mob next [ci-skip] [ci skip] [skip ci]

lastFile:routers/yada-house/device.nix

.gitignore

@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-
+run-vm-*

flake.lock

@@ -136,6 +136,19 @@
         "type": "github"
       }
     },
+    "liminix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1760087246,
+        "narHash": "sha256-HRUkAS5XDuM7yDnz+TIMAre7kFOuqyHL/y26wTbH6Sg=",
+        "path": "/home/kurogeek/Desktop/gitea/dan/liminix",
+        "type": "path"
+      },
+      "original": {
+        "path": "/home/kurogeek/Desktop/gitea/dan/liminix",
+        "type": "path"
+      }
+    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -207,6 +220,7 @@
         "devshell": "devshell",
         "flake-parts": "flake-parts",
         "import-tree": "import-tree",
+        "liminix": "liminix",
         "nixpkgs": "nixpkgs",
         "treefmt-nix": "treefmt-nix"
       }

flake.nix

@@ -21,6 +21,11 @@
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    liminix = {
+      # url = "git+https://gti.telent.net/dan/liminix?ref=refs/heads/main&rev=29fbb5461d034c4c59b88cbe04937b04ecad18e0";
+      url = "path:/home/kurogeek/Desktop/gitea/dan/liminix";
+      flake = false;
+    };
   };
   outputs =
     {
@@ -33,11 +38,30 @@
         systems = [
           "x86_64-linux"
         ];
+
+        flake.legacyPackages.qemu-router = import "${inputs.liminix}/default.nix" {
+          liminix-config = import "${inputs.liminix}/examples/hello-from-qemu.nix";
+          device = (import "${inputs.liminix}/devices/qemu-aarch64/default.nix");
+        };
+        flake.legacyPackages.yada-router = import "${inputs.liminix}/default.nix" {
+          liminix-config = import ./routers/yada-house/configuration.nix { inherit inputs; };
+          device = (import ./routers/yada-house/device.nix { inherit inputs; });
+        };
+        flake.legacyPackages.qemu-flake = import "${inputs.liminix}/default.nix" {
+          liminix-config = import ./routers/qemu/configuration.nix { inherit inputs; };
+          device = (import ./routers/qemu/device.nix { inherit inputs; });
+        };
+        flake.legacyPackages.vanilla = import "${inputs.liminix}/default.nix" {
+          liminix-config = import ./routers/vanilla/configuration.nix { inherit inputs; };
+          device = (import "${inputs.liminix}/devices/gl-mt300a/default.nix");
+        };
+
         imports = [
           ./fmt.nix
           ./shell.nix
 
           ./machines
+          ./routers
           ./inventories
           ./modules/clan/flake-module.nix
         ];

inventories/default.nix

@@ -1,16 +1,10 @@
-{
-  inputs,
-  self,
-  lib,
-  pkgs,
-  ...
-}:
 {
   clan = {
     inventory = {
 
-      machines = {
+      tags = {
-        rigel.deploy.targetHost = "root@rigel.local";
+        glom = [ "vega" ];
+        b4l = [ "rigel" ];
       };
 
       instances = {
@@ -36,6 +30,24 @@
           };
         };
 
+        glom-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."vega" = { };
+          roles.peer.tags.glom = { };
+        };
+
+        b4l-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."rigel" = { };
+          roles.peer.tags.b4l = { };
+        };
+
         pocket-id = {
           module = {
             name = "pocket-id";
@@ -49,7 +61,6 @@
             input = "self";
           };
           roles.default.machines.b4l = { };
-
         };
         stirling-pdf = {
           module = {

lib/auto-accept-zerotier-members.nix

@@ -0,0 +1,21 @@
+{
+  memberIds,
+}:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  systemd.services.zerotier-accept-external = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "zerotierone.service" ];
+    path = [ config.clan.core.clanPkgs.zerotierone ];
+    serviceConfig.ExecStart = pkgs.writeShellScript "zerotier-inventory-autoaccept" ''
+      ${lib.concatMapStringsSep "\n" (zerotier-id: ''
+        ${config.clan.core.clanPkgs.zerotier-members}/bin/zerotier-members allow ${zerotier-id}
+      '') memberIds}
+    '';
+  };
+}

machines/rigel/configuration.nix

@@ -1,4 +1,16 @@
+{ config, ... }:
 {
+  imports = [
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
   system.stateVersion = "25.11";
   clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 }

machines/vega/configuration.nix

@@ -0,0 +1,62 @@
+{
+  inputs,
+  config,
+  ...
+}:
+{
+  imports = [
+    (inputs.import-tree ./services)
+
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.vega-public-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base public domain for Vega machine. Default:(glomglom.fun)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glomglom.fun" > $out/name'';
+  };
+
+  clan.core.vars.generators.vega-internal-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base internal domain for Vega machine. Default:(glom.newedge.house)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glom.newedge.house" > $out/name'';
+  };
+
+  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
+  system.stateVersion = "25.11";
+
+  # security.acme.defaults.email = "admin@b4l.co.th";
+  # security.acme.acceptTerms = true;
+  # services.nginx.virtualHosts."${config.networking.fqdn}" = {
+  #   enableACME = true;
+  # };
+}

machines/vega/disko.nix

@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d14f9e";
+  vdev = [
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5RYRG"
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5S02X"
+  ];
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}

machines/vega/services/samba.nix

@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    GLOM.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "Glom Vega";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}

routers/default.nix

@@ -0,0 +1,25 @@
+{ inputs, ... }:
+{
+  flake.legacyPackages = {
+    qemu-router = import "${inputs.liminix}/default.nix" {
+      liminix-config = import "${inputs.liminix}/examples/hello-from-qemu.nix";
+      device = (import "${inputs.liminix}/devices/qemu-aarch64/default.nix");
+    };
+    yada-router = import "${inputs.liminix}/default.nix" {
+      liminix-config = import ./routers/yada-house/configuration.nix { inherit inputs; };
+      device = (import ./routers/yada-house/device.nix { inherit inputs; });
+    };
+    qemu-flake = import "${inputs.liminix}/default.nix" {
+      liminix-config = import ./routers/qemu/configuration.nix { inherit inputs; };
+      device = (import ./routers/qemu/device.nix { inherit inputs; });
+    };
+    vanilla = import "${inputs.liminix}/default.nix" {
+      liminix-config = import ./routers/vanilla/configuration.nix { inherit inputs; };
+      device = (import "${inputs.liminix}/devices/gl-mt300a/default.nix");
+    };
+    fax-router = import "${inputs.liminix}/default.nix" {
+      device = (import "${inputs.liminix}/devices/gl-ar750");
+      liminix-config = import ./fax-router/configuration.nix { inherit inputs; };
+    };
+  };
+}

routers/fax-router/configuration.nix

@@ -0,0 +1,46 @@
+# This is an example that uses the "gateway" profile to create a
+# "typical home wireless router" configuration suitable for a Gl.inet
+# gl-ar750 router. It should be fairly simple to edit it for other
+# devices: mostly you will need to attend to the number of wlan and lan
+# interfaces
+{ inputs }:
+{ config, pkgs, ... }:
+let
+  inherit (pkgs.liminix.services) target;
+  svc = config.system.service;
+in
+rec {
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/ntp"
+    "${inputs.liminix}/modules/vlan"
+  ];
+
+  services.dhcpv4 =
+    let
+      iface = svc.network.link.build { ifname = "eth1"; };
+    in
+    svc.network.dhcp.client.build { interface = iface; };
+
+  services.defaultroute4 = svc.network.route.build {
+    via = "$(output ${services.dhcpv4} ip)";
+    target = "default";
+    dependencies = [ services.dhcpv4 ];
+  };
+
+  services.packet_forwarding = svc.network.forward.build { };
+
+  services.ntp = config.system.service.ntp.build {
+    pools = {
+      "pool.ntp.org" = [ "iburst" ];
+    };
+  };
+
+  boot.tftp = {
+    serverip = "192.168.8.148";
+    ipaddr = "192.168.8.251";
+  };
+
+  defaultProfile.packages = [ pkgs.hello ];
+}

routers/fax-router/router-secrets.nix

@@ -0,0 +1,17 @@
+{
+  wpa_passphrase = "you bring light in";
+  ssid = "liminix";
+  l2tp = {
+    name = "abcde@a.1";
+    password = "NotMyIspPassword";
+  };
+  root = {
+    #  mkpasswd -m sha512crypt
+    passwd = "$6$6pt0mpbgcB7kC2RJ$kSBoCYGyi1.qxt7dqmexLj1l8E6oTZJZmfGyJSsMYMW.jlsETxdgQSdv6ptOYDM7DHAwf6vLG0pz3UD31XBfC1";
+    openssh.authorizedKeys.keys = [ ];
+  };
+
+  lan = {
+    prefix = "10.8.0";
+  };
+}

routers/qemu/configuration.nix

@@ -0,0 +1,49 @@
+{ inputs }:
+{ config, pkgs, ... }:
+let
+  svc = config.system.service;
+
+in
+rec {
+  imports = [
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/dnsmasq"
+    "${inputs.liminix}/modules/ssh"
+  ];
+
+  hostname = "hello";
+
+  # configure the internal network (LAN) with an address
+  services.int = svc.network.address.build {
+    interface = config.hardware.networkInterfaces.lan;
+    family = "inet";
+    address = "10.3.0.1";
+    prefixLength = 16;
+  };
+
+  services.sshd = svc.ssh.build { };
+
+  users.root = {
+    # the password is "secret". Use mkpasswd -m sha512crypt to
+    # create this hashed password string
+    passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
+  };
+
+  services.dns =
+    let
+      interface = services.int;
+    in
+    svc.dnsmasq.build {
+      inherit interface;
+      ranges = [
+        "10.3.0.10,10.3.0.240"
+        "::,constructor:$(output ${interface} ifname),ra-stateless"
+      ];
+
+      domain = "example.org";
+    };
+
+  defaultProfile.packages = with pkgs; [
+    figlet
+  ];
+}

routers/qemu/device.nix

@@ -0,0 +1,58 @@
+# This "device" generates images that can be used with the QEMU
+# emulator. The default output is a directory containing separate
+# kernel ("Image" format) and root filesystem (squashfs or jffs2)
+# images
+{ inputs }:
+{
+  system = {
+    crossSystem = {
+      config = "aarch64-unknown-linux-musl";
+    };
+  };
+
+  description = ''
+    QEMU Aarch64
+    ************
+
+    This target produces an image for
+    the `QEMU "virt" platform <https://www.qemu.org/docs/master/system/arm/virt.html>`_ using a 64 bit CPU type.
+
+    ARM targets differ from MIPS in that the kernel format expected
+    by QEMU is an "Image" (raw binary file) rather than an ELF
+    file, but this is taken care of by :command:`run.sh`. Check the
+    documentation for the :ref:`qemu` target for more information.
+
+  '';
+
+  # this device is described by the "qemu" device
+  installer = "vmroot";
+
+  module =
+    { config, lim, ... }:
+    {
+      imports = [
+        "${inputs.liminix}/modules/arch/aarch64.nix"
+        "${inputs.liminix}/devices/families/qemu.nix"
+      ];
+      kernel = {
+        config = {
+          VIRTUALIZATION = "y";
+          PCI_HOST_GENERIC = "y";
+
+          SERIAL_AMBA_PL011 = "y";
+          SERIAL_AMBA_PL011_CONSOLE = "y";
+        };
+      };
+      boot.commandLine = [
+        "console=ttyAMA0,38400"
+      ];
+      hardware =
+        let
+          addr = lim.parseInt "0x40010000";
+        in
+        {
+          loadAddress = addr;
+          entryPoint = addr;
+        };
+    };
+}

routers/vanilla/configuration.nix

@@ -0,0 +1,41 @@
+{ inputs }:
+{ config, pkgs, ... }:
+let
+  inherit (pkgs.liminix.services) target;
+  svc = config.system.service;
+in
+rec {
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/ntp"
+    "${inputs.liminix}/modules/vlan"
+  ];
+
+  services.dhcpv4 =
+    let
+      iface = svc.network.link.build { ifname = "eth1"; };
+    in
+    svc.network.dhcp.client.build { interface = iface; };
+
+  services.defaultroute4 = svc.network.route.build {
+    via = "$(output ${services.dhcpv4} ip)";
+    target = "default";
+    dependencies = [ services.dhcpv4 ];
+  };
+
+  services.packet_forwarding = svc.network.forward.build { };
+
+  services.ntp = config.system.service.ntp.build {
+    pools = {
+      "pool.ntp.org" = [ "iburst" ];
+    };
+  };
+
+  boot.tftp = {
+    serverip = "192.168.8.148";
+    ipaddr = "192.168.8.251";
+  };
+
+  defaultProfile.packages = [ pkgs.hello ];
+}

routers/vanilla/device.nix

@@ -0,0 +1,86 @@
+# This "device" generates images that can be used with the QEMU
+# emulator. The default output is a directory containing separate
+# kernel (uncompressed vmlinux) and initrd (squashfs) images
+{ inputs }:
+{
+  system = {
+    crossSystem = {
+      config = "mips-unknown-linux-musl";
+      gcc = {
+        abi = "32";
+        arch = "mips32"; # maybe mips_24kc-
+      };
+    };
+  };
+
+  description = ''
+    QEMU MIPS
+    *********
+
+    This target produces an image for
+    QEMU, the "generic and open source machine emulator and
+    virtualizer".
+
+    MIPS QEMU emulates a "Malta" board, which was an ATX form factor
+    evaluation board made by MIPS Technologies, but mostly in Liminix
+    we use paravirtualized devices (Virtio) instead of emulating
+    hardware.
+
+    Building an image for QEMU results in a :file:`result/` directory
+    containing ``run.sh`` ``vmlinux``, and ``rootfs`` files. To invoke
+    the emulator, run ``run.sh``.
+
+    The configuration includes two emulated "hardware" ethernet
+    devices and the kernel :code:`mac80211_hwsim` module to
+    provide an emulated wlan device. To read more about how
+    to connect to this network, refer to :ref:`qemu-networking`
+    in the Development manual.
+
+  '';
+  module =
+    {
+      config,
+      lib,
+      lim,
+      ...
+    }:
+    {
+      imports = [
+        "${inputs.liminix}/modules/arch/mipseb.nix"
+        "${inputs.liminix}/devices/families/qemu.nix"
+      ];
+      kernel = {
+        config = {
+          MIPS_MALTA = "y";
+          CPU_MIPS32_R2 = "y";
+
+          POWER_RESET = "y";
+          POWER_RESET_SYSCON = "y";
+
+          SERIAL_8250 = "y";
+          SERIAL_8250_CONSOLE = "y";
+        };
+      };
+      hardware =
+        # from arch/mips/mti-malta/Platform:load-$(CONFIG_MIPS_MALTA)  += 0xffffffff80100000
+        let
+          addr = lim.parseInt "0x80100000";
+        in
+        {
+          loadAddress = addr;
+          entryPoint = addr;
+
+          # Unlike the arm qemu targets, we need a static dts when
+          # running u-boot-using tests, qemu dumpdtb command doesn't
+          # work for this board. I am not at all sure this dts is
+          # *correct* but it does at least boot
+          dts = lib.mkForce {
+            src = "${config.system.outputs.kernel.modulesupport}/arch/mips/boot/dts/mti/malta.dts";
+            includePaths = [
+              "${config.system.outputs.kernel.modulesupport}/arch/mips/boot/dts/"
+            ];
+          };
+
+        };
+    };
+}

routers/yada-house/configuration.nix

@@ -0,0 +1,54 @@
+{ inputs }:
+
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  svc = config.system.service;
+
+in
+rec {
+  imports = [
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/dnsmasq"
+    "${inputs.liminix}/modules/ssh"
+  ];
+
+  hostname = "hello";
+
+  # configure the internal network (LAN) with an address
+  services.int = svc.network.address.build {
+    interface = config.hardware.networkInterfaces.lan2;
+    family = "inet";
+    address = "192.168.8.1";
+    prefixLength = 24;
+  };
+
+  services.sshd = svc.ssh.build { };
+
+  users.root = {
+    # the password is "secret". Use mkpasswd -m sha512crypt to
+    # create this hashed password string
+    passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
+  };
+
+  services.dns =
+    let
+      interface = services.int;
+    in
+    svc.dnsmasq.build {
+      inherit interface;
+      ranges = [
+        "192.168.8.1,192.168.8.240"
+        "::,constructor:$(output ${interface} ifname),ra-stateless"
+      ];
+
+      domain = "example.org";
+    };
+
+  # defaultProfile.packages = with pkgs; [
+  #   figlet
+  # ];
+}

routers/yada-house/device.nix

@@ -0,0 +1,127 @@
+# GL.iNet GL-MT6000
+{ inputs }:
+{
+  system = {
+    crossSystem = {
+      config = "aarch64-unknown-linux-musl";
+      gcc = {
+        arch = "armv8-a";
+      };
+    };
+  };
+
+  description = ''
+    Device configuration for Yada/White house router.
+  '';
+
+  module =
+    {
+      pkgs,
+      config,
+      lib,
+      lim,
+      ...
+    }:
+    let
+      inherit (pkgs) openwrt_24_10;
+      # mac80211 = pkgs.kmodloader.override {
+      #   targets = [ "rt2800soc" ];
+      #   inherit (config.system.outputs) kernel;
+      # };
+    in
+    {
+      imports = [
+        "${inputs.liminix}/modules/outputs/mtdimage.nix"
+        "${inputs.liminix}/modules/outputs/squashfs.nix"
+        "${inputs.liminix}/modules/outputs/tftpboot.nix"
+        "${inputs.liminix}/modules/outputs/vmroot.nix"
+        "${inputs.liminix}/modules/arch/aarch64.nix"
+        # "${inputs.liminix}/modules/base.nix"
+        "${inputs.liminix}/modules/vlan"
+      ];
+      boot.tftp = {
+        serverip = "192.168.1.254";
+        ipaddr = "192.168.1.1";
+        loadAddress = lim.parseInt "0x46000000";
+      };
+      boot.imageFormat = "fit";
+      boot.loader.fit.enable = true;
+      rootfsType = "squashfs";
+      hardware = {
+        loadAddress = lim.parseInt "0x48080000";
+        entryPoint = lim.parseInt "0x48080000";
+
+        flash = {
+          address = lim.parseInt "0x41e00000";
+          size = lim.parseInt "0x4000";
+          eraseBlockSize = 65536;
+        };
+        rootDevice = "/dev/root";
+
+        dts = {
+          src = "${openwrt_24_10.src}/target/linux/mediatek/dts/mt7986a-glinet-gl-mt6000.dts";
+          includePaths = [
+            "${openwrt_24_10.src}/target/linux/mediatek/dts"
+            "${config.system.outputs.kernel.modulesupport}/arch/arm64/boot/dts/mediatek/"
+          ];
+        };
+        networkInterfaces =
+          let
+            inherit (config.system.service.network) link;
+            inherit (config.system.service) vlan;
+          in
+          rec {
+            eth0 = link.build { ifname = "eth0"; };
+            wan = link.build { ifname = "eth1"; };
+
+            lan1 = vlan.build {
+              ifname = "lan1@eth0";
+              primary = eth0;
+              vid = "1";
+            };
+            lan2 = vlan.build {
+              ifname = "lan2@eth0";
+              primary = eth0;
+              vid = "2";
+            };
+            lan3 = vlan.build {
+              ifname = "lan3@eth0";
+              primary = eth0;
+              vid = "3";
+            };
+            lan4 = vlan.build {
+              ifname = "lan4@eth0";
+              primary = eth0;
+              vid = "4";
+            };
+            lan5 = vlan.build {
+              ifname = "lan5@eth0";
+              primary = eth0;
+              vid = "5";
+            };
+
+            # wlan = link.build {
+            #   ifname = "wlan0";
+            #   dependencies = [ mac80211 ];
+            # };
+          };
+      };
+
+      kernel = {
+        src = openwrt_24_10.kernelSrc;
+        version = openwrt_24_10.kernelVersion;
+        extraPatchPhase = ''
+          echo ==================================================
+          ls ${openwrt_24_10.src}/config
+          echo ==================================================
+          patch ${openwrt_24_10.src}/package/boot/uboot-mediatek/patches/436-add-glinet-mt6000.patch
+          echo --------------------------------------------------
+          ls ${openwrt_24_10.src}/config
+          echo --------------------------------------------------
+          ${openwrt_24_10.applyPatches.mediatek}
+        '';
+        config = {
+        };
+      };
+    };
+}

routers/yada-house/dts/mt7986a.dtsi

@@ -0,0 +1,645 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/clock/mt7986-clk.h>
+#include <dt-bindings/reset/mt7986-resets.h>
+#include <dt-bindings/phy/phy.h>
+
+/ {
+	compatible = "mediatek,mt7986a";
+	interrupt-parent = <&gic>;
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		cpu0: cpu@0 {
+			compatible = "arm,cortex-a53";
+			reg = <0x0>;
+			device_type = "cpu";
+			enable-method = "psci";
+			#cooling-cells = <2>;
+		};
+
+		cpu1: cpu@1 {
+			compatible = "arm,cortex-a53";
+			reg = <0x1>;
+			device_type = "cpu";
+			enable-method = "psci";
+			#cooling-cells = <2>;
+		};
+
+		cpu2: cpu@2 {
+			compatible = "arm,cortex-a53";
+			reg = <0x2>;
+			device_type = "cpu";
+			enable-method = "psci";
+			#cooling-cells = <2>;
+		};
+
+		cpu3: cpu@3 {
+			compatible = "arm,cortex-a53";
+			reg = <0x3>;
+			device_type = "cpu";
+			enable-method = "psci";
+			#cooling-cells = <2>;
+		};
+	};
+
+	clk40m: oscillator-40m {
+		compatible = "fixed-clock";
+		clock-frequency = <40000000>;
+		#clock-cells = <0>;
+		clock-output-names = "clkxtal";
+	};
+
+	psci {
+		compatible = "arm,psci-0.2";
+		method = "smc";
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+		secmon_reserved: secmon@43000000 {
+			reg = <0 0x43000000 0 0x30000>;
+			no-map;
+		};
+
+		wmcpu_emi: wmcpu-reserved@4fc00000 {
+			no-map;
+			reg = <0 0x4fc00000 0 0x00100000>;
+		};
+
+		wo_emi0: wo-emi@4fd00000 {
+			reg = <0 0x4fd00000 0 0x40000>;
+			no-map;
+		};
+
+		wo_emi1: wo-emi@4fd40000 {
+			reg = <0 0x4fd40000 0 0x40000>;
+			no-map;
+		};
+
+		wo_ilm0: wo-ilm@151e0000 {
+			reg = <0 0x151e0000 0 0x8000>;
+			no-map;
+		};
+
+		wo_ilm1: wo-ilm@151f0000 {
+			reg = <0 0x151f0000 0 0x8000>;
+			no-map;
+		};
+
+		wo_data: wo-data@4fd80000 {
+			reg = <0 0x4fd80000 0 0x240000>;
+			no-map;
+		};
+
+		wo_dlm0: wo-dlm@151e8000 {
+			reg = <0 0x151e8000 0 0x2000>;
+			no-map;
+		};
+
+		wo_dlm1: wo-dlm@151f8000 {
+			reg = <0 0x151f8000 0 0x2000>;
+			no-map;
+		};
+
+		wo_boot: wo-boot@15194000 {
+			reg = <0 0x15194000 0 0x1000>;
+			no-map;
+		};
+
+	};
+
+	soc {
+		compatible = "simple-bus";
+		ranges;
+		#address-cells = <2>;
+		#size-cells = <2>;
+
+		gic: interrupt-controller@c000000 {
+			compatible = "arm,gic-v3";
+			reg = <0 0x0c000000 0 0x10000>,  /* GICD */
+			      <0 0x0c080000 0 0x80000>,  /* GICR */
+			      <0 0x0c400000 0 0x2000>,   /* GICC */
+			      <0 0x0c410000 0 0x1000>,   /* GICH */
+			      <0 0x0c420000 0 0x2000>;   /* GICV */
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+		};
+
+		infracfg: infracfg@10001000 {
+			compatible = "mediatek,mt7986-infracfg", "syscon";
+			reg = <0 0x10001000 0 0x1000>;
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+		};
+
+		wed_pcie: wed-pcie@10003000 {
+			compatible = "mediatek,mt7986-wed-pcie",
+				     "syscon";
+			reg = <0 0x10003000 0 0x10>;
+		};
+
+		topckgen: topckgen@1001b000 {
+			compatible = "mediatek,mt7986-topckgen", "syscon";
+			reg = <0 0x1001B000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		watchdog: watchdog@1001c000 {
+			compatible = "mediatek,mt7986-wdt";
+			reg = <0 0x1001c000 0 0x1000>;
+			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+			#reset-cells = <1>;
+			status = "disabled";
+		};
+
+		apmixedsys: apmixedsys@1001e000 {
+			compatible = "mediatek,mt7986-apmixedsys";
+			reg = <0 0x1001E000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		pio: pinctrl@1001f000 {
+			compatible = "mediatek,mt7986a-pinctrl";
+			reg = <0 0x1001f000 0 0x1000>,
+			      <0 0x11c30000 0 0x1000>,
+			      <0 0x11c40000 0 0x1000>,
+			      <0 0x11e20000 0 0x1000>,
+			      <0 0x11e30000 0 0x1000>,
+			      <0 0x11f00000 0 0x1000>,
+			      <0 0x11f10000 0 0x1000>,
+			      <0 0x1000b000 0 0x1000>;
+			reg-names = "gpio", "iocfg_rt", "iocfg_rb", "iocfg_lt",
+				    "iocfg_lb", "iocfg_tr", "iocfg_tl", "eint";
+			gpio-controller;
+			#gpio-cells = <2>;
+			gpio-ranges = <&pio 0 0 100>;
+			interrupt-controller;
+			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-parent = <&gic>;
+			#interrupt-cells = <2>;
+		};
+
+		pwm: pwm@10048000 {
+			compatible = "mediatek,mt7986-pwm";
+			reg = <0 0x10048000 0 0x1000>;
+			#pwm-cells = <2>;
+			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_PWM_SEL>,
+				 <&infracfg CLK_INFRA_PWM_STA>,
+				 <&infracfg CLK_INFRA_PWM1_CK>,
+				 <&infracfg CLK_INFRA_PWM2_CK>;
+			clock-names = "top", "main", "pwm1", "pwm2";
+			status = "disabled";
+		};
+
+		sgmiisys0: syscon@10060000 {
+			compatible = "mediatek,mt7986-sgmiisys_0",
+				     "syscon";
+			reg = <0 0x10060000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		sgmiisys1: syscon@10070000 {
+			compatible = "mediatek,mt7986-sgmiisys_1",
+				     "syscon";
+			reg = <0 0x10070000 0 0x1000>;
+			#clock-cells = <1>;
+		};
+
+		trng: rng@1020f000 {
+			compatible = "mediatek,mt7986-rng",
+				     "mediatek,mt7623-rng";
+			reg = <0 0x1020f000 0 0x100>;
+			clocks = <&infracfg CLK_INFRA_TRNG_CK>;
+			clock-names = "rng";
+			status = "disabled";
+		};
+
+		crypto: crypto@10320000 {
+			compatible = "inside-secure,safexcel-eip97";
+			reg = <0 0x10320000 0 0x40000>;
+			interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "ring0", "ring1", "ring2", "ring3";
+			clocks = <&infracfg CLK_INFRA_EIP97_CK>;
+			assigned-clocks = <&topckgen CLK_TOP_EIP_B_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>;
+			status = "disabled";
+		};
+
+		uart0: serial@11002000 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11002000 0 0x400>;
+			interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART0_SEL>,
+				 <&infracfg CLK_INFRA_UART0_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
+					  <&infracfg CLK_INFRA_UART0_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_XTAL>,
+						 <&topckgen CLK_TOP_UART_SEL>;
+			status = "disabled";
+		};
+
+		uart1: serial@11003000 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11003000 0 0x400>;
+			interrupts = <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART1_SEL>,
+				 <&infracfg CLK_INFRA_UART1_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&infracfg CLK_INFRA_UART1_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_F26M_SEL>;
+			status = "disabled";
+		};
+
+		uart2: serial@11004000 {
+			compatible = "mediatek,mt7986-uart",
+				     "mediatek,mt6577-uart";
+			reg = <0 0x11004000 0 0x400>;
+			interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_UART2_SEL>,
+				 <&infracfg CLK_INFRA_UART2_CK>;
+			clock-names = "baud", "bus";
+			assigned-clocks = <&infracfg CLK_INFRA_UART2_SEL>;
+			assigned-clock-parents = <&topckgen CLK_TOP_F26M_SEL>;
+			status = "disabled";
+		};
+
+		i2c0: i2c@11008000 {
+			compatible = "mediatek,mt7986-i2c";
+			reg = <0 0x11008000 0 0x90>,
+			      <0 0x10217080 0 0x80>;
+			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+			clock-div = <5>;
+			clocks = <&infracfg CLK_INFRA_I2C0_CK>,
+				 <&infracfg CLK_INFRA_AP_DMA_CK>;
+			clock-names = "main", "dma";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi0: spi@1100a000 {
+			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x1100a000 0 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_MPLL_D2>,
+				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&infracfg CLK_INFRA_SPI0_CK>,
+				 <&infracfg CLK_INFRA_SPI0_HCK_CK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+			status = "disabled";
+		};
+
+		spi1: spi@1100b000 {
+			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
+			reg = <0 0x1100b000 0 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&topckgen CLK_TOP_MPLL_D2>,
+				 <&topckgen CLK_TOP_SPIM_MST_SEL>,
+				 <&infracfg CLK_INFRA_SPI1_CK>,
+				 <&infracfg CLK_INFRA_SPI1_HCK_CK>;
+			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
+			status = "disabled";
+		};
+
+		thermal: thermal@1100c800 {
+			compatible = "mediatek,mt7986-thermal";
+			reg = <0 0x1100c800 0 0x800>;
+			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_THERM_CK>,
+				 <&infracfg CLK_INFRA_ADC_26M_CK>;
+			clock-names = "therm", "auxadc";
+			nvmem-cells = <&thermal_calibration>;
+			nvmem-cell-names = "calibration-data";
+			#thermal-sensor-cells = <1>;
+			mediatek,auxadc = <&auxadc>;
+			mediatek,apmixedsys = <&apmixedsys>;
+		};
+
+		auxadc: adc@1100d000 {
+			compatible = "mediatek,mt7986-auxadc";
+			reg = <0 0x1100d000 0 0x1000>;
+			clocks = <&infracfg CLK_INFRA_ADC_26M_CK>;
+			clock-names = "main";
+			#io-channel-cells = <1>;
+			status = "disabled";
+		};
+
+		ssusb: usb@11200000 {
+			compatible = "mediatek,mt7986-xhci",
+				     "mediatek,mtk-xhci";
+			reg = <0 0x11200000 0 0x2e00>,
+			      <0 0x11203e00 0 0x0100>;
+			reg-names = "mac", "ippc";
+			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&infracfg CLK_INFRA_IUSB_SYS_CK>,
+				 <&infracfg CLK_INFRA_IUSB_CK>,
+				 <&infracfg CLK_INFRA_IUSB_133_CK>,
+				 <&infracfg CLK_INFRA_IUSB_66M_CK>,
+				 <&topckgen CLK_TOP_U2U3_XHCI_SEL>;
+			clock-names = "sys_ck",
+				      "ref_ck",
+				      "mcu_ck",
+				      "dma_ck",
+				      "xhci_ck";
+			phys = <&u2port0 PHY_TYPE_USB2>,
+			       <&u3port0 PHY_TYPE_USB3>,
+			       <&u2port1 PHY_TYPE_USB2>;
+			status = "disabled";
+		};
+
+		mmc0: mmc@11230000 {
+			compatible = "mediatek,mt7986-mmc";
+			reg = <0 0x11230000 0 0x1000>,
+			      <0 0x11c20000 0 0x1000>;
+			interrupts = <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
+			assigned-clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
+					  <&topckgen CLK_TOP_EMMC_250M_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_MPLL>,
+						 <&topckgen CLK_TOP_NET1PLL_D5_D2>;
+			clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
+				 <&infracfg CLK_INFRA_MSDC_HCK_CK>,
+				 <&infracfg CLK_INFRA_MSDC_CK>,
+				 <&infracfg CLK_INFRA_MSDC_133M_CK>,
+				 <&infracfg CLK_INFRA_MSDC_66M_CK>;
+			clock-names = "source", "hclk", "source_cg", "bus_clk",
+				      "sys_cg";
+			status = "disabled";
+		};
+
+		pcie: pcie@11280000 {
+			compatible = "mediatek,mt7986-pcie",
+				     "mediatek,mt8192-pcie";
+			reg = <0x00 0x11280000 0x00 0x4000>;
+			reg-names = "pcie-mac";
+			ranges = <0x82000000 0x00 0x20000000 0x00
+				  0x20000000 0x00 0x10000000>;
+			device_type = "pci";
+			#address-cells = <3>;
+			#size-cells = <2>;
+			interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
+			bus-range = <0x00 0xff>;
+			clocks = <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
+				 <&infracfg CLK_INFRA_IPCIE_CK>,
+				 <&infracfg CLK_INFRA_IPCIER_CK>,
+				 <&infracfg CLK_INFRA_IPCIEB_CK>;
+			clock-names = "pl_250m", "tl_26m", "peri_26m", "top_133m";
+
+			phys = <&pcie_port PHY_TYPE_PCIE>;
+			phy-names = "pcie-phy";
+
+			#interrupt-cells = <1>;
+			interrupt-map-mask = <0 0 0 0x7>;
+			interrupt-map = <0 0 0 1 &pcie_intc 0>,
+					<0 0 0 2 &pcie_intc 1>,
+					<0 0 0 3 &pcie_intc 2>,
+					<0 0 0 4 &pcie_intc 3>;
+			status = "disabled";
+
+			pcie_intc: interrupt-controller {
+				#address-cells = <0>;
+				#interrupt-cells = <1>;
+				interrupt-controller;
+			};
+		};
+
+		pcie_phy: t-phy {
+			compatible = "mediatek,mt7986-tphy",
+				     "mediatek,generic-tphy-v2";
+			ranges;
+			#address-cells = <2>;
+			#size-cells = <2>;
+			status = "disabled";
+
+			pcie_port: pcie-phy@11c00000 {
+				reg = <0 0x11c00000 0 0x20000>;
+				clocks = <&clk40m>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+		};
+
+		efuse: efuse@11d00000 {
+			compatible = "mediatek,mt7986-efuse", "mediatek,efuse";
+			reg = <0 0x11d00000 0 0x1000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			thermal_calibration: calib@274 {
+				reg = <0x274 0xc>;
+			};
+		};
+
+		usb_phy: t-phy@11e10000 {
+			compatible = "mediatek,mt7986-tphy",
+				     "mediatek,generic-tphy-v2";
+			ranges = <0 0 0x11e10000 0x1700>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			status = "disabled";
+
+			u2port0: usb-phy@0 {
+				reg = <0x0 0x700>;
+				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
+					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
+				clock-names = "ref", "da_ref";
+				#phy-cells = <1>;
+			};
+
+			u3port0: usb-phy@700 {
+				reg = <0x700 0x900>;
+				clocks = <&topckgen CLK_TOP_USB3_PHY_SEL>;
+				clock-names = "ref";
+				#phy-cells = <1>;
+			};
+
+			u2port1: usb-phy@1000 {
+				reg = <0x1000 0x700>;
+				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
+					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
+				clock-names = "ref", "da_ref";
+				#phy-cells = <1>;
+			};
+		};
+
+		ethsys: syscon@15000000 {
+			 compatible = "mediatek,mt7986-ethsys",
+				      "syscon";
+			 reg = <0 0x15000000 0 0x1000>;
+			 #clock-cells = <1>;
+			 #reset-cells = <1>;
+		};
+
+		wed0: wed@15010000 {
+			compatible = "mediatek,mt7986-wed",
+				     "syscon";
+			reg = <0 0x15010000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
+					<&wo_data>, <&wo_boot>;
+			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+					      "wo-data", "wo-boot";
+			mediatek,wo-ccif = <&wo_ccif0>;
+		};
+
+		wed1: wed@15011000 {
+			compatible = "mediatek,mt7986-wed",
+				     "syscon";
+			reg = <0 0x15011000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
+					<&wo_data>, <&wo_boot>;
+			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
+					      "wo-data", "wo-boot";
+			mediatek,wo-ccif = <&wo_ccif1>;
+		};
+
+		eth: ethernet@15100000 {
+			compatible = "mediatek,mt7986-eth";
+			reg = <0 0x15100000 0 0x80000>;
+			interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 199 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&ethsys CLK_ETH_FE_EN>,
+				 <&ethsys CLK_ETH_GP2_EN>,
+				 <&ethsys CLK_ETH_GP1_EN>,
+				 <&ethsys CLK_ETH_WOCPU1_EN>,
+				 <&ethsys CLK_ETH_WOCPU0_EN>,
+				 <&sgmiisys0 CLK_SGMII0_TX250M_EN>,
+				 <&sgmiisys0 CLK_SGMII0_RX250M_EN>,
+				 <&sgmiisys0 CLK_SGMII0_CDR_REF>,
+				 <&sgmiisys0 CLK_SGMII0_CDR_FB>,
+				 <&sgmiisys1 CLK_SGMII1_TX250M_EN>,
+				 <&sgmiisys1 CLK_SGMII1_RX250M_EN>,
+				 <&sgmiisys1 CLK_SGMII1_CDR_REF>,
+				 <&sgmiisys1 CLK_SGMII1_CDR_FB>,
+				 <&topckgen CLK_TOP_NETSYS_SEL>,
+				 <&topckgen CLK_TOP_NETSYS_500M_SEL>;
+			clock-names = "fe", "gp2", "gp1", "wocpu1", "wocpu0",
+				      "sgmii_tx250m", "sgmii_rx250m",
+				      "sgmii_cdr_ref", "sgmii_cdr_fb",
+				      "sgmii2_tx250m", "sgmii2_rx250m",
+				      "sgmii2_cdr_ref", "sgmii2_cdr_fb",
+				      "netsys0", "netsys1";
+			assigned-clocks = <&topckgen CLK_TOP_NETSYS_2X_SEL>,
+					  <&topckgen CLK_TOP_SGM_325M_SEL>;
+			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>,
+						 <&apmixedsys CLK_APMIXED_SGMPLL>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			mediatek,ethsys = <&ethsys>;
+			mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
+			mediatek,wed-pcie = <&wed_pcie>;
+			mediatek,wed = <&wed0>, <&wed1>;
+			status = "disabled";
+		};
+
+		wo_ccif0: syscon@151a5000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151a5000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		wo_ccif1: syscon@151ad000 {
+			compatible = "mediatek,mt7986-wo-ccif", "syscon";
+			reg = <0 0x151ad000 0 0x1000>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		wifi: wifi@18000000 {
+			compatible = "mediatek,mt7986-wmac";
+			reg = <0 0x18000000 0 0x1000000>,
+			      <0 0x10003000 0 0x1000>,
+			      <0 0x11d10000 0 0x1000>;
+			resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>;
+			reset-names = "consys";
+			clocks = <&topckgen CLK_TOP_CONN_MCUSYS_SEL>,
+				 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
+			clock-names = "mcu", "ap2conn";
+			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>;
+			memory-region = <&wmcpu_emi>;
+		};
+	};
+
+	thermal-zones {
+		cpu_thermal: cpu-thermal {
+			polling-delay-passive = <1000>;
+			polling-delay = <1000>;
+			thermal-sensors = <&thermal 0>;
+
+			trips {
+				cpu_trip_crit: crit {
+					temperature = <125000>;
+					hysteresis = <2000>;
+					type = "critical";
+				};
+
+				cpu_trip_hot: hot {
+					temperature = <120000>;
+					hysteresis = <2000>;
+					type = "hot";
+				};
+
+				cpu_trip_active_high: active-high {
+					temperature = <115000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_med: active-med {
+					temperature = <85000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+
+				cpu_trip_active_low: active-low {
+					temperature = <60000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+			};
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
+	};
+};

routers/yada-house/kconf-from-openwrt.txt

@@ -0,0 +1,103 @@
+ARM="y";
+SYS_HAS_NONCACHED_MEMORY="y";
+POSITION_INDEPENDENT="y";
+ARCH_MEDIATEK="y";
+TEXT_BASE="0x41e00000";
+SYS_MALLOC_F_LEN="0x4000";
+NR_DRAM_BANKS="1";
+ENV_SIZE="0x80000";
+ENV_OFFSET="0x400000";
+DEFAULT_DEVICE_TREE="mt7986a-glinet-gl-mt6000";
+OF_LIBFDT_OVERLAY="y";
+TARGET_MT7986="y";
+SYS_LOAD_ADDR="0x46000000";
+PRE_CON_BUF_ADDR="0x4007EF00";
+DEBUG_UART_BASE="0x11002000";
+DEBUG_UART_CLOCK="40000000";
+DEBUG_UART="y";
+AHCI="y";
+FIT="y";
+AUTOBOOT_KEYED="y";
+AUTOBOOT_MENU_SHOW="y";
+DEFAULT_FDT_FILE="mediatek/mt7986a-glinet-gl-mt6000.dtb";
+LOGLEVEL="7";
+PRE_CONSOLE_BUFFER="y";
+LOG="y";
+BOARD_LATE_INIT="y";
+HUSH_PARSER="y";
+SYS_PROMPT="MT7986> ";
+CMD_CPU="y";
+CMD_LICENSE="y";
+CMD_BOOTMENU="y";
+CMD_ASKENV="y";
+CMD_ERASEENV="y";
+CMD_ENV_FLAGS="y";
+CMD_STRINGS="y";
+CMD_DM="y";
+CMD_GPIO="y";
+CMD_PWM="y";
+CMD_GPT="y";
+CMD_MMC="y";
+CMD_PART="y";
+CMD_USB="y";
+CMD_TFTPSRV="y";
+CMD_RARP="y";
+CMD_CDP="y";
+CMD_SNTP="y";
+CMD_LINK_LOCAL="y";
+CMD_DHCP="y";
+CMD_DNS="y";
+CMD_PING="y";
+CMD_CACHE="y";
+CMD_PSTORE="y";
+CMD_PSTORE_MEM_ADDR="0x42ff0000";
+CMD_UUID="y";
+CMD_HASH="y";
+CMD_SMC="y";
+OF_EMBED="y";
+ENV_OVERWRITE="y";
+ENV_IS_IN_MMC="y";
+SYS_RELOC_GD_ENV_ADDR="y";
+USE_DEFAULT_ENV_FILE="y";
+DEFAULT_ENV_FILE="defenvs/glinet_gl-mt6000_env";
+ENV_VARS_UBOOT_RUNTIME_CONFIG="y";
+VERSION_VARIABLE="y";
+NETCONSOLE="y";
+USE_IPADDR="y";
+IPADDR="192.168.1.1";
+USE_SERVERIP="y";
+SERVERIP="192.168.1.254";
+NET_RANDOM_ETHADDR="y";
+BUTTON="y";
+BUTTON_GPIO="y";
+CLK="y";
+GPIO_HOG="y";
+LED="y";
+LED_BLINK="y";
+LED_GPIO="y";
+SUPPORT_EMMC_BOOT="y";
+MMC_HS200_SUPPORT="y";
+MMC_MTK="y";
+PHY_FIXED="y";
+MEDIATEK_ETH="y";
+PHY="y";
+PHY_MTK_TPHY="y";
+PINCTRL="y";
+PINCONF="y";
+PINCTRL_MT7986="y";
+POWER_DOMAIN="y";
+MTK_POWER_DOMAIN="y";
+DM_REGULATOR="y";
+DM_REGULATOR_FIXED="y";
+DM_REGULATOR_GPIO="y";
+DM_PWM="y";
+PWM_MTK="y";
+RAM="y";
+DM_SERIAL="y";
+SERIAL_RX_BUFFER="y";
+MTK_SERIAL="y";
+USB="y";
+USB_XHCI_HCD="y";
+USB_XHCI_MTK="y";
+USB_STORAGE="y";
+HEXDUMP="y";

routers/yada-house/mt7986a-glinet-gl-mt6000.dts

@@ -0,0 +1,356 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	model = "GL.iNet GL-MT6000";
+	compatible = "glinet,gl-mt6000", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		label-mac-device = &gmac1;
+		led-boot = &led_blue;
+		led-failsafe = &led_blue;
+		led-running = &led_white;
+		led-upgrade = &led_white;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=PARTLABEL=rootfs rootwait";
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "1.8vd";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_blue: led-0 {
+			label = "blue:run";
+			gpios = <&pio 38 GPIO_ACTIVE_LOW>;
+		};
+
+		led_white: led-1 {
+			label = "white:system";
+			gpios = <&pio 37 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	usb_vbus: regulator-usb-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		nvmem-cells = <&macaddr_factory_a 2>;
+		nvmem-cell-names = "mac-address";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_a 0>;
+		nvmem-cell-names = "mac-address";
+		phy-mode = "2500base-x";
+		phy-handle = <&phy1>;
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy1: phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <1>;
+			reset-assert-us = <100000>;
+			reset-deassert-us = <100000>;
+			reset-gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			interrupt-parent = <&pio>;
+			interrupts = <46 IRQ_TYPE_LEVEL_LOW>;
+			realtek,aldps-enable;
+		};
+
+		phy7: ethernet-phy@7 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <7>;
+			reset-assert-us = <100000>;
+			reset-deassert-us = <100000>;
+			reset-gpios = <&pio 19 GPIO_ACTIVE_LOW>;
+			interrupt-parent = <&pio>;
+			interrupts = <47 IRQ_TYPE_LEVEL_LOW>;
+			realtek,aldps-enable;
+		};
+
+		switch: switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 18 GPIO_ACTIVE_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&pio>;
+			interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					label = "lan2";
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan3";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan4";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan5";
+				};
+
+				port@5 {
+					reg = <5>;
+					label = "lan1";
+					phy-handle = <&phy7>;
+					phy-mode = "2500base-x";
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pio {
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <MTK_DRIVE_4mA>;
+		};
+	};
+
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <MTK_DRIVE_6mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <MTK_DRIVE_6mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+		conf-ds {
+			pins = "EMMC_DSL";
+			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
+		};
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
+		};
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&usb_vbus>;
+	status = "okay";
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	status = "okay";
+};
+
+&mmc0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <8>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	status = "okay";
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+			partitions {
+				block-partition-env {
+					partname = "u-boot-env";
+
+					nvmem-layout {
+						compatible = "u-boot,env";
+					};
+				};
+
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1000>;
+						};
+
+						macaddr_factory_a: macaddr@a {
+							compatible = "mac-base";
+							reg = <0xa 0x6>;
+							#nvmem-cell-cells = <1>;
+						};
+					};
+				};
+			};
+		};
+	};
+};

sops/machines/vega/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+    "type": "age"
+  }
+]

sops/secrets/vega-age.key/secret

@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:3WgicB2mjBGo3YWFG9mVBYnapj1ZoH6ohwxIUcA9byWVTCS0ZKyIJZlPeyvKWEzX9ZnxgLd1DPDfFfppwsnkxYOvEJsBAf0AanI=,iv:OKSKHu3h8Kl/qAlQ1xiYElDjaql0FdIWVPJYicfvH8Y=,tag:Xa9RfEBC8l8VgHbJHTr4jQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCK0NJR2VzVU1xVGZBd3Fh\nU0xEdmFhTllBU1dpMDM4V3NjTjB6dWxoRGdNCmdMS0duUUV1bVdtVmF1Nml5YTRV\naHpLMExzTGxKclJDZkl2UWdFUHRxY2cKLS0tIER1ajBQdEFuTDQvSERQTDZialBp\nN2RJdS9tVk8wb1lMclNrQzBCTWx3UUUKVKrK0KHOAcd0oMlzeCbN9xX35QKG+za2\nMqEmG/duejDVVzxjIcMBhsXD3EytUMw6IJ/dQtGYS3lJUXH0tiq1Iw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:12Z",
+		"mac": "ENC[AES256_GCM,data:Nvb0JIeARvwzDQSiUkqNMsTFQpGLDTtM0v8ZDyYzQY9yloS1AsGtehbWPgq9Rzr6L5I71bubw8LWpa6UnlqQSrC8GLOy+ojvu/KknkNaVrWQFCw0BDJk4ypBUaQk8n3dGjkG8UUvKCy7dkwwkP3nNbsQ8HA9R5zSYHNakZmWpes=,iv:iozu9qC8nY2XCPG5aBPihCjoNIxXV3kKLcoesFYPSj4=,tag:NkqiJVwj35VY5teW7eTtsQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

sops/secrets/vega-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

vars/per-machine/rigel/zerotier/zerotier-identity-secret/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/rigel/zerotier/zerotier-identity-secret/machines/rigel

@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel

vars/per-machine/rigel/zerotier/zerotier-identity-secret/secret

@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:HyP/Y+xjRTrixNZ6sZS4wMix3KXEYckSEhOBzUA2qS3XSB+1VyVPUCfAQjyV0jjzUAvXa8cYo5NpQIqV6whLasTTX8TgROkjlh1bIkRzrxVfZ3Rzsp25y7ZtyvTOZT12OJqmQb9LVI14eL5aG7JRRwpsff2VxqXbfynz2G3XvhCsaF3cb0rGVaE1AhJNN7E9jLkmLyxFTYkuFNZBw4FmP3CMeQTwnRsV8PUAs1HLeGoU/8rs3apK0VS7UXeFSXxIMK7tygPa3Bzu9nEqFTfL1fOIHXjiMwWisn7Rs0sIKVd6vBY5WPclV4Q6mk1KJD+BfhljPWs8Wu9a98A/j2imKXF1TQe1aGVFLTMDmhMM,iv:A8WntsxBmFW3fp2bVSPhfcxj1/K3MRr6e4vxquY0YG8=,tag:vqKuaeEPH0oI19iTEF5/jw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUaWlpWXZJRno3Z2I0K003\nQk5RVmYwS25GdStuYU1taVB1a2cwbXVnSHk0CmpvbEhsdVl2RTlUcHlMRjhNZG9j\ndDJqQnBIOTNYWTRYLzQ1OTRueGFvaGcKLS0tIEN2SVB2QUhTZUdGaDl6SVBHak9G\naWtkT1ZDLzBQVDhHV3krZ3F3OGUzN0EKggPAMl3Z/U+1xOGB3syCnBG5IkkYp3k8\nEVI8ZNqP1AfKK8Cnc16lZ8ImLBjZnh8OdNJUSdemrCfxYnkxk9bUoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvV2I0MFNnTERvTGExb1Q0\ndld3VjBNQjhVaFpJdzlxYWE0N05tc0N4YVY4CkUxU3RIdzl1Y0dSTTFVZ2UwUjRG\naW5FaG1vaHBzcVU3QmMvU2swM0lLWTQKLS0tIGRLYXZ4Ly94RExMeER1UjJ5NUlB\nTGV3MWFlNHJDTisvZUphWFc4b1hRd1EKZ2IQcUpBTZq2+SkPbsLHNgsb3K/63QNu\nNQr886LiO8ERLw9NZ87WG2p50FHRNKAviTZm9XZf/AgGdBH+cpvg7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFk5ZzRCeXNx\nZ0pUeWlSVXRTYjMyeHRJRmNCSitDL2JEeFc1czU1VUpxVEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpGSlY0dkduZWREK09tRGtmeWVzMW1o\nOTB1WmJ5YTBKeVJZUTJHYXM2dlB3Ci0tLSB5Mnk0R2VQOHNyUVlVaytKUU5GMGtx\ndW5oTGtLQ0RQRUxKRktNeS9FSEF3CgG0zNOuH54TxGzBFFgvMVCtDh/6nyhwWi/m\nUNOtZrlcT7qwaqBvMSjGjnWAEqwr+s15P9wi2lPX/UdVUpXa2N4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEVvNzJ3YlFW\nd0YrenJZcHdQK2YyYzNGa3BqY2ZVeElyQmkxMlJuSHlVMHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwowbDB0akhEZG5weklKNmxxa1VzbmhY\nR1QraHErWCtZa0F5aTdkWGVKRkZzCi0tLSBOR1NNQkdDWmlwZ3NaSTVhaW4rN1Nk\nZkUrMklBb3NmeXN0QTY0cGFXRUZFCkzEyNFrzpKxFENcq84i2dSsBp6ltOAIt3CZ\ncHDCmL29d5/LjWrb4Qbp8lPYPr94kJLbtAoL1JmN+hAJqCY7JVI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpNaUFzYmY3\nQk1ncEFYM1RkZTJQY2JTR0RWbWFENkRhalVtUDcyZXNjVU0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwphNkVjYUcwRnN3RWJCMTRXT1hlcVA2\nMGFWUzFRTFlUbTUyR2Z4WlVDbk9JCi0tLSBBVFhlUnlxbWQ3WU9KL0t6a0tNMkF3\nTjBybHZWOVhnL0oyemxQR2Zwbk1NCmQL+jg7YhafYZMP00eQvJpNwvXK4sSJ6pPd\nONYhdpYWSqorv6O53ch9ipDhL6X3RPgHRyX3R+fIFstArOtOWvs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNTFiRjJud3FTN1lZNDY3\nTFNKQStzSGVzaC9MMjI5ZVJ0Z1BzWW5TSkVZCkhwNit5dTkwbWRncTRkNm1URDJN\nZlJrNlMyL1dRRWlRTUYrOXFjamVtVk0KLS0tIE1Wd0pTdkVRdXFlQjhhTnY4WlNV\nclRacUV2bGZmalV2bkhVWEtWbXM0blUKpjB3n1v/2ZGSHwZB6VqQDmvBpQJ+C8lM\nThKdQL9BqWhizig2Y1sYuXSSbktcsme6AabDNh/7FkrfRW8HGbXj6A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQXZpbkMvc1cySk43cWdN\nSzZTdTRpR2czR0crMXJtTUxNazBjU0FkV0U4CmJmcG01SHhOTk5wVjNrNmE0N1VD\nYVMyZGg3Zk15MlZwRTZsS1Y1Q2lxRzQKLS0tIE5zditwbkc3dU10RVlPUWJCWEUw\nUHZpbC82bG0vdy9veXhtazA1ckR0MjgKmwJI23KxoGn7QPkcxYnOYQfHG2qdQzzK\nm2+qXvA8Iful/7sB71GvcUoSFMqvR8jDo84PO3tUuFPZvgf3CfITJg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrODlOWnl3R0lVM2ZJYVQ1\nczdKcnZWTmEzS3U0akhvL1RZbDc4ZFJNU2hRCmplQlhOZU9kdy9iUmV1eHk2M3Ns\nZTJDdDlnZ2tEd3dtVTNVVmJCME56K0EKLS0tIEoxTUwxcmYrSHdpbzlnOEVSYS84\nUlV3RlNNa25RZXpQTXNTUXp4ckxnd0kK2sRFVRZ/7uaB8S9wfEVO05fNlwXH7Cf6\nT/rRpXAvjGSABWq6Fwzt5dPvIf7iKntYHHP3RHsB3dBoxhQayEFoZw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxa1hzSlFtNndUeWNad3g1\nZWFsV3dGQjRVem9SZS81WU5iWTdDNGtZRXhnCkFTT0tOSng1RWtRODROZStxNmd1\nODNQQndGSk1wcUFvdjlRYUM3ZHJMMjAKLS0tIDFZS0dlMXZ2QTdLdFRhT2szSksz\nZitZcU9MendCbkQ5NXVHSDY4TXByRncK8CajXcPrPFpMnOGWlx0Cp1boK9fujUbc\nN8Uz7J++4wsZF68Pri2a1fCHXXDRtkPYQi2IDvuAtVslC21rFJp5pQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-24T08:01:35Z",
+		"mac": "ENC[AES256_GCM,data:0U1N+gx4OChXGJBoXLurTsiCshv1kx1aQLnDT+Yu5+igWS60XgtIrkbriy7SMbL1eGrEZWjtuIKw4QEN0alkNWFb1h6T1fYYKQaenKK/dUTautgpfAyxElDNJZ9bBVnYAH4axCvYuR7W5kgqvfLagXQU2D6fpargfdHWxG41J3g=,iv:czkt4doampkV+5X2NXIG23cEzJIrBSN0co2IzRQAMks=,tag:yWyBfOwg9cRzc5xoMFiW7g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/rigel/zerotier/zerotier-identity-secret/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/rigel/zerotier/zerotier-ip/value

@@ -0,0 +1 @@
+fd79:fada:fbe9:8c5d:d899:9379:fada:fbe9

vars/per-machine/rigel/zerotier/zerotier-network-id/value

@@ -0,0 +1 @@
+79fadafbe98c5dd8

vars/per-machine/vega/nextcloud/adminpassFile/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/vega/nextcloud/adminpassFile/machines/vega

@@ -0,0 +1 @@
+../../../../../../sops/machines/vega

vars/per-machine/vega/nextcloud/adminpassFile/secret

@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:8WNZYX0r9a8TGoO4JiogOZmgv3jDEQ2B5Ubc6JE5dNdokQ==,iv:WupqJ9NLHRdKEcMFd3JviX1CL0FSrri/hxL4ePnPs/A=,tag:kvlS0bwOikdSsyhIo6Gbow==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGZPY1hZL214\ncVJ2bm9qTmR0MHZFY1VtVjdDT0h2c2ZPUTVIOFFVWDdNd3cgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo1NjRpNllvOFhJNnI4VDRHUWtnMndw\nUVZDTzRTK0FLb1orYm9WaXR1d3ZRCi0tLSBnWSt6Y2FaZ3NTRmREUGpvc0QxWFdz\naUQ4eVlpRlQvYXlhTmRiNjZZR2RVCjadjzYus2Ao4x8UvciVQl++kU3ie6I4tu2F\nhpZdq9+knbzUopWX4A0jdrBwUlu4im1IgBqqJlWxG333ThcVBdo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExMZzU2Y3do\nck1zRktzT0hYT01rUmlQWmlodHVjZW1EYzdoUlE2enhyVDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpFR3hrcnJYdkx1NWMzeEFPOXVic29h\nYUdpOGo4SnUvRkFKTGlRZmdjZ2dNCi0tLSBGQlFPeGJsU1IvcnNUMTdVQmZiajc4\nTkFKMU1vYURseWR5eGFCT0FpaHIwCkwK8EXaRMCtNqqzR3gaklpTULy+2ACNDeAw\nyJVRm+Svx+4/bjt/LoKcNtaMEjIPuUHR66ffs3H0Dd9bLSetHu0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdHZ4ZlZJWXFRTzFIKzdB\nNVh1TVFnREhvVGM3MU04RWRNcE92bk8xWno4CkNOQkt0TERzMWFXYmlSbXJZWCtI\nYTdCMzUrcVJaNmR0U3lBUENIazhlRWMKLS0tIHNHb1JiV2JyRmVKRDkyV2VlTkNq\nVmVLdWk4SnJCMEcrZysraDFhS2hwYWMKlpCitnwEx8yzJ5tcPukGXrJLvSzP4gk+\nHk51WG4V8M/wLJ01CPniCSmkC8s5uUCeiEbsTieWik+oLc71ZqbzUw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpTU45bVU4SDZPb1hUMEJ6\nYUZlRzBpM2d0ZWZHZ0piVU5RQWpSVitxSUd3CnVqMFNvWGRJQXNTakJOa1ZJTXdV\nSDIyZkNkc1hGVDJpVk1keTFtSkRCRjQKLS0tIHFKRWZCSjROdWEwdDJHQThqYkk5\nc2E3QTRyZGRLZ3RoaWNRREhVSkJFUzAKUKDVxGcDm2+0l8OxcuEMJhwJuhc2uH3K\n4qWQP9YeFwTh79Dltq8+mBSxKXFzM4HVvMhUl+2WrDccwDK2UUN1Xw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqKzhERDBRaGtReVZ1UmNN\nMlBianQzaTRWcEZPWlZ6cVI2ZENUQ3NuWVVZCmJvRHFyK1Jzc2h4UDVoZkZYU2lT\nZCtCczZPWUdvOVBvb1FUUVJlQk1XM3cKLS0tIG5kYU81N1ZRS3hWTzRyTE5CbWJ2\nalJkZ3B4VXh0OFpSR0gyK3BSQ0tWZ3cKa78Y1SpbIsQvRKhUyEkIwHZSc5Rw3GBV\n/7OlMibkSzNm1tgHe12jA8c+z6wj5qxS6LxPOdRnvKZlqBzA/QIMIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2NVRGbzFCY2RKMktSMHpo\nRE1Lc2VpZGxmNktWdE1XTHd6VHB3Z2ZwWEY0ClovQkMvS3g2Uk9OcTBzUnUzdm9x\nT2RudkRNT0JlbHNNVlpYZ3dDeVNwdmMKLS0tIFZUcHU2dk1nQWt5S2NGbmtpaWp2\nQW5SN1p5VGRyekQ2M3Y1NmFCSXJkQncKEXtJZnjAPmxWqch3sP4ZMwCYNttsWIfK\njZEJxZqJOmbgGYGRoXy8J1+/BQHSiqRwSJLSxW+2KlFq93gv9Cd0zA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBua3A3am03ejZ3ZGZYZjBP\nMXJNUDY5MmtzMkdwQXJDNzFTcS9Sc0Z4MVFvCnBoZkhJZUdYdHhnc0VtZWRMOVNm\nbTd5TEtJY3NTcWtqSS95ak9CNHBuL0kKLS0tIGtXVlp1Nm5jUktzK0ZYbUNlTExV\nbUhhOEM3NlUxRVhydDFKVVRxS3RCRGcKgdKLJasZC1nNakRHoRVl++T4huNIOVzJ\n5wgnP51BRfi/SAtKfGcBoK4gBB427EUwUClVe4fdWF5MG3YK8M2fmA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRlhOeU1BY0lpMTM5bTc4\ndlkwOW0xbVJrQkM2a0tPR0ZRZit0TXUzQkFVCjd3K0JRelF1L1V2bDVBRFJEejY3\neGpWeHdZVDJnTTZRTkFJZjZ3TUtVc1kKLS0tIG9IS2owUUJBbFBnVVM0VkVNL3J6\nQmtqL0JxRWIzc2dKMzNQc0JkN3Y3aGMKs7r7yenHL+rTlv7mqS6MEeyVKtCrwnjK\nu92lVy5QGnx7+/I8Iy+blaLAiQlsN+AEFHun6aH26+cK66T+SVzipA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cW9rV1VrVXVHNDJENVQz\nb2sxNHVGSzFtMFdxaWUwSnRzcW54OHViRURzCjFJeFNYSnk4b3ZVbXlxdGQ2L3li\nc2dTQTVFejNRbE4xblJrYnBpb01SeHMKLS0tIHNtLzdkcGszemdRSHNmTzRGTk9Q\nU3hMeDV0SFI1VzlOaTBuK3Z4WUZreDgKjA9NFwaNXzQamVgmTxReONTfXZCGlixD\nwxpJjC0V6P03Eu9B9HB8T4sSXSXsRKL2k3H9BcGCKu5xNhqG6zAUbA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHg5MlNGdHdP\naW4zbHhBa0Z2L0tpS3J6MmFlV2QzVmxJRlBVL3dQWEl4WDQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3QytPSkFDUFV0d1h0UTFOWm0yT2lu\neEVPSDVBRC9aV0hzZmEzYXpyT0c0Ci0tLSBQc28xZ1RlY2dIak9ITHVuMUF3VGZa\nNDdEVkI0c3ZXdi9FRWdWSG1nRWhRCukr1O74W/LgHpNExNf21Ph5mCs2vdV3yqJS\nX3GRWmwqGKNxl4c4TOacQ/gvJIDg7LYH5KQEXxcvNnFwBx87F+M=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T07:08:26Z",
+		"mac": "ENC[AES256_GCM,data:q1ZwaPw1WOhfFvkBltOHh3LXfhDReHy9AD9VN9NUhY5eiPUwEIAjNu4z2vdknaNtzPCwYp6uERdH66D9l4saxyGOROhUKl8GDDsPs+cYXderSHXQeOEB0knW851/BQaaicmSzH2WbpbDUqmwCdDfz2rJ51r0KRB9X0HUHnTWzZw=,iv:jKIIHUCQWxLuuB5vipslI/3JC45d27yyyaXX5N/uKJU=,tag:nx9zwXVAQ/zfQPfQI1MK4A==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/vega/nextcloud/adminpassFile/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/vega/openssh/ssh.id_ed25519.pub/value

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPv0QjFM0mBgOprFKcStm105vdgH1mbx6f+1X7P5UH7j 

vars/per-machine/vega/openssh/ssh.id_ed25519/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/vega/openssh/ssh.id_ed25519/machines/vega

@@ -0,0 +1 @@
+../../../../../../sops/machines/vega

vars/per-machine/vega/openssh/ssh.id_ed25519/secret

@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:vYNRYtA8xBb5eqlVk/cnWUCr2EfvyGW0imm0tV8Nnqeik7qVDQe9hyHNdvMrD6zpICor5LfNQAb45fYGtsIRPyV3cSU7HrD0qmNeDLP9lgsQFrAHCJaQz2Om0tOM0tHLP0fuUpWpaYtjPIl+5P7PiQV4rzO79cGc0mO2VfQbJI68ugRBb4md6zEF7UarKx1bi/tlKlrix1F9PpQvh4Sd0fJDFs3yiOz/tQLiXqzW4Fk1olqSZcqU4Ogdbs5tASmlCdzqrM2Qr77Gr33FmrvG+A0DOM3FUSCFVCJjaYRyC+bof0EbSthG0pROyx0vA+rPIXiCq6lr9xBocC97m7dEtIQEZlQKwJv/ulxnX/9YL3Km9tIBrm5ir7nhU3D/5alfjPHPPKJ0BUTCUku3A+3CeeorgGVrZupcX3rDlk9rd3i8M2+ucbr5X3/xMfvDXDCNx/Fj+e3gX6iMcftldIKNi4bY9zET1Do3NAsJtMxUBNgsBtKw0EuccN2H0TV25lCTiAqx,iv:Tk/ZfnU78z96EN81ixQR6XyL5C8lG9d94MJ81xW5eFQ=,tag:gpt1ACabLL4YGWxZmL0ECA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZRUDJDMmdM\nZTQxNDhWYjVCMHpXVWFac3AxVU83UktnQjZFTUJlWFZSM3MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp4NTRpbzkvVWtvNWplanFtQlhHVHo0\nSmpDUTJwTGxtZHB1bVNaTlowc1lrCi0tLSBtWFI3Q2g0eXdkRGRPakFiOTVQUk9Q\nYXNJeHZ4ai9vYW1hNGdITTNBRjZBCu3l23xWd61ULPtmz51vZp5XkuaQSNF6gmsN\n2HIqpwUA/2OnzXfpzWwZySlIoFdVe+J3UAZBZ7K+eYAzoSc3BDo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdjbWRnd0RP\nZUErbWlOQ290SHJSbFdaazVnZlZIQVVObW1pd2NrY2dzVk0gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpFSDRjcWVYVm4ydnFuNlI5aGlvbnBp\nbWJCaGtDcy82UWphUlpWM25QVmNVCi0tLSA2MkN6c3MzOTlEdEVIVnlFTGZJQ3VP\naWlPOXBvUCtHRWl3a04rM0ZYdkE4Co8mML7PcjvnmNiCICZGw8YmT4WjMbP24fb0\n9yU83OiRSVlcKYKekh2jSNf95mxn7D8Dbq+ZAZRIxQ2FkefW6hg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpNXJ5SFV0bmVaOEx5SW1J\nTjFnV1h4SktDZ2xmVForN1I2ZjlpdTRidWhnCmRZanlVK2x1NjNsd2x2OVVsQ0du\nUmM0MWo1SEJ3eVVsQWs2V3ByN1V5QncKLS0tIDVMRis1NERwRHBFZHc1NkY3MG1R\nSkZWY1RoZzdZYVMyZE1uMkZUZ3V3M2sKKiBWZF/eKHAvn45mHFl1zOWOIU0QBruK\nb7zySBdND82AbJ+Lqp6pE4jlFpEjGFH8wJf5xNsrJqp2KHPZgbA13Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrM2lPdHplVVFHTGd6ZWRl\nMVhabVZXYkpRRlp2YUxnWU1TZHRLNWVoTmtRCmEzTGI0RnVkY3F2QWRFdFNvazBG\nd0lmcG1LSFhtckV0VmR2bFNhR2ZBQVkKLS0tIEY2MEJ1UTN1UUxDU0dsOWUvMzYv\naWhpTjRKeEhGbE9HMzF1UlpITFpXTzQKYvjqH9OEppWUt1756/uVZZDEcxvaVng4\nzAI64N3g0H2+XSHiZTbSuUJEznqkd+fYmezQRbElrP+OZKP64/1NfA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoZmFvWWduUmtTbDZuaXJx\nZXduOE9BdHZMKzRTTXkyRDMwSDJIR0VyZ3prCkJyc2d2SzcvZDBuMDBiQ0NPZCtj\nNGsxbVR2VEtaOGpydjRwWlc3WVRJbjAKLS0tIHE4T09mWTZFZjhsZi9UQUJ4Tkp4\nUnhPSUtyVDNyQ3FUOTg3c0doZ2tSaE0KklIZLnHGddAwqFjT2el5HsXSw0ptE8mo\nRv9QUp8/c3RukPsG5vE/BsWjJ0Q/cYfEXCWabsvxaFDGounHPJknuw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3UTFqQjl6d3p2ckRFU1V6\nbkRBUVk0MkVldzBJTURvMDZnTFBqOTgzYVZVCi9sQXJXL1lPdjlSSU01cjZqL05m\nckZyTnpwcW1la2xTM1IwQUJXTWdQRkEKLS0tIEkydGxzUjFxZlJ3VmxYNXpZSzFi\nVEVDenZ2dGZrN3lkS0xIVW1mek1ibmsKZkWJyZfGAcWbVMVc6964JaBleTT4ZKwI\nm68OfaNAmA57y09/O8Xnxp5FsnkbdULBRbccv6s5rBimr/5GgfIARg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmZHMrL2h2QlZySldjR2NB\nVnVxYXIrY2ZHVEJPU1oxaG9CSHpvOE01K1E4ClFqai9jZkc5bW9LNEU3TE5ZQmZa\nbHFuR21YVGs3bkU4cnYrN0k2QU1BYVUKLS0tIG1vT1E2c0JWME9nMDNNYTdYL3dp\nNHc0RWJYdVFsME5pRUpMTGY0UkFpRU0K8H+FfF4mGKag2dsx1BjBu4/e6XkTu8Pq\neDEe0zwCD0z/emYaLslZ50NDgAgvGkl6Q2y8Y1vcaX2X2BREH0kzzQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZWVwcitjSklXdTNYYVAv\nWDU1VzNxbVdDOUo3b2hXNFg3V0RqMUFwVDNJCjE4UXdZb1FFTWp2VjdSMFd2NWpC\nUjZmUjVYYXRvSWUzVk1mUkMzSU52dmsKLS0tIHpFcU0wUEROVkV0YXFoODhtbmZi\nWVFiWmRrRXNNaFVsZU42V2ltQjhGREEK7qXMJEtDMMVU5BJJeOwn4ticQXNaTQS+\nyvYjCE+U5080PtK+9l1LnlOpYxIKXw+Cn+jTUkGmDwEX0oifPNIUvg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBna3djTDBqKzlTWFpFaUhX\nVkNuQnNTN3VuNTFuUE9RalI2djdVOFdLaHhrCis1S2EyenlGZDdHSzhPTEFtMUdk\ncjQ0akRYU2huV1pzOEhDUWtLN2JWZU0KLS0tIFhPR2YzQ0Z2V2phc2xrNTc3Rmpv\nTnE5NzB6aENZNFp0U09QTUVDOWhSblkKd7bqI00jFdfYlLFooTSfsME6oXDPBFrc\n8GrniJr9sLSyPXUCGZQ+ZWF5ooW/szlB4HYL7/MPXhDct82/TeaUMg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFdXTExVcmZG\neWl6WUFDMk95N0RKNVpNakhPUjhjL0RqaWNaMEtiNHRPU1kgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp5QkNLbWhHVTNIdjBiSnBPMUlNY1Ft\nMzRHNXlVVThlNVowQ2N4bjFMcGRFCi0tLSBSZnVwaGhNUW40TDVwVGRoWERxcVho\ndE1xUmprSXViWWpmREhjaXg5SGZzCu18I0Dsq3bHy4XBiCpw011tO8EgGUSPCfZb\nZXyFvh0gZOFKvNkkGDHl52ejzO7PuNx0g8oH9OSTfrNNJKhLtJc=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:12Z",
+		"mac": "ENC[AES256_GCM,data:md8/9N/a9LX4xTCfuWIaFkxc/Zg57oW97qPVOcyx0EA6FpxH4IBXdLfQ3Mnw4onet5JUwxMbZUU8nQuHMNdupjf7W8zeemdns3nDTYxU55G5Ba+Ku3QXdPXryJycVOoPsv+uTN4iucMCruCEApqNFyhBP15Ev8PPcri/OLdtr0g=,iv:7s0JMSmZCM+TzxHMBw3HRqN9AgkisM394aOQc2rgijA=,tag:gHvLHuK8HtER3QB8QJTxig==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/vega/openssh/ssh.id_ed25519/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/vega/pocket-id/encryption-key/machines/vega

@@ -0,0 +1 @@
+../../../../../../sops/machines/vega

vars/per-machine/vega/pocket-id/encryption-key/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:EdRWRXZnTG8lhatXpy+ldTDad1E+lyjtFBFrPXUAvsrz,iv:zjqe5vnMPYv6Op4pBBGMJLCgdJ3nUtbXs7b41bpPwRg=,tag:hkkRkvRFo6tUc4REJu/ubg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3cHRRckpQUHdMYmNwZVdk\nY2ZSOHNTcXZaeUdqT0djTTh4RzdRNWZPRUQwCmRwc011UzZOVHhHL3dSUDRQVTB2\nZ1BKRFRCenQzMVhMVW10S3MvVnNsbGcKLS0tIDc4WUF1OXFLVXFVZi9paWtNY0Jj\nMGRCdVd1UmlHbmdBQ2dMbWt2MFFzVE0KyymVPmsYPe5zD9eDKN+zjzlpJ01kfwcj\nuVh70RA+O2zfzF292H2kqntfsbbW05LXAr15yMXHrnwEBxqZdyyHPw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsUlRlQkt2MkQ3dVdKcytt\nUzdEL1JCK3BJdFJyMk9uVFJSbG42ME9MQmkwCkhRTklrdU1Id3NBWlJtUG95ZHI1\nMjBNZzM1T2lENUllekNpYUc0OFo5TjgKLS0tIFlOWVdhU3BLdk9ybHRzVGJSSmdQ\nMzhraTlZYmUzcXZHdkJ6c3pCamZtSGsK0WsS2pjVkHVr6Zv3gdv3Y36RcLEqB+pj\noIMXJa6g2qnzlpyzF5jrMiK1ZZHInBn1QljZlKjqILTuiX8rzyxuIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T07:08:28Z",
+		"mac": "ENC[AES256_GCM,data:pmYh5nxAPXG9dUd85L3zBjpzwbDUsUFj+IJinuThLyBS+2NshJmEoa2N7GcVSCd+OvDGeW+yHTrewgX/i/G+G0Kk/2x3koHLAebYEwYPRkqz7YEhBHA/JSRDa+C4V3CFt8l8NyfLnoqtuPFNhHG0cGpV5EIKsS65sQ0NLzT1TP0=,iv:hx8jCYESaokgLXjvxnn1WNEq4oHZQ6N91zplhDJKxNw=,tag:279TaUllCUi1YHUU1SFKPA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/vega/pocket-id/encryption-key/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/vega/root-password/password-hash/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/vega/root-password/password-hash/machines/vega

@@ -0,0 +1 @@
+../../../../../../sops/machines/vega

vars/per-machine/vega/root-password/password-hash/secret

@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:PU3fH7ode0Sj7Om9kIDHQ9CjLz7KZSdhaSTPsfzRhmr8w4YRQHTf3YGx7beMTGpx3mnxXljBAuGXdoK2NLfGaJJCrIRF0HU3+Y9idokp2BnH3LW5dNTV+KVpVVDcuVqCw/eLTL4O3RqbvA==,iv:p1rv8LSAJLPf1BeUoPUh1gEsWEG8m34WYsohefCA7Mk=,tag:XPetfNGYOeJW1cgVlrxUSQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEhwY000OEwv\nSmduQjNEVWpPdVVDdnZjM24xOEJVRWN5c3ZXR3ZiVDU1bncgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyd1pZbFNIQTlMekZ1dklFTXNRaFdk\ncndEK0tKaWhnQVUyT2doZWtMOVV3Ci0tLSB6WFBrUmUxMFE0VnFMVzNCcXJ2QWR5\ndm85SkI1d3JtT01TYmYzVHdPYlNFCquhBwkMovf6wPqg7NREA4TSqJbHr6W00goe\nyGJhWDnXVMWhkyssqi3u80pYNKM1G9Rq+zSsCKRtRo/if4RjCu4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGMvSmFDSVdo\nQWpKMzI2TjRRM1lLNWNxSHpCaEl3TUFaRmx3UGlhczZZaG8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo2VnU2T1FsSG1hMFlOWVZpLzhVOXp1\nVnQ4VkVEeGNDQmVVQk9CN3NVTlNjCi0tLSBTSmthSlYzb1RKQWZIM0Z1TURCYVZ5\nb2k5SzRDS1Y3TU52and3ek5VZThBCtiCy4AjKW2gf33FluA4UVMMAaIe16rSn4mn\nPEtYUsM8gJfR9m7XRuQNVBz72h4abWP10qGOUrCegFglaCGKvqE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjbnFKdkNwRmJvUDhWakIw\ndVpiUDFxdzAvRWRHWGx5MnpNK3NJaDV5VHpVCkVvUWwvQTJqdzE3N1VpVmg4cUho\nTjgycmtXZ3Q0YTUrZEt5UFYrVTh3OTgKLS0tIGpmYU1XUUtURkIzUGM4RkVRK0d1\nNkloUXZXdFBIdkFqL212UUovVkxsdHMKBARoORZa7HkDB1QWCxjTT1QIuKYWoVii\nlrhd7/wmJ3wb8iKQygsK53twx3ujXUGH2H5ThCwfKxfBO8wpDGxkFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1SDJRYUZuYW55T25ubGda\nWjdDMHQyM0VQV0drZnNWRnFxY2ErTGNTcGwwCnBGeDhHNmJwN3BhNWdaSWpReVVP\nZHdxWlBLUVdBQ28xMjE1Vng0YWI0L3MKLS0tIG9TRG1EaVZlcEQzNFI3dU05OEt1\namFiYWFmVUZ1QVhLR3gvSWpNRUpzRjQKiMowQiEraMlYoBLqAdQ7y7Y3sO1cjz7d\noCKatPJkJ0ub4Y3Wg01xnwKaNClk6vozNvsp6SKy07RUhHSjlk0dFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSL05nRE8vRnRZdkV3SWZk\nTGN6VlRBenVqYzJhbER2aUY5MmJIR1JFZEZjCmc2R1ZZQVd0aFVDNk5SUVduR2pI\nZlB3RVNBV1Y2VW5TaGM1T2RxTjZtZXcKLS0tIGFsOGd5OGVYMHFFY3A1Y2l1M2kw\nVmgzQklwbFV3bkMzUHlxa3lGdVZMYk0K5y9ISsL1lMyBuT+R0M1Q9T/PBIwOuvce\njTGiOYYytpWqfIuUIwVP+k2g002WI8ILipD3lhX8SNqy82F3maCVPA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQd2FnN3NMcVZYcVNYc2dk\ndTVWMWxNY0NHK0EwOFFBSGdiUUxrTmFMTlF3CituVFNiSXR5OStNQjdGTHE3c3hy\nL3VFUmZ4eDQxaWZwaUFXZlBOWDhxTWsKLS0tIHFCQjdRT0dIYmFKQWVmK0lQKzQ4\nMVlVRlp0cUF0ZzFEcCt4c0Yxem9tdHcKgzHyrDi8oa/a6QRojRqoYxNzwcGaZJ0u\nasn0hyLiLiOhaJs1EOvg4Sp7rGpxIKKSBMI9qQeGlISRJi8pCvqKOA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMmtod1R2dGdDdXluRUV5\ncEZNODJPbStUV1ZsQXJRTk9MbGNsL05RY3pRCmVsMFB1QlRQTnljMVozdmRMM3o0\nWWdaL25CWk1idjhOeDZRQzVidVRBbWcKLS0tIEFIRmJjK21OS20yL2lZekRVRi90\nSVMvNklEYTI5T1pSSXMvbFZtOXhsTXcKuyefORMk0im4AWP1p1YbcRk65DDDCN9G\n06xvBCjAsxA8kjKqfMWVdzE2E+sAC6fuYym2+NJdf2GJDg8MEK8/Jg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3N3hVdk81SVJXUFIzRjI3\nbFFNUGtPWHJDRnhUVmVtSG1WdTc3TWVseXlvCmhacnQrRVVLYlZySUpIVjVBMnpM\nWFIwMUJ5eU1yUmZRRyt4bTI4ZFFCNG8KLS0tIGljc0pSK0pLQ2h2RmFHZzBEY29S\naWxNUDFFdlZiWmQ3QlNHckM2ZUNYZmMKP8xLp3Q5sZldJDTuQ9zO064ckHG3ryBX\nmGXtp9l+SDyKL7VHAV2Vxl6tRhQ4Dvfy9pfSXog9mynXrDY4JT4wPQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZ3R5MytPZnE3dnlEaFI5\nSEVYQnlYcm1aSGllMWVSOXR0T2U2ZXVQZWlvCmhrSm1WZHVBTlBqWVJPMWZzb2JD\nWW1GQ2FnbzNFOGlsS0g2V3Y4clR4RUkKLS0tIFpiRjhadHZZYWhxN2lUZFNiMDVi\nTUpGK04vc3VTdVB5eSttWWxlWHlnK00KgHQVIFtPtkjldEdSguBqItHkrXIfKcDT\nnYKyAj4EH6H4/miqJ1nKo/a4bSpAA05HbCfashmqIU3J6ED/UV+XXQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFlUWUtDeTl3\nMHg4a0lQcm92NTNPTm9YS1dTOC9nNFNCYWdlTDJqeE1GVFUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpENVBkeCtqU3FucXg3VmYvYU5yb1BZ\nTkZYWGh4Q3QrVm95amZJVjVuQmJBCi0tLSAzZDVYcWlYalM5MWhibm1MQS9jQzNP\nU3ZiQ3RMMlEramFiTENVU3hMcEJzCk+0tLWVj/tvtVr5NOvMej4k+0BJs7RUEkIP\ndlF8mTIQ+IVhOgSEkEDgaWemMihiaJC4FgKu80IWg/HlXsMIUKs=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:17Z",
+		"mac": "ENC[AES256_GCM,data:aBlQlB4fvyiW83pgQr7+06F3XWQAR2wiHIE3TXb/HYHyGsMoGsOK3CTi//cq3gsa3tahRPb7YyMmV21iGvLWBMUwoEKxD6CVnLYjKZxthkgJ4L5O9kTudyZBUcRcZj/3LVQRqdBEnMjLBZPdSYNcAorkGxgOlha1wtZS9uJb4D8=,iv:a3h3syMqSVkZFWaOPFjDdtXsMoY6tlHh84l0a7ZsGWw=,tag:KFn09QfVB7EAjl7vCmfyMw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/vega/root-password/password-hash/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/vega/root-password/password/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/vega/root-password/password/secret

@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:qoZ16d1q7SyZq6BEEfi4DDZVbF8Dlm3AmS+m1GbJSs0mXI4j,iv:uCN8zWAhVyGBessK5K6xlpBOcPV1mn4YUe8FUuQjlwo=,tag:jx4lt9NzEdb1NUjmI7N65Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGg0cUhRYmdj\nejFSQm9GY2NzUEhaQ1N5OHFGeGkzR29mT2duQ3RmTEhabU0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp5TmdPZzhobVBrQldmR1FidENKek5G\nTXQ1ZFNQNWVVY0pHcUNSeGIrTU5BCi0tLSA3aE51RThtQU9JUHlGOEVHYjNORzlH\nTWdVUzdrRitxRS9rYmRCU2xSNUpFCj7MTRh2deMUTz2tyMMjuy63KDiEd7tQ0Dzy\nlThWRu/fos9UdIdrFtS4oQfp23+UCp5E3fZRAEivi2JrZszoMfU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdvcEhEa3VB\nM1hPNFF0ditNckdXc3RiOUs3OWg5NHRyQ3IvdndjQ2crVEkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp5OHNTZmZzUWNGMGJGWFZvRkF3S0tY\nbW5XdnVKeGtXZiswYTdyUWZoaEJJCi0tLSBUSzBRY0ZPNjM1TUtkQ0VwanE2UFZh\nVElFMUxPQVM1WDhKZFB1L0hyQmFjCqsLBmzhIuYCanm2RdrjB9AVjX4vh8XY1yrr\n5x5rnEmCafGnH3+wrKlyHox+n+AKPuNt4SOpyWK9VTKWmT7AXNw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eHRrOVQyaHQwY21qc1JE\nNENkVzF6VGxzODB5SnNxdlJSV3VyUExIaVdBCkJWQnZ0bTdpT0NYMG56amlZQkxN\nbEhPbW5wb3l1WDJPV3FWV2lGaWVDUmcKLS0tIDJCdzh4dHNzRkE3OWpuZktkYTBI\nTVJlNWE0cXAwRHlZNlk2eWV4YkhCaW8KuGJlV1iFieVfdahrjZohOszofRMmvHU1\nWY8MeWUBiIxeBcvErr0rHo/ecwn10Bo9b1rer0Fc/wa4hiuL2D9i1A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFME9QbkN3YXB1clkwZncw\ncW5lR3JtakV4SDRwL1dMR3VFd3VMZGhQYVJNCk02UXZLcEVkNkFaTVBxaitSYUQ5\nRisvZ2xCMEw1MksyMlNrYnkyZzNYZUEKLS0tIDNsSkRtdWJwbFlsSkVrOE1reUFu\nNXRaL3NwVG5VRGNXU3cwWG9FZVVkUHcKgsRKXiMJmoO2vv7oECkpt4t0b8mnpQCW\npFCGSYiVBrycIQtnYj5VAvhDaGdIhA4NGvMKEkvFXE+SZay8kpgMUA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpMHJVZGphbERLWFZIZ1Zh\nK2FJNktTMG5PU0ZVZ09jM2JhUUdENGwyTkNFCmhYMUN3VEs1czRzdXNoS2s1L0NS\nMTRjSytZb3JTMjBJOUhZRmtLWmRBekEKLS0tIHZ1RW9HNnUxdktZQ2lUVlF3eWRG\nVUlrVXlnNit5SFhCUzlMbmtoZUY2ZWMK/6DcAfzcsLD5zM7kz32Zs6oShOvlCFUt\nc+r/FvlFKH5BD2WWL8hqwqk5OOfV+r+JeD5KFJ1f/ZZHG/3erE50Lw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWTlNldVZoOVhHWC90VzN6\nWWZTQi9NMnFIZXNBay9Db0VmWUpyTmYyekdNCkpaYkpnNkQ4dnM1Zm1ydExLTkI4\nNXhTeFovTE9ZckZKbTNEQ0M1aUVaRjQKLS0tIDZadHJBVlhRL0taSUl3LzVyT1py\nK3pkeGdIVU90SENsYSszb0VSMjRwcnMKHfELyOWyv/r3cRfbwfzQx3o4y5Hww5+M\ny9w85WTgaG5q81cqZ2gPZZ1L/UQspUrsDee+H93G3kq8s6RB+4zcJg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYMlMvQlVDVHViYXlsVFND\nK1lwbTBuS0d1Z2Q2YmJieDdxUmhma0h3WWdRCldUUjFpWmtnUE9GTHdFRnVRU1Zl\nY1lzSkdFSkFidEd4VUJRZi9VcmNWa00KLS0tIDFZcjJlTmhiQWlnTHRpWWk2cmNO\nTldDMlNvVGVhdVVjdkdyZ2RXUVVxaTgKzVIoGyFLRgaRM/iKc/QWNiMptTkpkr8/\naBykdoiBStexDJ2LYwGgCtR/4kq6BcciJJ1jFQrFSWgeIznfNlfWlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVWUgwYVNHSHpIVnJPRG5j\nOWkrVW9CNlVtY2daak9EcVVMeFFZV2xMbmlVCjIzWk4xK0VKT0tEREkwUzkyTENU\nU2wxaVloaTF1WHJFU3FuTXlnTUp2SFkKLS0tIGM1V0ZQeExST1dSYzMwc1R5aVZK\nSEpERlJRd0JoOUJhNkxjOXZqM0dvczQKeNqVhh9CX+sURWXo26LtVVxF3B8rep/1\nSk8nqzk/PpZh2UoKTeIykVN4l+z8ugrnCZCSG1cqx7reysehGLxKcg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBEQVFGWUR0\nVlhrWjdROWd6RVJxMWY4LzhFUHR4YzFEY2IwT3pQWVlMaVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3aC92TkRGUnpjalZTdXZDNUk4WlVG\nR3RES3NGVjlzM0lVZk8zeVpzdXZRCi0tLSBucEZHWWVkTkxnNldFTTdDMUp0d2RN\ncWJJSXlBQ1ZveXVjY2Z1cTMyVlJVChqwHohrYRFIPco5FyQqIMxLbueuUfo7S+pt\n+u3NDGr7AN7iAt/qUpvX50y58+MEAm6vV3Qgvf8bnxmPUTgB4kw=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:17Z",
+		"mac": "ENC[AES256_GCM,data:oVgkprOgs3sEG4ojcZYcXFHVk2GEuyQF22QB035VVYkw5S3eOPLzc3jFFdkFbW/S61QstSfV2X37RZdJ1knKlfr2+uFbkIje5TfmnVTeonvOAVJIF2E6I978ogobHDDkmokv7YatLOVdsuZE8ce3ghc/q4ULf9AuYCTuWcAwhtI=,iv:T2mb1fDhn72pkR80LewvDJ5T7pT3Pj5YgoGw5f57Gss=,tag:M5Wkax8QtHX+VnqeGUSonw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/vega/root-password/password/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/vega/vega-internal-domain/name/value

@@ -0,0 +1 @@
+glom.newedge.house

vars/per-machine/vega/vega-pocket-id/subdomain/value

@@ -0,0 +1 @@
+auth

vars/per-machine/vega/vega-public-domain/name/value

@@ -0,0 +1 @@
+glom.newedge.house

vars/per-machine/vega/zerotier/zerotier-identity-secret/groups/admins

@@ -0,0 +1 @@
+../../../../../../sops/groups/admins

vars/per-machine/vega/zerotier/zerotier-identity-secret/machines/vega

@@ -0,0 +1 @@
+../../../../../../sops/machines/vega

vars/per-machine/vega/zerotier/zerotier-identity-secret/secret

@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:sBBwkfwu1NtWd2JQR4lzuYeggRj8phsNiv6WBmksXy5AKXqtDnEpZWYf4qxaRPXX9UkzMLgzmVr0r4DYfaQ8WFSGLRTgWhGKOnm/IaT4XVDofqUub7Hn/GVhY+WCbXI062QW7MHNnGIPZ0Yt3AxU/vUu5vAs3xI/XA/zHeKLz8tcXcSpzuOYA2fRB38BVCUAuP+VVvKmNakUDfzkWJFMEZtoDH3EcbNJNgToVd66GnaXGITTwoMvNnN5T6A9iJVoZajro6WVJOUVcKLdjwaLjwzZMccr1sy6h4+zMFtf3RKIc+KpHN3R8O7PauSZecRDVJBRmg9x4cFQK1qUtLRpiS6ULwolMaGBif6iAz+y,iv:EhAK5Q08rtDhXMUY2dP5kIPvdq6K/tP5KzbgEiXxUbw=,tag:JAX90GRMlV9PukShTBX+bA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHd0RzBERHh5\nSFJTelhsa0pxT1l6bGZTd3NoTDZxaFR1dDZ5SElDM1JZbEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp0SzZKUFVpNVFEMTFNSmZQU0pQQ3RS\nNkpEd1ptRnl4SDdseVkyWVVYZks0Ci0tLSBPcVNSeXlleWZ2Vit3bTRWSEhQWVNz\nU0VkamhrTkhnREgwUmhwQ215c24wCmj9yksSUTM6+f3pbFFW5Sfo08szndQ4/pTK\nCQMbmau2P9eBfh+I62RX7p5FBgd45sjnKZKNhvlAQzLUK66Sctw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGFsZlhlVi92\nUG9qK3pVdTlkTWFBUHFObXVHcFZ2RlBWTGlSWXh4MDNZa1EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwozenRyU25PdEdYZ2ROUExvZ3lhNHM4\nNlV1UFBod0lYSnFBQVczblJUeHZnCi0tLSBnbzlMeC80VVQ3cmJxOHMvRHZjSzRE\ncFBQaHJENDBwNG11VFp3UllFRTBnCiRzHmji41MHT1rlXBlglqJM0afHgV9686SI\n77ESU6AwJkjeL2n8GKyhnuO0kjRR47j12OHFIXsL0QGfEarbkWo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4cUlKc0NkRFVYKy9YOXVR\nVzRxdEF5dEtUSTljVzF1cEpTdWh2dDBWdTNrCks2RlAwSnFmdEdiVzBBdkloNDhO\nZ1dacnp4TnhmTGhycG5qemZ1R0EwcDgKLS0tIGZxdlREWkI2NXkxVmxweTNDUEor\nNjQzZUkzQUoyMEx6Q2h0K2pURzFIMFkKvxF1E9Zv83RnhmiswgXcKk6cgOSNpvdV\nc1rbIDgJ2t1hNfKBQXYaY/w5h7Aca88u99tv1vdcHTa4qar1FwQAUA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyeDZ6eHMwRk5VckRSUkpt\nMHFES1FrTXF5dm9ldzJRSC9pVWNqUDRUTVRFCkZFT0NIQzZNYmozT1BCYUN5WDkr\nc1lTb3QzUTlNUU10amI1eEcyQXE1YW8KLS0tIGVLWjNJaUwydFVTdmFRNUkwT2dY\nRHB1N0M4Wm5VdHoyemtzSk1JNGJ1U1kKWL5XmBmoe8hpDt0y/0y+mWQ1CjpyAC2m\nBQYKtR2DKy8Vt5UEyp0Xb4e8BYK3XUc4xLOhaxXljpKxJmxTcqMfMQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIWXJQVFltYTd2RitnRllk\nei9aQzRPZTl4QnlOL3FsU0hQc2FaaE0vbVNNClRqd0xwSWJOeG5XRURwRXpPNXpV\nV1Y4ODE5Wkd1cHhoWklibE51OHZnZEEKLS0tIDJCSzcvb2lsRnF3YjFKM1QxOSti\nay9OTlRGZlFucGZSd0c3TVZVemM0ZXcKmIIInb+zk++BeFu9rsNiHoZ9ExyOJX8U\n9B6IDaH2zXdKqZo7EQb2jG7FDLUpL/Oa+48gqpFXEEtQlweCOep0uQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjWVFUejVRdllsaXRCdXVY\nMVZueUxYK1pNVG5yM2o3QkpUOUdsUkNTNWtnCnNwdXZPTHNzYlIzWjFHRnVmbVdn\nYWVsbTcvVlo5L3JRNEg3cU01M2JNK2sKLS0tIFByNkxtUitCM2tVblkrTE52UTVJ\neVdhajEvcWlRQWx3aW9PNnhtdUtoLzAKWLb3sM263EW0MjRfcJPFeQKs+OvFlyvi\ny2+Ew9jLv+J7s7Y6cTLWAsW5l7BygJ+ZZ1bmLVIfepI1M4AEdKTFnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjdnJTT28yZXZ3VkRKb2Ja\nSWgrQzZGR1U1RENER3ppN2pRMWFpVGswbkFZCktuVWhkSHhBOXY0MkNCdmlUaE1z\naGE5MjhmMmRuK2tlVGhPdlVKSXV0Z0UKLS0tIEQrdDFOU3kvZEhCeTVnb0I5ZjBK\nSkdNVmRZNEE3KzZwSWFoeW9ielJHMU0KDuIi66meRyB817Uts4b2CBM9wp4ONNcY\n8mqmGqrXsQy6bWlYULDkRewOtjBQDMVXhaqMLPujhgemaimQKAYLaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUVRLZGVidDgwOVB2ZkZw\nNyt6RStwTkVTbTArVkh6QVRYZ0M0a2JwQ0M4CkdlV3FPSWNMMzRqL1BMMVZESWZw\nRlBib1U4ZmoyL2w4RWhqbzJLZHY5SEkKLS0tIG9DUTA2UDZYNERwU0gvU0FpQjNi\nNXhzdXdnWll1aTVDQ2NYbkRJbHRmZjAK/e1xoPAr3PP8OJr3ftXrm4xCzjgFfXn7\nGH4x/xSo5il7DkkOG3bGQr+Kl5sStJvgbns3iWim3sAsT59Cr2/zAQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdGpCTkJHR1g1Q0dtTUpT\ncjdBc1NEYmE4U1BlQnQvQzRqRFZTUnZqb1M4CmJxak1RVWw1ZHFmbFdIeGxodjJ5\nMjJGRTJzV3huUUZseWM4UExHRy9adWcKLS0tIC9sV1dpRlZCZmdpYnhEUk92VEEz\nVEhsd0tLamZRQUxYNnVxZDV3c3A1ZlkKD9DUy00ufdnI4HOP+xff1KroR32C9qWy\nTR/KUSNwB4WraIGUWwIl8scecorkAqkCL/DVlgFMbL0+Kr7e1C7Z7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHN4Z3NscTdk\nMURyQm5XWTRkVURmVFQ0a2NRRFV3WlVWejBocEpxY1ZqRmcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZworWGRwWStFWjZnYTFIVlI2VFpNVDIv\nK2paa2Q1cTNMZUo1bHFKVXQ1WURrCi0tLSAwUFlMbHd4NGFzMUpMVXpsaW83YUxN\nbFhoVERmcFY4ZW1RLzRWR2VtYlJ3CsDVEIrmcAdDN97oMOhfN1uc92HE4XFsr06e\n4QlrAEHQPaSxTaNUQwANWK7ODLHhxJBLCWWvZ/32lDK4h0Lp3jA=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-22T07:07:34Z",
+		"mac": "ENC[AES256_GCM,data:nmh+RoAoHUcrjXQx9VTPRjfQtAofwKXr1gv6eB0a9qtgCWfx3BGgo0qgZpqxX/vFw2WCgvU8I+TEPhflWXSrtpuDHrKKX0lVNyQiRnWpRLyPisaBM7FgH914zFRx0kqIFq8qbvWGBh/HWBt5olVvMsL8+liCP7wy5AIYBlAdnxQ=,iv:gbUbVUYy6WeSBizDtEpjJgvikGfLwcy8u8jUzdKaxp0=,tag:/eUGtnkwSqUjPbknJZiGqg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

vars/per-machine/vega/zerotier/zerotier-identity-secret/users/kurogeek

@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek

vars/per-machine/vega/zerotier/zerotier-ip/value

@@ -0,0 +1 @@
+fdf7:d53f:344b:8562:2599:93f7:d53f:344b

vars/per-machine/vega/zerotier/zerotier-network-id/value

@@ -0,0 +1 @@
+f7d53f344b856225