+        "type": "github"
+      }
+    },
     "paisano": {
       "inputs": {
         "call-flake": "call-flake",
@@ -661,6 +685,7 @@
         "import-tree": "import-tree",
         "liminix": "liminix",
         "nixpkgs": "nixpkgs_2",
+        "openwrt-imagebuilder": "openwrt-imagebuilder",
         "plasma-manager": "plasma-manager",
         "treefmt-nix": "treefmt-nix"
       }
@@ -673,11 +698,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780547341,
+        "lastModified": 1772340640,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "narHash": "sha256-1nq7+Kt5IUBD8Hu3nptVPbMf+22rNJoHT0t9L1X+GKA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "rev": "dec4d8eac700dcd2fe3c020857d3ee220ec147f1",
         "type": "github"
       },
       "original": {
@@ -763,22 +788,6 @@
       }
     },
     "systems": {
-      "locked": {
-        "lastModified": 1774449309,
-        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "ref": "future-26.11",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -793,6 +802,21 @@
         "type": "github"
       }
     },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1680978846,
+        "narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "type": "github"
+      }
+    },
     "systems_3": {
       "locked": {
         "lastModified": 1681028828,
@@ -808,6 +832,21 @@
         "type": "github"
       }
     },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1680978846,
+        "narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -26,6 +26,11 @@
     };
     import-tree.url = "github:vic/import-tree";
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    openwrt-imagebuilder = {
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
+      url = "github:astro/nix-openwrt-imagebuilder";
+    };
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -56,6 +61,7 @@
           ./shell.nix
 
           ./overlays
+          ./modules/nixos
           ./machines
           ./routers
           ./inventories
@@ -78,6 +84,7 @@
             packages.think-be = pkgs.think-backend-gtcm;
             packages.file-uploader = pkgs.gtcm-file-uploader;
           };
+
       }
     );
 }

inventories/default.nix

@@ -19,11 +19,13 @@
         w = [ "sirius" ];
         b4l = [
           "rigel"
+          "neptune"
           "rana"
           "petra"
           "alasia"
         ];
         phonebox = [
+          "neptune"
           "rigel"
           "almach"
           "alpheratz"
@@ -31,11 +33,12 @@
           "adhil"
           "buna"
         ];
-
+        global-network = [
-        prometheus = [
+          "rana"
-          "cursa"
+          "sirius"
-          "rigel"
+          "hadar"
-          "vega"
+          "procyon"
+          "alasia"
         ];
       };
 
@@ -47,6 +50,8 @@
             authorizedKeys = {
               "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
               "davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
+              "vi" =
+                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387";
               "kurogeek" =
                 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
               "matthewcroughan" =
@@ -97,13 +102,7 @@
             name = "zerotier";
             input = "clan-core";
           };
-          roles.controller.machines."vega" = {
+          roles.controller.machines."vega" = { };
-            settings.allowedIds = [
-              "dbe44c0287" # Alex-gateway
-              "b0e0b84fd3" # Alex
-              "2bd36db8cc" # kurogeek-thinkpad
-            ];
-          };
           roles.peer.tags.glom = { };
         };
 
@@ -112,13 +111,7 @@
             name = "zerotier";
             input = "clan-core";
           };
-          roles.controller.machines."rigel" = {
+          roles.controller.machines."rigel" = { };
-            settings.allowedIds = [
-              "dbe44c0287" # Alex-gateway
-              "b0e0b84fd3" # Alex
-              "2bd36db8cc" # kurogeek-thinkpad
-            ];
-          };
           roles.peer.tags.b4l = { };
         };
 
@@ -136,24 +129,12 @@
           roles.peer.tags."poy" = { };
         };
 
-        internet = {
-          module.name = "internet";
-          roles.default.machines = {
-            ramus.settings.host = "5.223.63.55";
-            tangra.settings.host = "5.223.65.50";
-          };
-        };
-
         yggdrasil-global-network = {
           module = {
             name = "yggdrasil";
             input = "clan-core";
           };
-          roles.default.tags."all" = { };
+          roles.default.tags."global-network" = { };
-          roles.default.settings.extraYggdrasilIPs = [
-            # kurogeek's laptop
-            "200:c8db:ea9b:5bdc:44ed:ad87:462a:6bd0"
-          ];
           roles.default.settings.extraPeers = [
             "tls://ygg.jjolly.dev:3443"
             "tls://[2602:fc24:18:7a42::1]:993"
@@ -179,6 +160,20 @@
           };
         };
 
+        yggdrasil-phone-network = {
+          module = {
+            name = "yggdrasil";
+            input = "clan-core";
+          };
+          roles.default.tags."phonebox" = { };
+          roles.default.settings.extraPeers = [
+            "tls://ygg.jjolly.dev:3443"
+            "tls://[2602:fc24:18:7a42::1]:993"
+            "tcp://leo.node.3dt.net:9002"
+            "tcp://ygg-kcmo.incognet.io:8883"
+          ];
+        };
+
         phonebox = {
           module = {
             name = "phonebox";
@@ -188,13 +183,6 @@
           roles.default.machines."adhil".settings = {
             ata-ethernet-iface = "end0";
           };
-          roles.default.machines."rigel".settings = {
-            extraClientNumbers = [
-              "01"
-              "02"
-            ];
-            extraFixedIPClient = { };
-          };
         };
 
         pulse-stream = {
@@ -289,64 +277,6 @@
             dataDir = "/mnt/hdd/samba";
           };
         };
-
-        wordpress = {
-          module = {
-            name = "wordpress";
-            input = "self";
-          };
-          roles.server.machines."tangra".settings = {
-            tenants = [
-              "poyfestival.com"
-            ];
-            phpfpmOptions = ''
-              upload_max_filesize=64M
-              post_max_size=128M
-            '';
-            wpExtraConfig = ''
-              define('WP_MEMORY_LIMIT', '256M');
-              define('WP_DEBUG', false);
-              define('WP_DEBUG_DISPLAY', false);
-              define('WP_DEBUG_LOG', false);
-            '';
-          };
-        };
-
-        prometheus-monitoring = {
-          module = {
-            name = "prometheus";
-            input = "self";
-          };
-          roles.server.machines."cursa".settings = {
-            matrix-alertmanager = {
-              enable = true;
-              homeserverUrl = "https://matrix-client.matrix.org";
-              matrixUser = "@nixapollo:matrix.org";
-              matrixRooms = [
-                {
-                  receivers = [
-                    "matrix"
-                  ];
-                  roomId = "!rqIrWqPvsXqMgYpcNZ:matrix.org";
-                }
-              ];
-            };
-          };
-
-          roles.nodes.machines = {
-            vega.settings = {
-              exporters.smartctl = { };
-              exporters.zfs = { };
-            };
-            rigel.settings = {
-              exporters.smartctl = { };
-            };
-            sirius.settings = {
-              exporters.smartctl = { };
-              exporters.zfs = { };
-            };
-          };
-        };
       };
     };
   };

inventory.json

@@ -47,12 +47,6 @@
     },
     "bosona": {
       "installedAt": 1779098893
-    },
-    "tangra": {
-      "installedAt": 1779958921
-    },
-    "cursa": {
-      "installedAt": 1782187627
     }
   }
 }

machines/bosona/facter.json

@@ -25,7 +25,10 @@
       {
         "index": 8,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -73,7 +76,10 @@
       {
         "index": 9,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -125,7 +131,10 @@
       {
         "index": 10,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -173,7 +182,10 @@
       {
         "index": 11,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -229,7 +241,10 @@
       {
         "index": 12,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -282,14 +297,21 @@
         },
         "driver": "piix4_smbus",
         "driver_module": "i2c_piix4",
-        "drivers": ["piix4_smbus"],
+        "drivers": [
-        "driver_modules": ["i2c_piix4"],
+          "piix4_smbus"
+        ],
+        "driver_modules": [
+          "i2c_piix4"
+        ],
         "module_alias": "pci:v00008086d00007113sv00001AF4sd00001100bc06sc80i00"
       },
       {
         "index": 17,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -339,7 +361,11 @@
       {
         "index": 22,
         "attached_to": 15,
-        "class_list": ["cdrom", "scsi", "block_device"],
+        "class_list": [
+          "cdrom",
+          "scsi",
+          "block_device"
+        ],
         "bus_type": {
           "hex": "0084",
           "name": "SCSI",
@@ -396,8 +422,14 @@
         "unix_device_name2": "/dev/sg1",
         "driver": "ata_piix",
         "driver_module": "ata_piix",
-        "drivers": ["ata_piix", "sr"],
+        "drivers": [
-        "driver_modules": ["ata_piix", "sr_mod"]
+          "ata_piix",
+          "sr"
+        ],
+        "driver_modules": [
+          "ata_piix",
+          "sr_mod"
+        ]
       }
     ],
     "cpu": [
@@ -464,7 +496,9 @@
           "spectre_v2_user",
           "its"
         ],
-        "power_management": [""],
+        "power_management": [
+          ""
+        ],
         "bogo": 4224,
         "cache": 16384,
         "page_size": 4096,
@@ -546,7 +580,9 @@
           "spectre_v2_user",
           "its"
         ],
-        "power_management": [""],
+        "power_management": [
+          ""
+        ],
         "bogo": 4224,
         "cache": 16384,
         "page_size": 4096,
@@ -570,7 +606,11 @@
       {
         "index": 23,
         "attached_to": 19,
-        "class_list": ["disk", "scsi", "block_device"],
+        "class_list": [
+          "disk",
+          "scsi",
+          "block_device"
+        ],
         "bus_type": {
           "hex": "0084",
           "name": "SCSI",
@@ -634,15 +674,24 @@
         ],
         "driver": "virtio_scsi",
         "driver_module": "virtio_scsi",
-        "drivers": ["sd", "virtio_scsi"],
+        "drivers": [
-        "driver_modules": ["sd_mod", "virtio_scsi"]
+          "sd",
+          "virtio_scsi"
+        ],
+        "driver_modules": [
+          "sd_mod",
+          "virtio_scsi"
+        ]
       }
     ],
     "graphics_card": [
       {
         "index": 16,
         "attached_to": 0,
-        "class_list": ["graphics_card", "pci"],
+        "class_list": [
+          "graphics_card",
+          "pci"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -699,8 +748,12 @@
         },
         "driver": "bochs-drm",
         "driver_module": "bochs",
-        "drivers": ["bochs-drm"],
+        "drivers": [
-        "driver_modules": ["bochs"],
+          "bochs-drm"
+        ],
+        "driver_modules": [
+          "bochs"
+        ],
         "module_alias": "pci:v00001234d00001111sv00001AF4sd00001100bc03sc00i00"
       }
     ],
@@ -708,7 +761,10 @@
       {
         "index": 24,
         "attached_to": 7,
-        "class_list": ["usb", "hub"],
+        "class_list": [
+          "usb",
+          "hub"
+        ],
         "bus_type": {
           "hex": "0086",
           "name": "USB",
@@ -781,8 +837,12 @@
         "hotplug": "usb",
         "driver": "hub",
         "driver_module": "usbcore",
-        "drivers": ["hub"],
+        "drivers": [
-        "driver_modules": ["usbcore"],
+          "hub"
+        ],
+        "driver_modules": [
+          "usbcore"
+        ],
         "module_alias": "usb:v1D6Bp0001d0618dc09dsc00dp00ic09isc00ip00in00"
       }
     ],
@@ -790,7 +850,9 @@
       {
         "index": 5,
         "attached_to": 0,
-        "class_list": ["memory"],
+        "class_list": [
+          "memory"
+        ],
         "base_class": {
           "hex": "0101",
           "name": "Internally Used Class",
@@ -814,7 +876,9 @@
       {
         "index": 21,
         "attached_to": 16,
-        "class_list": ["monitor"],
+        "class_list": [
+          "monitor"
+        ],
         "base_class": {
           "hex": "0100",
           "name": "Monitor",
@@ -960,7 +1024,10 @@
       {
         "index": 25,
         "attached_to": 24,
-        "class_list": ["mouse", "usb"],
+        "class_list": [
+          "mouse",
+          "usb"
+        ],
         "bus_type": {
           "hex": "0086",
           "name": "USB",
@@ -996,7 +1063,9 @@
         "model": "QEMU USB Tablet",
         "sysfs_id": "/devices/pci0000:00/0000:00:01.2/usb1/1-1/1-1:1.0",
         "sysfs_bus_id": "1-1:1.0",
-        "unix_device_names": ["/dev/input/mice"],
+        "unix_device_names": [
+          "/dev/input/mice"
+        ],
         "unix_device_name2": "/dev/input/mouse0",
         "resources": [
           {
@@ -1037,11 +1106,18 @@
         "hotplug": "usb",
         "driver": "usbhid",
         "driver_module": "usbhid",
-        "drivers": ["usbhid"],
+        "drivers": [
-        "driver_modules": ["usbhid"],
+          "usbhid"
+        ],
+        "driver_modules": [
+          "usbhid"
+        ],
         "driver_info": {
           "type": "mouse",
-          "db_entry_0": ["explorerps/2", "exps2"],
+          "db_entry_0": [
+            "explorerps/2",
+            "exps2"
+          ],
           "xf86": "explorerps/2",
           "gpm": "exps2",
           "buttons": -1,
@@ -1054,7 +1130,9 @@
       {
         "index": 18,
         "attached_to": 13,
-        "class_list": ["network_controller"],
+        "class_list": [
+          "network_controller"
+        ],
         "bus_type": {
           "hex": "008f",
           "name": "Virtio",
@@ -1079,7 +1157,9 @@
         "model": "Virtio Ethernet Card 0",
         "sysfs_id": "/devices/pci0000:00/0000:00:12.0/virtio1",
         "sysfs_bus_id": "virtio1",
-        "unix_device_names": ["ens18"],
+        "unix_device_names": [
+          "ens18"
+        ],
         "resources": [
           {
             "type": "hwaddr",
@@ -1092,8 +1172,12 @@
         ],
         "driver": "virtio_net",
         "driver_module": "virtio_net",
-        "drivers": ["virtio_net"],
+        "drivers": [
-        "driver_modules": ["virtio_net"],
+          "virtio_net"
+        ],
+        "driver_modules": [
+          "virtio_net"
+        ],
         "module_alias": "virtio:d00000001v00001AF4"
       }
     ],
@@ -1101,7 +1185,9 @@
       {
         "index": 26,
         "attached_to": 18,
-        "class_list": ["network_interface"],
+        "class_list": [
+          "network_interface"
+        ],
         "base_class": {
           "hex": "0107",
           "name": "Network Interface",
@@ -1115,7 +1201,9 @@
         "model": "Ethernet network interface",
         "sysfs_id": "/class/net/ens18",
         "sysfs_device_link": "/devices/pci0000:00/0000:00:12.0/virtio1",
-        "unix_device_names": ["ens18"],
+        "unix_device_names": [
+          "ens18"
+        ],
         "resources": [
           {
             "type": "hwaddr",
@@ -1128,13 +1216,19 @@
         ],
         "driver": "virtio_net",
         "driver_module": "virtio_net",
-        "drivers": ["virtio_net"],
+        "drivers": [
-        "driver_modules": ["virtio_net"]
+          "virtio_net"
+        ],
+        "driver_modules": [
+          "virtio_net"
+        ]
       },
       {
         "index": 27,
         "attached_to": 0,
-        "class_list": ["network_interface"],
+        "class_list": [
+          "network_interface"
+        ],
         "base_class": {
           "hex": "0107",
           "name": "Network Interface",
@@ -1147,14 +1241,19 @@
         },
         "model": "Loopback network interface",
         "sysfs_id": "/class/net/lo",
-        "unix_device_names": ["lo"]
+        "unix_device_names": [
+          "lo"
+        ]
       }
     ],
     "pci": [
       {
         "index": 13,
         "attached_to": 0,
-        "class_list": ["pci", "unknown"],
+        "class_list": [
+          "pci",
+          "unknown"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1211,14 +1310,21 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
+        "drivers": [
-        "driver_modules": ["virtio_pci"],
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
         "module_alias": "pci:v00001AF4d00001000sv00001AF4sd00000001bc02sc00i00"
       },
       {
         "index": 14,
         "attached_to": 0,
-        "class_list": ["pci", "unknown"],
+        "class_list": [
+          "pci",
+          "unknown"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1274,8 +1380,12 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
+        "drivers": [
-        "driver_modules": ["virtio_pci"],
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
         "module_alias": "pci:v00001AF4d00001002sv00001AF4sd00000005bc00scFFi00"
       }
     ],
@@ -1283,7 +1393,10 @@
       {
         "index": 6,
         "attached_to": 17,
-        "class_list": ["storage_controller", "pci"],
+        "class_list": [
+          "storage_controller",
+          "pci"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1340,14 +1453,21 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
+        "drivers": [
-        "driver_modules": ["virtio_pci"],
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
         "module_alias": "pci:v00001AF4d00001004sv00001AF4sd00000008bc01sc00i00"
       },
       {
         "index": 15,
         "attached_to": 0,
-        "class_list": ["storage_controller", "pci"],
+        "class_list": [
+          "storage_controller",
+          "pci"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1437,8 +1557,12 @@
         },
         "driver": "ata_piix",
         "driver_module": "ata_piix",
-        "drivers": ["ata_piix"],
+        "drivers": [
-        "driver_modules": ["ata_piix"],
+          "ata_piix"
+        ],
+        "driver_modules": [
+          "ata_piix"
+        ],
         "module_alias": "pci:v00008086d00007010sv00001AF4sd00001100bc01sc01i80"
       }
     ],
@@ -1449,7 +1573,9 @@
       {
         "index": 19,
         "attached_to": 6,
-        "class_list": ["unknown"],
+        "class_list": [
+          "unknown"
+        ],
         "base_class": {
           "hex": "0000",
           "name": "Unclassified device",
@@ -1467,14 +1593,20 @@
         "sysfs_bus_id": "virtio2",
         "driver": "virtio_scsi",
         "driver_module": "virtio_scsi",
-        "drivers": ["virtio_scsi"],
+        "drivers": [
-        "driver_modules": ["virtio_scsi"],
+          "virtio_scsi"
+        ],
+        "driver_modules": [
+          "virtio_scsi"
+        ],
         "module_alias": "virtio:d00000008v00001AF4"
       },
       {
         "index": 20,
         "attached_to": 14,
-        "class_list": ["unknown"],
+        "class_list": [
+          "unknown"
+        ],
         "base_class": {
           "hex": "0000",
           "name": "Unclassified device",
@@ -1492,8 +1624,12 @@
         "sysfs_bus_id": "virtio0",
         "driver": "virtio_balloon",
         "driver_module": "virtio_balloon",
-        "drivers": ["virtio_balloon"],
+        "drivers": [
-        "driver_modules": ["virtio_balloon"],
+          "virtio_balloon"
+        ],
+        "driver_modules": [
+          "virtio_balloon"
+        ],
         "module_alias": "virtio:d00000005v00001AF4"
       }
     ],
@@ -1501,7 +1637,10 @@
       {
         "index": 7,
         "attached_to": 0,
-        "class_list": ["usb_controller", "pci"],
+        "class_list": [
+          "usb_controller",
+          "pci"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1568,15 +1707,25 @@
         },
         "driver": "uhci_hcd",
         "driver_module": "uhci_hcd",
-        "drivers": ["uhci_hcd"],
+        "drivers": [
-        "driver_modules": ["uhci_hcd"],
+          "uhci_hcd"
+        ],
+        "driver_modules": [
+          "uhci_hcd"
+        ],
         "driver_info": {
           "type": "module",
-          "db_entry_0": ["uhci-hcd"],
+          "db_entry_0": [
+            "uhci-hcd"
+          ],
           "active": true,
           "modprobe": true,
-          "names": ["uhci-hcd"],
+          "names": [
-          "module_args": [""],
+            "uhci-hcd"
+          ],
+          "module_args": [
+            ""
+          ],
           "conf": ""
         },
         "module_alias": "pci:v00008086d00007020sv00001AF4sd00001100bc0Csc03i00"
@@ -1689,7 +1838,9 @@
           "name": "RAM",
           "value": 7
         },
-        "memory_type_details": ["Other"],
+        "memory_type_details": [
+          "Other"
+        ],
         "speed": 0
       }
     ],

machines/canopus/configuration.nix

@@ -50,7 +50,7 @@ in
     ];
     sites = {
       "${sitename}" = {
-        domains = [ sitename ];
+        domains = [ "localhost" ];
         apps = [
           "frappe"
           "erpnext"

machines/cursa/configuration.nix

@@ -1,14 +0,0 @@
-{
-  ...
-}:
-{
-  clan.core.settings.machine.description =
-    "VM machine for collecting prometheus metrics and fire alerts";
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-}

machines/cursa/disko.nix

@@ -1,85 +0,0 @@
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/deneb/configuration.nix

@@ -56,7 +56,6 @@ in
       pkgs.frappix.erpnext
       pkgs.frappix.hrms
       pkgs.frappix.crm
-      pkgs.frappix.posprinter
     ];
     sites = {
       "${sitename}" = {
@@ -66,7 +65,6 @@ in
           "erpnext"
           "hrms"
           "crm"
-          "posprinter"
         ];
       };
     };

machines/hadar/configuration.nix

@@ -9,6 +9,13 @@ let
 in
 {
   clan.core.settings.machine.description = "VM machine that host Inventree system for Poy";
+  imports = [
+    inputs.self.nixosModules.inventree
+  ];
+
+  nixpkgs.overlays = [
+    inputs.self.overlays.packagesOverlay
+  ];
 
   nixpkgs.hostPlatform = {
     system = "x86_64-linux";
@@ -75,12 +82,19 @@ in
 
   services.inventree = {
     enable = true;
-    inherit domain;
+    hostName = "${domain}";
+    config.site_url = "https://${config.services.inventree.hostName}";
     secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
-    adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
+    config.oidc_private_key_file = config.clan.core.vars.generators.inventree.files.oidc-key.path;
-    settings.INVENTREE_SITE_URL = "https://${domain}";
+    config.adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
   };
 
+  # services.nginx.virtualHosts."${domain}" = {
+  #   forceSSL = true;
+  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
+  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
+  # };
+
   system.stateVersion = "25.11";
   clan.core.sops.defaultGroups = [ "admins" ];
 }

machines/neptune/configuration.nix

@@ -10,6 +10,7 @@
   };
   system.stateVersion = "25.11";
   clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 
   networking.interfaces.enx00e04c106368.useDHCP = true; # recovery
 

machines/procyon/configuration.nix

@@ -9,6 +9,13 @@ let
 in
 {
   clan.core.settings.machine.description = "VM machine that host Inventree system for Glom";
+  imports = [
+    inputs.self.nixosModules.inventree
+  ];
+
+  nixpkgs.overlays = [
+    inputs.self.overlays.packagesOverlay
+  ];
 
   nixpkgs.hostPlatform = {
     system = "x86_64-linux";
@@ -75,12 +82,19 @@ in
 
   services.inventree = {
     enable = true;
-    inherit domain;
+    hostName = "${domain}";
+    config.site_url = "https://${config.services.inventree.hostName}";
     secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
-    adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
+    config.oidc_private_key_file = config.clan.core.vars.generators.inventree.files.oidc-key.path;
-    settings.INVENTREE_SITE_URL = "https://${domain}";
+    config.adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
   };
 
+  # services.nginx.virtualHosts."${domain}" = {
+  #   forceSSL = true;
+  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
+  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
+  # };
+
   system.stateVersion = "25.11";
   clan.core.sops.defaultGroups = [ "admins" ];
 }

machines/ramus/configuration.nix

@@ -9,6 +9,7 @@
   clan.core.settings.machine.description = "A Hetzner VPS machine own by Alex.";
 
   clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 
   clan.core.vars.generators.acme = {
     share = true;

machines/rigel/configuration.nix

@@ -1,7 +1,18 @@
 { config, ... }:
 {
+  imports = [
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
   system.stateVersion = "25.11";
   clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 
   clan.core.settings.machine.description = "Zima board computer for testing in B4L";
 }

machines/tangra/configuration.nix

@@ -1,32 +0,0 @@
-{
-  system.stateVersion = "25.11";
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-
-  clan.core.settings.name = "tangra";
-  clan.core.settings.machine.description =
-    "A Hetzner VPS machine own by Alex. This is a machine for poyfestival.com";
-
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  clan.core.vars.generators.acme = {
-    share = true;
-    files.email.secret = false;
-
-    prompts.email = {
-      type = "line";
-      description = "Email for ACME registeration";
-    };
-
-    script = ''
-      cat $prompts/email > $out/email
-    '';
-  };
-
-  users.users.nginx.extraGroups = [ "acme" ];
-
-  security.acme.acceptTerms = true;
-
-  imports = [ ];
-}

machines/tangra/disko.nix

@@ -1,86 +0,0 @@
-{ ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_119349241";
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-
-  boot.zfs.forceImportRoot = true;
-
-  disko.devices = {
-    disk = {
-      "os-${hashDisk os}" = {
-        type = "disk";
-        device = os;
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "nofail" ];
-              };
-            };
-            system = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        options.ashift = "12";
-        datasets = {
-          "root" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-          };
-          "root/nixos" = {
-            type = "zfs_fs";
-            options.mountpoint = "/";
-            mountpoint = "/";
-          };
-          "root/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "/home";
-            mountpoint = "/home";
-          };
-          "root/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/tmp";
-            options = {
-              mountpoint = "/tmp";
-              sync = "disabled";
-            };
-          };
-        };
-      };
-    };
-  };
-}

machines/vega/configuration.nix

@@ -10,9 +10,17 @@
 
     (inputs.import-tree ./services)
 
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
   ];
 
   clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 
   clan.core.settings.machine.description = "Glom NAS";
 

modules/clan/headscale/default.nix

@@ -173,7 +173,6 @@
                 base_domain = settings.base_domain;
                 override_local_dns = true;
                 nameservers.global = settings.nameservers;
-                magic_dns = false;
               };
             };
 

modules/clan/home-profiles/home-user/emmie.nix

@@ -66,6 +66,8 @@
                 "AutofillAddressEnabled" = false;
                 "AutofillCreditCardEnabled" = false;
                 "TranslateEnabled" = false;
+                "DnsOverHttpsMode" = "secure";
+                "DnsOverHttpsTemplates" = "https://dns.adguard-dns.com/dns-query";
               };
             };
 
@@ -79,32 +81,14 @@
                 inputs,
                 ...
               }:
-              let
-                dictionaries =
-                  with pkgs;
-                  (hunspellWithDicts (
-                    with hunspellDicts;
-                    [
-                      en-us-large
-                      th-th
-                    ]
-                  ));
-              in
               {
                 imports = [ inputs.plasma-manager.homeModules.plasma-manager ];
 
-                systemd.user.sessionVariables = {
-                  DICPATH = "${dictionaries}/share/hunspell";
-                };
-
                 home = {
                   homeDirectory = lib.mkForce "/home/${username}";
                   stateVersion = osConfig.system.stateVersion;
-
                   packages = with pkgs; [
-                    libreoffice-qt6
+                    libreoffice-fresh
-                    dictionaries
-
                     element-desktop
                     signal-desktop
                     brave

modules/clan/personal-computer/desktop-environment.nix

@@ -5,4 +5,5 @@
 
   services.displayManager.sddm.enable = lib.mkForce false;
   services.displayManager.gdm.enable = true;
+  services.displayManager.gdm.wayland = true;
 }

modules/clan/phonebox/default.nix

@@ -24,36 +24,6 @@
           description = "";
           default = "";
         };
-        options.extraClientNumbers = lib.mkOption {
-          type = with lib.types; listOf str;
-          description = "List of client suffix number.";
-          default = [ ];
-        };
-
-        options.extraFixedIPClient = lib.mkOption {
-          type = lib.types.attrsOf (
-            lib.types.submodule {
-              options = {
-                ip = lib.mkOption {
-                  type = lib.types.str;
-                  description = "IP address for this client";
-                };
-
-                name = lib.mkOption {
-                  type = lib.types.str;
-                  description = "Name of the client";
-                };
-              };
-            }
-          );
-          description = "Extra client to be added to pjsip config as a fixed IP auth";
-          example = {
-            "01" = {
-              ip = "192.168.1.3";
-              name = "bob";
-            };
-          };
-        };
       };
     perInstance =
       {
@@ -156,41 +126,6 @@
                 remove_existing=yes
               '';
 
-            genLocalSIPEndpointV6 =
-              { localNumber }:
-              ''
-                [${localNumber}](internal_endpoint)
-                transport=transport-udp6
-                aors=${localNumber}
-                auth=${localNumber}
-
-                [${localNumber}](userpass_auth)
-                username=${localNumber}
-                password=${localNumber}
-
-                [${localNumber}](dynamiic_aor)
-                max_contacts=1
-              '';
-
-            genLocalSIPIPEndpoint = number: ''
-
-              [${number}](internal_endpoint)
-              aors=${number}
-              auth=${number}
-              contact_deny=0.0.0.0/0
-              contact_deny=::/0
-              contact_permit=${settings.extraFixedIPClient.${number}.ip}/128
-
-              [${number}](dynamiic_aor)
-              max_contacts=1
-              remove_existing=yes
-
-              [${number}](userpass_auth)
-              username=${number}
-              password=${number}
-
-            '';
-
             genLocalExtenConf =
               { localNumber }:
               ''
@@ -421,14 +356,6 @@
                     + (genLocalExtenConf {
                       localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
                     })
-                    + lib.concatStringsSep "\n" (
-                      builtins.map (number: genLocalExtenConf { localNumber = number; }) settings.extraClientNumbers
-                    )
-                    + lib.concatStringsSep "\n" (
-                      lib.mapAttrsToList (
-                        number: _: genLocalExtenConf { localNumber = number; }
-                      ) settings.extraFixedIPClient
-                    )
                     + serverConf;
 
                   "rtp.conf" = ''
@@ -482,12 +409,6 @@
                     + (genLocalSIPEndpoint {
                       localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
                     })
-                    + lib.concatStringsSep "\n" (
-                      builtins.map (number: genLocalSIPEndpointV6 { localNumber = number; }) settings.extraClientNumbers
-                    )
-                    + lib.concatStringsSep "\n" (
-                      lib.mapAttrsToList (number: _: genLocalSIPIPEndpoint number) settings.extraFixedIPClient
-                    )
                     + serverConf;
                 };
             };

modules/clan/prometheus/default.nix

@@ -1,308 +0,0 @@
-{ clanLib, ... }:
-{
-  _class = "clan.service";
-  manifest.name = "prometheus";
-  manifest.description = "The Prometheus monitoring system and time series database.";
-  manifest.readme = builtins.readFile ./README.md;
-  manifest.categories = [ "System" ];
-
-  roles.server = {
-    description = "Prometheus server that scraps all data from nodes";
-
-    interface =
-      { lib, ... }:
-      {
-        options = {
-          scrape_interval = lib.mkOption {
-            type = with lib.types; nullOr str;
-            default = "1m";
-            description = "How often to scrape targets. Default is 1 minutes";
-          };
-          extra_rules = lib.mkOption {
-            type = with lib.types; listOf attrs;
-            default = [ ];
-            description = "Additional rules for Prometheus";
-          };
-          default_receiver = lib.mkOption {
-            type = with lib.types; attrs;
-            default = {
-              name = "default";
-            };
-            description = "Definition of a default receiver, default is doing nothing";
-          };
-          matrix-alertmanager = {
-            enable = lib.mkOption {
-              type = with lib.types; bool;
-              default = false;
-              description = "Whether to enable `services.matrix-alertmanager`";
-            };
-            homeserverUrl = lib.mkOption {
-              type = with lib.types; str;
-              default = "https://matrix-client.matrix.org";
-              description = "URL of the Matrix homeserver to use";
-            };
-            matrixUser = lib.mkOption {
-              type = with lib.types; str;
-              description = "Matrix user for the bot";
-            };
-            matrixRooms = lib.mkOption {
-              type = lib.types.listOf (
-                lib.types.submodule {
-                  options = {
-                    receivers = lib.mkOption {
-                      type = lib.types.listOf lib.types.str;
-                      description = "List of receivers for this room";
-                    };
-                    roomId = lib.mkOption {
-                      type = lib.types.str;
-                      description = "Matrix room ID";
-                      apply =
-                        x:
-                        assert lib.assertMsg (lib.hasPrefix "!" x) "Matrix room ID must start with a '!'. Got: ${x}";
-                        x;
-                    };
-                  };
-                }
-              );
-              description = ''
-                Combination of Alertmanager receiver(s) and rooms for the bot to join.
-                Each Alertmanager receiver can be mapped to post to a matrix room.
-
-                Note, you must use a room ID and not a room alias/name. Room IDs start
-                with a "!".
-              '';
-              example = [
-                {
-                  receivers = [
-                    "receiver1"
-                    "receiver2"
-                  ];
-                  roomId = "!roomid@example.com";
-                }
-                {
-                  receivers = [ "receiver3" ];
-                  roomId = "!differentroomid@example.com";
-                }
-              ];
-            };
-
-          };
-        };
-      };
-
-    perInstance =
-      {
-        settings,
-        roles,
-        ...
-      }:
-      {
-        nixosModule =
-          {
-            config,
-            lib,
-            pkgs,
-            ...
-          }:
-          let
-            getYggdrasilIP =
-              machineName:
-              if config.clan.core.vars.generators.yggdrasil.files.address ? value then
-                clanLib.getPublicValue {
-                  flake = config.clan.core.settings.directory;
-                  machine = machineName;
-                  generator = "yggdrasil";
-                  file = "address";
-                  default = null;
-                }
-              else
-                throw "clanService/yggdrasil is required";
-
-            matrixRoomReceivers = lib.unique (
-              lib.concatMap (entry: entry.receivers) settings.matrix-alertmanager.matrixRooms
-            );
-          in
-          lib.mkMerge [
-            {
-              networking.firewall.allowedTCPPorts = [
-                9090
-              ];
-              services.prometheus = {
-                enable = true;
-
-                globalConfig = {
-                  scrape_interval = settings.scrape_interval;
-                };
-
-                alertmanagers = [
-                  {
-                    scheme = "http";
-                    path_prefix = "/";
-                    static_configs = [ { targets = [ "localhost:9093" ]; } ];
-                  }
-                ];
-
-                alertmanager = {
-                  enable = true;
-                  configuration = {
-                    global = {
-                      resolve_timeout = "5m";
-                    };
-                    route = {
-                      receiver = "default";
-                      routes = map (mReceiver: { receiver = mReceiver; }) matrixRoomReceivers;
-                    };
-                    receivers = [
-                      { name = "default"; }
-                    ]
-                    ++ map (mReceiver: {
-                      name = mReceiver;
-                      webhook_configs = [
-                        {
-                          url_file = config.clan.core.vars.generators.prometheus.files.matrix-alertmanager-urlfile.path;
-                          send_resolved = true;
-                        }
-                      ];
-                    }) matrixRoomReceivers;
-                  };
-                };
-
-                scrapeConfigs = lib.mapAttrsToList (machineName: machineVal: {
-                  tls_config.insecure_skip_verify = true;
-                  job_name = "${machineName}";
-                  static_configs = lib.mapAttrsToList (
-                    exporterName: exporterVal:
-                    let
-                      targetPort =
-                        if exporterVal ? port then
-                          exporterVal.port
-                        else
-                          config.services.prometheus.exporters."${exporterName}".port;
-                      targetHost = getYggdrasilIP machineName;
-                    in
-                    {
-                      targets = [ "[${targetHost}]:${lib.toString targetPort}" ];
-                    }
-                  ) machineVal.settings.exporters;
-                }) roles.nodes.machines;
-
-                rules = [
-                  (builtins.toJSON {
-                    groups = [
-                      {
-                        name = "default";
-                        rules = [
-                          {
-                            alert = "NodesDown";
-                            expr = "count by (job) (up == 0) > 0";
-                            for = "1m";
-                            labels = {
-                              severity = "critical";
-                            };
-                            annotations.summary = "Node **{{ $labels.job }}** has been down for more than 1 minutes.";
-                          }
-                          {
-                            alert = "SmartCtlErrors";
-                            expr = "smartctl_device_error_log_count > 0";
-                            for = "5m";
-                            labels = {
-                              severity = "critical";
-                            };
-                            annotations.summary = ''
-                              Errors occur on **{{ $labels.job }}**
-                              Disk {{ $labels.device }} {{ $value }}
-                            '';
-                          }
-                          {
-                            alert = "ZFSPoolsHealth";
-                            expr = "zfs_pool_health > 0";
-                            for = "5m";
-                            labels = {
-                              severity = "critical";
-                            };
-                            annotations.summary = ''
-                              Unhealthy Pool at **{{ $labels.job }}**
-                              Pool {{ $labels.pool }} value {{ $value }}
-                            '';
-                          }
-                        ]
-                        ++ settings.extra_rules;
-                      }
-                    ];
-                  })
-                ];
-
-              };
-
-            }
-            (lib.optionalAttrs settings.matrix-alertmanager.enable {
-
-              clan.core.vars.generators.prometheus = {
-                files.matrix-alertmanager-token.secret = true;
-                files.matrix-alertmanager-secret.secret = true;
-                files.matrix-alertmanager-urlfile = {
-                  secret = true;
-                  owner = "alertmanager";
-                  group = "alertmanager";
-                };
-                script = ''
-                  echo "" > $out/matrix-alertmanager-token
-                  openssl rand -hex 32 > "$out"/matrix-alertmanager-secret
-
-                  echo "http://localhost:3000/alerts?secret=$(cat $out/matrix-alertmanager-secret)" > $out/matrix-alertmanager-urlfile
-                '';
-                runtimeInputs = [
-                  pkgs.openssl
-                ];
-              };
-
-              services.matrix-alertmanager = lib.mkIf settings.matrix-alertmanager.enable {
-                enable = true;
-                tokenFile = config.clan.core.vars.generators.prometheus.files.matrix-alertmanager-token.path;
-                secretFile = config.clan.core.vars.generators.prometheus.files.matrix-alertmanager-secret.path;
-                homeserverUrl = settings.matrix-alertmanager.homeserverUrl;
-                matrixUser = settings.matrix-alertmanager.matrixUser;
-                matrixRooms = settings.matrix-alertmanager.matrixRooms;
-              };
-            })
-          ];
-      };
-  };
-
-  roles.nodes = {
-    description = "A node will expose metrics for server to harvest";
-
-    interface =
-      { lib, ... }:
-      {
-        options = {
-          exporters = lib.mkOption {
-            type = lib.types.attrsOf (lib.types.submodule { });
-            default = { };
-            description = "Mirror of services.prometheus.exporters";
-          };
-        };
-      };
-
-    perInstance =
-      { settings, ... }:
-      let
-        enabledExporters = builtins.mapAttrs (
-          name: value:
-          value
-          // {
-            enable = true;
-            openFirewall = true;
-          }
-        ) settings.exporters;
-      in
-      {
-        nixosModule =
-          { ... }:
-          {
-            services.prometheus.exporters = enabledExporters;
-          };
-      };
-  };
-
-}

modules/clan/prometheus/flake-module.nix

@@ -1,19 +0,0 @@
-{ self, inputs, ... }:
-let
-  module = ./default.nix;
-in
-{
-  clan.modules = {
-    prometheus = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-prometheus = {
-        imports = [ ./tests/vm/default.nix ];
-        _module.args = { inherit self inputs; };
-
-        clan.modules."@clan/prometheus" = module;
-      };
-    };
-}

modules/clan/prometheus/tests/vm/default.nix

@@ -1,101 +0,0 @@
-{
-  self,
-  hostPkgs,
-  config,
-  lib,
-  ...
-}:
-{
-  name = "service-prometheus";
-  result.update-vars =
-    let
-      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
-    in
-    hostPkgs.writeShellScriptBin "update-vars" ''
-      set -x
-      export PRJ_ROOT=$(git rev-parse --show-toplevel)
-      ${
-        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
-      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
-    '';
-
-  clan = {
-    test.useContainers = false;
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-      machines.nodeA = { };
-
-      instances = {
-        yggdrasil = {
-          module.name = "yggdrasil";
-          roles.default.machines.server = { };
-          roles.default.machines.nodeA = { };
-        };
-
-        prometheus = {
-          module.name = "@clan/prometheus";
-          module.input = "self";
-          roles.nodes.machines."nodeA".settings = {
-            exporters.smartctl = { };
-          };
-          roles.server.machines."server".settings = {
-            extra_rules = [
-              {
-                alert = "test";
-                expr = "zfs_pool_health > 0";
-                for = "5m";
-                labels = {
-                  severity = "critical";
-                };
-                annotations.summary = ''
-                  Unhealthy Pool at {{ $labels.job }}
-                  Pool {{ $labels.pool }} value {{ $value }}
-                '';
-              }
-            ];
-
-            matrix-alertmanager = {
-              enable = true;
-              matrixUser = "test@matrixtest.org";
-              matrixRooms = [
-                {
-                  roomId = "!testroom";
-                  receivers = [ "matrix" ];
-                }
-              ];
-            };
-
-          };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = { };
-    nodeA = { };
-  };
-
-  testScript =
-    { nodes, ... }:
-    ''
-      start_all()
-
-      server.wait_for_unit("prometheus.service")
-
-      nodeA.wait_for_unit("prometheus-smartctl-exporter.service")
-      nodeA.wait_for_open_port(9633)
-
-      nodeA.succeed("systemctl status prometheus-smartctl-exporter.service")
-      nodeA.succeed("curl http://localhost:9633/metrics")
-
-
-      server_ip = server.succeed("ip -4 addr show eth1 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'").strip()
-      nodeA_ip = nodeA.succeed("ip -4 addr show eth1 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'").strip()
-
-      server.succeed(f"ping -c 3 {nodeA_ip}")
-      server.succeed(f"curl -v http://{nodeA_ip}:9633/metrics")
-
-    '';
-}

modules/clan/prometheus/tests/vm/sops/machines/nodeA/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1kxsp8pa8am6k333nxs4akjqkhht8gspznmlqz4pxn35h5dj4uv5qj6q6fl",
-    "type": "age"
-  }
-]

modules/clan/prometheus/tests/vm/sops/machines/server/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1dkrf438z3337d2qnc7ugkggua99xkh55wuf9zgun35fjrxdpnf5qkg4z6j",
-    "type": "age"
-  }
-]

modules/clan/prometheus/tests/vm/sops/secrets/nodeA-age.key/secret

@@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:Z8I3ecNV2N2jed1sPBU+tI5r5qB2nVTO7aNyMxvp0ztujn8kXjw+thSvLGtRygL2V9rSmPJalHQf1IYUriXgCmYtfg5InPDCAqk=,iv:O4rSyg2G6PJWHURZ/BTBKmn1AVekbNBdg5137sOPL/U=,tag:4/CLfO50laZ8ljWkr6o4qA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSWxnekYvREdZMTBMVlRq\nRmtCemFYZDhLYU93azc5czdoTVUydFFUL1JzCmo4ZHlrNi8yeW15N2JxTytWeCtk\nbjRwWUVlazUwTlMwc1RZVU8xYlVlckEKLS0tIFVPeU5KMVFwdExFT0wzeXZka2Jo\nSmxEM2RPTWdoZXJxK0dpemUzVkNzdGcKfXdiSeAcNwEZi7kh9c89ss5K+dYG0lhq\nFsf2I0A1csxqqnYJqXPmwlVGMzuWDrWRU0uc+hQLndP3TbadVux64w==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-06-11T07:43:55Z",
-		"mac": "ENC[AES256_GCM,data:OCPR2tkbN72MdaczO47UNCJBb1KjABHQH9q7dtVEwoAhKg4QWFtsDaMwBTVE9qe48nlaWQbxT1mM7uztm6RXLkc5y2c3danPUYFj/FK/ffqpaxv3oReyxWqMoGayT23kFbB0TWEx1K8Jp3gOkwCPg+ZRClvhV1dXrfnwIwZHrBY=,iv:3puPIWFIxRF1KtrmyG54LqCc7Zg4/AOMD65QjYdN970=,tag:RoIVltMKw7WUvgW6sNk6mA==,type:str]",
-		"version": "3.13.0"
-	}
-}

modules/clan/prometheus/tests/vm/sops/secrets/nodeA-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin

modules/clan/prometheus/tests/vm/sops/secrets/server-age.key/secret

@@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:Nuq6ege3HJOxpRgA6fnxdD2Wj+KCw+3PaJCxmZirJl3mkRVLnZgUUhr+gOVEup9Ifjl1ZnP+PqV7b9pPR/WQg0LARYtxIC1QGJ8=,iv:v9p9lsefP5V9McAJCzS7v9sl8XHr9/hAL41XwFbwMOA=,tag:ETK+CFFJAAzGTpowQNAZMQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArN0NEWFZoZWlyeUtZc3hi\ndnVNcHl4eVVHckRLeFhPYUt4a3BwMElFMVZZCklkU1NEWVVmSGw1NmJmWWkrVHFH\nVTN5U0x3NXdiQUJCc095TElzMWZCMXMKLS0tIHRXQkJNREFYUFFvMXM1Sk53VW5z\naTRjMXozZXZiNU8zSkF5d2hhdklBY1EKWwsPi6YiHKFfAyqWH2u75hw47gzcQOz/\n95Im0FgadhqGDCeZhTDfEAc4b1VWQULInsjeRapzf5OJOwekbz6guA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-06-11T07:45:26Z",
-		"mac": "ENC[AES256_GCM,data:mTKFSBFnUzu3rldQCHPZHoyzDdwPzBWPIAhemC1XyG5PiQ/OczStjYaLzZQGCpPvOjBb5Ntqrc+dnaOedZgKlOdaPjZs1U2ZDWadoeWQ2TAKWYA6+kN7PXomsxtHhntiaujMy3502eh06VyiutpVuCdzK2cfEwuno8nyIcHgtXk=,iv:/5DRvFVDQA+yd8m/+Cyxb+aIsfwoaFcV6KRQ/7ISHnU=,tag:z31P6CL0NNRlQThqwapVNA==,type:str]",
-		"version": "3.13.0"
-	}
-}

modules/clan/prometheus/tests/vm/sops/secrets/server-age.key/users/admin

@@ -1 +0,0 @@
-../../../users/admin

modules/clan/prometheus/tests/vm/sops/users/admin/key.json

@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}

modules/clan/prometheus/tests/vm/vars/per-machine/nodeA/state-version/version/value

@@ -1 +0,0 @@
-26.05

modules/clan/prometheus/tests/vm/vars/per-machine/nodeA/yggdrasil/address/value

@@ -1 +0,0 @@
-204:b10b:6057:4bbe:2b44:fc58:c6fd:90ad

modules/clan/prometheus/tests/vm/vars/per-machine/nodeA/yggdrasil/privateKey/machines/nodeA

@@ -1 +0,0 @@
-../../../../../../sops/machines/nodeA

modules/clan/prometheus/tests/vm/vars/per-machine/nodeA/yggdrasil/privateKey/secret

@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:JkuciSmL5nmSjcYn22W7iHKzuRxWMJ5dixYllm0aSM7DsyAp9mQzIYJJmalepp7sEhSJ5As3vQW6ZpOQ3G8ZheG06++1GlM8lvVV2FKmYvKHQpI+V7WyUJl7dpfu+5A6BzWES0GbC1g8l/a8sb/+jjEoqUTAj/4=,iv:tehdHsdm2uSRAAzImHhwBSnSBF6lzjLzF9HIPnoi9s0=,tag:dWnQhAiJeCkcssjko+dUpw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOVmRSR2xDNmdPYW5MNUVH\nYWVpaTc0TjdOZFBTSEJDL1Z3VG9vVHkrZUFjCklUMUU1bnVmZFJYbzVPd09oZm1U\nNHY0R1hNQnBBc2V4Y2RWQ1ZZRjdOK0kKLS0tIEJkSWFaTDJzMDNJR3QwQzRVdld4\ndDA5ZmZSeTYyVUE5Y1Z1T1l5QmpHRTQKSaN+MIazA8RXhRSyFSkDTyXEp43COpbf\nXOzAhTXja+ut/akUuKadDS4xycZ+ZXAreVmdsF4SWvwZkmPeew+hKQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1kxsp8pa8am6k333nxs4akjqkhht8gspznmlqz4pxn35h5dj4uv5qj6q6fl"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMNmZkTHlaRWl1V3UvcGxk\nR0hhL1lNekNzb0REaEc4bitBZkcwYmRDb2hjCnloQTZUL3ZneWZQZk9NTEc1bGNB\nY3ljdFRMMUhLeDdyblhVY3lSOFBXc1UKLS0tIEJUc1ZpQmtuNlRUUEVmajY5TGdP\ncSs2RkZXcnJYRlEvcEtYSWxIWmkrVEkKgQnfxuZuxl1OpZDUPVuqseSN89WnBGFw\nx2PI3cqN67R2tV/FEjOZo+GFgxW93SYdMvxzg2aG2q/7xOQxfj9sjg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-06-11T07:44:25Z",
-		"mac": "ENC[AES256_GCM,data:gRk1t7xFxXSTUcZQw0DCH3QtRnQJF4Mc4kZeeckhuQdc/VATj+cq+ugicrcGJWbbXzAscQLG6g72+Qiane5nFfzmjNoO6JMe181wm7pY/5St+2MjXZEzwAaYjn6ZAm+U7aiUVcp8RBjFIL9HCvBF8qFl7rqqTvYHnTOU0V6TIIo=,iv:eUvZFDKl8PX5QaQPmwJXaokawQMNP0TGOklTAMgB/sg=,tag:3cHICox8bKWkPKMUgvLuXA==,type:str]",
-		"version": "3.13.0"
-	}
-}

modules/clan/prometheus/tests/vm/vars/per-machine/nodeA/yggdrasil/privateKey/users/admin

@@ -1 +0,0 @@
-../../../../../../sops/users/admin

modules/clan/prometheus/tests/vm/vars/per-machine/nodeA/yggdrasil/publicKey/value

@@ -1 +0,0 @@
-0a77a4fd45a20ea5d81d39c8137a97dd4988c692ce4263959559b8c3f966c1de

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-secret/machines/server

@@ -1 +0,0 @@
-../../../../../../sops/machines/server

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-secret/secret

@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:VszBHfdaNOOYYa6tNUPq9CsJHp+KMBTnZOdHnJz6v3pZQl1zCeYdW3ExvDfNY85tUAZ3YAHthD9JhuR1D+VVVn8=,iv:zbMmaTDZ5mL9IzRTEzuTSPkfwrwOlOIFJtLQyTzGkPw=,tag:Ez68y6gMIj0e/RYQ/Z+s8Q==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlenlYOCt2RkJOK1hDdUti\ncUpxS1F1RTBnZGo1Njg0Y0EwbzM1dWM5b1hJClFKQ1NDRVVpRXRpOGx3SU52MDZZ\nVVh2NDg5TDgzckFKZ0lNaG1tTEk0MmsKLS0tIHRvR0IzWFZUVkJEM0dwRFZ2SFRz\nNHpCYkI4dUx6YXJSd0xreUN1aUtKNEUK/SJqs5pbFipbp9P7ASUMby7H5ProXknF\nGMvHcIxa6OLLOCRA39YZBVEUlRd03j3rVFILZqVq47CwfaeHj0WBdw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1dkrf438z3337d2qnc7ugkggua99xkh55wuf9zgun35fjrxdpnf5qkg4z6j"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4cWMzaElhYmZaRGhmMXJQ\nbWk2WVl0UmtidjdzYXM0enB3MGdTMWRMVDBjCmdiNEx2RURGL0ZtWCtkcHlabUs0\nVis2d3JieC8yOXV5OW9sN1l5ZWs5Sk0KLS0tIFNmaVpDQklaUDFQK1JnZWZzMDF6\nY0g1M2NHNTEvSkRsTVJSODcxcVVrV0EK8FLzflXqPcooAPh38L7oVliUY8WbB97W\naQYvGf/yo9Izmm8Pa0/ZUGSRnCVRAXtQ1IeR1uPNyuy47mHXO7n7Bw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-06-22T07:46:31Z",
-		"mac": "ENC[AES256_GCM,data:ewR8kGgrAj7i6b5UUwh4Fn4CbtRcsDSHhHzrBwGBi9S0XWaatVTQAAmsAVm7DEiJ+a3SQLIAyx6Ef7uqCsZagmzs7LBq0YXNxWtxv62EWPwx8Vihzz3gscDJo1DM3ictX7yi6EiipQ0aYoPCh1veqw8AspLdwnkBxdUF2C+0muc=,iv:bo7vq8BfL437ZI63Os96pAg8EKi8NnrqhABz4Jft9YI=,tag:8krOKra/Z3MJdlmZFBZ7YQ==,type:str]",
-		"version": "3.13.1"
-	}
-}

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-secret/users/admin

@@ -1 +0,0 @@
-../../../../../../sops/users/admin

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-token/machines/server

@@ -1 +0,0 @@
-../../../../../../sops/machines/server

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-token/secret

@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:Mw==,iv:ylmBzsJVBD2pcQNkLcdthT9FX7YW84yZk0u7SlJUdaY=,tag:O1oT/MVijlrQDQG1ddFKlg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRd2ZIMElrK2ZacXFTTHFl\nWDkwbGROS1d3WlhzcHhQK21Fc1pmWFZ1VkJRCjlrY1E0cndsZUR1dVQ2L0dud3RQ\nbDlNa3NQZjBPQTAxdUVkUk9lYkgyTGcKLS0tIEUyMVE5Y25BOFJyUWdkdWI1L3VQ\nSE5ubkMvWU9YbE94VTN2VXFUc2F0ajQKKz5VJEtEQcKggoO89ZSfpB3KLBHCnMf+\no8llbCm5bZ39S3qA2Q8spOK4AlkW/NiaCQE4G1LSkvvT6tYEMkwbyQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1dkrf438z3337d2qnc7ugkggua99xkh55wuf9zgun35fjrxdpnf5qkg4z6j"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnNHhVMWNhZGR6LzgrcG05\nMmVUYU1zcC93YklZUkVETFhZL1BISU13MEFNCjFSZ25EQUQrZTNIcmliTG5UV2xp\nKzQ3MzhkdzcxeGgyV3oxbXo5Y0ZMcmMKLS0tIDVMZjdYWjRkUE50dmE5dm42alpn\nbk1JN1poZWp2bEZNQ3VIdm9PS3Z1ZlEKYOTa7L9tVKq3gZbAeKmCifIxs/sqaPoj\nqdUlsPkwBPjSvlv1QLdRbjBICPdyfH+GiHCmj78DitzZ+KUnRKYqSQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-06-22T07:46:31Z",
-		"mac": "ENC[AES256_GCM,data:NqKlCAKKPF0OTesGozt0GSSd/HT8+h4meiO57EBzD7vwLc9mobG0rLn5C2i3e7tBM13VYzR66qPzQtaWI/jVA7BpJ0PNa2u9MHA2JV6nshRdhMtYgxVCBy8Had7IixAZEs1lLE2zHcWRvLMJPOvUp7tpghb34RddmF/Po/Mkm2s=,iv:9XCsu+rO/DbtaLt13O0/PUo/yV2eUjNP+GGmkYjOIfY=,tag:7tzJE5XBR5PfOqdIh7IKAQ==,type:str]",
-		"version": "3.13.1"
-	}
-}

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-token/users/admin

@@ -1 +0,0 @@
-../../../../../../sops/users/admin

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-urlfile/machines/server

@@ -1 +0,0 @@
-../../../../../../sops/machines/server

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-urlfile/secret

@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:LetAgJg1TgcJL+W7dX8k8MlvpS3PPwVGdco3Z6a8fGhGeQARcuHWV57K4lLQzPpJ7Cruxc6XGQn1U/t3cubdp2NPtwQsP9jaIqPnlZblrq6foHaUmBLaRzc4ed7HOo94ErfV5ZY=,iv:jdt3jMNlK3QvJP8i3OlGydkRPRd2rVybnmUxCDCxfz4=,tag:imNVcalMwnpuaLCdaoaegg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4WU9IT3g4TVpiSWdYMUFo\nZGpSUG5xekZLaGMzNTZlcHFaSm1kbTBxUHhjClRIMzlhWW9ub2JFZHhVY3I3TkF3\nU0t5eHJVeFVHRStoNTFkT0lpYnNoMFkKLS0tIEM3aWdIL2RrSGx0ZkdheVRtYUhm\nUHZxeGZvUlBybWJFTHIrZDNxZVloemMKvpt+hkFaRUEXNp1dcfnIWD1i6fyVkaZm\neTn6RBxl1idVN1XlXAwrHHTekuZIobST5kGTV0uR3nLk5Cmhe2x93g==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1dkrf438z3337d2qnc7ugkggua99xkh55wuf9zgun35fjrxdpnf5qkg4z6j"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTDlTM0JBaEowaXJOV1hE\nZWZ2UmUzQmlyek5NRWlqWDZiY0FXVHpKL1d3CitreGc3OUFzS0tYYm5UZ0tUb2pX\nb0pZZ3VacVBma09pSDEyalc0VU1HTVUKLS0tIE5YcnY2RnFCVk13dDZJQ3NMZDQ4\nTGgrY3FwMW5ybjM0a0FmNllrRWZYNWMK2BklSFSm1jT1SsdaMtFWZX4uu4JT2kGi\njyD9E/G0yGl5JH8xfKO/x7vIPuow96WW8bx9aqGRnshXqbe6WzvbIQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-06-22T07:46:31Z",
-		"mac": "ENC[AES256_GCM,data:bO9VvnIcjXDSyTdEHm1l5Dqm4umLC7FCEaJIbuC+M776q+GR3crq1FWm7J6tinlHDNFX/WmcS417b5WY5VJlP3jqvCalQdttg0EzlhwT65vATvJHoYEp8uqahyLzA9tj9ncQ9LL2XGFeIsvWnU9OcZ5s/42v2DtVdS1/32PT+7U=,iv:W29qp/zHP367rkwiMmpPQcKS/5g6HR5CZGkGCIacwD4=,tag:3DHc5kdj1Ar+7TcaSOnj+Q==,type:str]",
-		"version": "3.13.1"
-	}
-}

modules/clan/prometheus/tests/vm/vars/per-machine/server/prometheus/matrix-alertmanager-urlfile/users/admin

@@ -1 +0,0 @@
-../../../../../../sops/users/admin

modules/clan/prometheus/tests/vm/vars/per-machine/server/state-version/version/value

@@ -1 +0,0 @@
-26.05

modules/clan/prometheus/tests/vm/vars/per-machine/server/yggdrasil/address/value

@@ -1 +0,0 @@
-202:8a70:e215:f822:c67a:f191:b04a:a8f

modules/clan/prometheus/tests/vm/vars/per-machine/server/yggdrasil/privateKey/machines/server

@@ -1 +0,0 @@
-../../../../../../sops/machines/server

modules/clan/prometheus/tests/vm/vars/per-machine/server/yggdrasil/privateKey/secret

@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:JcxiDqZDX3J3ooSeN0pQ28uvI86mtHUf2BEcOQdFIDhJZODGCc+BhZvBQmu2mabV8Jf4skrTWqD+60c1fkRcsM+MMXfoyNsrRyQ2K39mG4kl8jJKVKDs+BqXa+CvZ96kesOMgi9vdc3YUKo5cCLY4bQ9VwymqH8=,iv:W3z8Pbyo2IMzkxI4k14FlirLa28qgZ3rnTAWuusiw/0=,tag:EQc8mo/UvACbt8hQv3zPEw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRDNOSU81alN2THNQQ3ZW\nbHVjMmxaYWpzak1NZHplNTVzZzQvMHg4azAwCkExb0VLYlZUd2JjVGNlcXUyR0p1\nWHk5cXpOeGZ0VFRFTGllQWpxRlBTRk0KLS0tIDhKeUc4RHQvb0o0ZXFXZUNCanVY\nYm04TVBoWjlLT0tFOHRnLzd3RHV2ZzAKVpLtENDySGC6UDgAwhDb+7KJiHXOZF6n\nIaeIQWQqiB+45h72NE3yh02boPK8pl6IoJFcK3e4zSO7/G8jGUp0MQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1dkrf438z3337d2qnc7ugkggua99xkh55wuf9zgun35fjrxdpnf5qkg4z6j"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGSUZXVzJwVHdwZGtxOVRu\nN1hMZkltdVM0cnNRL2tSNENkSGV2VzFIU1VBCmRZWlJTODNPMVRjVWY1V1VZcFln\nTDE3N0xsMXdMWityRUNUYWlQOXBMMTgKLS0tIGViTzBrQk5wQXBYQitIb1ZPUitC\nLysyUER0UjFlZm95c3ZGK3hEMEtrNUEKABpoKBUnvzQKSrgsdnU+uyDyED0Tlr7D\nnSsf12c84cvdt0OeCWwf2WvBANZL26XTcFq1fBYOFTJqNLs1ZfO2kg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
-			}
-		],
-		"lastmodified": "2026-06-11T07:45:55Z",
-		"mac": "ENC[AES256_GCM,data:jjhkZB9NdpvV2R0k9yS/AcUqeMr1RLv1UZwGCemlKSwhBfs8E5NxTXLhtmJeQ+hltOTYpz51BIporVtlaH6ElVnh7khOrG3Lb5cLBrL41QM59y3Tbfu6TjNOE3NyMiWuxZnwuqUGWQjsjrIIhE0ftKnpSpkGHMie+BC3iNSB1tY=,iv:onOVK9eJxWOaIjChQD54tz8lY+r/jpp6AArsBIuoRUM=,tag:2Oas1C5D2kZOe4iiD5huyw==,type:str]",
-		"version": "3.13.0"
-	}
-}

modules/clan/prometheus/tests/vm/vars/per-machine/server/yggdrasil/privateKey/users/admin

@@ -1 +0,0 @@
-../../../../../../sops/users/admin

modules/clan/prometheus/tests/vm/vars/per-machine/server/yggdrasil/publicKey/value

@@ -1 +0,0 @@
-2eb1e3bd40fba730a1cdc9f6beae1848e4b965e37f18a61593327964108fe6a8

modules/clan/wordpress/default.nix

@@ -1,174 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "wordpress";
-  manifest.description = "wordpress with multi-tenant support and state of plugins and themes are allowed";
-  manifest.readme = "wordpress with multi-tenant support and state of plugins and themes are allowed";
-  manifest.categories = [ "System" ];
-
-  roles.server = {
-    description = "A default server role";
-    interface =
-      { lib, ... }:
-      {
-        options = {
-          tenants = lib.mkOption {
-            type = with lib.types; listOf str;
-            default = [ "localhost" ];
-            description = "List of tenants website to host on the instance";
-            example = [ "example.com" ];
-          };
-          phpfpmOptions = lib.mkOption {
-            type = with lib.types; lines;
-            default = "";
-            description = "options appended to the PHP configuration file";
-          };
-          wpExtraConfig = lib.mkOption {
-            type = with lib.types; lines;
-            default = "";
-            description = "Any additional text to be appended to the wp-config.php";
-          };
-        };
-      };
-
-    perInstance =
-      { settings, ... }:
-      {
-        nixosModule =
-          {
-            pkgs,
-            lib,
-            config,
-            ...
-          }:
-          let
-            user = "wordpress";
-
-            mkSafeDBName = domain: "wp_${builtins.replaceStrings [ "." ] [ "_" ] domain}";
-
-            mkWordpressSite = domain: {
-              database = {
-                name = mkSafeDBName domain;
-                user = user;
-              };
-              package = wp-pkg domain;
-              extraConfig = ''
-                define('FS_METHOD', 'direct');
-              ''
-              + settings.wpExtraConfig;
-              themes = { };
-            };
-
-            stateDir = hostName: "/var/lib/wordpress/${hostName}";
-
-            wp-pkg =
-              hostName:
-              let
-                upStreamSrc = pkgs.wordpress;
-              in
-              pkgs.stdenv.mkDerivation {
-                pname = "wordpress-custom";
-                version = upStreamSrc.version;
-                src = upStreamSrc;
-
-                installPhase = ''
-                  mkdir -p $out
-                  cp -r * $out/
-
-                  rm -rf $out/share/wordpress/wp-content/plugins
-                  rm -rf $out/share/wordpress/wp-content/themes
-
-                  # symlink uploads directory
-                  ln -s "${stateDir hostName}"/wp-content/themes $out/share/wordpress/wp-content/themes
-                  ln -s "${stateDir hostName}"/wp-content/plugins $out/share/wordpress/wp-content/plugins
-                  ln -s "${stateDir hostName}"/wp-content/upgrade $out/share/wordpress/wp-content/upgrade
-                  ln -s "${stateDir hostName}"/wp-content/upgrade-temp-backup $out/share/wordpress/wp-content/upgrade-temp-backup
-                  ln -s "${stateDir hostName}"/wp-content/ai1wm-backups $out/share/wordpress/wp-content/ai1wm-backups
-
-                '';
-              };
-            webserver = config.services.${config.services.wordpress.webserver};
-          in
-          {
-            services.wordpress.webserver = "nginx";
-
-            services.wordpress.sites = builtins.listToAttrs (
-              map (tenant: {
-                name = tenant;
-                value = mkWordpressSite tenant;
-
-              }) settings.tenants
-            );
-
-            systemd.tmpfiles.rules = lib.flatten (
-              map (tenant: [
-                "d '${stateDir tenant}/wp-content' 0750 ${user} ${webserver.group} - -"
-                "d '${stateDir tenant}/wp-content/themes' 0750 ${user} ${webserver.group} - -"
-                "Z '${stateDir tenant}/wp-content/themes' 0750 ${user} ${webserver.group} - -"
-                "d '${stateDir tenant}/wp-content/plugins' 0750 ${user} ${webserver.group} - -"
-                "Z '${stateDir tenant}/wp-content/plugins' 0750 ${user} ${webserver.group} - -"
-                "d '${stateDir tenant}/wp-content/upgrade' 0750 ${user} ${webserver.group} - -"
-                "Z '${stateDir tenant}/wp-content/upgrade' 0750 ${user} ${webserver.group} - -"
-                "d '${stateDir tenant}/wp-content/upgrade-temp-backup' 0750 ${user} ${webserver.group} - -"
-                "Z '${stateDir tenant}/wp-content/upgrade-temp-backup' 0750 ${user} ${webserver.group} - -"
-                "d '${stateDir tenant}/wp-content/ai1wm-backups' 0750 ${user} ${webserver.group} - -"
-                "Z '${stateDir tenant}/wp-content/ai1wm-backups' 0750 ${user} ${webserver.group} - -"
-              ]) settings.tenants
-            );
-
-            networking.firewall.allowedTCPPorts = [
-              80
-              443
-            ];
-
-            services.phpfpm.pools = builtins.listToAttrs (
-              map (
-                tenant: lib.nameValuePair "wordpress-${tenant}" { phpOptions = settings.phpfpmOptions; }
-              ) settings.tenants
-            );
-
-            security.acme.acceptTerms = true;
-
-            users.users.nginx.extraGroups = [ "acme" ];
-
-            security.acme.certs = lib.listToAttrs (
-              map (
-                tenant:
-                (lib.nameValuePair tenant {
-                  email = config.clan.core.vars.generators.acme.files.email.value;
-                  webroot = "/var/lib/acme/acme-challenge/${tenant}";
-                })
-              ) settings.tenants
-            );
-
-            services.nginx.clientMaxBodySize = "128m";
-
-            services.nginx.virtualHosts = lib.listToAttrs (
-              map (
-                tenant:
-                (lib.nameValuePair tenant {
-                  forceSSL = true;
-                  useACMEHost = tenant;
-                  acmeRoot = config.security.acme.certs.${tenant}.webroot;
-                })
-              ) settings.tenants
-            );
-
-            clan.core.vars.generators.acme = {
-              share = true;
-              files.email.secret = false;
-
-              prompts.email = {
-                type = "line";
-                description = "Email for ACME registeration";
-              };
-
-              script = ''
-                cat $prompts/email > $out/email
-              '';
-            };
-
-          };
-      };
-  };
-}

modules/clan/wordpress/flake-module.nix

@@ -1,19 +0,0 @@
-{ self, inputs, ... }:
-let
-  module = ./default.nix;
-in
-{
-  clan.modules = {
-    wordpress = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-wordpress = {
-        imports = [ ./tests/vm/default.nix ];
-        _module.args = { inherit self inputs; };
-
-        clan.modules."@clan/wordpress" = module;
-      };
-    };
-}

modules/clan/wordpress/tests/vm/default.nix

@@ -1,59 +0,0 @@
-{
-  self,
-  config,
-  lib,
-  hostPkgs,
-  ...
-}:
-{
-  name = "service-wordpress";
-  result.update-vars =
-    let
-      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
-    in
-    hostPkgs.writeShellScriptBin "update-vars" ''
-      set -x
-      export PRJ_ROOT=$(git rev-parse --show-toplevel)
-      ${
-        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
-      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
-    '';
-
-  clan = {
-    test.useContainers = false;
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        wordpress-test = {
-          module.name = "@clan/wordpress";
-          module.input = "self";
-          roles.server.machines."server".settings = {
-            tenants = [
-              "localhost"
-              "site2.localhost"
-            ];
-          };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = { };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("phpfpm-wordpress-localhost.service")
-    server.wait_for_unit("phpfpm-wordpress-site2.localhost.service")
-
-    server.succeed("systemctl status phpfpm-wordpress-localhost.service")
-    server.succeed("systemctl status phpfpm-wordpress-site2.localhost.service")
-    server.wait_for_open_port(80)
-    server.succeed("curl -H \"Host: localhost\" http://127.0.0.1:80 ")
-    server.succeed("curl -H \"Host: site2.localhost\" http://127.0.0.1:80 ")
-  '';
-}

modules/clan/wordpress/tests/vm/sops/users/admin/key.json

@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}

modules/clan/wordpress/tests/vm/vars/per-machine/server/state-version/version/value

@@ -1 +0,0 @@
-26.11

modules/clan/wordpress/tests/vm/vars/shared/acme/email/value

@@ -1 +0,0 @@
-fake_line_value

modules/nixos/default.nix

@@ -0,0 +1,5 @@
+{
+  flake.nixosModules = {
+    inventree = import ../nixos/inventree;
+  };
+}

modules/nixos/inventree/default.nix

@@ -0,0 +1,334 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    ;
+
+  configFormat = pkgs.formats.json { };
+  cfg = config.services.inventree;
+  pkg = cfg.package;
+  configFile = "${cfg.dataDir}/config.json";
+
+  env = {
+    INVENTREE_CONFIG_FILE = configFile;
+    INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+    INVENTREE_AUTO_UPDATE = "1";
+    INVENTREE_PLUGINS_ENABLED = "1";
+    INVENTREE_PLUGIN_NOINSTALL = "0";
+    INVENTREE_STATIC_ROOT = cfg.config.static_root;
+    INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+    INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+    INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+    INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+    INVENTREE_DB_NAME = cfg.config.database.NAME;
+    INVENTREE_DB_HOST = cfg.config.database.HOST;
+    INVENTREE_DB_USER = "inventree";
+    INVENTREE_ADMIN_USER = cfg.config.adminUser;
+    INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+    INVENTREE_USE_X_FORWARDED_HOST = "1";
+    INVENTREE_CORS_ORIGIN_ALLOW_ALL = "1";
+    INVENTREE_FRONTEND_SETTINGS = ''{"mobile_mode":"allow-always"}'';
+
+    INVENTREE_SITE_URL = cfg.config.site_url;
+
+    PYTHONPATH = pkg.pythonPath;
+  };
+
+  inventree-invoke = pkgs.writeShellApplication {
+    name = "inventree-invoke";
+    text = ''
+      export INVENTREE_CONFIG_FILE=${configFile}
+      export INVENTREE_SECRET_KEY_FILE=${cfg.secretKeyFile}
+      export PYTHONPATH=${pkg.pythonPath}
+
+      exec -a "$0" ${pkgs.python3Packages.invoke}/bin/invoke -r ${cfg.package}/opt/inventree "$@"
+    '';
+  };
+in
+{
+  options.services.inventree = {
+    enable = mkEnableOption "InvenTree parts manager";
+
+    package = lib.mkOption {
+      type = types.package;
+      default = pkgs.inventree;
+      description = ''
+        InvenTree package to use
+      '';
+    };
+
+    hostName = mkOption {
+      type = types.str;
+      description = "FQDN for the InvenTree instance.";
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/inventree";
+      example = "/var/lib/inventree";
+      description = ''
+        The default path for all inventree data.
+      '';
+    };
+
+    secretKeyFile = mkOption {
+      type = types.path;
+      default = "${cfg.dataDir}/secret_key.txt";
+      description = ''
+        Path to a file containing the secret key
+      '';
+    };
+
+    config = mkOption {
+      type = types.submodule ({
+        freeformType = configFormat.type;
+        options = {
+          adminUser = mkOption {
+            type = types.str;
+            default = "admin";
+          };
+          adminPasswordFile = mkOption {
+            type = types.path;
+            description = "Path to password file for user `admin`";
+          };
+          site_url = mkOption {
+            type = types.str;
+            default = "https://${cfg.hostName}";
+          };
+          static_root = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/static";
+            description = ''
+              Static file storage
+            '';
+          };
+          media_root = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/media_root";
+            description = "Media root directory";
+          };
+          backup_dir = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/backups";
+            description = "Backup directory";
+          };
+          oidc_private_key_file = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/oidc.key";
+          };
+        };
+      });
+      default = { };
+      description = ''
+        Config options, see https://docs.inventree.org/en/stable/start/config/
+        for details
+      '';
+    };
+
+    serverStartTimeout = mkOption {
+      type = types.str;
+      default = "10min";
+      description = ''
+        TimeoutStartSec for the server systemd service.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStartSec=
+        for more details
+      '';
+    };
+
+    serverStopTimeout = mkOption {
+      type = types.str;
+      default = "5min";
+      description = ''
+        TimeoutStopSec for the server systemd service.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStopSec=
+        for more details
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ inventree-invoke ];
+
+    systemd.tmpfiles.rules = (
+      map (dir: "d ${dir} 0755 inventree inventree") [
+        "${cfg.dataDir}"
+        "${cfg.dataDir}/static"
+        "${cfg.dataDir}/media_root"
+        "${cfg.dataDir}/backups"
+      ]
+    );
+
+    services.inventree.config = {
+      plugins_enabled = false;
+      plugin_file = "${cfg.dataDir}/plugins.txt";
+      plugin_dir = "${cfg.dataDir}/plugins";
+      database = {
+        ENGINE = "postgresql";
+        NAME = "inventree";
+        HOST = "/run/postgresql";
+      };
+    };
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "inventree" ];
+      ensureUsers = [
+        {
+          name = "inventree";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    users.users.inventree = {
+      group = "inventree";
+      isSystemUser = true;
+      description = "InvenTree daemon user";
+    };
+
+    users.groups.inventree = { };
+
+    services.nginx.enable = true;
+
+    services.nginx.virtualHosts.${cfg.hostName} = {
+      locations =
+        let
+          unixPath = config.systemd.sockets.inventree-gunicorn.socketConfig.ListenStream;
+        in
+        {
+          "/" = {
+            extraConfig = ''
+              client_max_body_size 100M;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            '';
+            proxyPass = "http://unix:${unixPath}";
+          };
+          "/static/" = {
+            alias = "${cfg.config.static_root}/";
+            extraConfig = ''
+              expires 30d;
+            '';
+          };
+          "/media/" = {
+            alias = "${cfg.config.media_root}/";
+            extraConfig = ''
+              auth_request /auth;
+            '';
+          };
+          "/auth" = {
+            extraConfig = ''
+              internal;
+            '';
+            proxyPass = "http://unix:${unixPath}:/auth/";
+          };
+        };
+    };
+
+    systemd.targets.inventree = {
+      description = "Target for all InvenTree services";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+    };
+
+    systemd.services.inventree-config = {
+      description = "Inventree config generation";
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      before = [
+        "inventree-static.service"
+        "inventree-gunicorn.service"
+        "inventree-qcluster.service"
+      ];
+      serviceConfig = {
+        # User = "root";
+        # Group = "root";
+        User = "inventree";
+        Group = "inventree";
+        Type = "oneshot";
+        RemainAfterExit = true;
+        PrivateTmp = true;
+      };
+      environment = env;
+      script = ''
+        set -euo pipefail
+
+        umask u=rwx,g=,o=
+
+        # chown inventree:inventree ${configFile}
+
+        ${pkg}/opt/inventree/src/backend/InvenTree/manage.py migrate
+      '';
+    };
+
+    systemd.services.inventree-static = {
+      description = "InvenTree static migration";
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      before = [ "inventree-gunicorn.service" ];
+      environment = env;
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg}/opt/inventree/src/backend/InvenTree/manage.py collectstatic  --no-input
+        '';
+      };
+    };
+
+    systemd.services.inventree-gunicorn = {
+      description = "InvenTree Gunicorn server";
+      requiredBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      #wantedBy = [ "inventree.target" ];
+      environment = env;
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg.gunicorn}/bin/gunicorn InvenTree.wsgi \
+            --pythonpath ${pkg}/opt/inventree/src/backend/InvenTree
+        '';
+      };
+    };
+
+    systemd.sockets.inventree-gunicorn = {
+      wantedBy = [ "sockets.target" ];
+      partOf = [ "inventree.target" ];
+      socketConfig.ListenStream = "/run/inventree/gunicorn.socket";
+    };
+
+    systemd.services.inventree-qcluster = {
+      description = "InvenTree qcluster server";
+      requiredBy = [ "inventree.target" ];
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      environment = env;
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg}/opt/inventree/src/backend/InvenTree/manage.py qcluster
+        '';
+      };
+    };
+  };
+}

modules/nixos/think-backend-gtcm.nix

@@ -173,10 +173,10 @@ in
       serviceConfig = {
         User = cfg.user;
         WorkingDirectory = "${file-uploader}";
-        ExecStart = "${lib.getExe pkgs.nodejs} ${file-uploader}/src/be/index.js";
+        ExecStart = "${lib.getExe pkgs.nodejs_20} ${file-uploader}/src/be/index.js";
         Restart = "on-failure";
       };
-      path = [ pkgs.nodejs ];
+      path = [ pkgs.nodejs_20 ];
     };
 
     environment.systemPackages = [

pkgs/gtcm-file-uploader.nix

@@ -17,7 +17,7 @@ buildNpmPackage {
   version = "1.0.0";
 
   nativeBuildInputs = with pkgs; [
-    nodejs
+    nodejs_20
     breakpointHook
   ];
 

pkgs/inventree/default.nix

@@ -0,0 +1,161 @@
+{
+  stdenvNoCC,
+  python3,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  nodejs,
+}:
+let
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "inventree";
+    repo = "InvenTree";
+    tag = "${version}";
+    hash = "sha256-GAATo5zkkNCes9fCQsYUsZ9auhgYEUnevN4obWj3ZRA=";
+  };
+
+  frontend = stdenvNoCC.mkDerivation {
+    name = "inventree-frontend";
+    inherit version src;
+
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${src}/src/frontend/yarn.lock";
+      hash = "sha256-Ijbkx+INZgsvMhkzo8h/FUY75W3UHnKAdUjQRD8kJZw=";
+    };
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      nodejs
+    ];
+
+    patchPhase = ''
+      runHook prePatch
+      cd src/frontend
+      runHook postPatch
+    '';
+
+    buildPhase = ''
+      echo "Running lingui"
+      ./node_modules/.bin/lingui compile --typescript
+      echo building lib
+      ./node_modules/.bin/tsc --p ./tsconfig.lib.json
+      ./node_modules/.bin/vite --config vite.lib.config.ts build
+      echo "Running tsc"
+      ./node_modules/.bin/tsc
+      echo "Running vite"
+      ./node_modules/.bin/vite build --emptyOutDir --outDir $out
+    '';
+  };
+
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "InvenTree";
+  inherit version src;
+
+  format = "other";
+
+  dependencies =
+    with python3.pkgs;
+    [
+      coreapi
+      cryptography
+      distutils
+      dj-rest-auth
+      django
+      django-allauth
+      django-allauth.optional-dependencies.openid
+      django-allauth.optional-dependencies.mfa
+      django-allauth.optional-dependencies.socialaccount
+      django-cleanup
+      django-cors-headers
+      django-dbbackup
+      django-error-report-2
+      django-filter
+      django-flags
+      django-formtools
+      django-ical
+      django-js-asset
+      django-maintenance-mode
+      django-markdownify
+      django-money
+      django-mptt
+      django-mailbox
+      django-anymail
+      django-redis
+      django-oauth-toolkit
+      django-otp
+      django-q-sentry
+      django-q2
+      django-redis
+      django-sesame
+      django-sql-utils
+      django-structlog
+      django-stdimage
+      django-taggit
+      django-user-sessions
+      django-weasyprint
+      djangorestframework
+      djangorestframework-simplejwt
+      djangorestframework-simplejwt.optional-dependencies.crypto
+      django-xforwardedfor-middleware
+      django-storages
+      drf-spectacular
+      dulwich
+      feedparser
+      gunicorn
+      pdf2image
+      pillow
+      pint
+      pip-licenses
+      pypdf
+      python-barcode
+      python-barcode.optional-dependencies.images
+      python-dotenv
+      pyyaml
+      qrcode
+      qrcode.optional-dependencies.pil
+      rapidfuzz
+      sentry-sdk
+      tablib
+      tablib.optional-dependencies.xls
+      tablib.optional-dependencies.xlsx
+      tablib.optional-dependencies.yaml
+      weasyprint
+      whitenoise
+
+      psycopg2
+      fido2
+
+      opentelemetry-api
+      opentelemetry-sdk
+      opentelemetry-exporter-otlp
+      opentelemetry-instrumentation-django
+      opentelemetry-instrumentation-requests
+      opentelemetry-instrumentation-redis
+      opentelemetry-instrumentation-sqlite3
+      opentelemetry-instrumentation-system-metrics
+      opentelemetry-instrumentation-wsgi
+    ]
+    ++ django-anymail.optional-dependencies.amazon-ses;
+
+  installPhase = ''
+    substituteInPlace src/backend/InvenTree/InvenTree/settings.py --replace-fail "django_slowtests.testrunner.DiscoverSlowestTestsRunner" "django.test.runner.DiscoverRunner"
+
+    mkdir -p $out/opt/inventree
+    cp -r . $out/opt/inventree
+
+    echo "Installing frontend"
+
+    mkdir -p $out/opt/inventree/src/backend/InvenTree/web/static/web
+    cp -r ${frontend}/* $out/opt/inventree/src/backend/InvenTree/web/static/web/
+    cp -r ${frontend}/.* $out/opt/inventree/src/backend/InvenTree/web/static/web/
+  '';
+
+  passthru = {
+    pythonPath = python3.pkgs.makePythonPath dependencies;
+    gunicorn = python3.pkgs.gunicorn;
+    inherit frontend;
+  };
+}

pkgs/overlay.nix

@@ -2,4 +2,28 @@ final: prev: {
   think-gtcm = final.callPackage ./think-gtcm.nix { };
   think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
   gtcm-file-uploader = final.callPackage ./gtcm-file-uploader.nix { };
+
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (py-final: py-prev: {
+      django-dbbackup = py-final.callPackage ./python/django-dbbackup { };
+      django-error-report-2 = py-final.callPackage ./python/django-error-report-2 { };
+      django-flags = py-final.callPackage ./python/django-flags { };
+      django-ical = py-final.callPackage ./python/django-ical { };
+      django-markdownify = py-final.callPackage ./python/django-markdownify { };
+      django-money = py-final.callPackage ./python/django-money { };
+      django-q-sentry = py-final.callPackage ./python/django-q-sentry { };
+      django-recurrence = py-final.callPackage ./python/django-recurrence { };
+      django-slowtests = py-final.callPackage ./python/django-slowtests { };
+      django-structlog = py-final.callPackage ./python/django-structlog { };
+      django-stdimage = py-final.callPackage ./python/django-stdimage { };
+      django-user-sessions = py-final.callPackage ./python/django-user-sessions { };
+      django-weasyprint = py-final.callPackage ./python/django-weasyprint { };
+      django-xforwardedfor-middleware = py-final.callPackage ./python/django-xforwardedfor-middleware { };
+      pip-licenses = py-final.callPackage ./python/pip-licenses { };
+      py-moneyed = py-final.callPackage ./python/py-moneyed { };
+      pytest-pycodestyle = py-final.callPackage ./python/pytest-codestyle { };
+      sentry-sdk = py-final.callPackage ./python/sentry-sdk { };
+    })
+  ];
+  inventree = final.callPackage ./inventree { python3 = final.python312; };
 }

pkgs/python/django-dbbackup/default.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+  pytz,
+}:
+
+buildPythonPackage rec {
+  pname = "django-dbbackup";
+  version = "4.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-dbbackup";
+    rev = version;
+    hash = "sha256-GD+f9mbImGPQ6MOUK3ftHqiGv7TT39jNQsFvd0dnnWU=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    django
+    pytz
+  ];
+
+  pythonImportsCheck = [ "dbbackup" ];
+
+  meta = {
+    description = "Management commands to help backup and restore your project database and media files";
+    homepage = "https://github.com/jazzband/django-dbbackup";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+    mainProgram = "django-dbbackup";
+  };
+}

pkgs/python/django-error-report-2/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-error-report-2";
+  version = "0.4.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "matmair";
+    repo = "django-error-report-2";
+    rev = version;
+    hash = "sha256-ZCaslqgruJxM8345/jSlZGruM+27H9hvwL0wtPkUzc0=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "error_report" ];
+
+  meta = {
+    description = "Log/View Django server errors";
+    homepage = "https://github.com/matmair/django-error-report-2";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-flags/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-flags";
+  version = "5.0.13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cfpb";
+    repo = "django-flags";
+    rev = version;
+    hash = "sha256-WPMfFYoP6WaVzZmVtqAz4LlY761aCRyPhd5npc8bOOI=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "flags" ];
+
+  meta = {
+    description = "Feature flags for Django projects";
+    homepage = "https://github.com/cfpb/django-flags";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-ical/default.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+  django-recurrence,
+  icalendar,
+}:
+
+buildPythonPackage rec {
+  pname = "django-ical";
+  version = "1.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-ical";
+    rev = version;
+    hash = "sha256-DUe0loayGcUS7MTyLn+g0KBxbIY7VsaoQNHGSMbMI3U=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    django
+    django-recurrence
+    icalendar
+  ];
+
+  pythonImportsCheck = [ "django_ical" ];
+
+  meta = {
+    description = "ICal feeds for Django based on Django's syndication feed framework";
+    homepage = "https://github.com/jazzband/django-ical";
+    changelog = "https://github.com/jazzband/django-ical/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-markdownify/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  bleach,
+  django,
+  markdown,
+}:
+
+buildPythonPackage rec {
+  pname = "django-markdownify";
+  version = "0.9.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "erwinmatijsen";
+    repo = "django-markdownify";
+    rev = version;
+    hash = "sha256-KYU8p8NRD4EIS/KhOk9nvmXCf0RWEc+IFZ57YtsDSWE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    bleach
+    django
+    markdown
+  ];
+
+  pythonImportsCheck = [ "markdownify" ];
+
+  meta = {
+    description = "Markdown template filter for Django";
+    homepage = "https://github.com/erwinmatijsen/django-markdownify";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-money/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+  py-moneyed,
+}:
+
+buildPythonPackage rec {
+  pname = "django-money";
+  version = "3.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "django-money";
+    repo = "django-money";
+    rev = version;
+    hash = "sha256-eL26NsreUqtMJ26TmvmB53EJI4Sjs7qjFDnnt4N0vdI=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    django
+    py-moneyed
+  ];
+
+  pythonImportsCheck = [ "djmoney" ];
+
+  meta = {
+    description = "Money fields for Django forms and models";
+    homepage = "https://github.com/django-money/django-money";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-q-sentry/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  setuptools,
+  sentry-sdk,
+}:
+
+buildPythonPackage rec {
+  pname = "django-q-sentry";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "danielwelch";
+    repo = "django-q-sentry";
+    rev = "d3a43a90c82734244d5ebf3295652223053f1354";
+    hash = "sha256-3C7A+X18c7p19HWD/uPRtAMf29VjmrfXXh2z5PPOREY=";
+  };
+
+  build-system = [
+    poetry-core
+    setuptools
+  ];
+
+  dependencies = [ sentry-sdk ];
+
+  pythonImportsCheck = [ "django_q_sentry" ];
+
+  meta = {
+    description = "Bringing Sentry error tracking to Django Q";
+    homepage = "https://github.com/danielwelch/django-q-sentry";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-recurrence/default.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pdm-backend,
+  django,
+  flake8,
+  pytest,
+  pytest-cov,
+  pytest-django,
+  pytest-sugar,
+  python-dateutil,
+  sphinx,
+  sphinx-rtd-theme,
+  tox,
+}:
+
+buildPythonPackage rec {
+  pname = "django-recurrence";
+  version = "1.12.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-recurrence";
+    rev = version;
+    hash = "sha256-Q33zyMa1wI13RNLxynGAJHlagahpnFHCmZbHp0aPC/w=";
+  };
+
+  build-system = [ pdm-backend ];
+
+  dependencies = [
+    django
+    flake8
+    pytest
+    pytest-cov
+    pytest-django
+    pytest-sugar
+    python-dateutil
+    sphinx
+    sphinx-rtd-theme
+    tox
+  ];
+
+  pythonRelaxDeps = true;
+
+  pythonImportsCheck = [ "recurrence" ];
+
+  meta = {
+    description = "Utility for working with recurring dates in Django";
+    homepage = "https://github.com/django-recurrence/django-recurrence";
+    changelog = "https://github.com/django-recurrence/django-recurrence/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-slowtests/default.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-slowtests";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "realpython";
+    repo = "django-slow-tests";
+    rev = version;
+    hash = "sha256-gW9AZiMpXJp1m2X1cbm6GdZ9cH+TFqjNLQJFmsvGjB0=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "django_slowtests" ];
+
+  meta = {
+    description = "Locate your slowest tests";
+    homepage = "https://github.com/realpython/django-slow-tests";
+    changelog = "https://github.com/realpython/django-slow-tests/blob/${src.rev}/CHANGELOG.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-stdimage/default.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+  pillow,
+  gettext,
+}:
+
+buildPythonPackage rec {
+  pname = "django-stdimage";
+  version = "6.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "codingjoe";
+    repo = "django-stdimage";
+    rev = version;
+    hash = "sha256-uwVU3Huc5fitAweShJjcMW//GBeIpJcxqKKLGo/EdIs=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    django
+    pillow
+  ];
+
+  nativeBuildInputs = [ gettext ];
+
+  preBuild = ''
+    echo "bla bla"
+    echo $PATH
+  '';
+
+  pythonImportsCheck = [ "stdimage" ];
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/codingjoe/django-stdimage";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-structlog/default.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  asgiref,
+  django,
+  django-ipware,
+  structlog,
+  celery,
+  django-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "django-structlog";
+  version = "9.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jrobichaud";
+    repo = "django-structlog";
+    rev = version;
+    hash = "sha256-SEigOdlXZtfLAgRgGkv/eDNDAiiHd7YthRJ/H6e1v5U=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    asgiref
+    django
+    django-ipware
+    structlog
+  ];
+
+  optional-dependencies = {
+    celery = [ celery ];
+    commands = [ django-extensions ];
+  };
+
+  pythonImportsCheck = [ "django_structlog" ];
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/jrobichaud/django-structlog";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-user-sessions/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-user-sessions";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-user-sessions";
+    rev = version;
+    hash = "sha256-Wexy6G2pZ8LTnqtJkBZIePV7qhQW8gu/mKiQfZtgf/o=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "user_sessions" ];
+
+  meta = {
+    description = "Extend Django sessions with a foreign key back to the user, allowing enumerating all user's sessions";
+    homepage = "http://github.com/jazzband/django-user-sessions";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-weasyprint/default.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+  weasyprint,
+}:
+
+buildPythonPackage rec {
+  pname = "django-weasyprint";
+  version = "2.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fdemmer";
+    repo = "django-weasyprint";
+    rev = "v${version}";
+    hash = "sha256-eSh1p+5MyYb6GIEgSdlFxPzVCenlkwSCTkTzgKjezIg=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    weasyprint
+  ];
+
+  pythonImportsCheck = [ "django_weasyprint" ];
+
+  meta = {
+    description = "A Django class-based view generating PDF resposes using WeasyPrint";
+    homepage = "https://github.com/fdemmer/django-weasyprint";
+    changelog = "https://github.com/fdemmer/django-weasyprint/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/django-xforwardedfor-middleware/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-xforwardedfor-middleware";
+  version = "2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "allo-";
+    repo = "django-xforwardedfor-middleware";
+    rev = "v${version}";
+    hash = "sha256-dDXSb17kXOSeIgY6wid1QFHhUjrapasWgCEb/El51eA=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "x_forwarded_for" ];
+
+  meta = {
+    description = "Use the X-Forwarded-For header to get the real ip of a request";
+    homepage = "https://github.com/allo-/django-xforwardedfor-middleware";
+    license = lib.licenses.publicDomain;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/pip-licenses/default.nix

@@ -0,0 +1,74 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  prettytable,
+  tomli,
+  autopep8,
+  black,
+  docutils,
+  isort,
+  mypy,
+  pip-tools,
+  pypandoc,
+  pytest-cov,
+  pytest-pycodestyle,
+  pytestrunner,
+  tomli-w,
+  twine,
+}:
+
+buildPythonPackage rec {
+  pname = "pip-licenses";
+  version = "5.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "raimon49";
+    repo = "pip-licenses";
+    rev = "v-${version}";
+    hash = "sha256-6xw6BCuXSzNcwkpHaEFC5UPpubPUwhx/pg6vZq2er7A=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    prettytable
+    tomli
+  ];
+
+  optional-dependencies = {
+    dev = [
+      autopep8
+      black
+      docutils
+      isort
+      mypy
+      pip-tools
+      pypandoc
+      pytest-cov
+      pytest-pycodestyle
+      pytestrunner
+      tomli-w
+      twine
+      wheel
+    ];
+  };
+
+  pythonImportsCheck = [ "piplicenses" ];
+
+  meta = {
+    description = "Dump the license list of packages installed with pip";
+    homepage = "https://github.com/raimon49/pip-licenses";
+    changelog = "https://github.com/raimon49/pip-licenses/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/py-moneyed/default.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  babel,
+  typing-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "py-moneyed";
+  version = "3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "py-moneyed";
+    repo = "py-moneyed";
+    rev = "v${version}";
+    hash = "sha256-k0ZbLwog6TYxKDLZV7eH1Br8buMPfpOkgp+pMN/qdB8=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    babel
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "moneyed" ];
+
+  meta = {
+    description = "Provides Currency and Money classes for use in your Python code";
+    homepage = "http://github.com/py-moneyed/py-moneyed";
+    changelog = "https://github.com/py-moneyed/py-moneyed/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

pkgs/python/sentry-sdk/default.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  certifi,
+  urllib3,
+}:
+
+buildPythonPackage rec {
+  pname = "sentry-sdk";
+  version = "2.26.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "getsentry";
+    repo = "sentry-python";
+    rev = version;
+    hash = "sha256-Wl8yq2X9GuPcqaS93hkKXs2cDzz282Xceaai4NjbVZY=";
+    fetchSubmodules = true;
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    certifi
+    urllib3
+  ];
+
+  pythonImportsCheck = [ "sentry_sdk" ];
+
+  meta = {
+    description = "The official Python SDK for Sentry.io";
+    homepage = "https://github.com/getsentry/sentry-python";
+    changelog = "https://github.com/getsentry/sentry-python/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}

routers/default.nix

@@ -1,4 +1,4 @@
-{ inputs, ... }:
+{ inputs, lib, ... }:
 {
   flake.legacyPackages = {
     whitehouse-router = import "${inputs.liminix}/default.nix" {
@@ -9,5 +9,110 @@
       device = (import "${inputs.liminix}/devices/gl-ar750");
       liminix-config = import ./white-house-2/configuration.nix { inherit inputs; };
     };
+
+    flint-repeater =
+      let
+        pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;
+        profiles = inputs.openwrt-imagebuilder.lib.profiles { inherit pkgs; };
+        config = profiles.identifyProfile "glinet_gl-mt6000" // {
+          # add package to include in the image, ie. packages that you don't
+          # want to install manually later
+          packages = [
+            "tcpdump"
+            "relayd"
+            "luci-proto-relay"
+          ];
+
+          disabledServices = [ ];
+
+          # include files in the images.
+          # to set UCI configuration, create a uci-defauts scripts as per
+          # official OpenWRT ImageBuilder recommendation.
+          files =
+            let
+              router-config = {
+                ssh-keys = [
+                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
+                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
+                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387"
+                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
+                  "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo="
+                  "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo="
+                  "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo="
+                ];
+                upstream-wifi = {
+                  ssid = "Glom";
+                  password = "";
+                };
+                wifi = {
+                  ssid = "GL-AR750";
+                  password = "qwer1234";
+                };
+              };
+              dropbear-path = "/etc/dropbear";
+            in
+            pkgs.runCommand "image-files" { } ''
+              mkdir -p $out/${dropbear-path}
+              cat > $out/${dropbear-path}/authorized_keys <<EOF
+              ${lib.concatStringsSep "\n" router-config.ssh-keys}
+              EOF
+
+              mkdir -p $out/etc/uci-defaults
+              cat > $out/etc/uci-defaults/99-custom <<EOF
+              uci -q batch << EOI
+              set system.@system[0].hostname='flint'
+              commit
+              EOI
+
+              uci set dropbear.@dropbear[0].RootLogin='1'
+              uci set dropbear.@dropbear[0].PasswordAuth='off'
+              uci set dropbear.@dropbear[0].RootPasswordAuth='off'
+              uci commit dropbear
+              service dropbear restart
+
+              # Add a new wifi-iface for the upstream network (station mode)
+              uci set wireless.wwan=wifi-iface
+              uci set wireless.wwan.device='radio0'        # radio1 for 5GHz
+              uci set wireless.wwan.mode='sta'
+              uci set wireless.wwan.network='wwan'
+              uci set wireless.wwan.ssid='${router-config.upstream-wifi.ssid}'
+              uci set wireless.wwan.encryption='psk2'
+              uci set wireless.wwan.key='${router-config.upstream-wifi.password}'
+              uci commit wireless
+
+              uci set network.wwan=interface
+              uci set network.wwan.proto='dhcp'
+              uci commit network
+
+              uci set network.relay=interface
+              uci set network.relay.proto='relay'
+              uci set network.relay.network='lan wwan'
+              uci commit network
+
+              # Edit the existing AP or add a new one:
+              uci set wireless.default_radio0.ssid='${router-config.wifi.ssid}'
+              uci set wireless.default_radio0.encryption='psk2'
+              uci set wireless.default_radio0.key='${router-config.wifi.password}'
+              uci set wireless.default_radio0.disabled='0'
+              uci commit wireless
+
+              uci set dhcp.lan.ignore='1'
+              uci commit dhcp
+
+              uci set firewall.@zone[1].network='wan wan6 wwan'
+              uci commit firewall
+
+              /etc/init.d/relayd enable
+              /etc/init.d/relayd start
+              /etc/init.d/network restart
+
+              /etc/init.d/firewall restart
+              wifi
+
+              EOF
+            '';
+        };
+      in
+      inputs.openwrt-imagebuilder.lib.build config;
   };
 }

sops/groups/admins/users/vi

@@ -0,0 +1 @@
+../../../users/vi

sops/machines/cursa/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1ayu4av6r9rtrz54rr5w9vvjucnxxdf3pq7ut0zrqzqd9dpqjjyws82fff7",
-    "type": "age"
-  }
-]

sops/machines/tangra/key.json

@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age14pdszyzzu9lwzhxs7xz7k94knvgensay9qr4p6j9z8qnqnvqup8qpvk6ra",
-    "type": "age"
-  }
-]

sops/secrets/adhil-age.key/secret

@@ -3,41 +3,44 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHFveTNJNWk4\nTjZleFhqY0Fxc08vSkZSaVpnRjYxejRybmJCcmU4bFBzajggQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp5TzcwVWdXd25MVUlHN0hqV1U1Uyts\nVXJOMHM5bUt0RWlVMmRpRWd1UHRnCi0tLSBrYXZlLzRmKzJpVW0zOTdMTlY4YlIv\nelgweHp4anAzb2s2K1F4R0hCS2RvCiUGYrRkes1sDYK52rUceCO1lhmQ6hPjW/sA\nwv/UgJ3OCqeuYC29Hzu4OtC2nLZaFOyRopTgKQ74PfJk3dzuNRg=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBET3d5UTJRNExVRkppSE5I\ncG02V0lDcGZnTmdLRVBkWUlWS3hUaWVaa1NJCkV3V2pseDFQV3RvR0N4cjNqaEk4\naGRkaDBMQnJIc1BlMCtvVW94M0dkYTAKLS0tIHRySkpXMzJiMzFrUU1UekdPUmVi\nMmZiRXBSc3FXMndVNjRqc2xTSlU3RTAK/erwb450pgiQAdYQlrVe32BEiaFIthl2\nUVQTCHQILnxyfC19ZOmlAnSuhXXrj7XdAQmK40DLb0A52QpFC2EP9w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTVkN1STZsYm1aVmtiZHlo\nVDZteEJKWWpRZGRCK09XN012ZVhlRXNnMWs4Clc3bisrSHJiZ0JJbmxkby9LeG02\nY0dSdWdoQ2t2bW5xODIyWEpuMytlYkEKLS0tIENjQnFuV3hBSnNoam1xNzZIVGxD\nVXA5Q1pMTjZKQzNHSzZIaFp2TEY5blkKOjxy9+mpfYGW4SSwlAmZCew3dlN+cV4f\nQaGFYiOUg1USSAmyevmQlGEMX+LvJjhVsVVXXZ+qEhYrbWo9hSI/aA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0dFdWFOdGgrR0hsemYr\nOGpFV1VqQS8vRHA3UURXMEQ2ZDJHcWNCVzBZCitvZTZYdDYzYm8xQzlYNHNVYmRt\nMWNzbitjaUxMSXN5WHp2SVhPY29XY0EKLS0tIGJOSUFBOU1RMHBnQWJsQkg0cFlp\nZ2c5QU5aeDlUMG1KTlMzQ1FPMldTeEUKxyt4xdySOfB8Fa8KjPytjjq0oGgeFBlo\n+uT97/DvDbiBfGaZPaSyJPRP+Mca0yQz9nltCOm7qz68BEjboFKUEw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGliU2VucU1s\nTUNSckREWXFndmZ4dTRtVkNvME5id3poaXNSRWtWMnUxUkEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpaQUFBYVVjcWczeTAxSzFhVVFCOVhJ\nSnB3RmJKbEUxM0NEUjlYRXVUcXNVCi0tLSBRSW4xTUJSeVN4RGdrSys1VU43UXkz\nWWpLMk1qeUdTeEgrQ3pOZEpySHpBCtfbhg5p1A/s6772Kbe8bGjEeKLYJZYCbEav\n+0ZVCW3aAmRBQevSvQI9BUCUrFhaD5TgsDlX04wHX5AeLcRp0Aw=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGU1YU05Y1Zm\nZ0Q4RDB5ZFc4cndmaTVTRXc1MXNmdllocGdVa2xrREQwa1kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPNEJKRkdxc1RkRWJ5d3diQzhuTjBy\nV1VNYXRKV2JXMGpPbWEycUlJSUh3Ci0tLSB2Y2dMV0M2OWwyUVRzZVNCZm91a3FL\nQnlFTjV0dnFhZWkxd2tNOWZScUMwCri3NvW7zXusWvELSRNc4kLfAc6JTbR8q4KS\nqu8E80e4gwng53PpHkmK0pBRYnJbZUf5DPITOy1mrbnNGMh6Nbs=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1YXpQSFUyM0g0Kzd2YjBU\nS3FkWGRMcnJNSnlDSkZlNldpR3lza2VTNENVCmNjT2pWdHRVMGQ3TW1wQm9BdU0z\ndXdiVk5DKzR0dGpEYTNFM291VWhLQk0KLS0tIDI4TkZYTWIvWXNYNGN2emJnM05G\nTHVtSS93S0Q0QnZpcDNLUlRMbUlFWVkKIG6CfJZNkwRjT7lVqisJOZWzswZReUPI\nDFB04ClMfrlStaZxFt2fk6uBIFJPvJLtiHg3oyyTvG1siTcsmOcHfw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEI3YWUzWWxp\nUSszSGNybG9oMitaUXludExlKzVOVFNNVkJteFpadWhtMDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpiTDJ2VGI5VjZZU0xKdTY4czhiT0RP\nbmZtU1ZQZERLNzk0MHpQM2gzdTVNCi0tLSBheWw4OVk5SzJYbW5ZZWl6SFRraXVK\nKzgrODM2alJON1FqTXczOW5JaWN3CpdplHYscbileaUWp0wSuirTOZUefZNUkbyh\nCqwS2/3JZ2IMhAYLfLoeVRbp7OrncmQF7L3KuvPPaE7WjAYwYug=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwNWxpcHJxR0ZVaUNPZkpG\nNE9ONElCVndkVmlVemQrQTE5Yk44Q3llYkdJCnRIYVRDZis5NWYwdEJLbmtCYXVw\nVFJnUktBZzdEWVR4dC9TYnp6bjFNNFEKLS0tIEx5N0hiZ0JIY25FdHVncmk2OEhY\ncEMvdjNJZWFWR0xOd01rc3dvd0l1L00KP2EZ2ZuYBMxXvCgIM3g3otZ8KPYElqqs\nDdmVqie/iKdJckBW3rc1heGOkEdxaxgRvJaLhCZopmLKoi9Cv4pqLw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRMU0NKM2Fh\nQm9uYzYwQnNSWUdReGV1QXFXaXRORUJobURKOTFBbFoxRm8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpSVVgrL3RicHh2OEgvbC9xSzhjKzNz\nYnRIa0Qyc1I1cUhVZmJkSGk5YU1nCi0tLSBPb3Nud0Q3TjZMMkJvRGZNWklQSlFZ\nNHVndHNjZmljVExmNzNYdzRrZmJRCgwWFdIGjZJfugyk8GSk9zPE/cgERs9E48S9\nVjUEetmVvRPj3jOsseyrF8KF4ZAppo7u10WXKvTZOBTDISpCW0U=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFUTg4OW9JaytRSDFkQzJs\nVWtTM08yU2t3UDA3VXJrMm1IZ0hkaEVYTTJRCkpqU1VPdW1OUW5yWGcxU0Mvenc5\nWStnQml4a0NqOTFDZDBiWUp6ZzYrWk0KLS0tIERzL2dXZ21zT1hpNTJhY25PNEFV\nVGtpSUVlcUgvbGZ3TXhvSEJINjM4a0kKwkoAvl9pe701KPwki89jpU2KPr1WlRpB\nbxo7kTWebNlk3kwpF2ZHw1ci2HoNreqiCZ6thvJMcYoH1OwZ1OzF0Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMUoyTlhwOWVSNG1vbGdz\ncDJwc3ZTUjI4OUpLN3lnQWJvME0vbzkyTVJJCkJMbXUwbnVDMG5oNjVJR25wSVZw\nYjEyMWk2Y2pCa2N5ZTlka2tNTFVybXMKLS0tIE45akZVUWdsQmRUWFhuVmdhYTR5\nZ1hKVytCb2pvM0c5UDJlVVBUdXNxS2MKnQXRfa5eXzos/rAa3KUNtzKwXWuyqvU4\naMSGMpzI62JYrzv51od2sJVOPog0jrUsaIFx8rp6nuYsqRZ1fmDzKg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE12VDZ6aEhQ\nY01QeWF0Smp5T1Q0UmJmRzcwaFV4cVozeXZwR0xaRUk5UjggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpDMFRveEtVZmtQR2M5cUpUWTk1eG9r\namFrcUw5SVk3QmdNZzEyWU1SODZrCi0tLSBmNHRUaGJFZ2dXM0o4ek44cXFJckVC\nYjJhY2ZZQUMrcmw5YXR3YXlBaDA4CgGT9c2VYZUMxxp9R27R20GnF8wgAHwTyQBH\n5r01NTws2RpnFXgKvLSTqytzPcQMz0Z+r5PUtTp1WlUN5ECjD0g=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUmdlRldqaFFrZWp5eU5y\nSTRPeTVHdVFOYldkYVdKcFl6dklRMXpVWTE4Ci9KWUhJcnREMzJyNExZSFk0TFJl\nYmlVK1E5ZlFGWlJRZWwreVY3MWtHUzQKLS0tIElDNEl4UXFFNTJyODB6UnhaT3gw\nK1ViUzFLYjFTemcweERlaDNnR0FsaEkKJjG/XkynVLGQVdywXn0cM0db7X7aYrpP\nxYAUaS5SM7Ny0x3sEyP0+KdsWjBuHfi/CVsiTdBJ8CDpwkYSrpw5Lg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1aXZKTWs1eS9qRkRyeUY2\ndUZaZnZnZXZybUNjR2d5MDl3Ny95M3ZQQ21FCmRWQjhlck9BMHhKWXlqbm1MVkNh\nbjVuRjFCMTFIZXl1ZTYrMlk0YjBoajQKLS0tIExpemlkVlJlaDN0TXgvTDZ5d1Vi\ncTlVTEh5bXc3NmovOUZNNGdMSDVzdHMKpf1ubA1RBtQzSGVd4fyfsGv3VvhHBMoK\nC1/+KnnquvOKQlHNew7B44PKGF9wiraJft8+b4v3Ns8bfOtrv4GYdA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVnNpbUV3Z25weGFmTVg5\nOFV6cjl1eHJXemYzbitQNW9tSmNwaWdtQTA4Ci9ueHRSMndKVnJjVTFDQ044NEhs\nUEpuNnpSZDJjZzJuNjFMQ2ZVQWZ2b28KLS0tIE9LMjhPUndWNVBMR3QxQ041Qnc2\nbXR1U1VOWUxPd1ZBMzBxbGEvS2tFK2sKGnpSdS9f3sNFLstp8ONYTRqZVU7ujFAE\nqwTq4BJUlffEc9JXnvS/ZaC7O1yKmz8V5coKSHlbn+IyrZPbx9scaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOGd1emMzZkxPRjU1Ylcr\nRlVXbHBnTVV3eU9QU3NxYzBKYUJ5cVg1SXpjClNOYUZBNXMwdHJEVlNoRjdRZWVC\ndTluVVdtdkZDVDcwaGFGZUM4MEE3WUUKLS0tIGlHVVprTjhYQmJva1dQT0ZrdkE0\nNHZZTnhnWi94eURxR3ZCczlCeWxZVmsKOKXVYQAMftId6wXOsI+G/1/xPuVCLZOh\nrDzvaUbipkBTdZ/DXXvXf2f1fDcIqXXtPJyBD7Yh/6+KIPxf8wjVVA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-09T04:18:54Z",
 		"mac": "ENC[AES256_GCM,data:VpfhhVlfPQB94009yErF8NJl+BbhBgc/dAPNyvqQzqORpXsPa9DXjae+giPkRXhTS+263NIglUbPiNqZedj0d9ep78gj/rCupmYcGSsX0gqwFfwj50xX0qWDgs6Z5b7QytDlDPiNOCYM287Q7XLob7CcvAM46Ulo3vx/QKD76Qc=,iv:SBwlzN4PIEPo/iZl/VpkcgNtxqlyNOjqi5y9UGzWQgI=,tag:0/0mKGEQtGOrXYSsn+inmw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }

sops/secrets/alasia-age.key/secret

@@ -3,41 +3,44 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBVL0ZwMDFM\nVlhpenVGalZ1L0RmQzdNUEczY3FWWFgxVjZjUGNDMkNsakEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpXRXREbzZrTTBEbzJMZlZuQjFoYzVH\ndno4OG9qVC9uMkJWaXY2VnBwYmZ3Ci0tLSBDOVhPTmlTSU9CUTVxSmRiNVdTclBY\nR3RMNVh0UXJYZ3lOc0ZjMWREUkhZCoUDa9889e8Q+mFJEp3NNnROCh8tCOpEqdNH\nYqi+UnNrO8KXgNi+jMkH/rR1lrvdBxKnp/dp31eaMp/06fCIH+w=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLK2lYZWdHdzhqekpxeGFm\na3JjWHh1a2ZKVlptTk14Mm1ablpudTlaRGlBCnlEem1ZYkMvTGFNNFc2RGRNSkdr\nUXQ2Yk44MnJlL2wyVHpOQlI1cXFZS1EKLS0tIEVzc3VXYmZ6U01VMXlrdVFKUlI5\nSTdrR1BXNlArelBMVm5oWk5SeUZOYUEKSLWtYHUvkcPYC4h7dnHnWA3S84Tuf8ZN\ns2vwgOcFbm0APnoWQsJy4L3uqGoK5btB/EzgXtCopxlv+6CODhIscg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMzBkbjUwcEFzN1dOZkh6\nVnlWdUtPNUh4ZXVBVzlXQmdSWnFXdC9BMEhnCkNCU2Q3R0Qrb2czU2lEMGR6d3kz\naDBZQWlrajBKYW45cHRUcEs2eGdhRjQKLS0tIEtHNkU3TTdQMFd5OUhrejlwWlBR\nUUk5RlRyZzdJSnowcWJ3R1VYNUtTNm8KPkfnali8SglMAwgNva2aQ5mZRyMtXQbf\nb13HJiDgpiqhlTJuzAVchiqtwvGFwWKyd11CbkQstlVCCPDM4ZWrTw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwaDBQc1RPaG5nN3NJbTkz\nSEVmd0dlMU1lYTJlNGRJUml3MFA3d3hvdUZVCi8vU1lsL29NSVY3UmZ3dUZwOE1B\na2h6MFhxUVQ2ZmdSUzRUZVJIRnNiWWcKLS0tIExzeUpueU9VZjBDRk1nVzR0ZmFq\nM0NDcSt6VytTb04yZ0pCdm83UWE0cEkKmLmWCFioA6MRExdjkYupUVtR0Cmo8o+J\ns7B49+L20jTQ3ok4b8Qpl8Q41E5i0FD44sO0Yc12ER6Z9OrDOxs18Q==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHFYS1RPNzZR\nMUNYSDUyU3VjTGthRmN2aU1iRnBHN0hiNElyZkY3ZVRCbncgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpSVXpGSmt0K2pqclVwVmlzQ1NiZklT\nTExJakx4SEFpaGgvWTZaMGUzamx3Ci0tLSB0dkdENXYxVW9hM04xcXNjYlZwc0k0\nNWFuMUJyV3VrOTlvNTN6WCszRnFJCmvToGBQ8FjCA/QwHLCfPPOdEkyFkKTjinZ9\n/XBrzAYGiLbsa4UCCNsw4WTotNSa6yKM4zsiNzi8MBKFXvuTIbc=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDgwQ2ZoMHlz\neFJWdnNqY1hqVXF5bkphM3I3YXpERVNPRzYrenJDbEpTVmcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpFZ0NqMmZnSVAyU0g4eEFTUEZvK0hl\ncW5qdW1CcWNPWnJhaTNkNVowSlgwCi0tLSBhUWF1QjBxOXlML1BqcjErWnZ5dlo4\nc3JQRU42SEhkSFVxcDBmbmpCQndvCji6mMl3vDHlhYgHtBdZaA0iDxqX70jMCAww\n0SpnRzgndSeBQFVxs8Nqa4Lo3ti7juLg7fRuEXQIxq7pYBESj1Y=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGM4MnNxWXhj\nbG5XVjFGZERaRzVHV2lEQVNtOG4wemdaR2ZPNzFiNHVXbVUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpGWGdVL3VlbHpFc0dvY24vZmFlL2ZO\nVXltZllXQi9LZGlGRmdIQk0yNmxZCi0tLSA4eDdVV0JuWnNmT1dLTG0zTFQxU3c0\nSmJvV3o4RzJ5WkRWVzJWa25VczFJCgQe4ow0UVMnRZbQtz8W+uPst0IoKcJThU8x\n0DwZO3J7wL9kCL1Sd2TPYKBRgcBHGvEa/mhOvIoURmNMhEXr0ME=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlUUJwUTBlWEtEZkdxSEdu\nQ0VsdkxTeDVrVmFDclhjZDZiNHI3SXdUaW1jClFaR1ZYWGt6a2tsUjhaN096cnBl\nc1p3NnlFeDQzcEEra0d1Tk5YSnc2bFkKLS0tIDNvbXFJcGRyY0FGUzVRRGpORjVj\nRzhackJVcmtXcTFnOVFCVkpzclFwNEkKLFuruNcaMxUxzYAFcBXlwTAnmQp+GeKw\nNOgTGf7VC9dlel/ubzU2jrI0mMkOmnhQ9adigwzIWvMYjlIPQbUByw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNlV3oyZ2Mx\nQU1qMytLQ1Y4K0FaZVpwR0Y5eHpJN3RBL20yTjVzYnBVR0UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo0VWdKeUF0R3ZRZDBNUE5LTTlUYmVO\nd01hV1ZJdGVlR3l6emF0eGdFNThjCi0tLSBkNWlDMWUwS3N2SDY1TVpQNVFWdmUr\nT0N5RERxV3NIaDFiWTdvU3dDdWxBCpC9Zvjypga/Ul+ZbLoZw7S41Wvq8i7mxewy\nUOOTCpcCbBaCn24Z99UssHY3GbVygsz4554nDAdqmC+6s5bJxa4=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxMG8yWTN6N3JhOVJhSU1p\ndkw4V3FiTE1TN3YwOEJrZEo3cGFYT3lNaGpjCjJFRTBvM0dSblY2Y041SlRTREtG\nNUlYYy9XS1RoczRSd3lyYWxPcGxlck0KLS0tIGtKc2xRWkpXdEFLRFY1Z2xLL2ZG\ncFdFdnlUWjRjczZaUWh1ak1LZHovZUEKFH/np8OI1lOD7VpN7XNW5qcHxcvwAc1b\nwrsds3tIh0IJcWrLCQ9c4WIMpzbisGpja9p8N7MBlU6zhPEXscwXKA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQWRMRjdVaFQ2Ujk5bXF0\nd3UzanVNRDdNU1RvemFNenhFdGZuV3V0cFVrCjA3eUs1QjRqallkUnZkSmxDV0g3\nRHlUQ1RmMGV3dStZN2dLbHRVK3RVdG8KLS0tIFRnUzVxbnRMQ045N1oxMUZPRUxa\nT1dlL1dUS1hEZENIR1pleCtJTy81QVEKgnG0Q1PqlGbv0APDkFB5cG/GzwVfimhF\nXys9RtYqGoQoY9V59lQ3ziI1S+2itjFKGdHHlyedv4IT/aY2uW8kXA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRHVVlZWFlT\nWHpqdW5nR01BRFZhK1lrOWNIVHgwa3hrYVI5bDY4c1A1MG8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwprSjh5clBEMWVlYWNmbG8vTXd0VmZm\nREdGVW9kMGZ2cXpJTnpra2tGY1pJCi0tLSBTVEhnUnpXOW55ZjBRT3NtRUZ0dFZS\nU2VySlE0cHRTZGdSTkxIMWVEVXJBCmDXdGJJacQ12Y2NX4MeauzUhcbzUM0hT5Bp\nD9GRj3QM9VCjb+Nt+4lrohvrG/4/1CEiic3G/75wphymsgSFlpI=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLL1lMbnJDVmRERzAvZW56\nbGR6MkpzYk5DTnVTY0xEWVZ5WEpkVERzVEZVCnQ2b010bEorOFJhOVRBMTVHMFFj\nUDRFWWJ3RG1iYitYS2J0YjFYWW51S2MKLS0tIG9LYStmbEpDZlJUWFlWM1R6dE0r\nVGRBbXhIczhzeE1zOUZSRlZDOVJ6cGcKAziJF6QrZtxkrsOSdJ/iEp0WcHKNtjWA\n6u8HAb1eRb9IGZmibauCfqOBJMmPLaPDYpbQT3XBb+kO6sMMHE15Ag==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRXpwQXk1eUNYNnAveHoz\nRkdPY2JKbmVBZXNjZ3ZtQ3pFT0ZjR1lIRVFvCllVeTltNEcrQjljYUUxOWNOa1lh\nUnYrMWI5czhxKy9Dc015cnFUd3dDNncKLS0tIE5NWEZIK21QdGhjUXc2ckNvNFBp\nSFJpZ1ZGNC9Xdk1sZHpnaDlEYzd5eHMKmsMek5EezKKiyG+9sVNwK92TJ5xdM4mY\naWzz8iFw1lkeJ3iwK5da5iPFolO6C6Sk1Kf2Mst84lklDKE6dtiwxg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaFJNMjVPS2c1V2Zkak1Y\nQmtybk1XSThhZXYzTWZhYkdqYy9CZHQ2Zml3CnJPeUtxdWN2YTA5eHBxVXNBNmpw\najYrTDUrK1E4VjFHaXI3Zkp5Vmdwc1EKLS0tIENad1p3TmpaM3MzMzBvSXQ2eGNu\nRk9VZFFKZk9saGpHQzVjRUpvRWwwaGsKqjU3CjfNLuzLAf4uCmzkNbwZRkxDQuaK\nshnCgn26VQq5De8+QDoboYKOW5Qnf5rjMhKrpGW69C7fir5QIpe64w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnaWV4cGV3WkhiVzU1WXox\nenR1ZGg4M2NiYmQwTEdFaCthS2dCbXVFTVh3CkFFdlkyRm9KYnZRQ0svaGYxR2ZK\nc2d3anJWZjZzdWpPYWtqMWpWTnZ5V00KLS0tIDFyajBoemlqYkhCRDVKQXIvaTFL\nRkp1YU1SZWlSa3l2b2IwN0dMQXo1bVkKxdaMlyWnIDt3e4ckZDD9Fqbc96GHFE9i\n478Ar+UAllWQ5IT2iDFvJVv/FUl2H8PX57aWkbSoe9CvsoKvvA8XrQ==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbHprcnBIZWZYcmQ5b0Y5\nVW5SN2ZFVU9rSncvMzF2WW5pWVZKWnBBNmdrCkpCK3E0aGIwSDZ6YzRhUEcvVnFw\nUW1tMFhjZHZSSW1lSXh5QTdNNGdrbjgKLS0tIExwMStRdmt0ZHhZTmRYalgvSVYy\neWVsQ1g2eGNhSXVLaFFOVXNmcE80eHcKoABIslKMdmsaVJ2mvP+xPUVp0ZLwdUPu\nfOKgZuyY/LRILRosZPFX/efxI7qZx04xo5WMA++IrB03FFH1DQ6F8A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			}
 		],
 		"lastmodified": "2026-05-12T10:32:02Z",
 		"mac": "ENC[AES256_GCM,data:UherYfiTSm/qJ1gElQYS5LagP8d+6s7726HdCFk1xAkdPaqF5u9Jzxuqi/W6o6J2WO0JdgnMOWs9VUNhQbCpFCsCukUblrFZyySA6jhSd+CT4RbJ1UFtFUOjyEdEiRuxB+ARW8IuXcNRg8XTgK4GUw7VWPGSwq5JYjuvGE1GOJY=,iv:r1HgjnlTHZU8jbN/10NJmImaw/wZihwzfdRYNvS6RCI=,tag:uaZtEAdn7cTRRmVeGrSbZw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
 		"version": "3.13.0"
 	}
 }

sops/secrets/almach-age.key/secret

@@ -3,41 +3,44 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEx5bVR6OTl1\nbUR4bXI4ejVmaGtWbTBMUXJ0N0RTRFBVazdNa1duc0xBRTAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQphb1JkK3dDY3BlY1d3ellPcGYyVTdE\nd2NKQWdReVpaMlZBaytVTUI5dVVBCi0tLSB3RGVSRTNKN2E1a0swTTVoYmVXcXdt\nMktHRE9raE5ZQWl0L2RWcWpsTzJZCoaCy6C4O/IzFUVqvjlpc8v0U1so+tWy1dVR\nuGj2w3rOOhj4G3th1XTnhyKckk/FYQMc7eqtCNw/aoeYzTbM4xg=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBObGdiWjBtTkR3alBDTEdm\nb25kbWY5WkFUd1dsanZ5M2FjQm11TnBVdWdZCnNOSE45cFMwallGRVZuMTdlVTBO\naTVnS29vQk9QZVJyaGRzTGNNcUdGQ00KLS0tICsxZ3NtVlVoc2FpQUMxSm9uZWF3\ncjZXcDVwZ0pUcDlqOGN2aGxmME43NXcK28S/SKkLgXJWQ5sdDxcGyoO74e0MaxeM\nx1kGfiKJBLqok+wNOPO9SFHbWY/ITH5RdV8iLchPBe2VM9IuC0nZ4g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNmtWVXMrL0JqRmxMcktL\nQUw2azlReGNUQXdDbHNMYkRIRk5kbzY0QkdBCkczaDVjN1BUWk1oQnNJclNHUEJE\nRXB5V25tb1lyWWpZQU5pSVAzRU9TME0KLS0tIHBITUg5YUF3eldrOTJNY0ZHOVdM\nTkxlMm4rTU80YVdxT2ZUeElzOHVEVFkKazdHvtc3uvlSCT2KpsoYmUbSbPlC5xz5\nuWTUX0wf9ewy8t3WIwAwLZDw3PW0DNvSWPIf0jWkYXowrlUR8O32+A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsb3dPMGhpdHE5SlBQK3hu\ncEJqL0JaZk1rOE5MS0krUHpyMUNMUkhyMFdzCmM3V25vS3U2WENycmZIRC81Y2k0\nSEJTekNaNTFMZy85VHh4MENvbUk3Uk0KLS0tIGExYUFNVlRZeThQRHlKVDZWU1Jn\ncUNRd1cwZU1SL3BKOGZZaFErR3F3NkUKnILS6XWSl2MaQ+FAZvRAZzgJxL4OWl+v\ntDxXBBCapOeoLgRH61Q06JnDjgBCz14QIROgZP9Zji/HsdSeRiKR0A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDd3bEYwTzIv\nVW93UGFkTVNtUU92Rm8wcmdnR0JIZVcrd1NiRWVDTVlFaEUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpsZTVVYXBpV2F1V3JKOTZhdDlHK3VB\nRURUYTg1c3QxUy81Qzk3Y2tqTDRNCi0tLSBMOEpYVFhoSVdWTVYxUVBaSWdOMUdW\nZHkwQXdMNFAvOUdWVnlSNXI3UkN3ChOrOyjJ/Gcy6Rxannu9fOinfrUsj9SuEbmp\nunSoNcB0pEM4wM6e/JofVBTKvtZ2VeIn1ms+MiNR/JizQxWbJsA=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEhLejJLVEk2\nR0dtY0FJQUYyd3JObitPdEcweWVUang5ZUdEcTg1UlJUMFUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpvUS80dk92MjBnN1N6Y284RGE4T0tR\nemN5Wks5dS9vdWRBTU1YYlo3UXBZCi0tLSBEb0pmU2xGMFFjazZ4em5uT0wyZUZW\nT1JqdjZjTDRwUUJLNzAvYTFreXp3Cqfcpn+UlJE63ymHbremaZ8X+wDDQw3gPGmX\nav9dmxfLCPLwwTbd3e8N98Jnc0OwGUiKTavtjpph9ygThvo86jE=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvd0loUlZXbTFFcGx4U1ZZ\nWmkyWXVJZWlJNERRWFdpMG5UTUxOelpaNmlVClVaREdlemwxTEJvVDMra3FNY3hK\neGpicjRqZnJod28wTzAzRGJZbUIxaHMKLS0tIEIvcW90SUVvZnc0RHlBQUVIYzVw\nNGRoTTd5OHF1MFNNRXk2d1RGUVNPQlEKK8pSsxseowIbNXTVUA/G3otDPPdTETdg\nphv6F7RsiBEGXFqlQpvg059DeFJFT8Xjrqknm1j04uGQxN9Ty+kUlw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNqaHoxdk83\nSnFNRXg4TzZLY3BSOXNSdWVrby90V1Q2Q2RRUi9xZGZ2Q1EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpZM05YUEFYNEVRM0FSYkpKY05pc0hq\nWWRzTzFWSUZRNmI2NENDL3RyNVkwCi0tLSBPMURucGFSdHJER0tqUlRHb2NmNmYw\nVTZsN295QUJZQ1BObERGYjlESGUwCuYMMiu6NyO8Q/lvBHI7muzQOZfaL3Ny3S3E\nE7TlShnbLEsDxApvBV1KJaiYY21Z+1Up9DM0xQskFBYQCya3APo=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUmE1alpPSXpiVndtcEh4\nTHArVkJNSGp2MFNXZ3BGZ0NnOC90alN5UFhZCkNUMEVCWDVsWGRGUjFCSGF1OW4y\nRlhrRWFlbUYxQzdsRHcrNk5tNG9YNkEKLS0tIHJjRmNrZzRvcWRKZGswdHp1Zkkx\nSnQwK0dia1ZBSGxRQ21XeGIzWWkwbkUK5rThaH6WAH9PXLINKTkv6VsKgJOA4zO1\ng+lEE3Kxy92FI8hbov543t54R3YvGxorRekyqqqhvhYwOfEDYKA5Rg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEw4eHIya0RX\neE5Nalk3YWs2R1ZFcmp6OEIvSDhPMVlZYk5TcTQwbXBpMlkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpYMURZbG5lNlYwMUdVSUtsRlJqWEhj\nbHdvZVdpTGt4ZzhRZERpWWJkbG5ZCi0tLSBJMG93d1ZPa1Z3WWVDSjJ2ZXEwRDJD\nQ0cyQUxlaTdycXhGVVRzSnAvakJvCgoORUSoqTGsS5hvnV3hJNIz1Y9pTR7foSz8\nXMd/f3TObHeokHsejbxx2yMDLPt5fD1MWc5MioLyMNMpwjqq+T8=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4OVI3eUJKSUdVRHJzZUdP\na0FQdFN5TE1iSWsvUnFqRHZSdGx2MFNrT1VrCmlZZEZlR2w2M3h2b01YTWVpRHRR\nVlJCV0h0OTdMTm1RczdhRXhoYVRmYVUKLS0tIGlQMXNlS1puMS8rV3p6UXVaMU1U\nSE9zMkkyZHI0L1AvSU5KZVhRQzJNaXMKRhx7txNzoPgk5/k/uLsJ6kTLB/Ketb0K\nl2IeDtLQ+jvkkwAtfwGrJWJ6fR8VkfWvW2kClBuYMJws7qC8QbchdQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvYWZ3a1ljTVhQZFNHTGxP\nQnEzdm9QM1ZqMGZEMVF1UzczeG5LYW8wam44Cm9GKzc2c0M4dEgramE5VlBQK3NQ\nTkdlajFFRzU1aXorV0tuL2M5cENQRkEKLS0tIERWcFd0MXAzYVZOdlgxSDcybk1O\nMkQwM1l5UGRVaHdtNCsyR2Y0VXRSSkkK3Bmoxs/GeybD/cwQf2d8QGdTVa2tfKXp\nTExxPuwsrb+/uaooHbCefv35r8jAmH67fJPM8IjyrcmW9HQpvL9R6w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEI0NFhuckxS\nQ3AxSGtzQVNQdCtFV1dUUDR0MkI1MC9JVGxXZUJlZFMveTggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpNZzBsa28xeXhFL0p2WEFVbzdNRFVQ\ndkZMdlZ5cjBVZE5iMDgrY2lDS04wCi0tLSByUWJvNmpBVGtsejl4R21ERmhnRjlj\nb2dEMDdLeFgyZGVnaElqL2RURlZrCtci44/ANGXQGUpwQwBPFCXJzM8ZlhQEsymr\n8/yyb57cpn8ZDzVlBbEwlE5h6k1jjiM6IdORSf0Y4GatguBOWLI=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5SGlpbnpUejhLVVNBVWN0\nMklqalJvT2NTL1VhcVIyUDRMQTJ3cUdHVWtJCmpWV1B6QkRwUHZ6K2pzNDJFSmpi\nZWlpNXo0aXM3Qlk0ejlMWDZ3RXFLN1kKLS0tIFYyYnB4VmhWQUoxNmlBMXZQT3ZX\ndW55WktEOGhua3Y3a091a1ZLbXV6ZzgKqQ9g37DyZNJDyjarEKqnftB4l8JCyCpx\nVJLSsjC4kvQCMhRsgZuLZaoICNRgOQiPIW8+N+bqNQ/WxcoOZM2z1w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVZGd4MWNxaE0rcS8xL3lN\neDdsdUlmMEVWUk5nKzhwUHpWZXc5VzJaT0ZrCm9McThNUTlZSkRVNVFjNGx4SS9V\nQzk1bnNRTmJvdmp5d1d5QUxpTk16YXMKLS0tIHFDbGh4MWllSUY1aUMvMnFRNk1t\neHBweWlvMmhJaUw0VTk4dXZiNWNiZGcKAquDq1StOGfI83c1EBBuCV7H/sG/bnRf\nS9EGOmrDYnCJEiKCDvbaY80Nbb0AJvH3lugBwVNWcDxmuT6hFimBxA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z0x5NUJnK2RqYXNzT2l5\nbkd1UWgzTnFpcFQ1Y2RPQlFKSktRV3kvcFFrCkRyOXRDNHFHY2QrdGhrM2JEbzQ0\nb0xPb21qd2NjRGUzVUhBdW5sVkVld1kKLS0tIEVNQUwza3luSCtEblphYnBlbmJT\ndm5IMVJUc2hBVVRrZEROUzI0YllRVHMKIq8EbkeEXMDDh+MEQqkU7BtdlMTmeGYn\nHgizD8RFh4/0A2MifmMD/9OarqSNQXvQi8z2rTVctLMcLCfuAf53uQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrOFFUdmRIQjVXblRGNjFq\nUmNaYUgzY2hsaXRrUXRZQzFrTWloUG5xbnh3Ck1hYWJXZytEQzJjWWVGblZ3WGhV\nc3FSNXpPMVU2ODdDL3RNT2FTT21iNXMKLS0tIC9xK3NGRnRudVQ5RFFsVGI5MEtF\nSlljWXhUVXVhc2JmZ3k2RE43ak1ScGcKGaUeC/5UFHVLu9NETJTIVsOd+NnXphZ0\nQImkKtlJXxQ4OBJWGP7Ybm5h4mWiqqVWIrkodyH+qo1/EyOwZ7OjgA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-03T07:06:11Z",
 		"mac": "ENC[AES256_GCM,data:rEbXQH/lqWkL6EG+DoRNQtNTY0rIXQDR5aK/VFfZLCQw5RYTOdnnAeK93z5uV/jSJ6PdwCPFLbCKF34+aKwSS1xVrLp2oZb0aK1J85sP5V41+r385rxB/0BZP7dk4IaAkEOnU39qoyo0hCYROJ95V+97JhdvV7Y0l2zXypdLuNM=,iv:MqXHtyaOb4di969TLoAyhl0Kpo/JsfUU6pS9Jwes2oI=,tag:2JSV57+uAEQPNm8ODmCocQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }

sops/secrets/alpheratz-age.key/secret

@@ -3,41 +3,44 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDlubEtKU3NO\nODdnTzBRZGlPRFJ0d0hQNEQ2bHN4VXF0Y1RDMlhhakk0bWMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpEZkkzL1B5bFd4WEpDTzJTZWNGUSs0\nVDZ5WksxSHgvQk9sK1ZOc1lsRWlrCi0tLSBUbERZdElWa2hCOGdvakIzekxQU1VC\nWnZqdUQ3bjVOcFZWRjVYbmJuUThjCubHPVP5xwgzi+KgNSQiS5qKbDhjekJ7/aIM\nub0w758JxU4JcvL7R3EpQCujmoav4KEgzx3B6S+b+nOu+Y4DPMo=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdFhxQ2hndlFoS1dGd2Ns\nMVFJN09RL2pSekZ1bTNuSjFyeE5QVFQrUVJFCndabkNqdXFESTQ5TUY1TURhZjcx\nb2RrTGUxQUFMOEdadGFFMFMwMUIzUVUKLS0tIEh5Q05SaWRJbHgwVC9aMWsyUUN3\neVpnRVQrUjM3Y05KbTRLR0t0NHFRWTgKbMpXKBQJhHedMYbDB1/N7ASUJ5m8bM7X\nuC3BSGXUmrH81krmnbdaaMontpllUtpdmDd1hYOAbQLVC3UYADfbCQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsS1p6NGF0Q1NkN1dlYzZO\nVFVEUFhFTmFmUjRSUU9xQ2dKL05LNStObGpVCmFDQXZjdmdvNWRreEdoSytqZURa\ncVQwKzl1a1NVcXFCRG81QXNOK0loR3cKLS0tIHM3a1U1c1o1cDh1c1NDa3pBV1Jj\nS01NWjBDR25PY0tBdEl6ZHlWR3VkYTgKVrRMylzjIlD5Z+H1FfCXxwn3W1ACXghH\nOHjq3GRunWD1xnksZ2WD4b0dZu1vmzLSvURHZTXFAIJF55xPBgqngA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxejVIbzBWMFYwTEJyWUZC\nK25GeWNtWThUVVRKMXJnQkN1blFFMVJMVEU0CmJGdURFbUVYMWR3d1d4ak1SWFlN\nSHVDYW1yeUJwWUZwT0lMRUgvQmx6c2sKLS0tIDVIb0h4VnJPTkhlcTN0S0dUMmp0\nRXdxSmpXQ0tkZnBUQ1plMVI2RGNxVFEKGnJ5y1umJbn0qP5aCGs/AAuSJMRl+cIB\nfI8wVSGzeRtaoryAIFD/b2STSfBDyjKOkQOQXML+YEsEwqLlCufWKA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDh3NHpIYjdL\nallGVHN6TlZoaEtCZlkwZ0Z3VTcyTFMwM1dENnNocmZPU2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpCSTNEYVU2MGMrUU5idy85ampFeXlC\nSTFWYlRXODhrOUZMMENSN2V0MGZvCi0tLSBUQWNveVJDQnUxTFFMQmR2eHp3QThQ\nWkVjaE4wM1E0VDEwWXYvbXZtUTNNCg37LCamDQadO7OZDGPySOLdzBFuRuERINaU\nsMK6aJ7BJ8TrSfPYuFiJHvK4/t/Ta9tJcvUz9ab8jGms9vYdF5s=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9GcTYzaFFz\nLzduT3BpTFhwUGxyMkdSMm9oL3J6UGZCcTJ3azBTdVBnUk0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpkanEzVWo5b1N0ZU4ySWR6MHBTK0tJ\nL24yV0FLa1lId2JPaWZ0aU01MVRBCi0tLSBVRXJxMlVhTGZSajhBZ21TT3Nib3ph\nSnFSdDlpbmg5dW1oNnlkSTVTTFFNCs2S1wPrTFqeOx1kvMPiRJs99VbXZyU2j5yY\nU027yIrDzqpcfqcWx9FjHNtDJzJM/150dNkwieheGCOCaHpyqnI=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUaERmVTRsU2lHMUFveVIx\nZUM5UUFuUHNvSUpPWXFRSGV6dzNocjg4UWlFCnNUbTMyNUlldFBRRUZQRzdpWlZ2\nVXZWZUZJeFlDaWlOclp6bWNVdjExTFUKLS0tIEFrV2JyU0VOemJMYTdMSkdmK1l3\nV0dJK2xUWjMwZVUrWXp3SlV1SFYwTVEKFRpWBH6LNhX4taH1GfaRid5ueoNb+Ck8\nWw4WWxI3KyOLxOdxj6yKYNvcn3ogpKQgHIA4jtxwmE00NP6LIMC2pw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExsR3l0VWc0\nb1h2K0tPNjhFaFhJTFREQXR6Q2gvdjZSa1RKeWtVWE1XZ1kgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYblNDNWZkM2lnUXQyVjYweGZWUnJC\nS1p1N3N4RCt4RDZZNnRCSi84c3ZZCi0tLSBEUkQxekp2alExQWpWSkVoWmpia0hJ\nbldabG5LckwwOVlHUDh1cXUvMjZnCn6Q1+kL5JG2org5bxIa6Y6Lgu+LlTyM2fhp\nNmhsoxrah8FGCsBkSNRwsVJE+RxalkUygQ+hf+ss+dDPbDsZ2oA=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDV3A4bjZvU2twWGdUSkVh\nM0dGdVlaRjhCSEN1dlRkazRUY2lpT09XaFhFClZPc1ZnT2F3RXZaVHhQYUdtU2N6\nRVZoa2tlckhvNmlaMzdBdjQ1Y29UMkUKLS0tICtsY0N3UUR3TklQT0syRnlMem5k\nR2JUejhLT0g4MkJEdlUwMXN4aWs5aWcKfDofFL3jFvj2NYkg4emfmd181MeDe4ZD\n2VEotZJF4qHzGhpjiiE5KGHjIzVDCADbI0wfj8z5lKA9n2IxjW7V2g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDk3M0J0MHFR\nN0E0a0xXN3ovZWVWQmkrQ3RBVklSTUwxQ0hmZWwyVDdlUncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpLdUFNYXZ6SStzc21Tc0JoSXYyU0x1\nZW5FbUtGVDh4RmZHUEdGWU1sbnVzCi0tLSBneE90QWp2d01xekVvV2p4RVAxQ3E1\nYjljWk5NTVJWYlI0UXVWQ2J3RkVvCkmNGybBIyBQNh2q5NOoyEg217n6P6a31XnL\nB8a778HPbmT0mhO4QvYn7R/duo07s+vu5mRm8gc5AkCpXiMNkRU=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyNS9tbWdYUFVGQjRZdFR2\nazBwa2VSeTZJVEJleFI4TG4wbUZUNlo5KzA0CksrWFIyb2lDYzhHYU80ZHpBTE5x\nbFpaZWhwSnRvZzN1a1c3SDUwSlZ6UWsKLS0tIGhKRGFYczBRZlNiamhKNTV6N09k\nOXFsdmpiYWhDaUplbFFEb1NnMUlqcTAKmTdcxJCMkGshqJ4hXchq5vUi4pHu+JZU\n78bu20KhkKq4ZZfSrNKNNVq/o+3Agb/VUw9eUFJJHWYCIPfEVsVzPw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dkNRTFpJcTJJVGlmMGc1\nOXMwRXVaRVdlN1RxdWx1R1AzQkliZjZkbVR3Ci8ycGxwVElGK0h1N1VKNFI1dGs3\nS00vd0gvRzBpVFN3SGZRaUVONG9ObjAKLS0tIGIrN2RiU3J5Ukw4SE9XU1VYYSs2\nMUw2ZEowbW5LZ0JXVnZOQTAzZm1aRWMKoM5Dj/mNrSERSCgZTobwMR5Bm1V6L3Yt\n104IQPfZaRv+eSNoKFv3mTL1C/sdRWR4wevQ5rvR8E/Y3CpymM4ZRw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDdVelcxMGNR\nZWF1N3VoUEQrNS8rZGc0Z1BwbXNFbWVkbTRtTi9GZmlDQ00gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpWTFhud3dzTHRkbDlGWUpEcG5BeEp6\nYW9mSGlZQ3pjNVhQbHZCYWUyaFdZCi0tLSBpRjlRMEFPdmhRNU1MVCtCUHF5RHpE\ndFo1YmplVUdSOHVWNTVXRHdXZG5NCs6FuexvoqFQxVNihPs1jPQQgf0b9I41VXDx\nhNF4lGAbnC3icqtHol4azl00RgEtoPE7z/mR36RTMx7ygeNR/5I=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ZGtpZm1ZYmlQRzVId1Zk\nTTNCT0N6aTJzR01tSy9LWTdYbXh3Z0tIeEhBCmQ0QlhDRzdlSXFlWkQ4aXRNQk5m\nTUM2L2J6NzZoTDZpaG0rSVJrMTFsdlkKLS0tIFI0Z0w5dzJOV1orcFcrazdWcHpz\ncDR2MDd1UHdIUlgrblQwYnd4aWVvWVEKJ8U56ajnsWdp96ARKFw1zdLY7z5zhgFZ\nMnd+j5VpjIn2AtIS4w27A+2PX7x+ZysEnnE3K4ndX9nSAzk9shSxpw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQUdWem1QSm9iQnZNOXVM\nVkpDOU4xSmdVd3EvVHhCa0s2N3dxc0xUbUI0CklrZmNJeVRRMTZqSEljeXRES1c2\nN2NKSDlsNVFGWmFmWlprSnVqMGZpcVEKLS0tIGdMYk8rcnRqRG1VUkQyOFFHdVZ5\nRWczMFEzdTlCY3Q2ZXpoZkNybTErS1kKb9/pcCnOz+Ijnp47t50h8D4588f38t1q\nOfbfLvAGgkvCq0vOQv3+MVarmoPeameQWwFjBfB7itbZzQDN1zFePA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxbXkvSERJZkgrM20xMW43\ndmFFWXFZVytwZm43SlkzUFM2dkZQdU9sZkQwCmh0bStPRDVOYnlITWdFdU5YNElk\nRk1uWjY0QTc3eUdSY1AyTHNTeFdHeUkKLS0tIE5MV21kMlBYbUIxMXJpZ1Y3VktI\nRU1jWVNEN2NCWi91ZHVHWk5CUnpVVzAKlS0amgC+dhZE6TExIGUURr/OhoudnZLf\nfpMXhkGbl5YsTm0Qeqaqu5bNo/XN+77e01WfDwRz+PYp7QXdhMN8XA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvaUIrUHpINE85SVcxOE1r\nU3RnQlEwMERnbFIweEZiblhPdEE4YWFZaEJjCm5NVGJYL3pQMlYyS29xLzhtMUlQ\nUlJFTytkNmk1YWVnTFRuQ0licGptQUUKLS0tIGVkRnpWQ0FwUzhVbmRNTWNSS2Rs\nQ0MwMElRV09ROFZ2YjB5cnEybzJ1Z3MKeOo3uU9D9BDJB8m9cZccIj8zztbvGqYV\nSWvR5AxNLvcEkbNKvxcDRjQUSDLWhcjdcozs7JgjO5P7YlOnZNACmw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-03T05:54:36Z",
 		"mac": "ENC[AES256_GCM,data:06949qq+AgyxgVLVx9ARvul77ypg8Kq3cqpFOWU/HARR1jgkf7n66SWTmVixkfHy5GqOJEBFQ0HYHzKkQ0BHr94se0bFlR5W+Md6pmDVH0sbnB4+leqR0I/1ZU7o6p3hj1nXlkUWRN6oM0wp0Hj3ClOPM5jZ6C44+cadswCQvGg=,iv:5TwgpN7waxevK8nnRaO/bunyjGNvFojXPPIPp1OrRuA=,tag:vycrcH1t7ZPsyqekae5Q2A==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }

sops/secrets/b4l-age.key/secret

@@ -3,12 +3,16 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByYkhyNzJJR0RzQXVPMzdR\nbTRSOXRKRmFKbFM1bDRWYnZ6S21ZcTZpeVNRCnM2RHNBUWVFbmxVWmtHeDlTNmtD\nMUpDeEtxRXEzajJoSXhDN2poY1JSc2sKLS0tIEVIQjJBS21sMmFFOG1SU1ltRnlB\nL3NwZWpzVUY0NkRjSUd4Sk1KYmNwd00KxqY6xtPZHhWrugdwjWHBfzKveWE6K+ZB\nUGd/7M2+qoiktGGr70g9Qho8x8hrdeMRz2v//jE1tudRXmZpng0rUA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsdnlFYjVtdGhHSmczV0Nk\nN0IwL0dLVTdkTWhIK2tmV1E5bE1wZjcyZkVnCkV4VEhlL2lyVkxXMzFQVTZ5dHBY\nSUJWRUh2MjgwZ2RmaVRFVHdmQm00ck0KLS0tIG1oTlE1alJDK0FuNGhDQmcrKzZk\nWDhZNEJIWmd1QkVJc0pLemVOSjhqQ2cKMDYUbT8wQ89mNBJFYp2igHB2aQtxBFtM\nilUU83E0stiVKWHrCnBlmQng4UDr0rPxOWa+JpbR4bSbLPXyKIPtrw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUbjlmaytjM04rUXpUcjc2\nclBobXlYVGZwTk1WRTdoNTBrMHVpN3JNSW5ZCjlRaGNxeUFrZGpHRVlxUS8vYlJV\nTFVGbDd1QXhhaDlWQ3pCR2JBUStIdmMKLS0tIE1uMEcxb3JHbVVyWGRqOVFhZVBF\nb1pJU1BPeVZjb1VPUkRxUnhJNklhYzAKCbsNEPbM2GfImjUzN19u4APdA1DgWkhM\nqR7cDPTQiF6CQLXF+FDrQwPnGSTP+Ku2fkvsfDS9KzMK2z6oIJ49RQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxZmVHaWRsa3Y0TGNIM0dx\ncThRc09ZdU5YVkpWdTdzTlRXa3pjMTRVd3lNCk4waktab2lzNDJhZ0hiOTh5MFVu\nTzR4clA5Mko4Y0o3cFMra0IyTUUydU0KLS0tIC9RWXUvMEduUkp1VXpSdjNUUkQ1\nN1NuTFY4ei9TdkVjK1lUQldOVG9sc1EKFwRbPZyd7TARXkvHD74DGqwvxOjIty+X\nBHFw8H5CWp2FCCQ+9bebMamG3ShzhM21Hju9uVbMXA/WACU/9dAJhg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOekRKMG5VdWpmcm96WEdK\nTnoyL3piaCtxVnN5b1E2RXh1SzZ1cGU3OFdrCjNNMGUxMDF6NzFUNFpPb0VNa2Q1\nL1VacitPRzU3MHh3dXpTNWxYeGFxeFkKLS0tIHV3TUkxTG5mQ3haZVRSTTB2bFBk\nU0dDaGQ0ZjhEOGdqZTFEQXlPczZWdm8KiDHBQQRL4qTnStFr8nmdhet+7gBELCvd\noRvky46oEsS36L9o477ZH134wrSqAcD0NCOO06hA/jEXNvLFig9yHw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T03:23:25Z",

sops/secrets/b4l-age.key/users/vi

@@ -0,0 +1 @@
+../../../users/vi

sops/secrets/bosona-age.key/secret

@@ -3,41 +3,44 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhOdllwaExP\nYkU5OVpPMmEydjJsOXhZczluSXQyQ3MySmcyRGlQS09teVEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQphSFFJbHFqaTFLRTBEN0draFVRUTRx\nS1FoamplTTkyTmlJS0tScXdCdDNrCi0tLSBFUWRCSUltbW5IcnRyU1JjdzlDTXgx\neGROSGFQSDBvbmRVbVVCdmZNSGEwCnOr3VuZfVTTCiRj5sKlgPoC0+0DgoGNRRt+\nF2ZXGzOMhr+2+lDjzU5IywPcWWDcw304wqmPMxmaYVb4jVp7tWw=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VzdmcXhvQVhSLzJwakFE\nS1A3MjZqNkxJclQvTlhSdXJsKzY5QTJ2SndvCm1wWWdieGJ5WXJlRTIxTWI1cTY3\nZ0Y0THpGSERqanRDcEZaODRWQ2pUNzgKLS0tIFA2bXJDc3prMzV5eHduZFFMWnZy\nYUt3VXdESFRZNDczL0diZVl4VTducEEKkVTuEYwEO9g0eE49iWG8cgabWHoacUwR\nHSR0fuHOiOuN48UnDbGruW5XP1iiU0PIXnda+mR6hWft7iOgdt/o0A==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUSW9CeDB1bFRhN3RXVGgw\nL29CTmN0aUlUQWk1UVZUV2cvb0hSU3BoekNJCm5WWThkOEVpQmNMRHdtMUxSVUx0\ndzhPdnBPY0ZYQndVUlFPWWlDZy81dDQKLS0tIHhyVHYrR1AvazcxZ1RtcDVsNjVW\nRFdTY014R0oxcjJFa2k5ZHdkd1VrelkKU/hc52aQ4Jb3AFfc1d1Q+ra4Pnzm3tkW\nXe+IjHedHHZrHC3383do0oRrCSVzggItfcTZ7xCONWF0KI16m0PP2A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOcjZpN1RXblZsVjVRc2V1\nYTlqS3JMOEYrSVQ1RTdpbGVla3FQL0FDWkdJCm5EOGRHeUlhR2VCaDNsYTdtUlBa\nUzM3TEMwYXk1SC8rMlluU254S3Q1RTgKLS0tIGZTM2Zhd05xQ0FkNUJGSE1pcjB6\nc0tzaFdmRzNCajFKbVA1Z2ZlSXFvSEEKVf5pbev34rn8b1yorJIXI65fxBIOjj+u\nQVgtPx7w/3YaS4zHOswlegRVHdbbNTucpdNiX1LrxZlTFFgiDTxsQg==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEpkcmFwR0g0\neXd6dzc3K0ZPNzNrVnB1SzBUTkgzdWx5RDF2V3c2Z3RWM0kgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpqcGFmZW9ENkE1N0RLSVBMKzNJeG5V\nVnV1WWt5bW1YN0thV1UrZ0hxUWNvCi0tLSBLb3YzTWpRTWU5UlRIR2JpY0kzdUg0\nM1NHeVlrcEl2NXBoaWRFa0VpM2VFCshLww4utpSguBV3PV+In9XLaZj/pAy68oW9\nf/T08lfZibWWdG/qUN1FC7xzOaLVPHRv/EXtI+Xcm/unxm8cMGM=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHpiRUpYRHJN\nMWdMV2Mva2sxd3VOSFpxcUwxdzQ1QzYwV2xkbWJuWkQ4WGsgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpQZGdRYTE5OHh4Z1hOcmtaNjhEZ0Y0\nUDFIMjNFQ2dLdm90ZC92TC94Ri9rCi0tLSBlSDZqQzhXZHhLZ1NyM2kwR3JIWXBr\nemU0dzUycTc0RWZmSm1DOElzTFlVCjRGG9YgYcohjXoCFID0w6K0+BgKGxD81D0O\naYeen4musWzwGLcE1nQroRJhZ7DtcumDgSL/Du5UsNEDDVdQQ9I=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZ2WWxnVnc5\nM2FLVHhIMmxYUVdtOGxvV1piQjgwTit6ZmYra1M4SnlqZ2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpucjhLczltalZXQ0lyK0cveUdyYkp2\nMTMzdnc5UUE2NENzaWZnVm9sY05RCi0tLSBycktLalJXNVpwQTQrRUkvZk1Iek5B\nVU94b2dxenBCelFTYTU4aVlwV2xrCuy6vEvX2lWY52yb/1PutSuJnSom2XPCabb7\nUoPrAmSwRACarHTujJHRClGL5vOS7mNagyNXoJJT746UcszyyAE=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdThkcFg5UVYraVlueng1\nYlBjdjZiL0NGODJQelNKOGJYdUtjbWJLc0FZCmZSS0NCUittdmJvVnNqbWJNZTZx\nWTc1TUg0RTFkcEU5SitpOTJwcFpnSFEKLS0tIDBKcnBFVXpjRGx5aSs5bFFsbjky\nNE94OU1BWXRBbC85VVl2TTFwcTRHRUUKY7y21ryifqxNt+Sx7TG3N/ZtT8pTGaug\nv1w2DO+7eCPbtxTq+QyKCmXMgxwoXNiTvxddSBhympALrb3b+BKxxA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHFSR0FLd3B5\nZjlpeWdJS3B0aG1PV0RuVXVxaVpXZU50UDZSekMzUHRUME0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpFYXNCOExCQkdhYnlYQVU5NVNHVmJQ\nM2pUMld1TldvMmw4a0pyOUNpYjdvCi0tLSBHZW5NQTJGajhqOGdnR0dVaThLVjBo\nOHE4NEZRUklMQW5QS3JWWHNhc3ZJCnFrQQJTnJfhQAiSnbcjtmQu/Y1OZMNDFlxx\nZ99ATnj4hQ4Yp3j18i9Yk4HrETYOh4ikbrTQoV9y6NSzh/6JrJ4=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKeVk0VCtIWmRwVDM4ODhj\nM2kwbXFhUWVqTHhZUmVXNHZ5L09RQThzOW1RCnpScnp3MDZJUjNxdWQycDJMQVl1\ndmxsNGVjbDEwR1RTQ015dDN6SFVRbTgKLS0tIDhXanpadFpIYVFJYkRQS2VMU2I3\ncDBZOFAzcC9aRm5YMW56VEM4djlQa2sKtmWAfexQmERb//bbmTNtbaqwZNl2GMZ2\nVY9WAJvh8TOCJASB09jruH84I0nppcIkj1rEaS0FVgaMHFtsn6a6JQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVb0M5a25UNkllNlV1dlln\nT0ZSVUptT3IwdERSSllEM0J6c0JOalFOUDM0CnlwL016N3hWRi85Y2lZUWtZYzRE\nbXB2MHA5RXJzWFN6ekJGWWc4dXZVN2MKLS0tIFMzcWY1bXpPQWpPWUcwdEdYV2J3\nZDgrcmpXdEpCMGlHYU9RM1p3NS96b2MKIhm+nD0zCpyaDvOCdoWT1dPWwxAJ7NWH\nOtP61p5dzWu5TQC/054Palzcj+BQvHcjuanpfm7lipihJ9Gy13NnIw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDBpN2tTTzNX\nZkxqVHdLRGR3MmFGTlZxaFBONGtic09NYXk0Z0Y2eE4xaDQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpaWTFmd1pEbGZENjQyOVJpdmRSVHBV\nSktObXlhRUZXNHZHMm5XR0Q4SHNnCi0tLSBvUjVuWERMR1ZkZ3NscXZlQzVpbTJt\nRCthb0FNM3lEL2lPU3UrT3A1OWdNCjPcm5FeD07BZpaveNpkTd2dKo5054ZcOwIv\nGeiY9ePzl1Xj+yFnSFMGBUsTJQ2wVkDJmtjZkTmwMvx7SwrI5mA=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBodEwwcW9JNUs0eTJDblFk\nU01talZkUjRncmxSanU0ZWxDWE85Qit1ZzNVClhiTk1WVnNnSXB1TmxJNGowZVVE\nSzNYNWlTSmFiRkFHd1ZDVXRhY1U1THMKLS0tIFBCVkZ5NmFmdDlqNGt6T0dVeTdv\nemw2SmhQLzYwSmN5d0Vja3Zkby9wbVUKiNNuHyr0WZQLF/GO2vVsGIuO0x+nRRQn\nvLBK3ahTSV361iRAWAP6x+e3Ir/p3Mkv8p8fozyG5ckupbZp7voC9g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjdzRpVUVkT0dJTkgyaXYx\naWtYM0RBbnFna0tlM2I4dWhLQVhSanEwV0NVCm5yb2QvdWc1Vk5yNzM1bkM2elJ3\nMThxK0ZRVnpkYkZOYm1uYXQ5dERpSG8KLS0tICtVaVdTaGJjaWdqT1l2Uy8wZWV6\nUml4TXNZdXB6ME9aQnRkcmtaWlNDZlUKXA0H46/EPWHkESXzeG1ZL3+RmDLeRkwk\noEi5Po/ut8xotW/FZNi9ja+DZ6qYIj8r6C3yDVD13z4rYvx3ytwUgw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDS0djeFRYaTJCUnhYSUI0\nQ1dXaDR1TGcvMzFvQzZxSFZOa1o2dHp2NjJFCmozbzZNemMrR1BDcFExSGZINE92\nYTUwbkxFVlVwOUNkRXR6WU1xa3haamcKLS0tIGRxazR6cHM1QkRoK3pXRDBEbnVN\nM091cnM4cENkalQwV0VMbXc5MmtrRkEKXtoZMTL6WuFmnkMHTirVYjBMUSS6K5sK\nMa1dWqcjvqoQdZuMoN0mgun9te0tqperKRjKEBQyJyR6jrHcs3EGvQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5aS9hdHcyTzlIQ2UwZ24v\nVndnWkU5bTloZ3VLRTM4MDg3ZEFucHo4L1NvCjFISFJvbnVMa1FmSFU2RlVGa1lK\nZ2R5ZVZoYndlKzZucEJSSWtrM045c1UKLS0tIG5CbmN6ak9ybThKN3pPZUZiMzA1\nN3VLektjdVFaRVdrd3hyaG85ZkNqMGMKimqul0TQ3ldYQItwnDgDF/vW2GSiCBRf\nDOuKlnvEZ7h9PqqvzClXzg/12QP7vZM+UJYXULK8nz9BdEYUStPBYA==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDS1RSeldpYUFNT3ZWbGNY\nQkcyVDZyb1JVQktLQ0hISi9Wc0ZCVjJtVlJNCmxyYSt2YmhRNFVzbUFEUWlrbU1u\nOVNXZFVpU01jY2VYMkZIdzN4Wlp4cWMKLS0tIGdZTEgrSU9JRlp4Q2svcDBodFZx\nT1ZlVE55SUFyRXBTVllBT3BwTmNGTTAKDkjB3Sm1lyNbf2vREHtXfMYzbdMpxbuS\nywh0qNaTh++J4HUOCg0h8UMDxopTApG3Acrivz/qrMcn9HVDuukpIA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			}
 		],
 		"lastmodified": "2026-05-18T09:55:00Z",
 		"mac": "ENC[AES256_GCM,data:0zsNfYUyZpsH1Sl+Y1JWR4Aq/nskVWCqQVC7t+r/HBPjUuy9adx0L9wVw+3EcLtFJ5Uf9hLkfNDMlJh4b6H3lJoMfNOENCUdMWnxDKpkdN7pkLyWx3r5LOlASgVvEemaArzQ+YalQnvB042LlCeWDcglmlNAD90hvcbTSytmhf0=,iv:PPnmiH72xNV70GF+NmnvNh5yWH6Bb3ku/7GmEdummmM=,tag:Dl6xI6jSDWcFmQ86CHIYcQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
 		"version": "3.13.0"
 	}
 }

sops/secrets/buna-age.key/secret

@@ -3,41 +3,44 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHhvNjltNFFz\nN2ZzQlJSQnhsc3psSjFvUzZqR3A0WWtoaVdFbWRKd1h5a28gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpxc1c2TmVGK1ozbSs4TDRkeEExaFRt\nZ0R6Q3ZqUmkvOENEaHVDaFFGYnVNCi0tLSBBNlJyL2E2d2pFVWJiNzM4Z2VwaEpD\nL25CMi8yS2ljN1h0SW5jSWJHRHFnCrq9xAfqdcz88Hz69owcZz9WJ/C2FVKz91O6\nC0ACGcSd2WCfjQOti3cRaXtq+0DredPF3undpR85MOHPL6UL1ms=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac01oOTRpQWFRaEhqM3FK\ndlpQNmU3d09pVHhxTktCeXRPRWVpZ3dzRGx3CnVLckkzQzlzOFdwc2FvTWF5ODVl\nSXJ4di9CcU9wcHhvNmdJczhDSTZMMWsKLS0tIGRrWHNINjRzeFNPZVBtcm52bmZv\nZVFJT3doVi8rY0RyOENRVEdVNjNoOVEKBwhAaM9nRfShEF2B2N4LBaY3WA0Jzib3\nZRXnpnaSVlbnCqJIXU9bYMA/UIQ7b8bRR2xQ0Y+gMabBI0Dzf6TmoQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTMGZZNzZnd21CUyt1UUxP\nVFgwK0wvakN3UkVKNHZFeFM5L2F5OEYzcFFVCmpkSzJ6eFdpNGNOdGRRMTdFc1Jw\nd2hJaVE3Y1RoeEhzZTN1WlQ0ZmU2SzAKLS0tIDdVN0g1c0ZwS05CQkF4MzRLYVFG\nZ1NDUFNwVmFwTTNPVGVSbEIxaWFTajgK/ZJ2hCrpMAWc9g/B0UbpgZo+I104Chwv\nnZyMjWmtX4Y+DL51YxToLSZfEyF57vWSKQNFxmw/eRthDIksOwOqVw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWc2p2NEFFM1NrUllYM0lN\nRUJhQzJXZ3N1ZlpsWmo0L2VneFdnc25KQVUwCkQvdm9leXlMVitQNXN1OHpWM0RI\nZG16bHZVZlZlNHl0UERhWTVpUithalEKLS0tIHo3ZEdtZWo4QmM1SUpuMW8xczg4\nSWFtN2pWS05wdGlQWDZHcFRoWHJUR2sKzy85bPbem51i3FUzhTgk7eEVDbOF3vgR\npbINpu0LikVOrYOgop8cxU94QBWbS1VQd/kCIAYot1jMZs5Xvf9L3A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpZbUN5NUhQ\nQlYvc1J5akN6R3NGRHhoZGNMSVBraGNadEZ6N1B3VjdFM00gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpNSjhBY1dScnRTdGQ5azkwOCtqMEVN\nSktoYldydmh3UGNwSE93eHBEQ2w0Ci0tLSAzUVlhVVFyRW5XVE5jSFloVE1Od3Jm\nT2diNHRSSzhXR21Ud0I0OHkwcVI4CrV8w3aN46IBWWAnLE7FhBDzjfObgHr9L/VO\njFbYe02DrcgdIV6nyuYxfeaJFJEzZXI/XvT61xle7kkWPhwCp9M=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNFT3h4K21F\nam5aMStNRHg3b0dFZm5tYmplSmxFRjBiakJJMExjS2poVEkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprMG5MSzk0YmlGaHpySzZFYk00eFpr\nbllMYmxkMkU1UlNGVWVYWHB2L3VNCi0tLSBCcUdaem9VYStjRmlsOWx3ckFnd3Nq\nR3BRTE9SaE9TQWs4VUZCRmQ3UmgwCj/4vmhRs9W6U9ay6mYFxPd6SvOTvxvYn/Oo\nuY7/N3PVpXxRK/UwovEGqY97AG/dEQk+I0/5AowFGmfPURpqKjo=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRk92UkxXM1VOb1M4UUhF\naWJBcjFJZFRXcmtZRXlOOVZiSGFBSTBId1QwClVBMEF4QnJOVzFCUkZDc3IyOVpR\nUi9oYStTQjRGem1ZQURPbUlMMW5XSVUKLS0tIHlWLzVyRkhrZXkweUFoTlRFWVNp\nZWVLMWdNUkFYakdCWjFrT09FTUc5Z28KLJswSZjTnOmX433D6FEfvx7JJtFdcNyc\nJcbh/i/x+1CiFtEZJ10fKnuf6y7Ut+HjHFqMOMST+UKW5PtYHgjZ5g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGRvMUlHeVhn\nU3BhcEV1bU5uZjZqa25ydHhDOFUyNUQ2SzRadzk2ek9YbjggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYS0Rrb1poMTRDNmd2eW5QSWJvU1hB\nYVpTYnF1NmQ0SkNsa0xCNTh4bEYwCi0tLSBZZDhMZ0JsQ0dPQ2VWYXpMZE9Fb2FY\nY25qNFdFbVo0dURyUHd1MDl6NFlvCjFQKnkAmGuTioiY11oEgdD4Ctcw1gFF7xR1\nk9RV6JRXe8YeuWYpQjS17vQVR65TpJukYWm9UYy3NPP4Xu72toc=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6b1o3UjFNWTI1ZXdhdGRk\nS05PQ3JONjZGdmxkM0tHWjYxaExoR0ZrbndjClp5MHk4QmFGalF5dVI5WlZWOXVm\nWFJGNkhacFlWdVc3VjB4WitXLzMxdlkKLS0tIFVmNUM4b2YwdHVFL0hVMjlSU2pE\nQUhkZmVkNVFzZ3hPU3lSWXJUdkJ3R1UKUmf3beqPvqgOJ4KQaT7kyCCelT4LHEFe\noCxC0QvVCfqEqOiFkE9DTYcqFi780Hpe81PwCqwe9HfovAc4U/7oyg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5HdTZDY3VH\nVnNvNHE2blFqM2pma001OGRWdGYxOHY2UkVhVW44bDdGUVEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjNkdSYlppQU51Wk40QzBlQ2lzaFBR\naWE1NDNOa21uNUNNWFBZWTVtKzJBCi0tLSBOWE1vUDZtVzRLMVdOMXBsNVpwMEc0\nTmwvZGVHd1Z0akJhempkZEdVSmpFCsnAxyLUrUbyMSBvak3VXBSdR5RmmL7eBjnM\nrw+kRLE8NFVwFiCZXgZDBlB2FkVKYvaL/hxsn4LYi3k53U9+vD0=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3SkU2aGRPZFhZclpqMDlw\nUURWTFIyNjNFMVBVMXJFNGllN2ZhSThMVDFZCmY4VTIzVGw4VVRoVzZmcXlHUXpa\nT3dsdGpwL3dyQTVaNkMxTzVoU2JlY00KLS0tIHQ0OHpnekVUWXdoYm5RaURDSUhq\nR0VQUFREL1I3ZHJ1a2xhekQ1T09HZEEKqyMKgxQmPUwSZ4AJsXeOJTFtWcg7NTiI\npq8vTg5rDrBoXHBeA6NlcBRh8Env2Dwxi/PRlSfRAqWQ6bXM+Fj9bw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmOUVPQ0RoSG95RUVnK3hC\nTHFEUHA2VWdadlBoNVRFNUl3Z0hOcjVXaVRzCkRXRTczZWRmenVZeHFWVVBEK2Z3\nVXFPWkpDak84akhEaTdkMjFUcmpnVTAKLS0tIGJLZFQ0UUVYeHkrTCsyYjVHcDQw\nUisxV3RVSEEycGhoSkttaEVXaTV0cFkKKo+lqTI+k6WDdPbMNo1owWH4/RoBt9e6\nmGO+sjziFzrZWUXx4RilR2F/3afRA/CdjzPab9I1sut3I6Z7FXNjYQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGFxS2VSS1pI\nQnRsdWU4STBJWmFtZWpGZVdacTZyN2MwQWJlc0xrdzh3bFUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpsa1pPSk11RHpPVndaQjE5S1c4MUNp\nbldBWFBvbXBJZDJwb2hWcHN3T25FCi0tLSBmWkJTZ3NFN1VZSG85L1hKUGFtVkdr\nbEdHQjVTWmpFbXlKS085aisrSS9ZCpQZhp8x8ty0suvx3N0+50odu1wKxkTHgacd\n3avyMu2Dv2ukwa9D6lKI7o0B5Dh1jxxTMEmJby3NhzC/ci9vyF0=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscXI3NGV1R3lNQjE4U3Nj\nb0ZTNndORXlIY3d4bWVWYzRVTzZHWC9sV3owClRWc2tRaytsQkxFazlyOFU4V2RS\nYTEvY2swdDRnMGowdzZESTVVeTNkN2sKLS0tIFk2alJHUkwrMTVsdG1LQ2pReHA5\nTllyMFhML1JJdWQ1NXJkb2U5K3F4K1UKn6OPUfym5f9aacaHq962347dNeTjBfK/\nAMXPZXs6DawU8vko1RqIgzX/7StrITcXGcFfTutmpSa3KjMzuzeb+Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWEM4cHhUMWg4cXhuT2V1\nbEhrVGtxU3U0UEpxUXg2OTBRc01rRXcxOGp3CjJSenpwVFBETDhNc0dTNkpDaDBL\nZXhUM3FTOGFPUXFtajhhRTNFNmlxTmMKLS0tIHlPdk01UVF0akFTZk5UR1diYlFp\nRTlOQ3dsZncvY1IvY284eERKYXBJRkUKadHRt9RjwAg3HhOzEWoFmHqyLmPxspdf\n7NRqfmXLkXEo8fmBrZCy7QwGdhb7uO+FGiJTFH6u7bUyIlIuAdorqw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1eXVNcklwZnI2dEtRaFdD\nOUVON1Nxd2l4L2xtYUtRSHlXVlc0VzVhZkZVCitxYjJTbDZDQjNHc2JrWmFaaEp0\nR1NMUEllalZxeHRndGxGRTZGSzV4TkEKLS0tIDhNZ2x0amhKdk1IdG16S0RLbWMz\nQSs0eTZ5YVBGdkdxYkhweUdMVVR3QVkKmau0k5SxJD/EURq6Lp4aDMYCoCFLOo/I\nRj5mAP4YGIVTU47HJYNcPcwzgwA6YVqVOiKaG6yyU7u1DsddaZHdiw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaHdMdC9jeDFWdktiV1JC\neDlFbW5QbmxVSStMZTYvak16K255TnZzMFdNCnFuOFlHVlYvQStmYWhITWl6NUN1\nOTdFdjg0OWZhUVd3NjQrcXQrNm9CWFkKLS0tIG9VWGZhUDJGWDNjTVg1bFMvVE5u\nYnkzV3QyczIrK1hLbUV1Q2twaDkxNm8KpHCL8htFz8UeMLsXmDUz/nAdTYsRSka1\nuq+bFkrVexExxqXJVyIXf20ceziFG8t5on8OGHDCOQsst4HEgRqyWg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-10T05:04:15Z",
 		"mac": "ENC[AES256_GCM,data:wJ646ZAfUOSwXnkIUDkvm4wz7uaW4U7bCkC/8uFuoTwY16F5+1N7AxaSE453w2cOCJE5qOAXORYj5M7J8o84LjLWYN4+PYjCcU2ulL9rug29fNblqFHG8G1OdHwURep6sGKfvsSCTGgpnA5fYmXucYWIqc27cQ9HDtiHw3Bojas=,iv:L6xUGwjihD08Ahc/3WoA3tZDXvllmNWK90RpK7m+4Pw=,tag:pMynp2rs42lenOYbLQ0c0A==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }

sops/secrets/canopus-age.key/secret

@@ -3,41 +3,44 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFtNlJtdGZZ\nL0F1emxLb3YwQUo2dlNHWnIxRG8vUVJFeTNURWIvUFVVRjQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpaU0RpZW5iWEFXRCtOTVp0TEh2a1lR\nTHVqWUp4UG9aVVFhTnRCOVIwa2o4Ci0tLSBxbWVNWFErMXArZnk5TzBhbGtvWjBD\nYmxNR1BvNFNpVllETWNLd2R2KzdJClf7cuTi3iF768KXBrOM8hrkEXToB1ldfp1R\nRhqqmmOVzumZ3RuoVnZWPuu1kQDmRuvvNZxqbMgmT/IC2iQbc2o=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNUU4MTdlQmRQNDUzTDdL\ncHhzazgyQTA1NnZuWGJSbTZLQ291RnVqYUFrCmdwNmQ3em1sREkzRjcvSmN4a0xi\nYkpXWmVyV0hlSG9LMlBXQUg0eGdneGcKLS0tIEtFQytreFB5QTZiQnFGZWhneDlt\nM2Y1TnJ4TWtLQ0VPYUFPb1hDU2FtOWsKTGdTMNjgYkhREx2u5Cd2kHIrHXOmgaXv\nxYx7TTXEsRBKPpELqyh4KrjkU3TulIN+aR2TTV6L8T4GPhz7qJRRcw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRGNkUUE1bUlKTGplSkQr\nRVFqbkp0WDZYNDNMdXNxVVJiMTRqV1lBUDE0CjlBb3VFK0NnSUZPb3I1NDlVb05R\nbGZ0WFZVbnAxRjVoYzNWVnhMVDhvdzgKLS0tIE1QaTBHQ05VOEtYZTJsSWJyMDg0\nOFc1R0xZeFhubTRQM1gyc05aOERoTHcKbAlKbX4/2CePvgFigUY8MnxAknYrPCqt\nXdOtUSm1FODK0h80Lr/ZyF3kRQKD7/SytGfsPiOC5JG5sZrPWoOazw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdXhYSlRIc3hUYUliRG9Z\nZys5Uy9nRFpXUnYxOXdKcGR1M2tyWngyRjJBCjB2R2Vha21nZ1hGUUErbzR5YTRG\nVGtNdWl5ejJ2bUgrS2tLTTByZzE5OVEKLS0tIHBBdUdrZjA0ZC9waHhvUzZpYS9W\ndkw3ZDkvOWVZUk8yekRJMkxodndhY3cKiM6SOGBJecXw6VaFx7ujyjJcD9gTZXll\nkx6CPjS1P5ur3nAxSRBXlgZ54rqv+gjJlhJzXY5+aCGtmuOPUIUUWg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFBxOEtKSEp0\nRGltS2x6K1l4ZThQM2hGOGJNdUt4ZjdTVk5lRDY1TUNRM28gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo0NE1BVVhiNCsxSzRLVVFwMHFJUDZY\naEJUbGUwaHdhMzdXR2FRUmtrdlRZCi0tLSBIQVUyZlhLNmVVS2oyL3RuQkpWYzFU\nbS83RjV0TUFuaFZ3WGtLWGFZNVhFCidQE4EgNJORKMZiMUEIho1Y57b77Ov+7xGh\n3APkMvv2Dz0GecxFC2HEPql+Gts9VFgi0rXyevI3BbeYYuol96U=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFlGRGYyZDNL\nZHc2UFRVUDB3NU11RWhVdHFPdDRTSi9VclNQaysyMytsaDQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp0RXpObEVJVHNRREEzR1R3bTBqN3Rm\nM3hXSWlrcWcxMlIrS2d5bGE3UGlrCi0tLSBZQ1hCZDFwYlNIV1RQK2s2SzFHU2Ja\nWENHL3FCcnNhckFsZW5jejA5Q3ZrCrov/P24IITo3YqDnxDq866Z2484tyGSBVWj\nRW9vd3DSFrN86pz/eXEinzOlEd0Y6G6g8Xbdb6wYDhb3jYLHkXY=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMb2EzR0pVbVVyQWtNaVM4\nY0M2NldVZEtKSEpaTHY4NU5TYWZ5YmZHd21FCnVXQTlsTmU4dUlyR2FQSDhZR1lV\nWmNPRGRBb1hJSllWa2NSU200TkcxM0UKLS0tIDBmSm54dVkrUXRCTHFNeG1RbEd3\nWVlseDRvbzNRRFdDQTBpL2hOWFFqQzQKl2jR49Za1Bc5pF4GLqIyme9xNuw52jNQ\nSSJST+wtobCOw+xqeSr5i1ET9AwS2VYf5Hcyc+/JcTK67Xa8vB7e4g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDN4dHFEOHl3\neHYzK2k0cWlLOWlIQ1lsc01CMWw1R0hDZUxDR0k4RE50VncgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwphRTZweGt6YjlHWUFWRHFabytZWDdI\neWR6YjFVUk40T0h6dnoxRTZLRVZVCi0tLSBZMU4vUy9iNG1DWTJRTWV3bllOam8w\nSjg4M0N6bnlwMXRDd3FoVWlCRVR3Cih+vMcCAkOkX+uWjKW62Jyj8jv5K79koJcz\n6Yh3eAqTrdJmdscKL75SBoD5BmD0Gtc+KE0gC1zKbHcQBkf6b4Y=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtSENESS84VndvTjJKZHZF\nMENBYnFTcGROVzh1VHJTdDEvWmlxYldlSnpJCmdRMXh1VVJ3Q2llbHZBZFFnS1pZ\nWHlyRWxSVkJXYVdzSGNhaDJIWjBhZTgKLS0tIDgvRlNYQ2dJcGNCaitpVnI4cVlJ\nUXJTdEU0dS9NeTN0dy81cHptMkFUY0UK7IfjEhXhYZtW61V8xTTHDIbiupXiA+1H\n55G7aNC20L57xqE25IKeNOtJ2Q/2mhcwHp4EioXdaaaBsWIcG07Yhg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9lMmFoc2Fa\nb1UwYzlYM0Q1T2c2WGx0T3JXaEhsM3ZFRFRURnNQRWlTekEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo5QUl6VzU3Sk9saVR0QmduNEVVczFB\neDdnQXl2bDdNOUlVanE4NVdENWFvCi0tLSByTm01ak1yUmFqczlsM3hGMlVtOS9S\nM0Qycks1aERSNUJpWE5MZ3U4MnEwCqebnYBNh6vYos01PJoTnUW3caGBCHrWs0aQ\niXGBFaiAgg8m27zSGF1E4ctQ+VgvlI7BWypVpyQMRw8SAvGxx08=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdUNhbmlBOGN4eituRm9V\nWlNzOTcwWnVzNm0zU0NaL2FuZmd4WjZBM3hnClIwZFZCaURTbUlGZmVLM1d3ejdi\nT3QyNG90WlFkKzJtajA5Z0NHRkFUY1EKLS0tIGEwdndlSE1kc2l6Z2pTMDdKV01h\nUkV3K0pXcUVSc3lxNnZtVGRiYzNlWEkKkF6xzjjCLYU/dD247NyFg1AfB9v6vXrd\nRaP2sXa0h/9EYOAoV60ruupLuug+d8Wwfy9DK1LOG9m0YS++DbNPCg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWU1hhWktFbWc1c2gvN1BM\nU0VrZUZpUkc3MUVUak90SGZxM1hGb3c5M3k4CnUydmVyaUN6UFcxVXJ4eStzbkt2\nRjM5QytuWENCUHJOeEtRM2I1Z3FnY2cKLS0tIGw4WHh2a2ViOTB0OThHTFBLWFlG\naUVXaGpONmNBVHBxejlxWDNSTWtESTAKc2y63StRLBsUByWJJGDNOnuoEP3SLy8F\nlUzHSazowmPAdVtm9gpIWTlnLVnJylY6k1v7TYalejkKl8YXEEt8GA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGYzbmJzTTg5\ndUxmV3o0c05pbnNublZMeUEyVDFDWnhGRzJHUUxjbGM1REUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwppem8zNEZUNHg3ZVlSZnB0NWRZazFo\naTdPRXhFOHBTbEI2aTNRTzNmWlVVCi0tLSBnMjY0QUtCY2hCNzB4OFh0eGJWUklZ\nVE00OEE5d2dWUUlnVHVUV0lBOHE0CgnctO+ym39ICt9RtS042J0EBQXCRd7i1prR\nY7cS+//L6R9skWaEQSMXvFLsmftftH9WawVdnqXmCPOT1Ci4kNY=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByR2M1ZG1XSThWYVN0SGR1\nT05VZmZkK0NNTGdNZjAyMEpmQjNEWGtOU0RRCmZHT1NlSy9Qek8zcUU4SEpndmp6\nYUJJZm5aeTNON2dBVElRMjJadCtsN1UKLS0tIFQ0WTBtY25XWCszOXM1VmVPSTZY\nYWJmcEVRd0YwK3RIUXRLYTVNd0ZkZWcKr5f6dCExSjlmClZiDjJylDWr1ccZkpCn\nhhjOsqA1vtayolowqvWheN2fysIg6NgLMZ4R9cedLahVcMfxk+2HGA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bVlwSys4QUlBSUtSYU13\nSnd1Y1N2QzVNWmYzUld5SGovVGVjSDd1SlUwCnZ3MTlkUW9IdldtM3BxYXlDditl\nVUFIamEzdW0rc3cxQStBekx1RVBtZUkKLS0tIEYxOHNNVWJaOFZjVkdUUmlOckRU\nT0NUVHkrZDJ0VWdTY2NUOWJaR1E0UEUK6RhNImrMpG52kwqvR4h2LXzHhxQ9+IdI\nVJ3HX6xdT5MkuHBtvubXzje4zMlrTGwQC3zeh7EFpvpdBIVt6NycuQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSEYwTVJlVjd1cjRPT2Rk\nQmphdU96OXRvNlRRd3c2alNiMVMvK1BVZ3hBClhsZ0NMVG82TEdibzFTQUVUVXBX\nNG1MbEk1dWFmdGxvVk5YQ0ZDTjJ4OUEKLS0tIEJJQ3o2ZnFqZmpsZGFrSis5NXBF\nZmZrL0RUVXhzMDhPNFBmTTR2VzBOSGcKPANYws4mekz7EN+ZjhfO5feMldFNDRSe\n1m5dGjswL5IyKpiE3wOlQAlkp8y5htYKbGdzwv0CxF8UYLGqVP8Jzw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPcStTSGxCYjdLUFJhNnZL\nMkFCQUxVT05rZE1HVWJwdCtOd0xsZGJXckRVCnhWQ2Ywd05TMDVKSUdoeFl3RmNz\nYWRLTGxsYmtzWDFydUVZOU9aTVkvTXcKLS0tIHR1akVGTzQ2dVFDQTF0VlZNT3pM\nRDVmc0w2bjR1QiswcmpkUU9hYzJEUUUKC12h6SCwmtfd72aNwo3eGwvYrwtK3ryI\nlB/xr6ZR02Vcc6y8tqpvTq+86TUw+od6NgqpATU2KOni8rZdWWnBJg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2026-04-09T10:50:52Z",
 		"mac": "ENC[AES256_GCM,data:zBTGL5/AH9Yt3fvfTUbuS0OpNQkLVSAo/TyypEUpS4TE2/2jpS3VIH8I9P51Iumqr1ZeCTWkR4ujFklXfS7tnvgFlqaJVJtod60C7WZMddrzhSeypOkcAH0/oj/pD1JEp1draiFJBf8NvRsx22RqY7yFUcC9O2KC9WnHn0avq7I=,iv:qz8nv3l9lgMa8IgDTEl9b3loi7CTrwJYVHnGZLuEcys=,tag:A3qyzRqjgKjEo6oYE9fz5g==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
 		"version": "3.12.2"
 	}
 }

sops/secrets/cursa-age.key/groups/admins

@@ -1 +0,0 @@
-../../../groups/admins

sops/secrets/cursa-age.key/secret

@@ -1,43 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:vK/gt7jg0jwe2dBjQ3YjuHMwv5iqGSq/8PMX2Ef8NRF7ghCDKfg7bajOvr7JLLZuTt9l/t99I/Tc4jDvd44+E4FZMtcrpwM99xI=,iv:WcF52uIamTbt61e4S8CRKLNurJZGPMIWZrdR/BmzXxo=,tag:0cYtehcf9rpsCWJubLHgJw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZuOHpTSDRH\nNE9KSUJPdHduZDNML1VxbEh3RlpldTZsN1Y4ZE9kVTJMWDAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp3SkorTkJNaWJiWjFXeFdQTlNRMGhx\nNm92MXNqNE5YTDRHZjhUZXFPbmpVCi0tLSAya2FPOGZPU1ZqTnVqMkhBWEFwYmli\nVEh2Mi9XQ3IraEZIUkVUQ0kyNFc0Ck1a80nYCQB7eHGjCY9RlqbblsGAtDRWkmFD\n0PF1lzsDKi/+5i9PGyBv8x8ObBuPG37hSxhFf+6HlO8aT6q9pXI=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3Nlc5aGEvNDZpWFQ0ZDNz\ndEZyK2tRc2cwdHhBMFphRWhBWmFNblFsV2dRCko1cWt4QnJyMGxnOHpOR0s5a1dV\nYlhUR2V6UkErZDExa0J0Rmp1UU5jRHMKLS0tIEhkdUg4d1Y3dEltLzdjV1VWdEdK\nL3IzWW1YcDFwM2hxUEp6VXZQenNIak0KBg8/vE2UAPibU+GH+Hq75t4p4PxC0lnh\nvVwVflsNt57mlp15FxUdyk1/h5kuQ3hJGCvNVBVDZC710+/aEC51lA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5COXlhRVEz\nZ1NUVVp0cmIyRVdkS2VwSkcrVmNPV1VJcFM0QzZTcFdsVTggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpjbWsreXJSS3JBY1N3RDMrMnFYT0U5\nb012ZCtwWmlXMUNjdDRMTnlUd0FjCi0tLSAxU0FaSVZXOGY0ZGd3T0tDbllrcUxm\nc3pWUzB6WDg5VTM2ZVNrSnNwU0FRCtP4FdLUIqmbNI2dhwa5EMGqkuQH8AimXiGv\n1Yv+Ed/ltgnIsonCSp1LGfZPjYAXkJNKTuC9hHZcHn06kEcqkcY=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUa0NiMmV0RjhBUXdoYy96\ncE5OUWl6V1BFL1RQVzg0dGJ6aC96dTg0TkhNCjZmVEY4Y3BRajF0d0ZxZnZHRlpZ\nejZBOCtkb3dLSTBTODlMMEx0alluR3cKLS0tIFRWOHFJQXpEbWxOZXpKUmZBYzc3\nMGl6TXNKQmczeDlta1JwRlIyWE5aWmMKBpnHnM9Kd44a8XD8DGEatLIRBNj5cKpq\nPi0Ras6sh/n9Qc/P2vXLmezJsprMinsU89Kq0YZ5fllYeYo7EtLUDQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ajJubk9wYUgySExnaUYv\nZGRYbGQrS1dOazJYMExia1MwaEV6U1JCbmkwCmk1MzNBYmxXdEQrUXVqQkc0aEdY\nblJXVDB2djV5NWpLbjZwRnpEVEszN1EKLS0tIHFxUjVSd09JUW9RQXJvSVVRUUNn\nNWRBN2xFVzd4SUsrRnpFS1BhVGxlTHMK0hstei4RTCq6QN8/3ObtRO5/vxuyJZSe\n8IPRM7NhQu9DrP9XXttAjY3Y0912kj86DD4jWBhQx8ifGWG4iIMqug==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmUmdYQmNJS2Y3Vk5CbHVJ\nRTdOOFMxMW0reXk2UkRPMVVQYUNxQ0thUUFFCnEzZW94cWsvVS9JRlZ3bVpBNlBk\nZGVFa05DQWZkbnVCeGZTVHdIblNEVlkKLS0tIDNIU2ZTOWtMaUg1enIxcDRZOEtU\nVW1TZFlKN1ZvRXloTGhFc2ZiM0VkSlkK+etXjSczCTvE7o9Z3uodyhE0swYqnYCb\ndluaM7qsksrTl35nmKZnWSWNdIUOsx6So0GV6X+fc2VsHFArf4XoGQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEN5eWp1ejNk\ndFNqeFA5SGJVS0Z1d29jT2JzWU9LOFJENVp6QTZ5ek1kRHcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBdjFyMEx4NVdjNURsdmJrZ2JUaTdy\nclVhR0J3cG80ZEpNUm56Z2I4TFlzCi0tLSBjMG11WEp1ZWlOaTFUc1BjdU1adEJ1\ncDZNMUJXZzlqdlAxMmZtTVdaVjhrCrKynVH4dBfhMW8T9OvjKGqsBRuPyvxMQa5n\nTOQOptzySV4t6KPdxMfezTN4AR9QVtVJhHSrUlfttUHEKzwxZuI=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4K2xsd1E4Z2Y1UndHKzB2\nMWhVOXRPODl1cW4yNWZlUVgrZTRGSTFOc0hzCis3VXcwaEMzRlRsazdsd043dVlE\neDJlYldxOGNSM1FoamVRZ3FBL1BYV0kKLS0tIFMxS091UC9MNDZ2S1lJdnBzeFNH\nU0lxN2pJZkpZL1VIUWYxZitaNnNPSFUK+jaFzy0tGcsBsTDSHrDa93qEVCFj44IJ\njH65qpXDh/+l7cdSRK0tmRkSFtbicC2fiZNly4RxVmezdK4IRxjP6A==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			}
-		],
-		"lastmodified": "2026-06-23T03:20:58Z",
-		"mac": "ENC[AES256_GCM,data:QiWkrocJs37Fvhum1FhdVBtKRXPWzIww8htwPCI+oUnFyOwDH78YbfcXG42Usg8pQFBQbVLG+DVa99PtdFFl7H6ZYntpfkUZC9j7GX95Cg80cJGCKawCfn71pGKFZgJUxEObXRB7yNGUPhy32cquBevRW8iMz18vfN8yR3Q7KfQ=,iv:LgQOvlHqLUfKPMmCV8X14pta9CSWPV9YjMRYWVZjtpc=,tag:dsBpzsP4dI3QU5nlvqMptQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.13.1"
-	}
-}

sops/secrets/cursa-age.key/users/kurogeek

@@ -1 +0,0 @@
-../../../users/kurogeek