clanService/personal-computer: now uses gdm

machines/petra: added to yggdrasil global network
machines/petra: rm yggdrasil vars
2026-01-23 11:48:36 +07:00 · 2026-01-23 11:14:19 +07:00 · 2026-01-23 11:13:44 +07:00 · 2026-01-23 11:10:03 +07:00 · 2026-01-23 10:39:09 +07:00 · 2026-01-23 09:10:40 +07:00
110 changed files with 10168 additions and 163 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -121,6 +121,26 @@
        "type": "github"
      }
    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768068402,
+        "narHash": "sha256-bAXnnJZKJiF7Xr6eNW6+PhBf1lg2P1aFUO9+xgWkXfA=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "8bc5473b6bc2b6e1529a9c4040411e1199c43b4c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
    "import-tree": {
      "locked": {
        "lastModified": 1752730890,
@@ -205,11 +225,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1761656231,
-        "narHash": "sha256-krgZxGAIIIKFJS+UB0l8do3sYUDWJc75M72tepmVMzE=",
+        "lastModified": 1768395095,
+        "narHash": "sha256-ZhuYJbwbZT32QA95tSkXd9zXHcdZj90EzHpEXBMabaw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d7f52a7a640bc54c7bb414cca603835bf8dd4b10",
+        "rev": "13868c071cc73a5e9f610c47d7bb08e5da64fdd5",
        "type": "github"
      },
      "original": {
@@ -224,6 +244,7 @@
        "clan-core": "clan-core",
        "devshell": "devshell",
        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
        "import-tree": "import-tree",
        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
@@ -273,11 +294,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1752055615,
-        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+        "lastModified": 1768158989,
+        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -15,6 +15,10 @@
      inputs.nixpkgs-lib.follows = "nixpkgs";
      url = "github:hercules-ci/flake-parts";
    };
+    home-manager = {
+      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
+    };
    import-tree.url = "github:vic/import-tree";
    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
    treefmt-nix = {
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,4 +1,5 @@
 {
+  imports = [ ./personal-computer.nix ];
  clan = {
    inventory = {

@@ -11,6 +12,8 @@
        b4l = [
          "rigel"
          "neptune"
+          "rana"
+          "petra"
        ];
        phonebox = [
          "neptune"
@@ -21,6 +24,9 @@
          "adhil"
          "buna"
        ];
+        global-network = [
+          "rana"
+        ];
      };

      instances = {
@@ -86,6 +92,20 @@
          roles.peer.tags.b4l = { };
        };

+        yggdrasil-global-network = {
+          module = {
+            name = "yggdrasil";
+            input = "clan-core";
+          };
+          roles.default.tags."global-network" = { };
+          roles.default.settings.extraPeers = [
+            "tls://ygg.jjolly.dev:3443"
+            "tls://[2602:fc24:18:7a42::1]:993"
+            "tcp://leo.node.3dt.net:9002"
+            "tcp://ygg-kcmo.incognet.io:8883"
+          ];
+        };
+
        yggdrasil-phone-network = {
          module = {
            name = "yggdrasil";
@@ -160,13 +180,6 @@
          };
          roles.default.machines.b4l = { };
        };
-        pingvin = {
-          module = {
-            name = "pingvin";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
        paperless = {
          module = {
            name = "paperless";
@@ -232,7 +245,7 @@
                ftdi-sd-spi = { };
                go-go-gadget = { };
                hacking-the-kindle = { };
-                islands = { };
+                islands = PUBLIC;
                kt = { };
                legba = { };
                llb = PUBLIC;
@@ -242,7 +255,7 @@
                navi = { };
                notmuch-memoryhole = PUBLIC;
                pms5003 = { };
-                thinc = { };
+                thinc = PUBLIC;
                toad = { };
                yggdrasil-erlang = { };
              };
--- a/inventories/personal-computer.nix
+++ b/inventories/personal-computer.nix
@@ -0,0 +1,55 @@
+{
+  clan.inventory = {
+    tags = {
+      kde-desktop = [
+        "rana"
+        "petra"
+      ];
+      personal-computer = [
+        "rana"
+        "petra"
+      ];
+    };
+
+    instances = {
+      emmie-home = {
+        module = {
+          name = "home-user";
+          input = "self";
+        };
+        roles.default.settings = {
+          username = "emmie";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
+        roles.default.machines."rana" = { };
+      };
+      chocolate-home = {
+        module = {
+          name = "home-user";
+          input = "self";
+        };
+        roles.default.settings = {
+          username = "chocolate";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
+        roles.default.machines."petra" = { };
+      };
+      personal-computer = {
+        module = {
+          name = "personal-computer";
+          input = "self";
+        };
+        roles.default.tags."personal-computer" = { };
+      };
+      kde = {
+        module = {
+          name = "kde";
+          input = "clan-core";
+        };
+        roles.default.tags."kde-desktop" = { };
+      };
+    };
+  };
+}
--- a/inventory.json
+++ b/inventory.json
@@ -20,6 +20,12 @@
    },
    "buna": {
      "installedAt": 1765343708
+    },
+    "rana": {
+      "installedAt": 1768294839
+    },
+    "petra": {
+      "installedAt": 1769064458
    }
  }
 }
--- a/machines/b4l/services/nextcloud.nix
+++ b/machines/b4l/services/nextcloud.nix
@@ -19,7 +19,7 @@ in

  services.nextcloud = {
    hostName = ncDomain;
-    package = pkgs.nextcloud31;
+    package = pkgs.nextcloud32;

    settings = {

--- a/machines/b4l/services/pingvin.nix
+++ b/machines/b4l/services/pingvin.nix
@@ -1,45 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-let
-  serviceName = "${config.networking.hostName}-pingvin";
-  domain-name = "${
-    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
-  }.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators."${serviceName}" = {
-    files = {
-      subdomain.secret = false;
-    };
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Pingvin. Default:(share)";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "share" > "$out"/subdomain
-      fi
-    '';
-  };
-
-  services.pingvin-share = {
-    nginx.enable = true;
-    https = true;
-    hostname = domain-name;
-  };
-}
--- a/machines/petra/configuration.nix
+++ b/machines/petra/configuration.nix
@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
--- a/machines/petra/disko.nix
+++ b/machines/petra/disko.nix
@@ -0,0 +1,77 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/ata-TOSHIBA_MQ01ABD100_85N8C2DPT";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/petra/facter.json
+++ b/machines/petra/facter.json
--- a/machines/rana/configuration.nix
+++ b/machines/rana/configuration.nix
@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
--- a/machines/rana/disko.nix
+++ b/machines/rana/disko.nix
@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/nvme-SAMSUNG_MZVL81T0HFLB-00BLL_S7XKNF0Y966645";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/rana/facter.json
+++ b/machines/rana/facter.json
--- a/modules/clan/actual-budget/default.nix
+++ b/modules/clan/actual-budget/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "actual-budget";
  manifest.description = "A local-first personal finance app ";
+  manifest.readme = "A local-first personal finance app";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "A default server role.";

    perInstance.nixosModule =
      {
--- a/modules/clan/git-daemon/default.nix
+++ b/modules/clan/git-daemon/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "git-daemon";
  manifest.description = "a really simple server for git repositories";
+  manifest.readme = "a really simple server for git repositories";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    interface =
      { lib, ... }:
      {
--- a/modules/clan/grafana/default.nix
+++ b/modules/clan/grafana/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "grafana";
  manifest.description = "Platform for data analytics and monitoring";
+  manifest.readme = "Platform for data analytics and monitoring";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "A default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/home-profiles/flake-module.nix
+++ b/modules/clan/home-profiles/flake-module.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    home-user = lib.modules.importApply ./home-user { };
+  };
+}
--- a/modules/clan/home-profiles/home-user/default.nix
+++ b/modules/clan/home-profiles/home-user/default.nix
@@ -0,0 +1,64 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "common-user-home-manager";
+  manifest.description = "General users' home-manager profile generator";
+  manifest.readme = "General users' home-manager profile generator";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default role for the user";
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          username = lib.mkOption {
+            type = lib.types.str;
+          };
+          kbLayout = lib.mkOption {
+            type = lib.types.str;
+            default = "us";
+          };
+          kbOptions = lib.mkOption {
+            type = lib.types.str;
+            default = "grp:win_space_toggle";
+          };
+        };
+      };
+    perInstance =
+      { settings, ... }:
+      {
+        nixosModule =
+          { inputs, ... }:
+          let
+            username = settings.username;
+          in
+          {
+            imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+            users.users.${username} = {
+              initialPassword = "";
+              isNormalUser = true;
+              extraGroups = [
+                "audio"
+                "video"
+                "networkmanager"
+              ];
+            };
+
+            services.xserver = {
+              enable = true;
+              xkb.layout = settings.kbLayout;
+              xkb.options = settings.kbOptions;
+            };
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.${username} = ./home.nix;
+            home-manager.extraSpecialArgs = {
+              inherit inputs username;
+            };
+          };
+      };
+  };
+}
--- a/modules/clan/home-profiles/home-user/home.nix
+++ b/modules/clan/home-profiles/home-user/home.nix
@@ -0,0 +1,24 @@
+{
+  osConfig,
+  pkgs,
+  lib,
+  username,
+  ...
+}:
+{
+  home = {
+    inherit username;
+    homeDirectory = lib.mkForce "/home/${username}";
+    stateVersion = osConfig.system.stateVersion;
+    packages = with pkgs; [
+      libreoffice
+      element-desktop
+      brave
+      firefox
+      keepassxc
+      vlc
+      thunderbird
+    ];
+  };
+  programs.home-manager.enable = true;
+}
--- a/modules/clan/jukebox/default.nix
+++ b/modules/clan/jukebox/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "jukebox";
  manifest.description = "mpd server, library on removable disks";
+  manifest.readme = "mpd server, library on removable disks";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    interface =
      { lib, ... }:
      {
@@ -111,19 +113,22 @@

            services.mpd = {
              enable = true;
-              musicDirectory = settings.baseDir;
-              network.listenAddress = "any";
-              extraConfig = ''
-                audio_output {
-                  type "pulse"
-                  name "jukebox"
-                  server "localhost"
+              openFirewall = true;
+              settings = {
+                bind_to_address = "any";
+                music_directory = settings.baseDir;
+                audio_output = [
+                  {
+                    type = "pulse";
+                    name = "jukebox";
+                    server = "localhost";
                  }
-              '';
+                ];
+              };
            };

            networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
-              allowedTCPPorts = [ config.services.mpd.network.port ];
+              allowedTCPPorts = [ config.services.mpd.settings.port ];
            });

            environment.systemPackages = [ pkgs.mpc ];
--- a/modules/clan/nextcloud/default.nix
+++ b/modules/clan/nextcloud/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "nextcloud";
  manifest.description = "Nextcloud server, a safe home for all your data";
+  manifest.readme = "Nextcloud server, a safe home for all your data";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/paperless/default.nix
+++ b/modules/clan/paperless/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "paperless";
  manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.readme = "A community-supported supercharged document management system: scan, index and archive all your documents";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/personal-computer/automatic-timezone.nix
+++ b/modules/clan/personal-computer/automatic-timezone.nix
@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  services.automatic-timezoned.enable = true;
+  services.geoclue2 = {
+    enableDemoAgent = lib.mkForce true;
+    geoProviderUrl = "https://beacondb.net/v1/geolocate";
+  };
+}
--- a/modules/clan/personal-computer/default.nix
+++ b/modules/clan/personal-computer/default.nix
@@ -0,0 +1,21 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "personal-computer";
+  manifest.description = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.readme = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "an only one default role";
+    perInstance.nixosModule =
+      { inputs, lib, ... }:
+      {
+        imports = [
+          (inputs.import-tree.initFilter (
+            p: !lib.hasSuffix "default.nix" p && !lib.hasSuffix "flake-module.nix" p
+          ) ./.)
+        ];
+      };
+  };
+}
--- a/modules/clan/personal-computer/desktop-environment.nix
+++ b/modules/clan/personal-computer/desktop-environment.nix
@@ -0,0 +1,9 @@
+{ config, lib, ... }:
+{
+  security.pam.services."sddm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+  security.pam.services."gdm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+
+  services.displayManager.sddm.enable = lib.mkForce false;
+  services.displayManager.gdm.enable = true;
+  services.displayManager.gdm.wayland = true;
+}
--- a/modules/clan/personal-computer/flake-module.nix
+++ b/modules/clan/personal-computer/flake-module.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    personal-computer = lib.modules.importApply ./default.nix { };
+  };
+}
--- a/modules/clan/personal-computer/libinput.nix
+++ b/modules/clan/personal-computer/libinput.nix
@@ -0,0 +1,11 @@
+{
+  services = {
+    libinput = {
+      enable = true;
+      touchpad = {
+        disableWhileTyping = true;
+        naturalScrolling = true;
+      };
+    };
+  };
+}
--- a/modules/clan/personal-computer/printing.nix
+++ b/modules/clan/personal-computer/printing.nix
@@ -0,0 +1,62 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  allowManageGroups = [
+    "root"
+    "wheel"
+    "lpadmin"
+  ];
+  polkitAllowGroups = builtins.concatStringsSep "||" (
+    builtins.map (group: ''subject.isInGroup("${group}")'') allowManageGroups
+  );
+
+  printerMember = lib.map (user: user.name) (
+    lib.attrsets.attrsToList (
+      lib.attrsets.filterAttrs (name: value: value.isNormalUser) config.users.users
+    )
+  );
+
+in
+{
+  services.printing = {
+    enable = true;
+    drivers = [
+      pkgs.brlaser
+      pkgs.gutenprint
+    ];
+
+    extraFilesConf = ''
+      SystemGroup ${builtins.concatStringsSep " " allowManageGroups}
+    '';
+  };
+
+  security.polkit = {
+    enable = true;
+
+    extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        var actionMatchs = (
+          action.id.indexOf('org.opensuse.cupspkhelper.mechanism.') === 0
+        );
+        if (actionMatchs) {
+          if (${polkitAllowGroups}) {
+            return polkit.Result.YES
+          }
+        }
+      });
+    '';
+  };
+
+  hardware.sane = {
+    enable = true;
+  };
+
+  users.groups.lpadmin.members = printerMember;
+  users.groups.lp.members = printerMember;
+  users.groups.scanner.members = printerMember;
+
+}
--- a/modules/clan/personal-computer/users.nix
+++ b/modules/clan/personal-computer/users.nix
@@ -0,0 +1,11 @@
+{ lib, ... }:
+{
+  users.mutableUsers = lib.mkForce true;
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if ((action.id == "org.freedesktop.accounts.change-own-password")) {
+        return polkit.Result.AUTH_SELF;
+      }
+    });
+  '';
+}
--- a/modules/clan/personal-computer/wireless.nix
+++ b/modules/clan/personal-computer/wireless.nix
@@ -0,0 +1,4 @@
+{
+  networking.networkmanager.enable = true;
+  hardware.bluetooth.enable = true;
+}
--- a/modules/clan/phonebox/default.nix
+++ b/modules/clan/phonebox/default.nix
@@ -5,10 +5,12 @@
 {
  _class = "clan.service";
  manifest.name = "phonebox";
-  manifest.description = "";
+  manifest.description = "A peer to peer phone relay network built on top of yggdrasil.";
+  manifest.readme = "A peer to peer phone relay network built on top of yggdrasil.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    interface =
      { lib, ... }:
      {
--- a/modules/clan/pingvin/default.nix
+++ b/modules/clan/pingvin/default.nix
@@ -1,23 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "pingvin";
-  manifest.description = "A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient file sharing.";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-
-    perInstance.nixosModule =
-      {
-        config,
-        ...
-      }:
-      {
-        services.pingvin-share = {
-          enable = true;
-        };
-
-        clan.core.state.pingvin-share.folders = [ config.services.pingvin-share.dataDir ];
-      };
-  };
-}
--- a/modules/clan/pingvin/flake-module.nix
+++ b/modules/clan/pingvin/flake-module.nix
@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    pingvin = module;
-  };
-
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-pingvin = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/pingvin" = module;
-      };
-    };
-}
--- a/modules/clan/pingvin/tests/vm/default.nix
+++ b/modules/clan/pingvin/tests/vm/default.nix
@@ -1,42 +0,0 @@
-{
-  ...
-}:
-{
-  name = "service-pingvin";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        pingvin-test = {
-          module.name = "@clan/pingvin";
-          module.input = "self";
-          roles.default.machines."server".settings = { };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      services.pingvin-share = {
-        hostname = "share.localhost";
-        frontend.port = 3000;
-        backend.port = 8000;
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("pingvin-share-frontend")
-
-    server.succeed("systemctl status pingvin-share-frontend")
-    server.wait_for_open_port(3000)
-    server.wait_for_open_port(8000)
-    server.succeed("curl -H \"Host: share.localhost\" http://127.0.0.1:3000 ")
-  '';
-}
--- a/modules/clan/pocket-id/default.nix
+++ b/modules/clan/pocket-id/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "pocket-id";
  manifest.description = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
+  manifest.readme = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/pulse-stream/default.nix
+++ b/modules/clan/pulse-stream/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "pulse-stream";
  manifest.description = "stream audio to attached speakers";
+  manifest.readme = "stream audio to attached speakers";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default role";
    interface =
      { lib, ... }:
      {
--- a/modules/clan/stirling-pdf/default.nix
+++ b/modules/clan/stirling-pdf/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "stirling-pdf";
  manifest.description = "Your locally hosted one-stop-shop for all your PDF needs.";
+  manifest.readme = "Your locally hosted one-stop-shop for all your PDF needs.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/clan/victoriametrics/default.nix
+++ b/modules/clan/victoriametrics/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "Victoria Metrics";
  manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
+  manifest.readme = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        config,
--- a/modules/clan/vikunja/default.nix
+++ b/modules/clan/vikunja/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "vikunja";
  manifest.description = "The to-do app to organize your life.";
+  manifest.readme = "The to-do app to organize your life.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "yggdrasil";
  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.readme = "An in scalable routing as an encrypted IPv6 overlay network";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default peer role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/nixos/think-backend-gtcm.nix
+++ b/modules/nixos/think-backend-gtcm.nix
@@ -57,7 +57,7 @@ in
    dataDir = lib.mkOption {
      type = lib.types.path;
      default = "/var/lib/think-backend.greaterchiangmai.com";
-      description = ''A place where to store states'';
+      description = "A place where to store states";
    };

    user = lib.mkOption {
@@ -263,6 +263,7 @@ in
          # migrate & seed db
          ${lib.getExe php} artisan key:generate --force
          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan storage:link
          ${lib.getExe php} artisan config:cache
        '';
    };
@@ -270,8 +271,8 @@ in
    systemd.tmpfiles.rules = [
      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
-      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
-      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0755 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0755 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
@@ -304,6 +305,16 @@ in
            index = "index.php";
            tryFiles = "$uri $uri/ /index.php?$query_string";
          };
+          "/uploads" = {
+            root = "${cfg.dataDir}/public/uploads";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "/storage" = {
+            root = "${cfg.dataDir}/public/storage";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
          "~ \\.php$".extraConfig = ''
            fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
          '';
--- a/modules/nixos/think-gtcm.nix
+++ b/modules/nixos/think-gtcm.nix
@@ -33,7 +33,7 @@ in
    dataDir = lib.mkOption {
      type = lib.types.path;
      default = "/var/lib/think.greaterchiangmai.com";
-      description = ''A place where to store states'';
+      description = "A place where to store states";
    };

    user = lib.mkOption {
@@ -228,6 +228,7 @@ in
          # migrate & seed db
          ${lib.getExe php} artisan key:generate --force
          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan storage:link
          ${lib.getExe php} artisan config:cache
        '';
    };
@@ -267,7 +268,16 @@ in
            index = "index.php";
            tryFiles = "$uri $uri/ /index.php?$query_string";
          };
-
+          "/uploads" = {
+            root = "${cfg.dataDir}/public/uploads";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "/storage" = {
+            root = "${cfg.dataDir}/public/storage";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
          "~ \\.php$".extraConfig = ''
            fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
          '';
--- a/pkgs/think-backend-gtcm.nix
+++ b/pkgs/think-backend-gtcm.nix
@@ -21,12 +21,16 @@ php.buildComposerProject2 (finalAttrs: {
    runHook preInstall
    mkdir -p $out
    cp -R * $out
+
    rm -rf $out/storage
+
    ln -s ${dataDir}/.env $out/.env
    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/public/storage $out/public/storage
+    ln -s ${dataDir}/public/uploads $out/public/uploads
    runHook postInstall
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-eXm1x3E9KHWojaT2RU4inMdZqQVcWdLCKlvzhOlIZrc=";
+  vendorHash = "sha256-wGfbprSDULBje1s5y3+ZiU/nCwYGDEULobZzyzGZ9bQ=";
 })
--- a/pkgs/think-gtcm.nix
+++ b/pkgs/think-gtcm.nix
@@ -21,12 +21,16 @@ php.buildComposerProject2 (finalAttrs: {
    runHook preInstall
    mkdir -p $out
    cp -R * $out
+
    rm -rf $out/storage
+
    ln -s ${dataDir}/.env $out/.env
    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/public/storage $out/public/storage
+    ln -s ${dataDir}/public/uploads $out/public/uploads
    runHook postInstall
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-QV3hR3U3GwCqrCRxfkazmJwDpO1vFyMfA6YqUb4bjMI=";
+  vendorHash = "sha256-b8+AKUmjQiOdV8UC9GYfJzAHFs9+FRSH91YsxKt0rDA=";
 })
--- a/sops/machines/petra/key.json
+++ b/sops/machines/petra/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1m2llc94j2ft2q52zj0jt5fghx2r8qtdagwxduuz24hhrmxytgguq90xpgn",
+    "type": "age"
+  }
+]
--- a/sops/machines/rana/key.json
+++ b/sops/machines/rana/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+    "type": "age"
+  }
+]
--- a/sops/secrets/petra-age.key/groups/admins
+++ b/sops/secrets/petra-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/petra-age.key/secret
+++ b/sops/secrets/petra-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:soUz5kHdCe4rH0TWKyYoAqbcmIRiN380vsQtt37IWMKpn2fCMIGtBjDXq5g7mLthQ7Cl7JizvhBL0qDJKVX+JZIOa/EQ4QlSn9s=,iv:RXCgYhE7lHZd42D6PSZcn1ERqaIJ7ujUVmt5wo9QJD0=,tag:yqQcr83MAZLSHk/cbwKvDA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVUTk5UkdzRWxkWUNDS3Nk\neHlpYk81QkVkRkFhSzNhOUUzelBmZUUySWd3CldpcEpRR2pTWUR3Vnl2bzhzSHV0\nVmdaNGloeHJCT1lRbWU3eFBhNlF1NUUKLS0tIG8zeUtoRXRrb1Fmc2h0a3JGNlpq\nOGdrd1U4SVJ5Q0VkOVRYZm1OU3d4MGMKdY0LvwYdiNV3v3OqoXgVCYAuGOIpoboe\nis2eLvNwxZ5c/l+miXrkQw0cDg0bvG+2jGGktbzS6F8fIbMX5VLgBA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJUmJ6eEJuMDNyS0lrbVRj\ncWtWcVY4My9STGRVcjFjVkZBU2Y1ZHQyblJzClZ0NlZDY0lMUGsvQVJGeTN3ZjBn\nZEFsMmJ1S2RuSndjWjh1aFRKTFNTaW8KLS0tIDZ5emlueFhIajZGN1BoeFJudE45\ndm5wY3k1Q3pyWndEclhzdHhGRlYrelkKhqPOc63fLmW2Ck3Mpjw8hiwTfD4dMDWF\nKHz6hY9mBQbQbOK1UL5QADA0EJFXFH4fiEYpOlKLMKr28lDgtgOWMw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGRKWThqMmJS\nUDlTYWs5c05rd2puR1R5L1pjQXEzc1g1RkZBM2RaY0NseFUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp4RzVWUXo5M0FYV0MzREE4L0FIWEU2\nanVEcTNBZ0FWdmpKcUVkMktVbWprCi0tLSBnVVlkNmhpS3dQRXhRRVZkYjVHSVJH\nRG1kd01yVDd1NzFlQTNUdkdhdDhBCr8wWDYWFC6ghoPWL6+ARhHTgEdex0RYVaKY\nDRPDHy2s+/LAkKaKYiNWAqLbscWdtKGXkmwnqoxQm9RKqOiqVe0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFVKNElteFpq\nYThYUndzcmEybHdZb3FuZEZLTGJOZG5qSzU3MytQcVZlM28gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp5K1grb2U1S240VFVZaEtWMTRYb3F4\nVTVZUDVZVFppY1NZeGZ1UG0zSzFJCi0tLSBQUGttdFpPV3dzOEZoWGY2akUxcW5L\nQ2tzS2NZTWUyZ1IvdVEzQTFKVEk0CkF2QbY5/opISu1Z5nZgtVtkaXyiEOL/dLP1\nmG18OHT2p5Q690YBAsxc2dgZ6kWxBtXFbXRIdU2D99dr9SzPhcE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9GUFZXNDU2\nY2RscnpRWjhDdElhSG5TV3RBdGxlMm95YVZocktMR1pORlkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpEdHp3MjlybnlSTGFNa1VMRTJnaE1Z\nWVg3Ly9ueGhyNVJIMmhuaEFGbGtJCi0tLSBjQTRMQ0l4KzZYd2gvcnNzTTAraDRT\nVW0rRzY1R2l1c3VrRjY1NWxuTGM0Cnk+L/s3P2zPqkEOnSrsOF3FC5GhdrOUnt22\nOpr8XZkwnOGz6eyTqKWDfpwwhnkGxro6TxE0fi7K3+m/5bvgsqM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkY1hQeFQ2R1A3TDJaNGph\nVG1vSEswUkdhclZCSG8zRGRIY1Fyb2srRkRrClgyR0JQbHZCeThjbHNxcjdKd0d3\nWnZxS1BLT2w2dWN1elA1RnRYNXo3c1EKLS0tIEtJa1dlVG1SZVRSVFVQSUZFR3FX\nU2JMUUMwa0VKTzVCc0dRd0NaaVozTGsKjfF1ukrmfIyKIO0ZuWHTFiidtrvZr4Cq\no2IJXOjxPOAuIEgioQyUAwl9ziWYISg9xuoe3Syi0qgeX/oAO0TXaA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENFF4VTZGSVJQNWMzMDM5\nTWo1eURqSUlmSTYxSFdwWWVJc1VCb3E1Q2ljCnZnSUs1Q3A5clZJREhNSWZNQlc1\nRTRIcHB4TDZGZnFwMGpVdU9Mbkg0VHcKLS0tIHJTZ2RmU2ovdW5wQStNZGM2MXVU\nS0o4NXI1eU51VlFuZDJsekN5R0M5bUEKvCNFQNUrY3o07bbWnEw5IuDvBGjXiDsw\nRRKjCXQpY+9kWDqk+Xah3T1aKpiImTLfK3q90tBK5tUVe7m4kqlB6A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVnBSeEhKTlhFZHA1OXU4\nRzVDQWtVYzVyUkNDbmd5d3NaR0RCdnd4a3pVCitnd3FSWS8zWE5LblNxS1RuZjM1\nRERNcjJ4Y0YwRVFtMEFZcXZTMEVMM0EKLS0tIDNuUnhmNElzN09hVDArNGFQZ3dP\ndkI0OFRBYXlOS0N6cEEvbmZXa0ZVSlEKzhPJSGjDHNsv0kuluhmzuEgdKX8588Cr\n41gDyJEreZRfFpu2zjcyXYuIkKqznNpcSg98wkEpsHVO8Q/mvzwEdw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByMWhZc1padStZa3kwRzFG\nZ2t6ZEV1cUdLRHBybk4wemxseEhsTkF6OXhzCkxlK0FMMmlNbDdwbndvV2hzSE4v\nQ3g0SWRLd2NhbHVIZVJkOU4rbHloN3cKLS0tIE4xZGFFdC9vbitJQzZpbDlxNUZJ\ncHVWRnh3MEFhQjJmaWZ3YzNueDhYUlkKQksX/rsAFdW3rL0AL8qifw6KuIohhxyq\nokPJhj3bKXwW+B6UDs4IrZaSsI7bPtfQM8tYZYScP7ULwE96iV48fQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-22T05:00:48Z",
+		"mac": "ENC[AES256_GCM,data:qLq3939SrebMCIUfG4D3w2Lc0TikxGOK4UKyWvYvQLWwjf6BBI14zoTPaH6RjuqhYIQexG6xcB68VhNfZf6QD3LB6arOsyKZeBOY8kWzLkh75iSwYGruWXEf1REGVxal1h1rhzy9XiHx9ZfR0RI6jJ0dz+O4sJDv64BZWgBvhZA=,iv:NSbramhOR7xg21UV03QRAk486zyruHAQ9R7BN1A9utQ=,tag:q9tlBsI2aEacfK9UbfEUSA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/petra-age.key/users/kurogeek
+++ b/sops/secrets/petra-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/secrets/rana-age.key/groups/admins
+++ b/sops/secrets/rana-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/rana-age.key/secret
+++ b/sops/secrets/rana-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:xkoZtvAxTFuTOtBu8Pc7X2aVgOdjFwSFHLuX92DuSLxBX3NW+YP0Qo/0y3dyVjwR/nPHj6N7LjSqHMC2aZLgcR1kYJchyjZ8ISw=,iv:CGJD7bDqMVbp1KxDswK3iizmV8vZiVcBUP5vUc7qqDA=,tag:K967EvYAzD6eOGwSQ4dTew==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUHhPbEROVjkwVFh6TE0r\nUW1KN1U4eTEzN0JQcUJFWjdvT2V2WnpUMlU4ClM0NWJmRzg3aVFRSFgzcllTOE1r\nV3lGVlJ5WkRMYm9xb0xoWGladlpYbVkKLS0tIFpoT0oxMG8reW1rRmdwcmp1NXpv\nb1VJZXZPZzB1dEJxWlJ5SEYwdWpObkUKqDFSxFQ9HSGWMF8K7v8K5BFAub0lbQ3Y\nNHDIy7mZjFinebrjhPzHxlzhdguoSRSDPfaKbnaIUdKY2cwvQC1zrA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyYVBlclRXWGJqcTZuMXNJ\nREJOcEgxc1lJQ2o4TmVlbnU3NkNwMGtjc1NJCktNS0VrbTlndENSaTBtYVRYVUVL\nSFljU2F0V0YwdlFLSHJkeW9IaDRwQjgKLS0tIFRNUFMrWEw1VGhWOEwrQ05EWHQ5\nTUVDcnRpeEtqVHh0QnhyWExGUWp5c2MKs3BRqjoXwok/BRIyIKGXYNTJbE+FIvbX\n40N4B/ZM3DhsAb2+zl/iaogycDx3HvlspljaWy0emzGJYLLBWBonxg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEViaTZla0Fy\nS3FnZjQ4ZkxuWFJuM1JnU2JrRXYzWlVRZVJ0ZHVwMHR6eTAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyZEtIMnNqREpuUk1rd2hWd280ZWFz\nb3c4TlUybzlOTmVOZW55Zi9ia20wCi0tLSB1NVNnbkk0V0lPNVQvcVpUQUNBdXVv\nSkRNRDh6bE1zVm5QdjhtWklhQUZJCjfd9Ce0sS3qEcF0oTfgA70StwrW6t0kyClE\nvGXH1b6caO6GuDqHlTCWtK8wXhPNmMvaHzuKIxRwcTlMjE0LsE8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZDTGpUWllm\nSGFlb2R4YXVDTldQOUpFMlRhMlBqZEZ1NUJLR3oxc3VDVUkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpkMGYzZGFNWlFpY09waFpOUE03TEdJ\nV0VEL2ZBeld5ZlZpTzZITWpDVWFzCi0tLSBSdGpPRzg5R1N1cDhxTWNldUlVOThj\nSy9Jc1BMMnRlWkN3RFlrTUZ0Rks0CvGs24pzjvolDKBG9qh0gRmzSvTHEftC98Ts\n7bKL/7kYENcsvHsRjJk7e2q85b/3NT9ft6O8cG1Poqh32Tka9gM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGlOQS8yQUtx\nTUtUK1V4azcybm1GZk44MTJZa2F0alRwamJtL3RwblVYUzQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo1YXR0SE5XcS9yNFZzZXE2dHNKZFNh\ndC9WaHZTM1I2U1gwNVpiR3U4dG9NCi0tLSB3RG95Mlp3TCtvcHVJTFdnVS9DZVov\nMmU4Sjl4U3V6K3YrYkFOUnlIaTVzCtNFHyDhSOIXGiACkxPD9jV0glmRNqtJGZvf\nphqY7zOPd5OQQNDM5QQdp/P7DDl1CT4QjUPu84TgmFKO4HX7WFI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNNi9WYXVHZ3V1OHJFTzZh\nK3A5aU5yRi8yR2J5aVBlRTV1NW5IREsrSEdZCjFLQUpJWjhTY0FjV24zV3R1VCtk\neldBeU9Fd1FqYnVqYU4rQlNmVUp3TVEKLS0tIFM5WkdlZVJCNWJLWmRtZGE2WVFV\nZ0kwOGthcUxrMlhrM0tseURVTThYbHcK5ouDof7sD7XlbJquDOkv4BxT2DMmok+n\nzfGnlTy0KK/eptfV0CQrGD/QVMVyZpGrecnLDNZOeI7dJT++u5cMyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmTktaWVYzVk4wZ1dHeGlQ\nRkUwVGZvUitPdXQ2dlpoT0xsWjNPZmNYYVdnCkdjVmZPankyQm1QU0o0WU9tei9y\nTDhkNC81SW5GMU4xSXhUTkU2c3VSeVUKLS0tIERSUithQU8zZXZyWkU4MS82OHUv\nYThTQ3VNMUIyV3c3SXZNWUpWU2hFUDgKH1/7Xup8vISgDxJlmatxuAKdjRV3fA1f\nOI+zJCtR94wJvGALufqt5zPEkTkT47Z+ZijoNp6sAxQCCAiNLKO5LA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQVd4cWtKSkhrN01JNzJp\nb3p5dXFxaTJ0ZGdCcmNCTEhOWVpMNm9XY0hJClMzV0dRSnlKNnc3aEpSRnQ4YUNY\nWFBBcjkwVzlEOE1XdUdrMkM1US81aWcKLS0tIDF4U3RCYTNBb1dSdnJHL2E4b0RF\nWjJSVnBReEFBWFZQRktZNkFWUEkyWEkKsepkOgBIbIxNRU1118q+pQb4U6sVUsxi\nKZHu270Xd254fSqUUZ0nfYG8tk5jzzZ9W5Rpb27gA3gGYQ5r5h4zNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSzdyMmJzam5FM0MvRjg3\neTQveHZNaTBXdzJIdklQeEZuUkRVOXNQWWlnCmYvV3pJQWZFNytMOUpFa0o0UjhT\nSWdzanBoK3lhTnpCcENvajJkdW5sa1EKLS0tIHduV0NjQzE4T1VadDcySkFFVWYv\nanNNQjdpalIvNmtGZ2N1aTlzeC9ZcFUKvSsgRyL5u5+Ly42Ua+zDIaJ6O3GOyjZf\nIH6c4edkafCk1nUc2Tr9mBWGp51MX4VV/mLxAVse25u9YztTgcDlnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:54Z",
+		"mac": "ENC[AES256_GCM,data:Bl5dFPtFausLeGxCVbDuaUf8pj5K6JDUPkAqdDT8yOPYWXj88gPjDCt7AIuux9GCUJut6DrrfDs9cpIM9YwBA08EnWthBtjTWvE9qBcLfrCkGxHJ5O4Sff28AJiHq4XBZK4Y85RvjgMxeMX6c9g6taEk/B0QqG5xkvFiMuuwIRw=,iv:W+8iDE+jzCqlIYmLu4dhUsij4czfJceneNdJyRCLmso=,tag:SiyGeJqUh2BZedjmIVtjWQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/rana-age.key/users/kurogeek
+++ b/sops/secrets/rana-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/vars/per-machine/petra/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/petra/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO6Ta58aLjO7YYRjSFF4HelSPK+DhwKk5AZhpzfwWKeM 
--- a/vars/per-machine/petra/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/petra/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/petra/openssh/ssh.id_ed25519/machines/petra
+++ b/vars/per-machine/petra/openssh/ssh.id_ed25519/machines/petra
@@ -0,0 +1 @@
+../../../../../../sops/machines/petra
--- a/vars/per-machine/petra/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/petra/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:iEKnaTTYSkgWPF9ZafVOKYwyobo40CgjLhSf83aHCdyxq9rL9+zsIEg1eMovY74PX7QcJj3U9BZPuYGF4Dnp3Oy1yBoQvXm9BbMJNVmGnqKdl6jDVfPynEis6pG0vFLRK32FnkFBM+umsEiETw84mlzJVrtabp9STtIQRCd9LKxKb4lJBGS8rW2o04sN866/mV9OINy29yZm7Xa7ODibPBof8VnPCJVWERy7AzWvYxYpJ4jE+q7waO3DtMyvQCcBxdLQeJhgp2Eld8egnfAm7Zxxiw59JFyT/6bf3Nrl7Ilo42blptHqz0xh+IjKGQHgwpQs1AQar5OwlaeaxpguE7VfjxcYk84x5HazBA9CBv7T876aAyanHSyFZkfK4NiBwcHXKMcXxq2HrVNDLfqYX/j1I3S8sEKsBlUYy/2Fwm45mGfGAezPfQf9pz9Sb5WZYROX9yaAtoiEUzP6dCDneO6/1Oijgosx0oHfK0mx5NjmKMlCsgYr7+ycWTj87v4e7i1m,iv:UydkL7n3lfFZ5dXd1tdLsJ7yXG1afUGMmScbQ5yqTS4=,tag:Ls2Oa172bcEVARSHZzZBmg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1bkdSWHpvbnNFd29pcGZk\naEJCNUVsMTl2R05jb1d4SUJUNFd1b2krdm1zCnhxLzZ6akp2eStOTUtocUNsRktq\nWExiWnBhbnF2RnZGZVk3MUplR0ltdXMKLS0tIGMwK3JrcEczMzN3cXhSTDZiTCtT\naXhlWnk1b1lCUVdtZmQrM1YzRFVwTTgKdbKURm/lNgk9zuHtVcYbqZCG7OBm1mQm\nNep0LFrQ2dVEOUAALmpJlgDyXXfUbck2MDT9v79aw5+Ze8iN2DSPJA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVNmJ2T0tsUy9XMGFLa3Fm\nS2FxZGpUNHFhWGM4S0F6UFVJdGRxOHRLWkFzCmtUWGZGY1JqaDE2NFpqZWxYKy9s\neEt0OUIxaERGemRGTjRuVHQyaWhCSDAKLS0tIEgxa3EvNFdFQ203R0Z3cGRPNFpB\nQnBmNndiOGFIVEhjSU55aHV6TUw4cncKtM+0SVjQUH6s3JQw5s4yTXNflBlt/95U\nWV/sY/SgSmkAmnRFKej/swK56ieV7IZAC9qNwX3ScVcQdotSK3UkeQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHc2bFFtemhy\nS3lzY25XU3pEVm1BV2hwRWIwZzluMElTSnpGaitpejVGMzAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQppb0hRRWVyNmhTbTB1WHYxMWtKV0xi\nR0wzNFlGM29Ya1NvelpDVytxYk84Ci0tLSA0TnlnQzNsVTlFbE9ZWlEyVTFhczBO\nMnhESEZPVXB2aVJzLy8yOUVJZHlzCn8XdZT5eJRTWP/SMm7BvkFHLFNXYMD7f4aL\nuH/rWEQHxpyW/WN8Es1QdQUfwWGQu5EQlcBoDaofdl+rkhn69Ps=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEpSYVpScFFR\nVzV3cWFsMW9QamlvQ3FKZHVWd09EN3RFaFNsMnJKSmxGQkEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp3MW9PQlA5ZXFQakRRR3pjTDBkTFFm\naksydDEwMWxEZXRQbGxOY2xPNEJJCi0tLSBsdk9OQmpTTk9pZ0RlME95c2U5UllF\nVkcvZTdtYk5CT1JQRzM3Y3dMSElJCpkCp4gwHGKNKGs6b20aSQ1a6U1bjJ5C5Ggh\nRfztd+KF2+hLvyi/wdYiFrjYyovk9KzM1LE/3kzDFQvH1Uzs5pE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJICtmdXRaaDJh\nSGlQZ0lrMjF2NnFneVd3MVY2bU1SMjhLUHJZeGxZMVVEVWMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBL3lsYmVRTHRYaWpsZ2t0YlZDQ2xE\nZldCWU9Va3BzYVFEUVdvTDBBRlk4Ci0tLSB1UHFoT1lqYTVKV1FlTFNOTWoyZWI0\nVTlvdkkvSnVhckNwRmV6RGIzZ01NCuhfG0T/0FNEH05WuSq8H28dfm1OVK+aBy8S\neJXid4Hjvyuz7/xJtcbQpJC9xtB4jPiRyMkm323KGVTY5WL4QiU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIVTZuUkloRjN3aXkxMWsy\nY3pxWjVXd0ZmaTdiN1EvZC9pRFdPK0xrVGhNCnJyUHpMRCt3ZEpCemZqckgyVFNY\nZDA5VWFoY1VacmlnR1FnSWxBS0xQQ00KLS0tIFI3aDJmcTN4c2Jvdk5zaGxWV1V1\nTEw4WnpJTWw0bHFhbERCdHc0NGVWbDQK5gLSvICLazB7+SZ/lDrHXLW+rL4grC54\n8OG4D1Cc5mV+DsYH3iSthjSbjadxysHPiS7dmCgLeD1NAw93TVp7YQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1m2llc94j2ft2q52zj0jt5fghx2r8qtdagwxduuz24hhrmxytgguq90xpgn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnbERZcDV6VEErTXIrZDZ6\nZldpcHpFaithcUZYNHlBaEw5ODRlazhnQ0U0ClJ5Ky9VcElZWm9pclM3ZFVJN0hW\nMktLSGhIcmdBeExsUFdWaS95cHQ3bHcKLS0tIHFQUm4rdUZWZkRBMVI3SUZyS01X\nc0F6aEt3U3FSUjhTcXNPWHBQYXdDT2sK+fwT8v5tcXB6+ZnfGYSfhy2Z48pGrO/R\nZG1wA5Jnuy+uGAgKKg1hwAjxeqVfu0w6Xzj5eWnQJKQKMtWjW6/iDw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyL2tUS0ZMOXB2RHJtaGt4\nWEEzeWRRaXJyV0FGa3d1bU5KUndWQ2FDZ0hVClFkZis1dE5qUkhkR2psYWFyT3g0\nc3UvWmRubUxkRVhBVjkwUmJhVnNYQm8KLS0tICsxTGxsY0g3Z2UxbTFqWFVoQ1U0\nNkFuY1BQQkxLTDNKc1VxSDVQKzhJTk0KjJfjmOKmFknjwnzlM2hX1/HlSElKrJ0m\nJPcYCnw9laazsd+hh0MtvRZy7KIELuKwghqWvVkCpBTWNWi14sJQFA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDNDdIU29xZWVNQzZDV2Iw\nYWt0aFNNYjR3d3hFbTYxbjN2c0lpbG93VGhBCm1NeDBaRk5XSXBnazEvYUJnbjFW\nVit2b1c0NHp1QlVHbWFtZWUwSGp3aTAKLS0tICtLMjZmakg4ZGloY3RIeThHUzF3\nT1NPSldvS285eEx5ZkhZaVRSY2pXQWsK1zfcRhnZ/j6Y/0sUn2xCHboZvTLiFr6Y\nBgBIEVRWCSrGLtzZH9PwM8aKKGnvUJvcEQdHauvRS6Erg6ZwU4qH6w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1THRsSitZcnRDVnVqeXpD\nNzB2T1ZwWnFUUk1zcVg1enp6U1BXLytBalNFCmdRNDhTTjlERnI3bHRLRTFkUHRr\nNWxMUWNtRFoxSDIyQWRMUjl4NklCZzgKLS0tIGwxdk04YVdkRkhCMkJqMU5iZGFU\ncDRKVUMzOVRlM09iU0FtbEU4TlRJaFEKBcgpAznuhOkMgCdEMXTRn6C1+dsAi4aO\nUpoWOoRSdLRNFKyXrINN7TgQiU4wlMUB2GRphCAJBAN/9JKGaKzcyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-22T05:00:48Z",
+		"mac": "ENC[AES256_GCM,data:RNDJFCoqWeSIt38DNaCk1ktWiKOb4AoKIV0bDZseLkPQFSFWbHGCYyqjt1njuuh3yQf36Ot0hNS1gP/CuS0jPp9YkCbustGq7SyTiQSxw5FUhR/lzDJhWnVSK7mbnv4VeHSgLBD9N9m5/5ovx2J9d0RUCbLnbHs2nVC5qr/rVqU=,iv:dfS8XImFHe4oVKGE9nXK10ZNE5CxFIcUK427IBw1u0g=,tag:WjeSbCvr5ttcZCJTRgl0jQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/petra/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/petra/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/petra/root-password/password-hash/groups/admins
+++ b/vars/per-machine/petra/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/petra/root-password/password-hash/machines/petra
+++ b/vars/per-machine/petra/root-password/password-hash/machines/petra
@@ -0,0 +1 @@
+../../../../../../sops/machines/petra
--- a/vars/per-machine/petra/root-password/password-hash/secret
+++ b/vars/per-machine/petra/root-password/password-hash/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:E2XMYAlg7uxBPQjkYIFJyiK5s7Jnve37lug4c3/jrN2IILJdSFVRktDJxzlKaoQyOQfze/Vw0MkOeUhamwkw8wlxUdWoroIoItwsid+kzYxUNuXSx4BwNv4CDbhBdihx5u4TuTAH7GQKsQ==,iv:OXME6OIL51RnB6kG2PXAzyxkHPE2MtyZfL+DMfWK6jA=,tag:ofWmJNpy6+HLQQNVYajKig==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQkVJeVpNODE2MHBqcnJL\nSGZSQzFVcDE0dGh3U2ZXTmVrNVBrZDFzMjBzCkpwaFhqaUZidnRXRXBYdm1WTjU5\nQmVNWHZZeUlCRTNONlpubzM2UCsyQzQKLS0tIHJpOTkzTjd5Uld1L0EzbVl1UE4w\nSzNiQUVjbVJQN0ZJcnBtd2lKVUJoYjQK+4Y/TReh5Ij9LvsxYiwXa7HmiCZomgsb\nIOhA6iDLbW85EqYf3o4Ddos5tiLCMGmpmawKvy1ymkiVWXzzHlTcWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0aXNUY3Y5V3VGcE1iZVY0\nTEw3MWZxcmd1UGN2SnFpeEJKRkw2RTdyUlhnClVielZBNEp1WG1rb2dENUQ4ckNm\nVVNOdjZ4NlNGL3JKc2YrY0RxalU2TUkKLS0tIDZNbkt2eitId3FLRVN3M1JuNFZP\ncVdHakd1Nmt4R3ZNL09ZYmFReGY4WjQKPpsSJpWVysOD6qNDpV6TzDuNM6Mp4NeL\nW0ZrmKMXWbmYBoJ0psJWqzoDoYBgPLNx7JX5xt6NCkQI7RD2VnRjYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdGUCt4S3dU\nZlRHM3NEQWhGT0pIOXZ1c2wvVGg0L2lZMnd2S1FERm8wVGMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpCQ2oxeDhYWldhSEJrUDdEVlZRVmg3\nQTJnUXhWMUI0TmVRTGxNUlpYOWxBCi0tLSArODYzbjg0eXZDeWJRWSsyM3VBU2dZ\nNXZqMEZkNHFQZ3MzdTErNDBDemhBCuKwuQV/Y8x5Ui1JLUg4uJdKWvxNIomfHMQl\ndV5pzukBrpPmPh6ngizdGEOXILOgbs0WjYhlJ6H+wthsRiXQAmI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpEOFBrb1JI\nOHlmL2FNeU1oQ01sNklFZkt3ajdNN2dWZitSdEs0cmtheEEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwprSmNxcHhNM0dySURKcEFVb2hVY2F0\nVC9RdU03UTd3a0hmQ3g3REwzSnhJCi0tLSBRWGhDS1BRQlJtbWNKYlEvSFMxMWlE\nN2lzMjBZaERJS1o0QlF6WjYrRXQwCtUHy11lECVMd6o9KrsLem5lOebwkioj4paR\naeyG+mLi84c7uuCCa4qH8QrHEpBBWUQGTMIAtKXpW6uG+krmyn0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE16K0Z2RWZy\nVnNPb01uL2FIb1MrT0NJckl2aER3OU9UcTdxKzJhM2dxbW8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3SU95SVBWZnpNaE9ncjN5NS9qeGpD\nNm94TGd3QVo1RXhtM1k0MFdQWDZVCi0tLSBZTkc0WWdYN2QyTHFNVGxyK2pIMmZw\nQ3J2ZzZacU9RbWtxcnJJWnlHdWlzCqv+JXNWs/m32E7Swx1gfKfVbvfPgCQUiqKQ\nCoeRJAn6V6f63B9cBybvnekBT3TjU5mnoaza+AF9BHBwJfth49I=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibnBzRGZYZU1OUXJzdHBa\nTCtsQUh6Wm1LbWJ5QlppbFNKbHNCMFNKclZBCnlXTXNUUmY0TEtTamNQOGhWM21O\nNURFajRmbmM0d2hLUG5PdzVOYUVQN2cKLS0tIGN0cUhjRG1oQ3ZLcUtyYUsvZFl4\nOW5DeTA1UEtDNFQzYUp0Nm9DZ29PVG8KhqNQFIA6V84a2Gn9bPiJoZKMPFmLfReK\nnOIVYTy9XnRUQYWZxAeJqTW1yT8KUPTgbJC0GfSfg6UKqezhQOw94g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1m2llc94j2ft2q52zj0jt5fghx2r8qtdagwxduuz24hhrmxytgguq90xpgn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxcEF1ZkcySUQzeGhCVEt1\nNzRtWGF3UEg4b3pyS2JjRm02ajJ6cVR1RnljCmtmWDlLR3MwRnkzdFNJb282RHNY\nTGd6dDNkMUhaYTNRVElNOGlLVkU2NjAKLS0tIERqMUNML0YwYzNkZHV1ejFhMW9C\nSUtONlJ2MkpUS1NTYWJpNWhGa1h2RmsKasVuzOEZrgoEXMckTdDoOeHe4fGP810y\nyCYrOIbHaGgl8aaqzgDfv5/AZrSgUuXwVn1WIz+8TsjrObpQMCWq0Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZRVJlcHhSWGZYb245UTZO\nL21qRVFDbUp2dUc2a1JQeXFSRHZ5bVdsYlNRClBDTi9rdU0rWTNQbXExS1BsczZH\nNDE3N0FMSUhCN1dRREY1MmxyRHArOU0KLS0tIHFmWmdzM3l0ejY0TXQ3Q1c5YS9J\nY3V5N1Z4SUptN096S2J0NTVTQ1kxc3MKeCV/hKyN0p13B2e1hME10ILe3sePm/sP\nZxZtgtx60/0Diww6SPWfdaPlhdraRRGaccGEiU620k7pPo2eaC38Ag==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVb25EdXV0NTBrMUUvWlpX\nR2JQNEl2RVRncmhRS2RvbDF2eVZqMUxIR1N3CkxmSHREK210SjBmK1FwSWVCYStU\nRUUxdzMxUVVBREZ3YmhoRDlJOVh4cDAKLS0tIGl1UGxCbldkU3FLTU9nK1V6ZE1F\nWm02bVFyeDNYTCtuUjVYLzg1YTQ0S2cKKRqfHu47DeDHkC/ihKioJeM8rT41e3eO\nOELW95Sl0/2pS0+/WQgK5agJ8A7i//eBqfVZW3OPmYdv/G+5Tp283w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBybFprbGQ4Z29qS2RHQXpC\nZjVQdmZsOStEcmFMdVZiVHFXSldnVnlUMENZCjh0ZmV3NWFVdzgwOFNxVGFGOFY2\nOHYvT1NQZmNQQUlHbjR4UnE3THQ1b3MKLS0tIGpMWVBSZHNlWWp2ZkttU2ZERDJZ\nMmFWUm1kMmt2MzRJZmVEQ3VNdmJ5SVkK1AOZQz/N4iYeSNDxgHGtF7Gf2QoIZMQf\nBhDDglxbwxWBrFRI7+kf6W+45pKk/SFaDXDAWNyD1+7nY/N5JnN/bw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-22T05:00:49Z",
+		"mac": "ENC[AES256_GCM,data:X3kdbdoFe9VzUylh4GgGz7rfgZh3zwhDNxWUxmbfsaV4U236XZczkQpurqDNZ0nI4KIXbQm58kmQ+CX4szayf37ZenCcBVCtMquPTwMnFXuTLRNB32KGI7/6c+RPZh5A0UGGOISfVADXjEjqIAuGC+9ouYFg35onyLex0Bw4uFs=,iv:JEtRIupFbf4vhE6lc9t5ZkwewpzLX8eIzo2XDFWwTu8=,tag:lRdhs59GLduNG7qYZSbUqQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/petra/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/petra/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/petra/root-password/password/groups/admins
+++ b/vars/per-machine/petra/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/petra/root-password/password/secret
+++ b/vars/per-machine/petra/root-password/password/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:/EFxsYz2UJ0HOtks4LEOtREG09W90ZdqvthYRsJjZp23bZpqSQ==,iv:AAhLkW5e4d3vWB3h4hwOUuczswnMYdI6kNzoOrPvZnU=,tag:rXGacmin9htmzmRlDslgxQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByZEpqZ0k1ZHcrVHVoQytJ\nYUZqZ01qd0U3bWFoUXo3S01CZktHb1l6QUVzCnJsdGRxZVJyTTlPMHRQZ2JNaHNJ\nbzRIRmFIU01RdlR2OStyZWczNWJsazQKLS0tIEdiblREZHlGdXJoRTlHU3NtNFl1\nMEhnSTZadktvM0E4eVBxbHFiamJpMEkKEt26YaoHE/U89GoHffrfCd/YPUzdOt41\n/20bgzdjBDeQp4fIslss16zcbgIcLGa4LQVGlRUXay8wZVP00aaFSA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPSE1zd29Nem9mUy82aXda\nRFd4N0JuaTRlZ1VtNnFSNVhoMS9SMDBPSmdZCm5zd2RYVjRBSmc4RTJ6Rmw2bGIw\nMG1NNXQxaVFxMGlQUnR1NG0rSjYyWVEKLS0tIGp3ZTIzelpYVGxxY2NFYmNzUEFV\nUENpWUNhRjBpUTZqZWIwVlRBWkszQ2sKAHu7ELOtp3HR0mQIi6q1CWQD/TE/rFvI\nGwADaL3XjDirjEzFC6A0jiacSWReO7vvNAhj7TpXVly8ntGmdK3wiQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFUveWxKTk5D\nSWJOTU5ySHByQzlhUWMzakZqaDErdnBVWE5LWC9TRXhkRVUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo1OCs4dzB3N0w2bzNyMGJWczMxMUNh\nMmY2NSsvWVZGaUlXWVhSZ1p6MFJFCi0tLSBjellTUHhNV3dPcllZa2JzQWdtcVZD\nY1N2STBGbVQ0Q0gvSnBybzVLcXE0CoLxckeOxdx5wLH2I5/81dN+PgHqPu06ZAV/\nhfr4GB9Q01QZ0kWgdyRf9ed7HtG0cJsvKNrzkW2VT/OZJxSKxsM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGh4bFhkY1NR\nQTlTa0lRMWhiOHl1VENpcENWSUZqYjVuTmpTemJ5eVlSWDAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZworY3hRaVNCKy9SVU1idGhNblpZcEdH\nYlNiRlA1YkpMa1dFamNscGg1WlNZCi0tLSBsWXlrYTl1ZENtLzZRM0h5dTRUNVhZ\nL2w4R3NCMytDa2xydjRLSDlzaGRnClnM0s9ptjFU98rgDVtz6zsbgVtFXH5HSMmL\nNwxpeVM5TBsDl6FLJlQXlzryInTjagazh6u+eqU70FEhPVeuGLU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIElUb3lTS1VD\nMlhrak1tY2xBQ3ZNd1RFMnQ5eTNvT1lEU0hzenlGaDcvRGMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpuSUp0UzNCZzBWZHB6YS92SFk4czlh\nek1hL0cxTERYV244RFEvM1A5U0JRCi0tLSBacy9RbExzazFrYTZ0YzNaZ3piUXpp\nbnZ1SFgzcEpWOW5Jclp0Sk5RSW9RCvKE2sHDrpty92wGvmC/o3Uh2OqeqbhZU6T/\n1acvk/DADsXTCkE9Pjni97VifQfsLTo1ofqpwngtLaQ21ZRCgaw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxcGxEdjg2bVhFS0Q2cmt5\naFRtejRsVFpNcUZGeDhtYmVlejduMGRNUlZRClNJNFV4Sk9nUlBRR0Y5QzBRb3RL\nMm1DUDJXVUwwc0o0T3VQV25wV1NvTDAKLS0tIEp6M1ZtZDlDWmxwdU9xNkxlU1Uy\nbU1TOE43Unczd3RFS2NPUTJXMktFQlUKOBJyGOXWoc/H7cCebN7mQ+pHTq1Jq7G/\n4V4umJNduUvtnNzifbmrTOK6/6xYXvVX54uIGT9yjeEq3fcj5JXJ/g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBaUxvVERQZ2dGOEJFTi9Q\neEF5bFpOVkpPbE96NUhKeXRkdVc5TU53RERvCmdNY3lOZVBxZW9jRDJ6VXF1TFZT\nalVhY1oxbG1RemlMeE5xSEtaTkFrOTgKLS0tIE5NM0Vlc1RQelhMLzEreDNnbW5v\nQkxyb2NiSFI4dUdxWWVxRWo1R0UxSXMKu+6M0wptG9HqBs6k/O5nGhXph0VF/vDS\nn5hEYJC44nty4clrX2ZEg3nhjWJdV3qqrjcFoTW4270HlLCXQtQBtQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuTGxzNzYvOGwxZkdLelc1\nQ0NsSG9VNURzaitPZjI1emJZUk9aNndob1hVCjZmM3pBR2ZOOUdQZ0U4OWtCY1pX\nMlhHOHRtcmd0MGpWSys0UDFreHdpR00KLS0tIC90UnBaM0NZYVJJeCtUUXJpaU9m\nN3Z4MDlBQW44dUNmditPTlhSdk1ZeFkKgRI+vJ8BwMq5G4kOY0mof9E7IAtYr63o\n88Z1/FTvZy4LqPFVgqWf3y4+Y1diHt/9IerOYvSx+6IY0KUJ26J5fA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4YUQ0QUc4NHpiY1d5YjVN\nMWs4c2hQMS93ek1VT0ZDbjBrS05kMzJObm04Cjk2MkpicXdrSU5NMnJ1djZZUWJZ\nRHVzVkJOQmltVmxjYTBtSDlEenFFaGMKLS0tIGFrUVFlOVJnY3NTaHo0SFNSNE1H\nTk45bW5HNlFNejlPaE90c0JoUmVuOGcKi/2IH6/KI/jGNAb0rj6tV3SlL9FmSEWb\n0R2tdJHKzq4pWi5R6X5yKp2lE90PyLnvuJG9yNR39ST7KKaZvM0OMQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-22T05:00:49Z",
+		"mac": "ENC[AES256_GCM,data:pT66PbapQD8Nahpt+21f3JHGl9GyvFJGk+rp5yr+lLcISJdYN6HBiAby6mGhIke9sJubcUS4oO3H8ssNYa7sqFUXpTnx/qaIHzTE6YtQD129U/irTM/ug/b513Ut5U+gWjAJp2ndBh1prahm7Wp7aUUIT7vrCr8J26VJUHD18PQ=,iv:2OivrhSVwVHTwk8f47Zx7j10zj1FkQJjgdbNmubbDDg=,tag:aQrdq0IwnDix5gfi8sGoTg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/petra/root-password/password/users/kurogeek
+++ b/vars/per-machine/petra/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/petra/state-version/version/value
+++ b/vars/per-machine/petra/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/petra/tor_tor/hostname/groups/admins
+++ b/vars/per-machine/petra/tor_tor/hostname/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/petra/tor_tor/hostname/machines/petra
+++ b/vars/per-machine/petra/tor_tor/hostname/machines/petra
@@ -0,0 +1 @@
+../../../../../../sops/machines/petra
--- a/vars/per-machine/petra/tor_tor/hostname/secret
+++ b/vars/per-machine/petra/tor_tor/hostname/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:0/gryltZdOWNEjSb518yDO2ikg/29IUSgdIS1gsDerD1XvJcTOaUn4vyTvwnVddCOtSQZV0/lLGZQqUNrIX8,iv:tJL/Z7OEUkN0Gc+g6bA//v9r6hRDmkA9QaBd1/Z01bw=,tag:nlpPh8mYwLMbMa3C6CdePA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1WmNtWERzQUYwTXlxRU1U\nbDVIL2pydUlsUXY2djI5c29DS3lKU2ZVL1VrClpCWG41U3Y2ZjI4TTVURWdQa0o2\nMElVdnpJMUd3SmxqRDhaVGdoS0JuNWsKLS0tIHdmenlQZFZHbjloeTg3U29aZFkw\nZkJLZG5PenM1MEhKb1JXQWlyOVlXRFEKuNVLUefYZnkUJ8syJHj5YWpW4ddCI3wn\ncWpY02kSf7ECqbhcBeUr4CZ/PedV0K1w/7uUcjT1WlGO3HuqxAtGDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiZ20yc2FBQ3V4M3hQRE1h\ndG1Pc2pvODhDcWxxODhaRGxZSDdsU1d0Q3hjCkhKZTlEcTJObDBwMTkvUXp3ZExh\nZEt4OXZsR1NTNGhNY0huRUw4eTJPUEUKLS0tIGs2UXVZRmpUa0dQOFdVTWlwYzVt\nelRRMUpUQklqOTBkSmZKU3l5NWNiZ3MKgbX2PaKbkHlVvZlIFpVzMkX28gfXveuv\nXDLYkaL5aXuJHn5HFFrmkRrx4g3jOQtGIzewSn59Moelm/Q4731ePg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE9nb0ZjZ0xl\nL1VHM0ZPMjhoQUFGelhQNytDdGx6NUhQeHRQYlE3YTl3bjAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPU0ErOCs0Z2NwWWc4Wm9EaENQMzJM\nZGVoMmVuNStycjRNcEQyUy9YeDVjCi0tLSBiZmZ4bGcxWGhTNkpUaGIyWVN6TGNh\nVmVoQnhhZzJnem11S2U1SjNueUVRCk3ZhwffRF6mIH8AcjaoQ6NzwjkWWNT2TbVt\nXpsgde3oiQHPxNOrNcC7rHHhTTKzUEF23w2flIzqTz6gmu7oaDM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1aa2V6UGlO\nd3FySG5IMGJ5ODZrTFBiUFFzV3dXVlpkd3M5VFIzQ3pJUWcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpmdXlkaGVBRVRGS2c3NVd6M2pFcVpt\nSnh0TU4zd2paeER5eGk1RU5sejZNCi0tLSBmSXJjdGJKUG56WVFZYlp4RHR3TjM0\naENGRGcrOGdTZW9mSElXUGFDSE80Cq32FpDNlnfnLyNPYESF8qqH7WuMp/+50gUO\ndJARjb/0MWs3nrrSs0xu5UaW6xaItRM8kIYov9Vb0++xsbg/m9A=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFA0WmcrdVA4\neFMrekZkMSswcjg0QzhXclNMWjRiWGtPRVF2Skc1OW56MjAgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpLSWZ1cHRpV2YyWEgzakhTdWhzYWxn\nRzFKTktSMTJMOTU1dDJsUE53SGlZCi0tLSBpM2FOSEdtd3RCU3J4UjZOK1BLZFVC\ndDZxZU9mWmdxa3NmUHBvQVUvMDdFClMyok88j0FL0BGdTgR3MP1ual0rgbRzqHmT\n2g3e8sYTbWrkdrIZFRL06/zZTOfP19XN5hwXC9aaSFsUkRAhZzM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4T1djUTZtb2NVU2cya2x4\nRHN2Q0RNUDFIRHEwdC9rUzJOM2xpNkN3c1JBCkx0VWNRNGx1Vk9uME5IUmNpK04r\naDVZeU0rYmRUOTRmQkU3V3crUXZRZ0EKLS0tIDJIT3RGSndURXFPOGVWVUhpUUg2\nUzUzSnlpVjFYY3hzMEwxckN4VXY0blEK6Wl1bIIPdHfdqyMr810f9r+Al1E0wPKf\n5om4uHISEqIN31FwFCSxg9uABO8u6H6D1PDjPYsr5aPmJKu2PZvFxg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1m2llc94j2ft2q52zj0jt5fghx2r8qtdagwxduuz24hhrmxytgguq90xpgn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ZTVqMXF2THdmY3hXR3NI\ndnRUeUVOOFduMWtlZjZVQUVuSXJ2ai8ySHhjCmFuV3A4YU15WXc4N2pHb0Qvejc2\nRjVEMjNOenRlQUw5ZmM3cll5Tk9EcW8KLS0tIER0ODBaNWVweFAralp3MmU1cU5w\nalNjNk1DL2JrQVlra3NkMUhNKy9iTEUKQZCKWDPqY5jE3FdGWaNkaCs+a03jLaPM\nNZVMEW7VbXqE0fVODPSXSX9HX8F3Vryd8GAtnfOi0wr6ldg5hotqAA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPTWM2dFdTSHJXT3d6WnRG\nWlBPY0dPUFl6dnBWVndwcFhibmpzM2F6VzFjCnJhbTJXalFobngxUUVRS1hqQnZW\nclJ2RWk0QlFzWTc3S0hHVkVEWU5EdmMKLS0tIHk3cVBvcWpqRHkvRVoxa1ZOTFEv\nNGtFQk9wY2JidGUzbHZZL2lmSzE3c1kKLkItAMTCLiFoLStnCVbxK2ioQfNEkPtc\nrO/mui+Ff3js3P5YN03fo8WAordwbVH4LZDMDE96poyN2oepO4hQuA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYVGNrNHBiSlMxOGEzdUFB\nSHdVSGEvWFB1SU8xNVBGUWVNbE41RGVEaFVZCnA0ckNZd0xmRmhEVXRFbXp6V1Jy\nVXRGVUZSQU9NZVo1b21QSXFDOVcyU2MKLS0tIGtjeEhzaHJyYzV0R1d4VmhScUpv\nbktwNHU3dll1Rmo3TnRJbjJRQk1FQTAKE9q2jelT3+AZou5ZMFPFxA1Gpa+DhzrM\nVv8cCM0rrVq/k4PbEolBhygVLh/EIyS46SVppgBWYzEj1rqIfWbTDg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBta2pWSTVEckdTWUZyeWVl\nMkNQOE5sY2JueEp1TkM1dzd5cUpZOWpUSVJZClFUUHZkVTFDL2w5VzAzUTkxbUly\nci83WWZucEUrcGhFbXZucEpZQTJJcG8KLS0tICtQSFJ1RkdXMVVrL0pHQVFrelBs\nRlRVd2FJdWJ4dG1GTWJoZmdNN2dGM2sKCtJq0MPzNwpKARbATDThzSAffnl16x3P\n0s0MmSHlapPkrtF0Td3ss+U4xariUHeu1pGJyxR8ayMGMjFenXYjkQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-22T05:00:51Z",
+		"mac": "ENC[AES256_GCM,data:ILJgv/XzSlUhwP5AwPL7Dm82CrKLtCxLNx2ohPaYftADuArrEbxIiE9OqDdH3JqsPd9RE82fqvXC9q4VLCHvqcV2nh5G4CQ05ID5k7f8qT0Ut59DwgJxHVm9UHU5WxLe0XZ9pvrsI7Vt7OVj+ltJry2M+qkEL46uqNpk9kliIxE=,iv:8Fj5SBCwC38JLNHaCfS6gP5usXAb5dAv/K0UXgNyfnc=,tag:IADeUZ3Mp8ycd6P2ctCgOg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/petra/tor_tor/hostname/users/kurogeek
+++ b/vars/per-machine/petra/tor_tor/hostname/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/petra/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/petra/tor_tor/hs_ed25519_secret_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/petra/tor_tor/hs_ed25519_secret_key/machines/petra
+++ b/vars/per-machine/petra/tor_tor/hs_ed25519_secret_key/machines/petra
@@ -0,0 +1 @@
+../../../../../../sops/machines/petra
--- a/vars/per-machine/petra/tor_tor/hs_ed25519_secret_key/secret
+++ b/vars/per-machine/petra/tor_tor/hs_ed25519_secret_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:sqc+lWjG0dcP5E2eumYrgC3bRJW7jn6PRB8k2YSNv1WCZWy277XDuQ8KFI2fuRzH1/2C94qfLwZegPElRxS8Kqy8QqctdPdfNU0sqg6s56H3OjugtHvUXyjqH6+JsIjV,iv:sedHJUdX9gt4MI+JLIZuD8F4ljmvrfP0Stbg60YGyEg=,tag:2SbAD5TUHGmUFO9MPqXm7g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWSExQNDhxZzJISFI1Vktu\nMTRiZjJlZFZYU0NTWnJPV1BKQytQZXhqcjFnClNKZ3NXTUtKRmVyVEVaT3MyL01H\nbmo2RFRhNndweGJRUCtFem83dFpPUHcKLS0tIGtReHEzYWVNbldJcDhXeHlJOUZG\nZ2Y4eXlhdXlwRFlnVGw2emhsSUtHNmcK2g1Ta0ErctDh5lWS3KGSbgzm2t2Brueq\noe3jjXSrmqnQeNfo8T7WHRjxE2DxnUk5Nu9NtijdxrRNxuP1+AgZKg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBodVRZUVFpM3ZOMUU4RE45\ncHhEMk5tZ3Bnb0dFZkhGMXIyQU9jMEVHL0dBCjNVbzlBdVpnWm02dVdjZSt2OFNF\ncEQwMjlJWDN1ejNaQXRyY1crVTNrbmcKLS0tIFhlQjhTNnc1Q09obm0vQ1B2Umgx\nTjZkemdzZU1USGVUU0dSKzcvUG9hdUkK7vNrW9hlBq1Ud3bQqcnjT3P7B5eSwNch\nIB+PePNwL4twwwBgaOv4JnugJ9dBxy2ldNHFOmnsmPKbUcsxyDUqLg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG51dEtEcWJM\naDlqcW50dDN2aW1UMnhFTU9vc0FLamdLQXQzSTRhWmdFUWMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpOaUx2VnBWWUM5L3RnUGRUUmFlK0My\nZHNUQi9nYitFUE9BN1kyeURuL2tjCi0tLSB4SGs5SUFIRkRqc1V5Uk5NdmJ0ZXFI\naDI1M3VySlltd0tVOWFMOXpjYzNBCkpDTgp1KBPXmXWaRwFJtMBSTRFRFgYQweGB\nWYUhxJ6jv3MYCFYX5ProthpfVhdvfOu06JjlhAs1k2JGUNImGPA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9XWWd0WGln\nNVdiUWV1VzJSQ0FkVEdIZkdYUkJMN1ZsaWhRS2NKOWJpWEkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo0eFhzRElzbzRzK3ZwNmRIM0VKcHFD\nbVo5VStZd2RLcUxyMWt5ajBKMU44Ci0tLSAzOFF1bzlVSFYrU2dQV2VkSDh2Q09u\nNHBMUk5obE9COXpjc3pIejh6Z3E4CvBJB9w/6aHTjIiQ+CT9gXZw6KNxI9X2BJbO\nfMkrIlIaqC7SP0+kTCir1J3tHcqri9muASJm0ogMO9qxjVkftAU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFdRTExWUDdv\nK0FNUDhqM2dtMUFvV3RNT3hrV3dmUDl6Y2xLajVyUmNPa1UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpvcEZtZ1R6Q3pEYXlyVVBHS3ZRaHZa\nNndwYytvMWprN2U1NEN2YjJoOVJjCi0tLSBGemRmOFpQcGVpWi81Ry9MNmY4Z09j\neGpSYU4weGRyZGRyUEMwbkpKTGNrCi9GPB8Z1eEQdjl3Hnk6+lRscieOEJ/FWAyp\n4qqLaDBQEqQ/Men5oUGXXXq/azSKZgCiDEKVsLRHVgqlIcA7VJs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVaUltTVAzZEkyeWF5elFv\nbkN4cloyMmtOeDVmb1ZMVTVWU2JzZWZUU0c4CmNPOU11MkdwWW5LZEpQMnRVakdL\nUFM2ZURRN1FQczlRRlpYYTVOVEgwWk0KLS0tIEpzVWYrOFhyVEg5ZUlpRHVNa1hj\nSTgvS2d1SVRLREFoYkNBbGJqYWZNaUEKeYfGI2CM3rj08QVyTXRAVLPZhBeOQ0pt\nTifMlE9Sw7rQ1oqjQKwK9bRXzae5j/M1KWFm+i3vvcaQjFXCh52MXg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1m2llc94j2ft2q52zj0jt5fghx2r8qtdagwxduuz24hhrmxytgguq90xpgn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVnJnazNjYVVhbnhDNkJn\nV25RSUhpZVA2K1lJMlBwVkttNWNQUzUvRzNJClV0eDF4MXU5K1QrZnVVVmdWcCto\nY0VXdjVWcldZSEhUTU9qRXY5ci90RTQKLS0tIFZySk1nWjdSTGJoa2J3eTZXcVly\naTZOVlZ6SVdVMU5rZy9OOEdOQ29OSGsKCGF+4buhXSa1FnrdRcib6ZnN1plpgJb7\nOeMdv4ulhhxukTrxjal+fIqVMI6mbL6oS8tbEwV2O6ZpSP9lGxpALg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzSUszYWRnVkthdVVjd2or\nTVRBT0kxM2xkS3E0dW91Qkl6L01ESUlJcFJBCnZvYnI3c3I0dmE2dmZ2MWYrdVlO\najZiZjNZMXk4L2YyY1dCVGc3UGJkTWMKLS0tIHNtSFBCREQwZTJKWllyelYzVEpC\nSGY1czA3b1JZNXFiTEErMG43WFNPeW8KvVjXD6oy2QIK3gQeQfqoiIYlw/hV+oux\n5R61uh2n4sdfWjEVTKImPhTuMc2DdwYdYrC6y5arJJq55RFh5DwONA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVZXJLS0hTRlAxNVVtNEcw\ncXcybmh1bkw0cSs3Sjk4MVgyRkxLU2oyUHo4CkRTUFFNRzBlYWRtb2dsbkFFV0di\nbEoreWg4Q3ZuVVlGSmk5TGFKYWMvMkUKLS0tIDYxRVNWdll2MmxtamJBc1FWMEJs\nUnNGaGlvbmIzNDVDbmVQRTZZdnc1WlkKxAuS/lTOZ8ZjRC1SVDbqXmPytQB8yHJo\nr1tm3Tc/deHONBFBNMdvn1ek4nB9Y0QfoW9fltAususGg5ICQxAdpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBld1hWcE1JMUo5YTd5N0N2\naXl6aHV2YmcxZmE2dXVZQThvRnZLT2drVnowCk55VCtDbFV2YzUwUTA4dWJGV0Nk\nb3Ewdmp3UXBCNjI1ZHl2K0JwUWMvMEUKLS0tIGtzV0grUFoyUGI3VHlYaGVGMG9Z\nK0hzVS9hTENGaUpDeWlxTVVKSmNMUW8K5zp8r0Y0+g+ikPp5MTXwry0g5bxwurLg\nBASGZFcMPJRHCQSBfC3HIPEzIb0pq273zNg85HmzG9+lgBiyXwunfQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-22T05:00:52Z",
+		"mac": "ENC[AES256_GCM,data:2AVKOE4kCV/Hk3XnwJsjUEJamEY83aurs3WN0use9xS6ZUZXQcf5c5pZPs62Wo1M6MlbtzYwIOBs28nQOljJPqzdvmxREC5No7D21+Bi2ISPUF7cYo0vwklVVj63DEx8skD+PIDJLIT+mO8agT260r4yqzdVQoiEbHwdvbyIS3A=,iv:A2TcDwCPaJGQ9GS9xFdQaBrSqYjEvDUxWw+mTvSMi2I=,tag:wS1SKQ0VoHrgtNHDf1le+Q==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/petra/tor_tor/hs_ed25519_secret_key/users/kurogeek
+++ b/vars/per-machine/petra/tor_tor/hs_ed25519_secret_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/petra/zerotier/zerotier-identity-secret/groups/admins
+++ b/vars/per-machine/petra/zerotier/zerotier-identity-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/petra/zerotier/zerotier-identity-secret/machines/petra
+++ b/vars/per-machine/petra/zerotier/zerotier-identity-secret/machines/petra
@@ -0,0 +1 @@
+../../../../../../sops/machines/petra
--- a/vars/per-machine/petra/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/petra/zerotier/zerotier-identity-secret/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:Ud317inGnmkS5ICWq6NJ4XDWquOdvoMWxqUYN2sxNjqk3aCfNE2mwVhhre2s4gqljSJWOHrMCv8f7XyRVcoTsiIXb3qQ9fXMxP4mygWEjCugQf69XXyGlOmCkDlFGAzMjUq4vl/foizn6BSX6Mb7GfTuQeq23wCV14NeiALppquFPOdMKxMLDhQxdBCKadDIxChb3Ckh9afHjoT9QeBibcZ1Ycken7mWWPwi8BcK+gj0xKU2KvFBkc+IIDX7AU+bNCyBewzHKL4QKIQ6SJ0KhiBtu0EGy+2EyQLuJtzOXDPrv1Ke0CAKa72FQNhfgH4bT3X17OSIqMcMDfcUloaHAdSTCGalqadvmnHqda7u,iv:bcyLpIB292C6SNJ55d8fMYauQxu3N7j0ApBKWYQ8ZCs=,tag:HktikyBZbhDGrFXtrpUm8Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6LzlQK01mMTB4VFpUNWkv\nSHZ4TzI4aG4vd0Yxd2JDb0ZIL2h1MVVJS2lRCmFuRFFjUFRScUZ4VmtpNmRhZC9L\nM1haR3l2OVVwT09yVlQvZXBNWCt0cWcKLS0tIGZHVW9SZDQzenJMd1JrYkJXcFZM\nc1NJb2JNZlZMend4ZzArczRvRVhIREEKqQygbaC1+byxAN883v+NbGC00eBvZSKS\ntDARsGV3z8yBytH2zdTXnZAMjs0dxvWn4iBTj1SfGuZKRUYGGEpniw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxclJjTFhocUoxY3Nscno5\nSlRvMHAyQVVMWnhaWmZkY2U1Q3VZSlp5eW1BCkFJckRoU0RqWU54TEh4UDVCWTZU\ndU1Ya1gyQlVrNkZWOWkzam9kQjg4d0EKLS0tIHFacU9IU2tVeFdNSkoxd3Zscjky\nODY1NE5CM2pON0RKRTNLalJXUVVaSXcKtbwePsqjTCEdm1jOc69M2yE8hOmLyWpS\n5JLPEdlsP2jLEVjca5kVta4cgVt01zezeNfF0G+1Rrqk7I15qv9j3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJICtqUTh2bmxU\nclMrc29oYTVGa05PTExjSVJzcTQxdXBaWnJmZW5wZGU4WFEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpMNTRjRVlMMCtpOXZMd2FMWS8zeitq\naXB0SVhRVVY2MVE5a0VWQUxIVTM4Ci0tLSBBdFk0M0hVcm9pdFZaT3hEbFBaMEFv\nbDdxRVZqRnNOWDZ5SmF4VDdZUzBnCgD/vNafwS9lV9jKjE9D+DHDH0dpReKunPOh\nLgaIa7Rw/JsYA38yT1QVus2MfdJ7NGeOQfbVHT0WeImsPJiCFzE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEgrZlQ2M0xK\nVm5PbnJTdHNCWXRoTm0xLzFmTTJxT3VjZFhTQXpJZVUvMlEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp4Q09QZEs5N0Iyd1RtbnFncHJka05N\nT1lVMW9nOU9mZ0ZmQysrYStFaXRjCi0tLSBvME1EZEVTN21vLzllUjBCaGtJc3hV\nVmJFd3RBUTN2eStOZWE4SkQ5bzdZCsujAFW61izVgIWEPdtZj2abkx1CtUOITii+\n5tudo10zCLbvpOdi9dui1MfFhyKriFNGhSa+w//cZ0OihJtKUtM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDlxUTVNbFU1\naHNQOWFVN0E4YmxDRDZVUFdQc0tEdHNhYTU4aS9lQVFHZ0EgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpNanJIT0xWamVtZTM4N2pLc3pYZzY0\nYzUwR3lLM1lpenNYUGVSQmNXTFdzCi0tLSBobVFIV1hjZWxtMmpIWHBwaHhBQ0F1\nbldmWXJNTlRDem12VDUyQ0hOZXlZCusbu+6UPJ9c+i/sb5/0MHWn0v5Y9YbP7CLr\nZlwSJwo7BS4xG07E9RMUs0aKHpd7r6i6dwkEbVr40A92gHtoDO0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4S01KMmh5bzJ4eHlPbW84\nZVJXR2EvZWVOUjdoSUs3WElKckVCa0FwZUN3CkxucDJvOEtOQnpXREZGN05qRGxH\ncFc3Zk5sbGZ1aGx6dEh3aVcyNHh1MVUKLS0tIDA4clZObWhZKzkvdXl1UmpXYmpt\nMGNscTV6aXdTVmJuVjluNk9ZelEzNlEKT6BUBj/Gz5QO0tCd7p1ULUSphimR/MWm\nyZNhMKCnhnT8bx3HKxJK/unU7WKT7j0PI4mAPvhzKwGPYRYYv61vVQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1m2llc94j2ft2q52zj0jt5fghx2r8qtdagwxduuz24hhrmxytgguq90xpgn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzK1RlSUNVUTRQUWpXdk52\ndWxNTWxkTEViYlVTR0NIL2VXZTZ1L2RobjNJCjgvZUcrenU5MzFrVjVjRDFjZVcz\nZDdKM1ZmNVVZUDF5dmdVRjR4Rm9TMG8KLS0tIG9VK1RyR0FKcVhlQnNSakdwNWNw\nNFNyeWdMNnZtWlJUbDl6NDBrQ1M1VzAKKqvkG8hmms2V8sgAh5qEutUfrqIjXw02\nV/NHVJ2yDpq9sQq76Gcd2M9sXE2GdgGCzwHZuJTVjGkGylj6nRuS1w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvQTduUkIwQ1NTR2RHa2Uy\nYjZTUHovbW8yMnE2MVYrMTltbXJEVmNHR1FZCmM2MUpIcDVNYjFRVEQ1VFFsYXNM\nVVdrb2JPbUZaOE11eHhtK0NMMDV3SXcKLS0tIG8yZGFGaE9mZ3IwZUViL1VYb2Nx\nbTB0NHUxeWRZTzdCUHRDRFJneS9TbEUKbIBT1UyMTNO8vdLA+7hXjiW/sl8fEEyr\nYOhmhe8W9SfP+7+k1tDeWSCb5EQEuoPZ72y9xsWsLBzeGaxNLwD89g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlTnY2eVlZVFZtQkFBRFdr\nMTc5bFcwdkQxY3JQUUF3TWVyNHZxUytDQmdvCjRmTm9TdFN5VnN1bkx2dHhlL3Zj\naHZFK3NvbnczNG1EZC9BZkxaRjJMVVkKLS0tIEs1cUUyeXJVNmFaMTVBNHRRdnY1\nSEoydnJWdHJDbkJKVEs3azA4aDVPVnMKzPcfS8lz3kXcqf7EObYAxPzRR55h5SMw\nqEkkr5nDkfDwQSuZXsNP9i8ktWYrWOhkz9/InpoFG0eGuj9EIHxk0w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMN1FzWGxkN2ZvOUlhVnQ4\ndzFremh0aTNOMjljSlVDMXB4R1J1emtBQXljCnFlQ0xwZXVKdTNPc24vU2wyV3hn\nRGRONlEyMmpvNXRxVnMzVkNzeU8zYWMKLS0tIE1iOGM5Ri9pVUZYYnZORVNzNEhi\naGRNeXo0SXBNUlFUbzk2K3BsQ1I1QjgKl4tYiBJEoIqcNFDZ9vLISrBaef/7F3IZ\nOMVVxV5LgB3qqIIY+IkrG5e3jZjweeeSzdhhDlWnO9rhr2DpDVt+Zg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-23T03:39:09Z",
+		"mac": "ENC[AES256_GCM,data:zNjoXj96jrx6t+OEOueP9RCMIDRQ7zp6i1hQ24CPVdFWTSrt7W5H6UmI17ZCKQBw7mKDwbj9cjyWTYSrlK8iNoQrX0dYv+PCEuB3A9Ru/noE5rY5JP8eNEheKfUfkmO1UgHr7ieeoEsAmMzws7Qv6lp1bk8j0jEu90yLwI4dZeE=,iv:BpkNODu3dQPJU0avyQgMWIj9cCjfGX88wj1ojWpa2vw=,tag:T+McVuZ9ukW07nbIY8MahA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/petra/zerotier/zerotier-identity-secret/users/kurogeek
+++ b/vars/per-machine/petra/zerotier/zerotier-identity-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/petra/zerotier/zerotier-ip/value
+++ b/vars/per-machine/petra/zerotier/zerotier-ip/value
@@ -0,0 +1 @@
+fd79:fada:fbe9:8c5d:d899:9375:b7b0:ee6
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxekSBcL5byOOEs2sq91Vas7BvggjQ65O28E3mflwUs 
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519/machines/rana
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:4DfyVoor5EuEDemCBS+7Nir8K0XlulK/hbSghmM39bNn6J1Y4VbIcUrvK3+HndEvEhQd3EgAVWzrNYIfI94bvzKkv3/s6VcmTgQ3/DbC3r1fLdQmDGD/qlyExbvug54AbJyTTyh+mrU3yBnNOf/7TPrndat8giUaOI3KsSjUIdYw+447Zv1U1cg4m31L7yqo9/EZTrIoSimjV1faigZxKZDpTOSuljQmjvA334FNIsuNMNMtMPQqOBB4rRdC0cX73qFH/4pvWENLYxPI92Ue/JtQ98swW+ewosLba4P2UC66MscW2zTxGG9JGGJ9Wb49bOYcWilLeaFyje744GgfFFY/g4X16gcOdZH+boKfMVlfimUJbijcH6ViNAIJu9cMpzeLLSirQ/vbNY+nQ3qvx8i7bPjOIf5wS/v2Jc4Wf4kCRgk4YCl03oEoQ4xbXmea+s4gFdC+SpN+M+Jw+Oo6GOMJ/VvGSQFx4c2Ol86WZMbhYBj10RxUJSCPcrvzebUGhEEB,iv:Y51HhH//qu5zpfRFFnTIKnCzpYr0utKpEiGqv1cCCnw=,tag:X6FYr+k4spNzbhfcBXnAjQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1dGEyRzEzYnlnVnNlOWMy\nYWtGUitzbDA4andyaEhFNGlrOW0rMWdDcldzClJwV2YzNjdUTFRXNzFsMlY4VHRR\nL2lYNlM2Uk9WT1NhTTkrbzh1cFMzOGcKLS0tIFVjWDcwQ0g0NVNKUXhHSmpKTUVW\nYUxtU0hHNmM0ak8vRDRwWGpsWFgxRE0KZYr6b3CPX6u4TF6t//YzkguOLaXxOAQd\nxkCygAnAJCITH0hHz8TyspNg7dR+J7E10Px6QC+6YjpTtmpZmbZl1Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaZUl6Tnh1Wm9jT0lFRVM1\nYi8wbmNNazZRY2Q1TW05ZHFRNndXaUNQT1ZrCjg2MnNGY2VrODNmb2tyVTRKVzhB\nRGpIaWNNcFc3dzl1RmM0TzhRV1JydDgKLS0tIEFGaDNDOS95VWxhS20xK2U4b0oz\nTFd0eDNkU1kwQzUwTnhzdEdXQkMvN1UKXmH5Hq2tIFfedG8PALnO+IbFjeYDBTmO\nf9aysra8Ait4TpWBNTCXbdf8KyqOQytV1spzsPBjVVTkNPwWaAwidA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBudFh6NlY0R2hNVEpIS29u\nTTlNdkkvQkRkekFKR3FGTCtjTXdHd3ptU3pVCmxiS2F0Z05DeDZIdkgxRDdpTUZz\nMk5OZEtjdEt5ckR6MmlRYTVKQU4zUEUKLS0tIGNsVXNNbWhoUHBteXErUUVVdUdF\nczR3L2dJcFptNnd6YUd3SXdFZXpZZW8KZtn+WIHD1H4qFZFK8idcS7hFgrnqaKiE\nt7ZpN4PyDH7mqH6rkW3Mn8o9ZsfvX9gV2HmgSkj8CITRLu7HfKGrog==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZTcTh6L2Nm\nUGNOck05Z2dibkVPUEhKYWk5aTZlSGlvTldYUmJoMXhmZ2sgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpnaUxBT1Z3ZHpTVzZKa3gwaDVvUlkr\nd1BiNW1vLytrZk54RFBHTEN1T3BNCi0tLSBHcHROSEFMOXZrcFRWNytxZGhNNm9Z\nRkxsQTdad2o3TzlzaHZuTDIvNW5BCjPnOg2RuHG5tAO/TpLjcIJ1spSujPEiQifn\nefk620zbb5nI6MAhWDX5BHNgHPCxDHJMo1mDgX63v+IXyx4DG6E=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGcvUGd6Zjcw\nRDcyV2MrK3JoSUtKMHR2ZnUwcm9iR3QvcDNLODRzTnBXVXMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpRdmRVZ2RtaHQzdnMrMkxLaHZyeTN4\nNTZ2OUpuNTFOeldnN0dZZ2RXZlFNCi0tLSBWZTBoTis2OCtOV2VUNzlUVnFURXEx\nU1RqQUQ0VW9MY0lEQ3FCdkVNZmtFCjwNPG3+79L13syxN+Ip9dMUN8qTOw4K7Isk\nRhlh38jv4j0jV7dGSjczBhnzh7nbskqCtqZ9mGa/vLx1fiDsBsc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG83a0JhZDlm\ndU1Dc3gvV2lXSDEwUDdpWkNQdmxpUXFmdEVQaTRhbmd6RW8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4SnNydWY5cWR1WlNJR3JqNnl2NGE5\nWGpNU1BUT1Axa0NNN3lqNlZrQVhRCi0tLSAwcXZjRjlKK3BFZ3FpU25nQTlRakRN\nSU84dDcrVVlmSS9Zc0VWNDE4K2F3Cvq4zmsqOwoypsjf3BO9MfjdNGxxU2tkgsPx\nuRwQHEJhT5W8x5pnSEi/CzA6bnFvlvP6mk6pxCJUERPZGVgHYAA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArRGwrS1RhUGpKOTJ3clU2\nc3hLbENPSnRpdnVyMjJYVm1YZ2FUazNCeFRFCjFZZmpuZnR5a2ZMdEhqSW5zcUhU\nR1lzYitNaWUxZndiZ05ZQUFBSFhGS0kKLS0tIHFOcEdnVlE5M0VXYnl0aEtiOXpT\nZURBZkFPSitHcjNnQmlQVElnbDNLK3MK4ujldBhvw2+3fKhilUJxTkASe3CyruKH\n6NKTCqG1lAf1j+4HqN51C1knOom5F0Qcc/lXWMbtgZA2N/pAjoz0XQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvU0hvUi9GdlcvZk9rVFNG\nblA3dmJZNnhrektydlBMeVhUZ3hZL0p3K0JNCkIyd3NhRnF1ZVlYVmFERHJsNEVI\ndm1uWEU4Y0J2dG55cmdNM3pvUTNQcEUKLS0tIDlyWXFDSzVpOXBxY3hhV3orZ3Ry\naG5FNkRhQTVBaDJ6cUdTSENPdmYwK0UKZROa124CV2j0rF4FkdJYDbzcbNFfLI0i\n3mLA6ugNwao145Cd/iFn4g1hHBJ2taWBmOLcjk9aa/NwekLclJrqQw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtc0VHTS9rejZnbFhaNVZ1\nckFMWmZPaFRoczlEVncxQVQ5MHliTWl5T1hFCm16UU92NEczUFZZa2cyenhBZGV3\nQTVmY2d4QXRQN09jdFB1bkd4VDMyMncKLS0tIGtZQ0Q1bHMxZXhSTzJZSnRDUEpM\nWEtid1BKcmUvMW9odkRFWnVNOSt6VGMKapQACZKpzcgNTXEZSGLN1zYXi43gH928\nG9AhUv7RtCaIPmHByjFBhxemh8zdvM0jfxRllpxYwlEWWjw3ebC26w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WFpZR0Jlb0ZqdXJOSUxh\na0tHNGt1M1MwSWoyWEhqK3N4cXl1Z1RzOFZRCjBQMWRvQkhJMXBkNnlTeVZNU2g0\nMGk3cmt4dnJmWFZRc2Y2cU9SWEQraTAKLS0tIEhpWXRselhPZ0l2TWlNMTUyR3ZU\nam9tZEdvdFg0aUxlVlV5VGZjY1dXdmcKmim8Cq93FQPaT3I2mGQ6qX542Zowzzt3\nJ/PF2IuzlXNiO93DLP8Th7jyo1EV8/yu2ak8R+yOWPSJpArLYWrGIw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:54Z",
+		"mac": "ENC[AES256_GCM,data:4yVGgr5CBueGSJTumk3vJ9AGTRbSLgP5PwA7xlPyg4aZB+kdqTFC6aPRvj6oJgHTgLW2GPk9Phd3ECS/eo2OwePUA41669S6WDZx+S+5XY8bFmN2CSWFGLC4RdAfTv69YxuheA9FZf2yKUuNuC4eXWFRnOB0+pjnNOWTQ+a3E6s=,iv:N6JLVDXG5yI7ufgeiFGOCV+pjn5WXyAl8naVnpBtqvQ=,tag:nKwkTLCSig6Eq6UU+ZgDLw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/root-password/password-hash/groups/admins
+++ b/vars/per-machine/rana/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/root-password/password-hash/machines/rana
+++ b/vars/per-machine/rana/root-password/password-hash/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/root-password/password-hash/secret
+++ b/vars/per-machine/rana/root-password/password-hash/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:i8C3sIwqpPXfoNnDt/ZKKqVMgDJNAFzvZeI+UeP2SAMQD9JbRnjzMJhDXd9Z8PNvx7g0y8M7qh/zubpfmme3fG81HZcn0gliuLqdpjPErpF5G2o2AQy52Y5IXYPAaicpsnpFzhSMnfMcZQ==,iv:BulJeE9R6EEDkrxMcHyIjnvN5CJlbYI18s7sYLSVW7c=,tag:1s/xo7ZvPgq9qmUqmTRTNw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhejdGaGYvNC94REUrajkv\nUjMxN25Da25lQ1o3ZHFueXBlTzBPUkVIVlRrCnp3Y3BxanRKSDNNT2NtdkNFMDZl\nSk04Y3VwM3hUZXBBT0ZzQ2hwTUlxNEkKLS0tIEExVU9xREU5d1FQd3ovdFAzNDlV\na0VlVmhILzN2bTlIeFpGa3B4RWhWbjAK2hnF26x18ETtSlP3u0AaEZZ+BH/iVQ/o\nnwpa/cxOeYsdXb/2oBBXLMtrHnuEX8bPfAks1EvUm4ekN2tTpGpJ+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpNHVPUW5JcDErNHpZK09q\nZDQzTWdjZWhBWjY0WXpkWnJlL0NlYzVYb2pnClZ2Um1qQzhwUFcxcHIzeFB1am5p\nNWpjdUVueERSV1VjRFFBQk93TEJHNDgKLS0tIDIyS2hWM3BjNmtkNmRxQXdieVZq\nam9xV1BzdjU4YXdVaDVNR3R1dmpDdGcKTWuulM9VO868v3r9iumbjjxM2TMJPERw\n3tnjbAmO0Rwg45HZD/xd7atiHCZvzxNH4Z/TBV92PAnHg9fZXeh6Rg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlUDlDSEQxZjJGbFBDTVZj\nYkZXajQ0L1R2MGJSbXhkY1N1a2ZJUjhnK0hrCk9HU0llRmxhN3JvUVB3MGNTZG1S\nRUZmOWR4S2EwOS9Vdm01cm1xYm9YQWsKLS0tIHAxY2VuZG9QMEhQYUxLa296VGw3\nVzZ4aDRmcGQ3MmpjellOK2tOWmQ4TzAKyvDTMDjyjeA2Emdv4wo5RJsx9l/J2iDD\nfu6gm+FD0BXga8G8pAgSClUJY/BP7PGMx43r3Jm+hPJQH2UTAcLy8w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHdZcUJTeFEv\nd1ByTnJvbW40b1YrR21MNHI5OVpncXh4d1BWaHo5Ymc4QzggQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpadTA1eDJUN0FOUXZVTEx0UGREQVpW\nVUN5RldWb0hQdktQU3hveVc3ei84Ci0tLSBXVUJvRHM1UXZYK2tNbllOQXcyNGtz\nL2wxUGJuOElKbmpTdnp1RXgyaGlJCoubZA2ZvTe35fyE9/AxNtoX+Tf9USaodHHl\n5Syjjm0kLMSQmutB5/zpfzKBTn/Y2cNqBjf6bRODzm3LKXP51F4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNZLzdJSFZ6\nUGo1Z3VVaWxORjhJRHBVak4ydS9BNE9xTTZVQnV5SlhpMlEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwplZWppMlJYTC9TSDdwTmE2bDdtdTV4\nZDM0WFo1bmZqSlBIOEw0OWwveFJFCi0tLSA1VDBRQ3MyNDdJRWNhUFc5RTM1Q0d6\nNEViYzlNTGVqZHFxOFFneG9WNDVJChqQvH/C16Fs/St/H6Td/zdNMydMoi6Zxx3q\nUX3FNV1O3OS1L85+WM1hzVoxGM1Fiap+2Bn3YV4HUnM8m4iyrUI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9qaVBNUy9W\nUHBEaW5EYW5wMnBYMXd5S0RlLzJVemdZdnpvL2VveEwzU1UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwplSU9rMUNhUlpLUGNiS0VFdklOR1l2\nRUZJWUxGb3VRN3BOZVRtZzFGeXZZCi0tLSB3dUs1YVc3NEp5cU5WZVpBYk1QL0g5\nMWZrYUN6Z3lBcU5EWmw2eklYMXNvCqi2vKIzq4Rqe/B/fb0KdFFi1VyhTOfAwZ5j\nxeEgcCo3cXK/x5QB6SWS03rJ4JurizhEyyupU7H4PvmXotJVcxQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1dHc1dDJkUklBb3VWY3BJ\nN3hSZnBOYnlhTXNPSC8vWEtTR1B2azV6NDFvCnpIbmV3bXpwTFRrNFg5SW9nZ0tV\nK1dDaWNvemJwbDRJWlJlTTZET0hqbHcKLS0tIHlmdkVYdkNScEFQOVNSbnU0TW5U\nVE54U2lqSXdCSkpQeEh2VmppRjR1cncK7JrYpimS2/93ueWyTvH9HdIXuAabOby3\ntq7V3PeAYJnxzqeNtQa5rASnpGOTYO84ETC8EF3InZg9rI2gkl33qg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGby9VWDAzNkVHV3pRK0NB\nU1h4VUxwVlVkdGtWYXpzVXAwT0hMaEd1QVJrCnUwOVlCM3A5ek1sM09VTWJiSkFp\nK3IzenhzekFGYzRTRjdtb3k3a1BTcmsKLS0tIFRkVS81bGNhTEJDME5LWlhSUHJZ\nWEV2aTRYT0J3dm9BNnB4NitUZTI5dm8KvmlWtCHAfoOQvQa6PAy2FvX7ZkWauCqq\nyjDxZuyMK33ZvhwVt8MtwwJUeGpHJ6gFjrcUvavlmv77KQAv+RZy5Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRFNweG5tWjBVc2ovTjN3\nSmdSbXBhMGUwbGVVQ1U4bUo3MEw0MVhyblZnCjQyN09TcmJIM25qMnNrbFBkMkJ2\naFhhNzZnN1BLWUFLT3VyaTFVYUU5Z28KLS0tIFNUSDZXUjVkaSt5QWEzMWxHdkky\nU2VGZ0tHUENsQkhUekpib2hGdkNZakUKsv/+PApCsND8s8NNz7onON6zBxUqd6WF\nrNypiNkN1Ww8mw4vvmN7fRHxU2wXUQwU141ycne5/3Ao25HQF/wicA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZNXNVT3ZiSHg3NGFBZWNF\naVdPTmhwU2hPcTZCcnBrM0xMcmo3SUhsZmc4CkhJMmdMZGFVZUpkNnA1WWtSQ3Vv\nbkUzQTJaSEFFNVlIcVFHK1dxVnBnQ0kKLS0tIDlvbjI5YlJDU3pReFE4Rlg5bklY\nWlkrZ1pqRjRaaVhhUGx3aEczYVFPSXcKZOULJ7oKQNj7nTVv6VRt7o9MofDG7TbN\nFV0S4raYatjNgPBMx4JCaer10PzbC/6IQBl0PZcK1/o+Hkug2deQKA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:55Z",
+		"mac": "ENC[AES256_GCM,data:LdJISLehuhnxYXc+xQszdx+xSoQK1zH7+Db5Y4M222Fac8jcEdykYzgPzCqzEvpDmT4zdDnoPnpHE2uk5MSLFr7g9++jeWRADCrvR42uOfWLoqBhKOxsaD7lbMw9sc+jQvk++gcnmucapNMPmxUQiMhGkjOPtGUNUYXmYo7poKI=,iv:+KRLeF69msX9k8koVAI69G6HytWqfzIUqo6XRN6UYGA=,tag:WH2P5CkZD9pVC5O+vztYQg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/rana/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/root-password/password/groups/admins
+++ b/vars/per-machine/rana/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/root-password/password/secret
+++ b/vars/per-machine/rana/root-password/password/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:hhcuc36SLu09Zl/orPiHrAfz47WqRE9NU+VVh7o6b+03nMrt,iv:ggDVEut8nHXRcL2FID+RQGUsqM7u9Kcp4R0DgZ/Vdyg=,tag:x9qf7SCtoZgQjH2Xt/xVmw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdm9obzJpK3YyeEhPZ01E\neDdWT0NkUFBjOFI5alMxY09XemMxWWFaZWpNCkF2YURuUnVTd2NoSW9hMHZJNzlM\nY01vSDZObjBXSVJCak9RNlR0b2x2blUKLS0tIEtDREcrdHpLNzNxbU9kVU04Z0dR\nZDhRbHBjVFg1cm9FTkpSb2R6L3VWc0UK8pNs1SgBGlKr3VOSmt4h8s4JkO/FRD64\nl7+HiCCl06B+ACBEZh7y6B1NMA6kD5em9plzzb8l2KbsVD60sany/Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmRCtxdlJWUTlwV05zbXl1\nYit4QzA0djVpeDJIbXd6SnpCVCtKUStqVGdFCnlxWjZ6aU0vNnhoOTJOMHZLVG1C\nVEhDZ3dyUmZwQm53NGdtYmZiZ1BIR1UKLS0tIExuRS84a3JuR2l3ZWE1SEIyMXhZ\nUWwyUENzM0VRQlhmK2VVT0UyY212emcKg1nBSq6I0XVf/qNmNLRsKKgEpz5Z1KkS\nSORG00uh7EXcnVdFPmLf3DEsPUnoNfXoHDgXOBEOP8kRwUEciazTBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDE0cksvdjhl\nbGo1Q25kRmNjaXhXMFNGNFNLc2Z0T1dWZlc5enNZTkNlMlkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyOEVZTUxUajNpeCtqcEpyc1ZZRWxj\nSW41c0dZTWFYODJDQVpGZlVnaXlnCi0tLSBiUlZNemhRMlExazlQREFYOGsxQ2c2\nam93cVl5akRSSHlJZ2JGa1Bmc1FNCqPKgV0nM9IUgpKa2wWrZyn7Z56QrNrT4L+8\nHqPToWF24itWig7ohHckoc+KlHMCLn6DHWbON8zS5uwH05j9lLM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGNpdGN0MUg0\nSi81RFlXOStRM3UyM1YwMDNPZ2h6U0gzc1N1M3J2NWVTM0EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwoxRkNvYi94aS9QN1pzMVhSTituQTlK\neEFrZXdkMGZ4d0xDVmFOUyt2Zkk0Ci0tLSBLWVJlMFhKM1V6YW9DSEQrNjF3QU1K\ncSt4VDFUOFh2RlpmN2llTEhHVHdrCqam34rliA2MYqnsuOiCE2Qf6G0XDYV8+Y4g\nC7MZzhdr+DJ5L8EuovI8/mAkmwhMQO1DRsu32w+thCsfo9YASmU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdNQzBrQkNr\nR3phTGZkTGg1V3EzTjhzOVNpSENuRGxOcGFjQVE5TDdpU00gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpscmlUU005OU9FZHI5Q1VoREJvU05y\nTFJ3MFRGUDF2QzRCbFFFeUdzTnVrCi0tLSB5NDVQQzM4RnliSXdHRC9KS2hiYUV1\nbHE4aHozUTlNWi9reFM1NWN4bm9vCjP9hdbQLRnHOcTWbF/epfLuxf4P5lS5mEL+\nGDO9vOZzgdDVlrvuMGA2d38TOBW1mpR7fosz7N5YYE3gHmcj6hY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Zm1HR3VKenlyTTdtVnlL\nSW16NExJRG8zd0Uxc3VlN1NBeEplMUFpTGwwCnpCOCtSQUpmVnZocmpQYlNEd0tV\nelNUM3NXL0NyaXI2WG5hQVBOQ0duZlkKLS0tIFZhNlhCKzVlTC92UzJRN2JodlZV\naTZCUmNrQUhmaWJDNm5sQkhvcGtMU1UK3zBLa5XmFPImosmxB+wjT+xoibQn2cO9\ntmposaSKgnkyvMO7z8tZHqADG3Uw+BQYwOJMTHOEw5Ers0edP9cBHw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaVlsSlRKZ3ZyQ0hDVllC\nVWFtcENqRUttSTZYQSt2UjA0RUJPTUhJWGhJClBoZUVPSSt0SlFRazY5YWxiZG5Y\nWGdkZ0RwME8xbFNUcUpmQnVrN0RnVVEKLS0tIGxKRkYxbGJCSU1KVzJPemhqTUUr\ncm05S084ckxaRkRKVjlQVHp4NktpZTAKjUCtoHgdtcFuKK++Rc11065nghUMVCJc\n6hnsIo/oJ1fUHE+IfXpjOQ4eazSh0ggLwPYnRCUiqV0OvXAIgwzMTg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLa2thS1loc3Azd0RISjRB\nQ1Q3MFM4UnN0WisxaU4rOHJzcHVFMFFqSEZrCnpYTUltb29yOThUNXRodkpwZVQx\nb0FncERWTVhtZGM0NUVKR1d4U1RVMFkKLS0tIG5FSnZOL1pGYmZ0a0NWN01HRmR6\nbFdHUklrSjJnRWw3TFdRdHM2N1lQZjAKEN0qllgzMDcqrJd/oDL4f6pxFnKYTQ8r\nrz1Aa+wF9nasW7bkgv7NCxAn9yVldmKOc16cDDoqKfwnpmnugxgiEw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMMGVZUklDRC9jSlpwZXZ6\nQWVoaXVnSGhVY3EzQ0xjVXF2eDhLYllKSlRNCllXbTdqRk94R2k5UFllODZ6RG10\nMDVCRGp2WVhxVjA5UWZWVE10YTJiLzQKLS0tIDk0QkoxR2l0clgyemo2ZlZ1WmtU\nMGoxTW5kbFdic2dhRmZ0MDFBd0RIQ0UKJtDsYSmRizimNjNDuUJlTmqEM4rIKjIQ\nVz9n54qNYMuk2lIqeDdxbWVoeSC7AS+hEeiQRn0TK6Uy8sewM+l6QA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:54Z",
+		"mac": "ENC[AES256_GCM,data:oxUamNJ+iLQXKEHpBivMdpuWkKi+L9CsR+hhJDVdbHLsGuDtJrJB8wmItoB7CusgQJCtOnRBCcK79PXFlOOhlXIjm98XdfJgl0em1hQS0mGwxudo3dJ//AZI7thKE3/Ys3+OuFqXDZHgUPcuZVLCLMuiKVBIftyLrVtCaMQsPIE=,iv:nQxcOgWVsbvnbTegZy+pv3pIN4+dQdJYd59n7FFRAdg=,tag:MlF5nfs5EpFAvTPER+Y7aA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/root-password/password/users/kurogeek
+++ b/vars/per-machine/rana/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/state-version/version/value
+++ b/vars/per-machine/rana/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/rana/tor_tor/hostname/groups/admins
+++ b/vars/per-machine/rana/tor_tor/hostname/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/tor_tor/hostname/machines/rana
+++ b/vars/per-machine/rana/tor_tor/hostname/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/tor_tor/hostname/secret
+++ b/vars/per-machine/rana/tor_tor/hostname/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:TzVLzHDkqdn0WGLJAksBmvz+ZeiYIodD3gBb+NI7O7yvWdRQwFQZ+nG/xa3cni2JpBWqdb+VNuHl+C3pluCV,iv:lY00qkX42DceadABPdVGh/vns9f39MMvTzRRjG+YpnI=,tag:aoC+9425KQ0qWt3trqQP0g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6YTlDV25qQ1J0MXRvNU5I\nSC9RenRXTGZwVVRDc2JoTjFKU2x4Q2xpekRVClNiTkEwNkhKalFKUlNYRllneUh3\nMysxSENGN081N3E2NmZZRUpGRDFJMm8KLS0tIEtxSzdqTW9WcFNvcVpPWURYZFVD\nMmVwNWU4ZVF5RlJrKzVGQ3RhaHZkYWsKZISNjCQm+6NETaJmc/yMer53WZdA0Wv4\nPR2fi7Acw150TOjdcpDq/FbtC581ZXu5HU7RmyKSrW5EcnEjkgFsuw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBya05pN2VYUlNMOVRLRFhT\nY2NhNnpabDdZZ0RvN00vR1ZPKzlNUlFYK3pNCnM3dXB0TGl2aGFEckM0OUUrTHpG\nMDZkREJsUTdWVU1zRE1UWXZvOEo1WkEKLS0tIFh3cTJMT1lRMWp0Njk1aFVOS2g3\nUDNQZXNtZ3hGSXJQb1pNeWtvM0R0bFEKq9kSfkcRyDxaxE6PAr3jD0z3BpejytzV\nWV9ACZGllQhuLc4y4Kr0eTbVk6r3WPh1/Bmke8/94dawNuCk/k+gVA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZWZrMVZaQmJDRnNDcWFr\nUFZrUW9ZRnBra0w3SnlzVGNqbmZrNTBxTWdrCnNJYVZDWjRLbEpZRkQzSytGMWRN\nbVNOU1JDZW9jTzVjemtUOVJVbmN5eWMKLS0tIE0yT1UrN2J5TnFQeStVTEVSK3lQ\nSXNkWFp2djhNTUpCQTBUZXJaWll5SkkK3eGMiLFDKWkGX5FVcGDEvI+8fgOO/x51\nafw5F7V3uR+ebJhxtyjua46HdPGaEhNDolZCR4WokdIqtsHhBWQMjw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDdlRmxDaW11\nejRzQVdtc0dSN3BEaVcxdnFNbWlpMUt3b3hDVU1IMStTbkEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpZWVFjUGkxZ3Z2RGRlOUNtQW1BZGZn\ncFRBcklhYXRFQmdpSERnWnBISG93Ci0tLSByZnQ2My9PY2g3Z2Z3cEVEQWFKWFpa\nQlJ2MGV1amhZWGJyWnl6cFIzK3VnCmEnVWZ+XV4NJKh+7u7fD5yjqcendqYkQYIj\nlsOMusnNKEuKf3042WgG8a+s4V2/QELkXmxqIKebFeGB9pZuNUg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDFrTjZrQWNz\neXcxMVB1ODA1d0kwblVBY2RqT0M0cUw2UklPL2FFeXh4UmcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwoyZ3NoTW5EWVpSZFo0dlUwcnZheWJE\nb1czUU9GdzJiV1JiTVQ3S2tnaTBJCi0tLSBiYytybDVaSFdTNGs4Lzg0Slp4b0lF\nM3QzZ3ZBdGVESFM3WUtqNW9LQUk4Cu8sY4GX1SSJfSql8Ewa3ZQFWBYI9+JFxJmc\nT61ZmHZCe+zhILeiDQgSbvpVMUV+tvJS5adknFCMnzUb2AvbWlY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE1ZUmJRWEJW\ndWFoc2x1bjU3OHhBZ3hBc2dvOVVFNGdwM2REM3hBelV5VUkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjc3FlRU9LeU5CcTVLUjVGS1o4QzE4\nbDI3SytLUDUzaDVYQURNVjRoWklFCi0tLSA2NFM2MWkySGkxRTZ6Q0R6VWoyclZK\nT25WdnlyMmVjc2pBQVNkeVdtb1BZCpelSmgjukzHMWtb8KH6xr5IcnMFbLqcda2E\nG32pKZ4Y9ibXJfqa3WL5mbm/O/TVJ0nOsag/DjXUVm3H6CVzgDg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEWFo4Mm1SbzdveW9DQ3Bn\nNkEvMXp5UDhjc0ozQWhYa0JOWG90a3AxUUFRCjY0QmRRU3Nwa1BUTldHVWd2RHYw\nNUwxenQ4STNVU3RqeEdQWUh0enVUKzQKLS0tIHh0MWYvS1dPczBLZFgvUkdhcmNa\nbEN3MGN3VnhReG1pVXVwelhZSTBMUDgK3NkdjDiLJwsxK72Vy21pP77B6FaVw3UV\nTBhg/mlHZfzj4tmjtJ0YMRbzVdLJBdnpUmxx89MPLBs9psXX/c2DDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVTE1xQTFpcExZaGZPVDdm\nT1ZlZktWRGtNUUk5VTd5MlFFNGF0N3poRDAwCmEzZ1pFTzY5bHltakovOG5CVENN\nb1hGN09pbGgyNG12bWpWSVJlMFRBaUkKLS0tIENScHhCTWVjQUxWZXI3OU5tV3F0\nTmIwQjMyRE5aNVppMzAzdDBOUG9jQmMK2E+3mhX1n4Lyp1c9TK7DjuggBUZxCBqd\nbRQXHz+APekrqM1fz1WaxcFxdUFuOFm6vXq46BxWnV2inUc2TqzUPw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyMUN6a1FPME1QMGpYWWk1\nTVhDdUlBK1lZdDc4NjhFcjduak5xMk83Tnh3CjM3MURuN2ZHbURCWTc5Q1MzeU4w\nSUxwL0RZNTBpQjU1RTJmZmNRaFB6QlUKLS0tIE1zVXVVZ3VZcC9LTlJyZko2Sm4z\nakhZd0wvdDR3SWJyeGViam1rTnU4dFUKyCPFRNUaY/xaSet4UMVuiDxcxaZlFPa0\nnmZBb7RrijB2Huhq9wktGBYUF0k7Lc4q7ZL8VwMRsuc4SfjCWqLwMw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmbmNVYXhlbE5pUktMVXEv\nYlpaVTNHYTJkTy9LNjJBbzdXNmkrZE9Bb2o0CjBhQW84Rlh1WjBFVDVaSUVLZndS\nRlJHRldxWTNQODcyS0ZiQ25ickd5aEkKLS0tIGQxQ3l4TTFRQzk3M1FGSXE1RXBv\nUWJTc2huVXh3ellUc0FtZFh4RG95WXcKZi8hCJ/T+gQHSVJiVBltVgTvq5i/JOql\nKPyA7C2T2jTabi0RFFeux+FnbOfjc9gATZ6nEbpuh1RBYTjCSt1KyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:57Z",
+		"mac": "ENC[AES256_GCM,data:HKSbSEeuew8iKJaJJA9SPmBD2JITc9j/JVsNl+EnHLIT+ccIT7/s5eMe6YXBS4DTxDV7WyKy7tP2ynWaiIo4RmUEkvi3TwY1kCfJ+VjpY3pheVFsJ2J0bjkPW3t8eFiMuTS8mUQlipkQjVtzeNn+WtW+pBmDS1tXwwUhwAP2XjE=,iv:JTSwcTrQAQIyM1EN7rXefAbGjkOhlSCRQ9L3WvDQDC0=,tag:BAo+jREHjKLrGoJrU1GS4g==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/tor_tor/hostname/users/kurogeek
+++ b/vars/per-machine/rana/tor_tor/hostname/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/machines/rana
+++ b/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/secret
+++ b/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:57R0rt4GIDxJYQqtAJODglyySiAtRh8UMuSSvmhb9kP91jmHGAAOGpEvfZMUDnTX2l/lWuHJE0rF0QhL4XX9ANJarRXyivte6fJ4KGB9ThhJQOh9/q9hc1nuaa4MFpn1,iv:YaqEBVVLTo/7Fwnj4mJYR7EUbaPN+gvO+iCJRN0w9xU=,tag:EcLuLdIpL8g51PWghGZFhA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzek1qTmlGeDNHN21HK3U0\nZ1djQVBJUVZ5RUVYVE43cU5VZ0wzSU01eUNnCnNrd3ZMTWtsZnRNYzFyVWVGYm15\nbjlUYmNqZzI2TGU5L210Vkd4V2ErazQKLS0tIDh0UWc0bkpKNlFXaWJ1Ni9HT05L\nZHAxcDl2TTlvOTZQL1BTTHZxK0dXMjQKKhXcdE0g67jSY0Zb3WLx4cdVxI4+1Pcu\nHbanf/yzPfjwpAqAy8Xo1TVUzuy6CmgSx6vW5Ww0/YbbXoP3zQ812g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3RWhDbXRRdnFoMk8xRWVn\nYWI0Qy9wSHNoaHdHdXFIQ3VTeGE1UWI4Ums4Cm90ait1VEhiOFZmeGRZTUVXZUxq\nOWhjOUdVdVVhU2dBbEdESnZjSGlhdEUKLS0tIGV4S3ZXLyszblErVExQTmxFNmdl\nRmtNSGxma1BOOUpoTmJpenBrOE5GR0kKCO5wjXfFjRltMU4xFcZhh6V+dB4/vo+e\nl7Zsws7JfxI7bFCdXBhaDiU9NzMbv2zYK50E0+PyjFTBisqKaF87XQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwV2xxT0lWRkZCWDFnekM5\nZ201RUtieUs0bGhTMnJXUnRPbVNPdXV4V0drCkYxM2hZOGNFVitkd2did1dZNUNl\nZzkxR1dFVkFYVUNRamFNYVFBOFU0ZFEKLS0tIEdtS3hWeHh1MjR0bTFyVFhmZmho\nb2IxY2gwbHR2RXFodFZGTUxwS05JWTgK1vftYCAKRpsw8y99NOwNOHpD5YD2LgHC\nPTVSiJXwtEGmccAK3JtdKIvBY4Pj9izo/FDymRKhmsOMS02sF6IJuQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFI5c1dzWFFl\nSk1MdERsaG83NUtzTVVJK2RjOWRGM1NUUldSWE1PMEdsVDQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpQeWh4T2JLdkZxZ21NWkZLcnNTeHpI\nSkpITkI2Q0JWR2dHY1psVWtCSE1ZCi0tLSB5VXlKYWRoSDlmOE5JZEx2QlJ6dzRo\ncm93SkNxMWQxaGJHcCtQbFRWZ1RrCnMTWbuWZl2CER0eVHtMNxMTnwpUqkDDB6km\nvL+ojGoyWtByvTZJJ8YcVs0mBL5QybFV7LUHmTvDyaQtj6AHs1g=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhhZGt4Y0dM\nLzNBVkRWK2dMNTErVW5WZW9OaXNLUFUvRVludFlINnhEMGcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpNUnZFWWFrZnhyYnc5YXVINXd0UmxG\nTWxidENCUHE0QzBrWkQzWlViWWxvCi0tLSB0ekRsTEJrbzZxdHpMTERSUGtGbDEy\nY3VrN2RwZWY4cVBEdVZNdytXSEt3Cqb4HstAzCG+qTAu7odfLuk/3DeSr7fQ+nbb\nUDyIopz6KhJ7Q2JP0TxA5odkioA5nDXGV2adKUbQMOlBvWx6UU8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFdqKzJsOG5o\nRzRFWndlSkhOVDdqWUVXVUpEY2VjNGFnR0pEQlVkdHpTR1UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpZNmxkbW9HSHJBWHpuVGNPU0V6czRj\ncVRwMjVXQ1U0OUNiK0w2c2FmZVRRCi0tLSAvaXExNm9oL1dDaGZ2SWswN3N1RUdO\naFprU1ZscWMyK2hBOXdvS0tUT3FRCli/j9d/Qvu4EkQBaHnHgPWfglrfEKInuyef\n2zpR4NX2DeAUtfDymaGdsBbtzdZsRQRc0a8rK21ngfbfewDb7QQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZmtXY3pJWHM2SFJueWkv\nSjNoRlJuc1I2V0I4d0Zrc3FVYWxJQzkzSFVjCnRWaVJqSGNFYWlyRGR4T09BNGt4\naHlRVXBhUm50c05QVlJDTWRyZlhVU3cKLS0tIENRaW9ucklkcWhiYkozdWRZWTlS\nbGI0UHREaGxnWWs1bFh5WTM2VVdvMlEK/bTMmQWeHBzQm5fSKR3/+GLpDDQT2orZ\nuLwhKcOi05/5im0jMij7WrfpWkbQ4eHgjsScUTeRRv1CRxzvBrUp8A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cG10RklUckVOajRhbW1J\nVkJmeGY3ckhGZzYrWHBpQkNZdDRiK0M5cTBjCmhrZkFPbmFJZ3ZCUWNwMGhGWitj\nU1Z5cFNuL2hheGhvSFU4MzNsbVN2a0EKLS0tIHJ4SFBFNXIwaFBOeVlmUGMxS1Fv\nQWErc0lmRnRrdk1LdVBqUkRtTk5SdUEKBr09MFwPJm7Hwi2jUCNyXH9c/ps67J2O\nHsNbQRzYSa7hxW9dC7h6XDSP3ys0VVHqcKxV5uul8M+OtHx7v9wncw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJN0FNd0R3N0xCdCtjTHN5\nMEd5S2FSR3VUUXZNNk5aTmorZkNxWkszYkFJCnlnZWdXSnRDamt4czFxUXpackUz\ncnM3UkgzOEVGQWw3NGQxVEMrVm5vdG8KLS0tIHExeWNTOGU0VlBnb1lVaHVXOUJ2\nV2FLMHhxOEFraWFSVEVWcitiOHF1L0UKWHs5mUD8sNHxHohmkzwCwaSGsAXnbE7J\n+zFy8PZBYPs/b5jIK7RBYM1rQMnu3Mko/2n11pN9iYpwPe8hZn6ADQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkcXZ6U1JMZXc0bnl1aENE\naDAxUHdyTURRTkZvdGJmMExkV0gzZEJyM0RrCkRNd2JXRVZoamdwa2RJTUdNOEtn\ndzN1WHFmS1hzUitLT2tuOVQ2Y3RFMk0KLS0tIE9iTFYxSXpiNGJ4SmNiMFh2QnRN\nYWJxNitYSk1kZDNxSjYrM0JYU0JSa00K+R8551LeE26QHmYuCTse8d5kUVXiUuMK\nRhDysOpiiio0j3OS+DdhCqgiJLzjfCRTL9kR+Kao3SX9zub4WSCgGQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:57Z",
+		"mac": "ENC[AES256_GCM,data:rzOB9Younj9bapsIldRyytaiaXGsL2enpDSt6UkTPZS8b5mEh86Gx4pnrN0PXwrSdBidC1/nRsxH/PaDjV2ByCwu0UblETWUW57sLSMs3w8IHalpUU+HWHx/DBoFgpuV+vAZl4Dk8Q0k8oPxWKnqvOlY2DmL18V3lJGugz1CmCI=,iv:zWvCmYaDQzaC0TOXYNc9tVkACXTL0EEQAiUdJ7iRR2I=,tag:cEdRJHA3697r/YnLggNpmg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/users/kurogeek
+++ b/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/yggdrasil/address/value
+++ b/vars/per-machine/rana/yggdrasil/address/value
@@ -0,0 +1 @@
+202:1025:d3d8:6714:d52:8f4d:e9b0:bdb0
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	f64119da4f	clanService/personal-computer: now uses gdm	2026-01-23 11:48:36 +07:00
kurogeek	8af9450ff6	machines/petra: added to yggdrasil global network	2026-01-23 11:14:19 +07:00
kurogeek	0b09a47f04	machines/petra: rm yggdrasil vars	2026-01-23 11:13:44 +07:00
kurogeek	ba35bebf89	Update vars via generator yggdrasil for machine petra	2026-01-23 11:10:03 +07:00
kurogeek	526244a8c6	Update vars via generator zerotier for machine petra	2026-01-23 10:39:09 +07:00
kurogeek	23d211d815	Update vars via generator yggdrasil for machine rana	2026-01-23 09:10:40 +07:00
kurogeek	696d5278cd	Update vars via generator yggdrasil for machine petra	2026-01-23 09:10:39 +07:00
kurogeek	a418222c4b	bump treefmt-nix	2026-01-22 17:07:10 +07:00
kurogeek	e50009e326	machines/petra: chocolate laptop pc	2026-01-22 15:35:36 +07:00
kurogeek	cfc967fac9	fix think-backend upload and get avartar image	2026-01-20 14:22:02 +07:00
kurogeek	f3d282b763	bump nixpkgs	2026-01-15 11:35:36 +07:00
kurogeek	a37a0cc7d1	rm clanService/pingvin	2026-01-15 11:35:12 +07:00
kurogeek	a629fa123a	no clanService warnings	2026-01-15 10:26:57 +07:00
kurogeek	d3c7baf551	rana machine: emmie personal laptop	2026-01-15 09:59:37 +07:00
vi	162ba62cb2	neptune: git-daemon: global read access to islands and thinc	2026-01-01 00:00:00 +00:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO6Ta58aLjO7YYRjSFF4HelSPK+DhwKk5AZhpzfwWKeM`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxekSBcL5byOOEs2sq91Vas7BvggjQ65O28E3mflwUs`