mob next [ci-skip] [ci skip] [skip ci]

lastFile:modules/clan/phonebox/default.nix

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761768376,
-        "narHash": "sha256-AZL8SPJ520NRnLft9Xz4trTECBB510YPRXJnE1OUeXw=",
+        "lastModified": 1764799743,
+        "narHash": "sha256-MbbiNG/bhqe+4z7ml8TefIs4swSonmiV0CimCntXuCg=",
         "ref": "refs/heads/main",
-        "rev": "bbc9486f0e6306f68e11f8aefa243da9f1c8c56f",
-        "revCount": 10924,
+        "rev": "ddc0f9fabf33ad000676a33e97be6b5df12a4560",
+        "revCount": 11417,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -49,11 +49,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760612273,
-        "narHash": "sha256-pP/bSqUHubxAOTI7IHD5ZBQ2Qm11Nb4pXXTPv334UEM=",
-        "rev": "0099739c78be750b215cbdefafc9ba1533609393",
+        "lastModified": 1762942435,
+        "narHash": "sha256-zIWGs5FIytTtJN+dhDb8Yx+q4TQI/yczuL539yVcyPE=",
+        "rev": "0ee328404b12c65e8106bde9e9fab8abf4ecada4",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0099739c78be750b215cbdefafc9ba1533609393.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0ee328404b12c65e8106bde9e9fab8abf4ecada4.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760701190,
-        "narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
+        "lastModified": 1764627417,
+        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
+        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
         "type": "github"
       },
       "original": {
@@ -162,11 +162,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761339987,
-        "narHash": "sha256-IUaawVwItZKi64IA6kF6wQCLCzpXbk2R46dHn8sHkig=",
+        "lastModified": 1764161084,
+        "narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "7cd9aac79ee2924a85c211d21fafd394b06a38de",
+        "rev": "e95de00a471d07435e0527ff4db092c84998698e",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
     },
     "nix-select": {
       "locked": {
-        "lastModified": 1755887746,
-        "narHash": "sha256-lzWbpHKX0WAn/jJDoCijIDss3rqYIPawe46GDaE6U3g=",
-        "rev": "92c2574c5e113281591be01e89bb9ddb31d19156",
+        "lastModified": 1763303120,
+        "narHash": "sha256-yxcNOha7Cfv2nhVpz9ZXSNKk0R7wt4AiBklJ8D24rVg=",
+        "rev": "3d1e3860bef36857a01a2ddecba7cdb0a14c35a9",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/92c2574c5e113281591be01e89bb9ddb31d19156.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/3d1e3860bef36857a01a2ddecba7cdb0a14c35a9.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -190,11 +190,11 @@
     },
     "nixos-facter-modules": {
       "locked": {
-        "lastModified": 1761137276,
-        "narHash": "sha256-4lDjGnWRBLwqKQ4UWSUq6Mvxu9r8DSqCCydodW/Jsi8=",
+        "lastModified": 1764252389,
+        "narHash": "sha256-3bbuneTKZBkYXlm0bE36kUjiDsasoIC1GWBw/UEJ9T4=",
         "owner": "nix-community",
         "repo": "nixos-facter-modules",
-        "rev": "70bcd64225d167c7af9b475c4df7b5abba5c7de8",
+        "rev": "5ea68886d95218646d11d3551a476d458df00778",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760998189,
-        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -44,9 +44,24 @@
           ./machines
           ./routers
           ./inventories
+          ./overlays
+          ./tests
           ./modules/clan/flake-module.nix
           ./modules/nixos/flake-module.nix
         ];
+        perSystem =
+          { pkgs, system, ... }:
+          {
+            _module.args.pkgs = import inputs.nixpkgs {
+              inherit system;
+              overlays = [
+                inputs.self.overlays.packagesOverlay
+              ];
+              config = { };
+            };
+            packages.think = pkgs.think-gtcm;
+            packages.think-be = pkgs.think-backend-gtcm;
+          };
       }
     );
 }

inventories/default.nix

@@ -3,10 +3,24 @@
     inventory = {
 
       tags = {
-        glom = [ "vega" ];
-        b4l = [ "rigel" ];
+        glom = [
+          "vega"
+          "ramus"
+        ];
         w = [ "sirius" ];
-        fax-bridge = [ ];
+        b4l = [
+          "rigel"
+          "neptune"
+        ];
+        phonebox = [
+          "neptune"
+          "rigel"
+          "almach"
+          "alpheratz"
+          "mirach"
+          "adhil"
+          "buna"
+        ];
       };
 
       instances = {
@@ -32,6 +46,14 @@
           };
         };
 
+        tor = {
+          module = {
+            name = "tor";
+            input = "clan-core";
+          };
+          roles.server.tags."nixos" = { };
+        };
+
         w-network = {
           module = {
             name = "zerotier";
@@ -64,19 +86,29 @@
           roles.peer.tags.b4l = { };
         };
 
-        yggdrasil = {
+        yggdrasil-phone-network = {
           module = {
             name = "yggdrasil";
-            input = "self";
+            input = "clan-core";
           };
-          roles.default.tags."fax-bridge" = { };
+          roles.default.tags."phonebox" = { };
+          roles.default.settings.extraPeers = [
+            "tls://ygg.jjolly.dev:3443"
+            "tls://[2602:fc24:18:7a42::1]:993"
+            "tcp://leo.node.3dt.net:9002"
+            "tcp://ygg-kcmo.incognet.io:8883"
+          ];
         };
 
-        asterisk = {
+        phonebox = {
           module = {
-            name = "asterisk";
+            name = "phonebox";
             input = "self";
           };
+          roles.default.tags."phonebox" = { };
+          roles.default.machines."adhil".settings = {
+            ata-ethernet-iface = "end0";
+          };
         };
 
         pocket-id = {
@@ -142,6 +174,32 @@
           };
           roles.default.machines.b4l = { };
         };
+        pulse-stream = {
+          module = {
+            name = "pulse-stream";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.client-ip-ranges = [
+              "10.0.0.0/24"
+            ];
+          };
+        };
+        jukebox = {
+          module = {
+            name = "jukebox";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings = {
+              binds = [ "wlp1s0" ];
+              disks.m3 = {
+                uuid = "105D-319E";
+                mountOptions = [ "utf8" ];
+              };
+            };
+          };
+        };
       };
     };
   };

inventory.json

@@ -1 +1,25 @@
-{}
+{
+  "machines": {
+    "ramus": {
+      "installedAt": 1764139649
+    },
+    "alpheratz": {
+      "installedAt": 1764741499
+    },
+    "mirach": {
+      "installedAt": 1764744666
+    },
+    "almach": {
+      "installedAt": 1764745787
+    },
+    "neptune": {
+      "installedAt": 1762147067
+    },
+    "adhil": {
+      "installedAt": 1765277591
+    },
+    "buna": {
+      "installedAt": 1765343708
+    }
+  }
+}

machines/adhil/configuration.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "aarch64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.meta.name = "adhil";
+  clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
+
+}

machines/adhil/disko.nix

@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-SD64G_0xfb330ff6";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/almach/configuration.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.meta.name = "almach";
+  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+
+}

machines/almach/disko.nix

@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d64f17";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "4G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/alpheratz/configuration.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.meta.name = "alpheratz";
+  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+
+}

machines/alpheratz/disko.nix

@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0xaedcfa8b";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "4G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/b4l/configuration.nix

@@ -19,4 +19,18 @@
   services.nginx.virtualHosts."${config.networking.fqdn}" = {
     enableACME = true;
   };
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
 }

machines/buna/configuration.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.meta.name = "buna";
+  clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
+
+}

machines/buna/disko.nix

@@ -0,0 +1,56 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/usb-Generic_MassStorageClass_000000001539-0:0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              end = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              name = "root";
+              end = "-0";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+                extraArgs = [
+                  "-O"
+                  "extra_attr,inode_checksum,sb_checksum,compression"
+                ];
+                mountOptions = [
+                  "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard"
+                ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/mirach/configuration.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  # clan.core.networking.targetHost = "root@";
+
+  clan.meta.name = "mirach";
+  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+
+}

machines/mirach/disko.nix

@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d64f33";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "4G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/neptune/configuration.nix

@@ -0,0 +1,62 @@
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
+{
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  networking.interfaces.enx00e04c106368.useDHCP = true; # recovery
+
+  clan.core.vars.generators.wireless-credentials = {
+    files = {
+      essid.secret = false;
+      psk.secret = true;
+    };
+    prompts = {
+      essid.persist = true;
+      psk.persist = true;
+    };
+    script = ''
+      cat "$prompts"/essid > $out/essid
+      prompt_psk=$(cat "$prompts"/psk)
+      echo "psk=$prompt_psk" > $out/psk
+    '';
+  };
+
+  networking.wireless =
+    let
+      credentials = config.clan.core.vars.generators.wireless-credentials.files;
+    in
+    {
+      enable = true;
+      secretsFile = credentials.psk.path;
+      networks.${credentials.essid.value}.pskRaw = "ext:psk";
+    };
+
+  networking.interfaces.wlp1s0 = {
+    useDHCP = false;
+    ipv4.addresses = [
+      {
+        address = "10.0.0.9";
+        prefixLength = 24;
+      }
+    ];
+  };
+
+  services.yggdrasil.settings.Peers = lib.mkForce [
+    "tcp://newt.barry.town:1337"
+    "tls://yg-hkg.magicum.net:32333"
+    "tls://astrra.space:55535"
+  ];
+
+  clan.meta.name = "neptune";
+  clan.meta.description = "Radxa SBC board for testing. (With vi)";
+
+}

machines/neptune/disko.nix

@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x9d59499c";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/ramus/configuration.nix

@@ -0,0 +1,35 @@
+{ self, config, ... }:
+{
+  system.stateVersion = "25.11";
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.meta.name = "ramus";
+  clan.meta.description = ''
+    A Hetzner VPS machine own by Alex.
+  '';
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
+
+  users.users.nginx.extraGroups = [ "acme" ];
+
+  security.acme.acceptTerms = true;
+
+  imports = [ ./think-greater-chiangmai.nix ];
+}

machines/ramus/disko.nix

@@ -0,0 +1,84 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_107266387";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/ramus/think-greater-chiangmai.nix

@@ -0,0 +1,136 @@
+{ self, config, ... }:
+let
+  commonSettings = {
+    APP_NAME = "Laravel";
+    APP_ENV = "local";
+    APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
+    APP_DEBUG = "false";
+    APP_URL = "http://localhost";
+
+    DB_CONNECTION = "mysql";
+    DB_HOST = "localhost";
+    DB_PORT = 3306;
+    DB_DATABASE = "thinkgtcm";
+    DB_USERNAME = "gtcm";
+
+    R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
+    R2_SECRET_ACCESS_KEY._secret =
+      config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
+    R2_REGION = config.clan.core.vars.generators.greaterchiangmai-s3.files.region.value;
+    R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
+    R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;
+
+    LOG_CHANNEL = "stack";
+    LOG_LEVEL = "debug";
+
+    FILESYSTEM_DISK = "local";
+
+    BROADCAST_DRIVER = "log";
+    CACHE_DRIVER = "file";
+    QUEUE_CONNECTION = "sync";
+    SESSION_DRIVER = "file";
+    SESSION_LIFETIME = 120;
+
+    MEMCACHED_HOST = "127.0.0.1";
+
+    REDIS_HOST = "127.0.0.1";
+    REDIS_PORT = 6379;
+
+    UPLOAD_MAX_FILESIZE = "5000M";
+    POST_MAX_SIZE = "5000M";
+
+    TEST_LOCAL = true;
+  };
+
+  baseDomain = "greaterchiangmai.com";
+  domain = "think.${baseDomain}";
+  domainBackend = "think-backend.${baseDomain}";
+in
+{
+  imports = [
+    self.nixosModules.think-gtcm
+    self.nixosModules.think-backend-gtcm
+  ];
+  nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+
+  clan.core.vars.generators.greaterchiangmai = {
+    files = {
+      app_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+    };
+
+    prompts = {
+      app_key.persist = true;
+    };
+
+    script = ''
+      cat $prompts/app_key > $out/app_key
+    '';
+  };
+
+  clan.core.vars.generators.greaterchiangmai-s3 = {
+    files = {
+      access_key_id.secret = false;
+      secret_access_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+      endpoint.secret = false;
+      region.secret = false;
+      bucket.secret = false;
+    };
+
+    prompts = {
+      access_key_id.persist = true;
+      secret_access_key.persist = true;
+      endpoint.persist = true;
+      region.persist = true;
+      bucket.persist = true;
+    };
+
+    script = ''
+      cat $prompts/access_key_id > $out/access_key_id
+      cat $prompts/secret_access_key > $out/secret_access_key
+      cat $prompts/endpoint > $out/endpoint
+      cat $prompts/region > $out/region
+      cat $prompts/bucket > $out/bucket
+    '';
+  };
+
+  services.think-greaterchiangmai = {
+    enable = true;
+    domain = domain;
+    settings = commonSettings;
+  };
+  services.think-backend-greaterchiangmai = {
+    enable = true;
+    domain = domainBackend;
+    settings = commonSettings;
+  };
+
+  security.acme.certs = {
+    "${domain}" = {
+      email = config.clan.core.vars.generators.acme.files.email.value;
+      webroot = "/var/lib/acme/acme-challenge/${domain}";
+    };
+    "${domainBackend}" = {
+      email = config.clan.core.vars.generators.acme.files.email.value;
+      webroot = "/var/lib/acme/acme-challenge/${domainBackend}";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    useACMEHost = domain;
+    acmeRoot = config.security.acme.certs.${domain}.webroot;
+  };
+  services.nginx.virtualHosts.${domainBackend} = {
+    forceSSL = true;
+    useACMEHost = domainBackend;
+    acmeRoot = config.security.acme.certs.${domainBackend}.webroot;
+  };
+}

modules/clan/asterisk/default.nix

@@ -1,69 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "asterisk";
-  manifest.description = "Asterisk PBX server";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-    perInstance.nixosModule =
-      {
-        lib,
-        ...
-      }:
-      {
-        services.asterisk = {
-          enable = lib.mkDefault true;
-          confFiles = {
-            # Dial plan config
-            "extensions.conf" = ''
-              exten => 1001,1,Dial(PJSIP/user1,20)
-              exten => 1002,1,Dial(PJSIP/user2,20)
-
-              exten => 100,1,Answer()
-              same  =>     n,Wait(1)
-              same  =>     n,Playback(hello-world)
-              same  =>     n,Hangup()
-            '';
-
-            "pjsip.conf" = ''
-              [transport-udp]
-              type=transport
-              protocol=udp
-              bind=0.0.0.0,[::]
-
-              [endpoint_internal](!)
-              type=endpoint
-              context=from-internal
-              disallow=all
-              allow=ulaw
-
-              [auth_userpass](!)
-              type=auth
-              auth_type=userpass
-
-              [aor_dynamic](!)
-              type=aor
-              max_contacts=1
-
-              [user1](endpoint_internal)
-              auth=user1
-              aors=user1
-              [user1](auth_userpass)
-              password=user1
-              username=user1
-              [user1](aor_dynamic)
-
-              [user2](endpoint_internal)
-              auth=user2
-              aors=user2
-              [user2](auth_userpass)
-              password=user2
-              username=user2
-              [user2](aor_dynamic)
-            '';
-          };
-        };
-      };
-  };
-}

modules/clan/asterisk/flake-module.nix

@@ -1,18 +0,0 @@
-{ lib, ... }:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    asterisk = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.asterisk = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/asterisk" = module;
-      };
-    };
-}

modules/clan/asterisk/tests/vm/default.nix

@@ -1,39 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  name = "service-asterisk";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        asterisk-test = {
-          module.name = "@clan/asterisk";
-          module.input = "self";
-          roles.default.machines."server".settings = { };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      services.asterisk = {
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("asterisk")
-
-    # Check that garage is running
-    server.succeed("systemctl status asterisk")
-
-  '';
-}

modules/clan/jukebox/default.nix

@@ -0,0 +1,133 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "jukebox";
+  manifest.description = "mpd server, library on removable disks";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          baseDir = lib.mkOption {
+            type = lib.types.str;
+            default = "/mnt/jukebox";
+          };
+          binds = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = [ ];
+          };
+          disks = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      uuid = lib.mkOption {
+                        type = str;
+                      };
+                      mountOptions = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+            description = "disks comprising library";
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            services.pulseaudio.enable = true;
+
+            # workaround cookie permissions
+            services.pulseaudio.tcp.enable = true;
+            services.pulseaudio.tcp.anonymousClients = {
+              allowedIpRanges = [ "127.0.0.1" ];
+              allowAll = true;
+            };
+
+            systemd.tmpfiles.rules = [
+              "d ${settings.baseDir} 0755 root root"
+            ];
+
+            fileSystems =
+              let
+                disk2fs =
+                  {
+                    name,
+                    uuid,
+                    mountOptions,
+                    ...
+                  }:
+                  lib.nameValuePair "${settings.baseDir}/${name}" {
+                    device = "/dev/disk/by-uuid/${uuid}";
+                    fsType = "auto";
+                    options = [
+                      "noauto"
+                      "nofail"
+                    ]
+                    ++ mountOptions;
+                  };
+              in
+              lib.listToAttrs (lib.mapAttrsToList (_: disk2fs) settings.disks);
+
+            services.udev.extraRules =
+              let
+                translate-prefix = path: (lib.removePrefix "-" (lib.replaceStrings [ "/" ] [ "-" ] path));
+                mount-name = name: "${translate-prefix settings.baseDir}-${name}.mount";
+                disk2rule =
+                  { name, uuid, ... }:
+                  lib.concatStringsSep ", " [
+                    ''ACTION=="add"''
+                    ''SUBSYSTEM=="block"''
+                    ''ENV{DEVLINKS}=="*/dev/disk/by-uuid/${uuid}*"''
+                    ''ENV{SYSTEMD_WANTS}="${mount-name name}"''
+                  ];
+              in
+              lib.concatMapStringsSep "\n" disk2rule (lib.attrValues settings.disks);
+
+            services.mpd = {
+              enable = true;
+              musicDirectory = settings.baseDir;
+              network.listenAddress = "any";
+              extraConfig = ''
+                audio_output {
+                  type "pulse"
+                  name "jukebox"
+                  server "localhost"
+                }
+              '';
+            };
+
+            networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
+              allowedTCPPorts = [ config.services.mpd.network.port ];
+            });
+
+            environment.systemPackages = [ pkgs.mpc ];
+          };
+      };
+  };
+}

modules/clan/jukebox/flake-module.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    jukebox = module;
+  };
+}

modules/clan/phonebox/default.nix

@@ -0,0 +1,364 @@
+{ clanLib, ... }:
+{
+  _class = "clan.service";
+  manifest.name = "phonebox";
+  manifest.description = "";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    interface =
+      { lib, ... }:
+      {
+        options.ata-ethernet-iface = lib.mkOption {
+          type = lib.types.str;
+          description = "An Ethernet interface that connect to ATA box.";
+          default = "enp2s0";
+        };
+      };
+    perInstance =
+      {
+        roles,
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            lib,
+            config,
+            pkgs,
+            ...
+          }:
+          let
+            user = "asterisk";
+            rtpPortFrom = 10000;
+            rtpPortTo = 20000;
+            ata-interface = settings.ata-ethernet-iface;
+
+            genServerSIPEndpoint =
+              { hostname, address }:
+              ''
+                [${hostname}](internal_endpoint)
+                aors=${hostname}
+
+                [${hostname}](ip_auth)
+                endpoint=${hostname}
+                match=[${address}]
+
+                [${hostname}](dynamiic_aor)
+                contact=sip:[${address}]
+              '';
+
+            genLocalSIPEndpoint =
+              { localNumber }:
+              ''
+                [${localNumber}](internal_endpoint)
+                aors=${localNumber}
+                auth=${localNumber}
+
+                [${localNumber}](userpass_auth)
+                username=${localNumber}
+                password=${localNumber}
+
+                [${localNumber}](dynamiic_aor)
+                max_contacts=1
+              '';
+
+            genLocalExtenConf =
+              { localNumber }:
+              ''
+                exten => ${localNumber},1,Dial(PJSIP/${localNumber},20)
+              '';
+            genExtentConf =
+              {
+                prefixNumber,
+                hostname,
+                localNumber,
+              }:
+              let
+                replaceWithX =
+                  ln: builtins.concatStringsSep "" (builtins.genList (_: "X") (builtins.stringLength ln));
+              in
+              ''
+                exten => _${prefixNumber}${replaceWithX localNumber},1,Dial(PJSIP/''${EXTEN:${builtins.toString (builtins.stringLength prefixNumber)}}@${hostname},30)
+              '';
+
+            getYggdrasilIP =
+              machineName:
+              if config.clan.core.vars.generators.yggdrasil.files.address ? value then
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "yggdrasil";
+                  file = "address";
+                  default = null;
+                }
+              else
+                throw "clanService/yggdrasil is required";
+          in
+          {
+            clan.core.vars.generators.phonebox = {
+              files = {
+                server-prefix-number.secret = false;
+                ata-local-number.secret = false;
+              };
+
+              prompts = {
+                server-prefix-number = {
+                  type = "line";
+                  description = "Server prefix number: indicate server to connect to [10XX]";
+                };
+                ata-local-number = {
+                  type = "line";
+                  description = "Local suffix number: indicate local number on the server [XX00]";
+                };
+              };
+
+              script = ''
+                cat $prompts/server-prefix-number > $out/server-prefix-number
+                cat $prompts/ata-local-number > $out/ata-local-number
+              '';
+            };
+
+            networking.interfaces = {
+              ${ata-interface} = {
+                useDHCP = false;
+                ipv4.addresses = [
+                  {
+                    address = "192.168.254.1";
+                    prefixLength = 24;
+                  }
+                ];
+              };
+            };
+
+            services.dnsmasq = {
+              enable = true;
+
+              settings = {
+                bind-dynamic = true;
+                listen-address = "192.168.254.1";
+                # enable-ra = true;
+                domain-needed = true;
+                domain = "localhost";
+                dhcp-range = [
+                  "192.168.254.100,192.168.254.100,255.255.255.0,3m"
+                ];
+                dhcp-leasefile = "/dev/null";
+                dhcp-option = [
+                  "3,192.168.254.1"
+                ];
+                interface = [ ata-interface ];
+              };
+            };
+
+            services.nginx = {
+              enable = true;
+              virtualHosts = {
+                "_" = {
+                  locations."/" = {
+                    proxyPass = "http://192.168.254.100";
+                    extraConfig = ''
+                      client_max_body_size 100M;
+                    '';
+                  };
+                };
+              };
+            };
+
+            networking.firewall.allowedUDPPortRanges = [
+              {
+                from = rtpPortFrom;
+                to = rtpPortTo;
+              }
+            ];
+
+            networking.firewall.allowedUDPPorts = [
+              53
+              67
+              5060
+            ];
+            networking.firewall.allowedTCPPorts = [
+              53
+            ];
+            networking.firewall.interfaces =
+              let
+                matchAll = if !config.networking.nftables.enable then "zt+" else "zt*";
+              in
+              {
+                "${matchAll}".allowedTCPPorts = [ 80 ];
+              };
+
+            services.asterisk = {
+              enable = lib.mkDefault true;
+              confFiles =
+                let
+                  machines = lib.attrNames roles.default.machines;
+                  nodes = builtins.foldl' (
+                    nodes: name:
+                    nodes
+                    ++ [
+                      {
+                        hostname = name;
+                        address = getYggdrasilIP name;
+                        prefixNumber = clanLib.getPublicValue {
+                          flake = config.clan.core.settings.directory;
+                          machine = name;
+                          generator = "phonebox";
+                          file = "server-prefix-number";
+                          default = null;
+                        };
+
+                        localNumber = clanLib.getPublicValue {
+                          flake = config.clan.core.settings.directory;
+                          machine = name;
+                          generator = "phonebox";
+                          file = "ata-local-number";
+                          default = null;
+                        };
+                      }
+                    ]
+                  ) [ ] machines;
+                in
+                {
+                  "logger.conf" = ''
+                    [general]
+                    dateformat = %F %T.%3q ; ISO 8601 date format with milliseconds
+                    use_callids = yes
+                    appendhostname = no
+                    queue_log = yes
+                    queue_log_to_file = no
+                    queue_log_name = queue_log
+                    queue_log_realtime_use_gmt = no
+                    rotatestrategy = rotate
+                    exec_after_rotate=gzip -9 $\{filename\}.2
+                    [logfiles]
+                    console => notice,warning,error
+                    security => security
+                    messages => notice,warning,error
+                    full => notice,warning,error,verbose,dtmf,fax
+                    syslog.local0 => notice,warning,error
+                  '';
+
+                  # Dial plan config
+                  "extensions.conf" =
+                    let
+                      serverConf = builtins.foldl' (
+                        config: node:
+                        config
+                        + (genExtentConf {
+                          inherit (node) prefixNumber hostname localNumber;
+                        })
+                      ) "" nodes;
+                    in
+                    ''
+                      [from-internal]
+                      exten => 999,1,Answer()
+                      same  =>     n,Playback(hello-world)
+                      same  =>     n,Hangup()
+
+                      exten => 000,1,Answer()
+                      same => n,ReceiveFAX(/run/asterisk/test.tiff)
+                      same => n,Set(FAXFILE=/run/asterisk/test.tiff)
+                      same => n,Hangup()
+                      same => n,Dial(PJSIP/''${CALLERID(num)},30,U(send-fax-sub))
+                      same => n,Hangup()
+
+                      [send-fax-sub]
+                      exten => s,1,SendFAX($FAXFILE)
+                      same => n,Return()
+
+                    ''
+                    + (genLocalExtenConf {
+                      localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
+                    })
+                    + serverConf;
+
+                  "rtp.conf" = ''
+                    [general]
+                    rtpstart=${builtins.toString rtpPortFrom}
+                    rtpend=${builtins.toString rtpPortTo}
+                  '';
+
+                  "pjsip.conf" =
+                    let
+                      serverConf = builtins.foldl' (
+                        conf: node:
+                        conf
+                        + (genServerSIPEndpoint {
+                          hostname = node.hostname;
+                          address = node.address;
+                        })
+                      ) "" nodes;
+                    in
+                    ''
+                      [transport-udp]
+                      type=transport
+                      protocol=udp
+                      bind=0.0.0.0
+                      [transport-udp6]
+                      type=transport
+                      protocol=udp
+                      bind=::
+
+                      [base_endpoint](!)
+                      type=endpoint
+                      disallow=all
+                      allow=ulaw,alaw,g722,gsm
+                      direct_media=no
+
+                      [internal_endpoint](!,base_endpoint)
+                      context=from-internal
+
+                      [userpass_auth](!)
+                      type=auth
+                      auth_type=userpass
+
+                      [ip_auth](!)
+                      type=identify
+                      endpoint=external
+
+                      [dynamiic_aor](!)
+                      type=aor
+
+                    ''
+                    + (genLocalSIPEndpoint {
+                      localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
+                    })
+                    + serverConf;
+                };
+            };
+
+            systemd.services.asterisk-watcher = {
+              enable = true;
+              description = "Asterisk Configuration files watcher";
+
+              requires = [ "asterisk.service" ];
+              after = [ "network.target" ];
+              wantedBy = [ "multi-user.target" ];
+              path = with pkgs; [
+                inotify-tools
+                asterisk
+              ];
+              script = ''
+                inotifywait -m -e move /etc/asterisk |
+                while read path action file; do
+                  case "$file" in
+                    pjsip.conf)
+                      echo "restarting pjsip"
+                      asterisk -rx "pjsip reload"
+                      ;;
+                  esac
+                  case "$file" in
+                    extensions.conf)
+                      echo "restarting core"
+                      asterisk -rx "core restart now"
+                      ;;
+                  esac
+                done
+              '';
+            };
+          };
+      };
+  };
+}

modules/clan/phonebox/flake-module.nix

@@ -0,0 +1,23 @@
+{
+  inputs,
+  self,
+  ...
+}:
+let
+  module = ./default.nix;
+in
+{
+  clan.modules = {
+    phonebox = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.service-phonebox = {
+        imports = [ ./tests/vm/default.nix ];
+        _module.args = { inherit self inputs; };
+
+        clan.modules."@clan/phonebox" = module;
+      };
+    };
+}

modules/clan/phonebox/tests/vm/default.nix

@@ -0,0 +1,59 @@
+{
+  self,
+  hostPkgs,
+  config,
+  inputs,
+  lib,
+  ...
+}:
+{
+  name = "service-phonebox";
+  result.update-vars =
+    let
+      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
+    in
+    hostPkgs.writeShellScriptBin "update-vars" ''
+      set -x
+      export PRJ_ROOT=$(git rev-parse --show-toplevel)
+      ${
+        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
+      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
+    '';
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        yggdrasil = {
+          module.name = "yggdrasil";
+          roles.default.machines.server = { };
+        };
+        phonebox-test = {
+          module.name = "@clan/phonebox";
+          module.input = "self";
+          roles.default.machines."server".settings = {
+            ata-ethernet-iface = "enp2s0";
+          };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.asterisk = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("asterisk")
+
+    server.succeed("systemctl status asterisk")
+
+  '';
+}

modules/clan/phonebox/tests/vm/sops/machines/server/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
+    "type": "age"
+  }
+]

modules/clan/phonebox/tests/vm/sops/secrets/server-age.key/secret

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:t+zYfcA2f1sdUNBAl+bRGyhPEl5HZFIu+au6heH3+SoHf0zy+Deh25gaVay/oswIg2q806ozjEnTw9q2eaq0VXwMSAWOoTWteI0=,iv:sXoOmfzoCv6GHe21n2Elxr/GTdViI5vfLzMwOLvf1F4=,tag:Fmo9MjEaKV3BehR/bYRdVw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVlo0YjZFVFF2VkFlSzBL\ndHp4YTQ5RlNxV2FWNnNScTh5d0hXR05RL0NVCnBVUENNNjg0dTFVcmx3N3djZ25l\ncmxYTVVrNGhGSkdwVThoaC9UVTQ3L2sKLS0tIG1uREdFcXNubGxzUUQ1Rkh5Wnlx\nRG5OZmJwaGh2dkt6RSttb0gxZ3FBaEkKZzwUuQmOeBk5kfRfVVdqgNvsTU1Ssb/I\nx9Iv9w/YKHDmmcFLcAbGAHbS0/Js0YqBKZonxEMDdWP/+/F+Pv8LqQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-31T07:08:30Z",
+		"mac": "ENC[AES256_GCM,data:CBuTnVIta0eFqlB7ZpDkzPOEGbIQbb5oCpksI4umscB3uE0HM3j4N5r6bCPEcYpehB3qWXuCxlj4NfH7zmp6CDq6Be6bfpB1f8MCwTlPvQUho2f31so3U/g99q6ZyWI2rJO50dzn77bdma3JXo9VQb3uRqJ0mk72IYXFwdHvO9s=,iv:9uwjtGYpqsLcXRoBFmjJjfHUq7R47ZqkrKEXMulw4OY=,tag:4Auq3mnhlusogyW44SJfqg==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/phonebox/tests/vm/sops/secrets/server-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/phonebox/tests/vm/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}

modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-local-number/value

@@ -0,0 +1 @@
+fake_line_value

modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:L4fWAVQdQP2tgYPzUnDY5X0=,iv:fWeTc1buW/JI/8qngZwzDp+wq2OTZPGdItqG0Up5eZ8=,tag:RJt6PQdCisDhtbr3ph3fWA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFK2x0SkcxK2RxTDRvOEpZ\nTS9QNGJxbmZIL2xtUWxyNjA2VDNVWEQzQVc4CkkxeEZDQm1mQVdUUzVIQThDVkV3\nU2lWbnlnb3lqWDZ0NWRqa2RJV0pVK1UKLS0tIHc5eUJBUUtiL0NwZDRnN004UEtr\nYnU2SWlFOGlucTdydGVmZCtGK3NjS28KkNAxwz9MesicLWtViL302AwZYdiTHmd5\nppbwelisNVlsYHSa5ybVDYER4IUz1d8AKO0jtS7qEDfT53R36swSAA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArbEpzdk0xQTFkM2V0K2xz\nRFhDak0ybkhZUjJJdVI4YTl3cStXT2hTZDBFCmRvQ3ZXYkQ1NktCb004ZE1FS1FF\naSt4RlVXSlRhYWdlQ3htTkdkb2dyVDAKLS0tIG16VFNQM0dnaGVSRmlFRFB0WWtW\nN0dPL08rV01sY3ovRnEvUnNMaWVhd2sKvQIZIo5pPMXKh9Ea3ZgHj99Dn1X3JkmB\noscG8S7HOJh/cw+uITmkuv00TyIA9pid6L1kXvfcfv+tcuY9H1Vg4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-31T07:08:30Z",
+		"mac": "ENC[AES256_GCM,data:bmvshL97XNvNYYg0EjkUAQViHpKJ/+A+CGE90/uSM2WXooJF5yzvVJSHLAuYxWM295awN8ygTRUZ2VJ0SyfjzjAyUIH4SxqlrgywqMouyVsiFDAB6R4AmMmbvvC6rSs/TSMOwYC5pchrISbpsE2kmJnAXCqcev6Q0fl8Sa1PSxo=,iv:BuBQCFb3EWfG+bPzgaRDseDq6MJQ/Fs8okvksvEj1bA=,tag:n14VDbQk+zl+XbJPkTRAGg==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/ata-password/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/server-prefix-number/value

@@ -0,0 +1 @@
+fake_line_value

modules/clan/phonebox/tests/vm/vars/per-machine/server/state-version/version/value

@@ -0,0 +1 @@
+25.11

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/address/value

@@ -0,0 +1 @@
+202:fe87:1ca6:3cfd:e095:c2b1:321c:c391

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:0LwQxArH6fpIYpGIEzPtjh8elyKSaed7L+KqgnIlPVneR0UbsbOM6p5kVGTRPh5LWH6jmkURCqc2c5oT5CNLBePLQcgvtfLDSFWyyPrD9WtBSPu+YGF7K51JUUIkX07//LqTQQaM5Uu/STQRIoL1BD0Tofk2woA=,iv:3rSDqBj8N9RsSLijZm7mUUjUhiLHc2yidGkil8NvCD8=,tag:F8zlw9pfMjZdJSObDePLsQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0NnVzT0lOWnFTUU85c0d5\nZ0Q1b0xkS1NWbWVsc0o1emxLOW5NRU52REFZCjRkUGJHaDhyazdFdkxWaW1XVW53\nb25pUXlDRmhrTHlIWGl6RDJBZ2hTOW8KLS0tIGsxQmlQejkvQk9wTmtMQzZJa2dB\na0piOGlyMzVrTmNOUEhtaDNTWHdwTDAKroQG8KlnWZ6gwu1y0mr0gGezDF1jsS0Y\nC1LUAarHl+lY51sw+HJT88Y9mDfLjvYIMHKS33zdJuBXbNpoIfWyzA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqQVJhYkI1eEFYL0d5OE1F\nSStqV0xPb0pybyt2QWd4SEpiaDhlNDJicTA0CkgrVU9FcThuQktaMThTaXBmWHNV\nd2tpMVVYT21TWUFvMS9wakl4RyszTGsKLS0tIHVVeDdoMUJQaURMOGFkM3dNa3ZG\nMmVPdEg3bmdZZHgwaGpnbFFKUTdvcUUKTaxEfp19+9AJihqx51m0cLz6IuR5pvnT\nt90kZxq+BH3/6gjiDlhwzqztnMbdqQYcVuCDVp/1aVWfThABUZ92aQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-05T04:42:06Z",
+		"mac": "ENC[AES256_GCM,data:1/u3c/wf2Gh6PPeVTKKGBxG1FWvN7hyuzx3Qa7yU3yKCD7LDHrrzTbQkFHDo1ZrXixK5NICCw48BWA0Jao0kItu6aU1Dbk5PexZI9ls1eyaDS7nwtZuHKDSEtDYu/kx5kZgQKH9tsokLqKlcoeocS0Mp1tjvUSQsiZFaYsuKaM4=,iv:gCPqFgpwjSONn/JN3dpJOk1BXtdd9cvIAz/NKPuAdKg=,tag:j8upk9sgDiYj5lmfU4V+OQ==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/privateKey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/publicKey/value

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAIC8cazhgQ+1Hqdm8Z43J5ooymP2ytrBEvdfXYz0ryp8=
+-----END PUBLIC KEY-----

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value

@@ -0,0 +1 @@
+201:b9d:4329:71c2:79ca:3648:e86d:4236

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:bAJv40t1hkgMBz4boOEIw9GIY/4UFYI2WZidRrU88ky0JDBwSmHDnxuBFRpdjfAx7sO9d6vSHxAmaf45NlTKwnkUJnaIW0NK+979lXbLV+AG0suc4Vci6fsdbAHofR//3DfTYs03HoALkRUgRemTl7kQtdMB6E6LN02OE19HSVuFjMiEipwosmFfMoR69ZZuPSzNg1uVnw==,iv:LbZZGbwkXc71PAKgjD2CvXJVtyiqgi+cNsBzbulPyIk=,tag:VPESc2Y8SdU5CovQinZleA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fdkan6n20swmut0sa86g5a6gxrj8qj2sgqe8hxtw32c0u9rr4drqlyr5mf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2L3FzSkh3UTkvdTR6eEVE\nNnYrcnAydUl4QnJSbWJRbFFQODFmSld1YkJZCnNFUHp6YjQ3WW0vVHh5dXZBMzFJ\nYWRnZWNHN2dkL1JBWHNrZTcvTHI5S3MKLS0tIGpnekxneURuMWFkQ1RLTEszTFhi\nUUkzR2ljTXFhb1c2RDhpeFJXaXpYakUK/fLOqjNR2LML7uN3fiB9GdhWTDcr0wn4\n37ESeS1kx0EobRMaDVu8GPZovcdypFOOPiuUpEu6hIEdwvl736oDSA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjQWE2L3F1RW9oNlQzR0I3\nZDJoZ1hIM2N0Mm1aQ1IrN1gweWZxeWVGdUdzCmlIZXdKYm8rUGkvVVpiY1BJZmlD\nN0MwRHN3dUNrRU9McjNFMXpranJGU1UKLS0tIG1yMmJGaEp1cU1iZGdqdzRUTWZW\nZzZrVkRuOTBTcnFuaTE1Um1ISUxBaTQKf842rL3N7Gl1QfrIURWiu26LwO0ERkP4\nvfXN2HH1jjp2pblQF9qb+5vmUsaX1pPSY1R+YMvUK7wIwOb9zyIfmQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-31T07:50:02Z",
+		"mac": "ENC[AES256_GCM,data:/c1jqMSLd9/fxm1PxtRITr3qkjtrlJ/5wJgEVkraAqU6XTuzSyseMhdeWLL2Fy2OunT/+alM6VpaliBmcZqRkSSGngbuvMsujDiJLgUXQ8wNhMcK7ln/dqFMcA+RYGxihGEMwuPKs3yOVKj9PDzFYnm6TUCFkU/heotI/hQ1lQI=,iv:EsWsi4r4DctMLvi4WmqKe0D1NTHwYVKCcxKQ+6grzYg=,tag:28dmpzF/6dbvGIriaBVKPw==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/phonebox/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-subnet/value

@@ -0,0 +1 @@
+301:b9d:4329:71c2::/64

modules/clan/pulse-stream/default.nix

@@ -0,0 +1,42 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pulse-stream";
+  manifest.description = "stream audio to attached speakers";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    interface =
+      { lib, ... }:
+      {
+        options.client-ip-ranges = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "ip subnets permitted to stream to the server";
+          default = [ ];
+        };
+      };
+    perInstance =
+      {
+        roles,
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          { ... }:
+          {
+            services.pulseaudio = {
+              enable = true;
+              systemWide = true;
+              tcp = {
+                enable = true;
+                anonymousClients.allowedIpRanges = settings.client-ip-ranges;
+                anonymousClients.allowAll = true;
+              };
+              zeroconf.publish.enable = true;
+            };
+            networking.firewall.allowedTCPPorts = [ 4713 ];
+          };
+      };
+  };
+}

modules/clan/pulse-stream/flake-module.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pulse-stream = module;
+  };
+}

modules/nixos/flake-module.nix

@@ -3,5 +3,11 @@
     common = {
       imports = [ ./common.nix ];
     };
+    think-gtcm = {
+      imports = [ ./think-gtcm.nix ];
+    };
+    think-backend-gtcm = {
+      imports = [ ./think-backend-gtcm.nix ];
+    };
   };
 }

modules/nixos/think-backend-gtcm.nix

@@ -0,0 +1,292 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.think-backend-greaterchiangmai;
+  think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
+  defaultUser = "gtcm";
+  defaultGroup = "gtcm";
+
+  php = pkgs.php83;
+
+  artisan-be = pkgs.writeScriptBin "gtcm-be" ''
+    #! ${pkgs.runtimeShell}
+    cd ${think-backend-gtcm}
+    sudo() {
+      if [[ "$USER" != ${cfg.user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe php} artisan "$@"
+  '';
+
+in
+{
+  options.services.think-backend-greaterchiangmai = {
+    enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/think-backend.greaterchiangmai.com";
+      description = ''A place where to store states'';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which this runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      defaultText = "${defaultGroup}";
+      description = "Group under which the website runs.";
+    };
+
+    package = lib.mkPackageOption pkgs "think-backend-gtcm" { };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "think-backend.greaterchiangmai.com";
+      example = "forum.example.com";
+      description = "Domain to serve on.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = lib.mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      description = ''
+        Options for settings environment variables
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_NAME = "Laravel";
+          APP_ENV = "local";
+          APP_KEY = "key";
+          APP_DEBUG = true;
+          APP_URL = "http://localhost";
+
+          LOG_CHANNEL = "stack";
+          LOG_DEPRECATIONS_CHANNEL = "null";
+          LOG_LEVEL = "debug";
+
+          DB_CONNECTION = "mysql";
+          DB_HOST = "127.0.0.1";
+          DB_PORT = "3306";
+          DB_DATABASE = "laravel";
+          DB_USERNAME = "root";
+          DB_PASSWORD = "";
+        }
+      '';
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = lib.mkForce {
+      isSystemUser = true;
+      home = cfg.dataDir;
+      createHome = true;
+      homeMode = "755";
+      group = cfg.group;
+    };
+    users.groups.${cfg.group} = { };
+
+    services.phpfpm.pools.think-backend-gtcm = {
+      inherit (cfg) user group;
+      phpPackage = php;
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "listen.mode" = "0600";
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 10;
+        "pm.max_requests" = lib.mkDefault 500;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 1;
+        "pm.max_spare_servers" = lib.mkDefault 3;
+      };
+      phpOptions = ''
+        error_log = syslog
+        log_errors = on
+      '';
+    };
+
+    environment.systemPackages = [
+      artisan-be
+    ];
+
+    services.think-backend-greaterchiangmai.settings = {
+      APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
+      APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
+      APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
+      APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
+      APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
+    };
+
+    systemd.services.think-backend-gtcm-setup = {
+      description = "think-backend.greaterchiangmai installation";
+      requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
+      before = [ "phpfpm-think-backend-gtcm.service" ];
+      requires = [ "mysql.service" ];
+      after = [ "mysql.service" ];
+      serviceConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        UMask = 77;
+        WorkingDirectory = "${think-backend-gtcm}";
+        RuntimeDirectory = "think-backend-gtcm/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          gtcmEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              lib.escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !lib.elem v [
+              { }
+              null
+            ]
+          )) cfg.settings;
+          gtcmEnv = pkgs.writeText "gtcm-be.env" (gtcmEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${lib.getExe php} artisan key:generate --force
+          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."${cfg.domain}" = {
+        root = "${think-backend-gtcm}/public";
+        locations = {
+          "/" = {
+            index = "index.php";
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+          };
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
+          '';
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    services.mysql = {
+      enable = true;
+      package = lib.mkForce pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.DB_DATABASE ];
+      ensureUsers = [
+        {
+          name = cfg.settings.DB_USERNAME;
+          ensurePermissions = {
+            "${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+  };
+}

modules/nixos/think-gtcm.nix

@@ -0,0 +1,295 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.think-greaterchiangmai;
+  think-gtcm = pkgs.think-gtcm.override { dataDir = cfg.dataDir; };
+  defaultUser = "gtcm";
+  defaultGroup = "gtcm";
+
+  php = pkgs.php83;
+
+  artisan = pkgs.writeScriptBin "gtcm" ''
+    #! ${pkgs.runtimeShell}
+    cd ${think-gtcm}
+    sudo() {
+      if [[ "$USER" != ${cfg.user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe php} artisan "$@"
+  '';
+
+in
+{
+  options.services.think-greaterchiangmai = {
+    enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/think.greaterchiangmai.com";
+      description = ''A place where to store states'';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which this runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      defaultText = "${defaultGroup}";
+      description = "Group under which the website runs.";
+    };
+
+    package = lib.mkPackageOption pkgs "think-gtcm" { };
+
+    packageBackend = lib.mkPackageOption pkgs "think-backend-gtcm" { };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "think.greaterchiangmai.com";
+      example = "forum.example.com";
+      description = "Domain to serve on.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = lib.mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      description = ''
+        Options for settings environment variables
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_NAME = "Laravel";
+          APP_ENV = "local";
+          APP_KEY = "key";
+          APP_DEBUG = true;
+          APP_URL = "http://localhost";
+
+          LOG_CHANNEL = "stack";
+          LOG_DEPRECATIONS_CHANNEL = "null";
+          LOG_LEVEL = "debug";
+
+          DB_CONNECTION = "mysql";
+          DB_HOST = "127.0.0.1";
+          DB_PORT = "3306";
+          DB_DATABASE = "laravel";
+          DB_USERNAME = "root";
+          DB_PASSWORD = "";
+        }
+      '';
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      home = cfg.dataDir;
+      createHome = true;
+      homeMode = "755";
+      group = cfg.group;
+    };
+    users.groups.${cfg.group} = { };
+
+    services.phpfpm.pools.think-gtcm = {
+      inherit (cfg) user group;
+      phpPackage = php;
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "listen.mode" = "0600";
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 10;
+        "pm.max_requests" = lib.mkDefault 500;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 1;
+        "pm.max_spare_servers" = lib.mkDefault 3;
+      };
+      phpOptions = ''
+        error_log = syslog
+        log_errors = on
+      '';
+    };
+
+    environment.systemPackages = [
+      artisan
+    ];
+
+    services.think-greaterchiangmai.settings = {
+      APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
+      APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
+      APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
+      APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
+      APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
+    };
+
+    systemd.services.think-gtcm-setup = {
+      description = "think.greaterchiangmai installation";
+      requiredBy = [ "phpfpm-think-gtcm.service" ];
+      before = [ "phpfpm-think-gtcm.service" ];
+      requires = [ "mysql.service" ];
+      after = [ "mysql.service" ];
+      serviceConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        UMask = 77;
+        WorkingDirectory = "${think-gtcm}";
+        RuntimeDirectory = "think-gtcm/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          gtcmEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              lib.escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !lib.elem v [
+              { }
+              null
+            ]
+          )) cfg.settings;
+          gtcmEnv = pkgs.writeText "gtcm.env" (gtcmEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${lib.getExe php} artisan key:generate --force
+          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."${cfg.domain}" = {
+        root = "${think-gtcm}/public";
+        locations = {
+          "/" = {
+            index = "index.php";
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+          };
+
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
+          '';
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    services.mysql = {
+      enable = true;
+      package = pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.DB_DATABASE ];
+      ensureUsers = [
+        {
+          name = cfg.settings.DB_USERNAME;
+          ensurePermissions = {
+            "${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+  };
+}

overlays/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  flake.overlays = {
+    packagesOverlay = import ../pkgs/overlay.nix;
+  };
+}

pkgs/overlay.nix

@@ -0,0 +1,4 @@
+final: prev: {
+  think-gtcm = final.callPackage ./think-gtcm.nix { };
+  think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
+}

pkgs/think-backend-gtcm.nix

@@ -0,0 +1,32 @@
+{
+  fetchgit,
+  php,
+  dataDir ? "/var/lib/think-backend-gtcm",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
+    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+  };
+  src = "${repoSrc}/think-backend.greaterchiangmai.com";
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "think-backend-gtcm";
+  version = "1.0.0";
+
+  inherit src;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+    rm -rf $out/storage
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    runHook postInstall
+  '';
+
+  composerStrictValidation = false;
+  vendorHash = "sha256-eXm1x3E9KHWojaT2RU4inMdZqQVcWdLCKlvzhOlIZrc=";
+})

pkgs/think-gtcm.nix

@@ -0,0 +1,32 @@
+{
+  fetchgit,
+  php,
+  dataDir ? "/var/lib/think-gtcm",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
+    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+  };
+  src = "${repoSrc}/think.greaterchiangmai.com";
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "think-gtcm";
+  version = "1.0.0";
+
+  inherit src;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+    rm -rf $out/storage
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    runHook postInstall
+  '';
+
+  composerStrictValidation = false;
+  vendorHash = "sha256-QV3hR3U3GwCqrCRxfkazmJwDpO1vFyMfA6YqUb4bjMI=";
+})

routers/white-house/configuration.nix

@@ -25,6 +25,7 @@ in
     "${inputs.liminix}/modules/vlan"
     "${inputs.liminix}/modules/ssh"
     "${inputs.liminix}/modules/bridge"
+    "${inputs.liminix}/modules/health-check"
     "${modulesPath}/profiles/gateway.nix"
   ];
 
@@ -48,14 +49,46 @@ in
       name = "resolvconf";
       up = ''
         ( in_outputs ${name}
-         echo "nameserver $(output ${config.services.wan} ns1)" > resolv.conf
-         echo "nameserver $(output ${config.services.wan} ns2)" >> resolv.conf
+         echo "nameserver 208.67.222.222" >> resolv.conf
+         echo "nameserver 208.67.220.220" >> resolv.conf
+         echo "nameserver 1.1.1.1" >> resolv.conf
+         echo "nameserver 1.0.0.1" >> resolv.conf
+         echo "nameserver 8.8.8.8" >> resolv.conf
          chmod 0444 resolv.conf
         )
       '';
     }
   );
 
+  services.reAddDefaultroute =
+    let
+      threshold = 3;
+      healthCheck = pkgs.writeAshScript "ping-check" { } "ping 1.1.1.1";
+    in
+    pkgs.liminix.services.longrun rec {
+      # dependencies = [ config.services.wan ];
+      name = "hack-default-route";
+      run = ''
+        fails=0
+        while sleep 10 ; do
+          ${healthCheck}
+          if test $? -gt 0; then
+            fails=$(expr $fails + 1)
+          else
+            fails=0
+          fi
+          echo fails $fails/${toString threshold} for ${name}
+          if test "$fails" -gt "${toString threshold}" ; then
+            echo [+] adding default route
+            ${config.services.defaultroute4}/${config.services.defaultroute4.name}/up
+            ${config.services.defaultroute6}/${config.services.defaultroute6.name}/up
+            echo bounced
+            fails=0
+          fi
+        done
+      '';
+    };
+
   profile.gateway = {
     lan = {
       interfaces = with config.hardware.networkInterfaces; [
@@ -123,7 +156,7 @@ in
   defaultProfile.packages = with pkgs; [
     busybox
     iw
-    iptables
+    nftables
   ];
 
 }

sops/machines/adhil/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+    "type": "age"
+  }
+]

sops/machines/almach/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1m2e4c3gv7mxyg839gf0lfsh8wvygx3rn8u5cwnn99vw2w43ssers40tlq8",
+    "type": "age"
+  }
+]

sops/machines/alpheratz/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age17c9908f08w2w0ajprep4p60a7hd27cznrnxmq4mxwznvgzjuhymsxttd3d",
+    "type": "age"
+  }
+]

sops/machines/buna/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm",
+    "type": "age"
+  }
+]

sops/machines/mirach/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age15k6cz0lj207608gdlgxq6l2n5zsflvg0lw8qqlvkyk0xddc4kqvq9nh6ex",
+    "type": "age"
+  }
+]

sops/machines/neptune/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+    "type": "age"
+  }
+]

sops/machines/ramus/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+    "type": "age"
+  }
+]

sops/secrets/adhil-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/adhil-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:DXK8BjWBriLUvOP2jz+48QP87iolYrob32o2D13EID/wiRoJDzz4Txr1AobrHa1NU791coXU2r7gteWA5KjYudXEgQW2opDjPFw=,iv:jLBLq3KqTvuntbLLCCMB8cVTGejetM7oGYV2j9rRlrw=,tag:0h3UtQ4tTDgGxksKmRoSVw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBET3d5UTJRNExVRkppSE5I\ncG02V0lDcGZnTmdLRVBkWUlWS3hUaWVaa1NJCkV3V2pseDFQV3RvR0N4cjNqaEk4\naGRkaDBMQnJIc1BlMCtvVW94M0dkYTAKLS0tIHRySkpXMzJiMzFrUU1UekdPUmVi\nMmZiRXBSc3FXMndVNjRqc2xTSlU3RTAK/erwb450pgiQAdYQlrVe32BEiaFIthl2\nUVQTCHQILnxyfC19ZOmlAnSuhXXrj7XdAQmK40DLb0A52QpFC2EP9w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0dFdWFOdGgrR0hsemYr\nOGpFV1VqQS8vRHA3UURXMEQ2ZDJHcWNCVzBZCitvZTZYdDYzYm8xQzlYNHNVYmRt\nMWNzbitjaUxMSXN5WHp2SVhPY29XY0EKLS0tIGJOSUFBOU1RMHBnQWJsQkg0cFlp\nZ2c5QU5aeDlUMG1KTlMzQ1FPMldTeEUKxyt4xdySOfB8Fa8KjPytjjq0oGgeFBlo\n+uT97/DvDbiBfGaZPaSyJPRP+Mca0yQz9nltCOm7qz68BEjboFKUEw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGU1YU05Y1Zm\nZ0Q4RDB5ZFc4cndmaTVTRXc1MXNmdllocGdVa2xrREQwa1kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpPNEJKRkdxc1RkRWJ5d3diQzhuTjBy\nV1VNYXRKV2JXMGpPbWEycUlJSUh3Ci0tLSB2Y2dMV0M2OWwyUVRzZVNCZm91a3FL\nQnlFTjV0dnFhZWkxd2tNOWZScUMwCri3NvW7zXusWvELSRNc4kLfAc6JTbR8q4KS\nqu8E80e4gwng53PpHkmK0pBRYnJbZUf5DPITOy1mrbnNGMh6Nbs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEI3YWUzWWxp\nUSszSGNybG9oMitaUXludExlKzVOVFNNVkJteFpadWhtMDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpiTDJ2VGI5VjZZU0xKdTY4czhiT0RP\nbmZtU1ZQZERLNzk0MHpQM2gzdTVNCi0tLSBheWw4OVk5SzJYbW5ZZWl6SFRraXVK\nKzgrODM2alJON1FqTXczOW5JaWN3CpdplHYscbileaUWp0wSuirTOZUefZNUkbyh\nCqwS2/3JZ2IMhAYLfLoeVRbp7OrncmQF7L3KuvPPaE7WjAYwYug=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRMU0NKM2Fh\nQm9uYzYwQnNSWUdReGV1QXFXaXRORUJobURKOTFBbFoxRm8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpSVVgrL3RicHh2OEgvbC9xSzhjKzNz\nYnRIa0Qyc1I1cUhVZmJkSGk5YU1nCi0tLSBPb3Nud0Q3TjZMMkJvRGZNWklQSlFZ\nNHVndHNjZmljVExmNzNYdzRrZmJRCgwWFdIGjZJfugyk8GSk9zPE/cgERs9E48S9\nVjUEetmVvRPj3jOsseyrF8KF4ZAppo7u10WXKvTZOBTDISpCW0U=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMUoyTlhwOWVSNG1vbGdz\ncDJwc3ZTUjI4OUpLN3lnQWJvME0vbzkyTVJJCkJMbXUwbnVDMG5oNjVJR25wSVZw\nYjEyMWk2Y2pCa2N5ZTlka2tNTFVybXMKLS0tIE45akZVUWdsQmRUWFhuVmdhYTR5\nZ1hKVytCb2pvM0c5UDJlVVBUdXNxS2MKnQXRfa5eXzos/rAa3KUNtzKwXWuyqvU4\naMSGMpzI62JYrzv51od2sJVOPog0jrUsaIFx8rp6nuYsqRZ1fmDzKg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUmdlRldqaFFrZWp5eU5y\nSTRPeTVHdVFOYldkYVdKcFl6dklRMXpVWTE4Ci9KWUhJcnREMzJyNExZSFk0TFJl\nYmlVK1E5ZlFGWlJRZWwreVY3MWtHUzQKLS0tIElDNEl4UXFFNTJyODB6UnhaT3gw\nK1ViUzFLYjFTemcweERlaDNnR0FsaEkKJjG/XkynVLGQVdywXn0cM0db7X7aYrpP\nxYAUaS5SM7Ny0x3sEyP0+KdsWjBuHfi/CVsiTdBJ8CDpwkYSrpw5Lg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVnNpbUV3Z25weGFmTVg5\nOFV6cjl1eHJXemYzbitQNW9tSmNwaWdtQTA4Ci9ueHRSMndKVnJjVTFDQ044NEhs\nUEpuNnpSZDJjZzJuNjFMQ2ZVQWZ2b28KLS0tIE9LMjhPUndWNVBMR3QxQ041Qnc2\nbXR1U1VOWUxPd1ZBMzBxbGEvS2tFK2sKGnpSdS9f3sNFLstp8ONYTRqZVU7ujFAE\nqwTq4BJUlffEc9JXnvS/ZaC7O1yKmz8V5coKSHlbn+IyrZPbx9scaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOGd1emMzZkxPRjU1Ylcr\nRlVXbHBnTVV3eU9QU3NxYzBKYUJ5cVg1SXpjClNOYUZBNXMwdHJEVlNoRjdRZWVC\ndTluVVdtdkZDVDcwaGFGZUM4MEE3WUUKLS0tIGlHVVprTjhYQmJva1dQT0ZrdkE0\nNHZZTnhnWi94eURxR3ZCczlCeWxZVmsKOKXVYQAMftId6wXOsI+G/1/xPuVCLZOh\nrDzvaUbipkBTdZ/DXXvXf2f1fDcIqXXtPJyBD7Yh/6+KIPxf8wjVVA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:54Z",
+		"mac": "ENC[AES256_GCM,data:VpfhhVlfPQB94009yErF8NJl+BbhBgc/dAPNyvqQzqORpXsPa9DXjae+giPkRXhTS+263NIglUbPiNqZedj0d9ep78gj/rCupmYcGSsX0gqwFfwj50xX0qWDgs6Z5b7QytDlDPiNOCYM287Q7XLob7CcvAM46Ulo3vx/QKD76Qc=,iv:SBwlzN4PIEPo/iZl/VpkcgNtxqlyNOjqi5y9UGzWQgI=,tag:0/0mKGEQtGOrXYSsn+inmw==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/adhil-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/secrets/almach-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/almach-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:qkIwSe6DxrWpmUgMi6G8srenbwUuMHSKXgzL/nybITl8iXTfoLBucjlPp6JpBmfs2NdOEqWS2+QUcnVRAueH9rbABKeAVdoGdio=,iv:NHplT1IbuYfyq8n2Nqq6TBRFi+nTtOOreyprIlXwWHg=,tag:/BU417a9kYMhgexskyE0Qg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBObGdiWjBtTkR3alBDTEdm\nb25kbWY5WkFUd1dsanZ5M2FjQm11TnBVdWdZCnNOSE45cFMwallGRVZuMTdlVTBO\naTVnS29vQk9QZVJyaGRzTGNNcUdGQ00KLS0tICsxZ3NtVlVoc2FpQUMxSm9uZWF3\ncjZXcDVwZ0pUcDlqOGN2aGxmME43NXcK28S/SKkLgXJWQ5sdDxcGyoO74e0MaxeM\nx1kGfiKJBLqok+wNOPO9SFHbWY/ITH5RdV8iLchPBe2VM9IuC0nZ4g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsb3dPMGhpdHE5SlBQK3hu\ncEJqL0JaZk1rOE5MS0krUHpyMUNMUkhyMFdzCmM3V25vS3U2WENycmZIRC81Y2k0\nSEJTekNaNTFMZy85VHh4MENvbUk3Uk0KLS0tIGExYUFNVlRZeThQRHlKVDZWU1Jn\ncUNRd1cwZU1SL3BKOGZZaFErR3F3NkUKnILS6XWSl2MaQ+FAZvRAZzgJxL4OWl+v\ntDxXBBCapOeoLgRH61Q06JnDjgBCz14QIROgZP9Zji/HsdSeRiKR0A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEhLejJLVEk2\nR0dtY0FJQUYyd3JObitPdEcweWVUang5ZUdEcTg1UlJUMFUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpvUS80dk92MjBnN1N6Y284RGE4T0tR\nemN5Wks5dS9vdWRBTU1YYlo3UXBZCi0tLSBEb0pmU2xGMFFjazZ4em5uT0wyZUZW\nT1JqdjZjTDRwUUJLNzAvYTFreXp3Cqfcpn+UlJE63ymHbremaZ8X+wDDQw3gPGmX\nav9dmxfLCPLwwTbd3e8N98Jnc0OwGUiKTavtjpph9ygThvo86jE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNqaHoxdk83\nSnFNRXg4TzZLY3BSOXNSdWVrby90V1Q2Q2RRUi9xZGZ2Q1EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpZM05YUEFYNEVRM0FSYkpKY05pc0hq\nWWRzTzFWSUZRNmI2NENDL3RyNVkwCi0tLSBPMURucGFSdHJER0tqUlRHb2NmNmYw\nVTZsN295QUJZQ1BObERGYjlESGUwCuYMMiu6NyO8Q/lvBHI7muzQOZfaL3Ny3S3E\nE7TlShnbLEsDxApvBV1KJaiYY21Z+1Up9DM0xQskFBYQCya3APo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEw4eHIya0RX\neE5Nalk3YWs2R1ZFcmp6OEIvSDhPMVlZYk5TcTQwbXBpMlkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpYMURZbG5lNlYwMUdVSUtsRlJqWEhj\nbHdvZVdpTGt4ZzhRZERpWWJkbG5ZCi0tLSBJMG93d1ZPa1Z3WWVDSjJ2ZXEwRDJD\nQ0cyQUxlaTdycXhGVVRzSnAvakJvCgoORUSoqTGsS5hvnV3hJNIz1Y9pTR7foSz8\nXMd/f3TObHeokHsejbxx2yMDLPt5fD1MWc5MioLyMNMpwjqq+T8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvYWZ3a1ljTVhQZFNHTGxP\nQnEzdm9QM1ZqMGZEMVF1UzczeG5LYW8wam44Cm9GKzc2c0M4dEgramE5VlBQK3NQ\nTkdlajFFRzU1aXorV0tuL2M5cENQRkEKLS0tIERWcFd0MXAzYVZOdlgxSDcybk1O\nMkQwM1l5UGRVaHdtNCsyR2Y0VXRSSkkK3Bmoxs/GeybD/cwQf2d8QGdTVa2tfKXp\nTExxPuwsrb+/uaooHbCefv35r8jAmH67fJPM8IjyrcmW9HQpvL9R6w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5SGlpbnpUejhLVVNBVWN0\nMklqalJvT2NTL1VhcVIyUDRMQTJ3cUdHVWtJCmpWV1B6QkRwUHZ6K2pzNDJFSmpi\nZWlpNXo0aXM3Qlk0ejlMWDZ3RXFLN1kKLS0tIFYyYnB4VmhWQUoxNmlBMXZQT3ZX\ndW55WktEOGhua3Y3a091a1ZLbXV6ZzgKqQ9g37DyZNJDyjarEKqnftB4l8JCyCpx\nVJLSsjC4kvQCMhRsgZuLZaoICNRgOQiPIW8+N+bqNQ/WxcoOZM2z1w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z0x5NUJnK2RqYXNzT2l5\nbkd1UWgzTnFpcFQ1Y2RPQlFKSktRV3kvcFFrCkRyOXRDNHFHY2QrdGhrM2JEbzQ0\nb0xPb21qd2NjRGUzVUhBdW5sVkVld1kKLS0tIEVNQUwza3luSCtEblphYnBlbmJT\ndm5IMVJUc2hBVVRrZEROUzI0YllRVHMKIq8EbkeEXMDDh+MEQqkU7BtdlMTmeGYn\nHgizD8RFh4/0A2MifmMD/9OarqSNQXvQi8z2rTVctLMcLCfuAf53uQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrOFFUdmRIQjVXblRGNjFq\nUmNaYUgzY2hsaXRrUXRZQzFrTWloUG5xbnh3Ck1hYWJXZytEQzJjWWVGblZ3WGhV\nc3FSNXpPMVU2ODdDL3RNT2FTT21iNXMKLS0tIC9xK3NGRnRudVQ5RFFsVGI5MEtF\nSlljWXhUVXVhc2JmZ3k2RE43ak1ScGcKGaUeC/5UFHVLu9NETJTIVsOd+NnXphZ0\nQImkKtlJXxQ4OBJWGP7Ybm5h4mWiqqVWIrkodyH+qo1/EyOwZ7OjgA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-03T07:06:11Z",
+		"mac": "ENC[AES256_GCM,data:rEbXQH/lqWkL6EG+DoRNQtNTY0rIXQDR5aK/VFfZLCQw5RYTOdnnAeK93z5uV/jSJ6PdwCPFLbCKF34+aKwSS1xVrLp2oZb0aK1J85sP5V41+r385rxB/0BZP7dk4IaAkEOnU39qoyo0hCYROJ95V+97JhdvV7Y0l2zXypdLuNM=,iv:MqXHtyaOb4di969TLoAyhl0Kpo/JsfUU6pS9Jwes2oI=,tag:2JSV57+uAEQPNm8ODmCocQ==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/almach-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/secrets/alpheratz-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/alpheratz-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:BbWM+ivTGdZbMPymSsKWOuUbcozyBKWuXeO0bGTElE2l67OsPKD+Mdw4a3sRRY9xs1RatQ8vg9CId/wiZJSv5c8oogjo/bv3m9Q=,iv:iwtN0Ko7PZjMrPtzzgNvFz5n6X07Mpy4oF+8AZr0nWw=,tag:oFxc/34dkHNkQ1IfACh87Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdFhxQ2hndlFoS1dGd2Ns\nMVFJN09RL2pSekZ1bTNuSjFyeE5QVFQrUVJFCndabkNqdXFESTQ5TUY1TURhZjcx\nb2RrTGUxQUFMOEdadGFFMFMwMUIzUVUKLS0tIEh5Q05SaWRJbHgwVC9aMWsyUUN3\neVpnRVQrUjM3Y05KbTRLR0t0NHFRWTgKbMpXKBQJhHedMYbDB1/N7ASUJ5m8bM7X\nuC3BSGXUmrH81krmnbdaaMontpllUtpdmDd1hYOAbQLVC3UYADfbCQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxejVIbzBWMFYwTEJyWUZC\nK25GeWNtWThUVVRKMXJnQkN1blFFMVJMVEU0CmJGdURFbUVYMWR3d1d4ak1SWFlN\nSHVDYW1yeUJwWUZwT0lMRUgvQmx6c2sKLS0tIDVIb0h4VnJPTkhlcTN0S0dUMmp0\nRXdxSmpXQ0tkZnBUQ1plMVI2RGNxVFEKGnJ5y1umJbn0qP5aCGs/AAuSJMRl+cIB\nfI8wVSGzeRtaoryAIFD/b2STSfBDyjKOkQOQXML+YEsEwqLlCufWKA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9GcTYzaFFz\nLzduT3BpTFhwUGxyMkdSMm9oL3J6UGZCcTJ3azBTdVBnUk0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpkanEzVWo5b1N0ZU4ySWR6MHBTK0tJ\nL24yV0FLa1lId2JPaWZ0aU01MVRBCi0tLSBVRXJxMlVhTGZSajhBZ21TT3Nib3ph\nSnFSdDlpbmg5dW1oNnlkSTVTTFFNCs2S1wPrTFqeOx1kvMPiRJs99VbXZyU2j5yY\nU027yIrDzqpcfqcWx9FjHNtDJzJM/150dNkwieheGCOCaHpyqnI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExsR3l0VWc0\nb1h2K0tPNjhFaFhJTFREQXR6Q2gvdjZSa1RKeWtVWE1XZ1kgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYblNDNWZkM2lnUXQyVjYweGZWUnJC\nS1p1N3N4RCt4RDZZNnRCSi84c3ZZCi0tLSBEUkQxekp2alExQWpWSkVoWmpia0hJ\nbldabG5LckwwOVlHUDh1cXUvMjZnCn6Q1+kL5JG2org5bxIa6Y6Lgu+LlTyM2fhp\nNmhsoxrah8FGCsBkSNRwsVJE+RxalkUygQ+hf+ss+dDPbDsZ2oA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDk3M0J0MHFR\nN0E0a0xXN3ovZWVWQmkrQ3RBVklSTUwxQ0hmZWwyVDdlUncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpLdUFNYXZ6SStzc21Tc0JoSXYyU0x1\nZW5FbUtGVDh4RmZHUEdGWU1sbnVzCi0tLSBneE90QWp2d01xekVvV2p4RVAxQ3E1\nYjljWk5NTVJWYlI0UXVWQ2J3RkVvCkmNGybBIyBQNh2q5NOoyEg217n6P6a31XnL\nB8a778HPbmT0mhO4QvYn7R/duo07s+vu5mRm8gc5AkCpXiMNkRU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dkNRTFpJcTJJVGlmMGc1\nOXMwRXVaRVdlN1RxdWx1R1AzQkliZjZkbVR3Ci8ycGxwVElGK0h1N1VKNFI1dGs3\nS00vd0gvRzBpVFN3SGZRaUVONG9ObjAKLS0tIGIrN2RiU3J5Ukw4SE9XU1VYYSs2\nMUw2ZEowbW5LZ0JXVnZOQTAzZm1aRWMKoM5Dj/mNrSERSCgZTobwMR5Bm1V6L3Yt\n104IQPfZaRv+eSNoKFv3mTL1C/sdRWR4wevQ5rvR8E/Y3CpymM4ZRw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ZGtpZm1ZYmlQRzVId1Zk\nTTNCT0N6aTJzR01tSy9LWTdYbXh3Z0tIeEhBCmQ0QlhDRzdlSXFlWkQ4aXRNQk5m\nTUM2L2J6NzZoTDZpaG0rSVJrMTFsdlkKLS0tIFI0Z0w5dzJOV1orcFcrazdWcHpz\ncDR2MDd1UHdIUlgrblQwYnd4aWVvWVEKJ8U56ajnsWdp96ARKFw1zdLY7z5zhgFZ\nMnd+j5VpjIn2AtIS4w27A+2PX7x+ZysEnnE3K4ndX9nSAzk9shSxpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxbXkvSERJZkgrM20xMW43\ndmFFWXFZVytwZm43SlkzUFM2dkZQdU9sZkQwCmh0bStPRDVOYnlITWdFdU5YNElk\nRk1uWjY0QTc3eUdSY1AyTHNTeFdHeUkKLS0tIE5MV21kMlBYbUIxMXJpZ1Y3VktI\nRU1jWVNEN2NCWi91ZHVHWk5CUnpVVzAKlS0amgC+dhZE6TExIGUURr/OhoudnZLf\nfpMXhkGbl5YsTm0Qeqaqu5bNo/XN+77e01WfDwRz+PYp7QXdhMN8XA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvaUIrUHpINE85SVcxOE1r\nU3RnQlEwMERnbFIweEZiblhPdEE4YWFZaEJjCm5NVGJYL3pQMlYyS29xLzhtMUlQ\nUlJFTytkNmk1YWVnTFRuQ0licGptQUUKLS0tIGVkRnpWQ0FwUzhVbmRNTWNSS2Rs\nQ0MwMElRV09ROFZ2YjB5cnEybzJ1Z3MKeOo3uU9D9BDJB8m9cZccIj8zztbvGqYV\nSWvR5AxNLvcEkbNKvxcDRjQUSDLWhcjdcozs7JgjO5P7YlOnZNACmw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-03T05:54:36Z",
+		"mac": "ENC[AES256_GCM,data:06949qq+AgyxgVLVx9ARvul77ypg8Kq3cqpFOWU/HARR1jgkf7n66SWTmVixkfHy5GqOJEBFQ0HYHzKkQ0BHr94se0bFlR5W+Md6pmDVH0sbnB4+leqR0I/1ZU7o6p3hj1nXlkUWRN6oM0wp0Hj3ClOPM5jZ6C44+cadswCQvGg=,iv:5TwgpN7waxevK8nnRaO/bunyjGNvFojXPPIPp1OrRuA=,tag:vycrcH1t7ZPsyqekae5Q2A==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/alpheratz-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/secrets/buna-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/buna-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:j5R4ApBy0c5t6wGmT0kRBT8g/G3HY2yVxR3/U1JqQrm6P/mzqJC5JDigGBWAZcdWv7wxQDXlkGi/ipEEhJsk8/if9S1atlMazF4=,iv:g6VPTjS5I+f7lVLcraBGXkI7cvyPgs3wgrfa14iGdvE=,tag:iz+/QqEBPD9EkRE9EL1mLA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac01oOTRpQWFRaEhqM3FK\ndlpQNmU3d09pVHhxTktCeXRPRWVpZ3dzRGx3CnVLckkzQzlzOFdwc2FvTWF5ODVl\nSXJ4di9CcU9wcHhvNmdJczhDSTZMMWsKLS0tIGRrWHNINjRzeFNPZVBtcm52bmZv\nZVFJT3doVi8rY0RyOENRVEdVNjNoOVEKBwhAaM9nRfShEF2B2N4LBaY3WA0Jzib3\nZRXnpnaSVlbnCqJIXU9bYMA/UIQ7b8bRR2xQ0Y+gMabBI0Dzf6TmoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWc2p2NEFFM1NrUllYM0lN\nRUJhQzJXZ3N1ZlpsWmo0L2VneFdnc25KQVUwCkQvdm9leXlMVitQNXN1OHpWM0RI\nZG16bHZVZlZlNHl0UERhWTVpUithalEKLS0tIHo3ZEdtZWo4QmM1SUpuMW8xczg4\nSWFtN2pWS05wdGlQWDZHcFRoWHJUR2sKzy85bPbem51i3FUzhTgk7eEVDbOF3vgR\npbINpu0LikVOrYOgop8cxU94QBWbS1VQd/kCIAYot1jMZs5Xvf9L3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNFT3h4K21F\nam5aMStNRHg3b0dFZm5tYmplSmxFRjBiakJJMExjS2poVEkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprMG5MSzk0YmlGaHpySzZFYk00eFpr\nbllMYmxkMkU1UlNGVWVYWHB2L3VNCi0tLSBCcUdaem9VYStjRmlsOWx3ckFnd3Nq\nR3BRTE9SaE9TQWs4VUZCRmQ3UmgwCj/4vmhRs9W6U9ay6mYFxPd6SvOTvxvYn/Oo\nuY7/N3PVpXxRK/UwovEGqY97AG/dEQk+I0/5AowFGmfPURpqKjo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGRvMUlHeVhn\nU3BhcEV1bU5uZjZqa25ydHhDOFUyNUQ2SzRadzk2ek9YbjggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYS0Rrb1poMTRDNmd2eW5QSWJvU1hB\nYVpTYnF1NmQ0SkNsa0xCNTh4bEYwCi0tLSBZZDhMZ0JsQ0dPQ2VWYXpMZE9Fb2FY\nY25qNFdFbVo0dURyUHd1MDl6NFlvCjFQKnkAmGuTioiY11oEgdD4Ctcw1gFF7xR1\nk9RV6JRXe8YeuWYpQjS17vQVR65TpJukYWm9UYy3NPP4Xu72toc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5HdTZDY3VH\nVnNvNHE2blFqM2pma001OGRWdGYxOHY2UkVhVW44bDdGUVEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjNkdSYlppQU51Wk40QzBlQ2lzaFBR\naWE1NDNOa21uNUNNWFBZWTVtKzJBCi0tLSBOWE1vUDZtVzRLMVdOMXBsNVpwMEc0\nTmwvZGVHd1Z0akJhempkZEdVSmpFCsnAxyLUrUbyMSBvak3VXBSdR5RmmL7eBjnM\nrw+kRLE8NFVwFiCZXgZDBlB2FkVKYvaL/hxsn4LYi3k53U9+vD0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmOUVPQ0RoSG95RUVnK3hC\nTHFEUHA2VWdadlBoNVRFNUl3Z0hOcjVXaVRzCkRXRTczZWRmenVZeHFWVVBEK2Z3\nVXFPWkpDak84akhEaTdkMjFUcmpnVTAKLS0tIGJLZFQ0UUVYeHkrTCsyYjVHcDQw\nUisxV3RVSEEycGhoSkttaEVXaTV0cFkKKo+lqTI+k6WDdPbMNo1owWH4/RoBt9e6\nmGO+sjziFzrZWUXx4RilR2F/3afRA/CdjzPab9I1sut3I6Z7FXNjYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscXI3NGV1R3lNQjE4U3Nj\nb0ZTNndORXlIY3d4bWVWYzRVTzZHWC9sV3owClRWc2tRaytsQkxFazlyOFU4V2RS\nYTEvY2swdDRnMGowdzZESTVVeTNkN2sKLS0tIFk2alJHUkwrMTVsdG1LQ2pReHA5\nTllyMFhML1JJdWQ1NXJkb2U5K3F4K1UKn6OPUfym5f9aacaHq962347dNeTjBfK/\nAMXPZXs6DawU8vko1RqIgzX/7StrITcXGcFfTutmpSa3KjMzuzeb+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1eXVNcklwZnI2dEtRaFdD\nOUVON1Nxd2l4L2xtYUtRSHlXVlc0VzVhZkZVCitxYjJTbDZDQjNHc2JrWmFaaEp0\nR1NMUEllalZxeHRndGxGRTZGSzV4TkEKLS0tIDhNZ2x0amhKdk1IdG16S0RLbWMz\nQSs0eTZ5YVBGdkdxYkhweUdMVVR3QVkKmau0k5SxJD/EURq6Lp4aDMYCoCFLOo/I\nRj5mAP4YGIVTU47HJYNcPcwzgwA6YVqVOiKaG6yyU7u1DsddaZHdiw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaHdMdC9jeDFWdktiV1JC\neDlFbW5QbmxVSStMZTYvak16K255TnZzMFdNCnFuOFlHVlYvQStmYWhITWl6NUN1\nOTdFdjg0OWZhUVd3NjQrcXQrNm9CWFkKLS0tIG9VWGZhUDJGWDNjTVg1bFMvVE5u\nYnkzV3QyczIrK1hLbUV1Q2twaDkxNm8KpHCL8htFz8UeMLsXmDUz/nAdTYsRSka1\nuq+bFkrVexExxqXJVyIXf20ceziFG8t5on8OGHDCOQsst4HEgRqyWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-10T05:04:15Z",
+		"mac": "ENC[AES256_GCM,data:wJ646ZAfUOSwXnkIUDkvm4wz7uaW4U7bCkC/8uFuoTwY16F5+1N7AxaSE453w2cOCJE5qOAXORYj5M7J8o84LjLWYN4+PYjCcU2ulL9rug29fNblqFHG8G1OdHwURep6sGKfvsSCTGgpnA5fYmXucYWIqc27cQ9HDtiHw3Bojas=,iv:L6xUGwjihD08Ahc/3WoA3tZDXvllmNWK90RpK7m+4Pw=,tag:pMynp2rs42lenOYbLQ0c0A==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/buna-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/secrets/mirach-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/mirach-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:eJkzZkzzof8qcmbDOirf37W6dw2ypoK5DZ0ONaQkrEeSb3m2qJPEjMPK+oLjayTrajLNj9/e/mbJ8h5odQoue/Wl2iOPw0RA6Z4=,iv:Jx354QB1tReAoeJLHEuEI32yp71vicCwUk61z90WI44=,tag:NotiMJPhArvFNNiXTNK33Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZYXJCdSs5Y3VWbE5TOEJp\nVmpuL2ZOYU5pLzgxMHFkMGtpZG1QZGlENVY4CmVKaERaeGVnUndONzIzWmdtTFcw\nNnNzSW5Zam90OE8xR3VEVjM4V3RGVWcKLS0tIEZSYktnS2xoZlF6Yk4wcVZweWly\nUHlOOE9vUmNYTHBTSytwakhaSnZ1VjgKxoUCSVgFXOKsyXUWe7z17WiUa2OpwImm\n5NV2PeQ8uOnMT0c7Iwl/VEsXbYbOtnW8VT5m/JcLIdlXCBqkQ/B8PQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrVjVmSXpwK3JOQ3Jvd1VT\nZFN6ZGlib28zSE9MN3dwYkN2dkpON29EV25RCjhyU0hsZmVmZEY1SVZXb09UeXlh\nWnROTGlGUFNLL2lsY3RhSTVjVE4zZUUKLS0tIGs4Zi8vMnZLUUE5TGJ3TmppMk9D\ncDVoYnl0MGpsbmdQeUYyUlRuM3htbTgKHRLMrPGg9FljvwmWOZUODER/hSsmUNaq\nZBVNml61LztfZMgGtp56VZ77XU1bVLREL1VFyeTwzjpbYggLbuRJpA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHUveXJOK2dI\nTVJDamJzUWtmWlB1aVJCcmQrbElBaTRxYU1RQ1dUWG0wV1kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3cE1ZOWtDNUlqNWJxNjdKbjVNTGk3\ncWZMVEpMM0RHbVpUQ09EZUtRd1drCi0tLSBpaHNkWDUvSkgyODlhZ1V4Si81b1NK\nV2NUVWdVbTNZV3dqalAvMFc0QllVCph57nPcAfs4fu9kKIJZ5q/ejeP5u9W+HzsV\n+dpVasMbA++RB9SDXuifRkNC4b18fKiiOfOcutT8saG8Fth8/PQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdKVFRBazh1\nVzJuQkw3ZWZJNGhPOWZUeUJnS0o3MDlvd0hTRnZyWnRrR1UgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwplb0hlRElvQjBtaXR6cC9Ha1BhcnZU\naTZPakd2Z1JuMEZSWTdET2Y4cGVvCi0tLSBNTEZKNkI4ZGw3aFhvVDNCK2JWd0c2\nRkpENXM4OXpkQUJOWnNVZjJzYzk0Cic2m6ZalXUPRH2KjKUNlH3bV58NG0CMIgA/\njl1h5rGuFDLfuKiQehkOebf0k+Ndy1c2frJQ1wyM6Cs9OzLexqQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGFmWXJhTGRa\nckliN1dQR2hEYzBFWlNFd2hEWktvejluQkNQbWVnWXRZQ00gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpEQm9VK3BhbUpML2crSjdPQnk4aHJM\nV0pDUVZ6YmV1dUJzeXJBNkpDNmpFCi0tLSBWSWZRSWJGb1J0MGtXL1k4T1RVRWgy\ncnF5cCtUTXJKSFpCN1Q5alJxMi80Crgi+HtBO07LNKqN6RbRRzzjcrym+BkomFTT\na8ZLyCGECiAXoZ26GJ/RRjzru8S8VhArmy3uwa3mKpT5STkFYAQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvMStWdXpIV254WjNzMERj\nRXdpSG5EMmd2cld1bWYzdXJLQVlVVnVUUG1VCmJSMFk3SGdacitLbWQwT0lvWm9F\nanhIcUYydGJzYXVYZm95dWM3aXdDVE0KLS0tIHM4TDBuT0RjSG1oUHdYT2RVMHBw\nR1pTY2ZnTXNvZ2tObFA1WFdWZGFsTkEKH30K1NjoZatx84XhIqSxAZwrYpZ8xQqF\noFkKzh3NZ5dp3xJEIIlpSX3mydyB1+THBtKlx0x7oyN2AudO3TE6Pw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPU3ptYnZxZVcrU0Y3MEdM\nb0hrTTBPYzNCYjhlZjNKSFdJRllGeDhVYUQ0CitYM1Bjb05lYW9adEh0VjVaU0l3\nWFg3NXVZamlkQ1ZLdGhQQ1ZiNmdhUWMKLS0tIDR4bVhxY3NSZ01yZnR1NzllMEwz\nRytWbi9BYnJFcWE5cW44R0c0WWpSQzQKeEjW8I/5XNhEs+FCJ4xtjxD60OMfB169\nQ6zBQP8E/yfTIva4dsLCdvRTB49ibsinfzZOyBQ+ICQPz3g8C3Lc2Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpa0M3R1R6Q2wwazROZDN6\nUzFMYml4b2dNcWMycVNXNVIvQzhDUGZ3M2hzCmxKR1RhYTJkN2pnZjdwUW5PT1BY\nckpEeW5IcVh0ZklEVk1VOFkyZ0tDRGcKLS0tIDA0Vmx5NHhCWGQxZzAvOTBUWTFm\nYVlEdzlnWmpGM05XcTEvaVV5OFVNcEkKh2qhAWU+Hwz1Z+JAkirnGc6CMbykCOKy\nTyNxqzHX7z7o+8V+Oc3ChiuxSkruZQyajRgLdkrEZq/bnJDNfM0hgg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMTEttZ1dZYkhBRW1CVGdr\ncTNHTTFHUEZIVmEwV1YvSHgwL0NnWC9CaVdnCjRQWHoreldrZktsbFdCTEdLaXhF\ncTdWTlJGV3hZV0pBNUxyM0UrL1FIRUUKLS0tIGlpY1d2WXFSUk9WWUJ0RDdKUk9H\nL2p0cFNzQjhsYlRkd25RK0ZhUjlIKzQKj5vlI+K3D02AAC8j8Nn99EgOnEc2YRWj\nm3XTcyiCFTQDVMPWbUZXPelCIBLSPmksC1zLkWtlaWmOFkT/iLzWZg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-03T06:48:44Z",
+		"mac": "ENC[AES256_GCM,data:dMYkl39sOxlSL4Bl0S2FTHdHaiRECJkIrBSfthnmT0/LxcYoFi4RM27pY09QFfS5Ohg1DC0Chs+hSBCLsVidSWJCvwyuF0ir4zKJZM7+KeyJFq51InhiqjLXJAMwh0BL8BnCiLcdlblbCCg1JKrlwfMrPl3dLYhi/a7DVWMXz6g=,iv:9WGXjfhrAoEtecJWG99cTZTs6i34AfmL3IkeefuJmJY=,tag:kKgB63Cj9sFjhPfJjEruXw==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/mirach-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/secrets/neptune-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/neptune-age.key/secret

@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:XXV5r3FnMpt1rX8L4LtxLbNeEZ+tLkFeMQOTvyH93fRAEltE4Uszy5khsvyX9c/h33uxyGFQAymHUqSN8rBlBfbJ0bIf8DfoaJA=,iv:rYt5U/usIK7+glVjRclgCkNpQYwQoZ+UPSzanqbI9bA=,tag:c34l9laQnhQOZlV6bj9KCA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmY0szY2IvRzhId2l3MTFI\nUjFrV0hEWXJIOGcvTmNoaDkvZDlrN0dlRWhnCm1CR2tBWFhJb2NyVndkZTlYWmg1\nUlJHVTkyVGdWZFVVSkZtUzZIQm9DRGMKLS0tIDJxVnB4RFRkWWZ0Y01VeFNIV0hM\nQlphalhKeDQySEVoWWdGNmRaWUhDbm8KnTdaaJsw3YqkjSDQREQuOjeHqKjMbw8q\nfgeetuG7tI/30tKgggTr48rk6mHVHoZE0JHugjYTt0mfoM8Dqct/Sw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvK0R0TC8zZVFkRyt0cEJa\nam9XNk1oenZ6d0lyd0l2cVByZW85TDR6R0NjClFKeXp3ZzFrUU5vQ1dhczRtbGRN\ncVd0dm5uQ1NIeFJneDNXcEwwb3JkWDAKLS0tIGczcEhEWlFBTVJYNWxLMHhCUDY2\nRFhZdEN0NEJHRHpHL24wdjdNUEVmWDAKYVTOGiD/4zZ8ME3F931LDzjoloy6JESj\nGVcgg1ISR/GMeYGxqTGxTQhHVVXv0+djdTnK+RAg2wUJy0VbFTzqTA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFh0UzRLMXhN\nL1Z0QWJxaEVFRDQ5YnQwRGFLdGNzSzQydUJXbVpDTE1sV00gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpmcGdiQkVKSUxQZkJzbEVhay9rVlZS\nV2ZoNmg2WS9aWC9zbGYvdDNkUDlBCi0tLSBqWHM5alJISkNWaE4rcXV0OTZPU1Bh\nY0tFWFl5MnB4L3VrZFREVW50UFkwCqW2sa+4LVWIwcZT9xJ0evJsBva3Lmpcj2SF\nV9YHl7EmGb4pJBslgYUFMQkvTr0/w9VC545YLP3ECn9loC3hzxM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxOOVVrK1ZR\nWjFIcmpacjhUT29LRzlBcENjaWVKWW9BZzdVYUZDWFRIM1UgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwovWlU3RE5aMlczZlJocll1MDZlMG1Q\nSm9CZGZ4TjdYaCtDd04rcjdzQUE0Ci0tLSB3YnMrVGowTUFoNmlzYnRVbTU0dnFM\nb2tuVW1OanYwZm0yTVV0WlZkS21zCmRJ7ij8d36hIM0ZotpU/+ooyWKkHYSgRILa\ncm3F97UZGQ/TkNVaJvMlm7IlX4g/6hONDb41me4/29EmJsJHhKs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExBUmFLZlNY\nK0tHY2NSRzZtR0Rwci8weWphekM2bWZvTGFEREdzSG5pQTggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpsRU1ndC9FekMyTDMra2dYeTlDZFVC\nTURLTG1uMHQ1ZlBEL3ZadnF2R2k4Ci0tLSArWFoyRFdzeFh3cEd3L1hKT3B5a2xS\nQjFEd2Y4NzROTDNmWlYxK015TFRjCjbR7wDmMMuCZpzMq4bbKJNj5P0OH+GclyvT\np84RX7o2CzmlJQXmYwLkv6FICe7U904QURuhPywyU0RXGhKUqhM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVVU1M1M3VURheitScDRw\nbGhETlhUOXdPVVptUGgrUkM1QnRrckJCZERnCkhyY3dhSnJ3a3VDWEs1L3RrQVJl\nOHI0OXBJY2dDQm1vOUFpMzJQcGV3cG8KLS0tIEZ1SHdweDJkV1owRE9RanR3cTd3\nMWFlSDJuMHR1bXVHc1dNODlJejQ5N3MKhKq69LY9/9PXKm3TlsWHYW8PbMgWwgWQ\nUAC4WqLvKYk/MAbKbMOVr/TfrRbkrFJtbP1H0X6A7yzIrAXnsPfyRA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzZGJQTkRFcUh5SEM0Ritx\nLzNhNWxSL3g2Zm1kNUtmT1AyZ0VzOGh5eHhFClJmcm41Q1BFUVk3cWZ3d0VxV21X\nVmFKSzRkeTVWMzMzZzJIeXNDcWJFNkkKLS0tIDYrbWF3Z253ZDQxUkF5dzdGSlJW\nRkxReGYyV0tTcHJQR2JwUVdBL1I5TzgK5kZPf+5N0P/NeuqpQ04Lb8Sme+bocqYk\nk9Ld7vFSxXyjTTnhwKGv4+q85IkDq1xGLj+7iM7QfRfpZS6tBpKJjQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4U0VWYlJKM1JYOXRoU09r\nUjhzalA5aHRCVTVZWXBmODJZZnAvSEI2MFI4ClZEeGh6WnZsNUtTSW9lU0xnL1kx\nbDV4UGIvVXRra2VvdzJwNFdINmdlT00KLS0tIDJwMnpCWVVkVmtYVmxSNXJqNkYz\nM2lCbXQ5VEd1RE9TREF0WllGRWFjeFUKouFFBKiW7JQ+c41t5hwnBndUKZKhdwpm\nYCzF7/2YlZtNYdxip1+lZ5YEqyaXygcOZBjjZ/4s1B7ihEscQskLhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBidzFMU3pQRm1HL3IvS2NJ\na1ZjcFhyRTljb1lQeXhjK3BBN1htdjhCUnpRCmM2MnJEeE1UZ3N0RDRvRitLMndX\nZXpWNk53d3FXWjA5Nnd1Vm5idEg0Z0EKLS0tIC9RaXE4ak1tOXMzU3dsZWh1MFR5\nQnlqTnBGY2pMd0dZYVpGdHRaTzFuTmMKqixum2H5jyBFdxdXAVlLZ4Wn5ZfeUJNR\nnNNsDNsjMctBn3gbtGHkx2wEnlKS4a6jbk01wVdSeyOFWlR9KKXF7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:23:57Z",
+		"mac": "ENC[AES256_GCM,data:xVNbw/RamaR6701df6IHPGjGDoYsZH7gwOWeVpb8A8VoaxYNHQVnRkV6jL58AQqI4DR+HisrpkBoN4Ui9o8t5u7PRbGyjUgUr6tvuwh4MMpk+osUmlH8eNdzi0W3SarhFZIWtcSHkLuhOj92yk0qd+W3TmWd3iMCrdVpkDe2kU8=,iv:uuUYoGcDQTZu/vGgVkt0x4QMQNkcNWCcwOlM/XQBx38=,tag:J49wr+on3MJdlNASbr+tMg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

sops/secrets/neptune-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

sops/secrets/ramus-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/ramus-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:lc5PP4xpLq/JXq2LkG/5zkEY5luxKC7EZHx0s6exiwd+UtuGb5rjIOq0kUBFuJWYFWduqcvNS62kR76oQpRfmjIkq2t02NxZ1lA=,iv:eZsHK9u5Rvt886Elz7Vm+PMD8urm1UyoNbNNwnlJtj8=,tag:inCrDdsNmLb+L+LpF9k4Ag==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0STRlY1h1NTVUdDJRM1NO\nc1hacUg4TUtlK3Y0dVZqaE5LdUlqMkFKNmtVCllTYXFHdXM0NVdUejhHZWM1TnVx\nUURvd1JrQmR2K0N3RlZIS2d0RFhTRUEKLS0tIFp1ZlJSNmd2V3dpN05LYWh1VHNC\nbFNkdkY1aUhTZmM1R1FKUWlGWThSdE0KYxgpuknCD07awfN85PkaJjPohYyqT1wL\nbjUcGo6TmFQKIgEzTzNj+in1dm9wz0AnYl1teiHa9WjK/Udd2BANBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCd2Z1aTFYenowSnczWk05\nVEZ3d0FUNFNkV3RlWlpFWk5jd3QwazVES0ZVClVjY0Y2eW1hSGEraVVpSjdoaHMr\naS9lWFUvbFl6Nzd4U2l6dUhXRHBlT0kKLS0tIFNCYTlSL1VnNURBQUxoYVozODZw\nVVRkVGVINTV6SXExN3dCT1JmRmNFdlkK+jNS9cUz4TzBBzrtxuYcoiEmxKcRNTlt\nqksdFqnPWzKI+edJSWq3rkBYeuI7c4wmxTtsgVtHbv2jwbD1kJar1g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGNxVDh0SWNL\nOUt4TG93eGVjaUxzczhnVjNYRlB1Vy9haWxjYnN6aGI3ejQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpxSEtwcUxGcVY3RzNjR2REYmdrRWV6\nYWJyTjhXMVNtVFVpczRDc2dDaHRBCi0tLSA3NUVyR3YvMnVsd0l0TXIxQS9odUZO\nZnJWV0MvRlpwU3luNm9FOGtDNkhzCm/yGJJvQf5qvBRyGLrmCeiI31qHr+JoZ2Av\nbqMUeg3Vv82ffTLT6GX+JjiG0wQFcYAX3/k0noVN9JMR/boiWIc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGpMZ3JmMVFy\nU3AzeEFFa3B2TGxSL1NlQjhSa28waGtLQUlFTkp4N0hVeEEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYVDJSdCtnVHIzVXhSQ0lXRzE5dlJo\nS1NHa2F1WEpJK2xJQUQwa0RNNCs4Ci0tLSBBdmpiZGVSOWJwanRiUjUxT3JMT0VT\nM2k5bE0zOW5SVWg2ZGw0QUVvcWVrCrc2TjHS6Pp38MTPU9H59q2seVYlESH80V4+\ny1/qjB6fK8lnnyi5TLrSo+M9MAcG5T4EGvCcAPuzjTvF/DO7hxk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9jZllPWWhO\nV3pDa1MxSzF2ejRJMXJBWDlNMzZqcG1JdVB2Y0xjMlJKeGsgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpwSUdWWlFFbW55aXVkZ0pSeUVPRkF2\nTm5tTnkrTGNmcEdoWE1UckwvcXFBCi0tLSBnN1J1VlQvVnRXbkEvOWtLbHhzVzNN\nU01XVkpRNnd4bCtYb3poNjR4bno4CirmDl+6Kebk0jMjgRp00d8kpkzGtQFsZNht\nm5MPBM+FXVzpDcEWQGUlLr50yDKYVzHdIeeuGsWZ3KaI1GM8pdg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOEQrR1Z1K3RETGgzVi9H\nNXIzUW04UHFCMk5vQVZEN0taRWJwV040Q3h3CmpaVWV0WDZNemFSTHF1TTF4YXI3\nL1loMnA5OUNCbE55aGUyR2EwbklaczQKLS0tIEpnTkkzNStsNmdNS01HWDhXY2s1\nZ3hMNXA1dXUxVmxucTdtbWN4akQ2MTgKAolaT+61/BN/yzljENx7YZTrFRGA8zwN\nsquQs9vnFS8yduVMoaemXrCLTpiQ1KGCAWVX8pPtY8+GV9YKLZsV7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtTlNuQXN3VU9TVTlQd01N\nYVBpN1BxcjRLYWN5SUg3TlhUbHl0UzkrOWcwClZ5OHpOcGp6V2craFBkWCtwcktp\nWDZYYWR4ZjVhaVNPdEN4WmZ0UlJqR3cKLS0tIEx2WXdQL0x1Zm5rRnJGMmJQWFVW\nNW1nMFlac2lyY1ZuOW9OZmNWSjJxbTAK72xqJBlpV3UWAFhGlUjudEILQSnGDhQm\nS4U51sUc8rrUZLlmAivWg1nxCUAdrhLo/r9OuITR6QX9DeFsaeR9uA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6WmVUUDJ0V2sxS0Q1UFZv\nWldFK0tRSlViUkc5aXFTV0JDdDFVbVVXR1QwClUwLzg0eTAvbUtaTVRFV3ptZkJQ\naDR1REl6MXZ2cDlsZzk1SVI1N3pocGcKLS0tIFlUbGFPUXAxWVBvNXhjZ2QzWGNh\nWTkrMklIQnl2T3ZYL0Q1c3JOTU85bkUKL4h+PDQSnVbls8iuioUHTBVpVh5Yhhx5\nrK9ELFCYGPAVzbx5cFoOapnIJcTQUAPZdBpmlm7kgRmMLXptMdGkGg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZ3lPeVJyZUF3cVEvWnhH\nbVBwRmxaQUhaaExQSVRyeVJNZVFSRkFrU25NCkZDcklIcU5TQWplQkE1ZkFTUXB5\nLzZ0VFlEdks3OWpGM0JMSi9ZOVNndnMKLS0tIG11UFZkdWRYdHZJNk9TSDYvaHcw\nQUk1dGxIOFhwaXJZaEZNdVppWWlpdUUKQJ/UjgWIaeKa4o2El4cFkwv+O0bi9SOp\n13XExCNLB+BtwOGPREWbrmW/Z15c8koBEyrW7iuIhu0Pgz95oAF2Sw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:15Z",
+		"mac": "ENC[AES256_GCM,data:ovjPl0pJ6DSJGjGz+Zt5GLbwu3ZTMwOKNSsYxIx1NcjWAiGYpPNFcFrD5OBciVQ2K7VxlRoWW5WqbJt7mrvQXDO69LxvQqiK1+qHeFJOHRd6Sp29fRA1aqEz+kOif0SSzaEkHOXAp1kzk31CnEfIG2j5yQ3oMyrSqNnhnVrx6F4=,iv:NdeCrqNo5SV1Npu8aqPJcZDhPMGfUviyBQi2CUjYZOM=,tag:yM6P7P2vLUMs9GdT284Gvg==,type:str]",
+		"version": "3.11.0"
+	}
+}

sops/secrets/ramus-age.key/users/kurogeek

@@ -0,0 +1 @@
+../../../users/kurogeek

tests/default.nix

@@ -0,0 +1,16 @@
+{ self, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      checks =
+        let
+          checkArgs = {
+            inherit pkgs self;
+          };
+        in
+        {
+          think-gtcm = import ./tests/think-gtcm.nix checkArgs;
+        };
+    };
+}

tests/lib.nix

@@ -0,0 +1,18 @@
+test:
+# These arguments are provided by `flake.nix` on import, see checkArgs
+{ pkgs, self }:
+let
+  inherit (pkgs) lib;
+  # this imports the nixos library that contains our testing framework
+  nixos-lib = import (pkgs.path + "/nixos/lib") { };
+in
+(nixos-lib.runTest {
+  hostPkgs = pkgs;
+  # This speeds up the evaluation by skipping evaluating documentation (optional)
+  defaults.documentation.enable = lib.mkDefault false;
+  # This makes `self` available in the NixOS configuration of our virtual machines.
+  # This is useful for referencing modules or packages from your own flake
+  # as well as importing from other flakes.
+  node.specialArgs = { inherit self; };
+  imports = [ test ];
+}).config.result

tests/tests/think-gtcm.nix

@@ -0,0 +1,102 @@
+(import ../lib.nix) {
+  name = "think-gtcm";
+  nodes =
+    let
+      settings = {
+
+        DB_CONNECTION = "mysql";
+        DB_HOST = "localhost";
+        DB_PORT = 3306;
+        DB_DATABASE = "thinkgtcm";
+        DB_USERNAME = "gtcm";
+        DB_PASSWORD = "";
+
+        APP_NAME = "Laravel";
+        APP_ENV = "local";
+        APP_DEBUG = "false";
+        APP_URL = "http://localhost";
+
+        LOG_CHANNEL = "stack";
+        LOG_LEVEL = "debug";
+
+        BROADCAST_DRIVER = "log";
+        CACHE_DRIVER = "file";
+        FILESYSTEM_DISK = "local";
+        QUEUE_CONNECTION = "sync";
+        SESSION_DRIVER = "file";
+        SESSION_LIFETIME = "120";
+
+        MEMCACHED_HOST = "127.0.0.1";
+
+        REDIS_HOST = "127.0.0.1";
+        REDIS_PASSWORD = "null";
+        REDIS_PORT = "6379";
+
+        MAIL_MAILER = "smtp";
+        MAIL_HOST = "mailpit";
+        MAIL_PORT = "1025";
+        MAIL_USERNAME = "null";
+        MAIL_PASSWORD = "null";
+        MAIL_ENCRYPTION = "null";
+        MAIL_FROM_ADDRESS = "hello@example.com";
+
+        AWS_DEFAULT_REGION = "us-east-1";
+        AWS_USE_PATH_STYLE_ENDPOINT = "false";
+
+        PUSHER_PORT = 443;
+        PUSHER_SCHEME = "https";
+        PUSHER_APP_CLUSTER = "mt1";
+
+        UPLOAD_MAX_FILESIZE = "5000M";
+        POST_MAX_SIZE = "5000M";
+
+        TEST_LOCAL = "false";
+      };
+    in
+    {
+      gtcm1 =
+        { self, ... }:
+        {
+          nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+          imports = [ self.nixosModules.think-gtcm ];
+          services.think-greaterchiangmai = {
+            enable = true;
+            settings = settings // {
+              APP_SERVICES_CACHE = "/run/think-gtcm/cache/services.php";
+              APP_PACKAGES_CACHE = "/run/think-gtcm/cache/packages.php";
+              APP_CONFIG_CACHE = "/run/think-gtcm/cache/config.php";
+              APP_ROUTES_CACHE = "/run/think-gtcm/cache/routes-v7.php";
+              APP_EVENTS_CACHE = "/run/think-gtcm/cache/events.php";
+            };
+          };
+        };
+      backend1 =
+        { self, ... }:
+        {
+          nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+          imports = [ self.nixosModules.think-backend-gtcm ];
+          services.think-backend-greaterchiangmai = {
+            enable = true;
+            settings = settings // {
+              APP_SERVICES_CACHE = "/run/think-backend-gtcm/cache/services.php";
+              APP_PACKAGES_CACHE = "/run/think-backend-gtcm/cache/packages.php";
+              APP_CONFIG_CACHE = "/run/think-backend-gtcm/cache/config.php";
+              APP_ROUTES_CACHE = "/run/think-backend-gtcm/cache/routes-v7.php";
+              APP_EVENTS_CACHE = "/run/think-backend-gtcm/cache/events.php";
+            };
+          };
+        };
+    };
+  # This is the test code that will check if our service is running correctly:
+  testScript = ''
+    start_all()
+
+    gtcm1.wait_for_unit("phpfpm-think-gtcm")
+    gtcm1.wait_for_open_port(80)
+    output = gtcm1.succeed("curl localhost")
+
+    backend1.wait_for_unit("phpfpm-think-backend-gtcm")
+    backend1.wait_for_open_port(80)
+    output = backend1.succeed("curl localhost")
+  '';
+}

vars/per-machine/adhil/openssh/ssh.id_ed25519.pub/value

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWyBu9oHfZ1dUbauMofzaJhPNJAFX7BaNHmA1g8Xu1O 

vars/per-machine/adhil/openssh/ssh.id_ed25519/machines/adhil

@@ -0,0 +1 @@
+../../../../../../sops/machines/adhil

vars/per-machine/adhil/openssh/ssh.id_ed25519/secret

@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:86WcVdVW6U9/Bwgi15CF2g2pQ3N+l7ccGOgAqv4hQsnYZYACWU70dlMOWA/quo7emPYdgzNoBzVS5hoPDMFf3HTF1SfoCjaX/TRU1XAAXqpV/2G+PolLySdK/Vw5AEPWo1CL0S4/2L6FfB0TrXympw4fRNg6fCMS7LtOMsVdFGiU7RyPCIUEteZ3rUPlkIEpzaF66y8Tzfi88K6GSlFn2WTb1nTgrUQwKfvfzdXB3aZLqqzSVYA5p3pA6fzhbvifChVnBBcCkZIfGAApaqbdPBK8U/EPOLJtwQoTmcDilzjW7RJOWA6bIfq5ATJ9Ct6STv+gg+ozceot4LR6raYkGwG2NxQ7XoZEa62I9aLLTQZ07LOM28ZVA/BIfb7Bxj2Pu2Uzu6VE4xewgHS+u8HqvDKA3zXPKYCmnCSWiJLXKaZ5j1fxKcZnYVKlxxPzP6joIhKxPrUmASefcuCyXS5mQqM20sklHxG4SRrjoHHaAGkv7W23rPNq3MO2L8Voy+8u9UAk,iv:f/ddIhwLruDn7cRrSg24X3xcAn6ZaN7Rnp6UU4vUR9A=,tag:8qQIgJZfaNdMeTSx/ChW+g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcGQySFpsQW4wMCtrbnd6\nRFJvL052dWhyM0ljSjVlTG1CVXh3cHN1OFZrCmNBNWVBUFY4ZDU2bW5QMFo0YkVs\nbUp3Qjg5NDRicFc0Z01zZzVvc3hxdHcKLS0tIHBUNVlBVCtvUEZYSGIyRTZOVkxV\nODlNQmpJRllyNFZ0ZkFCdHY1ZExuK0kK/g/StMQx5LPX2Q0S6p7cBUZKImmyY5qJ\nkD3qJda5OF9pHcLTSiFMpgjI1gMiltzvDuzrwfOPgnplCnPgiUYNdA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuUGJzWC9vY0tVRWVSKzZY\nc3phd1Rsd3FtYjhUK0JsRk9HeEdJQUZISzFNCllHalJXbTZ2cTlyWjhMUkdPQXFh\nLzdldUFQcmUwblJtQmRTbzVhL05MZ1EKLS0tIDMvamJlZkM1SHNCTGRpc2lsdVdh\nbFNzb3hneTdCS3M2eVlxWnFOQ08wRUEKEcqMJiBMD8bn+X9yZ1KF8mxmZdo6czf4\ny/SsVodZaSAxsbiUFykapZ9tyOfc3VSp8dn2hlhs2ApeQ1ykunFgug==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBybTlWNzZ1MFdvMjRkTFAw\nYXBDRVBiSDJ6aVdJdVJOVStPQ1VNWEpPeUNNCkxjTWtNUWlnd3NmSTY1OExnMzl0\nOXVqQ1FhdE5BMXFDc0dZSlNKYi8rUzAKLS0tIFJYM2d0UU1tQzZpTVlNaVFtQ1hK\ncENTQ2VDb2ZISTZkaWpkTjA1V3lLWjAKDJXCX4TAwg+9KBZAPX/SSBXaw0ccFfQn\nYUcpls4hvti4qBntRMzHT1Pw5ok84whYKQYSpEnGU/pPgbBhcQovuA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNXR0kxRHBC\nR1RZVzA5TnhZaFJMUVZ2dkhZR2hwMzBRYW9YQWZTSmVZQjQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpHY0x5UEJUSyt4TUZTOEJUKzNRWkNo\nNkVWVlhZMDJTa2tsMHhLamQvM1hNCi0tLSBYdmRMbWZBR25LNzhkSURSZWFOaEhj\nL2VoRGdWc3hrend3VHN0cmxUczFjCp0cKOsgtfY5ArmAIsXFJZDtTsFU8S0ebfze\nmUnY3vVVOjf4XlSaBh9MFpBFSl1vnE+LKn/bYbuzVYmpNdcaMc4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNDZ09JcndH\ndnAra0I5Q2ZzWWRQUVZqVVA0bHhPTG1zKzQ2akJkSXRzWG8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpBTEpZM0tsa1hXSEpkUWFTemZlWDQ3\nWUNpZm4wbnM4dFdhRUdnNWVjeDJzCi0tLSBjTUo3ZUpYaVBnbmhwb3M0V0VtbE1V\nMnZrZTBheFpzUWZjVnd6OGNBemNVCtAPjcJ0hRaSeXZqDgz+dQttECYqakVo5Qzk\nnt07/aWu4xvtnKRn9yjaRq3KEPNEWcbHt2DdJSeVaiJWh+PtC1k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5EblZUVEUy\nODlmQzBWQ3RpeTVkeWFZTGlsZER6eUovdG9QZnFCNHRwbncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpiZS90cnlsZzIxNlBnVGNNQkRjV29W\nRTNYU2crb3RKbGNyaWZjOVdPNjc4Ci0tLSBmNXhXbmFVUWxjV2ZvZ3RvcDBQcWNq\nWXBmenpZZnp2dHpiUExXeUtRLzlrCp5OMLuza2aLmz4cTi9jCaV9JJukeBXPT8Z6\n32bWfx9eSD+MkGssBjmfFqzEvtaD0DkiXbr0upspREXpjrnB4wY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeklFYWdQUjRUcThrSVph\nRnQ0QUtrZVppaldMTUorbGVCUDlodEdYZEdZCml4VUlZVnJHT1VJSW1JK2hDSGNE\nclNvcXdxZjJsbUM1VW1qRFRYZ3dBdm8KLS0tIG5TVUJYZE85ZG9nZDl4OGsrUFBS\nWkxaMjBMblZ1WGpVei9KSnR1MkZnSzQKCL4kgeLf2ZRO0eMcb/2j6nfk0EXYo2+r\nGFTuE6/OlNXV0BIY8vXkubniWdkT0Mm/2nla0nQPiKv/ubterVZF3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBWGxBNVVKNmpxaEZOUHZE\nZVRxN1VPMTI1MDMzZmkrbWNxVHM5ZzVkbkMwCjZFbys0bVdlR1FvbDVmYzdSaUc3\nOXl2aW82T0p4UDlvajN6cERuS1FYaWcKLS0tIE1GdlJRVEppUEE3WGVsTnl1aCtx\nSHdlRWRJVzREakVnVjhPdm0xRXBGaVEK1iyMJmPeA1gySxLlzLVj4Pqb0AaBxH3k\nxKD4b4CTqA+gtv/NUt7rMG8sx0L+zpKrYsq8WWoTVR4iqi7pceKtyw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SEFhZ1IxYVh3R0RIb2lj\nUkpNVHRHV2NOTW9tMm9GSCt3WW9qaXlPSXdNCmlOYXRmTUxjWFBSU0FjV25VcFB4\nc09qNUNzd0dGWFpVaFVVWHBoNUVLeTgKLS0tIFFGRjc0c2dSOGs2TjNsTlhUampv\nb3FXakJNdHljYSs0UlhPUDBJNzFHcUUK+KI+/hjFWn0GDqYCLuF1D6mqm8Zwz2uT\nBnvYErRQp8zhzmJyISb1CWXOHN4iUhC7sAriLBA3CGJsveYiCo+QOQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGT0diZG0vaDhrbjRnYVhh\nMTJMTEd1TWxKcHJnV0s4cEVXWlFmOFAzbWhFCkx2dW1ISWpWbm8zdnE3ZkhRVXBr\nUVV0Sk5IL3BIdDQ1R0NIL2I3YnFwdG8KLS0tIHZmM2dKaDR6RkFzM2ZJNERlU0VW\nTGVkdTErdjIxVWV6SUpKUkJCS2JiTUEKcdc+IzYcGr/WAwvZLtbS4XUW2qxYNsrK\nBfYUB2e7uqyuLVQQtZjY7GeKtldJxmrPg1alpNYKVgb2q5/B03bK+g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-12-09T04:18:55Z",
+		"mac": "ENC[AES256_GCM,data:829+mmUUq8OwPJ196vFAjFoj9pU/86bCPU3CR321SYQrw8Max6mhlPJtaBsmQhux20Sv9jnd/vZyeJqTVzikE45v1uHcIdzHDzleSP4yRhyZ2EFOx7RMjbXxTGolLokKqlzTPwMIwP/R/93l4WmCLcK3j+xCU7BN8XUZHDvh3Qw=,iv:voxCHN9JYplyXBKyp55swfIQP0hVfJ/fk/FdJNvwpZg=,tag:T/26J+gaftij+BCqQFxGWw==,type:str]",
+		"version": "3.11.0"
+	}
+}