mob next [ci-skip] [ci skip] [skip ci]

lastFile:vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret
clanService asterisk
2025-10-22 16:42:00 +07:00 · 2025-10-22 16:40:59 +07:00 · 2025-10-21 15:55:18 +07:00 · 2025-10-17 16:58:43 +07:00 · 2025-10-16 14:53:41 +07:00 · 2025-10-10 15:38:28 +07:00
100 changed files with 5794 additions and 11 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-
+run-vm-*
--- a/flake.lock
+++ b/flake.lock
@@ -136,6 +136,24 @@
        "type": "github"
      }
    },
+    "liminix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1760426231,
+        "narHash": "sha256-r8c5PKtsxAvtQ/k17GH+WNvP47Lr+AbExLMPdLtvAKE=",
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "revCount": 1574,
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
+      },
+      "original": {
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
+      }
+    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -207,6 +225,7 @@
        "devshell": "devshell",
        "flake-parts": "flake-parts",
        "import-tree": "import-tree",
+        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
        "treefmt-nix": "treefmt-nix"
      }
--- a/flake.nix
+++ b/flake.nix
@@ -21,6 +21,10 @@
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    liminix = {
+      url = "git+https://git.b4l.co.th/newedge/liminix?ref=refs/heads/fix-gl-ar750&rev=3f1f7c08d440130cce9262a93ce78ed7969d93cd";
+      flake = false;
+    };
  };
  outputs =
    {
@@ -38,6 +42,7 @@
          ./shell.nix

          ./machines
+          ./routers
          ./inventories
          ./modules/clan/flake-module.nix
        ];
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,16 +1,14 @@
-{
-  inputs,
-  self,
-  lib,
-  pkgs,
-  ...
-}:
 {
  clan = {
    inventory = {

-      machines = {
-        rigel.deploy.targetHost = "root@rigel.local";
+      tags = {
+        glom = [ "vega" ];
+        b4l = [ "rigel" ];
+        fax-bridge = [
+          "neptune"
+          "rigel"
+        ];
      };

      instances = {
@@ -36,6 +34,39 @@
          };
        };

+        glom-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."vega" = { };
+          roles.peer.tags.glom = { };
+        };
+
+        b4l-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."rigel" = { };
+          roles.peer.tags.b4l = { };
+        };
+
+        yggdrasil = {
+          module = {
+            name = "yggdrasil";
+            input = "self";
+          };
+          roles.default.tags."fax-bridge" = { };
+        };
+
+        asterisk = {
+          module = {
+            name = "asterisk";
+            input = "self";
+          };
+        };
+
        pocket-id = {
          module = {
            name = "pocket-id";
@@ -49,7 +80,6 @@
            input = "self";
          };
          roles.default.machines.b4l = { };
-
        };
        stirling-pdf = {
          module = {
--- a/lib/auto-accept-zerotier-members.nix
+++ b/lib/auto-accept-zerotier-members.nix
@@ -0,0 +1,21 @@
+{
+  memberIds,
+}:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  systemd.services.zerotier-accept-external = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "zerotierone.service" ];
+    path = [ config.clan.core.clanPkgs.zerotierone ];
+    serviceConfig.ExecStart = pkgs.writeShellScript "zerotier-inventory-autoaccept" ''
+      ${lib.concatMapStringsSep "\n" (zerotier-id: ''
+        ${config.clan.core.clanPkgs.zerotier-members}/bin/zerotier-members allow ${zerotier-id}
+      '') memberIds}
+    '';
+  };
+}
--- a/machines/neptune/configuration.nix
+++ b/machines/neptune/configuration.nix
@@ -0,0 +1,22 @@
+{ inputs, config, ... }:
+{
+  imports = [
+    # (inputs.import-tree ./services)
+  ];
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  boot.loader.grub.devices = [ "/dev/disk/by-id/FIXME" ];
+  fileSystems = {
+    "/".device = "/dev/FIXME";
+  };
+  networking.fqdn = "b4l.co.th";
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+
+  security.acme.defaults.email = "admin@b4l.co.th";
+  security.acme.acceptTerms = true;
+  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+    enableACME = true;
+  };
+}
--- a/machines/rigel/configuration.nix
+++ b/machines/rigel/configuration.nix
@@ -1,4 +1,17 @@
+{ config, ... }:
 {
+  imports = [
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+    ./networking.nix
+  ];
+
  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 }
--- a/machines/rigel/networking.nix
+++ b/machines/rigel/networking.nix
@@ -0,0 +1,85 @@
+{ lib, config, ... }:
+let
+  ata-interface = "enp2s0";
+
+  ipv6Subnet = lib.elemAt (lib.splitString "/" config.clan.core.vars.generators.yggdrasil.files.yggdrasil-subnet.value) 0;
+  ipv6Prefix = lib.elemAt (lib.splitString "/" config.clan.core.vars.generators.yggdrasil.files.yggdrasil-subnet.value) 1;
+in
+{
+  # clan.core.vars.generators.networking.files.ata-interface.secret = false;
+
+  networking.interfaces = {
+    ${ata-interface} = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = "192.168.254.1";
+          prefixLength = 24;
+        }
+      ];
+      ipv6.addresses = [
+        {
+          address = ipv6Subnet + "1";
+          prefixLength = lib.toInt ipv6Prefix;
+        }
+      ];
+      ipv6.routes = [
+        {
+          address = "200::";
+          prefixLength = 7;
+          # via = "${ipv6Subnet}1";
+        }
+      ];
+    };
+  };
+
+  services.dnsmasq = {
+    enable = true;
+
+    settings = {
+      bind-interfaces = true;
+      server = [
+        "1.1.1.1"
+        "8.8.8.8"
+      ];
+      # enable-ra = true;
+      domain-needed = true;
+      domain = "localhost";
+      dhcp-range = [
+        "192.168.254.10,192.168.254.240,255.255.255.0,24h"
+        "${ipv6Subnet}10,${ipv6Subnet}240,slaac"
+      ];
+      dhcp-option = [
+        "3,192.168.254.1"
+        "6,8.8.8.8,8.8.4.4"
+        "option6:information-refresh-time,3600"
+      ];
+      interface = [ ata-interface ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "_" = {
+        locations."/" = {
+          proxyPass = "http://192.168.254.96";
+        };
+      };
+    };
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv6.conf.all.forwarding" = true;
+  };
+
+  networking.firewall.allowedUDPPorts = [
+    53
+    67
+  ];
+  networking.firewall.allowedTCPPorts = [
+    53
+    80
+    443
+  ];
+}
--- a/machines/vega/configuration.nix
+++ b/machines/vega/configuration.nix
@@ -0,0 +1,62 @@
+{
+  inputs,
+  config,
+  ...
+}:
+{
+  imports = [
+    (inputs.import-tree ./services)
+
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.vega-public-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base public domain for Vega machine. Default:(glomglom.fun)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glomglom.fun" > $out/name'';
+  };
+
+  clan.core.vars.generators.vega-internal-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base internal domain for Vega machine. Default:(glom.newedge.house)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glom.newedge.house" > $out/name'';
+  };
+
+  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
+  system.stateVersion = "25.11";
+
+  # security.acme.defaults.email = "admin@b4l.co.th";
+  # security.acme.acceptTerms = true;
+  # services.nginx.virtualHosts."${config.networking.fqdn}" = {
+  #   enableACME = true;
+  # };
+}
--- a/machines/vega/disko.nix
+++ b/machines/vega/disko.nix
@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d14f9e";
+  vdev = [
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5RYRG"
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5S02X"
+  ];
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/vega/facter.json
+++ b/machines/vega/facter.json
--- a/machines/vega/services/samba.nix
+++ b/machines/vega/services/samba.nix
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    GLOM.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "Glom Vega";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}
--- a/modules/clan/asterisk/default.nix
+++ b/modules/clan/asterisk/default.nix
@@ -0,0 +1,69 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "asterisk";
+  manifest.description = "Asterisk PBX server";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        ...
+      }:
+      {
+        services.asterisk = {
+          enable = lib.mkDefault true;
+          confFiles = {
+            # Dial plan config
+            "extensions.conf" = ''
+              exten => 1001,1,Dial(PJSIP/user1,20)
+              exten => 1002,1,Dial(PJSIP/user2,20)
+
+              exten => 100,1,Answer()
+              same  =>     n,Wait(1)
+              same  =>     n,Playback(hello-world)
+              same  =>     n,Hangup()
+            '';
+
+            "pjsip.conf" = ''
+              [transport-udp]
+              type=transport
+              protocol=udp
+              bind=0.0.0.0,[::]
+
+              [endpoint_internal](!)
+              type=endpoint
+              context=from-internal
+              disallow=all
+              allow=ulaw
+
+              [auth_userpass](!)
+              type=auth
+              auth_type=userpass
+
+              [aor_dynamic](!)
+              type=aor
+              max_contacts=1
+
+              [user1](endpoint_internal)
+              auth=user1
+              aors=user1
+              [user1](auth_userpass)
+              password=user1
+              username=user1
+              [user1](aor_dynamic)
+
+              [user2](endpoint_internal)
+              auth=user2
+              aors=user2
+              [user2](auth_userpass)
+              password=user2
+              username=user2
+              [user2](aor_dynamic)
+            '';
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/asterisk/flake-module.nix
+++ b/modules/clan/asterisk/flake-module.nix
@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    asterisk = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.asterisk = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/asterisk" = module;
+      };
+    };
+}
--- a/modules/clan/asterisk/tests/vm/default.nix
+++ b/modules/clan/asterisk/tests/vm/default.nix
@@ -0,0 +1,39 @@
+{
+  pkgs,
+  ...
+}:
+{
+  name = "service-asterisk";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        asterisk-test = {
+          module.name = "@clan/asterisk";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.asterisk = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("asterisk")
+
+    # Check that garage is running
+    server.succeed("systemctl status asterisk")
+
+  '';
+}
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -0,0 +1,53 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "yggdrasil";
+  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        pkgs,
+        ...
+      }:
+      {
+        clan.core.vars.generators.yggdrasil = {
+          files = {
+            yggdrasil-secret = {
+              secret = true;
+            };
+            yggdrasil-ip = {
+              secret = false;
+            };
+            yggdrasil-subnet.secret = false;
+          };
+          runtimeInputs = with pkgs; [
+            yggdrasil
+            jq
+          ];
+          script = ''
+            yggdrasil -genconf -json | jq {PrivateKey} > $out/yggdrasil-secret
+            cat $out/yggdrasil-secret | yggdrasil -useconf -address | tr -d "\n" > $out/yggdrasil-ip
+            yggdrasil -useconffile $out/yggdrasil-secret -subnet | tr -d "\n" > $out/yggdrasil-subnet
+          '';
+        };
+
+        services.yggdrasil = {
+          enable = lib.mkDefault true;
+          configFile = config.clan.core.vars.generators.yggdrasil.files.yggdrasil-secret.path;
+          settings = {
+            Peers = [
+              # US Peers
+              "tls://ygg.jjolly.dev:3443"
+              "tls://[2602:fc24:18:7a42::1]:993"
+              "tcp://leo.node.3dt.net:9002"
+              "tcp://ygg-kcmo.incognet.io:8883"
+            ];
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/yggdrasil/flake-module.nix
+++ b/modules/clan/yggdrasil/flake-module.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  inputs,
+  self,
+  ...
+}:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    yggdrasil = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      # clan.nixosTests.yggdrasil = {
+      #   imports = [ ./tests/vm/default.nix ];
+      #
+      #   clan.modules."@clan/yggdrasil" = module;
+      # };
+    };
+}
--- a/modules/clan/yggdrasil/tests/vm/default.nix
+++ b/modules/clan/yggdrasil/tests/vm/default.nix
@@ -0,0 +1,37 @@
+{
+  ...
+}:
+{
+  name = "service-yggdrasil";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        yggdrasil-test = {
+          module.name = "@clan/yggdrasil";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.yggdrasil = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("yggdrasil")
+
+    # Check that garage is running
+    server.succeed("systemctl status yggdrasil")
+  '';
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+    "type": "age"
+  }
+]
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:pGMobS67sLp2GN2Xw7A/trcLYnQdVZCUbjtlwS/AShXxyXgHXzkqRee6R765GZyCpDwM8A1IuMZYctrqWxVXrpIAiJpwvwy7vDM=,iv:ysRf5xAXN+dFSx+sFHNDt1GcVQx7RLej4c12v60iSI0=,tag:yXYpWhWLdsz9BOOoKpZU4g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UmhPdzcrSnFhVUxRNDBL\ncXlGRzdMdWxCWmFlUkE4RnJRQ3psMlBqV0Q0CkRjTXFoQitQbjRhMlVjaDc3UDN1\nR1hBeXlCeWxvdnZoVWI1ZkcweHF5VncKLS0tIHE4YVFhYTZTNko1MnJINjFPYXh4\ndlJJZThGZ0JIaDJWRTNXbXk3alNZTnMKgd+0535zoTu6xW2778uNReu4Z7LStN6d\n1O9SXAB+s1iOZ3xGEICiQTVF/6p8RE6lheV2oXgoMiXXrFNH6INLsw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:34Z",
+		"mac": "ENC[AES256_GCM,data:YIpKJlOI6ASgOYqv9ipu+T3c+PlM5HwvdFVH8gh8hVeSbmxD1baPPmVSWlLv+u61Q1/C9PK4mczaASopaGiLoswep+Hc1Gn7sSeP9wO6Djx6fEIEyE1VUhUbTqi/nHYiB21yB/wegfpqzNYIn1nO0oFCmDmSS5qIowcT1fhYIjM=,iv:lzxll5oC7poLvC/hZPexUGAcAdf67xZGRXUpj6O3p6Y=,tag:9xu17Y5MtW5XNzGBsWwA3g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+204:5ce7:aa27:579b:ec90:6907:4ddc:177
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:I6yalWQ2u5hI84lJTUmh07JxUBp4EZukJrSGSN7wsGiUGlFa1v/RT1XkTiXuRjDtUVYCLmQmfSCAp/OqFscxF8KL+s24iTDrG4e3S6AeKLa3oZrNJIt1EJ06gWrPNoh1ttmwXSd4Y4Bsk4Lg8vIjH4qw3Bx+KrufxYTqe+anfMdoXKnW8wOWud5O7HMvCh+sf4dNcf6PIQ==,iv:SF5qExXNPyif+LIcNhHP0PKELUBXaFsPj9B3wvUkEp0=,tag:QEkZXDrIdcpNiZ6l2ljOPw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENDhrWVRuYjRnZktROU4v\nSHNtODFGMWl0NDRHazIwcWl0WGtNY2dYMXhnCmZQQ0doS3BTaU5hRHVsVTB5THl1\nWUNDQUNiMVJFeFZnQ1ptYmFQdTJQc28KLS0tIEtJdUQ5Y1VqSThkSVVNcVNVNEFr\nMzBCRjM1L1V5TngrZG5rR0VHY3Z6TDAKPQ6P96upDeh8xwQDrX4Zcf71Dah5zkOJ\n/F5eODEBadzQSRmJuyp3+uRMFf47eR6Q5bVah3NsVxFquXOL3CtNlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHb0EwT2tuMVE5SE5XaWdQ\ncGR0bFFhOUQvM2dGUzdlUEFFbzRnTHBWWUVnCjFGTXcrWW1vR0x5dXBUamtkS0dF\neG9weUVwQzhhNHhPRUdqV1VnWXJyNFEKLS0tIC80b1ZqRGFOenpENDN1Vk5vRUhY\nVnJzZ1Q5VzZ6ZEZtZE13YjQ0VVhrTTAK5y0BjKBRg2AXuO416JWLMLyM/pCQChKn\nVKZMXcT6cc5hHDuqbp9qUofknF68XnzlH6nOyLB1ZtnELyeZuf29fw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:35Z",
+		"mac": "ENC[AES256_GCM,data:Y3k83RaeX64LA3rsIkQxyKw+LLUgXVsqr3F2UHkv9h73gkyChc6k1oE/FLR4CsZZWsfLNjCkPMuenqToA2mKqQK0aADwPDYo0aVm0hr1PGX5j3Py6EmP56NFvxlAQsExRWo32eqdkeCkY23hfcmUYlaB+bo/fsrRVj67zag9GYA=,iv:p18i8cV6jKXpuZ1Xd7KYCl8BMe1/8CW9YnCuVrTAqy0=,tag:IJnLzdZOn8Clu+lCKT6zvA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/routers/default.nix
+++ b/routers/default.nix
@@ -0,0 +1,9 @@
+{ inputs, ... }:
+{
+  flake.legacyPackages = {
+    whitehouse-router = import "${inputs.liminix}/default.nix" {
+      device = (import "${inputs.liminix}/devices/gl-ar750");
+      liminix-config = import ./white-house/configuration.nix { inherit inputs; };
+    };
+  };
+}
--- a/routers/white-house/configuration.nix
+++ b/routers/white-house/configuration.nix
@@ -0,0 +1,120 @@
+{ inputs }:
+{
+  config,
+  pkgs,
+  modulesPath,
+  lib,
+  ...
+}:
+let
+  secrets = {
+    firewallRules = { };
+  }
+  // (import ./secrets.nix);
+  wirelessConfig = {
+    country_code = "TH";
+    inherit (secrets) wpa_passphrase;
+    wmm_enabled = 1;
+  };
+  svc = config.system.service;
+in
+{
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/vlan"
+    "${inputs.liminix}/modules/ssh"
+    "${inputs.liminix}/modules/bridge"
+    "${modulesPath}/profiles/gateway.nix"
+  ];
+
+  hostname = "whitehouse";
+  boot = {
+    tftp = {
+      freeSpaceBytes = 3 * 1024 * 1024;
+      serverip = "${secrets.lan.prefix}.148";
+      ipaddr = "${secrets.lan.prefix}.251";
+    };
+  };
+
+  services.sshd = svc.ssh.build {
+    authorizedKeys.root = secrets.root.openssh.authorizedKeys.keys;
+  };
+
+  users.root = secrets.root;
+
+  services.resolvconf = lib.mkForce (
+    pkgs.liminix.services.oneshot rec {
+      name = "resolvconf";
+      up = ''
+        ( in_outputs ${name}
+         echo "nameserver $(output ${config.services.wan} ns1)" > resolv.conf
+         echo "nameserver $(output ${config.services.wan} ns2)" >> resolv.conf
+         chmod 0444 resolv.conf
+        )
+      '';
+    }
+  );
+
+  profile.gateway = {
+    lan = {
+      interfaces = with config.hardware.networkInterfaces; [
+        wlan
+        wlan5
+        lan
+      ];
+      inherit (secrets.lan) prefix;
+      address = {
+        family = "inet";
+        address = "${secrets.lan.prefix}.1";
+        prefixLength = 24;
+      };
+      dhcp = {
+        start = 10;
+        end = 240;
+        hosts = { };
+        localDomain = "lan";
+      };
+    };
+    wan = {
+      interface = svc.pppoe.build {
+        interface = config.hardware.networkInterfaces.wan;
+        username = secrets.l2tp.name;
+        password = secrets.l2tp.password;
+      };
+
+      dhcp6.enable = true;
+    };
+    firewall = {
+      enable = true;
+      rules = secrets.firewallRules;
+    };
+    wireless.networks = {
+
+      "${secrets.ssid}" = {
+        interface = config.hardware.networkInterfaces.wlan;
+        hw_mode = "g";
+        channel = "2";
+        ieee80211n = 1;
+      }
+      // wirelessConfig;
+      "${secrets.ssid}-5" = rec {
+        interface = config.hardware.networkInterfaces.wlan5;
+        hw_mode = "a";
+        channel = 36;
+        ht_capab = "[HT40+]";
+        vht_oper_chwidth = 1;
+        vht_oper_centr_freq_seg0_idx = channel + 6;
+        ieee80211n = 1;
+        ieee80211ac = 1;
+      }
+      // wirelessConfig;
+    };
+  };
+  defaultProfile.packages = with pkgs; [
+    busybox
+    iw
+    iptables
+  ];
+
+}
--- a/routers/white-house/secrets.nix
+++ b/routers/white-house/secrets.nix
@@ -0,0 +1,20 @@
+{
+  wpa_passphrase = "";
+  ssid = "WhiteHouse";
+  l2tp = {
+    name = "";
+    password = "";
+  };
+  root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387"
+    ];
+  };
+
+  lan = {
+    prefix = "192.168.1";
+  };
+}
--- a/sops/machines/neptune/key.json
+++ b/sops/machines/neptune/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+    "type": "age"
+  }
+]
--- a/sops/machines/vega/key.json
+++ b/sops/machines/vega/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+    "type": "age"
+  }
+]
--- a/sops/secrets/neptune-age.key/groups/admins
+++ b/sops/secrets/neptune-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/neptune-age.key/secret
+++ b/sops/secrets/neptune-age.key/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:XXV5r3FnMpt1rX8L4LtxLbNeEZ+tLkFeMQOTvyH93fRAEltE4Uszy5khsvyX9c/h33uxyGFQAymHUqSN8rBlBfbJ0bIf8DfoaJA=,iv:rYt5U/usIK7+glVjRclgCkNpQYwQoZ+UPSzanqbI9bA=,tag:c34l9laQnhQOZlV6bj9KCA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmY0szY2IvRzhId2l3MTFI\nUjFrV0hEWXJIOGcvTmNoaDkvZDlrN0dlRWhnCm1CR2tBWFhJb2NyVndkZTlYWmg1\nUlJHVTkyVGdWZFVVSkZtUzZIQm9DRGMKLS0tIDJxVnB4RFRkWWZ0Y01VeFNIV0hM\nQlphalhKeDQySEVoWWdGNmRaWUhDbm8KnTdaaJsw3YqkjSDQREQuOjeHqKjMbw8q\nfgeetuG7tI/30tKgggTr48rk6mHVHoZE0JHugjYTt0mfoM8Dqct/Sw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvK0R0TC8zZVFkRyt0cEJa\nam9XNk1oenZ6d0lyd0l2cVByZW85TDR6R0NjClFKeXp3ZzFrUU5vQ1dhczRtbGRN\ncVd0dm5uQ1NIeFJneDNXcEwwb3JkWDAKLS0tIGczcEhEWlFBTVJYNWxLMHhCUDY2\nRFhZdEN0NEJHRHpHL24wdjdNUEVmWDAKYVTOGiD/4zZ8ME3F931LDzjoloy6JESj\nGVcgg1ISR/GMeYGxqTGxTQhHVVXv0+djdTnK+RAg2wUJy0VbFTzqTA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFh0UzRLMXhN\nL1Z0QWJxaEVFRDQ5YnQwRGFLdGNzSzQydUJXbVpDTE1sV00gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpmcGdiQkVKSUxQZkJzbEVhay9rVlZS\nV2ZoNmg2WS9aWC9zbGYvdDNkUDlBCi0tLSBqWHM5alJISkNWaE4rcXV0OTZPU1Bh\nY0tFWFl5MnB4L3VrZFREVW50UFkwCqW2sa+4LVWIwcZT9xJ0evJsBva3Lmpcj2SF\nV9YHl7EmGb4pJBslgYUFMQkvTr0/w9VC545YLP3ECn9loC3hzxM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxOOVVrK1ZR\nWjFIcmpacjhUT29LRzlBcENjaWVKWW9BZzdVYUZDWFRIM1UgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwovWlU3RE5aMlczZlJocll1MDZlMG1Q\nSm9CZGZ4TjdYaCtDd04rcjdzQUE0Ci0tLSB3YnMrVGowTUFoNmlzYnRVbTU0dnFM\nb2tuVW1OanYwZm0yTVV0WlZkS21zCmRJ7ij8d36hIM0ZotpU/+ooyWKkHYSgRILa\ncm3F97UZGQ/TkNVaJvMlm7IlX4g/6hONDb41me4/29EmJsJHhKs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExBUmFLZlNY\nK0tHY2NSRzZtR0Rwci8weWphekM2bWZvTGFEREdzSG5pQTggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpsRU1ndC9FekMyTDMra2dYeTlDZFVC\nTURLTG1uMHQ1ZlBEL3ZadnF2R2k4Ci0tLSArWFoyRFdzeFh3cEd3L1hKT3B5a2xS\nQjFEd2Y4NzROTDNmWlYxK015TFRjCjbR7wDmMMuCZpzMq4bbKJNj5P0OH+GclyvT\np84RX7o2CzmlJQXmYwLkv6FICe7U904QURuhPywyU0RXGhKUqhM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVVU1M1M3VURheitScDRw\nbGhETlhUOXdPVVptUGgrUkM1QnRrckJCZERnCkhyY3dhSnJ3a3VDWEs1L3RrQVJl\nOHI0OXBJY2dDQm1vOUFpMzJQcGV3cG8KLS0tIEZ1SHdweDJkV1owRE9RanR3cTd3\nMWFlSDJuMHR1bXVHc1dNODlJejQ5N3MKhKq69LY9/9PXKm3TlsWHYW8PbMgWwgWQ\nUAC4WqLvKYk/MAbKbMOVr/TfrRbkrFJtbP1H0X6A7yzIrAXnsPfyRA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzZGJQTkRFcUh5SEM0Ritx\nLzNhNWxSL3g2Zm1kNUtmT1AyZ0VzOGh5eHhFClJmcm41Q1BFUVk3cWZ3d0VxV21X\nVmFKSzRkeTVWMzMzZzJIeXNDcWJFNkkKLS0tIDYrbWF3Z253ZDQxUkF5dzdGSlJW\nRkxReGYyV0tTcHJQR2JwUVdBL1I5TzgK5kZPf+5N0P/NeuqpQ04Lb8Sme+bocqYk\nk9Ld7vFSxXyjTTnhwKGv4+q85IkDq1xGLj+7iM7QfRfpZS6tBpKJjQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4U0VWYlJKM1JYOXRoU09r\nUjhzalA5aHRCVTVZWXBmODJZZnAvSEI2MFI4ClZEeGh6WnZsNUtTSW9lU0xnL1kx\nbDV4UGIvVXRra2VvdzJwNFdINmdlT00KLS0tIDJwMnpCWVVkVmtYVmxSNXJqNkYz\nM2lCbXQ5VEd1RE9TREF0WllGRWFjeFUKouFFBKiW7JQ+c41t5hwnBndUKZKhdwpm\nYCzF7/2YlZtNYdxip1+lZ5YEqyaXygcOZBjjZ/4s1B7ihEscQskLhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBidzFMU3pQRm1HL3IvS2NJ\na1ZjcFhyRTljb1lQeXhjK3BBN1htdjhCUnpRCmM2MnJEeE1UZ3N0RDRvRitLMndX\nZXpWNk53d3FXWjA5Nnd1Vm5idEg0Z0EKLS0tIC9RaXE4ak1tOXMzU3dsZWh1MFR5\nQnlqTnBGY2pMd0dZYVpGdHRaTzFuTmMKqixum2H5jyBFdxdXAVlLZ4Wn5ZfeUJNR\nnNNsDNsjMctBn3gbtGHkx2wEnlKS4a6jbk01wVdSeyOFWlR9KKXF7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:23:57Z",
+		"mac": "ENC[AES256_GCM,data:xVNbw/RamaR6701df6IHPGjGDoYsZH7gwOWeVpb8A8VoaxYNHQVnRkV6jL58AQqI4DR+HisrpkBoN4Ui9o8t5u7PRbGyjUgUr6tvuwh4MMpk+osUmlH8eNdzi0W3SarhFZIWtcSHkLuhOj92yk0qd+W3TmWd3iMCrdVpkDe2kU8=,iv:uuUYoGcDQTZu/vGgVkt0x4QMQNkcNWCcwOlM/XQBx38=,tag:J49wr+on3MJdlNASbr+tMg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/sops/secrets/neptune-age.key/users/kurogeek
+++ b/sops/secrets/neptune-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/secrets/vega-age.key/secret
+++ b/sops/secrets/vega-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:3WgicB2mjBGo3YWFG9mVBYnapj1ZoH6ohwxIUcA9byWVTCS0ZKyIJZlPeyvKWEzX9ZnxgLd1DPDfFfppwsnkxYOvEJsBAf0AanI=,iv:OKSKHu3h8Kl/qAlQ1xiYElDjaql0FdIWVPJYicfvH8Y=,tag:Xa9RfEBC8l8VgHbJHTr4jQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCK0NJR2VzVU1xVGZBd3Fh\nU0xEdmFhTllBU1dpMDM4V3NjTjB6dWxoRGdNCmdMS0duUUV1bVdtVmF1Nml5YTRV\naHpLMExzTGxKclJDZkl2UWdFUHRxY2cKLS0tIER1ajBQdEFuTDQvSERQTDZialBp\nN2RJdS9tVk8wb1lMclNrQzBCTWx3UUUKVKrK0KHOAcd0oMlzeCbN9xX35QKG+za2\nMqEmG/duejDVVzxjIcMBhsXD3EytUMw6IJ/dQtGYS3lJUXH0tiq1Iw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:12Z",
+		"mac": "ENC[AES256_GCM,data:Nvb0JIeARvwzDQSiUkqNMsTFQpGLDTtM0v8ZDyYzQY9yloS1AsGtehbWPgq9Rzr6L5I71bubw8LWpa6UnlqQSrC8GLOy+ojvu/KknkNaVrWQFCw0BDJk4ypBUaQk8n3dGjkG8UUvKCy7dkwwkP3nNbsQ8HA9R5zSYHNakZmWpes=,iv:iozu9qC8nY2XCPG5aBPihCjoNIxXV3kKLcoesFYPSj4=,tag:NkqiJVwj35VY5teW7eTtsQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/sops/secrets/vega-age.key/users/kurogeek
+++ b/sops/secrets/vega-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:ada9:8363:202b:faf:be:92ab:e46d
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:NSyWVWXMxoTR07uaLUYX6rHB17wsIB53FZHSsPxgDKJQ2wHBPFNaHSYh+BiSo+IrX+YcdUUqJFhEkjWDyG+vXaNZHrMbg/pzZ/cwTK/lPbYISkwtOhgr3zCA0H6DmQcHVmvR6fsdRDkFwl7pHtn1RMjEORQdbBINtscZfzZFcAF2L1t+WPFxgRKQDNT/9l3f4SoBcuakyg==,iv:/5JbEZ/vj/4I+eEElOY0cnhiYzqqPw2ZKLv2M/xkstw=,tag:23exDL72g56bP7ZbMsK4mA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTYUFSZGpmd2tmdzB6bkp5\naytPd1RhVWFqeXF3SDZia3QzUmRNNGpzcjBFCnl3VElLdXFvV0tFSEFlV3hRMzFH\nbnBnWVZ2QkRHZ1BoTEZxdFg4QWE4ckkKLS0tIHhSMlBKakxmM0xyeUphKytLTmpk\nVW90V05hTUEyTVNMQzZHN2xhYTBZRGcK/nJOIM4m56TE7KKmn/QH89g053mmuKKG\nQYs/86SWdLPqwL35FstQg2xDIHSxkDcoMSGc+C+/xdOjWV3qLil/DQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaU9idi9RZzhNeXhTb0pp\nUkZ3UVpsZlBka2kvZDBqcVhiRVdMNVFZbEJNCkhvdmFaVTBGcVAvalJPSlFuZHhi\nTE9qeTBMMjk2djhFUEdJbWZmTnN3WnMKLS0tIDludThMRDFDUHhCZVV3bUtVdVBZ\neGg4TzdqVjJPeUxYbnBWNURRSWRrMkEKBCACDZgHG5eVKcSdjHDITJZqgR7cHdHq\n9y8qS3YjaFZ37Ui6Lmb9vJEzDCEy3wEupBy4sbAX4okVapGPJ4fmwg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHJtSTZrY29X\nVTZNQm9XS3JsbEZCNDFUR1gxZXpObDdKRmQzUnRZMytOaFEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpYN2xlOFVDZFlEOHhTMGZTVDNjdjdU\ndWlqd2ROamdmelp4UjAyVitnYVQwCi0tLSBZWmVWc2J4YVhLN3VyMTQwamtYRW5K\nWVovUEp3YlN5WjA1VE10MElWMllvCiLrLLekRkmSL5ekLIcFMoqgeEPXSrn15JDd\neKT9sbYtwhB7vt2L57fDRfaF/+7wNb9y6cv2oi+EdDoDXp/EyB4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxiRWYyUmwv\nVjlEdS9LOVV2K1NwdDFhYWM5RS9LcTZFNkNaMWViMkl5bmMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpUQkk4NGZPVWRTbG5MNk9CTStSUXFi\nbXlGemlJR2o2dTB6QUE2Q2JKSnE4Ci0tLSBzZjRva2NtNHlRamNvQWpoZW1UWFMr\nQVdNYXBpOFVhaEVxWm1KNFM4UHJvCnebMj6d/+e0vp00Gb02qJtUp2+mEpF/jUpD\n25cxeoSAWPAhfnBgE+oLzQqnQSq5dCxsWteE/1eOXC68koeT9FY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9udm9sRDBJ\nNFM4dFA2ZDdJMlBXeXYvakM5RHVzNlcrRitzUHF6dnBvMVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpKZnBka3YzK0tUQ1hXTHVheE45Mzkw\ncE04aVVPQWM1eURmb1JaNlBwVlFFCi0tLSBHTlY4UW5FQXExK2cvMUJDZE9NaURy\nOFUxN0dvczJtWlVRc29QWlZ1bGg0CvUoAmTgDVSF7SPpqnkFhkCUn3N/Yr4Tzodw\nyCiD7U/KYFavEIxGIeg+ClhLF9o4fYq9kk8ld0vU8qUADXBdRDE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTUEyUndkSk1iQTB3eUpp\nb0ljaXpwdi9QYmdNV1J3L0NhWElRVzlnNTFVCnZ6Q01ESWRNMHRxdWZKM0lYTXBX\ncko5VitPdWk0UHpwWDhGNzFVZk4yYzgKLS0tIGVRdG5rWkYwOFlCQWNIWFBRalVE\nMmFtOHBvbUw5YXAvMG93MjBrRjdmMGMKlopySr6HS6vfFHiRcwlJz/qy7jzyS1Nf\nw4lw7QnOrvOkoutiK3HiIia5N6V0jd0TV7nJqIu7tz/zYksbzps7QQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVTZNTUM5UXowWTlPRDFW\nVUJTbStFcldHbTVDUVRJYjNiaklWRmowTHdnCkJNbUtmdk1jS3kyaVNWVFlOTytX\nKzBwTmxoZi9NdmJuRFNMNTUyRThNUDQKLS0tIENSMHZ5TGwxQ0xuZkZFQ3RJdGEv\nSXIvYW9WY243cTdzZEtra292K0JFVlEKMWhG/7R00uqLb5l5lU3p9Vt4pre6J85r\nIFWtg1G/54KaFt8aiWcD5RUSSARGZ3r4qVtO+9eWP+gA4DUpSNkWNw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WVlWMHJNbERKUGx0elgx\nUEF1Sms4VCtNRVRraWdvUkFEaTRzYTJ0TTFZCnl0aTIxR1QyQ1VsU0RFNnN1NzBr\neTVQbHJHQjAvYklFVkZkUDRXRGxvSkEKLS0tIHdINHFyQVE2V1V1R1ZxWEFuMm5x\nUVRjSVp6NStGSkQyQ05JVHlXejBEbWsKBlMvtw9MCReN1eSHKMwwsWaEF8kq1Pns\nLNSYEeWABZ5bbPB1xBvmIIlVFThJqgy5mBVJLzQMUwqb0IvixAgFxQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaSmNiVWlRSy91Mm5qSWJ5\nd2Z4WnEydE9ncWwzUVVCMDVoek1wRTFyOFJjCkZjOVZrVHY5d3FKRmMvaXJQWUtU\neGpSZkZITkJaOERkdWZpelA5dTJQOEkKLS0tIEtZOUNJSytYTFpSTWNuY3JjcnJv\nbFZpTXQxc29Pd1FIN0xrcEJYc3ZlV0kKyO/PLn2WNdVtTqM8cG1XFqV/5YdSqPAY\nvroStGVsLliV7W4T2MAmACeyjoMde9/gVosKfGc6awE+Bi2BUxrqpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T07:22:09Z",
+		"mac": "ENC[AES256_GCM,data:OxeLto6aeiTOX8OffRsQzxyluSdva7y3j4j67c+MI1ost+QCZyGAW/5pr2mMaoU2XrwYqUjZTKBhJ9p1FY6C29/EhyzrNhGUTjC5iTcXO1lbLUTgoSDN8KPmVea97sTa+easVHoSgnPLxisG2yCALv95k9/eQ7vF9FRjBBNTaIU=,iv:FQeojhtnKOlqWuQNJo1TmI/PhjYbgwtvK24gZMjbbpM=,tag:Vwum5bSSZRNNDQ3Yudw4hQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE09U7Tuvn3/icqFhjKuhp4hG+V6E6IFKhX1W2hVvyVj 
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/machines/neptune
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/machines/neptune
@@ -0,0 +1 @@
+../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:w0u/GcCzPgiQMK5NpXb3kBO4Y+cknIMebBSv8yVISZG3rQn4ndimELcAoxbbmvB4N5x8uHSG6YxVdKRGCr7J4Xw9UOLIr8XPeMst8ZqRZRvJQFqRbjyuBjp27JSPrrkFcohfWmjHIIaqDQ29mPCOhbY8bPfl0MM8p6Iyvft2VtQpo/A5dKbDtn8/e1/5ChTtmBQWdtIfw8LBILChlc03RTZmW0b0esNqLUwn9UFTGKjxF/CFjJKSpxLM1vdYFipHQ7VZWD/HRs0qtAlldXQmWu5d0ypI73NQ9dNAo000zcraf55DsjcwjLhjMdnm2heEovAqVBUpgdr+tHSnu3SKq4L+JFUVudxIHrQXsdUkV32QZddYitQANlwC4jjCK9jr4we39RV/AJzs3krkKcG+3tKWg/NCZeW1KwGfgdOuc+wPb1N3OQVIHcC9YgYlXViAW5NO1vT75UvLLNTxbnQRKKADvYVTuxo+ZIaxFBmd8ZUNXJTFbnZJ6e5MH7QbqOwrTDA9,iv:Hc6d3IxfBdHF5XmgdV2zvAU1XZhrgi53/kAKEk6cFiI=,tag:H9CYzcaHbr/LI518IB8YOw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMUh0ZzFCbWJxenpJYlBP\nelEwWDlTYmNuVE9GcXZRUERPd3lyaGhoRFZVCldEcDZUTmJueCt2dmhXS2x4c2Mv\nMENYTFo1UzRLM1lZWGdYRGVkb3hLN28KLS0tIHZhUWNzcXNiUnNPbFZQa0l1SXNl\nSzd4QU1DandCb1lRUEkxUFFNSE5rUUkK7LHoggdi4wj9K39A6KaH0+MFbJ4wzaIt\nRYZxyUdWtrDMm4tEPbHT3DgBYC7RdGfWbxct9KwihlwSWMhNTyXAbg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOb1lOQjRYOEd5S2lEeDho\nNkFLeWhnM1Zjdm9ENXZtUnQwbUlMckhBd2c4CkFLRkVJL25ka1hnTGNnVmRjZ1pz\ndFFFZ2NKZUU2REF0OXV0amVOL0VTZVEKLS0tIHFtcnJ1b1dWVnlPWnExeHJPYnBm\nNEVkNHJBRW1GM2p1Rlh6ZlZiTmYzZ2sKT21d9OMGWuPxkITTvl6XUWzHyGqqzZty\nitwdfFm3YpzGK/FLN6LH+KSXqfo/ntUMmOIAai+geefuT8mSW9n/Ag==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYOHhKWlAwMDBUZFBRamNT\nOFg2Ky94M0xvZTlsS0pEekxkRlYxN1lDVGpvCjZ3T1AzaEV5Qlo1TlAyazQzRUR1\nWjk3d01USzdNaHF6bGpPVWhEbENUZ0kKLS0tIG9TQWlkQmlFdklETXh4cUphUFdZ\nVVhuM3h6NFpKQm1IeGNDR2RxaEUvR2sKoXaltJrkQ4EzTRkrrO74CrCmT67Fef3Q\njRi8NcuYAFN/CrsBLGQA34JwTdKhmS0skkJsDEsofPuepebNc6IHCg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZyWndNQ3ho\nbTl4YXh4UkdyeUNTZzlyZXNIZGpOWklwSXp1Ykx1amZzQUEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpGMDdjSzIvUGtIaWR6eTlaSG51Z3Na\nSUJHWTVhcTRaRGp4NzExcDZTVVJJCi0tLSAvU1JPeGtLT25sNEIrdmJHUzYrTGky\ncURjektPeE1HTHlKK1M2VWpidlgwCimWuV36gFbk2wB7H1X8HJjfq3RJHjP0r5AF\nFY5UYFLvlftVdPizm0LXo5KQbnbckDPZxrlwvkcJP12PR+FOyh0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRpczlmNVdz\nd1BUUkk1OUZwOWhCY1lkbm9xUnBiYmltVWw3MFg0TWEvVVUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpCODRxNWYxNzdCdE51bkVGZU4xbENx\nZTlPTXh5VFJMWFl3ZlhSWElMRldRCi0tLSBnMXExUWtrL2Q1ZmdiaEpIdHVsWHJz\nSFJuRGRvWU01ejYvcFJTNVRqRUY0Ct9eLGkzb+9Zf5Au/Zg+EbQxzgoxTKByhtij\n2YSL2jfn+MiQSoEWeXYP2x6QiZ3gh7yp5WY1ghD09Yvf7x7UAPo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHAzLzNCa0RK\nOHBML3RQWDZPVk1SZlh3NkxqSDQ2eXd0amxiZHpzeEd0aEkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4NEkwbHhqUTZydmJOMm9xbjB3eGVU\nQmRtZW9ETElXdXIvK3NQb2ZjVHJrCi0tLSBzUUxtMnpYUFdyMlg3czg4RTBWcWdW\nUFFvN3N2WEI1Y2RWZWFwR1p6Rm9RCoMt8vokyKfTEPJ5nj/lKIS9OrBEe9QPADTG\nQ7HWrId0rRFkXXb8urU8APRJgUFKeap5mUtQ7LjNPMz0dhbccew=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwZ2ZoZElaeldaVE0xUElK\nelFWN3ZrS1VzYkFZbENjb0ZMQzA3TWFFTngwCkM0NUJseE5LUHZqUUxxbXB1Rndz\neVBMcWsvdGdNSURsR0xFOFJ3N09lOGsKLS0tIDUyaDRDL3QrcnltaDZHL3dPYmxs\naU1Xc1ZjYmhwV1lINk1UMTcxc1Q4SDgKTt5+DspGwjI2ODiemPgLkGzHnyo05u6y\nJpewiruQhL4WsZgI48Us8WFfyHNc+dLaGplBgJrUadh6S3Fo+QpiVA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcWFwdVFaMHEySmlKTUZq\nNWUxT05UMkhFall3Mzh6NTFIcDZoZUxpZkZVCmJQV0ZmYnFJbTQycXNBWGtLZG5s\nZ2ovc0Nydm1YcXBwdytuWHlRTWFCc2MKLS0tIGFnbzdMOWR1UzVpY2RvWnJFeXlO\nYmU0dWxWNjVTYkFLdW14Qk9jOTZOcUUK6BCenu5Mh8fg6Lia4CBcQgNVTQsTY9Z1\nxSlqi4zOvKRDlE9PNRW/dWas68F/bJCRa8KhUPQ5ZF475Q5FUrbNoA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrWUhZSEl2ckJwZWwzc1Fi\nQ3g5R2RpZzZVdUpFK0ZyTlcvQnZSWkFlaGc4CitPeTM3SDhvb1Z1ZFh6WmNpWFBR\nd1RURnJPbnZlTWtBTHNsa083M2VRZDgKLS0tIFl2Ty9JaGNUWE5VSzU4ZDhUOHBx\nVEtlL3Nwa0ZpWjl2K2ptQ054WUlSSjAKhxcMLryYi7O8CKnFDphV1ojcDaSYFXPL\ngzaX32vI1LOo/doAq0dLC+yLtj1G7f/tE6tK2ax7SCUsAEhTn8QJ4A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHalpIQWNJemFzaDRjM1JC\nUTJydzJPcWhoU3dPQkpjQWF3QVpUc2dhSkVnCkVGbkZQT3V6bWVqdS9KenBlcEpj\nUVdLQzdaRUlkdDIyeEV6bDhPU0VsQ0UKLS0tIHZYUHZVT1M0bm9oN3hwL1NkdWZW\nVVN0SWc2cTAwQWNoVUUrSkdwWHlSZUkKgsejUHV0bc70zNYwQk29KPetAbhiUMBg\nB3QxI8i+D8mJ+/EKFZzllakXK0NeHVDHTcALcyaI3SvIa95PMBczuA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:23:57Z",
+		"mac": "ENC[AES256_GCM,data:g054D4imoqjlpf/2HLfKW62cEJvJxGswSnNS+snyS1mx3+86E1kM256AJhETWl5ZC3qdfzgeobxRIIS1m3U8iajQtYn2nOJ23Njnfu2s9RTAQSCsnJevV+HfmaBDxqt/uS/q6DaXylaXmPINlmsA8Jwr4AiJtIKovm173P9/2hg=,iv:37tf+FpGFw1bv2q2Anc4gu6C9zacBjgh+Z5Xise6jKw=,tag:7HrVKWWkGE4CBF3TsisdzQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/root-password/password-hash/groups/admins
+++ b/vars/per-machine/neptune/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/root-password/password-hash/machines/neptune
+++ b/vars/per-machine/neptune/root-password/password-hash/machines/neptune
@@ -0,0 +1 @@
+../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/root-password/password-hash/secret
+++ b/vars/per-machine/neptune/root-password/password-hash/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:H2KsH0uMgHC/NjEHH04I5hm7k96ZjOITsZ+kzL3y2CEAaauvmmTh7wNxpvG3E7SswbkYx200KXZTxgfY7z+0pmQxvwMzRukwIjpKZLLxUIIfvlZc9qmwpNH+7wo3pwjLQmYJ0OhMO9tzFA==,iv:EmAv1RrWtasq0ViKkAH+TrPYRXdhH+SdLH9hHfFBpnI=,tag:+0TexZJUMyMd9Kt647iM3A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNb0VqN1h0QVdkendqTDVW\nM01kSGtZQkx3Ukw1UFBocUY4OVVxa2JLdVgwCkJEeGpHdlJCQkxnSW95ZlR0UVQv\nRFpmZzdpNVVYeTYxeWdyQUo4c1diZVkKLS0tIDBpdUdSNUVpamJvVy95QmhJbUhO\ndVpJZE5DdXJuSFJDaU5HT3FqNTA3amcKnmQ9DED2jtzConYx8tEQ0O5wkWLLuO/R\nFlpeMWrolziCbcBgraGffbFM3tk6jHqEdWB4r2SH/4U0HtNKBXSJfg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlMFY2cVpWd04rMTlGSWxq\naFNXSGtVU1p1U0x0NVZYV0hGb0wrdnJQQVJjClVkSnkzaVFjNTlrMjNjVGVDSGVF\nd3BJbmZvb3RjV2JkcThuaUNCZjRjNG8KLS0tIE5TbHNoYy9QdTdHZlZ0bHZEUHd1\nSUJ0Z3FpZmVWRWxqVmJUZVYxck8xWnMKVbTYt8zbGkKMuz7f4yOG/EkdYYqfmj03\nKDCVLPqwsRoibsBRpyRine5oOUwzN+PtQeXwHj1vRTjtGzZIgpQIQA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWUZwN1kwTTZHUjNJWUw1\nY1htbUM3dnJrNUFPTStOOGJ6MW1DeUJWcnowCjRObXdGT0pUbjFYZzExaVpMbjhi\nWmF3QzAxaVlSeUkvNUpzcSt4TG1wU1EKLS0tIExDTnNtR3lVRllwRFh1RW05NGRl\nNTVyRWRDNFl0aVAwKzVYNkFKcXNRaUEKv84/fA4ydX7MjuWJA3oYhYkmWHXl3LyN\nIHpWk+7JuZlWaHJGVO/ywQmnEj+aaETpVvh99cKQhHk68dzzSV36lg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHN5MVAyQmRk\nWVRodG5EY2pRc3ZYL3FiWVJCSURlYmd0VTlkeU1FRFE1ZzQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprSEFITXhnVGZhcTE3OTlSdzhmOXF1\nZFA1Zm5ZQVRLUDcrL3NBblhUVEZzCi0tLSBzUUFyR3V2UGFLYVQ4dG03RHZzZmZK\nOGtLMHJWbEYxOGQxL2NnRzVUdHN3Cun6V7ieogvJq02jePVUnX+IOHLnu3RRuVGX\n/PVGf0jRVQLP6u9gXsTa+GO/Ah6hYRsmV9lzq1S27gly5U0CbDI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhlcE9GVVVL\nN3JvTDRxUGNGZTE5ZngwYzVmTzM0ZmJ1N0Z4R2NYSlFobWsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo2U3NMTHAxTGlxU2FSYmVLb1JBbXhZ\ncVpDc080VVpRUHhEaEJQSHVFbzV3Ci0tLSB3bmxZQmNHbThMSEtPb3BjS1JhTmRu\nYUNWMWE2eVBFbk53Wi9HSFNZejEwCigdlrPSwK9e3LcE+U5ZMfy424+gjcXCPtJI\nhDQPkKQ0htljBYFDz2izD/s7qwKOqzTia8u6UPLTopMcGyXpSbs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE9qdHcxd2pS\nRkRXNjlpQWE1UVdudDdGRmdzcEFPditmWTRCbXpobkg1aXcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo2NkRIT3J1VnJzSEhCWjZLM1BtNWkz\nRjFMclJuMVB0U2ZsYkIzaUNEc2lBCi0tLSBQZ3IvK0Vvend0dThqalBwWFE2dExt\nYmk0NVhlY2E3Q2JWbXpMWE1PS1hvCv/w4TeDBqWbyBueaiypFgUu5InTNNuHRKOp\nvr1obhIlz4alQ62mhbLdGB+P3GB0yBkuamUlaOhfNNIk1kuMpt8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzdDdFbnY4OVpDdDcvT2pN\nQXNqdmYxaldmM0R5bGFmWWhlVzVoRWlMMjNjCkdXcUx1NU9KYmt4QUZCLzBYRUNo\ncFNqcjYxcUhFSWE2bjRqU0pzbjRrTmMKLS0tIG91K1RSWWxLaGdHazY2RDQ2VjA2\nV1NpN3p3Tm5sZ01jUUlhazlFNW1VQTgKj6wMVKN354bMWIs1OKAqCFu2+XSQ0KK4\nNxj0kJ3mimOpkZjTCAojuD784feb70gBx+Tgf3Z05jtR/EQBv5TjNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeFBrbUJaWER0dC9ueDM4\nVENqQTkrSHp6elJuLysyaGliOTVPY3ZEb1RFCnJRUWZMQy9tVEZjYlh0ejY2RVBB\nWFlPWXJHcXBTMnRjSjFvblNDQld2L2cKLS0tIHBvSkdST2o5WmRNYnFodkJ4aU5G\nQktFcTdBM2pnT1ZINWkvWit6d1Z3dFEK9abGvVqxqXfSH+vKT85RhlyMUTQjAink\nW/0bH3ToYJpIoqxXk7ZxGWBlA+6To6HUZ5y8fcCFg100LIVtcqT9Ew==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwYTE1cG5kUEN4U1I4b3lP\neXVJRCtzekc2azdWalJTWUJmU2c3N0c5NWk0CjFUelJnMytKbXVCY25YZ0F4RDB0\nRENtcXpwanMwV0xZZ3VYNy9BUjQwck0KLS0tIDZ4TkhXUGJKVnM2bkVHdnZCT0Jp\nR2hYK0dqU3dEVHJna0hsVjVzOVZDR1EKq2/gNYgUozNgWx+A1eWWN/1ci+JGLuC2\n6MSoCDx0ZUg4e5EOmBLRl4CwRUSBJklfhzeCGVh0lOznNBlr0WfMaA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBScGhnbklHZllqMXNrK3NH\naGZtZTNKS3IrU0ZEanFJeG9iaXhmaDNMbkN3CmlybXhLbERkMEVwcDJDS1h6TGEz\ndCs1VHh2MnNQcGVzU2JMVmk3MDZLSTAKLS0tIHVoOU8wN2lSUU16Vjl6ZVJlbUw1\nMjh2U0JoK3pCY0tOWWpxZWcyaGdXeGcKBMyrTPy/8sIl6wLoasD9P0/+D4MI3uMk\n8U9hL+4Hw/8BdRt9rYwbcRX04/oKNXcPiyByHmIjYYF1AJTX07hFiQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:24:05Z",
+		"mac": "ENC[AES256_GCM,data:TQi5XJZPZOhJrYNVqyr9azqo0QAs0Q30qB4BZXQdTN/+mfmDqx+mdJdkMQpSlJaFpbzCZhVGW0reSzCbFOtam73LFsBJZUr0c0RYXq3f8U91FE11czMp9+oau2yY4D/6PzDQbHdJVywj0t2qTrsSHHdF4b/0BdpTpi0goNgbacM=,iv:+xpi5If3k154cekAvrT3/rtII4BsrRg2YFDDRaLjNds=,tag:4GoEX5ZxSkaY8XofCSF8Iw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/neptune/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/root-password/password/groups/admins
+++ b/vars/per-machine/neptune/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/root-password/password/secret
+++ b/vars/per-machine/neptune/root-password/password/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:JatEWUAYacgbFT1oRM0i3oHwoWh2URg+ZX6y9qafiPZujagsx6Ks2AQrGg==,iv:Dd8djrt+mnVkrWgGnfLWOByretizJSJ3+PfYW3bbGVw=,tag:fK3lGIgr2bMtKUifKK7tOA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WU1mbG5UMnU1OVhRQ2p4\nVHU4VUkxTXR4V3VlU3ZQdDYvTzZ5K1IvSXc0ClZGeTRUc2ZyaituMkh5ckFmbzFZ\ncVNycHNDSXZ0dzNPVXJMZlJ0QTk2UXMKLS0tIFNEd1BLNVVXdUM5M2JQT3VLaXIv\nTzFKbW1BYkxPZDFueEs0UEVGUDVBNUEKfP73bJLaJn+xsE0t4kz5PE1+LJqMxwGe\n74m0W8YoVweZHnpUeRcOnsxp0egDAwhgqg+sqpxLfY08L+zpeNSpIA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQUZDWnpEZzVuWWJmUC94\nN3NwSEtNL1ROMnkrUy9VdjNUSFdub1A0VWl3CnhPRWpyUzNvajI3SitZZmVLQ1pB\nc085RU1CUHo3M3Q1em52ZmRnSnhqUFkKLS0tIHM0Qi95Q09CbkZDdEp2cTR3cGZw\nSkpjMjE5aHNMVFFGb1VYRWc0bi96RzQKhi6eXNUbhBeqofDl8WOvzLiD7mGiE7bk\nsctMjwCtHxpQTW0oD7hIMsNyJTduZ9/9rxPfRkmSDcCWYAsVFcBevA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEYxK09HUFNB\nZnVaUXp2RllSejJqTitBa2EveEZFdXpIb0VleHlHK2hweEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo1SlkvNVhtRXMraWtLQWxINFRuNy9E\nZUU1RlBqQ2d6eHQrMDJVK3B1Yys4Ci0tLSBwangzV2xtdHUreTRpLzFnMENQb1VE\nTllTc3RVYzVIeGtZMnhjNllSS1hjCleRr8GWtMiXRvk5IXgIKimKlJ6US26iHz3H\ngJhLHc9WzATHQFoiSnRsYLMRfXXfQDJ62GM6FX9MOZ8bbDdUZ78=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGI2UWIrOVdV\nbml5UmM3WU16YUVDMXJPRElFZVV2YlZtekJURnhuSU5zMkkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo5SDhoYUxHQUJTTUNPa2dYWnA3NlBE\ncFZoTGRjVEpNb055emN3OE96UzBJCi0tLSB6ZEZqc0txNmQ5K0ttN0s5YmpxQU1M\nTEI5MFZaQ0IzL2ZIVi9LZ0pjVkg0CnnCHiCzCg9iyOw+jjei0TmnQDuuhEpxTvLB\n78+JpBnOnVZRMZM/RrguHup2lAMVXSBtu0zddf5wSivr0renXRk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEZiTVJZbzVC\nQ2gxTG1PblRpUmM4QUQ3d2hhZ1YvRjBnT3IrcWljOEp0RE0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpyTm1leGQycmp0bXJqKys2S3VPblFu\nV0pwSS9GQUNFL2N2ekNIUFpVTGM4Ci0tLSBLbUpnVlJuRmpJOVpuRTE0WmlEbEQz\nY2pQbmFCaThtN0ZCTUtGbFVhaDdBCpg+8OIwptyv+WHA/1w0qWXfZH7RIj6Ao1L7\nHQyjOyEi2Y4sRYmgNg9xFKS9bT0Y6jamyXmemCeSmhZg3wg154M=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bEZDOHQ0cGdTa2JTNkhM\nclgwZWducDgvcVp6dlFScTByVHBxdEJWVUM4CnBnYWcxMHdERWNuOW9YRGkyaTBM\nV2M0QnJuWFZ3VXV6V2xIM01LQ21RK28KLS0tIGVyamo5cElVMFYyclZsWEgraW15\nbUxEc0R0SGRoTS9VbTJsZytvbWdCZkEKgwfGoXJgmvmM/QW+7WN6ssGgZuzQLmCz\nCrQWifImc4k9YjUPLyLc+rV5lnUBKiqJZug4RLRCmUvYYlEZBxqWRw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VjBkMnA4ZWloc2NUd3VL\nUHlyL0Q3c3Z4YkJuYTFiMXlwdHpUMW1HSzBBClBUdVQvaW5kRUE1eHpoY0ZMUWNC\na0s3Q3lVTHB2NGpFMk80anZQZzM5SFkKLS0tIFQ0c0QxbFdnTUFLbDdqc052R0tS\nYU8wbWwrWFJTNmdBZzBPdHN4VTMyZ0kKdsJa1r1GA/Ya93rbh/FkVEhK1QcfV+UF\nQMqjRfe9s2UIdRiMk+osPyV2Fr9L9ncIMw/5Eqdh1cJm04m7rAMN7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TUxlNmN1SWxxbVA1bHdO\nL0RFS2hDbzJ5Mk1sNVZVYlVvZ0VFTVp4d0RVCkRjZ0lhOEhnMVM4cDBQMjJVYlll\nc25rdWo5VTdyY0w5Mnhxdm1ubXdnbDgKLS0tIEZSQ3Z6c0lzQTJDOFZSR0dTR3BH\nbkorOWNLZkFSY0hYY1hIODFqMGNpczQKgnl7vH2fRrW2sGCxAlTnf0/9aTGWbXGX\n6OtGMfAIv9vZWXi65CpVwPFfx5f8yoydWTLOc8Pf/e5N+ZOZP3U2JA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3TmZmdk1qV0ZFYVorZXdy\nR0d0bUhkbGdqWTByM21kZForMUpMbTk2UG4wCjN0dURpRytnWW1peGRYL2Uwc29R\nSWF2ZENjWXlpQlpWamJEeE5SUlVrVVEKLS0tIEgvbjR6MFJVM0taMU9zV2orMmVB\nRVdrcG4xOEp5aFdpYlRtL050Q3ViR0kKZ8SzmPVVgDYshXyoFXiGvgvAnAKNI5qm\nQsV6tKCbuY+07yTSEtUo7B0htfS3k7YQqxC6dBEOODtM5C0yXcxzHA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:24:04Z",
+		"mac": "ENC[AES256_GCM,data:yWNfoYh1Yj6PctGH2sc0XHb32PkK7fH+pC7KdVBjqL6jOEeUmJeJUV1Krxw0lzHG/Z7iDsgVryVxT0CkZ9pmQsNe6HAVM33gd3snqhdSm9x690vAezWde3rqu/JelU01HTgrLnxWVdJcv3R1XM06BvJ64rzZPs0N4kjuketeIKk=,iv:oHOAzASEVZunFHUcXPTXFoXUw10hBeEwxYBRdpQI1cI=,tag:obZUAhewwsLVdrdHxLYg5Q==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/root-password/password/users/kurogeek
+++ b/vars/per-machine/neptune/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:6f1e:6b42:c153:5461:a48:bced:d936
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/machines/neptune
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/machines/neptune
@@ -0,0 +1 @@
+../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:mE1tSqDTrnvGFZIlA/Hzceg6NB0ZMGpu0XACSYlpLMyobqEa9RSsTUX+hyBrmTo0A9PosHTscmI4NmHWU73UAnTwOFkMwi6jebEKXDdIZU0YX0kus5blToe5Li0HTMhTR56GNPptywGjZsPGa3+zAOIh3TH8YMD4W8opdlisegTgG1d4On/rp+l6jcwRehCbL36pGmYKJg==,iv:cEK7BnP6CFLV4Fbrxs2CU68pvVxs6baR2/xXsAr8Gu4=,tag:iS7BahlN0GEjP+yj7FMo8g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkL0lNSm15QzlTQWZPZHVx\nRHp3UHJSR3hrQkVZYVVjOTBoMjhDcVE5elI4Cm83eGt6RXZLYzdsbk1QcndPWS9j\nanBDMTJwNEJ4enEyMy82cmc1ZHRyN1kKLS0tIHJsRzRSQVRNOWhFYmZWcFlRQlc1\ncGlFOXY4aHhlQU1iOUlJMlpvZktKNkEKRBvYL41kpcRYQhB112CYn3mAAGhzgH9O\ntl3dx12ziBAu3w2NNi9Kx56FTVwP/5MC5fa0z7/FEitW2qkVzXerXA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByckhBVmRvMEZCQWpHaTRv\nMDVlVzgwZmsxQmVhV3RHOHNVUlVVUlhYaFFRCjZ2ZmYrQkVuaVV1VjdCUkpieUVl\nUXRGektvdzNMTGdSN25IM1ZNSVVQbUkKLS0tIFNlMFRia3VBQ3dEZWdVb0tyU1l0\nZFJ1ZzBIMUM0OVVyUGRuOWxjT09xU0EKtwMOhar5P3NZlBnvugSzjTOUzG+3EzQh\nIKtn4ZtHVGL91VFYJwl6GpYmuaZM+bBQ9DfSf9xTtDelADJlv0NGVQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNQXF4Njc4MTN1Sm41VG5m\nR2UvS0pGajNlQjAyUHZUUDRyOWhqdmZnWFI0Cm1GUXZnY3VrbGpET3BoVTNyMTNC\nVldTcFprQ1dsK3JRbDB6eGh1R1FWbEUKLS0tIE9ib291VWV5dC9JaVVHODA3Rlh0\nalpnaE5sWUtGMzhhZWd2b0d4aHJLQmsK4SbS4M4n92o0Lk1ZnSjuXHvjKhwNBmlj\nMUZBAnXaPYRpvGNWdXmTaSkxXcJUTtJvrLqctBDDbIciEHyHOueQLg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFl3R3A2SENl\nWkFsdXRQOEs0dlFaSmVsYU5acWJxcWVrWGtUN0hDRXNvbVUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3K0pSN21ZUnhRRDR2TUo3b0MyTERy\nVTRkY1BTM1ZDbDZ0d3ZvZlJlM0t3Ci0tLSBITmlWMHpld1YwRmc4WmFLZDZsVzN4\naEk0aGVvTzBzcTRPUDJSekhycXJrCsW1R583IwdojY4bUSQspEdGVDXci1cWrScb\n6dpeYu9uWB0JiesaDJ/arF4FbA7bDMKC3WT6t8dvDdqPzwaMTyM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1xQ2YybXI1\nTFhEaXg4all6TVJFNW5WTEtKWDBRci9Zd3kvaG5odlB5aVEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpwd0UwcnZXemxkRDQvM2ZlWXRicEIv\nMDNra0txZkRTblRWbDQrMHBETkZNCi0tLSBNckdIT3h4aGF4N2xvNWtVakxIWUx6\nMUM1MlI3R1lqQ00yNkhMaSs1OG5JCrhuqHWE8aSoir4rYWtmZ8P+vL+gyxdvL3+n\n9iFyRiq9k74iyZ5qojiIOYhJIIis5Ygxygi/qDQm0/tqr7Vg7gE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEJBKzlIK0pY\nbmZpR0ZxYzBXVkREdmx4Z0pudDBHWHA5MVZkQ2R3em5WMncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp3SStKRzBTQ2loWkpidkJSZWdSYk1k\nNmFvOGpVWUhhNjJvckxKbDFOQVBzCi0tLSBEdE55NUhpSDR6U1FMRHhsVDVuYWZt\ncXBNVHBRVGQ2dm5rYkwvNTB4OEFvCl0/SrhvHrMD5O6bjUeOoXDeZjwsFdq636kz\nQvzC2t1rtthWo7oCKsTDV7wDCRIhqUeKnQlc5vb3ssQTzWByn1k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYQnIxVUNJV0JDY0xEZkFs\nc0F0QmNuY0xyM3l3MHYyOUJ4MVprbXNMVGpBCnpuUXJkTUZGb2RlMWdiYkpTZVRn\ndWpDSUtiT3pSNlVaaWZNVWR1NWFrRmcKLS0tIGFNTGt2N3JUeDNmQmRkZTBoUVJF\ndVhuRnJFa0ZWM1ZKSWUwMTRTUUlsRU0KkrDp96Evmf4vNnBeB0DWI7j6/t/3+T+C\n3OtG4xohL1R1tPzsaWeKRoSAzAMgAYWC2eSnJPT2xyN2ppGqu1Hu2g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqU09xVUJoU1NiQ2FwSG1E\nUElvVzJUTXNGMEtCQ2d5YVdkcWZpY3crVVFFCmc2My9XRzd4bzducHRwblcwOVhL\nelE5SHh4SXczVVF3c1dZaHR1WUpsS00KLS0tIFdCcmwyN1IzUmNRd3preUxxNGpD\nZzE3WVZyOG1RdWNRNXZ2ZUNtdEJnS1UKzmYfhhYiwmeNvpqFWgJdU5ogN5COd4j1\nc6aJ0QrdU7fnKQrAeYTbUCm3Hb0M02pzPLUiYgJVB86Nwlp8u/5TQg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Q3lwY0RZVC96NWNQUkhC\nOEpFYURlOUlpZjZHd3hBTVJhOVQ5azAwZUJ3Ckt5bXRWWmttUXduWTBZeWJxYkh2\nQ01QaXNicEdTcFpENTJ6Ti94YnBnZ3MKLS0tIGxCZUQ5ZVJXdDZxUWxMQ1R0ZU80\nSGUwZkRuM2hnNWNCeXhsRG9MNWViR28Kza+JHzNBnoSXz63q6nPEP+Zg//S9kn0J\nZj2GEgaK5X/VENf16blgwMvXuY1xGj+s91X+H4ZLudIQD4b9i6lk4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5bDdONmpwaC9PNFhYTGtj\nQm9RNUJoTUxPWG5BZkRqeGVRa2Fyd3VUQkFJCkRUZENaQndmcDhqRG9KSVNmN3VS\na1JlaWdWNW1lUllqa1hUZXdRTGVJdXMKLS0tIHNxUG5rdWwvTTQxeUhmbHE5a3Jv\nMy9jd1B0WHZxMHk0QXRIS0R4WlFUN1EKlSYbI89l0FaFSe2m/bTuccqP++0vNcBq\nbdD+Y0weyMuh9NvdbH+4wL2do/MgXNrGKKiBk8lIcwb6cUdbY5du7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-21T08:57:30Z",
+		"mac": "ENC[AES256_GCM,data:YV48MhAcKoE7BfYnAE4UrAl32Nv34KeliHuWhpf4hs5XE7675w/7nibYGOjgwLk5DO4HlalbRKHQzpxZJUHKZcWaNddc5k0rZIUm8is8n1B7MMA87Z1ZPuB5L/fRAhv9mdHCxBKL27X0FagiLxv5hZ1KXmxwu1HnP5s/V9+4ZlE=,iv:xqYactk9mfoMCyxtFUn/4iHdDsmtzxlntBvZjOR+p08=,tag:kF4bDKj7svRYeZvd5SwOMQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-subnet/value
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-subnet/value
@@ -0,0 +1 @@
+300:6f1e:6b42:c153::/64
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:8572:6695:fdef:15d6:6c5:698f:3ba4
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/machines/rigel
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:1dMtSGsh6eNkg3U4ReHxGbrGzomkthx8mtui7E58pk6f15tj7hFWpa3IKwGMXgszMWdnfIYIKT/eImz57P3/2Y/goBYZFCY9NuQztuSJx4BVgKn5vHJyGTWPRoEn1wKq1Py8PFubmsGmqxCSdtzRjc3q6ASoE21aknzg1E6suGOgX/Udt+ClQftaTqqardTGH/+QzzWLgA==,iv:0IGBhwFZzgeF3Q3BKsPoPStuvtBo+59N2NHR3wUUgQ8=,tag:9+HPTQK8uu+eeRLkMkUKWg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSUkRPSDR2ZTRNYmFVRXVa\nWU5LUTh1amdmSDFVQmhzZUp5ZW9Dcm1tYm1NCnJsVHdTWUYzbWV3UkVVeWVDRWlD\ndGJHQ0JkMU9RL2dNZnR3Vjc1blBMNkUKLS0tIHoyVnJmU0lKTG5seWVKTlN2UmFu\ncXNPcXJUOXpzMzl0MkZGejAxZ3VGc0EKS8OAKVR1APSdneX2wG0kOLPAcQqk0pXi\nuyzQvir3fJLsn27tnQ28owTRRZ+bF8W4hXFOhhFKMW9I0QfCEcfWng==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYdm9tYk9WWEUxUnpsYTNa\nMU1oYlcwOHRNdHhHamlBcHFWbW54Z09sMkg4CnFocWFUVXlQd3U2cUxmK0pXL2t2\nWUtOMEpNdmZnSDFoRDRGejRXVnd2RVEKLS0tIHVuV3oxSDJjZGpkS1NZMHMyR3Nn\nUXlkMXJzcVhMbmVvU3ZvYXltUkt5dHcKR8vpS/UKyMJ2hbtkBisJhR40RQFgBOa1\nE6l98MmLTRqzXzWcGUtx0KJIn1N5WYzObLDL+Ozame5tPPyXh1LufQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9zSmFScVJi\nUkFjVGRUbmpYMkNxamd2WHFidHdZT1NMSDJoQitYSVRPd0EgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp2bXJqWmNDRXc2V3l0SVdVNlIwRWJQ\nMGhmdDE2c2VzV2hyTlJDNzQvN1A0Ci0tLSBpZmc1RU9JTExvNGhVeGdYL1llRnFD\nclFjR08xVkhhdURaVDIrUVlxb2FvCsGgkwtlSkVYuv5ryExZ4pPW6nhzSfRRWU3S\nONCdxRzFZvRk2pjQnAVh/kZjahUXnBkIVhcq1Q3eYA2lyXxct1s=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHpaRGZhSlBa\nOE0zK08vZVpjaCt2cGI2aU1TcGZXR1UzSit5U0c4S3VnMHMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpzK250Skh6bkhzc0NyM2lVeWs5T013\nVFJ3R2J6VU1qdGh4N24yQmgxamVrCi0tLSA5bVNrYXhnSVZnNy9ZM3hxczFMWWJs\nRitlWFcwelZ5cEFxWFNWOTBoVlQwCjEqDW9t4SvIF2Ssft+vpnIYQ/FqBGaC6MOk\nhJMa1SxEyCJ4Ey4w/3EzlRybAZpSOfrHKsYi81IjN53zMMuCk9s=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5ac0Njd0lJ\nQ2kvcVQ5dTBhUmV6eUk1cll2K3lydWR3aXQwUlVHa3ZlQ3cgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6TXdDZEJvREtYblhuZ1pXVmp3Y0RE\nZyswOWhXZ0owSDRFQW40WFU5WVQ0Ci0tLSBDVnd6R2tBS1Y2M2NWd1owSDRmOXdO\nbEtOT3BNd0IzcHo5azVaWnBnQWh3CtPclvQu9at0hYpBkRywzG+Ar399azaEM22K\nHTikQgyAt3hwnxanAa6DFEtK3mggHK9bUQeFcAZd2/jCYprpNsA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTcnVBZ3Zid3NYdEdML2VG\nMDEzOFkrSDRuYkp0YThtKzBHQVRrRWlFa0VFCmIvQXRhRXNzY01hYTJiZkd0LzFS\nVm15K08zV3hzd0YvamhNNW1YQTVCTTQKLS0tIHYzNGptSkRnT2cwMUh4Ym44d0Ex\nd0owbzFUeTZUQmNNUHFEdzgyZ2NCZXMKm6vZhqi0LCyRZXNtF3M2pGfitexaBi9j\n5OuNC19YiNfTzLm0LRMuDjpzuypGJwzo3oSZH322aZNqvhgDfgx9WQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZWE1JcHJvU0pPMFRvU2tX\nejV3REdJUWxtYnk5VVlyR0doMVNiMUdGWFJNCmY2S3FacDRQR1FhOFN1c0dmOSta\nQkdyaTd4RnNYK0ZsOEhnUVEzdmhETE0KLS0tIFVSV2VFUmxQWGIyNWc1Mmx3cVhu\nZ0ZESURhcEc4cUw4T3haVVVTR1VuL1UK1YNbgSTxHAk9/5zuQ+44qSBR05Rx78Ln\n9g28PwfmccyizNNcuRVP71MOosATDS+FAkEIT02N+A8l3MeaSZ19Xg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5UDBQNHM2TzVKU0krOHZy\nRjl6cy9QME5GTUtxWU15K1ZrL2YvUjNzNEQ0CnUxd0tqNGxHVGZ5RWxLc3ExMEFj\nMGhzZm4rdFcwa2FBeGhvRUh5UnYveUEKLS0tIDBYQTdRQmhhVHR4U3d0amhJUnhU\nbXBPTCtoR1YrT2orQ1V2RkNlYkJuMmMKPD65HPvOQgPvuGp//PvDR/Pa87nTGeRG\n682MvdjUmDxLi5liRhoRvnMYN5P5aNP79/L5PSp0BrqDM1Dqxx8ZTA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3Z2lZcmhGSENRcDR6RVBx\nT2xLSEVleXJ3ZXZ6SkFJR0RMYzc0T0gybkhNCkthODZkbWptbnBKU1BpaVdBbGJX\nQTh6dU9CTlhDRjhaUnVxYy9yaDIzdEUKLS0tIGphcjBKREhPc3NHYmZMYVpLbnpR\nMEQzME05VCtxWFVQcVlCUXZEdUh0UlEK3PKmi8lZAFP80wbdjkXjU0a2xjw9xX9b\n5eGV53ULQXMpWaDHwpjYMxxi20bDjEVOgzphrhxyJt3hy+kSNBYN7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-21T08:57:45Z",
+		"mac": "ENC[AES256_GCM,data:bG7lqye0VqkkK7wtR8zoGqJPuphSOYw7QVNqxq7q0dr35yVjesGkJ7Y74+D/1qaeUXKbWnrDTGIAqYfdHXrWuyIuc+Ry77PA4keKFGbaa78GKuvUXrW2dTDd2G02YDGavpsYKbP1qUumPYjZ5NLkwZnHEo5GHRbdfj2l4AYrTEw=,iv:0qu47k2G/Yt99nGhz3fL6ScjScO11CdDLbU79Xkl08E=,tag:31lBmsiBRY4akCQTPIZ66w==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-subnet/value
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-subnet/value
@@ -0,0 +1 @@
+300:8572:6695:fdef::/64
--- a/vars/per-machine/rigel/zerotier/zerotier-identity-secret/groups/admins
+++ b/vars/per-machine/rigel/zerotier/zerotier-identity-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/zerotier/zerotier-identity-secret/machines/rigel
+++ b/vars/per-machine/rigel/zerotier/zerotier-identity-secret/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/rigel/zerotier/zerotier-identity-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:HyP/Y+xjRTrixNZ6sZS4wMix3KXEYckSEhOBzUA2qS3XSB+1VyVPUCfAQjyV0jjzUAvXa8cYo5NpQIqV6whLasTTX8TgROkjlh1bIkRzrxVfZ3Rzsp25y7ZtyvTOZT12OJqmQb9LVI14eL5aG7JRRwpsff2VxqXbfynz2G3XvhCsaF3cb0rGVaE1AhJNN7E9jLkmLyxFTYkuFNZBw4FmP3CMeQTwnRsV8PUAs1HLeGoU/8rs3apK0VS7UXeFSXxIMK7tygPa3Bzu9nEqFTfL1fOIHXjiMwWisn7Rs0sIKVd6vBY5WPclV4Q6mk1KJD+BfhljPWs8Wu9a98A/j2imKXF1TQe1aGVFLTMDmhMM,iv:A8WntsxBmFW3fp2bVSPhfcxj1/K3MRr6e4vxquY0YG8=,tag:vqKuaeEPH0oI19iTEF5/jw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUaWlpWXZJRno3Z2I0K003\nQk5RVmYwS25GdStuYU1taVB1a2cwbXVnSHk0CmpvbEhsdVl2RTlUcHlMRjhNZG9j\ndDJqQnBIOTNYWTRYLzQ1OTRueGFvaGcKLS0tIEN2SVB2QUhTZUdGaDl6SVBHak9G\naWtkT1ZDLzBQVDhHV3krZ3F3OGUzN0EKggPAMl3Z/U+1xOGB3syCnBG5IkkYp3k8\nEVI8ZNqP1AfKK8Cnc16lZ8ImLBjZnh8OdNJUSdemrCfxYnkxk9bUoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvV2I0MFNnTERvTGExb1Q0\ndld3VjBNQjhVaFpJdzlxYWE0N05tc0N4YVY4CkUxU3RIdzl1Y0dSTTFVZ2UwUjRG\naW5FaG1vaHBzcVU3QmMvU2swM0lLWTQKLS0tIGRLYXZ4Ly94RExMeER1UjJ5NUlB\nTGV3MWFlNHJDTisvZUphWFc4b1hRd1EKZ2IQcUpBTZq2+SkPbsLHNgsb3K/63QNu\nNQr886LiO8ERLw9NZ87WG2p50FHRNKAviTZm9XZf/AgGdBH+cpvg7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFk5ZzRCeXNx\nZ0pUeWlSVXRTYjMyeHRJRmNCSitDL2JEeFc1czU1VUpxVEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpGSlY0dkduZWREK09tRGtmeWVzMW1o\nOTB1WmJ5YTBKeVJZUTJHYXM2dlB3Ci0tLSB5Mnk0R2VQOHNyUVlVaytKUU5GMGtx\ndW5oTGtLQ0RQRUxKRktNeS9FSEF3CgG0zNOuH54TxGzBFFgvMVCtDh/6nyhwWi/m\nUNOtZrlcT7qwaqBvMSjGjnWAEqwr+s15P9wi2lPX/UdVUpXa2N4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEVvNzJ3YlFW\nd0YrenJZcHdQK2YyYzNGa3BqY2ZVeElyQmkxMlJuSHlVMHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwowbDB0akhEZG5weklKNmxxa1VzbmhY\nR1QraHErWCtZa0F5aTdkWGVKRkZzCi0tLSBOR1NNQkdDWmlwZ3NaSTVhaW4rN1Nk\nZkUrMklBb3NmeXN0QTY0cGFXRUZFCkzEyNFrzpKxFENcq84i2dSsBp6ltOAIt3CZ\ncHDCmL29d5/LjWrb4Qbp8lPYPr94kJLbtAoL1JmN+hAJqCY7JVI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpNaUFzYmY3\nQk1ncEFYM1RkZTJQY2JTR0RWbWFENkRhalVtUDcyZXNjVU0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwphNkVjYUcwRnN3RWJCMTRXT1hlcVA2\nMGFWUzFRTFlUbTUyR2Z4WlVDbk9JCi0tLSBBVFhlUnlxbWQ3WU9KL0t6a0tNMkF3\nTjBybHZWOVhnL0oyemxQR2Zwbk1NCmQL+jg7YhafYZMP00eQvJpNwvXK4sSJ6pPd\nONYhdpYWSqorv6O53ch9ipDhL6X3RPgHRyX3R+fIFstArOtOWvs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNTFiRjJud3FTN1lZNDY3\nTFNKQStzSGVzaC9MMjI5ZVJ0Z1BzWW5TSkVZCkhwNit5dTkwbWRncTRkNm1URDJN\nZlJrNlMyL1dRRWlRTUYrOXFjamVtVk0KLS0tIE1Wd0pTdkVRdXFlQjhhTnY4WlNV\nclRacUV2bGZmalV2bkhVWEtWbXM0blUKpjB3n1v/2ZGSHwZB6VqQDmvBpQJ+C8lM\nThKdQL9BqWhizig2Y1sYuXSSbktcsme6AabDNh/7FkrfRW8HGbXj6A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQXZpbkMvc1cySk43cWdN\nSzZTdTRpR2czR0crMXJtTUxNazBjU0FkV0U4CmJmcG01SHhOTk5wVjNrNmE0N1VD\nYVMyZGg3Zk15MlZwRTZsS1Y1Q2lxRzQKLS0tIE5zditwbkc3dU10RVlPUWJCWEUw\nUHZpbC82bG0vdy9veXhtazA1ckR0MjgKmwJI23KxoGn7QPkcxYnOYQfHG2qdQzzK\nm2+qXvA8Iful/7sB71GvcUoSFMqvR8jDo84PO3tUuFPZvgf3CfITJg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrODlOWnl3R0lVM2ZJYVQ1\nczdKcnZWTmEzS3U0akhvL1RZbDc4ZFJNU2hRCmplQlhOZU9kdy9iUmV1eHk2M3Ns\nZTJDdDlnZ2tEd3dtVTNVVmJCME56K0EKLS0tIEoxTUwxcmYrSHdpbzlnOEVSYS84\nUlV3RlNNa25RZXpQTXNTUXp4ckxnd0kK2sRFVRZ/7uaB8S9wfEVO05fNlwXH7Cf6\nT/rRpXAvjGSABWq6Fwzt5dPvIf7iKntYHHP3RHsB3dBoxhQayEFoZw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxa1hzSlFtNndUeWNad3g1\nZWFsV3dGQjRVem9SZS81WU5iWTdDNGtZRXhnCkFTT0tOSng1RWtRODROZStxNmd1\nODNQQndGSk1wcUFvdjlRYUM3ZHJMMjAKLS0tIDFZS0dlMXZ2QTdLdFRhT2szSksz\nZitZcU9MendCbkQ5NXVHSDY4TXByRncK8CajXcPrPFpMnOGWlx0Cp1boK9fujUbc\nN8Uz7J++4wsZF68Pri2a1fCHXXDRtkPYQi2IDvuAtVslC21rFJp5pQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-24T08:01:35Z",
+		"mac": "ENC[AES256_GCM,data:0U1N+gx4OChXGJBoXLurTsiCshv1kx1aQLnDT+Yu5+igWS60XgtIrkbriy7SMbL1eGrEZWjtuIKw4QEN0alkNWFb1h6T1fYYKQaenKK/dUTautgpfAyxElDNJZ9bBVnYAH4axCvYuR7W5kgqvfLagXQU2D6fpargfdHWxG41J3g=,iv:czkt4doampkV+5X2NXIG23cEzJIrBSN0co2IzRQAMks=,tag:yWyBfOwg9cRzc5xoMFiW7g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/rigel/zerotier/zerotier-identity-secret/users/kurogeek
+++ b/vars/per-machine/rigel/zerotier/zerotier-identity-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rigel/zerotier/zerotier-ip/value
+++ b/vars/per-machine/rigel/zerotier/zerotier-ip/value
@@ -0,0 +1 @@
+fd79:fada:fbe9:8c5d:d899:9379:fada:fbe9
--- a/vars/per-machine/rigel/zerotier/zerotier-network-id/value
+++ b/vars/per-machine/rigel/zerotier/zerotier-network-id/value
@@ -0,0 +1 @@
+79fadafbe98c5dd8
--- a/vars/per-machine/vega/nextcloud/adminpassFile/groups/admins
+++ b/vars/per-machine/vega/nextcloud/adminpassFile/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/nextcloud/adminpassFile/machines/vega
+++ b/vars/per-machine/vega/nextcloud/adminpassFile/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/nextcloud/adminpassFile/secret
+++ b/vars/per-machine/vega/nextcloud/adminpassFile/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:8WNZYX0r9a8TGoO4JiogOZmgv3jDEQ2B5Ubc6JE5dNdokQ==,iv:WupqJ9NLHRdKEcMFd3JviX1CL0FSrri/hxL4ePnPs/A=,tag:kvlS0bwOikdSsyhIo6Gbow==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGZPY1hZL214\ncVJ2bm9qTmR0MHZFY1VtVjdDT0h2c2ZPUTVIOFFVWDdNd3cgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo1NjRpNllvOFhJNnI4VDRHUWtnMndw\nUVZDTzRTK0FLb1orYm9WaXR1d3ZRCi0tLSBnWSt6Y2FaZ3NTRmREUGpvc0QxWFdz\naUQ4eVlpRlQvYXlhTmRiNjZZR2RVCjadjzYus2Ao4x8UvciVQl++kU3ie6I4tu2F\nhpZdq9+knbzUopWX4A0jdrBwUlu4im1IgBqqJlWxG333ThcVBdo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExMZzU2Y3do\nck1zRktzT0hYT01rUmlQWmlodHVjZW1EYzdoUlE2enhyVDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpFR3hrcnJYdkx1NWMzeEFPOXVic29h\nYUdpOGo4SnUvRkFKTGlRZmdjZ2dNCi0tLSBGQlFPeGJsU1IvcnNUMTdVQmZiajc4\nTkFKMU1vYURseWR5eGFCT0FpaHIwCkwK8EXaRMCtNqqzR3gaklpTULy+2ACNDeAw\nyJVRm+Svx+4/bjt/LoKcNtaMEjIPuUHR66ffs3H0Dd9bLSetHu0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdHZ4ZlZJWXFRTzFIKzdB\nNVh1TVFnREhvVGM3MU04RWRNcE92bk8xWno4CkNOQkt0TERzMWFXYmlSbXJZWCtI\nYTdCMzUrcVJaNmR0U3lBUENIazhlRWMKLS0tIHNHb1JiV2JyRmVKRDkyV2VlTkNq\nVmVLdWk4SnJCMEcrZysraDFhS2hwYWMKlpCitnwEx8yzJ5tcPukGXrJLvSzP4gk+\nHk51WG4V8M/wLJ01CPniCSmkC8s5uUCeiEbsTieWik+oLc71ZqbzUw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpTU45bVU4SDZPb1hUMEJ6\nYUZlRzBpM2d0ZWZHZ0piVU5RQWpSVitxSUd3CnVqMFNvWGRJQXNTakJOa1ZJTXdV\nSDIyZkNkc1hGVDJpVk1keTFtSkRCRjQKLS0tIHFKRWZCSjROdWEwdDJHQThqYkk5\nc2E3QTRyZGRLZ3RoaWNRREhVSkJFUzAKUKDVxGcDm2+0l8OxcuEMJhwJuhc2uH3K\n4qWQP9YeFwTh79Dltq8+mBSxKXFzM4HVvMhUl+2WrDccwDK2UUN1Xw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqKzhERDBRaGtReVZ1UmNN\nMlBianQzaTRWcEZPWlZ6cVI2ZENUQ3NuWVVZCmJvRHFyK1Jzc2h4UDVoZkZYU2lT\nZCtCczZPWUdvOVBvb1FUUVJlQk1XM3cKLS0tIG5kYU81N1ZRS3hWTzRyTE5CbWJ2\nalJkZ3B4VXh0OFpSR0gyK3BSQ0tWZ3cKa78Y1SpbIsQvRKhUyEkIwHZSc5Rw3GBV\n/7OlMibkSzNm1tgHe12jA8c+z6wj5qxS6LxPOdRnvKZlqBzA/QIMIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2NVRGbzFCY2RKMktSMHpo\nRE1Lc2VpZGxmNktWdE1XTHd6VHB3Z2ZwWEY0ClovQkMvS3g2Uk9OcTBzUnUzdm9x\nT2RudkRNT0JlbHNNVlpYZ3dDeVNwdmMKLS0tIFZUcHU2dk1nQWt5S2NGbmtpaWp2\nQW5SN1p5VGRyekQ2M3Y1NmFCSXJkQncKEXtJZnjAPmxWqch3sP4ZMwCYNttsWIfK\njZEJxZqJOmbgGYGRoXy8J1+/BQHSiqRwSJLSxW+2KlFq93gv9Cd0zA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBua3A3am03ejZ3ZGZYZjBP\nMXJNUDY5MmtzMkdwQXJDNzFTcS9Sc0Z4MVFvCnBoZkhJZUdYdHhnc0VtZWRMOVNm\nbTd5TEtJY3NTcWtqSS95ak9CNHBuL0kKLS0tIGtXVlp1Nm5jUktzK0ZYbUNlTExV\nbUhhOEM3NlUxRVhydDFKVVRxS3RCRGcKgdKLJasZC1nNakRHoRVl++T4huNIOVzJ\n5wgnP51BRfi/SAtKfGcBoK4gBB427EUwUClVe4fdWF5MG3YK8M2fmA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRlhOeU1BY0lpMTM5bTc4\ndlkwOW0xbVJrQkM2a0tPR0ZRZit0TXUzQkFVCjd3K0JRelF1L1V2bDVBRFJEejY3\neGpWeHdZVDJnTTZRTkFJZjZ3TUtVc1kKLS0tIG9IS2owUUJBbFBnVVM0VkVNL3J6\nQmtqL0JxRWIzc2dKMzNQc0JkN3Y3aGMKs7r7yenHL+rTlv7mqS6MEeyVKtCrwnjK\nu92lVy5QGnx7+/I8Iy+blaLAiQlsN+AEFHun6aH26+cK66T+SVzipA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cW9rV1VrVXVHNDJENVQz\nb2sxNHVGSzFtMFdxaWUwSnRzcW54OHViRURzCjFJeFNYSnk4b3ZVbXlxdGQ2L3li\nc2dTQTVFejNRbE4xblJrYnBpb01SeHMKLS0tIHNtLzdkcGszemdRSHNmTzRGTk9Q\nU3hMeDV0SFI1VzlOaTBuK3Z4WUZreDgKjA9NFwaNXzQamVgmTxReONTfXZCGlixD\nwxpJjC0V6P03Eu9B9HB8T4sSXSXsRKL2k3H9BcGCKu5xNhqG6zAUbA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHg5MlNGdHdP\naW4zbHhBa0Z2L0tpS3J6MmFlV2QzVmxJRlBVL3dQWEl4WDQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3QytPSkFDUFV0d1h0UTFOWm0yT2lu\neEVPSDVBRC9aV0hzZmEzYXpyT0c0Ci0tLSBQc28xZ1RlY2dIak9ITHVuMUF3VGZa\nNDdEVkI0c3ZXdi9FRWdWSG1nRWhRCukr1O74W/LgHpNExNf21Ph5mCs2vdV3yqJS\nX3GRWmwqGKNxl4c4TOacQ/gvJIDg7LYH5KQEXxcvNnFwBx87F+M=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T07:08:26Z",
+		"mac": "ENC[AES256_GCM,data:q1ZwaPw1WOhfFvkBltOHh3LXfhDReHy9AD9VN9NUhY5eiPUwEIAjNu4z2vdknaNtzPCwYp6uERdH66D9l4saxyGOROhUKl8GDDsPs+cYXderSHXQeOEB0knW851/BQaaicmSzH2WbpbDUqmwCdDfz2rJ51r0KRB9X0HUHnTWzZw=,iv:jKIIHUCQWxLuuB5vipslI/3JC45d27yyyaXX5N/uKJU=,tag:nx9zwXVAQ/zfQPfQI1MK4A==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/nextcloud/adminpassFile/users/kurogeek
+++ b/vars/per-machine/vega/nextcloud/adminpassFile/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPv0QjFM0mBgOprFKcStm105vdgH1mbx6f+1X7P5UH7j 
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519/machines/vega
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:vYNRYtA8xBb5eqlVk/cnWUCr2EfvyGW0imm0tV8Nnqeik7qVDQe9hyHNdvMrD6zpICor5LfNQAb45fYGtsIRPyV3cSU7HrD0qmNeDLP9lgsQFrAHCJaQz2Om0tOM0tHLP0fuUpWpaYtjPIl+5P7PiQV4rzO79cGc0mO2VfQbJI68ugRBb4md6zEF7UarKx1bi/tlKlrix1F9PpQvh4Sd0fJDFs3yiOz/tQLiXqzW4Fk1olqSZcqU4Ogdbs5tASmlCdzqrM2Qr77Gr33FmrvG+A0DOM3FUSCFVCJjaYRyC+bof0EbSthG0pROyx0vA+rPIXiCq6lr9xBocC97m7dEtIQEZlQKwJv/ulxnX/9YL3Km9tIBrm5ir7nhU3D/5alfjPHPPKJ0BUTCUku3A+3CeeorgGVrZupcX3rDlk9rd3i8M2+ucbr5X3/xMfvDXDCNx/Fj+e3gX6iMcftldIKNi4bY9zET1Do3NAsJtMxUBNgsBtKw0EuccN2H0TV25lCTiAqx,iv:Tk/ZfnU78z96EN81ixQR6XyL5C8lG9d94MJ81xW5eFQ=,tag:gpt1ACabLL4YGWxZmL0ECA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZRUDJDMmdM\nZTQxNDhWYjVCMHpXVWFac3AxVU83UktnQjZFTUJlWFZSM3MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp4NTRpbzkvVWtvNWplanFtQlhHVHo0\nSmpDUTJwTGxtZHB1bVNaTlowc1lrCi0tLSBtWFI3Q2g0eXdkRGRPakFiOTVQUk9Q\nYXNJeHZ4ai9vYW1hNGdITTNBRjZBCu3l23xWd61ULPtmz51vZp5XkuaQSNF6gmsN\n2HIqpwUA/2OnzXfpzWwZySlIoFdVe+J3UAZBZ7K+eYAzoSc3BDo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdjbWRnd0RP\nZUErbWlOQ290SHJSbFdaazVnZlZIQVVObW1pd2NrY2dzVk0gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpFSDRjcWVYVm4ydnFuNlI5aGlvbnBp\nbWJCaGtDcy82UWphUlpWM25QVmNVCi0tLSA2MkN6c3MzOTlEdEVIVnlFTGZJQ3VP\naWlPOXBvUCtHRWl3a04rM0ZYdkE4Co8mML7PcjvnmNiCICZGw8YmT4WjMbP24fb0\n9yU83OiRSVlcKYKekh2jSNf95mxn7D8Dbq+ZAZRIxQ2FkefW6hg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpNXJ5SFV0bmVaOEx5SW1J\nTjFnV1h4SktDZ2xmVForN1I2ZjlpdTRidWhnCmRZanlVK2x1NjNsd2x2OVVsQ0du\nUmM0MWo1SEJ3eVVsQWs2V3ByN1V5QncKLS0tIDVMRis1NERwRHBFZHc1NkY3MG1R\nSkZWY1RoZzdZYVMyZE1uMkZUZ3V3M2sKKiBWZF/eKHAvn45mHFl1zOWOIU0QBruK\nb7zySBdND82AbJ+Lqp6pE4jlFpEjGFH8wJf5xNsrJqp2KHPZgbA13Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrM2lPdHplVVFHTGd6ZWRl\nMVhabVZXYkpRRlp2YUxnWU1TZHRLNWVoTmtRCmEzTGI0RnVkY3F2QWRFdFNvazBG\nd0lmcG1LSFhtckV0VmR2bFNhR2ZBQVkKLS0tIEY2MEJ1UTN1UUxDU0dsOWUvMzYv\naWhpTjRKeEhGbE9HMzF1UlpITFpXTzQKYvjqH9OEppWUt1756/uVZZDEcxvaVng4\nzAI64N3g0H2+XSHiZTbSuUJEznqkd+fYmezQRbElrP+OZKP64/1NfA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoZmFvWWduUmtTbDZuaXJx\nZXduOE9BdHZMKzRTTXkyRDMwSDJIR0VyZ3prCkJyc2d2SzcvZDBuMDBiQ0NPZCtj\nNGsxbVR2VEtaOGpydjRwWlc3WVRJbjAKLS0tIHE4T09mWTZFZjhsZi9UQUJ4Tkp4\nUnhPSUtyVDNyQ3FUOTg3c0doZ2tSaE0KklIZLnHGddAwqFjT2el5HsXSw0ptE8mo\nRv9QUp8/c3RukPsG5vE/BsWjJ0Q/cYfEXCWabsvxaFDGounHPJknuw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3UTFqQjl6d3p2ckRFU1V6\nbkRBUVk0MkVldzBJTURvMDZnTFBqOTgzYVZVCi9sQXJXL1lPdjlSSU01cjZqL05m\nckZyTnpwcW1la2xTM1IwQUJXTWdQRkEKLS0tIEkydGxzUjFxZlJ3VmxYNXpZSzFi\nVEVDenZ2dGZrN3lkS0xIVW1mek1ibmsKZkWJyZfGAcWbVMVc6964JaBleTT4ZKwI\nm68OfaNAmA57y09/O8Xnxp5FsnkbdULBRbccv6s5rBimr/5GgfIARg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmZHMrL2h2QlZySldjR2NB\nVnVxYXIrY2ZHVEJPU1oxaG9CSHpvOE01K1E4ClFqai9jZkc5bW9LNEU3TE5ZQmZa\nbHFuR21YVGs3bkU4cnYrN0k2QU1BYVUKLS0tIG1vT1E2c0JWME9nMDNNYTdYL3dp\nNHc0RWJYdVFsME5pRUpMTGY0UkFpRU0K8H+FfF4mGKag2dsx1BjBu4/e6XkTu8Pq\neDEe0zwCD0z/emYaLslZ50NDgAgvGkl6Q2y8Y1vcaX2X2BREH0kzzQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZWVwcitjSklXdTNYYVAv\nWDU1VzNxbVdDOUo3b2hXNFg3V0RqMUFwVDNJCjE4UXdZb1FFTWp2VjdSMFd2NWpC\nUjZmUjVYYXRvSWUzVk1mUkMzSU52dmsKLS0tIHpFcU0wUEROVkV0YXFoODhtbmZi\nWVFiWmRrRXNNaFVsZU42V2ltQjhGREEK7qXMJEtDMMVU5BJJeOwn4ticQXNaTQS+\nyvYjCE+U5080PtK+9l1LnlOpYxIKXw+Cn+jTUkGmDwEX0oifPNIUvg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBna3djTDBqKzlTWFpFaUhX\nVkNuQnNTN3VuNTFuUE9RalI2djdVOFdLaHhrCis1S2EyenlGZDdHSzhPTEFtMUdk\ncjQ0akRYU2huV1pzOEhDUWtLN2JWZU0KLS0tIFhPR2YzQ0Z2V2phc2xrNTc3Rmpv\nTnE5NzB6aENZNFp0U09QTUVDOWhSblkKd7bqI00jFdfYlLFooTSfsME6oXDPBFrc\n8GrniJr9sLSyPXUCGZQ+ZWF5ooW/szlB4HYL7/MPXhDct82/TeaUMg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFdXTExVcmZG\neWl6WUFDMk95N0RKNVpNakhPUjhjL0RqaWNaMEtiNHRPU1kgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp5QkNLbWhHVTNIdjBiSnBPMUlNY1Ft\nMzRHNXlVVThlNVowQ2N4bjFMcGRFCi0tLSBSZnVwaGhNUW40TDVwVGRoWERxcVho\ndE1xUmprSXViWWpmREhjaXg5SGZzCu18I0Dsq3bHy4XBiCpw011tO8EgGUSPCfZb\nZXyFvh0gZOFKvNkkGDHl52ejzO7PuNx0g8oH9OSTfrNNJKhLtJc=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:12Z",
+		"mac": "ENC[AES256_GCM,data:md8/9N/a9LX4xTCfuWIaFkxc/Zg57oW97qPVOcyx0EA6FpxH4IBXdLfQ3Mnw4onet5JUwxMbZUU8nQuHMNdupjf7W8zeemdns3nDTYxU55G5Ba+Ku3QXdPXryJycVOoPsv+uTN4iucMCruCEApqNFyhBP15Ev8PPcri/OLdtr0g=,iv:7s0JMSmZCM+TzxHMBw3HRqN9AgkisM394aOQc2rgijA=,tag:gHvLHuK8HtER3QB8QJTxig==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/pocket-id/encryption-key/machines/vega
+++ b/vars/per-machine/vega/pocket-id/encryption-key/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/pocket-id/encryption-key/secret
+++ b/vars/per-machine/vega/pocket-id/encryption-key/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:EdRWRXZnTG8lhatXpy+ldTDad1E+lyjtFBFrPXUAvsrz,iv:zjqe5vnMPYv6Op4pBBGMJLCgdJ3nUtbXs7b41bpPwRg=,tag:hkkRkvRFo6tUc4REJu/ubg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3cHRRckpQUHdMYmNwZVdk\nY2ZSOHNTcXZaeUdqT0djTTh4RzdRNWZPRUQwCmRwc011UzZOVHhHL3dSUDRQVTB2\nZ1BKRFRCenQzMVhMVW10S3MvVnNsbGcKLS0tIDc4WUF1OXFLVXFVZi9paWtNY0Jj\nMGRCdVd1UmlHbmdBQ2dMbWt2MFFzVE0KyymVPmsYPe5zD9eDKN+zjzlpJ01kfwcj\nuVh70RA+O2zfzF292H2kqntfsbbW05LXAr15yMXHrnwEBxqZdyyHPw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsUlRlQkt2MkQ3dVdKcytt\nUzdEL1JCK3BJdFJyMk9uVFJSbG42ME9MQmkwCkhRTklrdU1Id3NBWlJtUG95ZHI1\nMjBNZzM1T2lENUllekNpYUc0OFo5TjgKLS0tIFlOWVdhU3BLdk9ybHRzVGJSSmdQ\nMzhraTlZYmUzcXZHdkJ6c3pCamZtSGsK0WsS2pjVkHVr6Zv3gdv3Y36RcLEqB+pj\noIMXJa6g2qnzlpyzF5jrMiK1ZZHInBn1QljZlKjqILTuiX8rzyxuIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T07:08:28Z",
+		"mac": "ENC[AES256_GCM,data:pmYh5nxAPXG9dUd85L3zBjpzwbDUsUFj+IJinuThLyBS+2NshJmEoa2N7GcVSCd+OvDGeW+yHTrewgX/i/G+G0Kk/2x3koHLAebYEwYPRkqz7YEhBHA/JSRDa+C4V3CFt8l8NyfLnoqtuPFNhHG0cGpV5EIKsS65sQ0NLzT1TP0=,iv:hx8jCYESaokgLXjvxnn1WNEq4oHZQ6N91zplhDJKxNw=,tag:279TaUllCUi1YHUU1SFKPA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/pocket-id/encryption-key/users/kurogeek
+++ b/vars/per-machine/vega/pocket-id/encryption-key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/root-password/password-hash/groups/admins
+++ b/vars/per-machine/vega/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/root-password/password-hash/machines/vega
+++ b/vars/per-machine/vega/root-password/password-hash/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/root-password/password-hash/secret
+++ b/vars/per-machine/vega/root-password/password-hash/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:PU3fH7ode0Sj7Om9kIDHQ9CjLz7KZSdhaSTPsfzRhmr8w4YRQHTf3YGx7beMTGpx3mnxXljBAuGXdoK2NLfGaJJCrIRF0HU3+Y9idokp2BnH3LW5dNTV+KVpVVDcuVqCw/eLTL4O3RqbvA==,iv:p1rv8LSAJLPf1BeUoPUh1gEsWEG8m34WYsohefCA7Mk=,tag:XPetfNGYOeJW1cgVlrxUSQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEhwY000OEwv\nSmduQjNEVWpPdVVDdnZjM24xOEJVRWN5c3ZXR3ZiVDU1bncgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyd1pZbFNIQTlMekZ1dklFTXNRaFdk\ncndEK0tKaWhnQVUyT2doZWtMOVV3Ci0tLSB6WFBrUmUxMFE0VnFMVzNCcXJ2QWR5\ndm85SkI1d3JtT01TYmYzVHdPYlNFCquhBwkMovf6wPqg7NREA4TSqJbHr6W00goe\nyGJhWDnXVMWhkyssqi3u80pYNKM1G9Rq+zSsCKRtRo/if4RjCu4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGMvSmFDSVdo\nQWpKMzI2TjRRM1lLNWNxSHpCaEl3TUFaRmx3UGlhczZZaG8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo2VnU2T1FsSG1hMFlOWVZpLzhVOXp1\nVnQ4VkVEeGNDQmVVQk9CN3NVTlNjCi0tLSBTSmthSlYzb1RKQWZIM0Z1TURCYVZ5\nb2k5SzRDS1Y3TU52and3ek5VZThBCtiCy4AjKW2gf33FluA4UVMMAaIe16rSn4mn\nPEtYUsM8gJfR9m7XRuQNVBz72h4abWP10qGOUrCegFglaCGKvqE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjbnFKdkNwRmJvUDhWakIw\ndVpiUDFxdzAvRWRHWGx5MnpNK3NJaDV5VHpVCkVvUWwvQTJqdzE3N1VpVmg4cUho\nTjgycmtXZ3Q0YTUrZEt5UFYrVTh3OTgKLS0tIGpmYU1XUUtURkIzUGM4RkVRK0d1\nNkloUXZXdFBIdkFqL212UUovVkxsdHMKBARoORZa7HkDB1QWCxjTT1QIuKYWoVii\nlrhd7/wmJ3wb8iKQygsK53twx3ujXUGH2H5ThCwfKxfBO8wpDGxkFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1SDJRYUZuYW55T25ubGda\nWjdDMHQyM0VQV0drZnNWRnFxY2ErTGNTcGwwCnBGeDhHNmJwN3BhNWdaSWpReVVP\nZHdxWlBLUVdBQ28xMjE1Vng0YWI0L3MKLS0tIG9TRG1EaVZlcEQzNFI3dU05OEt1\namFiYWFmVUZ1QVhLR3gvSWpNRUpzRjQKiMowQiEraMlYoBLqAdQ7y7Y3sO1cjz7d\noCKatPJkJ0ub4Y3Wg01xnwKaNClk6vozNvsp6SKy07RUhHSjlk0dFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSL05nRE8vRnRZdkV3SWZk\nTGN6VlRBenVqYzJhbER2aUY5MmJIR1JFZEZjCmc2R1ZZQVd0aFVDNk5SUVduR2pI\nZlB3RVNBV1Y2VW5TaGM1T2RxTjZtZXcKLS0tIGFsOGd5OGVYMHFFY3A1Y2l1M2kw\nVmgzQklwbFV3bkMzUHlxa3lGdVZMYk0K5y9ISsL1lMyBuT+R0M1Q9T/PBIwOuvce\njTGiOYYytpWqfIuUIwVP+k2g002WI8ILipD3lhX8SNqy82F3maCVPA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQd2FnN3NMcVZYcVNYc2dk\ndTVWMWxNY0NHK0EwOFFBSGdiUUxrTmFMTlF3CituVFNiSXR5OStNQjdGTHE3c3hy\nL3VFUmZ4eDQxaWZwaUFXZlBOWDhxTWsKLS0tIHFCQjdRT0dIYmFKQWVmK0lQKzQ4\nMVlVRlp0cUF0ZzFEcCt4c0Yxem9tdHcKgzHyrDi8oa/a6QRojRqoYxNzwcGaZJ0u\nasn0hyLiLiOhaJs1EOvg4Sp7rGpxIKKSBMI9qQeGlISRJi8pCvqKOA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMmtod1R2dGdDdXluRUV5\ncEZNODJPbStUV1ZsQXJRTk9MbGNsL05RY3pRCmVsMFB1QlRQTnljMVozdmRMM3o0\nWWdaL25CWk1idjhOeDZRQzVidVRBbWcKLS0tIEFIRmJjK21OS20yL2lZekRVRi90\nSVMvNklEYTI5T1pSSXMvbFZtOXhsTXcKuyefORMk0im4AWP1p1YbcRk65DDDCN9G\n06xvBCjAsxA8kjKqfMWVdzE2E+sAC6fuYym2+NJdf2GJDg8MEK8/Jg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3N3hVdk81SVJXUFIzRjI3\nbFFNUGtPWHJDRnhUVmVtSG1WdTc3TWVseXlvCmhacnQrRVVLYlZySUpIVjVBMnpM\nWFIwMUJ5eU1yUmZRRyt4bTI4ZFFCNG8KLS0tIGljc0pSK0pLQ2h2RmFHZzBEY29S\naWxNUDFFdlZiWmQ3QlNHckM2ZUNYZmMKP8xLp3Q5sZldJDTuQ9zO064ckHG3ryBX\nmGXtp9l+SDyKL7VHAV2Vxl6tRhQ4Dvfy9pfSXog9mynXrDY4JT4wPQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZ3R5MytPZnE3dnlEaFI5\nSEVYQnlYcm1aSGllMWVSOXR0T2U2ZXVQZWlvCmhrSm1WZHVBTlBqWVJPMWZzb2JD\nWW1GQ2FnbzNFOGlsS0g2V3Y4clR4RUkKLS0tIFpiRjhadHZZYWhxN2lUZFNiMDVi\nTUpGK04vc3VTdVB5eSttWWxlWHlnK00KgHQVIFtPtkjldEdSguBqItHkrXIfKcDT\nnYKyAj4EH6H4/miqJ1nKo/a4bSpAA05HbCfashmqIU3J6ED/UV+XXQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFlUWUtDeTl3\nMHg4a0lQcm92NTNPTm9YS1dTOC9nNFNCYWdlTDJqeE1GVFUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpENVBkeCtqU3FucXg3VmYvYU5yb1BZ\nTkZYWGh4Q3QrVm95amZJVjVuQmJBCi0tLSAzZDVYcWlYalM5MWhibm1MQS9jQzNP\nU3ZiQ3RMMlEramFiTENVU3hMcEJzCk+0tLWVj/tvtVr5NOvMej4k+0BJs7RUEkIP\ndlF8mTIQ+IVhOgSEkEDgaWemMihiaJC4FgKu80IWg/HlXsMIUKs=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:17Z",
+		"mac": "ENC[AES256_GCM,data:aBlQlB4fvyiW83pgQr7+06F3XWQAR2wiHIE3TXb/HYHyGsMoGsOK3CTi//cq3gsa3tahRPb7YyMmV21iGvLWBMUwoEKxD6CVnLYjKZxthkgJ4L5O9kTudyZBUcRcZj/3LVQRqdBEnMjLBZPdSYNcAorkGxgOlha1wtZS9uJb4D8=,iv:a3h3syMqSVkZFWaOPFjDdtXsMoY6tlHh84l0a7ZsGWw=,tag:KFn09QfVB7EAjl7vCmfyMw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/vega/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/root-password/password/groups/admins
+++ b/vars/per-machine/vega/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/root-password/password/secret
+++ b/vars/per-machine/vega/root-password/password/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:qoZ16d1q7SyZq6BEEfi4DDZVbF8Dlm3AmS+m1GbJSs0mXI4j,iv:uCN8zWAhVyGBessK5K6xlpBOcPV1mn4YUe8FUuQjlwo=,tag:jx4lt9NzEdb1NUjmI7N65Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGg0cUhRYmdj\nejFSQm9GY2NzUEhaQ1N5OHFGeGkzR29mT2duQ3RmTEhabU0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp5TmdPZzhobVBrQldmR1FidENKek5G\nTXQ1ZFNQNWVVY0pHcUNSeGIrTU5BCi0tLSA3aE51RThtQU9JUHlGOEVHYjNORzlH\nTWdVUzdrRitxRS9rYmRCU2xSNUpFCj7MTRh2deMUTz2tyMMjuy63KDiEd7tQ0Dzy\nlThWRu/fos9UdIdrFtS4oQfp23+UCp5E3fZRAEivi2JrZszoMfU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdvcEhEa3VB\nM1hPNFF0ditNckdXc3RiOUs3OWg5NHRyQ3IvdndjQ2crVEkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp5OHNTZmZzUWNGMGJGWFZvRkF3S0tY\nbW5XdnVKeGtXZiswYTdyUWZoaEJJCi0tLSBUSzBRY0ZPNjM1TUtkQ0VwanE2UFZh\nVElFMUxPQVM1WDhKZFB1L0hyQmFjCqsLBmzhIuYCanm2RdrjB9AVjX4vh8XY1yrr\n5x5rnEmCafGnH3+wrKlyHox+n+AKPuNt4SOpyWK9VTKWmT7AXNw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eHRrOVQyaHQwY21qc1JE\nNENkVzF6VGxzODB5SnNxdlJSV3VyUExIaVdBCkJWQnZ0bTdpT0NYMG56amlZQkxN\nbEhPbW5wb3l1WDJPV3FWV2lGaWVDUmcKLS0tIDJCdzh4dHNzRkE3OWpuZktkYTBI\nTVJlNWE0cXAwRHlZNlk2eWV4YkhCaW8KuGJlV1iFieVfdahrjZohOszofRMmvHU1\nWY8MeWUBiIxeBcvErr0rHo/ecwn10Bo9b1rer0Fc/wa4hiuL2D9i1A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFME9QbkN3YXB1clkwZncw\ncW5lR3JtakV4SDRwL1dMR3VFd3VMZGhQYVJNCk02UXZLcEVkNkFaTVBxaitSYUQ5\nRisvZ2xCMEw1MksyMlNrYnkyZzNYZUEKLS0tIDNsSkRtdWJwbFlsSkVrOE1reUFu\nNXRaL3NwVG5VRGNXU3cwWG9FZVVkUHcKgsRKXiMJmoO2vv7oECkpt4t0b8mnpQCW\npFCGSYiVBrycIQtnYj5VAvhDaGdIhA4NGvMKEkvFXE+SZay8kpgMUA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpMHJVZGphbERLWFZIZ1Zh\nK2FJNktTMG5PU0ZVZ09jM2JhUUdENGwyTkNFCmhYMUN3VEs1czRzdXNoS2s1L0NS\nMTRjSytZb3JTMjBJOUhZRmtLWmRBekEKLS0tIHZ1RW9HNnUxdktZQ2lUVlF3eWRG\nVUlrVXlnNit5SFhCUzlMbmtoZUY2ZWMK/6DcAfzcsLD5zM7kz32Zs6oShOvlCFUt\nc+r/FvlFKH5BD2WWL8hqwqk5OOfV+r+JeD5KFJ1f/ZZHG/3erE50Lw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWTlNldVZoOVhHWC90VzN6\nWWZTQi9NMnFIZXNBay9Db0VmWUpyTmYyekdNCkpaYkpnNkQ4dnM1Zm1ydExLTkI4\nNXhTeFovTE9ZckZKbTNEQ0M1aUVaRjQKLS0tIDZadHJBVlhRL0taSUl3LzVyT1py\nK3pkeGdIVU90SENsYSszb0VSMjRwcnMKHfELyOWyv/r3cRfbwfzQx3o4y5Hww5+M\ny9w85WTgaG5q81cqZ2gPZZ1L/UQspUrsDee+H93G3kq8s6RB+4zcJg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYMlMvQlVDVHViYXlsVFND\nK1lwbTBuS0d1Z2Q2YmJieDdxUmhma0h3WWdRCldUUjFpWmtnUE9GTHdFRnVRU1Zl\nY1lzSkdFSkFidEd4VUJRZi9VcmNWa00KLS0tIDFZcjJlTmhiQWlnTHRpWWk2cmNO\nTldDMlNvVGVhdVVjdkdyZ2RXUVVxaTgKzVIoGyFLRgaRM/iKc/QWNiMptTkpkr8/\naBykdoiBStexDJ2LYwGgCtR/4kq6BcciJJ1jFQrFSWgeIznfNlfWlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVWUgwYVNHSHpIVnJPRG5j\nOWkrVW9CNlVtY2daak9EcVVMeFFZV2xMbmlVCjIzWk4xK0VKT0tEREkwUzkyTENU\nU2wxaVloaTF1WHJFU3FuTXlnTUp2SFkKLS0tIGM1V0ZQeExST1dSYzMwc1R5aVZK\nSEpERlJRd0JoOUJhNkxjOXZqM0dvczQKeNqVhh9CX+sURWXo26LtVVxF3B8rep/1\nSk8nqzk/PpZh2UoKTeIykVN4l+z8ugrnCZCSG1cqx7reysehGLxKcg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBEQVFGWUR0\nVlhrWjdROWd6RVJxMWY4LzhFUHR4YzFEY2IwT3pQWVlMaVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3aC92TkRGUnpjalZTdXZDNUk4WlVG\nR3RES3NGVjlzM0lVZk8zeVpzdXZRCi0tLSBucEZHWWVkTkxnNldFTTdDMUp0d2RN\ncWJJSXlBQ1ZveXVjY2Z1cTMyVlJVChqwHohrYRFIPco5FyQqIMxLbueuUfo7S+pt\n+u3NDGr7AN7iAt/qUpvX50y58+MEAm6vV3Qgvf8bnxmPUTgB4kw=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:17Z",
+		"mac": "ENC[AES256_GCM,data:oVgkprOgs3sEG4ojcZYcXFHVk2GEuyQF22QB035VVYkw5S3eOPLzc3jFFdkFbW/S61QstSfV2X37RZdJ1knKlfr2+uFbkIje5TfmnVTeonvOAVJIF2E6I978ogobHDDkmokv7YatLOVdsuZE8ce3ghc/q4ULf9AuYCTuWcAwhtI=,iv:T2mb1fDhn72pkR80LewvDJ5T7pT3Pj5YgoGw5f57Gss=,tag:M5Wkax8QtHX+VnqeGUSonw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/root-password/password/users/kurogeek
+++ b/vars/per-machine/vega/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/vega-internal-domain/name/value
+++ b/vars/per-machine/vega/vega-internal-domain/name/value
@@ -0,0 +1 @@
+glom.newedge.house
--- a/vars/per-machine/vega/vega-nextcloud/subdomain/value
+++ b/vars/per-machine/vega/vega-nextcloud/subdomain/value
--- a/vars/per-machine/vega/vega-pocket-id/subdomain/value
+++ b/vars/per-machine/vega/vega-pocket-id/subdomain/value
@@ -0,0 +1 @@
+auth
--- a/vars/per-machine/vega/vega-public-domain/name/value
+++ b/vars/per-machine/vega/vega-public-domain/name/value
@@ -0,0 +1 @@
+glom.newedge.house
--- a/vars/per-machine/vega/zerotier/zerotier-identity-secret/groups/admins
+++ b/vars/per-machine/vega/zerotier/zerotier-identity-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/zerotier/zerotier-identity-secret/machines/vega
+++ b/vars/per-machine/vega/zerotier/zerotier-identity-secret/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/vega/zerotier/zerotier-identity-secret/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:sBBwkfwu1NtWd2JQR4lzuYeggRj8phsNiv6WBmksXy5AKXqtDnEpZWYf4qxaRPXX9UkzMLgzmVr0r4DYfaQ8WFSGLRTgWhGKOnm/IaT4XVDofqUub7Hn/GVhY+WCbXI062QW7MHNnGIPZ0Yt3AxU/vUu5vAs3xI/XA/zHeKLz8tcXcSpzuOYA2fRB38BVCUAuP+VVvKmNakUDfzkWJFMEZtoDH3EcbNJNgToVd66GnaXGITTwoMvNnN5T6A9iJVoZajro6WVJOUVcKLdjwaLjwzZMccr1sy6h4+zMFtf3RKIc+KpHN3R8O7PauSZecRDVJBRmg9x4cFQK1qUtLRpiS6ULwolMaGBif6iAz+y,iv:EhAK5Q08rtDhXMUY2dP5kIPvdq6K/tP5KzbgEiXxUbw=,tag:JAX90GRMlV9PukShTBX+bA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHd0RzBERHh5\nSFJTelhsa0pxT1l6bGZTd3NoTDZxaFR1dDZ5SElDM1JZbEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp0SzZKUFVpNVFEMTFNSmZQU0pQQ3RS\nNkpEd1ptRnl4SDdseVkyWVVYZks0Ci0tLSBPcVNSeXlleWZ2Vit3bTRWSEhQWVNz\nU0VkamhrTkhnREgwUmhwQ215c24wCmj9yksSUTM6+f3pbFFW5Sfo08szndQ4/pTK\nCQMbmau2P9eBfh+I62RX7p5FBgd45sjnKZKNhvlAQzLUK66Sctw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGFsZlhlVi92\nUG9qK3pVdTlkTWFBUHFObXVHcFZ2RlBWTGlSWXh4MDNZa1EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwozenRyU25PdEdYZ2ROUExvZ3lhNHM4\nNlV1UFBod0lYSnFBQVczblJUeHZnCi0tLSBnbzlMeC80VVQ3cmJxOHMvRHZjSzRE\ncFBQaHJENDBwNG11VFp3UllFRTBnCiRzHmji41MHT1rlXBlglqJM0afHgV9686SI\n77ESU6AwJkjeL2n8GKyhnuO0kjRR47j12OHFIXsL0QGfEarbkWo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4cUlKc0NkRFVYKy9YOXVR\nVzRxdEF5dEtUSTljVzF1cEpTdWh2dDBWdTNrCks2RlAwSnFmdEdiVzBBdkloNDhO\nZ1dacnp4TnhmTGhycG5qemZ1R0EwcDgKLS0tIGZxdlREWkI2NXkxVmxweTNDUEor\nNjQzZUkzQUoyMEx6Q2h0K2pURzFIMFkKvxF1E9Zv83RnhmiswgXcKk6cgOSNpvdV\nc1rbIDgJ2t1hNfKBQXYaY/w5h7Aca88u99tv1vdcHTa4qar1FwQAUA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyeDZ6eHMwRk5VckRSUkpt\nMHFES1FrTXF5dm9ldzJRSC9pVWNqUDRUTVRFCkZFT0NIQzZNYmozT1BCYUN5WDkr\nc1lTb3QzUTlNUU10amI1eEcyQXE1YW8KLS0tIGVLWjNJaUwydFVTdmFRNUkwT2dY\nRHB1N0M4Wm5VdHoyemtzSk1JNGJ1U1kKWL5XmBmoe8hpDt0y/0y+mWQ1CjpyAC2m\nBQYKtR2DKy8Vt5UEyp0Xb4e8BYK3XUc4xLOhaxXljpKxJmxTcqMfMQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIWXJQVFltYTd2RitnRllk\nei9aQzRPZTl4QnlOL3FsU0hQc2FaaE0vbVNNClRqd0xwSWJOeG5XRURwRXpPNXpV\nV1Y4ODE5Wkd1cHhoWklibE51OHZnZEEKLS0tIDJCSzcvb2lsRnF3YjFKM1QxOSti\nay9OTlRGZlFucGZSd0c3TVZVemM0ZXcKmIIInb+zk++BeFu9rsNiHoZ9ExyOJX8U\n9B6IDaH2zXdKqZo7EQb2jG7FDLUpL/Oa+48gqpFXEEtQlweCOep0uQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjWVFUejVRdllsaXRCdXVY\nMVZueUxYK1pNVG5yM2o3QkpUOUdsUkNTNWtnCnNwdXZPTHNzYlIzWjFHRnVmbVdn\nYWVsbTcvVlo5L3JRNEg3cU01M2JNK2sKLS0tIFByNkxtUitCM2tVblkrTE52UTVJ\neVdhajEvcWlRQWx3aW9PNnhtdUtoLzAKWLb3sM263EW0MjRfcJPFeQKs+OvFlyvi\ny2+Ew9jLv+J7s7Y6cTLWAsW5l7BygJ+ZZ1bmLVIfepI1M4AEdKTFnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjdnJTT28yZXZ3VkRKb2Ja\nSWgrQzZGR1U1RENER3ppN2pRMWFpVGswbkFZCktuVWhkSHhBOXY0MkNCdmlUaE1z\naGE5MjhmMmRuK2tlVGhPdlVKSXV0Z0UKLS0tIEQrdDFOU3kvZEhCeTVnb0I5ZjBK\nSkdNVmRZNEE3KzZwSWFoeW9ielJHMU0KDuIi66meRyB817Uts4b2CBM9wp4ONNcY\n8mqmGqrXsQy6bWlYULDkRewOtjBQDMVXhaqMLPujhgemaimQKAYLaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUVRLZGVidDgwOVB2ZkZw\nNyt6RStwTkVTbTArVkh6QVRYZ0M0a2JwQ0M4CkdlV3FPSWNMMzRqL1BMMVZESWZw\nRlBib1U4ZmoyL2w4RWhqbzJLZHY5SEkKLS0tIG9DUTA2UDZYNERwU0gvU0FpQjNi\nNXhzdXdnWll1aTVDQ2NYbkRJbHRmZjAK/e1xoPAr3PP8OJr3ftXrm4xCzjgFfXn7\nGH4x/xSo5il7DkkOG3bGQr+Kl5sStJvgbns3iWim3sAsT59Cr2/zAQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdGpCTkJHR1g1Q0dtTUpT\ncjdBc1NEYmE4U1BlQnQvQzRqRFZTUnZqb1M4CmJxak1RVWw1ZHFmbFdIeGxodjJ5\nMjJGRTJzV3huUUZseWM4UExHRy9adWcKLS0tIC9sV1dpRlZCZmdpYnhEUk92VEEz\nVEhsd0tLamZRQUxYNnVxZDV3c3A1ZlkKD9DUy00ufdnI4HOP+xff1KroR32C9qWy\nTR/KUSNwB4WraIGUWwIl8scecorkAqkCL/DVlgFMbL0+Kr7e1C7Z7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHN4Z3NscTdk\nMURyQm5XWTRkVURmVFQ0a2NRRFV3WlVWejBocEpxY1ZqRmcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZworWGRwWStFWjZnYTFIVlI2VFpNVDIv\nK2paa2Q1cTNMZUo1bHFKVXQ1WURrCi0tLSAwUFlMbHd4NGFzMUpMVXpsaW83YUxN\nbFhoVERmcFY4ZW1RLzRWR2VtYlJ3CsDVEIrmcAdDN97oMOhfN1uc92HE4XFsr06e\n4QlrAEHQPaSxTaNUQwANWK7ODLHhxJBLCWWvZ/32lDK4h0Lp3jA=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-22T07:07:34Z",
+		"mac": "ENC[AES256_GCM,data:nmh+RoAoHUcrjXQx9VTPRjfQtAofwKXr1gv6eB0a9qtgCWfx3BGgo0qgZpqxX/vFw2WCgvU8I+TEPhflWXSrtpuDHrKKX0lVNyQiRnWpRLyPisaBM7FgH914zFRx0kqIFq8qbvWGBh/HWBt5olVvMsL8+liCP7wy5AIYBlAdnxQ=,iv:gbUbVUYy6WeSBizDtEpjJgvikGfLwcy8u8jUzdKaxp0=,tag:/eUGtnkwSqUjPbknJZiGqg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/zerotier/zerotier-identity-secret/users/kurogeek
+++ b/vars/per-machine/vega/zerotier/zerotier-identity-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/zerotier/zerotier-ip/value
+++ b/vars/per-machine/vega/zerotier/zerotier-ip/value
@@ -0,0 +1 @@
+fdf7:d53f:344b:8562:2599:93f7:d53f:344b
--- a/vars/per-machine/vega/zerotier/zerotier-network-id/value
+++ b/vars/per-machine/vega/zerotier/zerotier-network-id/value
@@ -0,0 +1 @@
+f7d53f344b856225
Author	SHA1	Message	Date
kurogeek	f6e3b7509c	mob next [ci-skip] [ci skip] [skip ci] lastFile:vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret	2025-10-22 16:42:00 +07:00
kurogeek	7115a93a0b	clanService asterisk	2025-10-22 16:40:59 +07:00
kurogeek	b5f3adacd8	clanService yggdrasil add vars yggdrasil/yggdrasil-subnet	2025-10-21 15:55:18 +07:00
kurogeek	2eb52251cc	clanService yggdrasil	2025-10-17 16:58:43 +07:00
kurogeek	be25560858	WhiteHouse router configuration	2025-10-16 14:53:41 +07:00
kurogeek	e4bf326191	add Alex's laptop to networks	2025-10-10 15:38:28 +07:00
kurogeek	04fafa32d3	update kurogeek thinkpad zerotier id	2025-10-09 16:42:23 +07:00
kurogeek	ed4e045ffc	rm unused args	2025-09-28 13:30:10 +07:00
kurogeek	fd6edd83c2	machines are accessed by zerotier ip	2025-09-28 13:21:46 +07:00
kurogeek	65faa70fa3	no nextcloud on vega	2025-09-28 12:45:29 +07:00
kurogeek	377b63437c	no write permission on GLOM samba	2025-09-26 20:26:02 +07:00
kurogeek	43e8252459	samba for vega	2025-09-26 16:46:00 +07:00
kurogeek	800500f57e	vega on new device	2025-09-26 12:04:02 +07:00
kurogeek	8b7007b2b8	VPN for b4l	2025-09-25 14:46:26 +07:00
kurogeek	c0f50eb2b5	Glom NAS machine vega	2025-09-24 14:20:21 +07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE09U7Tuvn3/icqFhjKuhp4hG+V6E6IFKhX1W2hVvyVj`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPv0QjFM0mBgOprFKcStm105vdgH1mbx6f+1X7P5UH7j`