clanService/phonebox-global: unit tests for the directory sync logic

Add a flake check `phonebox-global-sync` that exercises phonebox-sync.py:
yggdrasil address derivation (fixed vector plus cross-check against the
yggdrasil binary), record verification (foreign address, bad or forged
signature, malformed tags, number format), collision tie-breaking, and
the files written for the dialplan including stale entry removal.

.gitignore

@@ -3,3 +3,4 @@
 result
 result-*
 run-vm-*
+.nixos-test-history

flake.lock

@@ -53,6 +53,69 @@
         "type": "github"
       }
     },
+    "clan-community": {
+      "inputs": {
+        "clan-core": [
+          "clan-core"
+        ],
+        "data-mesher": [
+          "clan-community",
+          "clan-core",
+          "data-mesher"
+        ],
+        "disko": [
+          "clan-community",
+          "clan-core",
+          "disko"
+        ],
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nix-darwin": [
+          "clan-community",
+          "clan-core",
+          "nix-darwin"
+        ],
+        "nix-github-actions": "nix-github-actions",
+        "nix-select": [
+          "clan-community",
+          "clan-core",
+          "nix-select"
+        ],
+        "nix-unit": "nix-unit",
+        "nixpkgs": [
+          "clan-community",
+          "clan-core",
+          "nixpkgs"
+        ],
+        "sops-nix": [
+          "clan-community",
+          "clan-core",
+          "sops-nix"
+        ],
+        "systems": [
+          "clan-community",
+          "clan-core",
+          "systems"
+        ],
+        "treefmt-nix": [
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784417092,
+        "narHash": "sha256-no5eDYWPUZZu4GtLufnA7b7CiZC4qAhCgf70gFiDLZk=",
+        "ref": "refs/heads/main",
+        "rev": "20371843d45f61217019e489d6857842dc8a0203",
+        "revCount": 73,
+        "type": "git",
+        "url": "https://git.clan.lol/clan/clan-community"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.clan.lol/clan/clan-community"
+      }
+    },
     "clan-core": {
       "inputs": {
         "data-mesher": "data-mesher",
@@ -72,11 +135,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781517972,
+        "lastModified": 1788346295,
-        "narHash": "sha256-G8bIXFqifs/y62GNPwg20Ksf71raYwzmyN99gf1tXak=",
+        "narHash": "sha256-k9Ol++FFhQuPya6ZNQwVhqZZkMvE1ytLtbdrbH5zkrI=",
         "ref": "refs/heads/main",
-        "rev": "7fc62d0c25c7a97d7027a9c248e21c97c9b3acc1",
+        "rev": "b15797faeca7494a7fe5fde2691d93affa3d3e37",
-        "revCount": 14604,
+        "revCount": 15239,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -101,11 +164,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778718524,
+        "lastModified": 1788308203,
-        "narHash": "sha256-pXLoI6Ax0EnUK6r34UM1vibVC7CfTu6j72R2692ZzPs=",
+        "narHash": "sha256-dCOb9YIJv9I2udjqukvjlGiTyOvGnO7zVbot0PxjBGk=",
-        "rev": "12c552ad547d87254f33f33bddd1a2cdbeac754d",
+        "rev": "644c49bbf121b3e256bc83ce10b5d97813d9181d",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/12c552ad547d87254f33f33bddd1a2cdbeac754d.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/644c49bbf121b3e256bc83ce10b5d97813d9181d.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -294,11 +357,11 @@
         "std": "std"
       },
       "locked": {
-        "lastModified": 1782964989,
+        "lastModified": 1787631179,
-        "narHash": "sha256-pU2Gye+1f+nvFleBTgXdeQfrQnKaJEuO2LT7PnsJ1p0=",
+        "narHash": "sha256-l+Zt5XNTD0f0ChkzDJURfQlFAgANIMrGYrk51SZEJKU=",
         "owner": "kurogeek",
         "repo": "frappix",
-        "rev": "ac5e2814fc1aca188080bf6b50504cd329790e56",
+        "rev": "fcb797886ae753b26a6e4415a7f2c19ba6adcf3b",
         "type": "github"
       },
       "original": {
@@ -353,11 +416,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781557312,
+        "lastModified": 1788355065,
-        "narHash": "sha256-QOIRYSUFSq7L5mY3dZymaVhcnne3tPgoR9riB0WocjA=",
+        "narHash": "sha256-gAz5oTI7ur34CfuakQduiQd/2ZhO62Bn2XXg08nZYYQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c03e4752899e55705dfa63979abd885c582a5c48",
+        "rev": "d9d750e4fc11c10cab2da677bdd31e427f3a3a71",
         "type": "github"
       },
       "original": {
@@ -484,11 +547,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781242433,
+        "lastModified": 1786845137,
-        "narHash": "sha256-bchLZZ3sRn740zyvD2icZSnNoTaanN0nw7l6fjVXO+E=",
+        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "aabb2037edfc0f210723b72cd5f528aab5dd3f0b",
+        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
         "type": "github"
       },
       "original": {
@@ -497,6 +560,49 @@
         "type": "github"
       }
     },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "clan-community",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737420293,
+        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
+    "nix-github-actions_2": {
+      "inputs": {
+        "nixpkgs": [
+          "clan-community",
+          "nix-unit",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737420293,
+        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
     "nix-select": {
       "locked": {
         "lastModified": 1763303120,
@@ -510,6 +616,32 @@
         "url": "https://git.clan.lol/clan/nix-select/archive/main.tar.gz"
       }
     },
+    "nix-unit": {
+      "inputs": {
+        "nix-github-actions": "nix-github-actions_2",
+        "nixpkgs": [
+          "clan-community",
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "clan-community",
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779338171,
+        "narHash": "sha256-affUbv/bwE8SLGhuWKniDr7SVO+Lo1XEPjCZdyU5kgQ=",
+        "owner": "nix-community",
+        "repo": "nix-unit",
+        "rev": "6ab1f232562a01d18b40d5ed6a58718c4f3a74bc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-unit",
+        "type": "github"
+      }
+    },
     "nixago": {
       "inputs": {
         "flake-utils": "flake-utils_3",
@@ -535,6 +667,29 @@
         "type": "github"
       }
     },
+    "nixos-images": {
+      "inputs": {
+        "nixos-stable": [
+          "nixpkgs"
+        ],
+        "nixos-unstable": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784802994,
+        "narHash": "sha256-4PcD0Ibzdkh85G+70w5dLlR9YgQ2bmNIjiPPMSzO57w=",
+        "owner": "nix-community",
+        "repo": "nixos-images",
+        "rev": "6ece16b0c97986fe085122e796044add4cc3ff64",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-images",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1712920918,
@@ -552,11 +707,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1781359544,
+        "lastModified": 1788775869,
-        "narHash": "sha256-iUuzKQcyXvopYDDzFpMK5eQKP3WIJExYny2kJtbgUcE=",
+        "narHash": "sha256-JRf1lSypbvKj6AzUZHpUA6YC1DirVuitZWOnRwcm+Ww=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9f11f828c213641c2369a9f1fa31fe31557e3156",
+        "rev": "58973d74f1893afe13f5902919803a0e99da0ca4",
         "type": "github"
       },
       "original": {
@@ -597,16 +752,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1708640854,
+        "lastModified": 1787579760,
-        "narHash": "sha256-EpcAmvIS4ErqhXtVEfd2GPpU/E/s8CCRSfYzk6FZ/fY=",
+        "narHash": "sha256-WGhIEINOICx7bhV3WrSz0QTzv8uzaaa9AXvD1clIWpc=",
         "owner": "paisano-nix",
         "repo": "core",
-        "rev": "adcf742bc9463c08764ca9e6955bd5e7dcf3a3fe",
+        "rev": "88739c84d308876714322eb9844ede6597c1a580",
         "type": "github"
       },
       "original": {
         "owner": "paisano-nix",
-        "ref": "0.2.0",
         "repo": "core",
         "type": "github"
       }
@@ -653,6 +807,7 @@
     },
     "root": {
       "inputs": {
+        "clan-community": "clan-community",
         "clan-core": "clan-core",
         "devshell": "devshell",
         "flake-parts": "flake-parts",
@@ -660,6 +815,7 @@
         "home-manager": "home-manager",
         "import-tree": "import-tree",
         "liminix": "liminix",
+        "nixos-images": "nixos-images",
         "nixpkgs": "nixpkgs_2",
         "plasma-manager": "plasma-manager",
         "treefmt-nix": "treefmt-nix"
@@ -673,11 +829,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780547341,
+        "lastModified": 1788337237,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
         "type": "github"
       },
       "original": {

flake.nix

@@ -7,6 +7,12 @@
       inputs.treefmt-nix.follows = "treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    clan-community = {
+      url = "git+https://git.clan.lol/clan/clan-community";
+      inputs.clan-core.follows = "clan-core";
+      inputs.flake-parts.follows = "flake-parts";
+      inputs.treefmt-nix.follows = "treefmt-nix";
+    };
     devshell = {
       url = "github:numtide/devshell";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -39,6 +45,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.devshell.follows = "devshell";
     };
+
+    nixos-images = {
+      url = "github:nix-community/nixos-images";
+      inputs.nixos-unstable.follows = "nixpkgs";
+      inputs.nixos-stable.follows = "nixpkgs";
+    };
   };
   outputs =
     {
@@ -77,6 +89,20 @@
             packages.think = pkgs.think-gtcm;
             packages.think-be = pkgs.think-backend-gtcm;
             packages.file-uploader = pkgs.gtcm-file-uploader;
+            packages.installer =
+              (pkgs.nixos [
+                inputs.nixos-images.nixosModules.image-installer
+                {
+                  users.users.root.openssh.authorizedKeys.keys = [
+                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
+                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
+                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
+                    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo="
+                    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo="
+                    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo="
+                  ];
+                }
+              ]).config.system.build.isoImage;
           };
       }
     );

inventories/default.nix

@@ -19,13 +19,11 @@
         w = [ "sirius" ];
         b4l = [
           "rigel"
-          "neptune"
           "rana"
           "petra"
           "alasia"
         ];
         phonebox = [
-          "neptune"
           "rigel"
           "almach"
           "alpheratz"
@@ -33,33 +31,173 @@
           "adhil"
           "buna"
         ];
-        global-network = [
+
-          "rana"
-          "sirius"
-          "hadar"
-          "procyon"
-          "alasia"
-          "rigel"
-          "vega"
-          "cursa"
-        ];
         prometheus = [
           "cursa"
           "rigel"
           "vega"
+          "buna"
+        ];
+
+        dm-bootstrapper = [
+          "rigel"
+          "cursa"
+          "deneb"
+          "bosona"
+          "canopus"
+        ];
+
+        dm-pull-deploy = [
+          "rana"
+          "rigel"
+          "vega"
         ];
       };
 
       instances = {
 
+        borgbackup = {
+          module = {
+            name = "borgbackup";
+            input = "clan-core";
+          };
+          roles.client.machines."cursa".settings.destinations = {
+            alex = {
+              repo = "ssh://borg@10.0.10.225:2222/backup/cursa/backup";
+              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+            };
+          };
+          roles.client.machines."hadar".settings.destinations = {
+            alex = {
+              repo = "ssh://borg@10.0.10.225:2222/backup/hadar/backup";
+              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+            };
+          };
+          roles.client.machines."procyon".settings.destinations = {
+            alex = {
+              repo = "ssh://borg@10.0.10.225:2222/backup/procyon/backup";
+              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+            };
+          };
+          roles.client.machines."bosona".settings.destinations = {
+            alex = {
+              repo = "ssh://borg@10.0.10.225:2222/backup/bosona/backup";
+              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+            };
+          };
+          roles.client.machines."canopus".settings.destinations = {
+            alex = {
+              repo = "ssh://borg@10.0.10.225:2222/backup/canopus/backup";
+              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+            };
+          };
+          roles.client.machines."deneb".settings.destinations = {
+            alex = {
+              repo = "ssh://borg@10.0.10.225:2222/backup/deneb/backup";
+              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+            };
+          };
+          roles.client.machines."alasia".settings.destinations = {
+            alex = {
+              repo = "ssh://borg@10.0.10.225:2222/backup/alasia/backup";
+              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+            };
+          };
+        };
+
+        data-mesher = {
+          module = {
+            name = "data-mesher";
+            input = "clan-core";
+          };
+          roles.bootstrap.tags = [ "dm-bootstrapper" ];
+          roles.default.tags = [ "all" ];
+          roles.default.settings.interfaces = [ "ygg" ];
+        };
+
+        auto-pull-update = {
+          module = {
+            name = "dm-pull-deploy";
+            input = "clan-community";
+          };
+          roles.push.machines."rigel".settings = {
+            gitUrl = "https://git.b4l.co.th/newedge/infra.git";
+            branch = "main";
+          };
+          roles.push.extraModules = [
+            (
+              { pkgs, config, ... }:
+              {
+                # work around until upstream is fixed
+                environment.systemPackages = [
+                  (pkgs.writeShellApplication {
+                    name = "custom-dm-send-deploy";
+                    runtimeInputs = [
+                      config.services.data-mesher.package
+                      pkgs.git
+                      pkgs.nix
+                      pkgs.jq
+                    ];
+                    text =
+                      let
+                        settings.gitUrl = "https://git.b4l.co.th/newedge/infra.git";
+                        settings.branch = "main";
+                      in
+                      ''
+                        if [ $# -gt 1 ]; then
+                          echo "Usage: dm-send-deploy [<flake-ref>]"
+                          echo "Without arguments, sends the latest commit on '${settings.branch}' from ${settings.gitUrl}"
+                          echo "Example: dm-send-deploy git+https://example.com/repo.git?rev=abc123..."
+                          exit 1
+                        fi
+
+                        KEY="${config.clan.core.vars.generators.dm-pull-deploy-signing-key.files."signing.key".path}"
+                        if [ ! -r "$KEY" ]; then
+                          echo "Error: cannot read signing key at $KEY (are you root?)"
+                          exit 1
+                        fi
+
+                        if [ $# -eq 1 ]; then
+                          FLAKE_REF="$1"
+                        else
+                          REV=$(git ls-remote "${settings.gitUrl}" "refs/heads/${settings.branch}" | cut -f1)
+                          if [ -z "$REV" ]; then
+                            echo "Error: could not determine latest commit on ${settings.branch} from ${settings.gitUrl}"
+                            exit 1
+                          fi
+                          FLAKE_REF="git+${settings.gitUrl}?rev=$REV"
+                        fi
+
+                        TMPFILE=$(mktemp)
+                        trap 'rm -f "$TMPFILE"' EXIT
+
+                        printf '%s' "$FLAKE_REF" > "$TMPFILE"
+
+                        NETWORK_ID="${config.clan.core.vars.generators.data-mesher-network.files."network.pub".path}"
+
+                        data-mesher file update "$TMPFILE" \
+                          --url http://localhost:7331 \
+                          --network-id "$NETWORK_ID" \
+                          --key "$KEY" \
+                          --name "dm_pull_deploy/target"
+
+                        echo "Deployment target pushed: $FLAKE_REF"
+                      '';
+                  })
+                ];
+              }
+            )
+          ];
+          roles.default.tags = [ "dm-pull-deploy" ];
+          roles.default.settings.action = "switch";
+        };
+
         sshd = {
           roles.server.tags."all" = { };
           roles.server.settings = {
             authorizedKeys = {
               "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
               "davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
-              "vi" =
-                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387";
               "kurogeek" =
                 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
               "matthewcroughan" =
@@ -149,12 +287,24 @@
           roles.peer.tags."poy" = { };
         };
 
+        internet = {
+          module.name = "internet";
+          roles.default.machines = {
+            ramus.settings.host = "5.223.63.55";
+            tangra.settings.host = "5.223.65.50";
+          };
+        };
+
         yggdrasil-global-network = {
           module = {
             name = "yggdrasil";
             input = "clan-core";
           };
-          roles.default.tags."global-network" = { };
+          roles.default.tags."all" = { };
+          roles.default.settings.extraYggdrasilIPs = [
+            # kurogeek's laptop
+            "200:c8db:ea9b:5bdc:44ed:ad87:462a:6bd0"
+          ];
           roles.default.settings.extraPeers = [
             "tls://ygg.jjolly.dev:3443"
             "tls://[2602:fc24:18:7a42::1]:993"
@@ -170,31 +320,31 @@
           };
           roles.server.machines."alasia".settings = {
             public_url = "tailvpn.public.newedge.house";
-            base_domain = "tailnet.newedge.house";
             advertise_routes = [ "10.0.10.0/24" ];
-            nameservers = [
+            dns = {
-              "10.0.10.82"
+              magic_dns = true;
-              "1.1.1.1"
+              base_domain = "tailvpn.newedge.house";
-              "8.8.8.8"
+              nameservers = [
-            ];
+                "10.0.10.82"
+                "1.1.1.1"
+                "8.8.8.8"
+              ];
+              extra_records = [
+                {
+                  name = "poyerp.newedge.house";
+                  type = "A";
+                  value = "10.0.10.1";
+                }
+                {
+                  name = "glomerp.newedge.house";
+                  type = "A";
+                  value = "10.0.10.1";
+                }
+              ];
+            };
           };
         };
 
-        yggdrasil-phone-network = {
-          module = {
-            name = "yggdrasil";
-            input = "clan-core";
-          };
-          roles.default.tags."phonebox" = { };
-          roles.default.settings.extraYggdrasilIPs = [ "200:c806:c13b:b855:723f:473:55:7904" ];
-          roles.default.settings.extraPeers = [
-            "tls://ygg.jjolly.dev:3443"
-            "tls://[2602:fc24:18:7a42::1]:993"
-            "tcp://leo.node.3dt.net:9002"
-            "tcp://ygg-kcmo.incognet.io:8883"
-          ];
-        };
-
         phonebox = {
           module = {
             name = "phonebox";
@@ -204,6 +354,13 @@
           roles.default.machines."adhil".settings = {
             ata-ethernet-iface = "end0";
           };
+          roles.default.machines."rigel".settings = {
+            extraClientNumbers = [
+              "01"
+              "02"
+            ];
+            extraFixedIPClient = { };
+          };
         };
 
         pulse-stream = {
@@ -354,8 +511,48 @@
               exporters.smartctl = { };
               exporters.zfs = { };
             };
+            buna.settings = {
+              exporters.smartctl = { };
+            };
+            mirach.settings = {
+              exporters.smartctl = { };
+            };
+            almach.settings = {
+              exporters.smartctl = { };
+            };
           };
         };
+
+        wifi =
+          let
+            networks = {
+              home = { };
+              glom = { };
+            };
+          in
+          {
+            module.name = "wifi";
+            module.input = "clan-community";
+
+            roles.default = {
+              machines."buna".settings = { inherit networks; };
+
+              extraModules = [
+                (
+                  { lib, ... }:
+                  {
+                    # profile names match the network attr names above;
+                    # 0 = retry forever for both (defaults: 4 autoconnect attempts, 3 auth attempts)
+                    networking.networkmanager.ensureProfiles.profiles = lib.mapAttrs (_: _: {
+                      connection.autoconnect-retries = 0;
+                      connection.auth-retries = 0;
+                    }) networks;
+                  }
+                )
+              ];
+            };
+          };
+
       };
     };
   };

inventory.json

@@ -19,7 +19,7 @@
       "installedAt": 1765277591
     },
     "buna": {
-      "installedAt": 1765343708
+      "installedAt": 1787123510
     },
     "rana": {
       "installedAt": 1773134236

machines/cursa/facter.json

@@ -25,10 +25,7 @@
       {
         "index": 8,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["pci", "bridge"],
-          "pci",
-          "bridge"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -76,10 +73,7 @@
       {
         "index": 9,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["pci", "bridge"],
-          "pci",
-          "bridge"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -131,10 +125,7 @@
       {
         "index": 10,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["pci", "bridge"],
-          "pci",
-          "bridge"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -182,10 +173,7 @@
       {
         "index": 11,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["pci", "bridge"],
-          "pci",
-          "bridge"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -241,10 +229,7 @@
       {
         "index": 12,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["pci", "bridge"],
-          "pci",
-          "bridge"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -297,21 +282,14 @@
         },
         "driver": "piix4_smbus",
         "driver_module": "i2c_piix4",
-        "drivers": [
+        "drivers": ["piix4_smbus"],
-          "piix4_smbus"
+        "driver_modules": ["i2c_piix4"],
-        ],
-        "driver_modules": [
-          "i2c_piix4"
-        ],
         "module_alias": "pci:v00008086d00007113sv00001AF4sd00001100bc06sc80i00"
       },
       {
         "index": 17,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["pci", "bridge"],
-          "pci",
-          "bridge"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -361,11 +339,7 @@
       {
         "index": 22,
         "attached_to": 15,
-        "class_list": [
+        "class_list": ["cdrom", "scsi", "block_device"],
-          "cdrom",
-          "scsi",
-          "block_device"
-        ],
         "bus_type": {
           "hex": "0084",
           "name": "SCSI",
@@ -422,14 +396,8 @@
         "unix_device_name2": "/dev/sg1",
         "driver": "ata_piix",
         "driver_module": "ata_piix",
-        "drivers": [
+        "drivers": ["ata_piix", "sr"],
-          "ata_piix",
+        "driver_modules": ["ata_piix", "sr_mod"]
-          "sr"
-        ],
-        "driver_modules": [
-          "ata_piix",
-          "sr_mod"
-        ]
       }
     ],
     "cpu": [
@@ -496,9 +464,7 @@
           "spectre_v2_user",
           "its"
         ],
-        "power_management": [
+        "power_management": [""],
-          ""
-        ],
         "bogo": 4224,
         "cache": 16384,
         "page_size": 4096,
@@ -580,9 +546,7 @@
           "spectre_v2_user",
           "its"
         ],
-        "power_management": [
+        "power_management": [""],
-          ""
-        ],
         "bogo": 4224,
         "cache": 16384,
         "page_size": 4096,
@@ -606,11 +570,7 @@
       {
         "index": 23,
         "attached_to": 19,
-        "class_list": [
+        "class_list": ["disk", "scsi", "block_device"],
-          "disk",
-          "scsi",
-          "block_device"
-        ],
         "bus_type": {
           "hex": "0084",
           "name": "SCSI",
@@ -674,24 +634,15 @@
         ],
         "driver": "virtio_scsi",
         "driver_module": "virtio_scsi",
-        "drivers": [
+        "drivers": ["sd", "virtio_scsi"],
-          "sd",
+        "driver_modules": ["sd_mod", "virtio_scsi"]
-          "virtio_scsi"
-        ],
-        "driver_modules": [
-          "sd_mod",
-          "virtio_scsi"
-        ]
       }
     ],
     "graphics_card": [
       {
         "index": 16,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["graphics_card", "pci"],
-          "graphics_card",
-          "pci"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -748,12 +699,8 @@
         },
         "driver": "bochs-drm",
         "driver_module": "bochs",
-        "drivers": [
+        "drivers": ["bochs-drm"],
-          "bochs-drm"
+        "driver_modules": ["bochs"],
-        ],
-        "driver_modules": [
-          "bochs"
-        ],
         "module_alias": "pci:v00001234d00001111sv00001AF4sd00001100bc03sc00i00"
       }
     ],
@@ -761,10 +708,7 @@
       {
         "index": 24,
         "attached_to": 7,
-        "class_list": [
+        "class_list": ["usb", "hub"],
-          "usb",
-          "hub"
-        ],
         "bus_type": {
           "hex": "0086",
           "name": "USB",
@@ -837,12 +781,8 @@
         "hotplug": "usb",
         "driver": "hub",
         "driver_module": "usbcore",
-        "drivers": [
+        "drivers": ["hub"],
-          "hub"
+        "driver_modules": ["usbcore"],
-        ],
-        "driver_modules": [
-          "usbcore"
-        ],
         "module_alias": "usb:v1D6Bp0001d0618dc09dsc00dp00ic09isc00ip00in00"
       }
     ],
@@ -850,9 +790,7 @@
       {
         "index": 5,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["memory"],
-          "memory"
-        ],
         "base_class": {
           "hex": "0101",
           "name": "Internally Used Class",
@@ -876,9 +814,7 @@
       {
         "index": 21,
         "attached_to": 16,
-        "class_list": [
+        "class_list": ["monitor"],
-          "monitor"
-        ],
         "base_class": {
           "hex": "0100",
           "name": "Monitor",
@@ -1024,10 +960,7 @@
       {
         "index": 25,
         "attached_to": 24,
-        "class_list": [
+        "class_list": ["mouse", "usb"],
-          "mouse",
-          "usb"
-        ],
         "bus_type": {
           "hex": "0086",
           "name": "USB",
@@ -1063,9 +996,7 @@
         "model": "QEMU USB Tablet",
         "sysfs_id": "/devices/pci0000:00/0000:00:01.2/usb1/1-1/1-1:1.0",
         "sysfs_bus_id": "1-1:1.0",
-        "unix_device_names": [
+        "unix_device_names": ["/dev/input/mice"],
-          "/dev/input/mice"
-        ],
         "unix_device_name2": "/dev/input/mouse0",
         "resources": [
           {
@@ -1106,18 +1037,11 @@
         "hotplug": "usb",
         "driver": "usbhid",
         "driver_module": "usbhid",
-        "drivers": [
+        "drivers": ["usbhid"],
-          "usbhid"
+        "driver_modules": ["usbhid"],
-        ],
-        "driver_modules": [
-          "usbhid"
-        ],
         "driver_info": {
           "type": "mouse",
-          "db_entry_0": [
+          "db_entry_0": ["explorerps/2", "exps2"],
-            "explorerps/2",
-            "exps2"
-          ],
           "xf86": "explorerps/2",
           "gpm": "exps2",
           "buttons": -1,
@@ -1130,9 +1054,7 @@
       {
         "index": 18,
         "attached_to": 13,
-        "class_list": [
+        "class_list": ["network_controller"],
-          "network_controller"
-        ],
         "bus_type": {
           "hex": "008f",
           "name": "Virtio",
@@ -1157,9 +1079,7 @@
         "model": "Virtio Ethernet Card 0",
         "sysfs_id": "/devices/pci0000:00/0000:00:12.0/virtio1",
         "sysfs_bus_id": "virtio1",
-        "unix_device_names": [
+        "unix_device_names": ["ens18"],
-          "ens18"
-        ],
         "resources": [
           {
             "type": "hwaddr",
@@ -1172,12 +1092,8 @@
         ],
         "driver": "virtio_net",
         "driver_module": "virtio_net",
-        "drivers": [
+        "drivers": ["virtio_net"],
-          "virtio_net"
+        "driver_modules": ["virtio_net"],
-        ],
-        "driver_modules": [
-          "virtio_net"
-        ],
         "module_alias": "virtio:d00000001v00001AF4"
       }
     ],
@@ -1185,9 +1101,7 @@
       {
         "index": 26,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["network_interface"],
-          "network_interface"
-        ],
         "base_class": {
           "hex": "0107",
           "name": "Network Interface",
@@ -1200,16 +1114,12 @@
         },
         "model": "Loopback network interface",
         "sysfs_id": "/class/net/lo",
-        "unix_device_names": [
+        "unix_device_names": ["lo"]
-          "lo"
-        ]
       },
       {
         "index": 27,
         "attached_to": 18,
-        "class_list": [
+        "class_list": ["network_interface"],
-          "network_interface"
-        ],
         "base_class": {
           "hex": "0107",
           "name": "Network Interface",
@@ -1223,9 +1133,7 @@
         "model": "Ethernet network interface",
         "sysfs_id": "/class/net/ens18",
         "sysfs_device_link": "/devices/pci0000:00/0000:00:12.0/virtio1",
-        "unix_device_names": [
+        "unix_device_names": ["ens18"],
-          "ens18"
-        ],
         "resources": [
           {
             "type": "hwaddr",
@@ -1238,22 +1146,15 @@
         ],
         "driver": "virtio_net",
         "driver_module": "virtio_net",
-        "drivers": [
+        "drivers": ["virtio_net"],
-          "virtio_net"
+        "driver_modules": ["virtio_net"]
-        ],
-        "driver_modules": [
-          "virtio_net"
-        ]
       }
     ],
     "pci": [
       {
         "index": 13,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["pci", "unknown"],
-          "pci",
-          "unknown"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1310,21 +1211,14 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": [
+        "drivers": ["virtio-pci"],
-          "virtio-pci"
+        "driver_modules": ["virtio_pci"],
-        ],
-        "driver_modules": [
-          "virtio_pci"
-        ],
         "module_alias": "pci:v00001AF4d00001000sv00001AF4sd00000001bc02sc00i00"
       },
       {
         "index": 14,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["pci", "unknown"],
-          "pci",
-          "unknown"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1380,12 +1274,8 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": [
+        "drivers": ["virtio-pci"],
-          "virtio-pci"
+        "driver_modules": ["virtio_pci"],
-        ],
-        "driver_modules": [
-          "virtio_pci"
-        ],
         "module_alias": "pci:v00001AF4d00001002sv00001AF4sd00000005bc00scFFi00"
       }
     ],
@@ -1393,10 +1283,7 @@
       {
         "index": 6,
         "attached_to": 17,
-        "class_list": [
+        "class_list": ["storage_controller", "pci"],
-          "storage_controller",
-          "pci"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1453,21 +1340,14 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": [
+        "drivers": ["virtio-pci"],
-          "virtio-pci"
+        "driver_modules": ["virtio_pci"],
-        ],
-        "driver_modules": [
-          "virtio_pci"
-        ],
         "module_alias": "pci:v00001AF4d00001004sv00001AF4sd00000008bc01sc00i00"
       },
       {
         "index": 15,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["storage_controller", "pci"],
-          "storage_controller",
-          "pci"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1557,12 +1437,8 @@
         },
         "driver": "ata_piix",
         "driver_module": "ata_piix",
-        "drivers": [
+        "drivers": ["ata_piix"],
-          "ata_piix"
+        "driver_modules": ["ata_piix"],
-        ],
-        "driver_modules": [
-          "ata_piix"
-        ],
         "module_alias": "pci:v00008086d00007010sv00001AF4sd00001100bc01sc01i80"
       }
     ],
@@ -1573,9 +1449,7 @@
       {
         "index": 19,
         "attached_to": 6,
-        "class_list": [
+        "class_list": ["unknown"],
-          "unknown"
-        ],
         "base_class": {
           "hex": "0000",
           "name": "Unclassified device",
@@ -1593,20 +1467,14 @@
         "sysfs_bus_id": "virtio2",
         "driver": "virtio_scsi",
         "driver_module": "virtio_scsi",
-        "drivers": [
+        "drivers": ["virtio_scsi"],
-          "virtio_scsi"
+        "driver_modules": ["virtio_scsi"],
-        ],
-        "driver_modules": [
-          "virtio_scsi"
-        ],
         "module_alias": "virtio:d00000008v00001AF4"
       },
       {
         "index": 20,
         "attached_to": 14,
-        "class_list": [
+        "class_list": ["unknown"],
-          "unknown"
-        ],
         "base_class": {
           "hex": "0000",
           "name": "Unclassified device",
@@ -1624,12 +1492,8 @@
         "sysfs_bus_id": "virtio0",
         "driver": "virtio_balloon",
         "driver_module": "virtio_balloon",
-        "drivers": [
+        "drivers": ["virtio_balloon"],
-          "virtio_balloon"
+        "driver_modules": ["virtio_balloon"],
-        ],
-        "driver_modules": [
-          "virtio_balloon"
-        ],
         "module_alias": "virtio:d00000005v00001AF4"
       }
     ],
@@ -1637,10 +1501,7 @@
       {
         "index": 7,
         "attached_to": 0,
-        "class_list": [
+        "class_list": ["usb_controller", "pci"],
-          "usb_controller",
-          "pci"
-        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1707,25 +1568,15 @@
         },
         "driver": "uhci_hcd",
         "driver_module": "uhci_hcd",
-        "drivers": [
+        "drivers": ["uhci_hcd"],
-          "uhci_hcd"
+        "driver_modules": ["uhci_hcd"],
-        ],
-        "driver_modules": [
-          "uhci_hcd"
-        ],
         "driver_info": {
           "type": "module",
-          "db_entry_0": [
+          "db_entry_0": ["uhci-hcd"],
-            "uhci-hcd"
-          ],
           "active": true,
           "modprobe": true,
-          "names": [
+          "names": ["uhci-hcd"],
-            "uhci-hcd"
+          "module_args": [""],
-          ],
-          "module_args": [
-            ""
-          ],
           "conf": ""
         },
         "module_alias": "pci:v00008086d00007020sv00001AF4sd00001100bc0Csc03i00"
@@ -1831,9 +1682,7 @@
           "name": "RAM",
           "value": 7
         },
-        "memory_type_details": [
+        "memory_type_details": ["Other"],
-          "Other"
-        ],
         "speed": 0
       }
     ],

machines/default.nix

@@ -9,7 +9,15 @@
   ];
   clan = {
     meta.name = "NewEdgeClan";
-    machines = { };
+    machines = {
+      cursa = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
+      hadar = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
+      procyon = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
+      bosona = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
+      canopus = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
+      deneb = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
+      alasia = { ... }: { clan.core.state."vars".folders = [ "/var/lib" ]; };
+    };
     secrets.age.plugins = [
       "age-plugin-yubikey"
       "age-plugin-fido2-hmac"

machines/deneb/configuration.nix

@@ -25,8 +25,11 @@ in
     inputs.self.overlays.frappixLibsOverlay
     inputs.self.overlays.frappixPythonOverlay
     inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.frappixAppsOverlay
   ];
 
+  fonts.packages = [ pkgs.tlwg ];
+
   clan.core.vars.generators.frappix = {
     files = {
       sslCertificate.secret = false;
@@ -57,6 +60,7 @@ in
       pkgs.frappix.hrms
       pkgs.frappix.crm
       pkgs.frappix.posprinter
+      pkgs.frappix.default_thai_company
     ];
     sites = {
       "${sitename}" = {
@@ -67,6 +71,7 @@ in
           "hrms"
           "crm"
           "posprinter"
+          "default_thai_company"
         ];
       };
     };

machines/sirius/configuration.nix

@@ -5,8 +5,6 @@
 }:
 {
   imports = [
-    self.nixosModules.common
-
     ./hardware-configuration.nix
   ];
 
@@ -23,15 +21,12 @@
   nixpkgs.hostPlatform = {
     system = "aarch64-linux";
   };
+  nixpkgs.buildPlatform = {
+    system = "x86_64-linux";
+  };
 
   system.stateVersion = "25.11";
 
-  services.journald.extraConfig = ''
-    Storage=volatile
-    RuntimeMaxUse=30M
-    RuntimeMaxFileSize=10M
-  '';
-
   services.udisks2.enable = false;
 
   nix.settings.log-lines = 25;
@@ -54,6 +49,25 @@
     "sd_mod"
   ];
 
+  boot = {
+    consoleLogLevel = 0;
+    kernel.sysctl = {
+      "fs.suid_dumpable" = 0;
+      "kernel.core_pattern" = "/dev/null";
+    };
+    tmp = {
+      useTmpfs = true;
+    };
+  };
+
+  services.journald.extraConfig = ''
+    Storage=none
+  '';
+
+  systemd = {
+    coredump.enable = false;
+  };
+
   fileSystems."/mnt/hdd" = {
     device = "zdata/nas";
     fsType = "zfs";

modules/clan/apple-network/README.md

@@ -0,0 +1,3 @@
+# Apple Network
+
+This service allows atalkd instances to connect to each other over vxlan over Yggdrasil. We need to use vxlan due to the support of broadcasting it provides. The service will form a network of star-topology vxlan using the underlying Yggdrasil network. With this vxlan network, we can have a private Apple Talk network over the internet.

modules/clan/apple-network/default.nix

@@ -0,0 +1,139 @@
+{ clanLib, ... }:
+{
+  _class = "clan.service";
+  manifest.name = "apple-network";
+  manifest.description = "This service will create an instance of `atalkd` for each peer to talk to Apple machines over Apple Talk protocol and automatically connect each peer using vxlan over Yggdrasil network to achieve Apple Talk over internet experience";
+  manifest.readme = builtins.readFile ./README.md;
+  manifest.categories = [ "Network" ];
+
+  roles.peer = {
+    description = "A gateway machine that allow classic Apple machines to connect to other Apple machines over the internet";
+
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          zone_name = lib.mkOption {
+            type = with lib.types; str;
+            description = "Zone name for Apple Talk protocol";
+            default = "Default";
+          };
+        };
+      };
+
+    perInstance =
+      { roles, settings, ... }:
+      {
+        nixosModule =
+          {
+            lib,
+            config,
+            pkgs,
+            ...
+          }:
+          let
+            vxlanPort = 4789;
+
+            getYggdrasilIP =
+              machineName:
+              if config.clan.core.vars.generators.yggdrasil.files.address ? value then
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "yggdrasil";
+                  file = "address";
+                  default = null;
+                }
+              else
+                throw "clanService/yggdrasil is required";
+
+            noSelfPeers = builtins.filter (peerName: peerName != config.clan.core.settings.machine.name) (
+              lib.mapAttrsToList (machineName: _: machineName) roles.peer.machines
+            );
+
+            sortedPeers = builtins.sort (x: y: x < y) (
+              lib.mapAttrsToList (machineName: _: machineName) roles.peer.machines
+            );
+
+            getMachineIndex = machineName: lib.lists.findFirstIndex (x: x == machineName) null sortedPeers;
+
+            selfVXAddress = "192.168.254.${
+              lib.toString ((getMachineIndex config.clan.core.settings.machine.name) + 1)
+            }/24";
+          in
+          {
+
+            services.atalkd = {
+              enable = true;
+              interfaces = {
+                vxlan.config = ''
+                  -router -phase 2 -net 1 -zone "${settings.zone_name}"
+                '';
+              };
+            };
+
+            networking.useNetworkd = true;
+
+            networking.firewall.interfaces."ygg".allowedUDPPorts = [ vxlanPort ];
+
+            boot.kernelModules = [ "vxlan" ];
+
+            systemd.network.netdevs =
+              builtins.listToAttrs (
+                map (
+                  peerName:
+                  (lib.nameValuePair "10-apl-vxlan-${peerName}" {
+                    enable = true;
+                    netdevConfig = {
+                      Name = "vxlan-${peerName}";
+                      Kind = "vxlan";
+                    };
+                    vxlanConfig = {
+                      VNI = (getMachineIndex config.clan.core.settings.machine.name) + (getMachineIndex peerName);
+                      Remote = getYggdrasilIP peerName;
+                      DestinationPort = vxlanPort;
+                      Independent = true;
+                    };
+                  })
+                ) noSelfPeers
+              )
+              // {
+                "10-apl-vxlan" = {
+                  enable = true;
+                  netdevConfig = {
+                    Kind = "bridge";
+                    Name = "vxlan";
+                  };
+                  bridgeConfig = {
+                    STP = true;
+                  };
+                };
+              };
+
+            systemd.network.networks =
+              builtins.listToAttrs (
+                map (
+                  peerName:
+                  (lib.nameValuePair "10-apl-vxlan-${peerName}" {
+                    enable = true;
+                    matchConfig.Name = "vxlan-${peerName}";
+                    networkConfig.Bridge = "vxlan";
+                  })
+                ) noSelfPeers
+              )
+              // {
+                "10-apl-vxlan" = {
+                  enable = true;
+                  matchConfig.Name = "vxlan";
+                  address = [ selfVXAddress ];
+                };
+              };
+
+            environment.systemPackages = [
+              pkgs.netatalk
+              pkgs.bridge-utils
+            ];
+          };
+      };
+  };
+}

modules/clan/apple-network/flake-module.nix

@@ -0,0 +1,19 @@
+{ inputs, self, ... }:
+let
+  module = ./default.nix;
+in
+{
+  clan.modules = {
+    apple-network = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.service-apple-network = {
+        imports = [ ./tests/vm/default.nix ];
+        _module.args = { inherit self inputs; };
+
+        clan.modules."@clan/apple-network" = module;
+      };
+    };
+}

modules/clan/apple-network/tests/vm/default.nix

@@ -0,0 +1,76 @@
+{
+  self,
+  lib,
+  config,
+  hostPkgs,
+  ...
+}:
+{
+  name = "service-apple-network";
+
+  result.update-vars =
+    let
+      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
+    in
+    hostPkgs.writeShellScriptBin "update-vars" ''
+      set -x
+      export PRJ_ROOT=$(git rev-parse --show-toplevel)
+      ${
+        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
+      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
+    '';
+
+  clan = {
+    directory = ./.;
+    test.useContainers = false;
+
+    inventory = {
+      meta.domain = "test.clan";
+
+      machines.peer1 = { };
+      machines.peer2 = { };
+      machines.peer3 = { };
+
+      instances = {
+        apple-network = {
+          module.name = "@clan/apple-network";
+          module.input = "self";
+          roles.peer.machines = {
+            peer1 = { };
+            peer2 = { };
+            peer3 = { };
+          };
+        };
+        yggdrasil = {
+          module.name = "yggdrasil";
+          roles.default.tags.all = { };
+          roles.default.settings.extraPeers = [
+            "tls://ygg.jjolly.dev:3443"
+            "tls://[2602:fc24:18:7a42::1]:993"
+            "tcp://leo.node.3dt.net:9002"
+            "tcp://ygg-kcmo.incognet.io:8883"
+          ];
+        };
+      };
+    };
+  };
+
+  nodes = {
+    peer1 = { };
+    peer2 = { };
+    peer3 = { };
+  };
+
+  testScript = _: ''
+    # cannot test connectivity due to Yggdrasil's establishment
+    start_all()
+    peer1.wait_for_unit("atalkd")
+    peer1.succeed("systemctl status atalkd")
+
+    peer2.wait_for_unit("atalkd")
+    peer2.succeed("systemctl status atalkd")
+
+    peer3.wait_for_unit("atalkd")
+    peer3.succeed("systemctl status atalkd")
+  '';
+}

modules/clan/apple-network/tests/vm/sops/machines/peer1/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1f92zl8y70z5w9gn0l5leg2fhyvxy6m93dfh7n6ltgvuu9nyg6epsrw6t8x",
+    "type": "age"
+  }
+]

modules/clan/apple-network/tests/vm/sops/machines/peer2/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1u36fr87cru90vfznf5szasya9nhvvseh4atk8zsdj0rrsu0nnvwqsyt8g6",
+    "type": "age"
+  }
+]

modules/clan/apple-network/tests/vm/sops/machines/peer3/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1rka3368ltqc787xw99uu762lqfk7qxld9265u2t62fpxnp9xhufsc2q5rw",
+    "type": "age"
+  }
+]

modules/clan/apple-network/tests/vm/sops/secrets/peer1-age.key/secret

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:hC4Lle6mXuTFq//wBHUTyH3X778u/gYJSXJOiQ7xUb+gnC8beH1olxL2ZhtUiMkktzhsPM/j6cxhltPp25UTeJnUOcoYesqZcp8=,iv:WOx2P2Cu4v58xM9ePjAw1gdA0fFnGG2UqEXH2iksGoo=,tag:43n1ibVSy2AeS9f5qQBKNQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtT244N1Q3Zk9pRjFFQlUr\ncDExSTBwSWk5UXVyMjhWclQwSFZaYnpTRFY0CnE5YStVdzMrS3BKYzYvc3V3QVFY\nbDVwVytoNERveU1xQllqNUFGV2hYbGMKLS0tIDJSUmkwMUQzL3Y0MU5qZTJ3eFN3\nNGdwamM1UDBPdzhvSWsyZzR6anZ0eFEKKnr1/7rf3fH1i7KUoZdilLDgb44K2qzn\nI9Y+7FbV4gzQUzKWjAQeFN37Z4Qiuy0xJVA0lw8KvM+NCxSZDfh3kw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			}
+		],
+		"lastmodified": "2026-07-03T10:46:56Z",
+		"mac": "ENC[AES256_GCM,data:hmpbOtra6EyNiPg7EsA3F4elHEO87JPUr4VKVppvzUwLX1HSj67WrU6k3rEoJT+k7Hq1lxnAzDEckSG1fUOap11rk8ksp1IAGR0+yqykC/Qj/Nl8wXqP84gr49bJK6xE/DDdCRCcBff2d6IpnehyEr8fGFEZbWGygblec8U8GPo=,iv:+M1C3rL22foowr0VD80jwrNFb5xz4k5JQ/DJm4ThKHk=,tag:wabFAC5NTCVGfIQQzm0yGg==,type:str]",
+		"version": "3.13.1"
+	}
+}

modules/clan/apple-network/tests/vm/sops/secrets/peer1-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/apple-network/tests/vm/sops/secrets/peer2-age.key/secret

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:ndWIEOqP2ybCN7Ak5g+8q3YG5rLQ7OuSv/vCbnMA8AK6Lby2JMGRkRGysqJdyEF7eh4w7PpZ/AtKPtPbUucjeTB5+8g76PPJTBE=,iv:EYy0GGqEBmIc5rSWP7Zleb5eQ0JzTz84HqeJPpCSpxk=,tag:iMgTUb9+wxE9S2kKoOEvsQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQTEF6OXN4K0dHdXhWWmt2\neG5wdkNIc2F0UnFEeHFLQkdTWkFpUWhTa0NBCmw2N2J1T0FJVE9JR3VBRWV0THh5\nVEZlbVZrcXAwK3BsYXFOZUF6c3lRSkUKLS0tIFRCQzNUaGFHdERWNWR4enVWRGpx\nbDEzRU9jWHgxWHovaENjbkFlZERIbkkKvAW31gTJg9izrWuAMeDHS9SWPQYtxRBY\necDCn8QORFrnDdxEusCnGJrAU4kmS3Y3CwSHCtEijs3JdIgg9wl/MA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			}
+		],
+		"lastmodified": "2026-07-03T10:47:04Z",
+		"mac": "ENC[AES256_GCM,data:y1U2vsdqR97fPAnp6iZiLY1KbWYmgDqgZ5bwIkWPCr7Gjjrn+qV+sc2T1BTVz3Zo0JOz4ScCc+f6snVsFKdCDU/NmDVFt/sqyH4NHUPRQ3StsQim8C7IkSwUtm3EhrqpLYFD21MEjrYYdHMHbWybxrOI0qI6mDwZymHJFeCLdQA=,iv:lVvPn69eQE/huwDmwePepfpi2l9ZOPQO7W20o4AJBFQ=,tag:7VPfjKZsBVJTZxNwTcI6sg==,type:str]",
+		"version": "3.13.1"
+	}
+}

modules/clan/apple-network/tests/vm/sops/secrets/peer2-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/apple-network/tests/vm/sops/secrets/peer3-age.key/secret

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:JPdetkhtF9eSmgEfCO2exXlGQ5KWLeIM3mnW5BfyTY8r0PxWSEGAwBskC1SiDdRERWB2VEbPiPgCNXMnGaYlDqSdZN6R9wSFvsQ=,iv:qGveNhUtgxvKnmdsPoPpffKyi5srlq0Pd6aW283B5C0=,tag:TcJsCrBlzfjXvztcRaxYFQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvdjNHa1RlcFJHazB5TXFu\nOUQ4REpCZm5Yc3ZhcVhwT1FqRHlvbnoxZWlFCnNrVUEyK2ZYSmlacmJ2b2QrclZl\nSDV1eWxXVmJxZlhMMXgrTWtjcjVhQlkKLS0tIHZPN3pCUVBLQmpRVGx6SDBQNDZo\nSitheGhXNGl5QW9HTGNsTTdTdWVwaE0KfuM5xZOPbR1lxkJPJUOVrtlW5Ujobemp\nid40reDqxKQxP3khJv8lf9ZoN8LAx2Iwh0DeAl+UJpsoVWgS7uI2qQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			}
+		],
+		"lastmodified": "2026-07-07T04:54:10Z",
+		"mac": "ENC[AES256_GCM,data:Tt8yqzfAnSDe2n7KDt1Z/D73hkS1w7DsqIh+s5WljLzar9PEt5vUCLb8DIvBwITyzGAoHH1ym3v3NrnJWCdxajKExTMBf4aY3MJCtykeCG37701S/KxumjTW9/fJw74gcET5I6NafTWb6H5XHsrRaQX1Xnspcs8B7uLGZZ28dSM=,iv:Fo5UPVhnjuOx6Cp4grofHOiD2pm0TXuRRuoTwvxKn1s=,tag:VQ/TF1TiyJADj7/3RwPCAg==,type:str]",
+		"version": "3.13.1"
+	}
+}

modules/clan/apple-network/tests/vm/sops/secrets/peer3-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/apple-network/tests/vm/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}

modules/clan/apple-network/tests/vm/vars/per-machine/peer1/state-version/version/value

@@ -0,0 +1 @@
+26.11

modules/clan/apple-network/tests/vm/vars/per-machine/peer1/yggdrasil/address/value

@@ -0,0 +1 @@
+200:e6cc:c86:f02d:b0d5:fba9:9b2c:eb77

modules/clan/apple-network/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/machines/peer1

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer1

modules/clan/apple-network/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:6YDp5S2TzEnhDgGhcz8cA3uBsfDt0Oc4JpztB1JUcg/+tDBbeaQN4MLxuZKstXn2Hb1mYtBLlX0vHw++T181Js2sIznyfC1lr68GOvQAp4NYgf23dXpdZk/CMPNUMiGOYVwKWQ/Z0/p0azJ6xV29dYQcM4Q9hys=,iv:Ijzz8hm0looCWoSpjg/rYKp9jhvzRuLboKWHrlwVeFA=,tag:kJcH/1Pu+9q9f2J68LETug==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYNDNEL3kvdEpEMjYyOFJG\nMk5adU04M3hxa21jTTZNM2dQREpmUlVES1NvCjh6eDNFZ1hzUVlTY3Nidnp3TkYr\nRVl4TFlrNUE3dVIzZzg2VWMwTFBYUXMKLS0tIFE0dVFQQmxwOFJ6YkdaQlh6dUlW\nTi8rdXdQbGR1eXpLcTdOandqQmxka3cKImbmJQo2YMYMSQD8kNTgol3VJ4YGIaoz\nl3AY4u/fobg5qlzVQwV33G0/Wf72Z2aTjSLnP4thnasQ89PdYvs7hA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1f92zl8y70z5w9gn0l5leg2fhyvxy6m93dfh7n6ltgvuu9nyg6epsrw6t8x"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiaWw5SU9KWmJnVVVmTVpr\nL1V6RnRYUGg2UnhXR1BnVTh5eFhnNFpidGdjCmdMeU1nZkZmTTVwbkNaVElFa0Z4\nVkdGdjc4c2lPWGNrVGxocE9iQUZ3QTAKLS0tIHIzTzRRbXVkM3I4ZVRxeSs5eHV5\nTUxOaytzb2MxQ2UybkVCYWVWVmVEcUEKPeK+CC7r3CP5BJqg9thWNHWjPBp/ueHU\nRif6T79kqf+c3B34qXwR0zfyM1+a0r9GAVVC2/q+Ha/As5sPJU39ww==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			}
+		],
+		"lastmodified": "2026-07-03T10:46:56Z",
+		"mac": "ENC[AES256_GCM,data:PffiPU1GR9DojTb7TxzBkpivKV2ybmmq9h4pOOyq7p5BAIPF+JSe+BDtbItQ+Gn5LnitQRUVvhat8E2iYfz3JgNxNKcsNFU/mWtCz3PlqyiuRzUBtEL3zYfhdMi8hYYlVdfMumaK3VMk+b4uDGExR+MpURL97TFku47qRbzbILs=,iv:3//fj7WtIX2QNYB9ub1JKAFIn5vJeuZl6rqaEsX0oQc=,tag:njU+WAVq7xBgE0sna2dMKA==,type:str]",
+		"version": "3.13.1"
+	}
+}

modules/clan/apple-network/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/apple-network/tests/vm/vars/per-machine/peer1/yggdrasil/publicKey/value

@@ -0,0 +1 @@
+8c99f9bc87e92795022b32698a440d6f9fe01d1110f867de8176bb190b92acab

modules/clan/apple-network/tests/vm/vars/per-machine/peer2/state-version/version/value

@@ -0,0 +1 @@
+26.11

modules/clan/apple-network/tests/vm/vars/per-machine/peer2/yggdrasil/address/value

@@ -0,0 +1 @@
+200:eb95:7d1b:3ac3:62e7:24af:2274:3771

modules/clan/apple-network/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/machines/peer2

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer2

modules/clan/apple-network/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:vOwMqT12A5ap5hRvCGTjTUX4sXKO3N7KE8eQ+/SCcBWndU9/b2AehiNgplWWMGcYdmeDL9qI8V2pPkgBkQ/tWH6N8DccSM/zQzrBUkXvRApl6hvNZAWuBVf/P4MW4/EbRGtMg2tEXkaPDtRn2TsDK7ygmXmqArI=,iv:FkxFx/ClAftLu85S6Uq3ZOom+YDOpeWGlYLOFBmFfnk=,tag:zprw62qiu+hmLZEZbnqYXA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0WVB1M2ttd0FocGhTSjNo\nUDFIcmpsL051TndWbkJVakJHbUxjY3Q3NjM0CnkrbFlHS1E4bkZJQTIvMDJ3VDFv\nNW1OdmwvalBEelN2d3YwbHVqTW94OFEKLS0tIGtpOWxCM29xdXhQL2Yzb094OG1n\nT21mc25yU1dJL29vekRHdldzdDR3dEkKoZ1dPRaPg8iVsuec6IhV3cLPchokV2wv\nu6qb92hsLQuyPHDA01Oey0jxmaYMQGtAVjo2zEM+E+zrKY+f2pHIUQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArcmo5d2x6c3J0YTkwMGJE\nanphd2FiUjdGdmdNeW0rL0FpcTVSM3dublZ3CnphajNVV2YrTGl2a3ZqMTJKeU4v\nTzZRS2F5MlA5Ny84cFFoNWZQZnpBZTgKLS0tIHVKQUJWcmlPdy9GNXNBYnpJcEVC\nNmJVMlpvSzZPdk1JY2hIZVEvc3cwV2MKE/cMJU/j5g62njJ49AfnLutmxkpz/gxX\nIqWe1m7Uxl/awVFa7F8N7TUkd0jLbAGXZaonDjiBxOTwg/jr/apnuQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1u36fr87cru90vfznf5szasya9nhvvseh4atk8zsdj0rrsu0nnvwqsyt8g6"
+			}
+		],
+		"lastmodified": "2026-07-03T10:47:04Z",
+		"mac": "ENC[AES256_GCM,data:wiIkwEDwGJZe0u8qLHthPkCXubeIGyHV8yBo8CsSengLVTOtRZ877zTrFvE74ATF1pGE3DFJ5qGRrOGgKJ4VOl043LbEBs0bxZC495pPMPYszimp2UAf/XE3QWlNi9p4Ce/kbvUDd0W3SRt4hIv6HOLWApiRoqfS2qSMUnBQeW0=,iv:Hs7EysUnje/iWZRhJLlqf8wuFJnIMpWfXWHrilfmM5I=,tag:Rgj9x4ZOM2fihKKNQ4ux3g==,type:str]",
+		"version": "3.13.1"
+	}
+}

modules/clan/apple-network/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/apple-network/tests/vm/vars/per-machine/peer2/yggdrasil/publicKey/value

@@ -0,0 +1 @@
+8a354172629e4e8c6da86ec5e447411e4238cf7bb439b798fae56509a82d7472

modules/clan/apple-network/tests/vm/vars/per-machine/peer3/state-version/version/value

@@ -0,0 +1 @@
+26.11

modules/clan/apple-network/tests/vm/vars/per-machine/peer3/yggdrasil/address/value

@@ -0,0 +1 @@
+200:3dcd:9b0d:103c:f953:1e8:e3a2:ed90

modules/clan/apple-network/tests/vm/vars/per-machine/peer3/yggdrasil/privateKey/machines/peer3

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer3

modules/clan/apple-network/tests/vm/vars/per-machine/peer3/yggdrasil/privateKey/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:7no9ZnfatNLEykz+JOUExxmaRzBr7B5PEcevETySJWHTCCjSULdRb2KLxbXP5OKWSuJbR8pJ+p+nZuyr7aOTyXrU+fgwf/Pff4KGaZbKf1t3HJun8wJ2q62uaFYu8ACbNFfwIzJ51SPGcO7IHxfjWn5k9zG7av4=,iv:+VNvFKAJ+HDCGZciug8SKHOcM1JZQUAbZpRT5en4xcU=,tag:3kcDHWIs9ITzTKDiyyYhnQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZ0VFcGhPR0NrMGU4dStU\nZGpnMHZmbUF0R0NFNWQzNGVpZXhYQ24xNXk0CnJIYmJYMnBmeURLZytBcXNRNG5u\nZzk4cXdPdnJIU0JVam1NWFA3TkhuWFkKLS0tIDZYUEVGMUtCQWdSM3k4WEZhdUt3\naElkc3o5SXlFYTJLNUpGZ0ptNm96M2MKYKW5emktK2M+IYX0v/swCV1fgrQXQVlb\nmz11rN5fJWV5wvLcTtyU9imgZLB9MfRMyIYlHzD2HPbW+zr8Fe+bBQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZVDVxY3JrWk1TY3ZsazNz\naVl4Vk1vRUdkRTdlaDU1TE15dC96ZHlxQ1ZBCmYvSmh1QlBNRnJyRy9kcDR0cXhY\neDdPUXZ6b2FkWnBXbzA4bzU1aFo3bEUKLS0tIHMrb05Oa3FrRzh5VHN1RWRmUU9W\ndGZUYTVVQkIzM3FRRHp6NXlEdEU0VTgK7ibTaEcvbVTQjcbgeylu2s5tmI5kAadM\nFGiOgJhDFuzbHxXIEQlsCBIaXe6LlGhBo41VZbMxme5py6nJFTBHKg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1rka3368ltqc787xw99uu762lqfk7qxld9265u2t62fpxnp9xhufsc2q5rw"
+			}
+		],
+		"lastmodified": "2026-07-07T04:54:10Z",
+		"mac": "ENC[AES256_GCM,data:gonhuGY61G3Gdtj7q23aTNYU95fjLMz2uVTsSX+Hw10LGUTEMM8LF/Phae9kr5BZKD8BYaIgH32As2+n0B9jZ4WV77A5hUe2NJze9d0A40P2MtMh9xFWWh7yEXXnx5dy1UDrthL2LBa7ebPspuaC0mFhRHdoJK3J2W1m41PGjZc=,iv:H4yNuE8i3UxVjAUIpnaFX6i8/DaO4uIlHrEY9VaSiRs=,tag:9lJtixSNv7tpox0V3ZoNnA==,type:str]",
+		"version": "3.13.1"
+	}
+}

modules/clan/apple-network/tests/vm/vars/per-machine/peer3/yggdrasil/privateKey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/apple-network/tests/vm/vars/per-machine/peer3/yggdrasil/publicKey/value

@@ -0,0 +1 @@
+e119327977e183567f0b8e2e8937c9d04708e296beed57792a1b6935eacf69d9

modules/clan/headscale/default.nix

@@ -19,12 +19,6 @@
             description = "Public URL for accessing the instance";
           };
 
-          base_domain = lib.mkOption {
-            type = with lib.types; str;
-            default = "";
-            description = "Defines the base domain to create the hostnames for MagicDNS in Headscale. `base_domain` must be a FQDN, without the trailing dot. The FQDN of the hosts will be `hostname.base_domain (e.g. myhost.tailnet.example.com)";
-          };
-
           advertise_routes = lib.mkOption {
             type = with lib.types; listOf str;
             default = [ ];
@@ -32,14 +26,57 @@
             example = [ "192.168.1.0/24" ];
           };
 
-          nameservers = lib.mkOption {
+          dns = {
-            type = with lib.types; listOf str;
+            base_domain = lib.mkOption {
-            default = [
+              type = with lib.types; str;
-              "1.1.1.1"
+              default = "";
-              "8.8.8.8"
+              description = "Defines the base domain to create the hostnames for MagicDNS in Headscale. `base_domain` must be a FQDN, without the trailing dot. The FQDN of the hosts will be `hostname.base_domain (e.g. myhost.tailnet.example.com)";
-            ];
+            };
-            description = "List of nameservers to pass to Tailscale clients";
+
-            example = [ "10.0.10.1" ];
+            nameservers = lib.mkOption {
+              type = with lib.types; listOf str;
+              default = [
+                "1.1.1.1"
+                "8.8.8.8"
+              ];
+              description = "List of nameservers to pass to Tailscale clients";
+              example = [ "10.0.10.1" ];
+            };
+
+            magic_dns = lib.mkOption {
+              type = with lib.types; bool;
+              default = true;
+              description = "Whether to enable MagicDNS";
+            };
+
+            extra_records = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (
+                  listOf (submodule {
+                    options = {
+                      name = lib.mkOption {
+                        type = lib.types.str;
+                        description = "DNS record name.";
+                        example = "grafana.tailnet.example.com";
+                      };
+                      type = lib.mkOption {
+                        type = lib.types.enum [
+                          "A"
+                          "AAAA"
+                        ];
+                        description = "DNS record type.";
+                        example = "A";
+                      };
+                      value = lib.mkOption {
+                        type = lib.types.str;
+                        description = "DNS record value (IP address).";
+                        example = "100.64.0.3";
+                      };
+                    };
+                  })
+                );
+            };
           };
         };
       };
@@ -170,10 +207,11 @@
               settings.server_url = "https://${settings.public_url}";
 
               settings.dns = {
-                base_domain = settings.base_domain;
+                base_domain = settings.dns.base_domain;
                 override_local_dns = true;
-                nameservers.global = settings.nameservers;
+                nameservers.global = settings.dns.nameservers;
-                magic_dns = false;
+                magic_dns = settings.dns.magic_dns;
+                extra_records = settings.dns.extra_records;
               };
             };
 

modules/clan/home-profiles/home-user/emmie.nix

@@ -116,6 +116,11 @@
                   ];
                 };
                 programs.chromium.package = pkgs.brave;
+
+                programs.firefox = {
+                  enable = true;
+                };
+
                 programs.home-manager.enable = true;
                 services.syncthing.tray.enable = osConfig.services.syncthing.enable;
                 programs.plasma.enable = true;

modules/clan/home-profiles/home-user/home.nix

@@ -11,7 +11,7 @@
     homeDirectory = lib.mkForce "/home/${username}";
     stateVersion = osConfig.system.stateVersion;
     packages = with pkgs; [
-      libreoffice-fresh
+      libreoffice-stable
       element-desktop
       signal-desktop
       brave

modules/clan/personal-computer/boot.nix

@@ -0,0 +1,5 @@
+{
+  boot.supportedFilesystems = {
+    ntfs = true;
+  };
+}

modules/clan/phonebox-global/README.md

@@ -0,0 +1,45 @@
+A peer to peer phone relay network built on top of yggdrasil.
+
+Successor of the `phonebox` service with a global, decentralized number
+directory. Every box is reachable from any yggdrasil node running this
+service, not only from members of the same clan. A machine runs either
+`phonebox` or `phonebox-global`, not both (they share the asterisk setup).
+Regenerate vars with `clan vars generate --generator phonebox-global`.
+
+## Numbers
+
+Each box gets a random 6 digit number (100000-999999) when its vars are
+generated. The number is signed with the box's yggdrasil private key, so a
+number is cryptographically bound to the yggdrasil address it belongs to;
+nobody can claim a number for an address they do not own. Regenerate the
+`phonebox` vars to get a new number.
+
+Dialing from a phone plugged into the ATA:
+
+| dialed        | reaches                                    |
+| ------------- | ------------------------------------------ |
+| `NNNNNN`      | the phone on box `NNNNNN` (line `00`)      |
+| `NNNNNNXX`    | line `XX` on box `NNNNNN`                  |
+| `00`, `01`... | local lines on this box                    |
+| `888`         | fax of the current number directory        |
+| `000`         | fax echo test                              |
+| `999`         | hello world                                |
+
+Caller ID on the callee is the caller's box number followed by its line, so
+calling it back works.
+
+## Directory
+
+There is no central registry. Each box runs a serf agent on yggdrasil port
+7946 that gossips its signed number record (`number`, `key`, `sig`, `owner`
+tags) to every other box it knows about. On every membership change the
+`phonebox-sync` handler verifies all records and writes the resulting
+`number -> yggdrasil address` map to `/run/phonebox/numbers/`, which the
+asterisk dialplan reads at call time.
+
+Bootstrapping: boxes of the same clan join each other automatically. To
+connect to boxes outside the clan add one of their yggdrasil addresses to
+`extraPeers`; after the first successful join the agent remembers the whole
+membership in `/var/lib/phonebox/serf.snapshot` and rejoins on its own.
+
+`serf members -rpc-addr 127.0.0.1:7373` shows the live directory.

modules/clan/phonebox-global/default.nix

@@ -0,0 +1,583 @@
+{
+  clanLib,
+  ...
+}:
+{
+  _class = "clan.service";
+  manifest.name = "phonebox-global";
+  manifest.description = "A peer to peer phone relay network built on top of yggdrasil.";
+  manifest.readme = builtins.readFile ./README.md;
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options.ata-ethernet-iface = lib.mkOption {
+          type = lib.types.str;
+          description = "An Ethernet interface that connect to ATA box.";
+          default = "enp2s0";
+        };
+        options.extraClientNumbers = lib.mkOption {
+          type = with lib.types; listOf str;
+          description = "List of client suffix number.";
+          default = [ ];
+        };
+
+        options.extraFixedIPClient = lib.mkOption {
+          type = lib.types.attrsOf (
+            lib.types.submodule {
+              options = {
+                ip = lib.mkOption {
+                  type = lib.types.str;
+                  description = "IP address for this client";
+                };
+
+                name = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Name of the client";
+                };
+              };
+            }
+          );
+          description = "Extra client to be added to pjsip config as a fixed IP auth";
+          default = { };
+          example = {
+            "01" = {
+              ip = "192.168.1.3";
+              name = "bob";
+            };
+          };
+        };
+
+        options.extraPeers = lib.mkOption {
+          type = with lib.types; listOf str;
+          description = ''
+            Yggdrasil addresses of phonebox nodes outside this clan to bootstrap
+            the number directory from. Any single reachable node is enough; the
+            directory is gossiped from there and remembered across restarts.
+          '';
+          default = [ ];
+          example = [ "200:1234:5678:9abc:def0:1234:5678:9abc" ];
+        };
+      };
+    perInstance =
+      {
+        roles,
+        settings,
+        ...
+      }:
+      {
+
+        nixosModule =
+          {
+            lib,
+            config,
+            pkgs,
+            ...
+          }:
+          let
+            asterisk = pkgs.asterisk.overrideAttrs (old: {
+              propagatedNativeBuildInputs = [ pkgs.spandsp3 ];
+            });
+
+            machineName = config.clan.core.settings.machine.name;
+            machines = lib.attrNames roles.default.machines;
+
+            user = "asterisk";
+            faxDir = "/run/asterisk/fax";
+            rtpPortFrom = 10000;
+            rtpPortTo = 20000;
+            ata-interface = settings.ata-ethernet-iface;
+
+            # The ATA's own line. Remote callers reach it by dialing the 6
+            # digit box number alone or with this extension appended.
+            ataLine = "00";
+            sipPort = 5060;
+
+            # Well-known port of the phonebox directory gossip. Every phonebox
+            # node worldwide must agree on it, so it is not configurable.
+            directoryPort = 7946;
+            directoryRpc = "127.0.0.1:7373";
+            directoryUser = "phonebox";
+            directoryDir = "/run/phonebox";
+
+            phoneboxVars = config.clan.core.vars.generators.phonebox-global.files;
+            ownNumber = phoneboxVars.number.value;
+            ownerName = lib.trim phoneboxVars.owner-name.value;
+
+            getYggdrasilIP =
+              name:
+              lib.trim (
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = name;
+                  generator = "yggdrasil";
+                  file = "address";
+                  default = "";
+                }
+              );
+
+            ownYggdrasilIP =
+              if config.clan.core.vars.generators.yggdrasil.files ? address then
+                config.clan.core.vars.generators.yggdrasil.files.address.value
+              else
+                throw "clanService/yggdrasil is required";
+
+            seedPeers = lib.unique (
+              lib.filter (ip: ip != "") (map getYggdrasilIP (lib.remove machineName machines))
+              ++ settings.extraPeers
+            );
+
+            # Rebuilds the number -> yggdrasil address directory from the
+            # gossip membership. Every record is verified: the yggdrasil
+            # address is derived from the record's public key, so a node can
+            # only publish numbers for the address it actually owns, and the
+            # number is signed with the matching private key.
+            phoneboxSync = pkgs.writers.writePython3Bin "phonebox-sync" {
+              libraries = [ pkgs.python3Packages.cryptography ];
+              flakeIgnore = [ "E501" ];
+            } (builtins.readFile ./phonebox-sync.py);
+
+            phoneboxSyncWrapped = pkgs.writeShellApplication {
+              name = "phonebox-sync";
+              runtimeInputs = [ pkgs.serfdom ];
+              text = ''
+                exec ${lib.getExe phoneboxSync} ${directoryRpc} ${directoryDir}
+              '';
+            };
+
+            createContactListTiff = pkgs.writeShellApplication {
+              name = "create-contact-tiff";
+              text = ''
+                magick -background white -fill black -pointsize 20 -font DejaVu-Sans label:"$(cat ${directoryDir}/contacts.txt)" "$1"
+                magick "$1" -border 20x50 -bordercolor white "$1"
+                magick "$1" -resize 1728x -units PixelsPerInch -compress Group4 -density 204x196 -monochrome -depth 1 "$1"
+              '';
+              runtimeInputs = [ pkgs.imagemagick ];
+            };
+
+            genLocalSIPEndpoint =
+              { localNumber }:
+              ''
+                [${localNumber}](internal_endpoint)
+                aors=${localNumber}
+                auth=${localNumber}
+
+                [${localNumber}](userpass_auth)
+                username=${localNumber}
+                password=${localNumber}
+
+                [${localNumber}](dynamic_aor)
+                max_contacts=1
+                remove_existing=yes
+              '';
+
+            genLocalSIPEndpointV6 =
+              { localNumber }:
+              ''
+                [${localNumber}](internal_endpoint)
+                transport=transport-udp6
+                aors=${localNumber}
+                auth=${localNumber}
+
+                [${localNumber}](userpass_auth)
+                username=${localNumber}
+                password=${localNumber}
+
+                [${localNumber}](dynamic_aor)
+                max_contacts=1
+              '';
+
+            genLocalSIPIPEndpoint = number: ''
+
+              [${number}](internal_endpoint)
+              aors=${number}
+              auth=${number}
+              contact_deny=0.0.0.0/0
+              contact_deny=::/0
+              contact_permit=${settings.extraFixedIPClient.${number}.ip}/128
+
+              [${number}](dynamic_aor)
+              max_contacts=1
+              remove_existing=yes
+
+              [${number}](userpass_auth)
+              username=${number}
+              password=${number}
+
+            '';
+
+            genLocalExtenConf =
+              { localNumber }:
+              ''
+                exten => ${localNumber},1,Dial(PJSIP/${localNumber},20)
+              '';
+
+            localNumbers = [
+              ataLine
+            ]
+            ++ settings.extraClientNumbers
+            ++ lib.attrNames settings.extraFixedIPClient;
+          in
+          {
+            assertions = [
+              {
+                assertion = !config.networking.nftables.enable;
+                message = "phonebox-global: opening the yggdrasil interface to non-clan nodes is only implemented for the iptables firewall backend";
+              }
+            ];
+
+            clan.core.vars.generators.phonebox-global = {
+              files = {
+                number.secret = false;
+                public-key.secret = false;
+                signature.secret = false;
+                owner-name.secret = false;
+              };
+
+              dependencies = [ "yggdrasil" ];
+
+              prompts.owner-name = {
+                persist = true;
+                type = "line";
+                description = "The owner's name for this unit";
+              };
+
+              runtimeInputs = with pkgs; [
+                coreutils
+                openssl
+                xxd
+              ];
+
+              # A random 6 digit number (100000-999999), bound to this
+              # machine's yggdrasil identity by signing it with the yggdrasil
+              # private key. Other nodes accept the number only if the
+              # signature checks out and the key derives to the yggdrasil
+              # address the record is gossiped from. Regenerate to re-roll.
+              script = ''
+                cat $prompts/owner-name > $out/owner-name
+                shuf -i 100000-999999 -n 1 | tr -d '\n' > $out/number
+                openssl pkey -in $in/yggdrasil/privateKey -pubout -outform DER \
+                  | tail -c 32 | xxd -p -c 64 | tr -d '\n' > $out/public-key
+                # openssl needs a regular file for one-shot ed25519 signing
+                printf 'phonebox:%s' "$(cat $out/number)" > $out/message
+                openssl pkeyutl -sign -rawin -inkey $in/yggdrasil/privateKey -in $out/message \
+                  | base64 -w0 > $out/signature
+                rm $out/message
+              '';
+            };
+
+            networking.interfaces = {
+              ${ata-interface} = {
+                useDHCP = false;
+                ipv4.addresses = [
+                  {
+                    address = "192.168.254.1";
+                    prefixLength = 24;
+                  }
+                ];
+              };
+            };
+
+            services.dnsmasq = {
+              enable = true;
+
+              settings = {
+                bind-dynamic = true;
+                listen-address = "192.168.254.1";
+                # enable-ra = true;
+                domain-needed = true;
+                domain = "localhost";
+                dhcp-range = [
+                  "192.168.254.100,192.168.254.100,255.255.255.0,3m"
+                ];
+                dhcp-leasefile = "/dev/null";
+                dhcp-option = [
+                  "3,192.168.254.1"
+                ];
+                interface = [ ata-interface ];
+              };
+            };
+
+            services.nginx = {
+              enable = true;
+              virtualHosts = {
+                "_" = {
+                  locations."/" = {
+                    proxyPass = "http://192.168.254.100";
+                    extraConfig = ''
+                      client_max_body_size 100M;
+                    '';
+                  };
+                };
+              };
+            };
+
+            networking.firewall.allowedUDPPortRanges = [
+              {
+                from = rtpPortFrom;
+                to = rtpPortTo;
+              }
+            ];
+
+            networking.firewall.allowedUDPPorts = [
+              53
+              67
+              sipPort
+            ];
+            networking.firewall.allowedTCPPorts = [
+              53
+            ];
+            networking.firewall.interfaces = {
+              "zt+".allowedTCPPorts = [ 80 ];
+              ygg = {
+                allowedTCPPorts = [ directoryPort ];
+                allowedUDPPorts = [ directoryPort ];
+              };
+            };
+
+            # clanService/yggdrasil drops everything on the ygg interface that
+            # does not come from a clan member. Phonebox is a global network,
+            # so let SIP, RTP and the directory gossip through from anyone.
+            networking.firewall.extraCommands = lib.mkAfter ''
+              if ip6tables -n -L ygg-input >/dev/null 2>&1; then
+                ip6tables -I ygg-input 1 -i ygg -p udp --dport ${toString sipPort} -j RETURN
+                ip6tables -I ygg-input 1 -i ygg -p udp --dport ${toString rtpPortFrom}:${toString rtpPortTo} -j RETURN
+                ip6tables -I ygg-input 1 -i ygg -p udp --dport ${toString directoryPort} -j RETURN
+                ip6tables -I ygg-input 1 -i ygg -p tcp --dport ${toString directoryPort} -j RETURN
+              fi
+            '';
+
+            users.users.${directoryUser} = {
+              isSystemUser = true;
+              group = directoryUser;
+            };
+            users.groups.${directoryUser} = { };
+
+            # Decentralized number directory: a serf gossip cluster over
+            # yggdrasil. Each node advertises its signed number record as
+            # tags; membership changes trigger phonebox-sync, which writes the
+            # verified number -> address map to ${directoryDir}/numbers/ for
+            # the dialplan. The snapshot lets a node rejoin from previously
+            # seen members, so seeds are only needed for the very first join.
+            systemd.services.phonebox-directory = {
+              description = "Phonebox number directory (serf gossip over yggdrasil)";
+              wantedBy = [ "multi-user.target" ];
+              wants = [ "network-online.target" ];
+              after = [
+                "network-online.target"
+                "yggdrasil.service"
+              ];
+              serviceConfig = {
+                User = directoryUser;
+                Group = directoryUser;
+                RuntimeDirectory = "phonebox";
+                RuntimeDirectoryMode = "0755";
+                RuntimeDirectoryPreserve = "yes";
+                StateDirectory = "phonebox";
+                Restart = "always";
+                RestartSec = 5;
+                ExecStart = lib.concatStringsSep " " (
+                  [
+                    (lib.getExe pkgs.serfdom)
+                    "agent"
+                    "-node=${machineName}-${ownNumber}"
+                    "-bind=[::]:${toString directoryPort}"
+                    "-advertise=[${ownYggdrasilIP}]:${toString directoryPort}"
+                    "-rpc-addr=${directoryRpc}"
+                    "-profile=wan"
+                    "-snapshot=/var/lib/phonebox/serf.snapshot"
+                    "-rejoin"
+                    "-retry-max=0"
+                    "-retry-interval=30s"
+                    "-tag number=${ownNumber}"
+                    "-tag key=${phoneboxVars.public-key.value}"
+                    "-tag sig=${phoneboxVars.signature.value}"
+                    "-tag ${lib.escapeShellArg "owner=${ownerName}"}"
+                    "-event-handler=member-join,member-leave,member-failed,member-update,member-reap=${lib.getExe phoneboxSyncWrapped}"
+                  ]
+                  ++ map (ip: "-retry-join=[${ip}]:${toString directoryPort}") seedPeers
+                );
+              };
+            };
+
+            services.asterisk = {
+              enable = lib.mkDefault true;
+              package = lib.mkDefault asterisk;
+              confFiles = {
+                "logger.conf" = ''
+                  [general]
+                  dateformat = %F %T.%3q ; ISO 8601 date format with milliseconds
+                  use_callids = yes
+                  appendhostname = no
+                  queue_log = yes
+                  queue_log_to_file = no
+                  queue_log_name = queue_log
+                  queue_log_realtime_use_gmt = no
+                  rotatestrategy = rotate
+                  exec_after_rotate=gzip -9 $\{filename\}.2
+                  [logfiles]
+                  console => notice,warning,error
+                  security => security
+                  messages => notice,warning,error
+                  full => notice,warning,error,verbose,dtmf,fax
+                  syslog.local0 => notice,warning,error
+                '';
+
+                "modules.conf" = ''
+                  [modules]
+                  autoload=yes
+
+                  load => res_fax_spandsp.so
+                '';
+
+                # Dial plan config
+                "extensions.conf" = ''
+                  [from-internal]
+                  exten => 999,1,Answer()
+                  same  =>     n,Playback(hello-world)
+                  same  =>     n,Hangup()
+
+                  exten => 000,1,Answer()
+                  same => n,ReceiveFAX(${faxDir}/echo-''${UNIQUEID}.tiff)
+                  same => n,Set(FAXFILE=${faxDir}/echo-''${UNIQUEID}.tiff)
+                  same => n,Set(FAXECHO=true)
+
+                  exten => 888,1,Answer()
+                  same => n,Set(FAXFILE=${faxDir}/contact.tiff)
+                  same => n,System(${lib.getExe createContactListTiff} ''${FAXFILE})
+                  same => n,Set(FAXECHO=true)
+                  same => n,Playback(vm-goodbye)
+                  same => n,Wait(3)
+
+                  exten => h,1,GotoIf($[''${FAXECHO}]?sendfax)
+                  same => n,Hangup()
+                  same => n(sendfax),Originate(PJSIP/${ataLine},app,SendFAX,''${FAXFILE})
+                  same => n,Set(FAXECHO=false)
+
+                  ; 6 digit box number, optionally followed by a 2 digit line
+                  exten => _[1-9]XXXXX,1,Goto(to-yggdrasil,''${EXTEN},1)
+                  exten => _[1-9]XXXXXXX,1,Goto(to-yggdrasil,''${EXTEN},1)
+
+                ''
+                + lib.concatMapStrings (number: genLocalExtenConf { localNumber = number; }) localNumbers
+                + ''
+
+                  ; Outbound: resolve the box number through the directory and
+                  ; send the call to that node over yggdrasil.
+                  [to-yggdrasil]
+                  exten => _[1-9]X.,1,Set(PEER=''${FILE(${directoryDir}/numbers/''${EXTEN:0:6})})
+                  same => n,GotoIf($["''${PEER}" = ""]?unknown)
+                  same => n,Set(CALLERID(num)=${ownNumber}''${CALLERID(num)})
+                  same => n,Set(CALLERID(name)=${ownerName})
+                  same => n,Dial(PJSIP/yggdrasil/sip:''${EXTEN}@[''${PEER}]:${toString sipPort},30)
+                  same => n,Hangup()
+                  same => n(unknown),Playback(ss-noservice)
+                  same => n,Hangup()
+
+                  ; Inbound from any yggdrasil node: only our own number is served.
+                  [from-yggdrasil]
+                  exten => ${ownNumber},1,Dial(PJSIP/${ataLine},20)
+                  exten => _${ownNumber}XX,1,Dial(PJSIP/''${EXTEN:6},20)
+                '';
+
+                "rtp.conf" = ''
+                  [general]
+                  rtpstart=${toString rtpPortFrom}
+                  rtpend=${toString rtpPortTo}
+                '';
+
+                "pjsip.conf" = ''
+                  [global]
+                  type=global
+                  ; Local lines authenticate by username; everything else from
+                  ; the yggdrasil range is a remote phonebox node.
+                  endpoint_identifier_order=username,ip,anonymous
+
+                  [transport-udp]
+                  type=transport
+                  protocol=udp
+                  bind=0.0.0.0
+                  [transport-udp6]
+                  type=transport
+                  protocol=udp
+                  bind=::
+
+                  [base_endpoint](!)
+                  type=endpoint
+                  disallow=all
+                  allow=ulaw,alaw,g722,gsm
+                  direct_media=no
+
+                  [internal_endpoint](!,base_endpoint)
+                  context=from-internal
+
+                  [userpass_auth](!)
+                  type=auth
+                  auth_type=userpass
+
+                  [dynamic_aor](!)
+                  type=aor
+
+                  [yggdrasil](base_endpoint)
+                  transport=transport-udp6
+                  context=from-yggdrasil
+
+                  [yggdrasil]
+                  type=identify
+                  endpoint=yggdrasil
+                  match=200::/7
+
+                ''
+                + (genLocalSIPEndpoint { localNumber = ataLine; })
+                + lib.concatMapStrings (
+                  number: genLocalSIPEndpointV6 { localNumber = number; }
+                ) settings.extraClientNumbers
+                + lib.concatMapStrings genLocalSIPIPEndpoint (lib.attrNames settings.extraFixedIPClient);
+              };
+            };
+
+            environment.systemPackages = [
+              createContactListTiff
+              phoneboxSyncWrapped
+            ];
+
+            systemd.tmpfiles.rules = [
+              "d ${faxDir}                            0755 ${user} ${user} - -"
+            ];
+
+            systemd.services.asterisk-watcher = {
+              enable = true;
+              description = "Asterisk Configuration files watcher";
+
+              requires = [ "asterisk.service" ];
+              after = [ "network.target" ];
+              wantedBy = [ "multi-user.target" ];
+              path = with pkgs; [
+                inotify-tools
+                asterisk
+              ];
+              script = ''
+                inotifywait -m -e move /etc/asterisk |
+                while read path action file; do
+                  case "$file" in
+                    pjsip.conf)
+                      echo "restarting pjsip"
+                      asterisk -rx "pjsip reload"
+                      ;;
+                  esac
+                  case "$file" in
+                    extensions.conf)
+                      echo "restarting core"
+                      asterisk -rx "core restart now"
+                      ;;
+                  esac
+                done
+              '';
+            };
+          };
+      };
+  };
+}

modules/clan/phonebox-global/flake-module.nix

@@ -0,0 +1,39 @@
+{
+  inputs,
+  self,
+  ...
+}:
+let
+  module = ./default.nix;
+in
+{
+  clan.modules = {
+    phonebox-global = module;
+  };
+  perSystem =
+    { pkgs, ... }:
+    {
+      clan.nixosTests.service-phonebox-global = {
+        imports = [ ./tests/vm/default.nix ];
+        _module.args = { inherit self inputs; };
+
+        clan.modules."@clan/phonebox-global" = module;
+      };
+
+      # Unit tests for the directory sync logic (record verification,
+      # address derivation, collision handling, file output).
+      checks.phonebox-global-sync =
+        pkgs.runCommand "phonebox-global-sync-test"
+          {
+            nativeBuildInputs = [
+              (pkgs.python3.withPackages (ps: [ ps.cryptography ]))
+              pkgs.yggdrasil
+            ];
+            PHONEBOX_SYNC = ./phonebox-sync.py;
+          }
+          ''
+            python3 ${./tests/sync/test_sync.py} -v
+            touch $out
+          '';
+    };
+}

modules/clan/phonebox-global/phonebox-sync.py

@@ -0,0 +1,111 @@
+"""Rebuild the phonebox number directory from serf membership.
+
+Usage: phonebox-sync <serf rpc addr> <state dir>
+
+Runs as a serf event handler. Every alive member carries its number record
+as tags (number, key, sig, owner). A record is accepted only when the
+yggdrasil address it is gossiped from derives from `key` and `sig` is a
+valid ed25519 signature of "phonebox:<number>" under that key, so a number
+can only ever be bound to the address of the node that signed it.
+
+Output, consumed by the asterisk dialplan:
+  <state dir>/numbers/<number>  the yggdrasil address, no trailing newline
+  <state dir>/contacts.txt      "<number> : <owner>" per line, for the fax
+"""
+
+import base64
+import ipaddress
+import json
+import os
+import subprocess
+import sys
+import syslog
+import tempfile
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+
+def yggdrasil_address(public_key: bytes) -> ipaddress.IPv6Address:
+    """Port of yggdrasil-go address.AddrForKey.
+
+    Invert the key; the address is 0x02, the count of leading one bits,
+    then the bits following the first zero, truncated to 128 bits.
+    """
+    bits = "".join(f"{b ^ 0xFF:08b}" for b in public_key)
+    ones = len(bits) - len(bits.lstrip("1"))
+    body = int(bits[ones + 1:ones + 113], 2).to_bytes(14, "big")
+    return ipaddress.IPv6Address(bytes([0x02, ones]) + body)
+
+
+def verified_record(member: dict) -> tuple[str, str, str, str]:
+    """Return (number, key hex, address, owner) or raise ValueError."""
+    tags = member.get("tags", {})
+    try:
+        number, key_hex, sig = tags["number"], tags["key"], tags["sig"]
+        key = bytes.fromhex(key_hex)
+        host, _ = member["addr"].rsplit(":", 1)
+        address = ipaddress.IPv6Address(host.strip("[]"))
+        signature = base64.b64decode(sig, validate=True)
+    except (KeyError, ValueError) as e:
+        raise ValueError(f"malformed record: {e}")
+    if not (len(number) == 6 and number.isdigit() and number[0] != "0"):
+        raise ValueError(f"invalid number {number!r}")
+    if yggdrasil_address(key) != address:
+        raise ValueError(f"key does not derive to address {address}")
+    try:
+        Ed25519PublicKey.from_public_bytes(key).verify(signature, b"phonebox:" + number.encode())
+    except (ValueError, InvalidSignature):
+        raise ValueError(f"bad signature for number {number}")
+    return number, key_hex, str(address), tags.get("owner", "")
+
+
+def directory(members: list[dict]) -> dict[str, tuple[str, str, str]]:
+    """number -> (key hex, address, owner); on a collision the lowest key wins."""
+    book = {}
+    for member in members:
+        try:
+            number, key, address, owner = verified_record(member)
+        except ValueError as e:
+            syslog.syslog(syslog.LOG_WARNING, f"ignoring {member.get('name')}: {e}")
+            continue
+        if number in book:
+            syslog.syslog(syslog.LOG_WARNING, f"number {number} claimed by keys {book[number][0]} and {key}")
+            if book[number][0] <= key:
+                continue
+        book[number] = (key, address, owner)
+    return book
+
+
+def write_atomic(path: str, content: str) -> None:
+    fd, tmp = tempfile.mkstemp(dir=os.path.dirname(path))
+    with os.fdopen(fd, "w") as f:
+        f.write(content)
+    os.chmod(tmp, 0o644)
+    os.replace(tmp, path)
+
+
+def main() -> None:
+    rpc_addr, state_dir = sys.argv[1:]
+    syslog.openlog("phonebox-sync")
+    out = subprocess.run(
+        ["serf", "members", "-format=json", "-status=alive", f"-rpc-addr={rpc_addr}"],
+        check=True, capture_output=True, text=True,
+    ).stdout
+    book = directory(json.loads(out)["members"])
+
+    numbers_dir = os.path.join(state_dir, "numbers")
+    os.makedirs(numbers_dir, exist_ok=True)
+    for number, (_, address, _) in book.items():
+        write_atomic(os.path.join(numbers_dir, number), address)
+    for stale in set(os.listdir(numbers_dir)) - book.keys():
+        os.unlink(os.path.join(numbers_dir, stale))
+    write_atomic(
+        os.path.join(state_dir, "contacts.txt"),
+        "".join(f"{number}\t\t: \t\t{book[number][2]}\n" for number in sorted(book)),
+    )
+    syslog.syslog(syslog.LOG_INFO, f"directory has {len(book)} numbers")
+
+
+if __name__ == "__main__":
+    main()

modules/clan/phonebox-global/tests/sync/test_sync.py

@@ -0,0 +1,164 @@
+"""Tests for phonebox-sync: record verification and directory output.
+
+Run via the `phonebox-global-sync` flake check; needs the `cryptography`
+python package and the `yggdrasil` binary on PATH.
+"""
+
+import base64
+import importlib.util
+import ipaddress
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+spec = importlib.util.spec_from_file_location("phonebox_sync", os.environ["PHONEBOX_SYNC"])
+sync = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(sync)
+
+PORT = 7946
+
+
+class Node:
+    """A phonebox node identity: yggdrasil key, address and signed number."""
+
+    def __init__(self, number: str, owner: str = ""):
+        self.key = Ed25519PrivateKey.generate()
+        self.public = self.key.public_key().public_bytes_raw()
+        self.address = str(sync.yggdrasil_address(self.public))
+        self.number = number
+        self.owner = owner
+
+    def member(self, name="node", **overrides) -> dict:
+        tags = {
+            "number": self.number,
+            "key": self.public.hex(),
+            "sig": base64.b64encode(self.key.sign(b"phonebox:" + self.number.encode())).decode(),
+            "owner": self.owner,
+        }
+        member = {"name": name, "addr": f"[{self.address}]:{PORT}", "port": PORT, "status": "alive", "tags": tags}
+        for k, v in overrides.items():
+            (tags if k in tags else member)[k] = v
+        return member
+
+
+def yggdrasil_binary_address(key: Ed25519PrivateKey) -> str:
+    private = key.private_bytes_raw() + key.public_key().public_bytes_raw()
+    out = subprocess.run(
+        ["yggdrasil", "-useconf", "-address"],
+        input=json.dumps({"PrivateKey": private.hex()}),
+        check=True, capture_output=True, text=True,
+    )
+    return out.stdout.strip()
+
+
+class AddressDerivation(unittest.TestCase):
+    def test_known_vector(self):
+        # A real clan machine key and the address yggdrasil assigned to it.
+        key = bytes.fromhex("0ec53986a2bdca8a43f74063aeab6a958fc697c528c83e7281365072926886f0")
+        self.assertEqual(str(sync.yggdrasil_address(key)), "204:2758:cf2b:a846:aeb7:8117:f38a:2a92")
+
+    def test_matches_yggdrasil_binary(self):
+        for _ in range(16):
+            key = Ed25519PrivateKey.generate()
+            expected = ipaddress.IPv6Address(yggdrasil_binary_address(key))
+            self.assertEqual(sync.yggdrasil_address(key.public_key().public_bytes_raw()), expected)
+
+
+class RecordVerification(unittest.TestCase):
+    def setUp(self):
+        self.node = Node("482913", owner="alice")
+
+    def test_valid_record(self):
+        number, key, address, owner = sync.verified_record(self.node.member())
+        self.assertEqual((number, key, address, owner), ("482913", self.node.public.hex(), self.node.address, "alice"))
+
+    def test_record_from_foreign_address_is_rejected(self):
+        other = Node("111111")
+        with self.assertRaisesRegex(ValueError, "does not derive"):
+            sync.verified_record(self.node.member(addr=f"[{other.address}]:{PORT}"))
+
+    def test_signature_over_other_number_is_rejected(self):
+        with self.assertRaisesRegex(ValueError, "bad signature"):
+            sync.verified_record(self.node.member(number="999999"))
+
+    def test_garbage_signature_is_rejected(self):
+        with self.assertRaisesRegex(ValueError, "malformed"):
+            sync.verified_record(self.node.member(sig="not base64!"))
+
+    def test_missing_tags_are_rejected(self):
+        with self.assertRaisesRegex(ValueError, "malformed"):
+            sync.verified_record({"name": "foreign", "addr": f"[{self.node.address}]:{PORT}", "tags": {}})
+
+    def test_number_must_be_six_digits_without_leading_zero(self):
+        for bad in ["012345", "12345", "1234567", "12a456", ""]:
+            node = Node(bad)
+            with self.assertRaisesRegex(ValueError, "invalid number", msg=bad):
+                sync.verified_record(node.member())
+
+    def test_owner_defaults_to_empty(self):
+        member = self.node.member()
+        del member["tags"]["owner"]
+        self.assertEqual(sync.verified_record(member)[3], "")
+
+
+class Directory(unittest.TestCase):
+    def test_invalid_records_are_skipped_not_fatal(self):
+        good = Node("482913", owner="alice")
+        bad = Node("555555")
+        members = [bad.member(sig="AAAA"), good.member(), {"name": "x", "addr": "[200::1]:7946", "tags": {}}]
+        self.assertEqual(sync.directory(members), {"482913": (good.public.hex(), good.address, "alice")})
+
+    def test_collision_lowest_key_wins_regardless_of_order(self):
+        a, b = Node("482913"), Node("482913")
+        winner = min((a, b), key=lambda n: n.public.hex())
+        for members in ([a.member("a"), b.member("b")], [b.member("b"), a.member("a")]):
+            self.assertEqual(sync.directory(members)["482913"][1], winner.address)
+
+
+class Main(unittest.TestCase):
+    def run_sync(self, members: list[dict], state: str) -> None:
+        bindir = tempfile.mkdtemp()
+        with open(os.path.join(bindir, "serf"), "w") as f:
+            f.write("#!/bin/sh\ncat <<'EOF'\n" + json.dumps({"members": members}) + "\nEOF\n")
+        os.chmod(os.path.join(bindir, "serf"), 0o755)
+        env_path = os.environ["PATH"]
+        os.environ["PATH"] = bindir + os.pathsep + env_path
+        argv = sys.argv
+        sys.argv = ["phonebox-sync", "127.0.0.1:7373", state]
+        try:
+            sync.main()
+        finally:
+            sys.argv = argv
+            os.environ["PATH"] = env_path
+
+    def test_writes_numbers_and_contacts_and_removes_stale(self):
+        state = tempfile.mkdtemp()
+        os.makedirs(os.path.join(state, "numbers"))
+        with open(os.path.join(state, "numbers", "111111"), "w") as f:
+            f.write("200::dead")
+        a, b = Node("482913", owner="alice"), Node("555555", owner="bob")
+        self.run_sync([b.member("b"), a.member("a")], state)
+
+        numbers = os.path.join(state, "numbers")
+        self.assertEqual(sorted(os.listdir(numbers)), ["482913", "555555"])
+        with open(os.path.join(numbers, "482913")) as f:
+            self.assertEqual(f.read(), a.address)  # no trailing newline: read by FILE() in the dialplan
+        with open(os.path.join(state, "contacts.txt")) as f:
+            self.assertEqual(f.read(), "482913\t\t: \t\talice\n555555\t\t: \t\tbob\n")
+
+    def test_empty_membership_clears_directory(self):
+        state = tempfile.mkdtemp()
+        self.run_sync([Node("482913").member()], state)
+        self.run_sync([], state)
+        self.assertEqual(os.listdir(os.path.join(state, "numbers")), [])
+        with open(os.path.join(state, "contacts.txt")) as f:
+            self.assertEqual(f.read(), "")
+
+
+if __name__ == "__main__":
+    unittest.main()

modules/clan/phonebox-global/tests/vm/default.nix

@@ -0,0 +1,77 @@
+{
+  self,
+  hostPkgs,
+  config,
+  lib,
+  ...
+}:
+{
+  name = "service-phonebox-global";
+  result.update-vars =
+    let
+      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
+    in
+    hostPkgs.writeShellScriptBin "update-vars" ''
+      set -x
+      export PRJ_ROOT=$(git rev-parse --show-toplevel)
+      ${
+        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
+      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
+    '';
+
+  clan = {
+    test.useContainers = false;
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+      machines.nodeA = { };
+
+      instances = {
+        yggdrasil = {
+          module.name = "yggdrasil";
+          roles.default.machines.server = { };
+          roles.default.machines.nodeA = { };
+        };
+        phonebox-global-test = {
+          module.name = "@clan/phonebox-global";
+          module.input = "self";
+          roles.default.machines.server.settings.ata-ethernet-iface = "enp2s0";
+          roles.default.machines.nodeA.settings.ata-ethernet-iface = "enp2s0";
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+    nodeA = { };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      number = node: nodes.${node}.clan.core.vars.generators.phonebox-global.files.number.value;
+      address = node: nodes.${node}.clan.core.vars.generators.yggdrasil.files.address.value;
+    in
+    ''
+      start_all()
+
+      for node in [server, nodeA]:
+          node.wait_for_unit("asterisk.service")
+          node.wait_for_unit("phonebox-directory.service")
+
+      # Directory converges: each node learns the other's number and address.
+      server.wait_until_succeeds("test -f /run/phonebox/numbers/${number "nodeA"}", timeout=300)
+      nodeA.wait_until_succeeds("test -f /run/phonebox/numbers/${number "server"}", timeout=300)
+      assert server.succeed("cat /run/phonebox/numbers/${number "nodeA"}") == "${address "nodeA"}"
+      assert nodeA.succeed("cat /run/phonebox/numbers/${number "server"}") == "${address "server"}"
+      assert "${number "nodeA"}" in server.succeed("cat /run/phonebox/contacts.txt")
+
+      # A call from server to nodeA's number is routed over yggdrasil and
+      # accepted by nodeA's asterisk (no phone is registered, so it fails
+      # after being identified, which is enough to prove the path).
+      nodeA.succeed("asterisk -rx 'pjsip set logger on'")
+      server.succeed("asterisk -rx 'channel originate Local/${number "nodeA"}@from-internal application Wait 3'")
+      nodeA.wait_until_succeeds("grep -q 'INVITE sip:${number "nodeA"}@' /var/log/asterisk/full", timeout=60)
+    '';
+}

modules/clan/phonebox-global/tests/vm/sops/machines/nodeA/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age18yf7r0dalnue5vwzanxl046fxsskhu9lzvd488ajhz7rp62mu94scmw3w4",
+    "type": "age"
+  }
+]

modules/clan/phonebox-global/tests/vm/sops/machines/server/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1sy8xkmssttcchjj0nkapk4tu530lrzszdp4lka6nn4gzlxam6e2s3xzp2j",
+    "type": "age"
+  }
+]

modules/clan/phonebox-global/tests/vm/sops/secrets/nodeA-age.key/secret

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:NkOeX6FboG7NOkdgiTgAsS+XjRoDU+AEYfMhpZXIJTYEM2dQti+PMGyizKRvr1wRnSGMp56XaX0bHdToBuf1gYruqAsEkKwqsYw=,iv:RFyO5/JybroNAKe+F3vv51l4OEu5XXNs+biTTH8poEg=,tag:zfPm0ZAjT2CC734EU+36KQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2RklrTFQxMll5VUxiaGVu\nNlRzeldTRnVrSG93TXYzc1YrRE9Nc1VqTHpNCjh4aHJMZmtpM2tDclNaT3d2SDhN\na1QxTXVFOHRuY3dpL1YxMTJKK3pUVmMKLS0tIHoyMGVyc01vak5EKzZONC9XUmFw\nMU5MRmx6UDROQzFiaTNuNXFiQTZoYmcK6wxypuP7vTnz//EcEt2pUNqUuKxjOaY3\nAmKToJQADJfzTsYGzpmWkkYaMHvG00v8Ja6TF6IxZr5SxUh4bdHr+w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			}
+		],
+		"lastmodified": "2026-09-18T02:02:10Z",
+		"mac": "ENC[AES256_GCM,data:kRpbcT5+I80iHPjPUnveQE9jpa65n0xPPQR/by4p1iM80ZKk9KH0cObB5hHhXO4BD1OqI79UJ3O9O7Jhmylgx5Uh8RNbK6wf26p4GO2Bvqh9r15NqbCZtXkoW30MTLLIs58Q7NeK9O2LgeckWrXLtyEytfhnTuoTSDFo8Sh8NQY=,iv:rcNow1Z4BN7bo1XERB6c+G6Gwl3tRU1VHvYmoDaLTl4=,tag:vy/5EB/1gw/KLLqXHSEV3g==,type:str]",
+		"version": "3.13.3"
+	}
+}

modules/clan/phonebox-global/tests/vm/sops/secrets/nodeA-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/phonebox-global/tests/vm/sops/secrets/server-age.key/secret

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:Sy9T0zEgSGZ/qkz5kaRN2qlH2X+pFRibzb8FpWuknuSI/9lActSG2Loq4LhmhqPGC5MGVkQcz2pcVFI7afUjzDzejfJf4De1ka4=,iv:JNLXguWEwJXR2+WNl0v0nUvkESVAbccfeQSUijKbj2I=,tag:/AAFKncO+B/XmUZYTQnTTw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqOXJoSXgvcEFXK2hWTlpi\nQWhCdnZPUCt5R2xEWFYxUnpWVlc1ei93TncwCjNKaVB0MFN1VUdheEwyUTBzcmFT\nb0RjTHp2MGE4cWIraCtZME9rQXAvVEkKLS0tIFpiZDhCN0NIY3FWTnlXaFhiMmtC\nTFJMUncvMnFRSEhNdHlhaWozcjlqYWsKLDH1VFG/QS3VIMn6Iwo2NmY5kdBiOPNR\nj4sOY6xBpWP5AiGUypGoX4Bm52gLgW5AdcBRIxxhFOekIv5G8wmRaw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			}
+		],
+		"lastmodified": "2026-09-18T02:02:23Z",
+		"mac": "ENC[AES256_GCM,data:DN97Dcpy29IZkBbwFVnMxnUnWYrgLKuvbANabkMCdpOJYgI1msYODltHJlR68Lk8Fmg25sXysvdbJOnc2cMH3pgcKxeyfhdAFwlIXdie1HRtTpZql15RF0fwPBGJjwL9YYubpZU7K4cNflGbjuOCEhp8bQOUYY8Ptd2deiDGGuw=,iv:bxTcKLUu6fcz7JKzStKiakgBeNx7aWCw6M7HolthfEo=,tag:/0nWBkdCPkpcWSpcfY/TfA==,type:str]",
+		"version": "3.13.3"
+	}
+}

modules/clan/phonebox-global/tests/vm/sops/secrets/server-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/phonebox-global/tests/vm/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/phonebox-global/number/value

@@ -0,0 +1 @@
+392268

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/phonebox-global/owner-name/value

@@ -0,0 +1 @@
+fake_line_value

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/phonebox-global/public-key/value

@@ -0,0 +1 @@
+cf28bbcd822efec197dfaa99fbe9004f78b4efa9724b4f453d05f12a61a0bb44

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/phonebox-global/signature/value

@@ -0,0 +1 @@
+CrnzGbqfVORt00zeI99crpBRUMfGF+2uEfaHe1L3Y8k7CIojc+8TID40HPhwEgXNtC9/xr61mN5L0Vp4vpviBA==

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/state-version/version/value

@@ -0,0 +1 @@
+26.11

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/yggdrasil/address/value

@@ -0,0 +1 @@
+200:61ae:8864:fba2:27c:d040:aacc:82d

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/yggdrasil/privateKey/machines/nodeA

@@ -0,0 +1 @@
+../../../../../../sops/machines/nodeA

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/yggdrasil/privateKey/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:hR33SvxgsU+hZnvF2hoQxE7n0IB6kLC9MgK0wS0NXpCht5NuPjTo5p51oUE8t95Dht2qlEdXAkGO39k/h42p54vhqcfuF7u/eqVMdX6pEJyOokFmsdDmdVZziyhZghrTI/nDlctxCPcqFkeCHU4SIBZs85NS8uk=,iv:Q8k8OXSS3lFw33UO8JiZYNkrH3s+Cvh0xnAbMiBmnNA=,tag:DtNYKgDYB2nSHIjvMdvu/w==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSzk1RUhIekVJRStQd3Er\nbXlHUmtVb201dkRteVR1VFpoMTVFcTFPSG5NCmlPcVM5cWVJQ0g0VHNXaS9rTzh2\nWTIyQnRXakVCRWRQL0xuVUdDOEV0WEUKLS0tIE43RENWL1M2STF1VzdMcHJTNThh\ndHpqNE9MMnkrMlIxN2FEcjZ6anRIbDAK3rZ1lzO42bH37lb+zoeF6rKoVgI0TBST\n9EoVwom5xOKtmVAh5jobY/z4TGSD1BqQ6P2rQ/IM1Dtw3/18Yk7TXQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age18yf7r0dalnue5vwzanxl046fxsskhu9lzvd488ajhz7rp62mu94scmw3w4"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkdDFsSTZHUG54ZWNtQVdj\nZno4enBaRVlaQU1wNTBEVDVscS9Jc1JaTXhjClA3YUNQa3B2L0JXY25SSHRGbS94\nNVVNdHZ5VzdXcWpXZG1ZS1U4T0NPUkEKLS0tIFJLVmZyazU4dWUyVnpvRDRWbHNn\nZFQ3dlhxN0lwc0loWEZIOE0yMElRV0EKeUVy2QpLHbJ8JUCl07f74V+ZnRkGfDdP\n5W28yiLuq+LYfKUaFYeRDvSVFCQo6FiYJcBPGmnPF5gg1BIUtUUBYw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			}
+		],
+		"lastmodified": "2026-09-18T02:02:10Z",
+		"mac": "ENC[AES256_GCM,data:Oq1UCi+VYuuAkMmVBife740m6fiXC+PfkaQAii+FORyv8Zpj938cPrZzE9z/LO5Ixye5cbUHGRhZr0vM1egnv9nhIFyfGinKyE/BLEOXHxOtHnAXSQOJU2bWiR6w/QzVCTy6vTTVnqD2AtEfbKndIK1PJ0ASLvxMGaRqRsA/juE=,iv:xCEQg6DHV6hbyfBk62bUKA1lnC3HgQtkn2o8i2CFjhs=,tag:Zvt9tomYGoDFDQGjLZC59A==,type:str]",
+		"version": "3.13.3"
+	}
+}

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/yggdrasil/privateKey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/phonebox-global/tests/vm/vars/per-machine/nodeA/yggdrasil/publicKey/value

@@ -0,0 +1 @@
+cf28bbcd822efec197dfaa99fbe9004f78b4efa9724b4f453d05f12a61a0bb44

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/phonebox-global/number/value

@@ -0,0 +1 @@
+981794

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/phonebox-global/owner-name/value

@@ -0,0 +1 @@
+fake_line_value

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/phonebox-global/public-key/value

@@ -0,0 +1 @@
+7291692f9a94948724377fc22055edde8e2773a581153317bc20bd5779736647

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/phonebox-global/signature/value

@@ -0,0 +1 @@
+IwAOYcmClqi8K8EStthYMqWCr6WsxM3nD0CLDRvvb7I3CUyihXBjdghXLutDD/bFsHKzOkDVV/gLnTuRj9IEAg==

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/state-version/version/value

@@ -0,0 +1 @@
+26.11

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/yggdrasil/address/value

@@ -0,0 +1 @@
+201:35ba:5b41:95ad:ade3:6f22:f7:7ea8

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/yggdrasil/privateKey/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/yggdrasil/privateKey/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:H1ngxnRS+cFNSxe9K7C/xNS5hzXyeTWBLZI18TPvEyT5l/MSBeRuK6FZ/G0xUGQAJw4Xo1nyX2PZEYH5wjhnG0UziKAZeM2Oe0G/ilpNbHeMS+HLVriDETlMQz2Hf4Y1J6jOZqSTgFuPMVG5armpZUYTcW+p2zo=,iv:u9sO6eiFzxtT7uImnHLXT3aYJJxgby8d5H2ckfZdNIw=,tag:ZLl7AHHRF+jmr0tnujrpIg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzdy9HVVFoa0N5ZnBDVDhM\ncm1vQzR3MUpSbW9KSjE0YmZueUlsY1gvUVc4CmlqaTBxMTNvZzdmdkJSMmMwN01N\nVGsvUzJ5Q055Tmk2L2ZUNjRpSHp0bE0KLS0tIGJhUUNDbGh1a09aeXMzWkl4K0F0\nZ0dYY1FnNCtkVXRVTVkyeXZPbFlVbUUK3a/V6XP6m8MDYPKwlu8z0cr4inuKGGNc\nYJjQw00ou3BdM/HOPZrMjYHtjg5WdtzYiFCOl8IRkeiDaEmXcOBjiw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSbW9lcXZweHZ6b0F1eVIy\nd2RWV2lkOHpoM2RkZWxSVEFwU1h5aXNMWldnCk5lS1E4b1BDMmRYUDNHK2NhTlVT\nWGpLWm4rUnpFVWNvMHNzclJuemNGZkEKLS0tIGZxcmowODUydm1kL24yVHd4YXl4\nWVd5eWZMZ0dyS2dpTDhuNXo4S25Ha0EKvc3hwrmlP5JcH7eQeRfoq40w/QdnQL8s\n+DAwsajzRp6H3/XVTm+nDQ+Qoc3aenewZkk6Pgn+x43hAh9zwuvGkA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sy8xkmssttcchjj0nkapk4tu530lrzszdp4lka6nn4gzlxam6e2s3xzp2j"
+			}
+		],
+		"lastmodified": "2026-09-18T02:02:24Z",
+		"mac": "ENC[AES256_GCM,data:xrshyxQAnlSORTzxxcpt0ABaNWSCCVnwHl6oPUQ59reumF7BoAy8HmdSyWeEpIKBNo2Ane1xxXBHa62+w58r0WjcneNzy8yIBBwXr1BIRZPX83HrSz3+bENPtj6TPWdHpFZ5aDFM2jVlUvwIkn/4g+1B9FnQtoH8kuYBGe2uGCM=,iv:slMt0ag3Kp3iD89jQa/YDta4mJccKiSqcTCt8C+1Dzs=,tag:o56eg/BSHOtBUeNQqRjQDg==,type:str]",
+		"version": "3.13.3"
+	}
+}

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/yggdrasil/privateKey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/phonebox-global/tests/vm/vars/per-machine/server/yggdrasil/publicKey/value

@@ -0,0 +1 @@
+7291692f9a94948724377fc22055edde8e2773a581153317bc20bd5779736647

modules/clan/phonebox/default.nix

@@ -24,6 +24,36 @@
           description = "";
           default = "";
         };
+        options.extraClientNumbers = lib.mkOption {
+          type = with lib.types; listOf str;
+          description = "List of client suffix number.";
+          default = [ ];
+        };
+
+        options.extraFixedIPClient = lib.mkOption {
+          type = lib.types.attrsOf (
+            lib.types.submodule {
+              options = {
+                ip = lib.mkOption {
+                  type = lib.types.str;
+                  description = "IP address for this client";
+                };
+
+                name = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Name of the client";
+                };
+              };
+            }
+          );
+          description = "Extra client to be added to pjsip config as a fixed IP auth";
+          example = {
+            "01" = {
+              ip = "192.168.1.3";
+              name = "bob";
+            };
+          };
+        };
       };
     perInstance =
       {
@@ -126,6 +156,41 @@
                 remove_existing=yes
               '';
 
+            genLocalSIPEndpointV6 =
+              { localNumber }:
+              ''
+                [${localNumber}](internal_endpoint)
+                transport=transport-udp6
+                aors=${localNumber}
+                auth=${localNumber}
+
+                [${localNumber}](userpass_auth)
+                username=${localNumber}
+                password=${localNumber}
+
+                [${localNumber}](dynamiic_aor)
+                max_contacts=1
+              '';
+
+            genLocalSIPIPEndpoint = number: ''
+
+              [${number}](internal_endpoint)
+              aors=${number}
+              auth=${number}
+              contact_deny=0.0.0.0/0
+              contact_deny=::/0
+              contact_permit=${settings.extraFixedIPClient.${number}.ip}/128
+
+              [${number}](dynamiic_aor)
+              max_contacts=1
+              remove_existing=yes
+
+              [${number}](userpass_auth)
+              username=${number}
+              password=${number}
+
+            '';
+
             genLocalExtenConf =
               { localNumber }:
               ''
@@ -356,6 +421,14 @@
                     + (genLocalExtenConf {
                       localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
                     })
+                    + lib.concatStringsSep "\n" (
+                      builtins.map (number: genLocalExtenConf { localNumber = number; }) settings.extraClientNumbers
+                    )
+                    + lib.concatStringsSep "\n" (
+                      lib.mapAttrsToList (
+                        number: _: genLocalExtenConf { localNumber = number; }
+                      ) settings.extraFixedIPClient
+                    )
                     + serverConf;
 
                   "rtp.conf" = ''
@@ -409,6 +482,12 @@
                     + (genLocalSIPEndpoint {
                       localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
                     })
+                    + lib.concatStringsSep "\n" (
+                      builtins.map (number: genLocalSIPEndpointV6 { localNumber = number; }) settings.extraClientNumbers
+                    )
+                    + lib.concatStringsSep "\n" (
+                      lib.mapAttrsToList (number: _: genLocalSIPIPEndpoint number) settings.extraFixedIPClient
+                    )
                     + serverConf;
                 };
             };

modules/clan/stirling-pdf/default.nix

@@ -14,11 +14,6 @@
         ...
       }:
       {
-        nixpkgs.overlays = [
-          (final: prev: {
-            libreoffice = prev.libreoffice-fresh;
-          })
-        ];
 
         services.stirling-pdf = {
           enable = lib.mkDefault true;

modules/clan/stirling-pdf/flake-module.nix

@@ -10,10 +10,10 @@ in
   perSystem =
     { ... }:
     {
-      clan.nixosTests.service-stirling-pdf = {
+      # clan.nixosTests.service-stirling-pdf = {
-        imports = [ ./tests/vm/default.nix ];
+      #   imports = [ ./tests/vm/default.nix ];
-
+      #
-        clan.modules."@clan/stirling-pdf" = module;
+      #   clan.modules."@clan/stirling-pdf" = module;
-      };
+      # };
     };
 }

overlays/default.nix

@@ -7,5 +7,6 @@
     frappixLibsOverlay = inputs.frappix.libsOverlay.x86_64-linux;
     frappixPythonOverlay = inputs.frappix.pythonOverlay.x86_64-linux;
     frappixToolsOverlay = inputs.frappix.toolsOverlay.x86_64-linux;
+    frappixAppsOverlay = import ../pkgs/frappix/overlay.nix;
   };
 }

pkgs/frappix/default-thai-company.nix

@@ -0,0 +1,35 @@
+{
+  buildPythonPackage,
+  pythonRelaxDepsHook,
+  flit-core,
+  mkAssets,
+  fetchFromGitea,
+}:
+let
+  version = "0.0.1";
+  src = fetchFromGitea {
+    domain = "git.b4l.co.th";
+    owner = "newedge";
+    repo = "default_thai_company";
+    rev = "caad6e77da35c9359b0dbd75ff0f39bb01891caf";
+    sha256 = "sha256-LH7E1EkecNPrhfQWSlWzPHHuJLM6SReCAifcFPDr61o=";
+  };
+in
+buildPythonPackage (finalAttrs: {
+  # pname doubles as the frappe app name (services.frappe reads app.pname)
+  pname = "default_thai_company";
+  inherit version;
+
+  pyproject = true;
+
+  src = mkAssets {
+    inherit (finalAttrs) pname version;
+    inherit src;
+    yarnHash = "sha256-oZgyP0hTU9bxszOVg3Bmiu6yos2d2Inc1Do8To4z8GQ=";
+  };
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    flit-core
+  ];
+})

pkgs/frappix/overlay.nix

@@ -0,0 +1,9 @@
+# Extends the frappix app scope with in-house frappe apps.
+# Must be applied after frappixFrappeOverlay (needs prev.frappix).
+final: prev: {
+  frappix = prev.frappix.overrideScope (
+    ffinal: _fprev: {
+      default_thai_company = ffinal.callPackage ./default-thai-company.nix { };
+    }
+  );
+}

sops/groups/admins/users/vi

@@ -1 +0,0 @@
-../../../users/vi

sops/secrets/adhil-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHFveTNJNWk4\nTjZleFhqY0Fxc08vSkZSaVpnRjYxejRybmJCcmU4bFBzajggQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp5TzcwVWdXd25MVUlHN0hqV1U1Uyts\nVXJOMHM5bUt0RWlVMmRpRWd1UHRnCi0tLSBrYXZlLzRmKzJpVW0zOTdMTlY4YlIv\nelgweHp4anAzb2s2K1F4R0hCS2RvCiUGYrRkes1sDYK52rUceCO1lhmQ6hPjW/sA\nwv/UgJ3OCqeuYC29Hzu4OtC2nLZaFOyRopTgKQ74PfJk3dzuNRg=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBET3d5UTJRNExVRkppSE5I\ncG02V0lDcGZnTmdLRVBkWUlWS3hUaWVaa1NJCkV3V2pseDFQV3RvR0N4cjNqaEk4\naGRkaDBMQnJIc1BlMCtvVW94M0dkYTAKLS0tIHRySkpXMzJiMzFrUU1UekdPUmVi\nMmZiRXBSc3FXMndVNjRqc2xTSlU3RTAK/erwb450pgiQAdYQlrVe32BEiaFIthl2\nUVQTCHQILnxyfC19ZOmlAnSuhXXrj7XdAQmK40DLb0A52QpFC2EP9w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTVkN1STZsYm1aVmtiZHlo\nVDZteEJKWWpRZGRCK09XN012ZVhlRXNnMWs4Clc3bisrSHJiZ0JJbmxkby9LeG02\nY0dSdWdoQ2t2bW5xODIyWEpuMytlYkEKLS0tIENjQnFuV3hBSnNoam1xNzZIVGxD\nVXA5Q1pMTjZKQzNHSzZIaFp2TEY5blkKOjxy9+mpfYGW4SSwlAmZCew3dlN+cV4f\nQaGFYiOUg1USSAmyevmQlGEMX+LvJjhVsVVXXZ+qEhYrbWo9hSI/aA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0dFdWFOdGgrR0hsemYr\nOGpFV1VqQS8vRHA3UURXMEQ2ZDJHcWNCVzBZCitvZTZYdDYzYm8xQzlYNHNVYmRt\nMWNzbitjaUxMSXN5WHp2SVhPY29XY0EKLS0tIGJOSUFBOU1RMHBnQWJsQkg0cFlp\nZ2c5QU5aeDlUMG1KTlMzQ1FPMldTeEUKxyt4xdySOfB8Fa8KjPytjjq0oGgeFBlo\n+uT97/DvDbiBfGaZPaSyJPRP+Mca0yQz9nltCOm7qz68BEjboFKUEw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGliU2VucU1s\nTUNSckREWXFndmZ4dTRtVkNvME5id3poaXNSRWtWMnUxUkEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpaQUFBYVVjcWczeTAxSzFhVVFCOVhJ\nSnB3RmJKbEUxM0NEUjlYRXVUcXNVCi0tLSBRSW4xTUJSeVN4RGdrSys1VU43UXkz\nWWpLMk1qeUdTeEgrQ3pOZEpySHpBCtfbhg5p1A/s6772Kbe8bGjEeKLYJZYCbEav\n+0ZVCW3aAmRBQevSvQI9BUCUrFhaD5TgsDlX04wHX5AeLcRp0Aw=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGU1YU05Y1Zm\nZ0Q4RDB5ZFc4cndmaTVTRXc1MXNmdllocGdVa2xrREQwa1kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPNEJKRkdxc1RkRWJ5d3diQzhuTjBy\nV1VNYXRKV2JXMGpPbWEycUlJSUh3Ci0tLSB2Y2dMV0M2OWwyUVRzZVNCZm91a3FL\nQnlFTjV0dnFhZWkxd2tNOWZScUMwCri3NvW7zXusWvELSRNc4kLfAc6JTbR8q4KS\nqu8E80e4gwng53PpHkmK0pBRYnJbZUf5DPITOy1mrbnNGMh6Nbs=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1YXpQSFUyM0g0Kzd2YjBU\nS3FkWGRMcnJNSnlDSkZlNldpR3lza2VTNENVCmNjT2pWdHRVMGQ3TW1wQm9BdU0z\ndXdiVk5DKzR0dGpEYTNFM291VWhLQk0KLS0tIDI4TkZYTWIvWXNYNGN2emJnM05G\nTHVtSS93S0Q0QnZpcDNLUlRMbUlFWVkKIG6CfJZNkwRjT7lVqisJOZWzswZReUPI\nDFB04ClMfrlStaZxFt2fk6uBIFJPvJLtiHg3oyyTvG1siTcsmOcHfw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEI3YWUzWWxp\nUSszSGNybG9oMitaUXludExlKzVOVFNNVkJteFpadWhtMDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpiTDJ2VGI5VjZZU0xKdTY4czhiT0RP\nbmZtU1ZQZERLNzk0MHpQM2gzdTVNCi0tLSBheWw4OVk5SzJYbW5ZZWl6SFRraXVK\nKzgrODM2alJON1FqTXczOW5JaWN3CpdplHYscbileaUWp0wSuirTOZUefZNUkbyh\nCqwS2/3JZ2IMhAYLfLoeVRbp7OrncmQF7L3KuvPPaE7WjAYwYug=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwNWxpcHJxR0ZVaUNPZkpG\nNE9ONElCVndkVmlVemQrQTE5Yk44Q3llYkdJCnRIYVRDZis5NWYwdEJLbmtCYXVw\nVFJnUktBZzdEWVR4dC9TYnp6bjFNNFEKLS0tIEx5N0hiZ0JIY25FdHVncmk2OEhY\ncEMvdjNJZWFWR0xOd01rc3dvd0l1L00KP2EZ2ZuYBMxXvCgIM3g3otZ8KPYElqqs\nDdmVqie/iKdJckBW3rc1heGOkEdxaxgRvJaLhCZopmLKoi9Cv4pqLw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRMU0NKM2Fh\nQm9uYzYwQnNSWUdReGV1QXFXaXRORUJobURKOTFBbFoxRm8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpSVVgrL3RicHh2OEgvbC9xSzhjKzNz\nYnRIa0Qyc1I1cUhVZmJkSGk5YU1nCi0tLSBPb3Nud0Q3TjZMMkJvRGZNWklQSlFZ\nNHVndHNjZmljVExmNzNYdzRrZmJRCgwWFdIGjZJfugyk8GSk9zPE/cgERs9E48S9\nVjUEetmVvRPj3jOsseyrF8KF4ZAppo7u10WXKvTZOBTDISpCW0U=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFUTg4OW9JaytRSDFkQzJs\nVWtTM08yU2t3UDA3VXJrMm1IZ0hkaEVYTTJRCkpqU1VPdW1OUW5yWGcxU0Mvenc5\nWStnQml4a0NqOTFDZDBiWUp6ZzYrWk0KLS0tIERzL2dXZ21zT1hpNTJhY25PNEFV\nVGtpSUVlcUgvbGZ3TXhvSEJINjM4a0kKwkoAvl9pe701KPwki89jpU2KPr1WlRpB\nbxo7kTWebNlk3kwpF2ZHw1ci2HoNreqiCZ6thvJMcYoH1OwZ1OzF0Q==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMUoyTlhwOWVSNG1vbGdz\ncDJwc3ZTUjI4OUpLN3lnQWJvME0vbzkyTVJJCkJMbXUwbnVDMG5oNjVJR25wSVZw\nYjEyMWk2Y2pCa2N5ZTlka2tNTFVybXMKLS0tIE45akZVUWdsQmRUWFhuVmdhYTR5\nZ1hKVytCb2pvM0c5UDJlVVBUdXNxS2MKnQXRfa5eXzos/rAa3KUNtzKwXWuyqvU4\naMSGMpzI62JYrzv51od2sJVOPog0jrUsaIFx8rp6nuYsqRZ1fmDzKg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE12VDZ6aEhQ\nY01QeWF0Smp5T1Q0UmJmRzcwaFV4cVozeXZwR0xaRUk5UjggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpDMFRveEtVZmtQR2M5cUpUWTk1eG9r\namFrcUw5SVk3QmdNZzEyWU1SODZrCi0tLSBmNHRUaGJFZ2dXM0o4ek44cXFJckVC\nYjJhY2ZZQUMrcmw5YXR3YXlBaDA4CgGT9c2VYZUMxxp9R27R20GnF8wgAHwTyQBH\n5r01NTws2RpnFXgKvLSTqytzPcQMz0Z+r5PUtTp1WlUN5ECjD0g=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUmdlRldqaFFrZWp5eU5y\nSTRPeTVHdVFOYldkYVdKcFl6dklRMXpVWTE4Ci9KWUhJcnREMzJyNExZSFk0TFJl\nYmlVK1E5ZlFGWlJRZWwreVY3MWtHUzQKLS0tIElDNEl4UXFFNTJyODB6UnhaT3gw\nK1ViUzFLYjFTemcweERlaDNnR0FsaEkKJjG/XkynVLGQVdywXn0cM0db7X7aYrpP\nxYAUaS5SM7Ny0x3sEyP0+KdsWjBuHfi/CVsiTdBJ8CDpwkYSrpw5Lg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1aXZKTWs1eS9qRkRyeUY2\ndUZaZnZnZXZybUNjR2d5MDl3Ny95M3ZQQ21FCmRWQjhlck9BMHhKWXlqbm1MVkNh\nbjVuRjFCMTFIZXl1ZTYrMlk0YjBoajQKLS0tIExpemlkVlJlaDN0TXgvTDZ5d1Vi\ncTlVTEh5bXc3NmovOUZNNGdMSDVzdHMKpf1ubA1RBtQzSGVd4fyfsGv3VvhHBMoK\nC1/+KnnquvOKQlHNew7B44PKGF9wiraJft8+b4v3Ns8bfOtrv4GYdA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVnNpbUV3Z25weGFmTVg5\nOFV6cjl1eHJXemYzbitQNW9tSmNwaWdtQTA4Ci9ueHRSMndKVnJjVTFDQ044NEhs\nUEpuNnpSZDJjZzJuNjFMQ2ZVQWZ2b28KLS0tIE9LMjhPUndWNVBMR3QxQ041Qnc2\nbXR1U1VOWUxPd1ZBMzBxbGEvS2tFK2sKGnpSdS9f3sNFLstp8ONYTRqZVU7ujFAE\nqwTq4BJUlffEc9JXnvS/ZaC7O1yKmz8V5coKSHlbn+IyrZPbx9scaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOGd1emMzZkxPRjU1Ylcr\nRlVXbHBnTVV3eU9QU3NxYzBKYUJ5cVg1SXpjClNOYUZBNXMwdHJEVlNoRjdRZWVC\ndTluVVdtdkZDVDcwaGFGZUM4MEE3WUUKLS0tIGlHVVprTjhYQmJva1dQT0ZrdkE0\nNHZZTnhnWi94eURxR3ZCczlCeWxZVmsKOKXVYQAMftId6wXOsI+G/1/xPuVCLZOh\nrDzvaUbipkBTdZ/DXXvXf2f1fDcIqXXtPJyBD7Yh/6+KIPxf8wjVVA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-09T04:18:54Z",
 		"mac": "ENC[AES256_GCM,data:VpfhhVlfPQB94009yErF8NJl+BbhBgc/dAPNyvqQzqORpXsPa9DXjae+giPkRXhTS+263NIglUbPiNqZedj0d9ep78gj/rCupmYcGSsX0gqwFfwj50xX0qWDgs6Z5b7QytDlDPiNOCYM287Q7XLob7CcvAM46Ulo3vx/QKD76Qc=,iv:SBwlzN4PIEPo/iZl/VpkcgNtxqlyNOjqi5y9UGzWQgI=,tag:0/0mKGEQtGOrXYSsn+inmw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }

sops/secrets/alasia-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLK2lYZWdHdzhqekpxeGFm\na3JjWHh1a2ZKVlptTk14Mm1ablpudTlaRGlBCnlEem1ZYkMvTGFNNFc2RGRNSkdr\nUXQ2Yk44MnJlL2wyVHpOQlI1cXFZS1EKLS0tIEVzc3VXYmZ6U01VMXlrdVFKUlI5\nSTdrR1BXNlArelBMVm5oWk5SeUZOYUEKSLWtYHUvkcPYC4h7dnHnWA3S84Tuf8ZN\ns2vwgOcFbm0APnoWQsJy4L3uqGoK5btB/EzgXtCopxlv+6CODhIscg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBVL0ZwMDFM\nVlhpenVGalZ1L0RmQzdNUEczY3FWWFgxVjZjUGNDMkNsakEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpXRXREbzZrTTBEbzJMZlZuQjFoYzVH\ndno4OG9qVC9uMkJWaXY2VnBwYmZ3Ci0tLSBDOVhPTmlTSU9CUTVxSmRiNVdTclBY\nR3RMNVh0UXJYZ3lOc0ZjMWREUkhZCoUDa9889e8Q+mFJEp3NNnROCh8tCOpEqdNH\nYqi+UnNrO8KXgNi+jMkH/rR1lrvdBxKnp/dp31eaMp/06fCIH+w=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwaDBQc1RPaG5nN3NJbTkz\nSEVmd0dlMU1lYTJlNGRJUml3MFA3d3hvdUZVCi8vU1lsL29NSVY3UmZ3dUZwOE1B\na2h6MFhxUVQ2ZmdSUzRUZVJIRnNiWWcKLS0tIExzeUpueU9VZjBDRk1nVzR0ZmFq\nM0NDcSt6VytTb04yZ0pCdm83UWE0cEkKmLmWCFioA6MRExdjkYupUVtR0Cmo8o+J\ns7B49+L20jTQ3ok4b8Qpl8Q41E5i0FD44sO0Yc12ER6Z9OrDOxs18Q==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDgwQ2ZoMHlz\neFJWdnNqY1hqVXF5bkphM3I3YXpERVNPRzYrenJDbEpTVmcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpFZ0NqMmZnSVAyU0g4eEFTUEZvK0hl\ncW5qdW1CcWNPWnJhaTNkNVowSlgwCi0tLSBhUWF1QjBxOXlML1BqcjErWnZ5dlo4\nc3JQRU42SEhkSFVxcDBmbmpCQndvCji6mMl3vDHlhYgHtBdZaA0iDxqX70jMCAww\n0SpnRzgndSeBQFVxs8Nqa4Lo3ti7juLg7fRuEXQIxq7pYBESj1Y=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGM4MnNxWXhj\nbG5XVjFGZERaRzVHV2lEQVNtOG4wemdaR2ZPNzFiNHVXbVUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpGWGdVL3VlbHpFc0dvY24vZmFlL2ZO\nVXltZllXQi9LZGlGRmdIQk0yNmxZCi0tLSA4eDdVV0JuWnNmT1dLTG0zTFQxU3c0\nSmJvV3o4RzJ5WkRWVzJWa25VczFJCgQe4ow0UVMnRZbQtz8W+uPst0IoKcJThU8x\n0DwZO3J7wL9kCL1Sd2TPYKBRgcBHGvEa/mhOvIoURmNMhEXr0ME=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMzBkbjUwcEFzN1dOZkh6\nVnlWdUtPNUh4ZXVBVzlXQmdSWnFXdC9BMEhnCkNCU2Q3R0Qrb2czU2lEMGR6d3kz\naDBZQWlrajBKYW45cHRUcEs2eGdhRjQKLS0tIEtHNkU3TTdQMFd5OUhrejlwWlBR\nUUk5RlRyZzdJSnowcWJ3R1VYNUtTNm8KPkfnali8SglMAwgNva2aQ5mZRyMtXQbf\nb13HJiDgpiqhlTJuzAVchiqtwvGFwWKyd11CbkQstlVCCPDM4ZWrTw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHFYS1RPNzZR\nMUNYSDUyU3VjTGthRmN2aU1iRnBHN0hiNElyZkY3ZVRCbncgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpSVXpGSmt0K2pqclVwVmlzQ1NiZklT\nTExJakx4SEFpaGgvWTZaMGUzamx3Ci0tLSB0dkdENXYxVW9hM04xcXNjYlZwc0k0\nNWFuMUJyV3VrOTlvNTN6WCszRnFJCmvToGBQ8FjCA/QwHLCfPPOdEkyFkKTjinZ9\n/XBrzAYGiLbsa4UCCNsw4WTotNSa6yKM4zsiNzi8MBKFXvuTIbc=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNlV3oyZ2Mx\nQU1qMytLQ1Y4K0FaZVpwR0Y5eHpJN3RBL20yTjVzYnBVR0UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo0VWdKeUF0R3ZRZDBNUE5LTTlUYmVO\nd01hV1ZJdGVlR3l6emF0eGdFNThjCi0tLSBkNWlDMWUwS3N2SDY1TVpQNVFWdmUr\nT0N5RERxV3NIaDFiWTdvU3dDdWxBCpC9Zvjypga/Ul+ZbLoZw7S41Wvq8i7mxewy\nUOOTCpcCbBaCn24Z99UssHY3GbVygsz4554nDAdqmC+6s5bJxa4=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlUUJwUTBlWEtEZkdxSEdu\nQ0VsdkxTeDVrVmFDclhjZDZiNHI3SXdUaW1jClFaR1ZYWGt6a2tsUjhaN096cnBl\nc1p3NnlFeDQzcEEra0d1Tk5YSnc2bFkKLS0tIDNvbXFJcGRyY0FGUzVRRGpORjVj\nRzhackJVcmtXcTFnOVFCVkpzclFwNEkKLFuruNcaMxUxzYAFcBXlwTAnmQp+GeKw\nNOgTGf7VC9dlel/ubzU2jrI0mMkOmnhQ9adigwzIWvMYjlIPQbUByw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRXpwQXk1eUNYNnAveHoz\nRkdPY2JKbmVBZXNjZ3ZtQ3pFT0ZjR1lIRVFvCllVeTltNEcrQjljYUUxOWNOa1lh\nUnYrMWI5czhxKy9Dc015cnFUd3dDNncKLS0tIE5NWEZIK21QdGhjUXc2ckNvNFBp\nSFJpZ1ZGNC9Xdk1sZHpnaDlEYzd5eHMKmsMek5EezKKiyG+9sVNwK92TJ5xdM4mY\naWzz8iFw1lkeJ3iwK5da5iPFolO6C6Sk1Kf2Mst84lklDKE6dtiwxg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxMG8yWTN6N3JhOVJhSU1p\ndkw4V3FiTE1TN3YwOEJrZEo3cGFYT3lNaGpjCjJFRTBvM0dSblY2Y041SlRTREtG\nNUlYYy9XS1RoczRSd3lyYWxPcGxlck0KLS0tIGtKc2xRWkpXdEFLRFY1Z2xLL2ZG\ncFdFdnlUWjRjczZaUWh1ak1LZHovZUEKFH/np8OI1lOD7VpN7XNW5qcHxcvwAc1b\nwrsds3tIh0IJcWrLCQ9c4WIMpzbisGpja9p8N7MBlU6zhPEXscwXKA==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaFJNMjVPS2c1V2Zkak1Y\nQmtybk1XSThhZXYzTWZhYkdqYy9CZHQ2Zml3CnJPeUtxdWN2YTA5eHBxVXNBNmpw\najYrTDUrK1E4VjFHaXI3Zkp5Vmdwc1EKLS0tIENad1p3TmpaM3MzMzBvSXQ2eGNu\nRk9VZFFKZk9saGpHQzVjRUpvRWwwaGsKqjU3CjfNLuzLAf4uCmzkNbwZRkxDQuaK\nshnCgn26VQq5De8+QDoboYKOW5Qnf5rjMhKrpGW69C7fir5QIpe64w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQWRMRjdVaFQ2Ujk5bXF0\nd3UzanVNRDdNU1RvemFNenhFdGZuV3V0cFVrCjA3eUs1QjRqallkUnZkSmxDV0g3\nRHlUQ1RmMGV3dStZN2dLbHRVK3RVdG8KLS0tIFRnUzVxbnRMQ045N1oxMUZPRUxa\nT1dlL1dUS1hEZENIR1pleCtJTy81QVEKgnG0Q1PqlGbv0APDkFB5cG/GzwVfimhF\nXys9RtYqGoQoY9V59lQ3ziI1S+2itjFKGdHHlyedv4IT/aY2uW8kXA==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnaWV4cGV3WkhiVzU1WXox\nenR1ZGg4M2NiYmQwTEdFaCthS2dCbXVFTVh3CkFFdlkyRm9KYnZRQ0svaGYxR2ZK\nc2d3anJWZjZzdWpPYWtqMWpWTnZ5V00KLS0tIDFyajBoemlqYkhCRDVKQXIvaTFL\nRkp1YU1SZWlSa3l2b2IwN0dMQXo1bVkKxdaMlyWnIDt3e4ckZDD9Fqbc96GHFE9i\n478Ar+UAllWQ5IT2iDFvJVv/FUl2H8PX57aWkbSoe9CvsoKvvA8XrQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRHVVlZWFlT\nWHpqdW5nR01BRFZhK1lrOWNIVHgwa3hrYVI5bDY4c1A1MG8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwprSjh5clBEMWVlYWNmbG8vTXd0VmZm\nREdGVW9kMGZ2cXpJTnpra2tGY1pJCi0tLSBTVEhnUnpXOW55ZjBRT3NtRUZ0dFZS\nU2VySlE0cHRTZGdSTkxIMWVEVXJBCmDXdGJJacQ12Y2NX4MeauzUhcbzUM0hT5Bp\nD9GRj3QM9VCjb+Nt+4lrohvrG/4/1CEiic3G/75wphymsgSFlpI=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbHprcnBIZWZYcmQ5b0Y5\nVW5SN2ZFVU9rSncvMzF2WW5pWVZKWnBBNmdrCkpCK3E0aGIwSDZ6YzRhUEcvVnFw\nUW1tMFhjZHZSSW1lSXh5QTdNNGdrbjgKLS0tIExwMStRdmt0ZHhZTmRYalgvSVYy\neWVsQ1g2eGNhSXVLaFFOVXNmcE80eHcKoABIslKMdmsaVJ2mvP+xPUVp0ZLwdUPu\nfOKgZuyY/LRILRosZPFX/efxI7qZx04xo5WMA++IrB03FFH1DQ6F8A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLL1lMbnJDVmRERzAvZW56\nbGR6MkpzYk5DTnVTY0xEWVZ5WEpkVERzVEZVCnQ2b010bEorOFJhOVRBMTVHMFFj\nUDRFWWJ3RG1iYitYS2J0YjFYWW51S2MKLS0tIG9LYStmbEpDZlJUWFlWM1R6dE0r\nVGRBbXhIczhzeE1zOUZSRlZDOVJ6cGcKAziJF6QrZtxkrsOSdJ/iEp0WcHKNtjWA\n6u8HAb1eRb9IGZmibauCfqOBJMmPLaPDYpbQT3XBb+kO6sMMHE15Ag==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
 			}
 		],
 		"lastmodified": "2026-05-12T10:32:02Z",
 		"mac": "ENC[AES256_GCM,data:UherYfiTSm/qJ1gElQYS5LagP8d+6s7726HdCFk1xAkdPaqF5u9Jzxuqi/W6o6J2WO0JdgnMOWs9VUNhQbCpFCsCukUblrFZyySA6jhSd+CT4RbJ1UFtFUOjyEdEiRuxB+ARW8IuXcNRg8XTgK4GUw7VWPGSwq5JYjuvGE1GOJY=,iv:r1HgjnlTHZU8jbN/10NJmImaw/wZihwzfdRYNvS6RCI=,tag:uaZtEAdn7cTRRmVeGrSbZw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.13.0"
 	}
 }

sops/secrets/almach-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEx5bVR6OTl1\nbUR4bXI4ejVmaGtWbTBMUXJ0N0RTRFBVazdNa1duc0xBRTAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQphb1JkK3dDY3BlY1d3ellPcGYyVTdE\nd2NKQWdReVpaMlZBaytVTUI5dVVBCi0tLSB3RGVSRTNKN2E1a0swTTVoYmVXcXdt\nMktHRE9raE5ZQWl0L2RWcWpsTzJZCoaCy6C4O/IzFUVqvjlpc8v0U1so+tWy1dVR\nuGj2w3rOOhj4G3th1XTnhyKckk/FYQMc7eqtCNw/aoeYzTbM4xg=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBObGdiWjBtTkR3alBDTEdm\nb25kbWY5WkFUd1dsanZ5M2FjQm11TnBVdWdZCnNOSE45cFMwallGRVZuMTdlVTBO\naTVnS29vQk9QZVJyaGRzTGNNcUdGQ00KLS0tICsxZ3NtVlVoc2FpQUMxSm9uZWF3\ncjZXcDVwZ0pUcDlqOGN2aGxmME43NXcK28S/SKkLgXJWQ5sdDxcGyoO74e0MaxeM\nx1kGfiKJBLqok+wNOPO9SFHbWY/ITH5RdV8iLchPBe2VM9IuC0nZ4g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNmtWVXMrL0JqRmxMcktL\nQUw2azlReGNUQXdDbHNMYkRIRk5kbzY0QkdBCkczaDVjN1BUWk1oQnNJclNHUEJE\nRXB5V25tb1lyWWpZQU5pSVAzRU9TME0KLS0tIHBITUg5YUF3eldrOTJNY0ZHOVdM\nTkxlMm4rTU80YVdxT2ZUeElzOHVEVFkKazdHvtc3uvlSCT2KpsoYmUbSbPlC5xz5\nuWTUX0wf9ewy8t3WIwAwLZDw3PW0DNvSWPIf0jWkYXowrlUR8O32+A==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsb3dPMGhpdHE5SlBQK3hu\ncEJqL0JaZk1rOE5MS0krUHpyMUNMUkhyMFdzCmM3V25vS3U2WENycmZIRC81Y2k0\nSEJTekNaNTFMZy85VHh4MENvbUk3Uk0KLS0tIGExYUFNVlRZeThQRHlKVDZWU1Jn\ncUNRd1cwZU1SL3BKOGZZaFErR3F3NkUKnILS6XWSl2MaQ+FAZvRAZzgJxL4OWl+v\ntDxXBBCapOeoLgRH61Q06JnDjgBCz14QIROgZP9Zji/HsdSeRiKR0A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDd3bEYwTzIv\nVW93UGFkTVNtUU92Rm8wcmdnR0JIZVcrd1NiRWVDTVlFaEUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpsZTVVYXBpV2F1V3JKOTZhdDlHK3VB\nRURUYTg1c3QxUy81Qzk3Y2tqTDRNCi0tLSBMOEpYVFhoSVdWTVYxUVBaSWdOMUdW\nZHkwQXdMNFAvOUdWVnlSNXI3UkN3ChOrOyjJ/Gcy6Rxannu9fOinfrUsj9SuEbmp\nunSoNcB0pEM4wM6e/JofVBTKvtZ2VeIn1ms+MiNR/JizQxWbJsA=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEhLejJLVEk2\nR0dtY0FJQUYyd3JObitPdEcweWVUang5ZUdEcTg1UlJUMFUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpvUS80dk92MjBnN1N6Y284RGE4T0tR\nemN5Wks5dS9vdWRBTU1YYlo3UXBZCi0tLSBEb0pmU2xGMFFjazZ4em5uT0wyZUZW\nT1JqdjZjTDRwUUJLNzAvYTFreXp3Cqfcpn+UlJE63ymHbremaZ8X+wDDQw3gPGmX\nav9dmxfLCPLwwTbd3e8N98Jnc0OwGUiKTavtjpph9ygThvo86jE=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvd0loUlZXbTFFcGx4U1ZZ\nWmkyWXVJZWlJNERRWFdpMG5UTUxOelpaNmlVClVaREdlemwxTEJvVDMra3FNY3hK\neGpicjRqZnJod28wTzAzRGJZbUIxaHMKLS0tIEIvcW90SUVvZnc0RHlBQUVIYzVw\nNGRoTTd5OHF1MFNNRXk2d1RGUVNPQlEKK8pSsxseowIbNXTVUA/G3otDPPdTETdg\nphv6F7RsiBEGXFqlQpvg059DeFJFT8Xjrqknm1j04uGQxN9Ty+kUlw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNqaHoxdk83\nSnFNRXg4TzZLY3BSOXNSdWVrby90V1Q2Q2RRUi9xZGZ2Q1EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpZM05YUEFYNEVRM0FSYkpKY05pc0hq\nWWRzTzFWSUZRNmI2NENDL3RyNVkwCi0tLSBPMURucGFSdHJER0tqUlRHb2NmNmYw\nVTZsN295QUJZQ1BObERGYjlESGUwCuYMMiu6NyO8Q/lvBHI7muzQOZfaL3Ny3S3E\nE7TlShnbLEsDxApvBV1KJaiYY21Z+1Up9DM0xQskFBYQCya3APo=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUmE1alpPSXpiVndtcEh4\nTHArVkJNSGp2MFNXZ3BGZ0NnOC90alN5UFhZCkNUMEVCWDVsWGRGUjFCSGF1OW4y\nRlhrRWFlbUYxQzdsRHcrNk5tNG9YNkEKLS0tIHJjRmNrZzRvcWRKZGswdHp1Zkkx\nSnQwK0dia1ZBSGxRQ21XeGIzWWkwbkUK5rThaH6WAH9PXLINKTkv6VsKgJOA4zO1\ng+lEE3Kxy92FI8hbov543t54R3YvGxorRekyqqqhvhYwOfEDYKA5Rg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEw4eHIya0RX\neE5Nalk3YWs2R1ZFcmp6OEIvSDhPMVlZYk5TcTQwbXBpMlkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpYMURZbG5lNlYwMUdVSUtsRlJqWEhj\nbHdvZVdpTGt4ZzhRZERpWWJkbG5ZCi0tLSBJMG93d1ZPa1Z3WWVDSjJ2ZXEwRDJD\nQ0cyQUxlaTdycXhGVVRzSnAvakJvCgoORUSoqTGsS5hvnV3hJNIz1Y9pTR7foSz8\nXMd/f3TObHeokHsejbxx2yMDLPt5fD1MWc5MioLyMNMpwjqq+T8=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4OVI3eUJKSUdVRHJzZUdP\na0FQdFN5TE1iSWsvUnFqRHZSdGx2MFNrT1VrCmlZZEZlR2w2M3h2b01YTWVpRHRR\nVlJCV0h0OTdMTm1RczdhRXhoYVRmYVUKLS0tIGlQMXNlS1puMS8rV3p6UXVaMU1U\nSE9zMkkyZHI0L1AvSU5KZVhRQzJNaXMKRhx7txNzoPgk5/k/uLsJ6kTLB/Ketb0K\nl2IeDtLQ+jvkkwAtfwGrJWJ6fR8VkfWvW2kClBuYMJws7qC8QbchdQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvYWZ3a1ljTVhQZFNHTGxP\nQnEzdm9QM1ZqMGZEMVF1UzczeG5LYW8wam44Cm9GKzc2c0M4dEgramE5VlBQK3NQ\nTkdlajFFRzU1aXorV0tuL2M5cENQRkEKLS0tIERWcFd0MXAzYVZOdlgxSDcybk1O\nMkQwM1l5UGRVaHdtNCsyR2Y0VXRSSkkK3Bmoxs/GeybD/cwQf2d8QGdTVa2tfKXp\nTExxPuwsrb+/uaooHbCefv35r8jAmH67fJPM8IjyrcmW9HQpvL9R6w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEI0NFhuckxS\nQ3AxSGtzQVNQdCtFV1dUUDR0MkI1MC9JVGxXZUJlZFMveTggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpNZzBsa28xeXhFL0p2WEFVbzdNRFVQ\ndkZMdlZ5cjBVZE5iMDgrY2lDS04wCi0tLSByUWJvNmpBVGtsejl4R21ERmhnRjlj\nb2dEMDdLeFgyZGVnaElqL2RURlZrCtci44/ANGXQGUpwQwBPFCXJzM8ZlhQEsymr\n8/yyb57cpn8ZDzVlBbEwlE5h6k1jjiM6IdORSf0Y4GatguBOWLI=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5SGlpbnpUejhLVVNBVWN0\nMklqalJvT2NTL1VhcVIyUDRMQTJ3cUdHVWtJCmpWV1B6QkRwUHZ6K2pzNDJFSmpi\nZWlpNXo0aXM3Qlk0ejlMWDZ3RXFLN1kKLS0tIFYyYnB4VmhWQUoxNmlBMXZQT3ZX\ndW55WktEOGhua3Y3a091a1ZLbXV6ZzgKqQ9g37DyZNJDyjarEKqnftB4l8JCyCpx\nVJLSsjC4kvQCMhRsgZuLZaoICNRgOQiPIW8+N+bqNQ/WxcoOZM2z1w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVZGd4MWNxaE0rcS8xL3lN\neDdsdUlmMEVWUk5nKzhwUHpWZXc5VzJaT0ZrCm9McThNUTlZSkRVNVFjNGx4SS9V\nQzk1bnNRTmJvdmp5d1d5QUxpTk16YXMKLS0tIHFDbGh4MWllSUY1aUMvMnFRNk1t\neHBweWlvMmhJaUw0VTk4dXZiNWNiZGcKAquDq1StOGfI83c1EBBuCV7H/sG/bnRf\nS9EGOmrDYnCJEiKCDvbaY80Nbb0AJvH3lugBwVNWcDxmuT6hFimBxA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z0x5NUJnK2RqYXNzT2l5\nbkd1UWgzTnFpcFQ1Y2RPQlFKSktRV3kvcFFrCkRyOXRDNHFHY2QrdGhrM2JEbzQ0\nb0xPb21qd2NjRGUzVUhBdW5sVkVld1kKLS0tIEVNQUwza3luSCtEblphYnBlbmJT\ndm5IMVJUc2hBVVRrZEROUzI0YllRVHMKIq8EbkeEXMDDh+MEQqkU7BtdlMTmeGYn\nHgizD8RFh4/0A2MifmMD/9OarqSNQXvQi8z2rTVctLMcLCfuAf53uQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrOFFUdmRIQjVXblRGNjFq\nUmNaYUgzY2hsaXRrUXRZQzFrTWloUG5xbnh3Ck1hYWJXZytEQzJjWWVGblZ3WGhV\nc3FSNXpPMVU2ODdDL3RNT2FTT21iNXMKLS0tIC9xK3NGRnRudVQ5RFFsVGI5MEtF\nSlljWXhUVXVhc2JmZ3k2RE43ak1ScGcKGaUeC/5UFHVLu9NETJTIVsOd+NnXphZ0\nQImkKtlJXxQ4OBJWGP7Ybm5h4mWiqqVWIrkodyH+qo1/EyOwZ7OjgA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-03T07:06:11Z",
 		"mac": "ENC[AES256_GCM,data:rEbXQH/lqWkL6EG+DoRNQtNTY0rIXQDR5aK/VFfZLCQw5RYTOdnnAeK93z5uV/jSJ6PdwCPFLbCKF34+aKwSS1xVrLp2oZb0aK1J85sP5V41+r385rxB/0BZP7dk4IaAkEOnU39qoyo0hCYROJ95V+97JhdvV7Y0l2zXypdLuNM=,iv:MqXHtyaOb4di969TLoAyhl0Kpo/JsfUU6pS9Jwes2oI=,tag:2JSV57+uAEQPNm8ODmCocQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }

sops/secrets/alpheratz-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDlubEtKU3NO\nODdnTzBRZGlPRFJ0d0hQNEQ2bHN4VXF0Y1RDMlhhakk0bWMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpEZkkzL1B5bFd4WEpDTzJTZWNGUSs0\nVDZ5WksxSHgvQk9sK1ZOc1lsRWlrCi0tLSBUbERZdElWa2hCOGdvakIzekxQU1VC\nWnZqdUQ3bjVOcFZWRjVYbmJuUThjCubHPVP5xwgzi+KgNSQiS5qKbDhjekJ7/aIM\nub0w758JxU4JcvL7R3EpQCujmoav4KEgzx3B6S+b+nOu+Y4DPMo=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdFhxQ2hndlFoS1dGd2Ns\nMVFJN09RL2pSekZ1bTNuSjFyeE5QVFQrUVJFCndabkNqdXFESTQ5TUY1TURhZjcx\nb2RrTGUxQUFMOEdadGFFMFMwMUIzUVUKLS0tIEh5Q05SaWRJbHgwVC9aMWsyUUN3\neVpnRVQrUjM3Y05KbTRLR0t0NHFRWTgKbMpXKBQJhHedMYbDB1/N7ASUJ5m8bM7X\nuC3BSGXUmrH81krmnbdaaMontpllUtpdmDd1hYOAbQLVC3UYADfbCQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsS1p6NGF0Q1NkN1dlYzZO\nVFVEUFhFTmFmUjRSUU9xQ2dKL05LNStObGpVCmFDQXZjdmdvNWRreEdoSytqZURa\ncVQwKzl1a1NVcXFCRG81QXNOK0loR3cKLS0tIHM3a1U1c1o1cDh1c1NDa3pBV1Jj\nS01NWjBDR25PY0tBdEl6ZHlWR3VkYTgKVrRMylzjIlD5Z+H1FfCXxwn3W1ACXghH\nOHjq3GRunWD1xnksZ2WD4b0dZu1vmzLSvURHZTXFAIJF55xPBgqngA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxejVIbzBWMFYwTEJyWUZC\nK25GeWNtWThUVVRKMXJnQkN1blFFMVJMVEU0CmJGdURFbUVYMWR3d1d4ak1SWFlN\nSHVDYW1yeUJwWUZwT0lMRUgvQmx6c2sKLS0tIDVIb0h4VnJPTkhlcTN0S0dUMmp0\nRXdxSmpXQ0tkZnBUQ1plMVI2RGNxVFEKGnJ5y1umJbn0qP5aCGs/AAuSJMRl+cIB\nfI8wVSGzeRtaoryAIFD/b2STSfBDyjKOkQOQXML+YEsEwqLlCufWKA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDh3NHpIYjdL\nallGVHN6TlZoaEtCZlkwZ0Z3VTcyTFMwM1dENnNocmZPU2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpCSTNEYVU2MGMrUU5idy85ampFeXlC\nSTFWYlRXODhrOUZMMENSN2V0MGZvCi0tLSBUQWNveVJDQnUxTFFMQmR2eHp3QThQ\nWkVjaE4wM1E0VDEwWXYvbXZtUTNNCg37LCamDQadO7OZDGPySOLdzBFuRuERINaU\nsMK6aJ7BJ8TrSfPYuFiJHvK4/t/Ta9tJcvUz9ab8jGms9vYdF5s=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9GcTYzaFFz\nLzduT3BpTFhwUGxyMkdSMm9oL3J6UGZCcTJ3azBTdVBnUk0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpkanEzVWo5b1N0ZU4ySWR6MHBTK0tJ\nL24yV0FLa1lId2JPaWZ0aU01MVRBCi0tLSBVRXJxMlVhTGZSajhBZ21TT3Nib3ph\nSnFSdDlpbmg5dW1oNnlkSTVTTFFNCs2S1wPrTFqeOx1kvMPiRJs99VbXZyU2j5yY\nU027yIrDzqpcfqcWx9FjHNtDJzJM/150dNkwieheGCOCaHpyqnI=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUaERmVTRsU2lHMUFveVIx\nZUM5UUFuUHNvSUpPWXFRSGV6dzNocjg4UWlFCnNUbTMyNUlldFBRRUZQRzdpWlZ2\nVXZWZUZJeFlDaWlOclp6bWNVdjExTFUKLS0tIEFrV2JyU0VOemJMYTdMSkdmK1l3\nV0dJK2xUWjMwZVUrWXp3SlV1SFYwTVEKFRpWBH6LNhX4taH1GfaRid5ueoNb+Ck8\nWw4WWxI3KyOLxOdxj6yKYNvcn3ogpKQgHIA4jtxwmE00NP6LIMC2pw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExsR3l0VWc0\nb1h2K0tPNjhFaFhJTFREQXR6Q2gvdjZSa1RKeWtVWE1XZ1kgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYblNDNWZkM2lnUXQyVjYweGZWUnJC\nS1p1N3N4RCt4RDZZNnRCSi84c3ZZCi0tLSBEUkQxekp2alExQWpWSkVoWmpia0hJ\nbldabG5LckwwOVlHUDh1cXUvMjZnCn6Q1+kL5JG2org5bxIa6Y6Lgu+LlTyM2fhp\nNmhsoxrah8FGCsBkSNRwsVJE+RxalkUygQ+hf+ss+dDPbDsZ2oA=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDV3A4bjZvU2twWGdUSkVh\nM0dGdVlaRjhCSEN1dlRkazRUY2lpT09XaFhFClZPc1ZnT2F3RXZaVHhQYUdtU2N6\nRVZoa2tlckhvNmlaMzdBdjQ1Y29UMkUKLS0tICtsY0N3UUR3TklQT0syRnlMem5k\nR2JUejhLT0g4MkJEdlUwMXN4aWs5aWcKfDofFL3jFvj2NYkg4emfmd181MeDe4ZD\n2VEotZJF4qHzGhpjiiE5KGHjIzVDCADbI0wfj8z5lKA9n2IxjW7V2g==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDk3M0J0MHFR\nN0E0a0xXN3ovZWVWQmkrQ3RBVklSTUwxQ0hmZWwyVDdlUncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpLdUFNYXZ6SStzc21Tc0JoSXYyU0x1\nZW5FbUtGVDh4RmZHUEdGWU1sbnVzCi0tLSBneE90QWp2d01xekVvV2p4RVAxQ3E1\nYjljWk5NTVJWYlI0UXVWQ2J3RkVvCkmNGybBIyBQNh2q5NOoyEg217n6P6a31XnL\nB8a778HPbmT0mhO4QvYn7R/duo07s+vu5mRm8gc5AkCpXiMNkRU=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyNS9tbWdYUFVGQjRZdFR2\nazBwa2VSeTZJVEJleFI4TG4wbUZUNlo5KzA0CksrWFIyb2lDYzhHYU80ZHpBTE5x\nbFpaZWhwSnRvZzN1a1c3SDUwSlZ6UWsKLS0tIGhKRGFYczBRZlNiamhKNTV6N09k\nOXFsdmpiYWhDaUplbFFEb1NnMUlqcTAKmTdcxJCMkGshqJ4hXchq5vUi4pHu+JZU\n78bu20KhkKq4ZZfSrNKNNVq/o+3Agb/VUw9eUFJJHWYCIPfEVsVzPw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dkNRTFpJcTJJVGlmMGc1\nOXMwRXVaRVdlN1RxdWx1R1AzQkliZjZkbVR3Ci8ycGxwVElGK0h1N1VKNFI1dGs3\nS00vd0gvRzBpVFN3SGZRaUVONG9ObjAKLS0tIGIrN2RiU3J5Ukw4SE9XU1VYYSs2\nMUw2ZEowbW5LZ0JXVnZOQTAzZm1aRWMKoM5Dj/mNrSERSCgZTobwMR5Bm1V6L3Yt\n104IQPfZaRv+eSNoKFv3mTL1C/sdRWR4wevQ5rvR8E/Y3CpymM4ZRw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDdVelcxMGNR\nZWF1N3VoUEQrNS8rZGc0Z1BwbXNFbWVkbTRtTi9GZmlDQ00gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpWTFhud3dzTHRkbDlGWUpEcG5BeEp6\nYW9mSGlZQ3pjNVhQbHZCYWUyaFdZCi0tLSBpRjlRMEFPdmhRNU1MVCtCUHF5RHpE\ndFo1YmplVUdSOHVWNTVXRHdXZG5NCs6FuexvoqFQxVNihPs1jPQQgf0b9I41VXDx\nhNF4lGAbnC3icqtHol4azl00RgEtoPE7z/mR36RTMx7ygeNR/5I=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ZGtpZm1ZYmlQRzVId1Zk\nTTNCT0N6aTJzR01tSy9LWTdYbXh3Z0tIeEhBCmQ0QlhDRzdlSXFlWkQ4aXRNQk5m\nTUM2L2J6NzZoTDZpaG0rSVJrMTFsdlkKLS0tIFI0Z0w5dzJOV1orcFcrazdWcHpz\ncDR2MDd1UHdIUlgrblQwYnd4aWVvWVEKJ8U56ajnsWdp96ARKFw1zdLY7z5zhgFZ\nMnd+j5VpjIn2AtIS4w27A+2PX7x+ZysEnnE3K4ndX9nSAzk9shSxpw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQUdWem1QSm9iQnZNOXVM\nVkpDOU4xSmdVd3EvVHhCa0s2N3dxc0xUbUI0CklrZmNJeVRRMTZqSEljeXRES1c2\nN2NKSDlsNVFGWmFmWlprSnVqMGZpcVEKLS0tIGdMYk8rcnRqRG1VUkQyOFFHdVZ5\nRWczMFEzdTlCY3Q2ZXpoZkNybTErS1kKb9/pcCnOz+Ijnp47t50h8D4588f38t1q\nOfbfLvAGgkvCq0vOQv3+MVarmoPeameQWwFjBfB7itbZzQDN1zFePA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxbXkvSERJZkgrM20xMW43\ndmFFWXFZVytwZm43SlkzUFM2dkZQdU9sZkQwCmh0bStPRDVOYnlITWdFdU5YNElk\nRk1uWjY0QTc3eUdSY1AyTHNTeFdHeUkKLS0tIE5MV21kMlBYbUIxMXJpZ1Y3VktI\nRU1jWVNEN2NCWi91ZHVHWk5CUnpVVzAKlS0amgC+dhZE6TExIGUURr/OhoudnZLf\nfpMXhkGbl5YsTm0Qeqaqu5bNo/XN+77e01WfDwRz+PYp7QXdhMN8XA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvaUIrUHpINE85SVcxOE1r\nU3RnQlEwMERnbFIweEZiblhPdEE4YWFZaEJjCm5NVGJYL3pQMlYyS29xLzhtMUlQ\nUlJFTytkNmk1YWVnTFRuQ0licGptQUUKLS0tIGVkRnpWQ0FwUzhVbmRNTWNSS2Rs\nQ0MwMElRV09ROFZ2YjB5cnEybzJ1Z3MKeOo3uU9D9BDJB8m9cZccIj8zztbvGqYV\nSWvR5AxNLvcEkbNKvxcDRjQUSDLWhcjdcozs7JgjO5P7YlOnZNACmw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-03T05:54:36Z",
 		"mac": "ENC[AES256_GCM,data:06949qq+AgyxgVLVx9ARvul77ypg8Kq3cqpFOWU/HARR1jgkf7n66SWTmVixkfHy5GqOJEBFQ0HYHzKkQ0BHr94se0bFlR5W+Md6pmDVH0sbnB4+leqR0I/1ZU7o6p3hj1nXlkUWRN6oM0wp0Hj3ClOPM5jZ6C44+cadswCQvGg=,iv:5TwgpN7waxevK8nnRaO/bunyjGNvFojXPPIPp1OrRuA=,tag:vycrcH1t7ZPsyqekae5Q2A==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }

sops/secrets/b4l-age.key/secret

@@ -3,16 +3,12 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByYkhyNzJJR0RzQXVPMzdR\nbTRSOXRKRmFKbFM1bDRWYnZ6S21ZcTZpeVNRCnM2RHNBUWVFbmxVWmtHeDlTNmtD\nMUpDeEtxRXEzajJoSXhDN2poY1JSc2sKLS0tIEVIQjJBS21sMmFFOG1SU1ltRnlB\nL3NwZWpzVUY0NkRjSUd4Sk1KYmNwd00KxqY6xtPZHhWrugdwjWHBfzKveWE6K+ZB\nUGd/7M2+qoiktGGr70g9Qho8x8hrdeMRz2v//jE1tudRXmZpng0rUA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsdnlFYjVtdGhHSmczV0Nk\nN0IwL0dLVTdkTWhIK2tmV1E5bE1wZjcyZkVnCkV4VEhlL2lyVkxXMzFQVTZ5dHBY\nSUJWRUh2MjgwZ2RmaVRFVHdmQm00ck0KLS0tIG1oTlE1alJDK0FuNGhDQmcrKzZk\nWDhZNEJIWmd1QkVJc0pLemVOSjhqQ2cKMDYUbT8wQ89mNBJFYp2igHB2aQtxBFtM\nilUU83E0stiVKWHrCnBlmQng4UDr0rPxOWa+JpbR4bSbLPXyKIPtrw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUbjlmaytjM04rUXpUcjc2\nclBobXlYVGZwTk1WRTdoNTBrMHVpN3JNSW5ZCjlRaGNxeUFrZGpHRVlxUS8vYlJV\nTFVGbDd1QXhhaDlWQ3pCR2JBUStIdmMKLS0tIE1uMEcxb3JHbVVyWGRqOVFhZVBF\nb1pJU1BPeVZjb1VPUkRxUnhJNklhYzAKCbsNEPbM2GfImjUzN19u4APdA1DgWkhM\nqR7cDPTQiF6CQLXF+FDrQwPnGSTP+Ku2fkvsfDS9KzMK2z6oIJ49RQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxZmVHaWRsa3Y0TGNIM0dx\ncThRc09ZdU5YVkpWdTdzTlRXa3pjMTRVd3lNCk4waktab2lzNDJhZ0hiOTh5MFVu\nTzR4clA5Mko4Y0o3cFMra0IyTUUydU0KLS0tIC9RWXUvMEduUkp1VXpSdjNUUkQ1\nN1NuTFY4ei9TdkVjK1lUQldOVG9sc1EKFwRbPZyd7TARXkvHD74DGqwvxOjIty+X\nBHFw8H5CWp2FCCQ+9bebMamG3ShzhM21Hju9uVbMXA/WACU/9dAJhg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOekRKMG5VdWpmcm96WEdK\nTnoyL3piaCtxVnN5b1E2RXh1SzZ1cGU3OFdrCjNNMGUxMDF6NzFUNFpPb0VNa2Q1\nL1VacitPRzU3MHh3dXpTNWxYeGFxeFkKLS0tIHV3TUkxTG5mQ3haZVRSTTB2bFBk\nU0dDaGQ0ZjhEOGdqZTFEQXlPczZWdm8KiDHBQQRL4qTnStFr8nmdhet+7gBELCvd\noRvky46oEsS36L9o477ZH134wrSqAcD0NCOO06hA/jEXNvLFig9yHw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T03:23:25Z",

sops/secrets/b4l-age.key/users/vi

@@ -1 +0,0 @@
-../../../users/vi

sops/secrets/bosona-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VzdmcXhvQVhSLzJwakFE\nS1A3MjZqNkxJclQvTlhSdXJsKzY5QTJ2SndvCm1wWWdieGJ5WXJlRTIxTWI1cTY3\nZ0Y0THpGSERqanRDcEZaODRWQ2pUNzgKLS0tIFA2bXJDc3prMzV5eHduZFFMWnZy\nYUt3VXdESFRZNDczL0diZVl4VTducEEKkVTuEYwEO9g0eE49iWG8cgabWHoacUwR\nHSR0fuHOiOuN48UnDbGruW5XP1iiU0PIXnda+mR6hWft7iOgdt/o0A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhOdllwaExP\nYkU5OVpPMmEydjJsOXhZczluSXQyQ3MySmcyRGlQS09teVEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQphSFFJbHFqaTFLRTBEN0draFVRUTRx\nS1FoamplTTkyTmlJS0tScXdCdDNrCi0tLSBFUWRCSUltbW5IcnRyU1JjdzlDTXgx\neGROSGFQSDBvbmRVbVVCdmZNSGEwCnOr3VuZfVTTCiRj5sKlgPoC0+0DgoGNRRt+\nF2ZXGzOMhr+2+lDjzU5IywPcWWDcw304wqmPMxmaYVb4jVp7tWw=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOcjZpN1RXblZsVjVRc2V1\nYTlqS3JMOEYrSVQ1RTdpbGVla3FQL0FDWkdJCm5EOGRHeUlhR2VCaDNsYTdtUlBa\nUzM3TEMwYXk1SC8rMlluU254S3Q1RTgKLS0tIGZTM2Zhd05xQ0FkNUJGSE1pcjB6\nc0tzaFdmRzNCajFKbVA1Z2ZlSXFvSEEKVf5pbev34rn8b1yorJIXI65fxBIOjj+u\nQVgtPx7w/3YaS4zHOswlegRVHdbbNTucpdNiX1LrxZlTFFgiDTxsQg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHpiRUpYRHJN\nMWdMV2Mva2sxd3VOSFpxcUwxdzQ1QzYwV2xkbWJuWkQ4WGsgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpQZGdRYTE5OHh4Z1hOcmtaNjhEZ0Y0\nUDFIMjNFQ2dLdm90ZC92TC94Ri9rCi0tLSBlSDZqQzhXZHhLZ1NyM2kwR3JIWXBr\nemU0dzUycTc0RWZmSm1DOElzTFlVCjRGG9YgYcohjXoCFID0w6K0+BgKGxD81D0O\naYeen4musWzwGLcE1nQroRJhZ7DtcumDgSL/Du5UsNEDDVdQQ9I=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZ2WWxnVnc5\nM2FLVHhIMmxYUVdtOGxvV1piQjgwTit6ZmYra1M4SnlqZ2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpucjhLczltalZXQ0lyK0cveUdyYkp2\nMTMzdnc5UUE2NENzaWZnVm9sY05RCi0tLSBycktLalJXNVpwQTQrRUkvZk1Iek5B\nVU94b2dxenBCelFTYTU4aVlwV2xrCuy6vEvX2lWY52yb/1PutSuJnSom2XPCabb7\nUoPrAmSwRACarHTujJHRClGL5vOS7mNagyNXoJJT746UcszyyAE=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUSW9CeDB1bFRhN3RXVGgw\nL29CTmN0aUlUQWk1UVZUV2cvb0hSU3BoekNJCm5WWThkOEVpQmNMRHdtMUxSVUx0\ndzhPdnBPY0ZYQndVUlFPWWlDZy81dDQKLS0tIHhyVHYrR1AvazcxZ1RtcDVsNjVW\nRFdTY014R0oxcjJFa2k5ZHdkd1VrelkKU/hc52aQ4Jb3AFfc1d1Q+ra4Pnzm3tkW\nXe+IjHedHHZrHC3383do0oRrCSVzggItfcTZ7xCONWF0KI16m0PP2A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEpkcmFwR0g0\neXd6dzc3K0ZPNzNrVnB1SzBUTkgzdWx5RDF2V3c2Z3RWM0kgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpqcGFmZW9ENkE1N0RLSVBMKzNJeG5V\nVnV1WWt5bW1YN0thV1UrZ0hxUWNvCi0tLSBLb3YzTWpRTWU5UlRIR2JpY0kzdUg0\nM1NHeVlrcEl2NXBoaWRFa0VpM2VFCshLww4utpSguBV3PV+In9XLaZj/pAy68oW9\nf/T08lfZibWWdG/qUN1FC7xzOaLVPHRv/EXtI+Xcm/unxm8cMGM=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHFSR0FLd3B5\nZjlpeWdJS3B0aG1PV0RuVXVxaVpXZU50UDZSekMzUHRUME0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpFYXNCOExCQkdhYnlYQVU5NVNHVmJQ\nM2pUMld1TldvMmw4a0pyOUNpYjdvCi0tLSBHZW5NQTJGajhqOGdnR0dVaThLVjBo\nOHE4NEZRUklMQW5QS3JWWHNhc3ZJCnFrQQJTnJfhQAiSnbcjtmQu/Y1OZMNDFlxx\nZ99ATnj4hQ4Yp3j18i9Yk4HrETYOh4ikbrTQoV9y6NSzh/6JrJ4=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdThkcFg5UVYraVlueng1\nYlBjdjZiL0NGODJQelNKOGJYdUtjbWJLc0FZCmZSS0NCUittdmJvVnNqbWJNZTZx\nWTc1TUg0RTFkcEU5SitpOTJwcFpnSFEKLS0tIDBKcnBFVXpjRGx5aSs5bFFsbjky\nNE94OU1BWXRBbC85VVl2TTFwcTRHRUUKY7y21ryifqxNt+Sx7TG3N/ZtT8pTGaug\nv1w2DO+7eCPbtxTq+QyKCmXMgxwoXNiTvxddSBhympALrb3b+BKxxA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjdzRpVUVkT0dJTkgyaXYx\naWtYM0RBbnFna0tlM2I4dWhLQVhSanEwV0NVCm5yb2QvdWc1Vk5yNzM1bkM2elJ3\nMThxK0ZRVnpkYkZOYm1uYXQ5dERpSG8KLS0tICtVaVdTaGJjaWdqT1l2Uy8wZWV6\nUml4TXNZdXB6ME9aQnRkcmtaWlNDZlUKXA0H46/EPWHkESXzeG1ZL3+RmDLeRkwk\noEi5Po/ut8xotW/FZNi9ja+DZ6qYIj8r6C3yDVD13z4rYvx3ytwUgw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKeVk0VCtIWmRwVDM4ODhj\nM2kwbXFhUWVqTHhZUmVXNHZ5L09RQThzOW1RCnpScnp3MDZJUjNxdWQycDJMQVl1\ndmxsNGVjbDEwR1RTQ015dDN6SFVRbTgKLS0tIDhXanpadFpIYVFJYkRQS2VMU2I3\ncDBZOFAzcC9aRm5YMW56VEM4djlQa2sKtmWAfexQmERb//bbmTNtbaqwZNl2GMZ2\nVY9WAJvh8TOCJASB09jruH84I0nppcIkj1rEaS0FVgaMHFtsn6a6JQ==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDS0djeFRYaTJCUnhYSUI0\nQ1dXaDR1TGcvMzFvQzZxSFZOa1o2dHp2NjJFCmozbzZNemMrR1BDcFExSGZINE92\nYTUwbkxFVlVwOUNkRXR6WU1xa3haamcKLS0tIGRxazR6cHM1QkRoK3pXRDBEbnVN\nM091cnM4cENkalQwV0VMbXc5MmtrRkEKXtoZMTL6WuFmnkMHTirVYjBMUSS6K5sK\nMa1dWqcjvqoQdZuMoN0mgun9te0tqperKRjKEBQyJyR6jrHcs3EGvQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVb0M5a25UNkllNlV1dlln\nT0ZSVUptT3IwdERSSllEM0J6c0JOalFOUDM0CnlwL016N3hWRi85Y2lZUWtZYzRE\nbXB2MHA5RXJzWFN6ekJGWWc4dXZVN2MKLS0tIFMzcWY1bXpPQWpPWUcwdEdYV2J3\nZDgrcmpXdEpCMGlHYU9RM1p3NS96b2MKIhm+nD0zCpyaDvOCdoWT1dPWwxAJ7NWH\nOtP61p5dzWu5TQC/054Palzcj+BQvHcjuanpfm7lipihJ9Gy13NnIw==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5aS9hdHcyTzlIQ2UwZ24v\nVndnWkU5bTloZ3VLRTM4MDg3ZEFucHo4L1NvCjFISFJvbnVMa1FmSFU2RlVGa1lK\nZ2R5ZVZoYndlKzZucEJSSWtrM045c1UKLS0tIG5CbmN6ak9ybThKN3pPZUZiMzA1\nN3VLektjdVFaRVdrd3hyaG85ZkNqMGMKimqul0TQ3ldYQItwnDgDF/vW2GSiCBRf\nDOuKlnvEZ7h9PqqvzClXzg/12QP7vZM+UJYXULK8nz9BdEYUStPBYA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDBpN2tTTzNX\nZkxqVHdLRGR3MmFGTlZxaFBONGtic09NYXk0Z0Y2eE4xaDQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpaWTFmd1pEbGZENjQyOVJpdmRSVHBV\nSktObXlhRUZXNHZHMm5XR0Q4SHNnCi0tLSBvUjVuWERMR1ZkZ3NscXZlQzVpbTJt\nRCthb0FNM3lEL2lPU3UrT3A1OWdNCjPcm5FeD07BZpaveNpkTd2dKo5054ZcOwIv\nGeiY9ePzl1Xj+yFnSFMGBUsTJQ2wVkDJmtjZkTmwMvx7SwrI5mA=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDS1RSeldpYUFNT3ZWbGNY\nQkcyVDZyb1JVQktLQ0hISi9Wc0ZCVjJtVlJNCmxyYSt2YmhRNFVzbUFEUWlrbU1u\nOVNXZFVpU01jY2VYMkZIdzN4Wlp4cWMKLS0tIGdZTEgrSU9JRlp4Q2svcDBodFZx\nT1ZlVE55SUFyRXBTVllBT3BwTmNGTTAKDkjB3Sm1lyNbf2vREHtXfMYzbdMpxbuS\nywh0qNaTh++J4HUOCg0h8UMDxopTApG3Acrivz/qrMcn9HVDuukpIA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBodEwwcW9JNUs0eTJDblFk\nU01talZkUjRncmxSanU0ZWxDWE85Qit1ZzNVClhiTk1WVnNnSXB1TmxJNGowZVVE\nSzNYNWlTSmFiRkFHd1ZDVXRhY1U1THMKLS0tIFBCVkZ5NmFmdDlqNGt6T0dVeTdv\nemw2SmhQLzYwSmN5d0Vja3Zkby9wbVUKiNNuHyr0WZQLF/GO2vVsGIuO0x+nRRQn\nvLBK3ahTSV361iRAWAP6x+e3Ir/p3Mkv8p8fozyG5ckupbZp7voC9g==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
 			}
 		],
 		"lastmodified": "2026-05-18T09:55:00Z",
 		"mac": "ENC[AES256_GCM,data:0zsNfYUyZpsH1Sl+Y1JWR4Aq/nskVWCqQVC7t+r/HBPjUuy9adx0L9wVw+3EcLtFJ5Uf9hLkfNDMlJh4b6H3lJoMfNOENCUdMWnxDKpkdN7pkLyWx3r5LOlASgVvEemaArzQ+YalQnvB042LlCeWDcglmlNAD90hvcbTSytmhf0=,iv:PPnmiH72xNV70GF+NmnvNh5yWH6Bb3ku/7GmEdummmM=,tag:Dl6xI6jSDWcFmQ86CHIYcQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.13.0"
 	}
 }

sops/secrets/buna-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHhvNjltNFFz\nN2ZzQlJSQnhsc3psSjFvUzZqR3A0WWtoaVdFbWRKd1h5a28gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpxc1c2TmVGK1ozbSs4TDRkeEExaFRt\nZ0R6Q3ZqUmkvOENEaHVDaFFGYnVNCi0tLSBBNlJyL2E2d2pFVWJiNzM4Z2VwaEpD\nL25CMi8yS2ljN1h0SW5jSWJHRHFnCrq9xAfqdcz88Hz69owcZz9WJ/C2FVKz91O6\nC0ACGcSd2WCfjQOti3cRaXtq+0DredPF3undpR85MOHPL6UL1ms=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac01oOTRpQWFRaEhqM3FK\ndlpQNmU3d09pVHhxTktCeXRPRWVpZ3dzRGx3CnVLckkzQzlzOFdwc2FvTWF5ODVl\nSXJ4di9CcU9wcHhvNmdJczhDSTZMMWsKLS0tIGRrWHNINjRzeFNPZVBtcm52bmZv\nZVFJT3doVi8rY0RyOENRVEdVNjNoOVEKBwhAaM9nRfShEF2B2N4LBaY3WA0Jzib3\nZRXnpnaSVlbnCqJIXU9bYMA/UIQ7b8bRR2xQ0Y+gMabBI0Dzf6TmoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTMGZZNzZnd21CUyt1UUxP\nVFgwK0wvakN3UkVKNHZFeFM5L2F5OEYzcFFVCmpkSzJ6eFdpNGNOdGRRMTdFc1Jw\nd2hJaVE3Y1RoeEhzZTN1WlQ0ZmU2SzAKLS0tIDdVN0g1c0ZwS05CQkF4MzRLYVFG\nZ1NDUFNwVmFwTTNPVGVSbEIxaWFTajgK/ZJ2hCrpMAWc9g/B0UbpgZo+I104Chwv\nnZyMjWmtX4Y+DL51YxToLSZfEyF57vWSKQNFxmw/eRthDIksOwOqVw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWc2p2NEFFM1NrUllYM0lN\nRUJhQzJXZ3N1ZlpsWmo0L2VneFdnc25KQVUwCkQvdm9leXlMVitQNXN1OHpWM0RI\nZG16bHZVZlZlNHl0UERhWTVpUithalEKLS0tIHo3ZEdtZWo4QmM1SUpuMW8xczg4\nSWFtN2pWS05wdGlQWDZHcFRoWHJUR2sKzy85bPbem51i3FUzhTgk7eEVDbOF3vgR\npbINpu0LikVOrYOgop8cxU94QBWbS1VQd/kCIAYot1jMZs5Xvf9L3A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpZbUN5NUhQ\nQlYvc1J5akN6R3NGRHhoZGNMSVBraGNadEZ6N1B3VjdFM00gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpNSjhBY1dScnRTdGQ5azkwOCtqMEVN\nSktoYldydmh3UGNwSE93eHBEQ2w0Ci0tLSAzUVlhVVFyRW5XVE5jSFloVE1Od3Jm\nT2diNHRSSzhXR21Ud0I0OHkwcVI4CrV8w3aN46IBWWAnLE7FhBDzjfObgHr9L/VO\njFbYe02DrcgdIV6nyuYxfeaJFJEzZXI/XvT61xle7kkWPhwCp9M=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNFT3h4K21F\nam5aMStNRHg3b0dFZm5tYmplSmxFRjBiakJJMExjS2poVEkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprMG5MSzk0YmlGaHpySzZFYk00eFpr\nbllMYmxkMkU1UlNGVWVYWHB2L3VNCi0tLSBCcUdaem9VYStjRmlsOWx3ckFnd3Nq\nR3BRTE9SaE9TQWs4VUZCRmQ3UmgwCj/4vmhRs9W6U9ay6mYFxPd6SvOTvxvYn/Oo\nuY7/N3PVpXxRK/UwovEGqY97AG/dEQk+I0/5AowFGmfPURpqKjo=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRk92UkxXM1VOb1M4UUhF\naWJBcjFJZFRXcmtZRXlOOVZiSGFBSTBId1QwClVBMEF4QnJOVzFCUkZDc3IyOVpR\nUi9oYStTQjRGem1ZQURPbUlMMW5XSVUKLS0tIHlWLzVyRkhrZXkweUFoTlRFWVNp\nZWVLMWdNUkFYakdCWjFrT09FTUc5Z28KLJswSZjTnOmX433D6FEfvx7JJtFdcNyc\nJcbh/i/x+1CiFtEZJ10fKnuf6y7Ut+HjHFqMOMST+UKW5PtYHgjZ5g==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGRvMUlHeVhn\nU3BhcEV1bU5uZjZqa25ydHhDOFUyNUQ2SzRadzk2ek9YbjggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYS0Rrb1poMTRDNmd2eW5QSWJvU1hB\nYVpTYnF1NmQ0SkNsa0xCNTh4bEYwCi0tLSBZZDhMZ0JsQ0dPQ2VWYXpMZE9Fb2FY\nY25qNFdFbVo0dURyUHd1MDl6NFlvCjFQKnkAmGuTioiY11oEgdD4Ctcw1gFF7xR1\nk9RV6JRXe8YeuWYpQjS17vQVR65TpJukYWm9UYy3NPP4Xu72toc=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6b1o3UjFNWTI1ZXdhdGRk\nS05PQ3JONjZGdmxkM0tHWjYxaExoR0ZrbndjClp5MHk4QmFGalF5dVI5WlZWOXVm\nWFJGNkhacFlWdVc3VjB4WitXLzMxdlkKLS0tIFVmNUM4b2YwdHVFL0hVMjlSU2pE\nQUhkZmVkNVFzZ3hPU3lSWXJUdkJ3R1UKUmf3beqPvqgOJ4KQaT7kyCCelT4LHEFe\noCxC0QvVCfqEqOiFkE9DTYcqFi780Hpe81PwCqwe9HfovAc4U/7oyg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5HdTZDY3VH\nVnNvNHE2blFqM2pma001OGRWdGYxOHY2UkVhVW44bDdGUVEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjNkdSYlppQU51Wk40QzBlQ2lzaFBR\naWE1NDNOa21uNUNNWFBZWTVtKzJBCi0tLSBOWE1vUDZtVzRLMVdOMXBsNVpwMEc0\nTmwvZGVHd1Z0akJhempkZEdVSmpFCsnAxyLUrUbyMSBvak3VXBSdR5RmmL7eBjnM\nrw+kRLE8NFVwFiCZXgZDBlB2FkVKYvaL/hxsn4LYi3k53U9+vD0=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3SkU2aGRPZFhZclpqMDlw\nUURWTFIyNjNFMVBVMXJFNGllN2ZhSThMVDFZCmY4VTIzVGw4VVRoVzZmcXlHUXpa\nT3dsdGpwL3dyQTVaNkMxTzVoU2JlY00KLS0tIHQ0OHpnekVUWXdoYm5RaURDSUhq\nR0VQUFREL1I3ZHJ1a2xhekQ1T09HZEEKqyMKgxQmPUwSZ4AJsXeOJTFtWcg7NTiI\npq8vTg5rDrBoXHBeA6NlcBRh8Env2Dwxi/PRlSfRAqWQ6bXM+Fj9bw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmOUVPQ0RoSG95RUVnK3hC\nTHFEUHA2VWdadlBoNVRFNUl3Z0hOcjVXaVRzCkRXRTczZWRmenVZeHFWVVBEK2Z3\nVXFPWkpDak84akhEaTdkMjFUcmpnVTAKLS0tIGJLZFQ0UUVYeHkrTCsyYjVHcDQw\nUisxV3RVSEEycGhoSkttaEVXaTV0cFkKKo+lqTI+k6WDdPbMNo1owWH4/RoBt9e6\nmGO+sjziFzrZWUXx4RilR2F/3afRA/CdjzPab9I1sut3I6Z7FXNjYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGFxS2VSS1pI\nQnRsdWU4STBJWmFtZWpGZVdacTZyN2MwQWJlc0xrdzh3bFUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpsa1pPSk11RHpPVndaQjE5S1c4MUNp\nbldBWFBvbXBJZDJwb2hWcHN3T25FCi0tLSBmWkJTZ3NFN1VZSG85L1hKUGFtVkdr\nbEdHQjVTWmpFbXlKS085aisrSS9ZCpQZhp8x8ty0suvx3N0+50odu1wKxkTHgacd\n3avyMu2Dv2ukwa9D6lKI7o0B5Dh1jxxTMEmJby3NhzC/ci9vyF0=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscXI3NGV1R3lNQjE4U3Nj\nb0ZTNndORXlIY3d4bWVWYzRVTzZHWC9sV3owClRWc2tRaytsQkxFazlyOFU4V2RS\nYTEvY2swdDRnMGowdzZESTVVeTNkN2sKLS0tIFk2alJHUkwrMTVsdG1LQ2pReHA5\nTllyMFhML1JJdWQ1NXJkb2U5K3F4K1UKn6OPUfym5f9aacaHq962347dNeTjBfK/\nAMXPZXs6DawU8vko1RqIgzX/7StrITcXGcFfTutmpSa3KjMzuzeb+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWEM4cHhUMWg4cXhuT2V1\nbEhrVGtxU3U0UEpxUXg2OTBRc01rRXcxOGp3CjJSenpwVFBETDhNc0dTNkpDaDBL\nZXhUM3FTOGFPUXFtajhhRTNFNmlxTmMKLS0tIHlPdk01UVF0akFTZk5UR1diYlFp\nRTlOQ3dsZncvY1IvY284eERKYXBJRkUKadHRt9RjwAg3HhOzEWoFmHqyLmPxspdf\n7NRqfmXLkXEo8fmBrZCy7QwGdhb7uO+FGiJTFH6u7bUyIlIuAdorqw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1eXVNcklwZnI2dEtRaFdD\nOUVON1Nxd2l4L2xtYUtRSHlXVlc0VzVhZkZVCitxYjJTbDZDQjNHc2JrWmFaaEp0\nR1NMUEllalZxeHRndGxGRTZGSzV4TkEKLS0tIDhNZ2x0amhKdk1IdG16S0RLbWMz\nQSs0eTZ5YVBGdkdxYkhweUdMVVR3QVkKmau0k5SxJD/EURq6Lp4aDMYCoCFLOo/I\nRj5mAP4YGIVTU47HJYNcPcwzgwA6YVqVOiKaG6yyU7u1DsddaZHdiw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaHdMdC9jeDFWdktiV1JC\neDlFbW5QbmxVSStMZTYvak16K255TnZzMFdNCnFuOFlHVlYvQStmYWhITWl6NUN1\nOTdFdjg0OWZhUVd3NjQrcXQrNm9CWFkKLS0tIG9VWGZhUDJGWDNjTVg1bFMvVE5u\nYnkzV3QyczIrK1hLbUV1Q2twaDkxNm8KpHCL8htFz8UeMLsXmDUz/nAdTYsRSka1\nuq+bFkrVexExxqXJVyIXf20ceziFG8t5on8OGHDCOQsst4HEgRqyWg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-10T05:04:15Z",
 		"mac": "ENC[AES256_GCM,data:wJ646ZAfUOSwXnkIUDkvm4wz7uaW4U7bCkC/8uFuoTwY16F5+1N7AxaSE453w2cOCJE5qOAXORYj5M7J8o84LjLWYN4+PYjCcU2ulL9rug29fNblqFHG8G1OdHwURep6sGKfvsSCTGgpnA5fYmXucYWIqc27cQ9HDtiHw3Bojas=,iv:L6xUGwjihD08Ahc/3WoA3tZDXvllmNWK90RpK7m+4Pw=,tag:pMynp2rs42lenOYbLQ0c0A==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }

sops/secrets/canopus-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFtNlJtdGZZ\nL0F1emxLb3YwQUo2dlNHWnIxRG8vUVJFeTNURWIvUFVVRjQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpaU0RpZW5iWEFXRCtOTVp0TEh2a1lR\nTHVqWUp4UG9aVVFhTnRCOVIwa2o4Ci0tLSBxbWVNWFErMXArZnk5TzBhbGtvWjBD\nYmxNR1BvNFNpVllETWNLd2R2KzdJClf7cuTi3iF768KXBrOM8hrkEXToB1ldfp1R\nRhqqmmOVzumZ3RuoVnZWPuu1kQDmRuvvNZxqbMgmT/IC2iQbc2o=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNUU4MTdlQmRQNDUzTDdL\ncHhzazgyQTA1NnZuWGJSbTZLQ291RnVqYUFrCmdwNmQ3em1sREkzRjcvSmN4a0xi\nYkpXWmVyV0hlSG9LMlBXQUg0eGdneGcKLS0tIEtFQytreFB5QTZiQnFGZWhneDlt\nM2Y1TnJ4TWtLQ0VPYUFPb1hDU2FtOWsKTGdTMNjgYkhREx2u5Cd2kHIrHXOmgaXv\nxYx7TTXEsRBKPpELqyh4KrjkU3TulIN+aR2TTV6L8T4GPhz7qJRRcw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRGNkUUE1bUlKTGplSkQr\nRVFqbkp0WDZYNDNMdXNxVVJiMTRqV1lBUDE0CjlBb3VFK0NnSUZPb3I1NDlVb05R\nbGZ0WFZVbnAxRjVoYzNWVnhMVDhvdzgKLS0tIE1QaTBHQ05VOEtYZTJsSWJyMDg0\nOFc1R0xZeFhubTRQM1gyc05aOERoTHcKbAlKbX4/2CePvgFigUY8MnxAknYrPCqt\nXdOtUSm1FODK0h80Lr/ZyF3kRQKD7/SytGfsPiOC5JG5sZrPWoOazw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdXhYSlRIc3hUYUliRG9Z\nZys5Uy9nRFpXUnYxOXdKcGR1M2tyWngyRjJBCjB2R2Vha21nZ1hGUUErbzR5YTRG\nVGtNdWl5ejJ2bUgrS2tLTTByZzE5OVEKLS0tIHBBdUdrZjA0ZC9waHhvUzZpYS9W\ndkw3ZDkvOWVZUk8yekRJMkxodndhY3cKiM6SOGBJecXw6VaFx7ujyjJcD9gTZXll\nkx6CPjS1P5ur3nAxSRBXlgZ54rqv+gjJlhJzXY5+aCGtmuOPUIUUWg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFBxOEtKSEp0\nRGltS2x6K1l4ZThQM2hGOGJNdUt4ZjdTVk5lRDY1TUNRM28gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo0NE1BVVhiNCsxSzRLVVFwMHFJUDZY\naEJUbGUwaHdhMzdXR2FRUmtrdlRZCi0tLSBIQVUyZlhLNmVVS2oyL3RuQkpWYzFU\nbS83RjV0TUFuaFZ3WGtLWGFZNVhFCidQE4EgNJORKMZiMUEIho1Y57b77Ov+7xGh\n3APkMvv2Dz0GecxFC2HEPql+Gts9VFgi0rXyevI3BbeYYuol96U=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFlGRGYyZDNL\nZHc2UFRVUDB3NU11RWhVdHFPdDRTSi9VclNQaysyMytsaDQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp0RXpObEVJVHNRREEzR1R3bTBqN3Rm\nM3hXSWlrcWcxMlIrS2d5bGE3UGlrCi0tLSBZQ1hCZDFwYlNIV1RQK2s2SzFHU2Ja\nWENHL3FCcnNhckFsZW5jejA5Q3ZrCrov/P24IITo3YqDnxDq866Z2484tyGSBVWj\nRW9vd3DSFrN86pz/eXEinzOlEd0Y6G6g8Xbdb6wYDhb3jYLHkXY=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMb2EzR0pVbVVyQWtNaVM4\nY0M2NldVZEtKSEpaTHY4NU5TYWZ5YmZHd21FCnVXQTlsTmU4dUlyR2FQSDhZR1lV\nWmNPRGRBb1hJSllWa2NSU200TkcxM0UKLS0tIDBmSm54dVkrUXRCTHFNeG1RbEd3\nWVlseDRvbzNRRFdDQTBpL2hOWFFqQzQKl2jR49Za1Bc5pF4GLqIyme9xNuw52jNQ\nSSJST+wtobCOw+xqeSr5i1ET9AwS2VYf5Hcyc+/JcTK67Xa8vB7e4g==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDN4dHFEOHl3\neHYzK2k0cWlLOWlIQ1lsc01CMWw1R0hDZUxDR0k4RE50VncgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwphRTZweGt6YjlHWUFWRHFabytZWDdI\neWR6YjFVUk40T0h6dnoxRTZLRVZVCi0tLSBZMU4vUy9iNG1DWTJRTWV3bllOam8w\nSjg4M0N6bnlwMXRDd3FoVWlCRVR3Cih+vMcCAkOkX+uWjKW62Jyj8jv5K79koJcz\n6Yh3eAqTrdJmdscKL75SBoD5BmD0Gtc+KE0gC1zKbHcQBkf6b4Y=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtSENESS84VndvTjJKZHZF\nMENBYnFTcGROVzh1VHJTdDEvWmlxYldlSnpJCmdRMXh1VVJ3Q2llbHZBZFFnS1pZ\nWHlyRWxSVkJXYVdzSGNhaDJIWjBhZTgKLS0tIDgvRlNYQ2dJcGNCaitpVnI4cVlJ\nUXJTdEU0dS9NeTN0dy81cHptMkFUY0UK7IfjEhXhYZtW61V8xTTHDIbiupXiA+1H\n55G7aNC20L57xqE25IKeNOtJ2Q/2mhcwHp4EioXdaaaBsWIcG07Yhg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9lMmFoc2Fa\nb1UwYzlYM0Q1T2c2WGx0T3JXaEhsM3ZFRFRURnNQRWlTekEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo5QUl6VzU3Sk9saVR0QmduNEVVczFB\neDdnQXl2bDdNOUlVanE4NVdENWFvCi0tLSByTm01ak1yUmFqczlsM3hGMlVtOS9S\nM0Qycks1aERSNUJpWE5MZ3U4MnEwCqebnYBNh6vYos01PJoTnUW3caGBCHrWs0aQ\niXGBFaiAgg8m27zSGF1E4ctQ+VgvlI7BWypVpyQMRw8SAvGxx08=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdUNhbmlBOGN4eituRm9V\nWlNzOTcwWnVzNm0zU0NaL2FuZmd4WjZBM3hnClIwZFZCaURTbUlGZmVLM1d3ejdi\nT3QyNG90WlFkKzJtajA5Z0NHRkFUY1EKLS0tIGEwdndlSE1kc2l6Z2pTMDdKV01h\nUkV3K0pXcUVSc3lxNnZtVGRiYzNlWEkKkF6xzjjCLYU/dD247NyFg1AfB9v6vXrd\nRaP2sXa0h/9EYOAoV60ruupLuug+d8Wwfy9DK1LOG9m0YS++DbNPCg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWU1hhWktFbWc1c2gvN1BM\nU0VrZUZpUkc3MUVUak90SGZxM1hGb3c5M3k4CnUydmVyaUN6UFcxVXJ4eStzbkt2\nRjM5QytuWENCUHJOeEtRM2I1Z3FnY2cKLS0tIGw4WHh2a2ViOTB0OThHTFBLWFlG\naUVXaGpONmNBVHBxejlxWDNSTWtESTAKc2y63StRLBsUByWJJGDNOnuoEP3SLy8F\nlUzHSazowmPAdVtm9gpIWTlnLVnJylY6k1v7TYalejkKl8YXEEt8GA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGYzbmJzTTg5\ndUxmV3o0c05pbnNublZMeUEyVDFDWnhGRzJHUUxjbGM1REUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwppem8zNEZUNHg3ZVlSZnB0NWRZazFo\naTdPRXhFOHBTbEI2aTNRTzNmWlVVCi0tLSBnMjY0QUtCY2hCNzB4OFh0eGJWUklZ\nVE00OEE5d2dWUUlnVHVUV0lBOHE0CgnctO+ym39ICt9RtS042J0EBQXCRd7i1prR\nY7cS+//L6R9skWaEQSMXvFLsmftftH9WawVdnqXmCPOT1Ci4kNY=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByR2M1ZG1XSThWYVN0SGR1\nT05VZmZkK0NNTGdNZjAyMEpmQjNEWGtOU0RRCmZHT1NlSy9Qek8zcUU4SEpndmp6\nYUJJZm5aeTNON2dBVElRMjJadCtsN1UKLS0tIFQ0WTBtY25XWCszOXM1VmVPSTZY\nYWJmcEVRd0YwK3RIUXRLYTVNd0ZkZWcKr5f6dCExSjlmClZiDjJylDWr1ccZkpCn\nhhjOsqA1vtayolowqvWheN2fysIg6NgLMZ4R9cedLahVcMfxk+2HGA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bVlwSys4QUlBSUtSYU13\nSnd1Y1N2QzVNWmYzUld5SGovVGVjSDd1SlUwCnZ3MTlkUW9IdldtM3BxYXlDditl\nVUFIamEzdW0rc3cxQStBekx1RVBtZUkKLS0tIEYxOHNNVWJaOFZjVkdUUmlOckRU\nT0NUVHkrZDJ0VWdTY2NUOWJaR1E0UEUK6RhNImrMpG52kwqvR4h2LXzHhxQ9+IdI\nVJ3HX6xdT5MkuHBtvubXzje4zMlrTGwQC3zeh7EFpvpdBIVt6NycuQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSEYwTVJlVjd1cjRPT2Rk\nQmphdU96OXRvNlRRd3c2alNiMVMvK1BVZ3hBClhsZ0NMVG82TEdibzFTQUVUVXBX\nNG1MbEk1dWFmdGxvVk5YQ0ZDTjJ4OUEKLS0tIEJJQ3o2ZnFqZmpsZGFrSis5NXBF\nZmZrL0RUVXhzMDhPNFBmTTR2VzBOSGcKPANYws4mekz7EN+ZjhfO5feMldFNDRSe\n1m5dGjswL5IyKpiE3wOlQAlkp8y5htYKbGdzwv0CxF8UYLGqVP8Jzw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPcStTSGxCYjdLUFJhNnZL\nMkFCQUxVT05rZE1HVWJwdCtOd0xsZGJXckRVCnhWQ2Ywd05TMDVKSUdoeFl3RmNz\nYWRLTGxsYmtzWDFydUVZOU9aTVkvTXcKLS0tIHR1akVGTzQ2dVFDQTF0VlZNT3pM\nRDVmc0w2bjR1QiswcmpkUU9hYzJEUUUKC12h6SCwmtfd72aNwo3eGwvYrwtK3ryI\nlB/xr6ZR02Vcc6y8tqpvTq+86TUw+od6NgqpATU2KOni8rZdWWnBJg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2026-04-09T10:50:52Z",
 		"mac": "ENC[AES256_GCM,data:zBTGL5/AH9Yt3fvfTUbuS0OpNQkLVSAo/TyypEUpS4TE2/2jpS3VIH8I9P51Iumqr1ZeCTWkR4ujFklXfS7tnvgFlqaJVJtod60C7WZMddrzhSeypOkcAH0/oj/pD1JEp1draiFJBf8NvRsx22RqY7yFUcC9O2KC9WnHn0avq7I=,iv:qz8nv3l9lgMa8IgDTEl9b3loi7CTrwJYVHnGZLuEcys=,tag:A3qyzRqjgKjEo6oYE9fz5g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.12.2"
 	}
 }

sops/secrets/cursa-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwT2NVZDBWOEI5YXlpbjUz\nbnd4OEtFcDhGbW5SS1lLTEh1YWVPUkhzbndnCmlIeWxHa2VtVElIc3psQ25FUUZk\nSE5CWjhmOGVHS3JIMzhOL3ExaDhCNUEKLS0tIGpKeWhoc29kN0RFQkhaZmM5cWp3\nbUYrWkNlVXJLdXFWYUVJRkczY3dXcmMK/i+TuXdT/Bv6TW8lXdbGmJNpH6RuSvOc\nJsGRWpbYJbUWMxjhko1KAjepvCWEVo3yXbiKbJkwpkE4mdHuaQXJXw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZuOHpTSDRH\nNE9KSUJPdHduZDNML1VxbEh3RlpldTZsN1Y4ZE9kVTJMWDAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp3SkorTkJNaWJiWjFXeFdQTlNRMGhx\nNm92MXNqNE5YTDRHZjhUZXFPbmpVCi0tLSAya2FPOGZPU1ZqTnVqMkhBWEFwYmli\nVEh2Mi9XQ3IraEZIUkVUQ0kyNFc0Ck1a80nYCQB7eHGjCY9RlqbblsGAtDRWkmFD\n0PF1lzsDKi/+5i9PGyBv8x8ObBuPG37hSxhFf+6HlO8aT6q9pXI=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkQW5sRFI2VnpFNUJ1cUlN\nUHpUR2hFb3pWSWVvSWdBTDVaSVRpRWVKemlBCng5TUM4MUJLUWFJZXkxeEZyM0Y2\nZ052MzhwL0Q1U3ViaHdqNGdZbGlkc2MKLS0tIHR6VWFsNGpOeXVyWU9ZM0lsQ3FQ\nYlpHcFNPYVBRd1F4MDJ5VS9VSFp3ZzAKqR5rqTJODozoWdVB+VrzEabW3BCOzkH8\nW6sxSgAutYKXRxAmiXNZUQ1gbwRpM/pclOf2vKLTcgqqCj4Sof6aLw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHpub0tGTDRW\nd1hpaUcrU005SkFLVlkzMGNvY2JEWFZFRGpWRGtmV0U5bFkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpYL3BhVVJJV3NJb1FlVytNc2dTdzQ1\nRFcrclBkVW1DUzJrN2E0K3M5akNjCi0tLSBidkVRMFBtb3FZcU5PVXFldTc0ckdU\ncVRKT3lJNkhycjBZa0dHM3NWcHNVCmdHsmmeshavDW2IbPKfY6Wrz7kvo9qpU337\nHdL+lamtUQaqTS2BPRk5ca7cba3VJY6gqQEIGcSsb5hqp9/209c=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFkUFdiK2wy\nRDYrSlR3WmY3d3o2SXk4SFhtczBudlIwd0xpV2VIYnpUMEUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpSL0FxcHpYSjBsL2RmakVPdXZCRUVq\nczNSTnpYKy9NaTVJZDlNMXk2S1pVCi0tLSBvVkV6ajVoVlhMaHlacm1MVXRyVVhu\nZTVsdTNkaXZUNC82QzhYZ1ZPNlBZCnvd2w1m8YsvuSjaSb4PLzOBfJtlDePZ/KAe\nsBUaenubt6M/Xy8LxnBk0MDDAK8egbn531Lt+QY6PQHi6j/4V04=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3Nlc5aGEvNDZpWFQ0ZDNz\ndEZyK2tRc2cwdHhBMFphRWhBWmFNblFsV2dRCko1cWt4QnJyMGxnOHpOR0s5a1dV\nYlhUR2V6UkErZDExa0J0Rmp1UU5jRHMKLS0tIEhkdUg4d1Y3dEltLzdjV1VWdEdK\nL3IzWW1YcDFwM2hxUEp6VXZQenNIak0KBg8/vE2UAPibU+GH+Hq75t4p4PxC0lnh\nvVwVflsNt57mlp15FxUdyk1/h5kuQ3hJGCvNVBVDZC710+/aEC51lA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5COXlhRVEz\nZ1NUVVp0cmIyRVdkS2VwSkcrVmNPV1VJcFM0QzZTcFdsVTggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpjbWsreXJSS3JBY1N3RDMrMnFYT0U5\nb012ZCtwWmlXMUNjdDRMTnlUd0FjCi0tLSAxU0FaSVZXOGY0ZGd3T0tDbllrcUxm\nc3pWUzB6WDg5VTM2ZVNrSnNwU0FRCtP4FdLUIqmbNI2dhwa5EMGqkuQH8AimXiGv\n1Yv+Ed/ltgnIsonCSp1LGfZPjYAXkJNKTuC9hHZcHn06kEcqkcY=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHhNdnE5dXhH\nWVpOMldxWE1Sak1aOFgwdk5Ra0V0aWJ4SW9INDVNM0hTeWMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6Q0hjVHhLVFJQU2I5VGNhOWQvSnh5\nWjRlaGpreHptaURRSWFic1gyR3hrCi0tLSBMLzFZYytBbk8yQ1IzdmVNeVhJTGd1\nZXY5ZXFSdmNBeHpqWFVpbTBXV1BJCp1nlZ0cXNOLh5mVJSRY2QS70T54ENuFpsaV\n2F21bxrHBFCpaXye5L62AXxl4B+yyghl9/jTv72lwQzT8ZctGuY=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUa0NiMmV0RjhBUXdoYy96\ncE5OUWl6V1BFL1RQVzg0dGJ6aC96dTg0TkhNCjZmVEY4Y3BRajF0d0ZxZnZHRlpZ\nejZBOCtkb3dLSTBTODlMMEx0alluR3cKLS0tIFRWOHFJQXpEbWxOZXpKUmZBYzc3\nMGl6TXNKQmczeDlta1JwRlIyWE5aWmMKBpnHnM9Kd44a8XD8DGEatLIRBNj5cKpq\nPi0Ras6sh/n9Qc/P2vXLmezJsprMinsU89Kq0YZ5fllYeYo7EtLUDQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZnBtSkdoOEh5aTIyNi8z\nK1BOUVBsemtRUWM1aHNGY1gwNkpZdFdMZ1hzClFnbDMrdWQ3ZU1mQkVFU001RFN3\nRStvWlBodnZUNXhkeVRUaG93Smxsa2sKLS0tIEcyajM0LzZJUmFsWWp5RU5DVlkv\ndjRYenhSNXVVV0xhRG9kR0lxMjdkRWsKKzPiSsNbpZufp42YuLFJa8Tx7ctDGTGC\nt376hPY5mDF4ImbuPUL41PkBeRM54CcxM6DgoQyry0hU7Jsai90oxw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ajJubk9wYUgySExnaUYv\nZGRYbGQrS1dOazJYMExia1MwaEV6U1JCbmkwCmk1MzNBYmxXdEQrUXVqQkc0aEdY\nblJXVDB2djV5NWpLbjZwRnpEVEszN1EKLS0tIHFxUjVSd09JUW9RQXJvSVVRUUNn\nNWRBN2xFVzd4SUsrRnpFS1BhVGxlTHMK0hstei4RTCq6QN8/3ObtRO5/vxuyJZSe\n8IPRM7NhQu9DrP9XXttAjY3Y0912kj86DD4jWBhQx8ifGWG4iIMqug==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBaDFVZlVLNzFoZG5NbjQr\nSFZYQkpqdThEZzFRdW0yQ3hsMHlEOTFhK3pVCjlyRVh2N0czTlFkL1VzZDdmQ3VG\nU3djMDdURkVReUZZQ3Y4QVVJVmFMMTQKLS0tIDlsOXBMaWJnOXNhanBLeGx3azRS\nVWRuREw2Y3ZPdW1LSU1BYnBVekNSWTgKzzs/60NzTAnMkmGaFilD6mR87yTQLKq8\nrsJjnZKMAI0vGY6k+/JHEhCiYKFL1RutfeaHuYHtzpLYCREc+USFJw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmUmdYQmNJS2Y3Vk5CbHVJ\nRTdOOFMxMW0reXk2UkRPMVVQYUNxQ0thUUFFCnEzZW94cWsvVS9JRlZ3bVpBNlBk\nZGVFa05DQWZkbnVCeGZTVHdIblNEVlkKLS0tIDNIU2ZTOWtMaUg1enIxcDRZOEtU\nVW1TZFlKN1ZvRXloTGhFc2ZiM0VkSlkK+etXjSczCTvE7o9Z3uodyhE0swYqnYCb\ndluaM7qsksrTl35nmKZnWSWNdIUOsx6So0GV6X+fc2VsHFArf4XoGQ==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUQTl5SUV1SUVRQVJNVytp\nR0Jvc1pHOXRjcTAyS2F0dDVyUHZYdWRMZGkwCldEZUx2ZGU2WVlaLzd3UDB1Sk9R\nL1ZnNjZlSFJ6aG50SzlNeVhNY2RabTgKLS0tIHNFZWNlYmRhYW5PMW1KdFdSYUFI\ndDl6MHZXSllLOEcraStIdU5FV0xRL0UK79Q+eb1evP5LnwnM6DoR8iFDx9Q43Rbj\nBOazxo9OSWb04A7qBhDqDCD4Pbh+fpdUQ4WSB5Y0lw0U8LTYxDgVYg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEN5eWp1ejNk\ndFNqeFA5SGJVS0Z1d29jT2JzWU9LOFJENVp6QTZ5ek1kRHcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBdjFyMEx4NVdjNURsdmJrZ2JUaTdy\nclVhR0J3cG80ZEpNUm56Z2I4TFlzCi0tLSBjMG11WEp1ZWlOaTFUc1BjdU1adEJ1\ncDZNMUJXZzlqdlAxMmZtTVdaVjhrCrKynVH4dBfhMW8T9OvjKGqsBRuPyvxMQa5n\nTOQOptzySV4t6KPdxMfezTN4AR9QVtVJhHSrUlfttUHEKzwxZuI=\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZ29jc2dvSHdKY0JVeExQ\nNWtJWFJvSFhMNU1sVW5xWGFMN21JZWQ1aDJjCmlVM2R5andlS2JGK0NycDdlTGhK\nUkMrVDByVE9vNVVFNXBacGwyT1FDK0kKLS0tIE5HT25SeXBWT3BDNmdJY25QT1F1\nWFZGMWJxaEd5RlIwdnZzNTIrREN4ZGMKddUmHXydh+7/paxTHEbfYBTJPHc/LQ6r\nNLSLD0SpKhpg+TNBuUb3LraLnLqhOKSbr8BwzZEX1O9D5C8iX8uQKg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4K2xsd1E4Z2Y1UndHKzB2\nMWhVOXRPODl1cW4yNWZlUVgrZTRGSTFOc0hzCis3VXcwaEMzRlRsazdsd043dVlE\neDJlYldxOGNSM1FoamVRZ3FBL1BYV0kKLS0tIFMxS091UC9MNDZ2S1lJdnBzeFNH\nU0lxN2pJZkpZL1VIUWYxZitaNnNPSFUK+jaFzy0tGcsBsTDSHrDa93qEVCFj44IJ\njH65qpXDh/+l7cdSRK0tmRkSFtbicC2fiZNly4RxVmezdK4IRxjP6A==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
 			}
 		],
 		"lastmodified": "2026-06-23T03:20:58Z",
 		"mac": "ENC[AES256_GCM,data:QiWkrocJs37Fvhum1FhdVBtKRXPWzIww8htwPCI+oUnFyOwDH78YbfcXG42Usg8pQFBQbVLG+DVa99PtdFFl7H6ZYntpfkUZC9j7GX95Cg80cJGCKawCfn71pGKFZgJUxEObXRB7yNGUPhy32cquBevRW8iMz18vfN8yR3Q7KfQ=,iv:LgQOvlHqLUfKPMmCV8X14pta9CSWPV9YjMRYWVZjtpc=,tag:dsBpzsP4dI3QU5nlvqMptQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.13.1"
 	}
 }

sops/secrets/deneb-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEVvQ3U3cE1U\nZGVLT09jR0ZVSVJ6OU5ZeEVnMTJCUXUrZDl3alJmbDRiZ0kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpORUtVMWF6OEJZQURqYUdMNFdvd2Rz\nUUpmQWVVenVONjloOGtYS3JESmJNCi0tLSBYU3pUSFVPQnM1a3E0VU5sMFBzMCtR\nREFIYjRMaktkT0tyY3dhbjBPYWJFCsJJQENWQaPMBQA61/6fLC/Ly+9a6DvUVig1\n3pBEEOY2YFK2b3Um1E1ZWhWdTLWcxz1GAhSGbATjj3kLVwgeULs=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMRXR4aVNHTEN1NWdTdXgx\nQ0tHWjRCYWFJcVh3WC94Wi9vRlFxTlZOYmlZCnQ4M1FOczJWQ2N0NCtNbnlDM25o\ndGFWZFZOQjFHczQxYS9NL0hFLzdHTFkKLS0tIDBNWnV0UGFxMUxIZ082bHFKMnJ1\nd2NsZ3FCZTh4aytBTUdzV0FKWnlZWjAKXTug9QehoAjumvq6cr2JgnHOB1l4Easx\ntXbpbGNm5a0rsYA9FxiQKhk37I7e5RbkxJpxnrlwvlN2QThIOqWDWw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6SjdMTXJ6KytiUmNWOWtL\nYlJkeWZRMDgwaFpoNWhoMHBMTlJ2TjkxdXo4CkZrczV5UDRJQ1NvbnBLTXJyN25p\nTTM4eWY5NnQ5R0JFWFJ0eUVaSUVjaE0KLS0tIGJSNSs5cWVoV0d4WVhSVkk0VHg5\nb1ZBdk5leHVHYm94R05VVG9DUklyZzQKEEVmNws7MA4Odj74ORLAODOjVTIAO9wV\noXtDUeyvXjjdDLZYh3IToFGf25IJwuoFQ392QvbKtA6mXUlgjRWGAQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHcysxTFFBK1puT2Q4UnJ0\ndmg0bTd2bmQ4TnRmSGJNeTl5cENSQ1gyanhrClV1cmt4TmlLZzhtSFBnQ0Q5dGMr\nVUkrMjF1M0c1UmJENHlIb1JBUHpuTE0KLS0tIGR5bEM1MEFIbjJxWGtKTFlpVkpG\nWTB5OEF2Z1I3azVsbTVHZ1NUeE1VNHcKm1gCaRCGahNVrYpIigDR1KeDlmFs/bQ7\nclmcsZb+RiCXU2frNqgXqMyhXDQ6eELCf0zpqZ5Tue5LQAkF/6CNKw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEd5U2taUFA0\nK2lBdTVwSHAwM3ZUR200WXB6V0FFWUR4WTVvd3QrRGZQVU0gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp2NW5VdnJEWHh1NGNmZ3REU08vVFEx\naGpoWVVjRkxTNkhGLzQ2M1plYmtzCi0tLSAzclRqUTBLOGN2elBGM0cvQ29RUG9u\ndFdjMU9YMnFIaDd6K3pCNlR2aG9rCg4RQVHmCMcFypRNezWRFa5ImQbPTIw0I9qX\nUGZsIOaqDnjSbYR/j6LoIE1n+yAxqsypbtOdRF03uDhjxh9FQ3E=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDVkWjRhVjZB\nQXBlT3YzUWNKemhLc2F0RzRHODZMaGtVRGg2SnV5UTAxaTQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3dGNKcUxEOXo3eUdzbnYrUm9uZUJV\nR3FwVmpSYzd4Z2RsRTdGTC8rYlJrCi0tLSBjcTc5UkE5Wk1vV3VLNTh5Sm5vSU1H\ncEJCdjA5QUlaVXMrQndTaVZneGprCu3I0FlZ+bRmxkkFnOqpOa6v0FStKOBlsTQl\nQMdFClzFjXQP/9i/xBXWIsrQ8fC7jiut/M7zDYtdQhUaIiLG5R0=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIL0NBU1lOaFA2SEVsc1cw\nS2lBMkhZRVlVbStJS0MyK0dCRitFdzNkSEJ3CjQyajFwbTRvaXF6NWltakg3cWll\na0pNVnJvQWVzNVBTRm04alpTMWFaY0UKLS0tIGtzZ0ZmRkhvb3dqekJhNjF5QkRi\nZ0VPQkJES3N3Z0VMeSttdDA0Vk1KOWMK+btA3rYHFgHiU7ncmmfFsDjMEBZtrOMD\npQz5ETQTLyNDfK5L0UD91QzS01of+Bx8Wgp9syOPmDPQZSBPKtRebw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGZadU1TQzIx\ndTFmSGY5amNmeFNZRERaaDBZTmxqb042ZVhVeVhtRU84Z3MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpxRW5wWmlodEJPbjBqdnluUkRMT04z\nclRBUUpYMWJLWkk1TzhHOVJOMDc4Ci0tLSBDYWprM3lYN2w1VFVCdXJleXVpMWFE\nM3NZWEdoRmR2ZlRQVGdVQ0F3QkdnChnVrO957ng+BWe1lMVl7y2+Db3TsXx6se3f\nXXkdV0Zzg6STsdSKG0+2TG9Zw1gsDeFcvrMZdE/i92Zn2lYYHD0=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aTFpUEZTWFQ2UTZSYm1a\nbEozQmlDM1A1RXQ2aHBud3JjY3VCYUMyUjJzCmxrNDZoSDNyNE14Y3BHYXU2dmpI\nVnM2R1dYbHp5c1RJY1VBd043WW5IVVkKLS0tIDdhRCtoZHY0SG5CSFNBbFFWNzBj\nd2xzSklvdzE3WUhWcGhMcW83ZnFQb1kKIU3TNMJCP2piwmEpDkoneeib/PMx2L1i\nErI3u4Dv/cX9k4EvR2Snd3llg4fEYtX8P2q+5wp1khztLH+sJwCViQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGlHdkYwQytj\nc0dkUEw0RlVWQzV2YWJnem9nSFpyZWNEazFUcTVXa1ArblEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6akdKdWxKMk1lNEhNL2RCYTVYT0lq\nZGxHeXRwWVQ4MXgrVjN4VEJoQ3NjCi0tLSBMQmVEejBwaFdVVGhDcEc4OUJMSXEr\nT0J6WGp4UzFxWG5kajlzWkt3Z1JzClGHNfyWCLbMeHr1Q/nWblcwQSYi2j6V6UzT\nanPgXMxfUO7qzGLJ9ybrPFxjyHLzAH1bBjVTLmig/V+jlqB5DO0=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnc212cWV4MWhvOHR3Z3F4\nTzQ1RnhJaklZRHN3aFNsd0Z3N0dFY1JybUZvCnpyMDN6UkJybFpyb1U2M3JuZ21L\nSHBDUmdkc05MK0NxdEY3bktpVkpxd00KLS0tIGloWVc2WEIrekk4V3ZVYys2ZnZJ\nOUJsK3duY0hiVFdReHRwTnl4ZXZOVTgKGcjoOiQkmq68D5i+GiRuHC3+Jo2kS/FF\n0fIrZzh+6P4bYizNf37dTI8IvsMrgS94cymfGeF7uOHTiDe0kbv9dQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UjZyaE9ySGdiQnYyeE9i\nbldRNzZCWnMvQmNseDl2UlVqeTNVQ3BJbVVrCmxWUmUyVUZ1YXlzc3Rremx6Mmlz\nZ1A0VlVPYS9lQkxicUhOd05mWmd6RmsKLS0tIDZka2N0eG00Ym5iQnR0RmN2NGFX\naUIxUnBleFJVcXNod0V3bUpiMHYzaDgK0l3YaBMqM1Kz1jZ++zus5tBWsynO0TsM\nLmgjxptgc3uFz4j9IrS4MJm5gxdTYEGGl/w67CG0BkiE/+7c/BCtOg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHpUS0tteEto\nWk9JTXBSUFpiN2ZzMnQ2YzZRL1psMi81TThZK2RHVnZlM0EgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpNam8xUDB4NTQzTVY2anltUC9uYi9u\nNFNjM0ZiSWM5WHllQVFORWQ3T2U0Ci0tLSBmdVRLczRMc1RMUDdtS2p0WHZaRkpH\nMjRncGZzQVhXVExVS1VvK05mNXo0Cky4JeMbKSM2uFZFtHHtvMIhHuxoBojne6tP\n+aBdXFaBGBzOVlzK/soY8AUwCFClf9cJbnd3VLV+DuDTAqgmb4s=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArNjlEa1ZPUENFcmhXcmpD\neU5obkJ0Z2plc0V4TS9IODdMS3pFYm93MURnCnZxejBtQkxQMHRTY1BoTExhb0pF\nb2g0Mld4MmJDMSt4Q29PNTh3eGoySG8KLS0tIG05Qzl2R3F3MkRQd2hMenhYbmRU\nR05kU1ZBQVI0Y2k4SlNFalJyK1ByZE0KqYpRiC/Ta1mACm/H+fFZ2/p22oVHYheB\nD81C3mPcGfM3z9pH2TAxwh9V4i1E4Bsio2lA//fJ174HiGbWr2SLNw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZdTFrcHFtWVAwYmc3amRy\nTkhaaWdTUmlJbVBMa0JUOVZwMnJSZm85a2prCmhqaUZvWlFML1UwVXhHMXBiZCtu\nQk03N2FqWUtuc2Vvc0dUQ0FaenAxT1EKLS0tIERWNkxYQ2F0TzdQYnJJNUZldVkv\nWGsrcEVCOHA3WXIyNWorWCs0THlHYmsKB3mKZNjOTJl2VrDXczkzGVUa5ROBFpOO\n2M8+YJEMDQgW4R8jEz1cfOUQ4eTjY01+tAZIK7LHIHrfSjbIUw9vXA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSUxBNHFJVytVbytTNFFQ\nRGFmd05CVWxzZzZFd2cxc1FGZ2dJRnM5aVV3Cnk0MWVRekd4S2dJcmxFUXhpOHE2\naHlxY1g4YVZiekl5aUJjalQ2Slo0MncKLS0tIDhTbWVGOE54Q09HeUJhbXEvb0Fu\nOHNEUkczU2w0L2ZkZHJsWFRpQlVTT2sK8RiKwY/waLn7ktbmh8+flByF9tN0RUD1\n78KVpKXp4SBWCp4Gr3tudZNWKnLsummhzxvNWY0FO3vOYK32SYFJ5w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNYmRWWVZ6VFF6L2J3OWlK\nUmdPZXNldWtHUHFPZmtEZ0VTTnFEZ2kvMXl3CjAyaUVNR2NmQ1dkTnVnNHY3Nitp\nY0Z4Rk5jK0gzbkl6ZDBHTERWeXg4UzAKLS0tIFFrREk3RnN4YTczTnoxZVZHZFQ3\nczlkd1A0VFNCSzFlT0t5ZG5xdWpoaHMKycCr9bQi7arZrREZWmbal6TYRxRj7Vmo\nBGAmgnS9JpMdojO2wbeXfA9NixznKc1SUgXYefsMIke29kUUM1Ij9A==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2026-04-08T06:38:23Z",
 		"mac": "ENC[AES256_GCM,data:7P6rZqkfnyHBRGJ6y61QMH5+fx/hTtOv0Qv0gBm3PF3vm0UH7oii5ztgx3QeImn1k44ctuA/RYMp0WTMHG6I3Uob/qC+XK5DTWPq+H2wx4qzb8iCR+63g2peqjVq8RV6TaXtJCNgLKf8K8OajMbBeLXZSeUmWtyxyGaDmIpPwTc=,iv:leBWe83Urp3vTMbBBNgihTO8DJ1RZ8+PfcdEsBAyEZY=,tag:Ix9vF10M77AiNF9h1oD8GA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.12.2"
 	}
 }

sops/secrets/hadar-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpPWDVURXVE\nNWhuM0JqaW9TOEF6UVEvUm1yRVh3UTl1cGQwOXlaK3pGQzQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpMa0QyVjVtWU9FdXhrajVnSlZaK0Ro\nR3pqZUUwUWJ6blh5RnExR3FoaHp3Ci0tLSBTdmdodmNWYjRROTJySFpRQ3JXbVNz\neVY3cXR3Rk5PVUZUOEUyQXZVSmpjCrmjnz7hqdBPSsGHkBc/DqU70t4WHRD4XYSb\ncvvYYP6TkOYDa07il3+0gDn0/BDkRKkTkOO0D7E4VzXRqSifAkg=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVVEkyZE9kRlpPVVdQcmQy\nV3d0alBkWmhmY3N5bXNSTzNmbjcyY1lHcUVRCnlsVDIwbDdOUmdDYlNaZXQzS0JF\nSm5ZTnZ0ZmE5TVNDa2tYVXd6VC9wUncKLS0tIE9EaUlYbmd4Ni9UVm4vMUV2TmJK\nMFdyOTRiR2tMSzJmcWtwK3VKd2s2RDQKwZFwjnhobvgRYmH726FLLl5n8zGo9+Ws\nJ5Mpy5vaIXAOCHBKim0GtEDik8YeSgURCPnvtXSGA6Wq2c66qKGkVA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVMTNWZXZBN1R0ZXpPWUZD\nQmRlNmNhQkRtem05YnhUZzEzSlB1bXRESzNBClpQbnYrZ0xGOWZndWc0bWVaVzZ5\nWlpMUnZxRzFHMnVwVENoT09PTkxoNEkKLS0tIGhPRmRXbVFxdytyd20zVnZtWW1M\nMDJaOEZzTzJrMXQzYmhsdVhvNDh6YnMK9fguASocrhr0g6MekA5i6Q9C3JcYkpBt\nqdO5xV7OdGrdC/95k+5hbXDdLDyuL6ThO+HOE9pts2umB3Jbil0pbw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2KzBNZGVpRjByN2JlVHBQ\nbDZqUy9SNDRpczkxQkJqUzdvMkZ4TjJIRUdrCkJmSHYzVXlGSHZsSWNuRG9mTUJs\nWmxYSFdxVnpvM29ScDdmNjZpcktScVUKLS0tIERHaFhIYVVEL3FCd1pjQnp2aklE\nSWJFRkpXa1BtWWxKSTB6OUdPblZ5YWMK5arDu2EI8uEXr1DBPAQ+OEtA+CBNxXXH\nWx4OBwTjUuh9YVCR138SDgNhyeuW9A+DUioDFS+DzIIK5XNzOZ+U1g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFhCT3MxR2p0\nM1grYWpPZDJzbHZIa1Z3cnZwUUMzOVZITTBDRHh2L1Q2MHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwowTk1iUkpvVGlLbTk3U0doMEZvZ3li\nblEwM0RHbVZORUJQWURhZXp0eUpNCi0tLSAyeUppNWtsKzRHNjdpaUJFQ0MrakQz\nSmFwNytIVmUxSWQ3cTU5bXJWZDVJCvP3uST0OFa3ZSiatTYCYu1YrL9HfzDsjlMi\n8iR+qLU+1eq/bycWaWwpJ2cKz5E9/ybSAjiqOeE9RgYAMrGtQ6g=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9LSXdtY2xs\ndGtMMTdZUC8zT0x4SGhUbHB4ZlhpUWdzRCtkQzFaZ2JpVDQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpLNEFrMWdSMld6dUZYeTl1WnZvbFpS\nRWoyYkVJMTBzanlDTVdmL0N6K3cwCi0tLSB6U2hpVFBkV1BPK3NGVXpvYS9qNzhS\nOStpa29rWGZZY09Hb3hHT0c0cTVjCnussox2HqzEt1dhN/T50N4teQEJv3hnB9oG\nDCQujYVLgXxT700BO/Mdd6UsfGUotRUspglTmKVRuGXd5m/wCXg=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdWRxTXh1Qnd0NCtac0pJ\ndnBEVlhnRUhsVjVKYSs5cElpK01udGRlVWtVCis2QjI3SFNiWDZOY2I1U2lUMDJS\ndVhhVW1oL0V3elZ0UmYvemtialhteWsKLS0tIEVuMzJIbGZQZlRIRFgra3I1dTh0\nUkE1RE9rcmxyYzZCbUxlTDU3U1Fqc00Ken/vC8mRE5xz2zZYze25icHBzMrXbV46\n8B5p03AdAy/9fmWv+i6f9+fFCQKHDY12UHbsX1TUrK/idxwCqOga8Q==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGIwaHgxVmZ6\ncFdtVjRWY2ZUbUZoem1FeDVFeElIb05DVWxMSFowUU1zM00gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpyWmVRMUVLWTA1bnZkamdWRWV4N3Vr\nVkNuQytMSGwvSWtXMFJ3ZVBQUTV3Ci0tLSBEejVhQzhvUEJGNmFCWnBLcEpuWHY0\ndXF6SG9RNEFDczBlaTdHdkJUZlBNCihddNokel0poWKU3Y32lIOrhJayA5f+UbNt\na3ckzRodBCPEDTRXxzGSeG6Oq/WaA1M/1MEoHiLHWfY7XZeZ7FY=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNUHh2WGExb3VyaVRlQmFM\nVkhuRFExMjJwUm53TUNrb1NRS3JJWGJiMUdzCnFiaGlhYWUzRG11NEgvRVVYcXU4\nVlp3MkV0K3FvR3VpRTBHZHR2Q0hMSG8KLS0tIGJ3bi81ck4rVXNxZlNRak00Y1J5\nQkVCYmxoeGNia0pobkttcjd6QjIwR0EKh8DTjgdlkivDabl7zEfMtIfxDnTq333B\nP2DcgbGDJDM29/NgQofDaQ+PpTwJk6d7o8xxRPhbWKoiYUTNTcK9Cw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEx0aUI5OTB1\nVWozRXhkcUJydUtCdGw1RGx4Z2tBQktkR1lLTks1eC91bkkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpmL3U2QXlINGQ1RGdmQjlZZVcrVjd4\nbTJLUUJHQmYwWFlhVG5DQ3c0eWdjCi0tLSBtYTA4RFBjd0YwTG5RUHlBaHRNWGtB\nQVgwTEZoV0VXOHJZUWdjeWZHRlkwCjVIezVWBVGrrS3tu1HMHc33di8NNCoG20tT\nme/TMN/9II/aNmnIa/rixH0nYzqcY3G3Xt3PehbPziB9qzOSXLk=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBReG40bnd1NldOczFjM1h5\nOS9LSlBBY1JRQW9PbG5PRXB3V3NiK2VYaTE4CmxQeVVnbjBkdTdDSDhVT3E0SVhh\nNVRDWUYxdHJMRFUrdGZsdEticTVob2sKLS0tIFRFeE9NRHdQc3hndmI0ekFEcDRn\nUWttV1FPa0JuU2lxOGdOajN2NWZqMlEKmpSBfXo/ekcP8JLr+4Dy8UniHJRxzrOe\nRB4kF2HMmv1733vBSdw9t2Ctgsp7QV2mkoVkywem0PNh5rojOUoOMg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6VDJqcEVzbGltMGNtdmhy\nZEptb0psd2xzRjREOUdVclpKR0M4M2tzRUdNClpmQmhFOWdhL3dpU1RpdnFuSUhy\ncXUxRFgyNUNzMElEQ2lkcTcwMENiTlkKLS0tIElLODF0bktIbFB4MTFxMXBGS1Iv\nT051ZWFkQmN6Zi82MjhRL1J6akNmUG8KV6qe1+f8NgTMezHOTNXf2T7XsC8bycOf\n+jJTRiwNIvw7CiWWLU43PLkeARg0xLZx08354iSEeKWP839kaoTTTg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5ySm5RNkZu\nUFFlOS9Zc2RCTEt4RkkxRXdkUlB6bS9MOTFVd05ER2xuSEkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp0TVRRSE5SbzBGN1paL09MTVNFQ2FN\nNnVaVUkweHE5dmRuOHd3SGlBUE93Ci0tLSBSdjc4bzJMYnRHKy83TTlCK0RBSzFU\nVVYrTUN2N2NKSnJYdGR2Y3lsamlZCtV60W98YvcgW+3ovn8cpFMKb63It9sB3U/H\nzVRhpqk5rwmOmSyE7ow5Gv8E5GNDAuDEprjULaZWRS2VegqOJJs=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOdm1zbjN2YVRPZ2VUVEVF\nVVJ1Z1B6T1IyQ0tOSlVydlgwMjZScTlNVms0CnppcDZHRnlETlVIUUY4d05oNW1z\nTy9yYlRBbXRFMkVQZGhzTHR2eWpOME0KLS0tIGI1YWRKdERTNjUzWDNJQjRJRWZH\nZFQvWFJwTTlVSS9vbndkcGdpSGFPL1EKJ+cbICrnFLqGIV3+NnfDixuFdIixtuOd\niyc9z62MqySpOz1zU0ZRgKOZxFhzgRn+ZESQOLjjmAN0Y3FeaWd/Dg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaZmh0cFh1MnBwYVVXZnBp\nTHh5Y001YWRoc3YxL2duN1NCYVIyM3lUOXpZCk1rcGRDRk50T0NQRlZOVDZOZDNo\neU5wNUwzdnQ3azAwQnF0QmtxY2hZSEEKLS0tIDhub1pOTHpvT0ZIaWFBRHlMem94\nMUw5WVkvSWd5a2w5bzJGZjBSK3FNeDAK+cYJAVD806JgsFCxRJP/lktbtawLTfMQ\nvFIPLM8MMUA+3eoXZqdTGk02s1lYij2tCfcoSoW/4P2NmUEQ3R+vWg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByYnlldUJPeW4ybkdHYlVS\nUzl2V2FkOVdpUXVLNzVxSkFNZitIWUpuYVV3Ci92OWZ0dzhoUTlkZDhSc2xPUnh0\nYzFzd05Hd1dTd2hHWFZpQ29NSEVBR1kKLS0tIHVsdEVEd0k4RG1LTGppTDVrWERL\nQm9VY1JLNk1hS2RtaGlqUWE2K1FESlkKzmXuABwFDIUfk1D2ajffLXzPZ0f/mdYd\nqy0EFA1fUv0KXo8d9/jQMVF+T4yi3VIxE/FpI90ewKANtrUOzuid6Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYS3BqSzNSa3A2S01DZVRr\nZTlaLzdMSzU5QTljVWV1ZFJ0V1plbXdHVVNRClJuK2h0RW1scVVqK3FrQUpEQ2VC\nVE82azNNOG1VSnlWMmJzK2I1U09RRFkKLS0tIG9obnB4ZURxZHlNQXRTWFhyMzRQ\neDZxeTM2L1BxSFRNWWRMUWRENndOU2cKjklv7uMQrwPsQqqMUmhgWPk5vERa4pGd\nSTx4QfVEYaWhkyDzBPd6tJX5Jt/xIUlI/ruUMqQa/4X+YXiDcjVGxA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2026-03-24T10:47:07Z",
 		"mac": "ENC[AES256_GCM,data:mGclnACS2m2tTgSaqKXp8bp9FqHXZjwbB5u4t0h/CgyhltcJQPPQ0KDUW4lkuQFlF/SFYyPFlC07iw3pyjWQQRXZmtxxAhjU14TnOJ1wo6nPElJ1Ytug57TNzJiRh//lMZxMJcaWpwmGj8eUOmrVQhRLdO+7Lw2jRXs8ndIXGEQ=,iv:ezqrUJjS/33c+ix+HxdG4G4lWIxPmynpnMQCKw/hxOU=,tag:3J8gK0jHAIXyX4nOUdWC2Q==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.12.1"
 	}
 }

sops/secrets/mimosa-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG42UElYczk4\nVTJPUDZuYXhuOWdwWmt4bXkvbXIxSTEya1RGSFJ6b2t6V2MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpFOTZyR2dDRlhYWGtObHh1WnM4elVY\nT1FwaHdJR3RBbmFBWHoreDNZdEVZCi0tLSBZL1gzL0t1eGlSbzU5bGhhaUNNY2Q3\nZ2o5YnZqU1hZWlBlQ3FrK1N6RG1zCnaX54rDeViB+2UopklAK9s54JQoq84PJMQz\n01fPLSmlFUxiWVvTAeyzVzp8CB34Ik58jSfLbBTSzvE0ydGHRtI=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXTFp4eWh2NlZTN05yMkFs\nNE9LaFYwb05xQWY5RmEyVVk2TGhra2JzZ1MwCms2NVJjaGxZSHhERC9KR2dPV2xD\ndXRoNk5GZUxiOE5HTVpDellCbmtKY28KLS0tIEEzdTI3WDFaRHM4dVd5Q2RscnVU\nSTdyUVhrYnIrN2VsZWNYSnM1eTlUMm8KoMcJ2FUh195IHljd2Wm9DNegDvzf+lZW\nL4ywKQ+ug/Xz/2QddHqTzS6sPO8zEsu1L28a1hEhzbYY/yvsLszhVw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2Sy96azVMUkoxc0xldTBG\nNkd2STIwTGl5bjF1Nk9Yb01JL01OMC9sMVYwClhTYjBPTm81TVRrUFN6UHJDZXQv\nVjlielhPQUIwS0o4T3RuVWhVaE95VWMKLS0tIHB5UHhSQUZuMjY5dkRBdzFhemZI\nbkhKYWRtYTdhSkpraWt2cmdhazNaRFkKtCwgFQ8L/Czo67TC/2Cqn6mr9n9s81Ew\n/KuOd4uEGF7Y4ZgH8hHNmuWiJPid8I6sfg53MehE3os6ExTWcLIG3w==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKeWNIWFFOVC8yWlhMdHp3\nQVZZdS9LNTExV3ZNSVF2MzlLTnVVK0R0SGgwCk8zdjRqaVl5S3Z5TFYxc29McjlV\nVnNNbFlDdE5GR2plM0J6bk54WFpPYTQKLS0tIC9UajJHOWhWNGhlODZFQ04vRmlJ\nSkM5VmdobC9pVEtlZ0xzOFIvV3M1M2cKxcdPGTlSWOPLmMd0NZyvAj8hVGezpPIJ\nBQrzuRcM2GbhQeZzlJ6VXJzHZad3qe/AMPX4V+94Y1pciErus46v7g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNLVXhOQ29M\nMDBvSTlZUVV3b2JwS1V5d250QmpzNEllMitVZEsyTjlHU3MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpueEdod3FyOUNlWkxpLzl0QlJqVnNO\nZXpqQ3J4ajZWZ3dud3pnV29NSDhjCi0tLSB5UXBUUWk3N1V5WEhmTlkvekYwZ1NJ\nbVpJVndGLzVuaXZQTnI0cmVHRW40CghUteAq6ZJO65QahWUvlyPCoA8SmXLfiqae\nzTA0GoWZ20DcJcUgERS44AYvqX+EYalr7fMa943WTh7bO/YGnpc=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHFyT2pBMzll\nWlAxN2RDdGxOaVNMVjBFVnJqRG1Tc1VwcXFpVlRXV29welEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprTFY0WmcycURBbGxTK2NyS2labk1J\nQktTZ2E5NnpUNlZ4THpzc0ovVHlzCi0tLSBFbFdjMG9RTFRNTXYrVTRXMGZhaHFs\nY2wreDRDZEpVb25oQy9QaGlpKzdnChsba779KxP5qPAIvFkEFg/FpOREFmxIziGh\nJ2Ve/KvTQeSEYOBHLsVeuzgYW0XqKhbaslWvcI5b4G9hxfsfjEo=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhcXVjV3F2MzFXcFhZL3ZP\nUFd3a1cyZGFCaVp0Ym1URTJwMXZOVVhsYlh3ClgrLzRaZy8xWUZ0bXZjVTJRd0hY\nNGFHMExBTnlhT1pSZ2NwOWI3UXBIelEKLS0tIFpkODFNUVJuTUk5dTF3VVlMV0hI\nTUU3WlpaTG5zek5Sd0ZkMVlSd3BiZkkKD/uiIwxkW/7bXPbHCmFzVzN3/u9liSmY\nQtSmtOHCO0eljqu0YONCn0EzW/B2bfbzwsnxIRiDEf7E7fgLIt/ZpA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEs3a1BubnZw\na0lvOCtNSEtvbDZLN3A0SUk3SzkrU3hBZmRyc2lBekZzSGMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwoyQVJPK3U1RlZkR0RneVZXbjdoblRo\nc0pvajRrOHlmeVZOdUxPTzY3bkNFCi0tLSBGbGFJV1NjSXphSXdEcFljUXY2VitT\nd2J6cUxvNVljMko0Yjk5WjhjYlNFCsbgrjV0eqyqr4JddP0Z4wEsDr9vsFlqWtIt\nsM0i0QSwWPwH6WqnERRf/P/MAkCnFouwYjiTtiUTduth/xQgJEM=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eUd2UkFJQjhpYXpsa0J6\nYytEWkM2Sm1ZWml4WGtkV3IyQWIwV3JTdzM0CkZDL2ZYRC9Jbld2YVRkR2s5WFAx\ndW04K2c0YUZiZGxDaXVONE8yMTV6dEEKLS0tIEpqNUdOaFFvOUJRLzJHWHg3c0Ix\nUy9CejIwUldPMktWcjBrWmh0ekM0cEUK+sm3cWGUhojfKn3qzlx90kQcxvC+2uNo\nGCZJohTR8SwHJgcKWCqnic0ElCMFyqHBsSeu2G08q4e/0NHozrgyLA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDFhSXhmeWVU\ndVFGYlZoQ01OR1ljdmtPcVYydnZ1eVV5TkZZS1FaMzZHRlUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpmU1JHb21PWG5RUWFOQ2hVU3Yzc2Zu\nS2Z1SkpKaVFlNUVTSGhPTE8wcTlnCi0tLSBsR1JWQURyL1ZXMW9wckkrNXFGUEZ1\nYnJqcGczRmJnYzhLdkhsY1VRbWNnChdr0xmapqKthTVeZz5G6QKQdjPYO6LCHmou\nXUOyNVR3Kkg4tcLY4nKhI40ZWsfyd/zvXQh6EZPde8Uiiw38vW4=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBydlFzNXc5NVh4WDFNMHRp\nS0h5Q0szUUQyOUlhejl0aFdMUjlDZjgxeGljClJrdDhlcllzWmRjSUhlVzNsaU9z\nOGNHdGVlTXlqcnNUSjZoSXlNTGNxUGcKLS0tIHg2Q2hXemFZQ3lCdUtkNVdhYXNN\nTWdnTHJ2bGRZZ1Q2dDRXa0RSN0x3eEkKMwHnek8vaGpsrve8UMrTKkCIlVOd5wVD\n4lL7lPniRo8bs9HJpleau1StvlK2WuOWns9d9jcf8SktPA/01WxRZw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSb0x5cHY5UUJjWjJGcUVR\ndGpKZkwrTkVKZ3pjQzd3UDA4ODFSUlFVUmxJCk82VnJNQkV5T1F0dkdXT05oRzBC\nVWdUbkFwdjhxeTY1MWJTTGVtcUM0V0EKLS0tIDB0aFBsUzN2R1dpM0U4NlIzZnZ2\nSnlSOEl1VFB4OVpRQ2J4UVk5dTlFTzAKBp0unrv3YVbOrfupfNFDm+1xxGXF4+ky\nqzais2PFnjNxAQw399P9hXwftftIU4n3XWEKHxmvEgMCOqB0qugw4w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDhlanJtdWhU\nd1ZkSUh4alBJWnFrRHhVSG9yVE8yK2h3djVuTmhEUnIvVjggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpwQzlQZFF3SjBuMlorVFZuZlFJQ1Vu\nOXgxZFIwR3c1aGVjL2lpN0xuN1dRCi0tLSBrV2ZubzBUZGJvcFhBRE1OYUFrSndu\nUUJzcGdlaVplRnpCbVM0a1gzRHZzCmAc6/pg2tAXcLHRGCnU/dTXjo3WjlvA7H6K\nno0wWSegyS5a/EdrNto5uTSLODqRsAH9SwxjI4Pc2LehpRwVY3Q=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1U05SZ2NCb0pkSDl2aStV\nbUxtc1ZXNGFmcGJQSU11UDBvSzRqWm1NZDN3CnoyTGFnbktTT0ZnOU9YbkJoaWpG\nNUNFbTc2L3ZKTm41ZURUYlk3cWxuVm8KLS0tIGt2bEJJRzYwaGRnWHNWc0l6WWNr\ncDJ1OXAraWxlWExmdU1iUEVINm45S0EKKAfctndTVs2JPSLov/SAOKbwfKyolYqH\nvIBIVbnNXR0Pn+Ma4g1di50XKXd95XwtWfH4LmhFo6xMFNeWPswa2w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxR3ZPc0V0Q2RKODk3NUpR\nbkFZWGVjaVVCajI3amJkZEFGMGVtU1pNTWdNClhWWUJnYWlNZVQ1a3Jac24raUd2\nbEVxWnpmbk5XL2Q4eURlNFhNNGlJQlUKLS0tIGhyTGdCbzMrdHJTcURIWm1wejN6\nN2ZJRE0ySENDRG5rYk9LQjNvUnA0Q3MK018BWwRDNUp4n9HWOEtpig1am2HqzI4A\nXLnYmRcIF98q97TqTzFqdq1mAjABMOG3/Df87cRT1pJM6sPNaLfyfA==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUdUlQU2g0TDJQcjIwaHhW\nTUc2YnFYSUdCMzJweis1SUFCSzFaVzhoTEhVCmJQek1ReWhuTFJ5bVVlUS9hQmQx\nanNBWDc1VktMeGRGRVBYWkRkWS9MM1EKLS0tIDRUd2N5RTlqN25tVVBIa3kvN0pq\ndWpJcG9DZkV3eVM1bStnU0ExWjBHY0UKEWkPdR3yYRjb97uSV0DkkZdbbH0W/QRO\n4MGcFqlS9kSn5PU5lgRcbYQjuXQB2nQnPD21VRVYBc0lDXYjJvZRLw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTZTBDd2VoUG8rZlRyMXVt\nNTFCdHk0NVFxUloxbTIvRWVIVzJJd2N1WmhNClhCSjZHQ2Fkd1lZakpKTjBRL3JT\nbDBNYUc5REJXZWoyM3VvVWJFVzFIL0EKLS0tIDYwRG1hQXNnVmxNSU50aUowaU45\nU3U2RnVHWmdjeEg2MVJReGFyM2lTVUEKiRIDsbFWzC57Km5DAojp4PlHuJM2ME+B\nAREFnuU5PN9Shk53yeFdLAynqG8OqBDjGCtsscPf1Mc3caCVKVLtDA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2026-04-06T06:01:48Z",
 		"mac": "ENC[AES256_GCM,data:zcg2q/LhpU6SCnKBNo1aGnkjkrvw/4nAEiUSVkQlEuP0uMtQqrThb2vxByuLBhcq9oKyb6a+Tq9NkZDEsNWXdTOxeJ59Miqn/LbYC9gnMpg/uhO7zozOOg0hIIBASzvNI1EHE6akjQnhJtWr6sCYJXq1dPJy1fCKgFILeUX3wEg=,iv:f18hvXKQxI2DL/rCiZGzOK0PmWi/6UMc5MjCe1fPZbU=,tag:+SS3ol2D48uAS7Bhkts26g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.12.2"
 	}
 }

sops/secrets/mirach-age.key/secret

@@ -3,44 +3,41 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFBNYlMvQWxu\nUVkzZkxDWVBKOVAzcHdEeDB6VWQraEIwdERySWJ6aEp0VzAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQppWStuaUFONjBBNlBqZkVvMWs0Ymxy\nbFNHNUR0RDE3cEw1dS9ob0dJTG9vCi0tLSAwdVpRVHg4bFUxTHRVM1hsUHFpdmkv\nWWY0NFh4ZndZSFlqcHo3dVhSbS9vChd1wN9gHUHm83ABhhKK9VFfmZQ7jxrz4E7c\nyIQDnOhLGmxCED2IU11g77jsTacgYA/+X/wezHf8iNy/TARLTaM=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZYXJCdSs5Y3VWbE5TOEJp\nVmpuL2ZOYU5pLzgxMHFkMGtpZG1QZGlENVY4CmVKaERaeGVnUndONzIzWmdtTFcw\nNnNzSW5Zam90OE8xR3VEVjM4V3RGVWcKLS0tIEZSYktnS2xoZlF6Yk4wcVZweWly\nUHlOOE9vUmNYTHBTSytwakhaSnZ1VjgKxoUCSVgFXOKsyXUWe7z17WiUa2OpwImm\n5NV2PeQ8uOnMT0c7Iwl/VEsXbYbOtnW8VT5m/JcLIdlXCBqkQ/B8PQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
 			},
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bUFIdmd0RXErQkxSQlls\nRnlXYVlOSGlMelgxZG1TN3Q3RTBpcXIyU3o4Ckk3UklEdktNbFN6UlJ1aWRqT3Rp\ndWNvbS9BUitEcUhha1FCRE5TTXVrV0UKLS0tIHdTZlZCR0RoNGRqYzVJcmlUUFRv\naTU1aUJIa1ZCVXptMjYra3NIY2lYaDgKfQqQ08rT6TmYd3zoqvLjnIh3nU8Eg/np\nxdj7396NZHIFuD9N9SMtM3WI1YN4qjvXqNjxkZIfAS6b+KrWgPo4bg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrVjVmSXpwK3JOQ3Jvd1VT\nZFN6ZGlib28zSE9MN3dwYkN2dkpON29EV25RCjhyU0hsZmVmZEY1SVZXb09UeXlh\nWnROTGlGUFNLL2lsY3RhSTVjVE4zZUUKLS0tIGs4Zi8vMnZLUUE5TGJ3TmppMk9D\ncDVoYnl0MGpsbmdQeUYyUlRuM3htbTgKHRLMrPGg9FljvwmWOZUODER/hSsmUNaq\nZBVNml61LztfZMgGtp56VZ77XU1bVLREL1VFyeTwzjpbYggLbuRJpA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDY3bFl1Qzho\nZmxkcTlhemtGaW0xOElNT3BMelBpd09Pd2lkVlVmbE16QW8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpaOVREVXg4RFpEQjBudi9hemVheVdx\neCs3UmtyRElKSWd6dWJjMXJsc2h3Ci0tLSBjMGJGT1Y1cGo4dllOeGg2RE1xWVVa\nVGRkNTI2MytlMTNNcDJOY2VLUDdrClRZyCeWUgf+dTIIRK4ALfpvTKhaKrVI5d/2\ndx6kFtkU7orHIWwsf6MrFYQ6htb6nPHxbNxP0tJ05fLOGJAFhys=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHUveXJOK2dI\nTVJDamJzUWtmWlB1aVJCcmQrbElBaTRxYU1RQ1dUWG0wV1kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3cE1ZOWtDNUlqNWJxNjdKbjVNTGk3\ncWZMVEpMM0RHbVpUQ09EZUtRd1drCi0tLSBpaHNkWDUvSkgyODlhZ1V4Si81b1NK\nV2NUVWdVbTNZV3dqalAvMFc0QllVCph57nPcAfs4fu9kKIJZ5q/ejeP5u9W+HzsV\n+dpVasMbA++RB9SDXuifRkNC4b18fKiiOfOcutT8saG8Fth8/PQ=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eS9pMnQ4c0N1UFY1SXRG\nZFk4YWkzTS9UVkQ4UGZvU0UzMWt2eXdhWDF3CkdZRnVCUnM5RzJCOEZpb2xUdS9J\nZkJwR01RbnV3WS9WWWc4ZFB6YnVoKzAKLS0tIDZyb2djYjdzMkR3SHJQeUM3bHdU\nQU8zMi9zdlVEQ3ZLMFhvdmRiRGs5YW8KvYOWORIww3Nzjt4We8o3Ph691NIolCHN\n9gC890llNejo/Ic+dqe1iwNPtCV6HvDJo/RbqPSoI1l/yRWIqGFLJw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdKVFRBazh1\nVzJuQkw3ZWZJNGhPOWZUeUJnS0o3MDlvd0hTRnZyWnRrR1UgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwplb0hlRElvQjBtaXR6cC9Ha1BhcnZU\naTZPakd2Z1JuMEZSWTdET2Y4cGVvCi0tLSBNTEZKNkI4ZGw3aFhvVDNCK2JWd0c2\nRkpENXM4OXpkQUJOWnNVZjJzYzk0Cic2m6ZalXUPRH2KjKUNlH3bV58NG0CMIgA/\njl1h5rGuFDLfuKiQehkOebf0k+Ndy1c2frJQ1wyM6Cs9OzLexqQ=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
 			},
 			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxKzBlbXJzMGFja1V1S3lM\neFBwVFEyRUNzM0NwdWVKVWlrbGNuWWVBZzNZCnlZTExVVXVDWnJuTXFIZkZvTmxM\neW56QmY1SXpsUTZ4U1FFRGVaSk9HMXMKLS0tIGdMWEVuY1NBUlgzUmNBUDNjdDNp\nN3M1L1Vhd29TUE9CbVN2VzVQSjkzVncKMkhz0pswmwQuxKv0vvy72if99W2kM6ri\nhL/8uFrebbpH0tfB6cUMocFuUwng+QwUSrKRjhSIFnfF9DdXcdjrDg==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGFmWXJhTGRa\nckliN1dQR2hEYzBFWlNFd2hEWktvejluQkNQbWVnWXRZQ00gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpEQm9VK3BhbUpML2crSjdPQnk4aHJM\nV0pDUVZ6YmV1dUJzeXJBNkpDNmpFCi0tLSBWSWZRSWJGb1J0MGtXL1k4T1RVRWgy\ncnF5cCtUTXJKSFpCN1Q5alJxMi80Crgi+HtBO07LNKqN6RbRRzzjcrym+BkomFTT\na8ZLyCGECiAXoZ26GJ/RRjzru8S8VhArmy3uwa3mKpT5STkFYAQ=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbnVQYi9aSGZ3RnRxS1pa\nK3BIYURpZElQYmppTG91TjU5T0U3NEdBdXlBClJkWENhRjU2anE5NDR4Z1RUaE1j\nUTdrN1JEb0sxL0EwaDBraGM2RnFVSncKLS0tIENzL0QyaEhhai9qaXJVWFV4dG5Y\naEtyczl5SHVEQ2ljU1h6RVRqOTlnbE0KVCHBXJ9ySVydzRoVBXRrjHnzX7A9pqmr\nRXB/nz4JIw/L3MQRURKlcgh5cJYazduM764NmvbNX2zOQKKcsrfkZw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvMStWdXpIV254WjNzMERj\nRXdpSG5EMmd2cld1bWYzdXJLQVlVVnVUUG1VCmJSMFk3SGdacitLbWQwT0lvWm9F\nanhIcUYydGJzYXVYZm95dWM3aXdDVE0KLS0tIHM4TDBuT0RjSG1oUHdYT2RVMHBw\nR1pTY2ZnTXNvZ2tObFA1WFdWZGFsTkEKH30K1NjoZatx84XhIqSxAZwrYpZ8xQqF\noFkKzh3NZ5dp3xJEIIlpSX3mydyB1+THBtKlx0x7oyN2AudO3TE6Pw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
 			},
 			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIENpc3oxVFFM\nQTd4K3hiQjdFOHF1K2NuR1VQRXRnNUVqcG1EdWUydlBYRWcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6bkkydC9NL1E1bkUwWlNRYis2RFEy\nYmMxR0tIK1V1a2pGQ2FXUlFWdHpZCi0tLSBQOTVUbGhnTFZGd2xEWUIwaGk1T1l1\nMDNFdHBTSUNhb2VnWkMveVJJek1RCjAt7RW0r3E0N6NTzrB3vRcE/sd7CsU8q7Q+\nuLVVd5JJ9SKDGRMNZH2y0HNrKbag/+/PFzPgChyWH6fLAFMnInw=\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPU3ptYnZxZVcrU0Y3MEdM\nb0hrTTBPYzNCYjhlZjNKSFdJRllGeDhVYUQ0CitYM1Bjb05lYW9adEh0VjVaU0l3\nWFg3NXVZamlkQ1ZLdGhQQ1ZiNmdhUWMKLS0tIDR4bVhxY3NSZ01yZnR1NzllMEwz\nRytWbi9BYnJFcWE5cW44R0c0WWpSQzQKeEjW8I/5XNhEs+FCJ4xtjxD60OMfB169\nQ6zBQP8E/yfTIva4dsLCdvRTB49ibsinfzZOyBQ+ICQPz3g8C3Lc2Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
 			},
 			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpOWx5YUdvTlNpd0xWYmlz\na1dMZkZWcFAyaHpHMHRqekRMakFudXJtUEZJCnZ6NEJuaGJORmdYTzNLOUkxZm5a\nRzByUjE4eWVuNk9EQ3JKcUZaNi9MR3MKLS0tIGdGTmw2WFdaRnNaZ2RRYTE4bno1\nWThrN3dXRFl0dmpGKzRWRmR2NkFsVkEKukMHVX2A6IiJxLwEWZyqpi1JyZM4QVLU\nuORho4MPVZSQA3VHo2+5HhO8FPdysD++cs0+5CUvgObo4sF7PYk9cQ==\n-----END AGE ENCRYPTED FILE-----\n",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpa0M3R1R6Q2wwazROZDN6\nUzFMYml4b2dNcWMycVNXNVIvQzhDUGZ3M2hzCmxKR1RhYTJkN2pnZjdwUW5PT1BY\nckpEeW5IcVh0ZklEVk1VOFkyZ0tDRGcKLS0tIDA0Vmx5NHhCWGQxZzAvOTBUWTFm\nYVlEdzlnWmpGM05XcTEvaVV5OFVNcEkKh2qhAWU+Hwz1Z+JAkirnGc6CMbykCOKy\nTyNxqzHX7z7o+8V+Oc3ChiuxSkruZQyajRgLdkrEZq/bnJDNfM0hgg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMTEttZ1dZYkhBRW1CVGdr\ncTNHTTFHUEZIVmEwV1YvSHgwL0NnWC9CaVdnCjRQWHoreldrZktsbFdCTEdLaXhF\ncTdWTlJGV3hZV0pBNUxyM0UrL1FIRUUKLS0tIGlpY1d2WXFSUk9WWUJ0RDdKUk9H\nL2p0cFNzQjhsYlRkd25RK0ZhUjlIKzQKj5vlI+K3D02AAC8j8Nn99EgOnEc2YRWj\nm3XTcyiCFTQDVMPWbUZXPelCIBLSPmksC1zLkWtlaWmOFkT/iLzWZg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-12-03T06:48:44Z",
 		"mac": "ENC[AES256_GCM,data:dMYkl39sOxlSL4Bl0S2FTHdHaiRECJkIrBSfthnmT0/LxcYoFi4RM27pY09QFfS5Ohg1DC0Chs+hSBCLsVidSWJCvwyuF0ir4zKJZM7+KeyJFq51InhiqjLXJAMwh0BL8BnCiLcdlblbCCg1JKrlwfMrPl3dLYhi/a7DVWMXz6g=,iv:9WGXjfhrAoEtecJWG99cTZTs6i34AfmL3IkeefuJmJY=,tag:kKgB63Cj9sFjhPfJjEruXw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }