mob next [ci-skip] [ci skip] [skip ci]

lastFile:flake.lock
2026-02-03 18:03:04 +07:00 · 2026-02-03 17:43:46 +07:00
84 changed files with 302 additions and 1418 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -9,6 +9,7 @@
        ],
        "nix-darwin": "nix-darwin",
        "nix-select": "nix-select",
+        "nixos-facter-modules": "nixos-facter-modules",
        "nixpkgs": [
          "nixpkgs"
        ],
@@ -19,11 +20,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772411144,
-        "narHash": "sha256-WhXudztwPNnKXaqGX4DOqNfHzHdBSiGCvKGHM20pscw=",
+        "lastModified": 1766984802,
+        "narHash": "sha256-SYZ/MXVtJEb3sRWxvPL/2HtpSL1CzQgu1o8ASXqCO98=",
        "ref": "refs/heads/main",
-        "rev": "92cc85bc24eb31ce5725e1e72753129810ce3fe9",
-        "revCount": 13201,
+        "rev": "052b66d8dc724c3e519b9003281c2f9a210fc380",
+        "revCount": 11770,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -48,11 +49,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772273147,
-        "narHash": "sha256-Wzhoc6ifjTDZi8aVRH3fuLJPdd4ouNTTwwVhgoMcMek=",
-        "rev": "d5de7a8d9e5726e678c94e62fe8ac3a809fee5da",
+        "lastModified": 1766977667,
+        "narHash": "sha256-LUALgG4ZpsA0k7pGYzMDto/r6T8aIPlYTok3lGlojjA=",
+        "rev": "3f852546b5d8bd2e9659a81c6b2cc14922e63a94",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/d5de7a8d9e5726e678c94e62fe8ac3a809fee5da.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/3f852546b5d8bd2e9659a81c6b2cc14922e63a94.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -87,11 +88,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1771881364,
-        "narHash": "sha256-A5uE/hMium5of/QGC6JwF5TGoDAfpNtW00T0s9u/PN8=",
+        "lastModified": 1766150702,
+        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "a4cb7bf73f264d40560ba527f9280469f1f081c6",
+        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
        "type": "github"
      },
      "original": {
@@ -158,17 +159,19 @@
    "liminix": {
      "flake": false,
      "locked": {
-        "lastModified": 1773253359,
-        "narHash": "sha256-LogvYVd2NfZnTlxAkl5K9tqX9c7wEEPdnYJsW9WTSG4=",
-        "ref": "refs/heads/main",
-        "rev": "7f23c5dc0f442de9fe07c076297c3a74f2a34e72",
-        "revCount": 1656,
+        "lastModified": 1760426231,
+        "narHash": "sha256-r8c5PKtsxAvtQ/k17GH+WNvP47Lr+AbExLMPdLtvAKE=",
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "revCount": 1574,
        "type": "git",
-        "url": "https://gti.telent.net/dan/liminix"
+        "url": "https://git.b4l.co.th/newedge/liminix"
      },
      "original": {
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
        "type": "git",
-        "url": "https://gti.telent.net/dan/liminix"
+        "url": "https://git.b4l.co.th/newedge/liminix"
      }
    },
    "nix-darwin": {
@@ -179,11 +182,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772379624,
-        "narHash": "sha256-NG9LLTWlz4YiaTAiRGChbrzbVxBfX+Auq4Ab/SWmk4A=",
+        "lastModified": 1766784396,
+        "narHash": "sha256-rIlgatT0JtwxsEpzq+UrrIJCRfVAXgbYPzose1DmAcM=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "52d061516108769656a8bd9c6e811c677ec5b462",
+        "rev": "f0c8e1f6feb562b5db09cee9fb566a2f989e6b55",
        "type": "github"
      },
      "original": {
@@ -205,42 +208,34 @@
        "url": "https://git.clan.lol/clan/nix-select/archive/main.tar.gz"
      }
    },
-    "nixpkgs": {
+    "nixos-facter-modules": {
      "locked": {
-        "lastModified": 1774794121,
-        "narHash": "sha256-gih24b728CK8twDNU7VX9vVYK2tLEXvy9gm/GKq2VeE=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "c397ef6af68c018462d786e1b65384abc472a907",
+        "lastModified": 1766558141,
+        "narHash": "sha256-Ud9v49ZPsoDBFuyJSQ2Mpw1ZgAH/aMwUwwzrVoetNus=",
+        "owner": "nix-community",
+        "repo": "nixos-facter-modules",
+        "rev": "e796d536e3d83de74267069e179dc620a608ed7d",
        "type": "github"
      },
      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
+        "owner": "nix-community",
+        "repo": "nixos-facter-modules",
        "type": "github"
      }
    },
-    "plasma-manager": {
-      "inputs": {
-        "home-manager": [
-          "home-manager"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
+    "nixpkgs": {
      "locked": {
-        "lastModified": 1772361940,
-        "narHash": "sha256-B1Cz+ydL1iaOnGlwOFld/C8lBECPtzhiy/pP93/CuyY=",
-        "owner": "nix-community",
-        "repo": "plasma-manager",
-        "rev": "a4b33606111c9c5dcd10009042bb710307174f51",
+        "lastModified": 1770115761,
+        "narHash": "sha256-tjQSjOk4TdngEzIwrNehqYFoa7b4S9JlWSqoTJo9KEI=",
+        "owner": "kurogeek",
+        "repo": "nixpkgs",
+        "rev": "e9a5b19fa711f0e48dfc9816778ce09d63574a4b",
        "type": "github"
      },
      "original": {
-        "owner": "nix-community",
-        "repo": "plasma-manager",
+        "owner": "kurogeek",
+        "ref": "inventree",
+        "repo": "nixpkgs",
        "type": "github"
      }
    },
@@ -253,7 +248,6 @@
        "import-tree": "import-tree",
        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
-        "plasma-manager": "plasma-manager",
        "treefmt-nix": "treefmt-nix"
      }
    },
@@ -265,11 +259,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772340640,
-        "narHash": "sha256-1nq7+Kt5IUBD8Hu3nptVPbMf+22rNJoHT0t9L1X+GKA=",
+        "lastModified": 1766894905,
+        "narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "dec4d8eac700dcd2fe3c020857d3ee220ec147f1",
+        "rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -19,19 +19,14 @@
      inputs.nixpkgs.follows = "nixpkgs";
      url = "github:nix-community/home-manager";
    };
-    plasma-manager = {
-      url = "github:nix-community/plasma-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.home-manager.follows = "home-manager";
-    };
    import-tree.url = "github:vic/import-tree";
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:kurogeek/nixpkgs/inventree";
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    liminix = {
-      url = "git+https://gti.telent.net/dan/liminix";
+      url = "git+https://git.b4l.co.th/newedge/liminix?ref=refs/heads/fix-gl-ar750&rev=3f1f7c08d440130cce9262a93ce78ed7969d93cd";
      flake = false;
    };
  };
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,8 +1,5 @@
 {
-  imports = [
-    ./personal-computer.nix
-    ./emmie.nix
-  ];
+  imports = [ ./personal-computer.nix ];
  clan = {
    inventory = {

@@ -29,7 +26,6 @@
        ];
        global-network = [
          "rana"
-          "sirius"
        ];
      };

@@ -265,24 +261,6 @@
              };
          };
        };
-
-        samba = {
-          module = {
-            name = "samba";
-            input = "self";
-          };
-          roles.server.machines."sirius".settings = {
-            globalUsers = {
-              w.writePerm = true;
-            };
-            sharedFolders = {
-              WHITEHOUSE = {
-                allowedGuest = true;
-              };
-            };
-            dataDir = "/mnt/hdd/samba";
-          };
-        };
      };
    };
  };
--- a/inventories/emmie.nix
+++ b/inventories/emmie.nix
@@ -1,44 +0,0 @@
-{ config, ... }:
-let
-  username = "emmie";
-  userhome = "/home/${username}";
-in
-{
-  clan.inventory = {
-    tags = {
-      emmie = [ "rana" ];
-    };
-
-    instances = {
-      emmie-syncthing = {
-        module = {
-          name = "syncthing";
-          input = "clan-core";
-        };
-        roles.peer.tags.emmie = { };
-        roles.peer.settings = {
-          folders = {
-            Syncthing = {
-              path = "${userhome}/Share/Syncthing";
-            };
-          };
-          extraDevices = {
-            pixel7a = {
-              id = "CEUJMEG-SOHXIJF-G2FT5QB-6MZW3EN-PONI3QN-HPEIOSU-IMSLGW7-XUU6BQK";
-              name = "eris";
-              addresses = [ "dynamic" ];
-            };
-          };
-        };
-        roles.peer.extraModules = [
-          {
-            config.services.syncthing = {
-              user = username;
-              dataDir = "${userhome}/Share";
-            };
-          }
-        ];
-      };
-    };
-  };
-}
--- a/inventories/personal-computer.nix
+++ b/inventories/personal-computer.nix
@@ -14,9 +14,14 @@
    instances = {
      emmie-home = {
        module = {
-          name = "emmie-home";
+          name = "home-user";
          input = "self";
        };
+        roles.default.settings = {
+          username = "emmie";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
        roles.default.machines."rana" = { };
      };
      chocolate-home = {
--- a/inventory.json
+++ b/inventory.json
@@ -22,13 +22,10 @@
      "installedAt": 1765343708
    },
    "rana": {
-      "installedAt": 1773134236
+      "installedAt": 1768294839
    },
    "petra": {
      "installedAt": 1769064458
-    },
-    "sirius": {
-      "installedAt": 1770974584
    }
  }
 }
--- a/machines/rana/configuration.nix
+++ b/machines/rana/configuration.nix
@@ -9,6 +9,4 @@
  };
  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
-
-  boot.kernelParams = [ "amdgpu.dcdebugmask=0x10" ];
 }
--- a/machines/rana/disko.nix
+++ b/machines/rana/disko.nix
@@ -53,9 +53,6 @@ in
      zroot = {
        type = "zpool";
        rootFsOptions = {
-          encryption = "aes-256-gcm";
-          keyformat = "passphrase";
-          keylocation = "file:///tmp/secret.key";
          mountpoint = "none";
          compression = "lz4";
          acltype = "posixacl";
--- a/machines/rigel/configuration.nix
+++ b/machines/rigel/configuration.nix
@@ -13,4 +13,8 @@
  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  services.inventree = {
+    enable = true;
+  };
 }
--- a/machines/sirius/README.md
+++ b/machines/sirius/README.md
@@ -1,21 +0,0 @@
-## How to setup this machine.
-
-This machine cannot be setup the same way as other machines are setup. Meaning that `clan machine install` won't work. Because of `disko` issue. So, below is how the machine is setup.
-
-1. Build an image to flash to an sd-card using
-
-```
-nix build -L --show-trace .\#nixosConfigurations.sirius.config.system.build.images.sd-card
-```
-
-2. Import the `zdata`
-
-```
-zpool import zdata
-```
-
-3. Update configuration
-
-```
-clan machine update sirius
-```
--- a/machines/sirius/configuration.nix
+++ b/machines/sirius/configuration.nix
@@ -1,4 +1,6 @@
 {
+  inputs,
+  config,
  self,
  ...
 }:
@@ -6,68 +8,17 @@
  imports = [
    self.nixosModules.common

-    ./hardware-configuration.nix
+    (inputs.import-tree ./services)
+
  ];

-  image.modules.sd-card = {
-    disabledModules = [
-      ./hardware-configuration.nix
-    ];
-  };
-
  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";

  nixpkgs.hostPlatform = {
-    system = "aarch64-linux";
+    system = "x86_64-linux";
  };

  system.stateVersion = "25.11";

-  services.journald.extraConfig = ''
-    Storage=volatile
-    RuntimeMaxUse=30M
-    RuntimeMaxFileSize=10M
-  '';
-
-  services.udisks2.enable = false;
-
-  nix.settings.log-lines = 25;
-  nix.settings.auto-optimise-store = true;
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 15d";
-  };
-
-  boot.loader.grub.enable = false;
-  boot.loader.generic-extlinux-compatible.enable = true;
-
-  boot.zfs.extraPools = [ "zdata" ];
-  boot.supportedFilesystems = [ "zfs" ];
-  boot.initrd.availableKernelModules = [
-    "usb_storage"
-    "sd_mod"
-  ];
-
-  fileSystems."/mnt/hdd" = {
-    device = "zdata/nas";
-    fsType = "zfs";
-    mountPoint = "/mnt/hdd";
-    options = [
-      "nofail"
-      "zfsutil"
-    ];
-  };
-
-  fileSystems."/var/lib" = {
-    device = "zdata/service-data";
-    fsType = "zfs";
-    mountPoint = "/var/lib";
-    options = [
-      "x-initrd.mount"
-      "nofail"
-      "zfsutil"
-    ];
-  };
-
 }
--- a/machines/sirius/disko-ref.nix
+++ b/machines/sirius/disko-ref.nix
@@ -1,150 +0,0 @@
-{ lib, pkgs, ... }:
-let
-  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  # os = "/dev/disk/by-id/mmc-SD64G_0x8336354b";
-  vdev = [
-    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYDBVV7Z"
-    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYDBSJRE"
-  ];
-  configTxt = pkgs.writeText "config.txt" ''
-    [pi4]
-    kernel=u-boot-rpi4.bin
-    enable_gic=1
-
-    # Otherwise the resolution will be weird in most cases, compared to
-    # what the pi3 firmware does by default.
-    disable_overscan=1
-
-    # Supported in newer board revisions
-    arm_boost=1
-
-    [all]
-    # Boot in 64-bit mode.
-    arm_64bit=1
-
-    # U-Boot needs this to work, regardless of whether UART is actually used or not.
-    # Look in arch/arm/mach-bcm283x/Kconfig in the U-Boot tree to see if this is still
-    # a requirement in the future.
-    enable_uart=1
-
-    # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel
-    # when attempting to show low-voltage or overtemperature warnings.
-    avoid_warnings=1
-  '';
-in
-{
-
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-    };
-    efi = {
-      canTouchEfiVariables = true;
-    };
-  };
-  # boot.tmp.useTmpfs = true;
-
-  disko.devices = {
-    disk = {
-      # "os-${hashDisk os}" = {
-      #   type = "disk";
-      #   device = os;
-      #   content = {
-      #     type = "gpt";
-      #     partitions = {
-      #       firmware = {
-      #         size = "60M";
-      #         priority = 1;
-      #         type = "0700";
-      #         content = {
-      #           type = "filesystem";
-      #           format = "vfat";
-      #           mountpoint = "/firmware";
-      #           postMountHook = toString (
-      #             pkgs.writeScript "postMountHook.sh" ''
-      #               (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf *.dtb /mnt/firmware/)
-      #               cp ${pkgs.ubootRaspberryPi4_64bit}/u-boot.bin /mnt/firmware/u-boot-rpi4.bin
-      #               cp ${configTxt} /mnt/firmware/config.txt
-      #             ''
-      #           );
-      #         };
-      #       };
-      #       ESP = {
-      #         size = "2G";
-      #         type = "EF00";
-      #         content = {
-      #           type = "filesystem";
-      #           format = "vfat";
-      #           mountpoint = "/boot";
-      #           mountOptions = [ "umask=0077" ];
-      #         };
-      #       };
-      #       root = {
-      #         name = "root";
-      #         end = "-0";
-      #         content = {
-      #           type = "filesystem";
-      #           format = "f2fs";
-      #           mountpoint = "/";
-      #           extraArgs = [
-      #             "-O"
-      #             "extra_attr,inode_checksum,sb_checksum,compression"
-      #           ];
-      #           mountOptions = [ "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard" ];
-      #         };
-      #       };
-      #     };
-      #   };
-      # };
-    }
-    // (lib.listToAttrs (
-      map (disk: {
-        name = "data-${hashDisk disk}";
-        value = {
-          type = "disk";
-          device = disk;
-          content = {
-            type = "zfs";
-            pool = "zdata";
-          };
-        };
-      }) vdev
-    ));
-    zpool = {
-      zdata = {
-        type = "zpool";
-        options.ashift = "12";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        mode = {
-          topology = {
-            type = "topology";
-            vdev = [
-              {
-                mode = "mirror";
-                members = vdev;
-              }
-            ];
-          };
-        };
-        datasets = {
-          "nas" = {
-            type = "zfs_fs";
-            mountpoint = "/mnt/hdd";
-            mountOptions = [ "nofail" ];
-          };
-          "service-data" = {
-            type = "zfs_fs";
-            mountpoint = "/var/lib";
-            mountOptions = [ "nofail" ];
-          };
-        };
-      };
-    };
-  };
-}
--- a/machines/sirius/disko.nix
+++ b/machines/sirius/disko.nix
@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-FIXME";
+  vdev = [
+    "/dev/disk/by-id/ata-FIXME"
+    "/dev/disk/by-id/ata-FIXME"
+  ];
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/sirius/hardware-configuration.nix
+++ b/machines/sirius/hardware-configuration.nix
@@ -1,6 +0,0 @@
-{
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
-    fsType = "ext4";
-  };
-}
--- a/machines/sirius/services/samba.nix
+++ b/machines/sirius/services/samba.nix
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    WhiteHouse.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "WhiteHouse NAS";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}
--- a/modules/clan/grafana/default.nix
+++ b/modules/clan/grafana/default.nix
@@ -13,28 +13,11 @@
      {
        config,
        lib,
-        pkgs,
        ...
      }:
      {
-        clan.core.vars.generators.grafana = {
-          files = {
-            secret_key = {
-              owner = "grafana";
-              group = "grafana";
-              secret = true;
-            };
-          };
-          script = ''
-            openssl rand -hex 32 > "$out"/secret_key
-          '';
-          runtimeInputs = [
-            pkgs.openssl
-          ];
-        };
        services.grafana = {
          enable = lib.mkDefault true;
-          settings.security.secret_key = "$__file{${config.clan.core.vars.generators.grafana.files.secret_key.path}}";
        };

        clan.core.state.grafana.folders = [ config.services.grafana.dataDir ];
--- a/modules/clan/grafana/flake-module.nix
+++ b/modules/clan/grafana/flake-module.nix
@@ -1,6 +1,6 @@
-{ self, inputs, ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
@@ -11,7 +11,6 @@ in
    {
      clan.nixosTests.service-grafana = {
        imports = [ ./tests/vm/default.nix ];
-        _module.args = { inherit self inputs; };

        clan.modules."@clan/grafana" = module;
      };
--- a/modules/clan/grafana/tests/vm/default.nix
+++ b/modules/clan/grafana/tests/vm/default.nix
@@ -1,23 +1,8 @@
 {
-  self,
-  config,
-  lib,
-  hostPkgs,
  ...
 }:
 {
  name = "service-grafana";
-  result.update-vars =
-    let
-      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
-    in
-    hostPkgs.writeShellScriptBin "update-vars" ''
-      set -x
-      export PRJ_ROOT=$(git rev-parse --show-toplevel)
-      ${
-        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
-      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
-    '';

  clan = {
    directory = ./.;
--- a/modules/clan/grafana/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/grafana/tests/vm/sops/machines/server/key.json
@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1chfz220hkkxvv25x4cmqsen38ppat9erplqus8gvynv0ajnu4uaqgfq3tj",
-    "type": "age"
-  }
-]
--- a/modules/clan/grafana/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/grafana/tests/vm/sops/secrets/server-age.key/secret
@@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:ZGt489y6VugKlhVLz6hC5sL+E+IDT6MkHS7jMU36WFWK9Co9btY4HRo+JtH/3C5iVuGLf/0j7n6W8SYZXigVCUTUQJvE56RfZ1s=,iv:rQM4ZZhN345KE2A16J9/ZKMZ9O+Qvb5y6kwXA/6SuZg=,tag:C+oeBtNFcImKd3HV/6yFCQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZU0hqYmtDKzBRWDVMNVdm\nUW5XMXd4WDNha0ppbENwOHk1bk1mVWxVV0F3CktYT01XdktyenNvUzU4UXBReEVp\nZXJKS05kS0NsbFNqamlXMkVzRmRhUkEKLS0tIEgweFVCT2tOZmMrdERDV0FBN3N2\nVjZPZXR3L0x0dER4T1Q4cTBlV20vUjAK9QJ2p8VzNqVY/lrcKwL56YF2JBfJp11M\ns801/6IQ5WvMPziG/E/nppv/9zL0kQTh9EPGqevy0juGcvqQgn1KQw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-03-02T07:38:10Z",
-		"mac": "ENC[AES256_GCM,data:ShP6xVJaIIyj5kqRJeIbTNJBkY3H/xvj/RgbEl65RZbJNVE0HTHkTmartKVEyROWQlMyhwesJr8FEKAnOrWysUOKQUKV9Cgfvr6J/IXZj1ZJkXbE9NcFmsRshv4Po4sCig7Hq7qt/hQLBqutUjXnpvLaKgARz2dcOv8HSoVkCKU=,iv:bvl6lFb2z8DGQkShEWe5XlYmhtXNf3bL5RHSsk9LAXs=,tag:HomMsFH3jEHCR0L6aXVsBw==,type:str]",
-		"version": "3.12.1"
-	}
-}
--- a/modules/clan/grafana/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/grafana/tests/vm/sops/secrets/server-age.key/users/admin
@@ -1 +0,0 @@
-../../../users/admin
--- a/modules/clan/grafana/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/grafana/tests/vm/sops/users/admin/key.json
@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}
--- a/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/machines/server
+++ b/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/machines/server
@@ -1 +0,0 @@
-../../../../../../sops/machines/server
--- a/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/secret
+++ b/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/secret
@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:xXGuIJCmajuSHV3rBaAC0+XZZekqPd3rTr1bTKjMIU34IF9ueairclcSAUjFHakRG5EeGJ90PTosuC1vnqk/emQ=,iv:9Od0lV3SeTlT9sgJHY6yw/tLz5WNbaMDDFfjvIMO76M=,tag:T4ybZEUDGrp+p4I5NEr+Xg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1chfz220hkkxvv25x4cmqsen38ppat9erplqus8gvynv0ajnu4uaqgfq3tj",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aUc5Yy8xOU0xcW02eDVK\nR0d5eXVtVU50dVk4L2dnZ3pObTJjOGQycHlnCjJBSndpdGNhRWVxeGZGdTJwZklU\nekdQTjZ1UTUzYklRVDd6WlVFeko0cEEKLS0tIDB2SkVpRXVEcG9nSGM0OG5hYmlR\ncXBMdUZ2MHdZd2hCaFF5Y1duOVlzc3MKgFUx3NZSoXiALUWj0gxPZLbmwfzRuq5w\nSc3CPCuEEALGq1unzndXJLSg+q4u/PAsZ/Q4l2CDHxuk5INct3Px7g==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTmxFL0UyNlhCaVhKWVJ5\nRUpLV3ZJdnNpYWZLa2phTlVNMmpzd20yd0FnCk9sOTFOZWQ3MzRHb3EwNUdzRDZ1\ndDk4eDVJRGFrOVIwd0xsb3c1b3VpWmcKLS0tIG16Nkc1TmlvbDNaYWZwcUFHYkV4\nT3Y5M1VOMWF3MHBMVlNMam1sSXIwNTQKRVvOVcV5GWua5hfS2ijKT5+C6Y5rZsXN\nKVzvemCk7pEGjVRSi4P0hrPnD37A6uwwj8FJqiLd7Y1p3hIVvBqR3w==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-03-02T07:38:11Z",
-		"mac": "ENC[AES256_GCM,data:HiiWGBruyPo/vGDdz/Zc/8Vd8oB2aMqoDjJCTybe9tRTJAojiSYZR4YyBO2ApCnYDyStJqXL0ZRjjRB73dwvldaNASz2odl/GGprmxcCH3T0A+Zrgu2gN9yNA5i+LkBLC2URXYwra4Den/WvIOTnrvvQcszN9SUBs+MOJM56KZo=,iv:+pjWMIf0+wBvWzkvsvqP7CI6zJpO3+8sqaZUEocXkXU=,tag:yp2CpOb38Kp13f2CJSzHEg==,type:str]",
-		"version": "3.12.1"
-	}
-}
--- a/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/users/admin
+++ b/modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/modules/clan/grafana/tests/vm/vars/per-machine/server/state-version/version/value
+++ b/modules/clan/grafana/tests/vm/vars/per-machine/server/state-version/version/value
@@ -1 +0,0 @@
-26.05
--- a/modules/clan/home-profiles/flake-module.nix
+++ b/modules/clan/home-profiles/flake-module.nix
@@ -2,6 +2,5 @@
 {
  clan.modules = {
    home-user = lib.modules.importApply ./home-user { };
-    emmie-home = lib.modules.importApply ./home-user/emmie.nix { };
  };
 }
--- a/modules/clan/home-profiles/home-user/emmie.nix
+++ b/modules/clan/home-profiles/home-user/emmie.nix
@@ -1,127 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "emmie-home-manager";
-  manifest.description = "Emmie's home-manager profile generator";
-  manifest.readme = "Emmie's home-manager profile generator";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-    description = "a default role for the user";
-    perInstance =
-      { ... }:
-      {
-        nixosModule =
-          { inputs, pkgs, ... }:
-          let
-            username = "emmie";
-          in
-          {
-            imports = [ inputs.home-manager.nixosModules.home-manager ];
-
-            users.users.${username} = {
-              initialPassword = "";
-              isNormalUser = true;
-              extraGroups = [
-                "audio"
-                "video"
-                "networkmanager"
-              ];
-            };
-
-            services.xserver = {
-              enable = true;
-              xkb.layout = "us,th";
-              xkb.options = "grp:win_space_toggle,grp:alt_shift_toggle";
-            };
-
-            programs.chromium = {
-              enable = true;
-              extraOpts = {
-                "BlockThirdPartyCookies" = true;
-                "ClearBrowsingDataOnExitList" = [
-                  "download_history"
-                  "cookies_and_other_site_data"
-                  "cached_images_and_files"
-                  "password_signin"
-                  "autofill"
-                  "site_settings"
-                  "hosted_app_data"
-                ];
-                "BraveRewardsDisabled" = true;
-                "BraveWalletDisabled" = true;
-                "BraveAIChatEnabled" = false;
-                "BraveNewsDisabled" = true;
-                "BraveSpeedreaderEnabled" = false;
-                "BraveWaybackMachineEnabled" = false;
-                "BraveStatsPingEnabled" = false;
-                "BraveWebDiscoveryEnabled" = false;
-                "BravePlaylistEnabled" = false;
-                "BraveVPNDisabled" = true;
-                "TorDisabled" = true;
-                "BraveP3AEnabled" = false;
-                "BraveTalkDisabled" = true;
-                "SyncDisabled" = false;
-                "PasswordManagerEnabled" = false;
-                "AutofillAddressEnabled" = false;
-                "AutofillCreditCardEnabled" = false;
-                "TranslateEnabled" = false;
-                "DnsOverHttpsMode" = "secure";
-                "DnsOverHttpsTemplates" = "https://dns.adguard-dns.com/dns-query";
-              };
-            };
-
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
-            home-manager.users.${username} =
-              {
-                osConfig,
-                pkgs,
-                lib,
-                inputs,
-                ...
-              }:
-              {
-                imports = [ inputs.plasma-manager.homeModules.plasma-manager ];
-
-                home = {
-                  homeDirectory = lib.mkForce "/home/${username}";
-                  stateVersion = osConfig.system.stateVersion;
-                  packages = with pkgs; [
-                    libreoffice-fresh
-                    element-desktop
-                    signal-desktop
-                    brave
-                    keepassxc
-                    vlc
-                    thunderbird
-                    wasabiwallet
-                    protonmail-desktop
-                  ];
-                };
-                programs.chromium.package = pkgs.brave;
-                programs.home-manager.enable = true;
-                services.syncthing.tray.enable = osConfig.services.syncthing.enable;
-                programs.plasma.enable = true;
-                programs.plasma.powerdevil = {
-                  AC = {
-                    autoSuspend.action = "shutDown";
-                    autoSuspend.idleTimeout = 1800;
-                  };
-                  battery = {
-                    autoSuspend.action = "shutDown";
-                    autoSuspend.idleTimeout = 1800;
-                  };
-                  lowBattery = {
-                    autoSuspend.action = "shutDown";
-                    autoSuspend.idleTimeout = 1800;
-                  };
-                };
-              };
-            home-manager.extraSpecialArgs = {
-              inherit inputs;
-            };
-          };
-      };
-  };
-}
--- a/modules/clan/home-profiles/home-user/home.nix
+++ b/modules/clan/home-profiles/home-user/home.nix
@@ -11,9 +11,8 @@
    homeDirectory = lib.mkForce "/home/${username}";
    stateVersion = osConfig.system.stateVersion;
    packages = with pkgs; [
-      libreoffice-fresh
+      libreoffice
      element-desktop
-      signal-desktop
      brave
      firefox
      keepassxc
@@ -22,5 +21,4 @@
    ];
  };
  programs.home-manager.enable = true;
-  services.syncthing.tray.enable = osConfig.services.syncthing.enable;
 }
--- a/modules/clan/paperless/default.nix
+++ b/modules/clan/paperless/default.nix
@@ -16,18 +16,6 @@
        ...
      }:
      {
-        nixpkgs.overlays = [
-          (final: prev: {
-            pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-              (pyFinal: pyPrev: {
-                psycopg = pyPrev.psycopg.overrideAttrs (old: {
-                  disabledTests = old.disabledTests ++ [ "test_stats_connect" ];
-                });
-              })
-            ];
-          })
-        ];
-
        services.paperless = {
          enable = lib.mkDefault true;
        };
--- a/modules/clan/personal-computer/printing.nix
+++ b/modules/clan/personal-computer/printing.nix
@@ -22,27 +22,11 @@ let

 in
 {
-  environment.systemPackages = [ pkgs.simple-scan ];
-  nixpkgs.config.allowUnfreePredicate =
-    pkg:
-    builtins.elem (lib.getName pkg) [
-      "brgenml1lpr"
-      "cups-brother-dcpt310"
-      "cups-brother-dcpt720dw"
-      "cups-brother-dcpt725dw"
-    ];
-  # nixpkgs.config.allowUnfree = true;
-  services.ipp-usb.enable = true;
  services.printing = {
    enable = true;
    drivers = [
      pkgs.brlaser
      pkgs.gutenprint
-      pkgs.brgenml1lpr
-      pkgs.brgenml1cupswrapper
-      pkgs.cups-brother-dcpt310
-      pkgs.cups-brother-dcpt720dw
-      pkgs.cups-brother-dcpt725dw
    ];

    extraFilesConf = ''
--- a/modules/clan/personal-computer/users.nix
+++ b/modules/clan/personal-computer/users.nix
@@ -4,7 +4,7 @@
  security.polkit.extraConfig = ''
    polkit.addRule(function(action, subject) {
      if ((action.id == "org.freedesktop.accounts.change-own-password")) {
-        return polkit.Result.YES;
+        return polkit.Result.AUTH_SELF;
      }
    });
  '';
--- a/modules/clan/phonebox/default.nix
+++ b/modules/clan/phonebox/default.nix
@@ -123,7 +123,6 @@

                [${localNumber}](dynamiic_aor)
                max_contacts=1
-                remove_existing=yes
              '';

            genLocalExtenConf =
--- a/modules/clan/samba/default.nix
+++ b/modules/clan/samba/default.nix
@@ -1,253 +0,0 @@
-{ lib, ... }:
-{
-  _class = "clan.service";
-  manifest.name = "samba";
-  manifest.description = "Samba configuration for NAS";
-  manifest.readme = "Samba configuration for NAS";
-  manifest.categories = [ "System" ];
-
-  roles.server = {
-    description = "A server role that host files";
-
-    interface =
-      { lib, ... }:
-      let
-        userOptions = {
-          readPerm = lib.mkOption {
-            type = with lib.types; bool;
-            description = "Permission to read";
-            default = false;
-          };
-          writePerm = lib.mkOption {
-            type = with lib.types; bool;
-            description = "Permission to write";
-            default = false;
-          };
-        };
-      in
-      {
-        options = {
-
-          globalUsers = lib.mkOption {
-            type =
-              with lib.types;
-              attrsOf (submodule {
-                options = userOptions;
-              });
-            description = "List of global users with permissions, this will be applied to all the folders.";
-            default = {
-              admin = {
-                readPerm = true;
-                writePerm = true;
-              };
-            };
-          };
-
-          sharedFolders = lib.mkOption {
-            type =
-              with lib.types;
-              attrsOf (submodule {
-                options = {
-                  users = lib.mkOption {
-                    type =
-                      with lib.types;
-                      attrsOf (submodule {
-                        options = userOptions;
-                      });
-                    description = "List of users with permissions, this will only applied to this particular folder.";
-                    default = { };
-                  };
-                  allowedGuest = lib.mkOption {
-                    type = with lib.types; bool;
-                    description = "Whether to allow guest access to this folder.";
-                    default = false;
-                  };
-                };
-              });
-            description = "List of folders with users permissions.";
-            default = [
-              {
-                name = "DEFAULT";
-              }
-            ];
-
-          };
-
-          dataDir = lib.mkOption {
-            type =
-              with lib.types;
-              oneOf [
-                str
-                path
-              ];
-            description = "A directory where all samba folders will be.";
-          };
-
-        };
-      };
-    perInstance =
-      { settings, ... }:
-      let
-        allUsernameList = lib.uniqueStrings (
-          lib.flatten (
-            (lib.mapAttrsToList (name: share: builtins.attrNames share.users) settings.sharedFolders)
-            ++ builtins.attrNames settings.globalUsers
-          )
-        );
-      in
-      {
-        nixosModule =
-          {
-            lib,
-            config,
-            pkgs,
-            ...
-          }:
-          {
-
-            users.users = builtins.listToAttrs (
-              map (
-                username:
-                lib.nameValuePair username {
-                  isSystemUser = true;
-                  group = username;
-                }
-              ) (allUsernameList ++ builtins.attrNames settings.sharedFolders)
-            );
-
-            users.groups = builtins.listToAttrs (
-              map (username: lib.nameValuePair username { }) (
-                allUsernameList ++ builtins.attrNames settings.sharedFolders
-              )
-            );
-
-            clan.core.vars.generators = builtins.listToAttrs (
-              map (
-                username:
-                lib.nameValuePair "${username}-smb-password" {
-                  files.password = { };
-                  runtimeInputs = with pkgs; [
-                    coreutils
-                    xkcdpass
-                    mkpasswd
-                  ];
-                  script = ''
-                    xkcdpass --numwords 3 --delimiter - --count 1 > $out/password
-                  '';
-                }
-              ) allUsernameList
-            );
-
-            systemd.services.samba-smbd.postStart =
-              lib.concatMapStrings (
-                user:
-                let
-                  passwordPath = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
-                  userDir = "${settings.dataDir}/${user}";
-                in
-                ''
-                  mkdir -p ${userDir}
-                  chown ${user}:users ${userDir}
-                  # if a password is unchanged, this will error
-                  (echo $(<${passwordPath}); echo $(<${passwordPath})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
-                ''
-              ) allUsernameList
-              + lib.concatMapStrings (
-                share:
-                let
-                  shareDir = "${settings.dataDir}/${share}";
-                in
-                ''
-                  mkdir -p ${shareDir}
-                  chown ${share}:${share} ${shareDir}
-                ''
-              ) (builtins.attrNames settings.sharedFolders);
-
-            services.samba = {
-              enable = true;
-              openFirewall = true;
-              settings = {
-                global = {
-                  security = "user";
-                  workgroup = "WORKGROUP";
-                  "server string" = "WhiteHouse NAS";
-                  "max log size" = "50";
-                  "dns proxy" = false;
-                  "syslog only" = true;
-                  "map to guest" = "Bad User";
-                  "guest account" = "nobody";
-                };
-              }
-              // lib.mapAttrs (
-                shareName: value:
-                {
-                  path = "${settings.dataDir}/${shareName}";
-                  comment = shareName;
-                  "force user" = shareName;
-                  "force group" = shareName;
-                  "create mask" = "0640";
-                  "directory mask" = "0750";
-                  "read only" = "yes";
-                  browseable = "yes";
-                  printable = "no";
-                  "read list" = lib.concatStringsSep " " (
-                    lib.uniqueStrings (
-                      lib.flatten (
-                        (builtins.attrNames (lib.filterAttrs (n: v: v.readPerm) value.users))
-                        ++ (builtins.attrNames (lib.filterAttrs (n: v: v.readPerm) settings.globalUsers))
-                      )
-                    )
-                  );
-                  "write list" = lib.concatStringsSep " " (
-                    lib.uniqueStrings (
-                      lib.flatten (
-                        (builtins.attrNames (lib.filterAttrs (n: v: v.writePerm) value.users))
-                        ++ (builtins.attrNames (lib.filterAttrs (n: v: v.writePerm) settings.globalUsers))
-                      )
-                    )
-                  );
-                }
-                // lib.optionalAttrs (value.allowedGuest) {
-                  public = "yes";
-                  "guest ok" = "yes";
-                }
-              ) settings.sharedFolders
-              // builtins.listToAttrs (
-                map (
-                  user:
-                  lib.nameValuePair user {
-                    comment = user;
-                    path = "${settings.dataDir}/${user}";
-                    "force user" = user;
-                    "force group" = "users";
-                    public = "yes";
-                    "guest ok" = "no";
-                    "create mask" = "0640";
-                    "directory mask" = "0750";
-                    writable = "yes";
-                    browseable = "yes";
-                    printable = "no";
-                    "valid users" = user;
-                  }
-                ) allUsernameList
-              );
-            };
-
-            services.samba-wsdd = {
-              enable = true;
-              openFirewall = true;
-            };
-
-            services.avahi = {
-              publish.enable = true;
-              publish.userServices = true;
-              # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
-              nssmdns4 = true;
-              # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
-              enable = true;
-              openFirewall = true;
-            };
-          };
-      };
-  };
-}
--- a/modules/clan/samba/flake-module.nix
+++ b/modules/clan/samba/flake-module.nix
@@ -1,20 +0,0 @@
-{ inputs, self, ... }:
-let
-  module = ./default.nix;
-in
-{
-  clan.modules = {
-    samba = module;
-  };
-
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-samba = {
-        imports = [ ./tests/vm/default.nix ];
-        _module.args = { inherit self inputs; };
-
-        clan.modules."@clan/samba" = module;
-      };
-    };
-}
--- a/modules/clan/samba/tests/vm/default.nix
+++ b/modules/clan/samba/tests/vm/default.nix
@@ -1,86 +0,0 @@
-{
-  lib,
-  self,
-  config,
-  hostPkgs,
-  ...
-}:
-let
-  testDir = "/mnt/hdd/samba";
-in
-{
-  name = "service-samba";
-  result.update-vars =
-    let
-      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
-    in
-    hostPkgs.writeShellScriptBin "update-vars" ''
-      set -x
-      export PRJ_ROOT=$(git rev-parse --show-toplevel)
-      ${
-        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
-      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
-    '';
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        samba-test = {
-          module.name = "@clan/samba";
-          module.input = "self";
-          roles.server.machines."server".settings = {
-            dataDir = testDir;
-            globalUsers = {
-              guser1 = {
-                readPerm = true;
-                writePerm = true;
-              };
-            };
-            sharedFolders = {
-              "share1" = {
-                users = {
-                  "u1share1" = { };
-                  "u2share1" = { };
-                };
-              };
-              "share2" = {
-                users = {
-                  "u1share2" = { };
-                  "u2share2" = { };
-                };
-              };
-              "share3" = { };
-            };
-          };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = { };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("samba-smbd")
-
-    server.succeed("systemctl status samba-smbd")
-
-    server.succeed("test -d ${testDir}/guser1")
-    server.succeed("test -d ${testDir}/u1share1")
-    server.succeed("test -d ${testDir}/u2share1")
-    server.succeed("test -d ${testDir}/u1share2")
-    server.succeed("test -d ${testDir}/u2share2")
-    server.succeed("test -d ${testDir}/share1")
-    server.succeed("test -d ${testDir}/share2")
-
-    server.succeed("runuser -u guser1 -- test -r ${testDir}/share1")
-    server.succeed("runuser -u guser1 -- test -r ${testDir}/share1")
-    server.succeed("runuser -u u1share1 -- test -r ${testDir}/share1")
-  '';
-}
--- a/modules/clan/samba/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/samba/tests/vm/sops/machines/server/key.json
@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
-    "type": "age"
-  }
-]
--- a/modules/clan/samba/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/samba/tests/vm/sops/secrets/server-age.key/secret
@@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:EH+rEfBdg4O7dEsk0o95T7xBQK/7duVCnLpdFOC1rWVbwdt/qYzEobZCo9awzvmh6YlC9Ld/OKv5wIBJJJI8PpTII2jdlWMG778=,iv:nhswri4dJ+Yj/1zarXzvLUhfJPSlWCGjVYOP6sYOT3w=,tag:WKFP6xhiSAfuDY880tEyAw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBheUV1blJCMFFoQmxVaGdK\nUmpsZHRkWDJXczFRaDdqWVRXeXYzSVZhdFUwCmY1Ym1uVWF2akJlc2JScWZWUUtI\nbXgvTFYvS0d1aXVSVkFUakJNSVdrZUEKLS0tIFA5WllweEhrK2hwYkFMaTRYeGJT\nU3YxY1ZIblhYdlJZaERodWVsSW1yYmsK5ow3QIvOt7nelW+aiBo1Z08SCqXTThTb\nAimCwnhqBhW08ipZ5hmQFqZc4cfoDapmemOBqW9Q6NPyNB0Mr2EIdg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-02-11T02:53:23Z",
-		"mac": "ENC[AES256_GCM,data:TxoCasCZ4fRLU4gFWSDl4oi5YUIFSKirYV1kI5oMJcFqSFUZ0ZXCbuBX4i5UA/VWkY0/Th4scRqgvVCFcr/sO8DGh+oi14Ayu1o70Pjf/f0u6S3ROa84f5nBybq8oVQTzP23+a0OkpJTB2vS+ELB2Q7GOeQ7MIrya58XB+40QCg=,iv:9H+0luICB18332YyuUnF+d8sYDWYWakiIK95dmqOZVA=,tag:ldPbuLykRCp9sqI+vHoO3w==,type:str]",
-		"version": "3.11.0"
-	}
-}
--- a/modules/clan/samba/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/samba/tests/vm/sops/secrets/server-age.key/users/admin
@@ -1 +0,0 @@
-../../../users/admin
--- a/modules/clan/samba/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/samba/tests/vm/sops/users/admin/key.json
@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/machines/server
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/machines/server
@@ -1 +0,0 @@
-../../../../../../sops/machines/server
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/secret
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/secret
@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:WU0RGh0P17GqEfENAZO9/orLxtU8wpc=,iv:yFINf8UCfkSKmWSghHB1wsrsgMcgAxjXbuSbtQY7WhI=,tag:sugSGytBTks5EYk5gZUw/Q==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBER2VuTUVpTnRDNzVKcW5I\nMTZ3NW5JVEJSVnB4UTBJQ2g5S3ZRdnZBaTFRCmZWTUwyckZwL1RhdXJaZUkyL1lH\nODdienVFWENrb0VDWENOK0hseFBKLzgKLS0tIHMrWDd3ZW9UM3lWZU9Vb2JYUC91\nZGhTTVBmSURPVmNITVlIM2swNXAxUW8K2/88jwpUI+gZ8B289I/AvxtXpQHRabcy\nS2tK1rww6umRYmEvN8X3Ek5cz7XeulgY3gMlS+IbtScjXCGySw5tTg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZRlFGV0FveEpkZVNhbjE0\nZ0c2cWtYTEVVTWlkeFMvT2twQVF1ZkRQcVJjCkVLRUpUY0RBQW54dU5McjUzbGQv\nSEorSFpXM3J3ZFgveUg3WDdMOVlwZWsKLS0tIHR2bXRVMnkxNThtNE5McmhzWWRE\ncHAyYW5FZXJ5T2piREhHY1F5WXpsQ0UKFyeMvgOogS9n8puvB0/0lq5+sOSq8yfZ\nSIGlqE0KTmFryNpPUINiJj5SpvdXvUeVqahoCB1QOGbodX1vKiwdgA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-02-11T02:53:23Z",
-		"mac": "ENC[AES256_GCM,data:gRxnr9F8mT7OuooHRVgtNLut1BAEQiWpVr9iw7oN2mKlbZxq0X09K8jYZu0/dEMijbRfDoZ2bUmW7VIcqAZXwAZqLoqx3vzBqOGAQFcxyVFk0yRqPzR6odMYBdOeLFufN9l1IXOKiH4wZZB1kHean7XBlLzNUCTts12l+wInisY=,iv:zz7g/VcsBkY0kCELIIOBByLOj9bfXVOkw7JdTnlKRWc=,tag:FcGO6rsv+fBTHt+ymL6c0A==,type:str]",
-		"version": "3.11.0"
-	}
-}
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/users/admin
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/state-version/version/value
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/state-version/version/value
@@ -1 +0,0 @@
-26.05
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/machines/server
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/machines/server
@@ -1 +0,0 @@
-../../../../../../sops/machines/server
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/secret
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/secret
@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:bgmzK6ERM6e6uJMW8Cqfgo1ktvM6l83LxNJV,iv:aYAYbWvBLZZx9zdUUZ/K29heR/yKXRDeR48g8rhKIQY=,tag:ZhXGRovVumEa0lpT8P8KaQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTG4yRFM5T1B1SWdzWWYv\nQTd0M2RjVTVKNy9rNUM1TmtvcEZsTVZ1U0JFCjNTOS95alh6MVZubXhOTGRwakUz\nZDBFck8rUVhYay9iRTRHY0pCZDJsSEEKLS0tIHJPUXpOVnMxMk9aSjYrTEFvSEJo\ndTd1MmNabVI1YkkwbVhkMnJLRzZzYjQKP6ehM8PTOrPVMgViUPGsXTyOdr9k5OAO\npf0faZpfH/GHiVBT7vaLrE/BLOhxLNkltldqyS1IUy19iXG9wEjbOQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVDVZM3U4b0JveXVQL3BS\nR2x0SnlyK3FHMGdPL0hsb3lLOWt6aHBRbWdBClpzYWxEWUJHOGxzM0ZrUWhEa2hv\ncnFmOElUUkw5NEtEMmV3VDdiUGkyWlkKLS0tIHVtUlN0VTR1Y3ZxQ3JyRjA4ZzNk\nZWthMDJ5K1Z4Uzc0dVdWY2xWQUgzYkkKE0WIA/a1ZJXDS+qZyqadNYPRg7ixB8fU\n/mqsnJ6imb4+436LDfAd+ZknhS38IKe+56Tj27/frHFvcM4XIdBOuQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-02-11T02:53:27Z",
-		"mac": "ENC[AES256_GCM,data:rTA80/5n6DcTQns0UfuIJ61700exGeY/9zZaFA29bPFVzjuWz7EF4kQB8c3Qt1NcgGECn39pI/cT8SO1fWvz5mMRpBuoPthG8vzHGtjpqYYQhvOXh4CPmPA2EpWsC5Yz+ixSNF5BsrQqr+nnHLncmqVtdwKNx5WHZ+cHGHscqlk=,iv:ve7d0esVdq74ABai4NnS/W2hcLTmEf4QpxoJ24dLMNw=,tag:u99X2k0L7/iWSIJoTBR3KQ==,type:str]",
-		"version": "3.11.0"
-	}
-}
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/users/admin
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/machines/server
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/machines/server
@@ -1 +0,0 @@
-../../../../../../sops/machines/server
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/secret
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/secret
@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:WgDWZkhHWOV+ziaXtaeTWQicasUPRXE=,iv:Mwgc7cohAOLNsN77fEMBuOQaeQYAUL2CpEE1WaXm0lk=,tag:05Xxc/rJg1bt1PF79MLd/g==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpWThaNElOVmhxbWFuTkJR\nQlJYMkVNTW5oRUNqRlowK2RLelhqb2hwSldFCjMycUpGelo1M2N1QWsxT3BCYktR\nUlpTYTUxTnVGMVZoelU3ZUlvQ1pMcTQKLS0tIGNmd1NQSlROR3lzQ2JQdkF0elkz\nNkN0Y2Z2T0Q2QUk0d0kzQmwrcVZEOVEKiM3Y/uGy4dB/5rGKAjjZM95y8INx+e+q\nxU9TUfGQBgYVzZtloLz3O7mlwhlamk1BvPvHttU+35paw26IbUlIoA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWczZZWk5OTGtCTUw3b1c3\ncU9UaE1RaHNMS01NeXNmYVVqVHhJOXdmUmxvClh4R0ZtZjVmblZCWjlBb2VEaUlE\nUDBmWTV5Wnhpa2tnTWo3bEhOYXlYRFkKLS0tIE5jV1Ivdzdxc0R6V1ZiZU5NWFNL\ndnNsK0dhTElVWDVMRUZiTG5kMnJVSlkKVXmgoqF2bdwia9VDlOOKA6DTZCqpl9DP\n2ClATf3YXnKQ/uBNpfWrKoqJDL2y+26rEeoisPUrkrgYbpr3hq6Nqg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-02-11T02:53:29Z",
-		"mac": "ENC[AES256_GCM,data:Yf5hFEEQ+yYH6OOjI7GLBahLL8UPuLIhIIdYkRoj6cSHgqm/ZpQGcd8MlHLGq0dpUcGOYJV9CM9pBqX0MjpABiK4XdTpoTn80EOV+mI2k6idE5N0doDecymI5A9ueB+5lO187HP57j5blJIn9aW+xO6MI9kYRYOz3sroAPq/JX0=,iv:yH1mB6DD+h869bsmovywJQm2ccd1PmqA7sZ9DGQ2+W4=,tag:sqLDW7JjT+K0JeWr8cUAQg==,type:str]",
-		"version": "3.11.0"
-	}
-}
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/users/admin
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/machines/server
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/machines/server
@@ -1 +0,0 @@
-../../../../../../sops/machines/server
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/secret
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/secret
@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:LgIGB2KkRtTiqyy97uHI87jzaWTn2oCiV+Jx,iv:fUBJ6d9svCfwS+nDcIxezV3Eevlyq6r81D4h10T7Tw8=,tag:jPTOtbwjYEZc2eyMAKBrkA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyekpXT3lVSWErbWZBZW9l\nalBMVTB2M3Y2czZQWFR0Y3NWMlVLT0o0eWg0CmJWZmlHWFUwelI3ei9wTm5SZ2JC\nODRoYVRoVDFTRC8vcWgxaXd0ODB2TEkKLS0tIEhZL25mR1ZMY1Z1anBCTnltYjlr\nL2h4M0lieDFWS2lCMDY3MERORDZBS3MK3onTR08r0s8KA3qRC9xymVRhHQ9I6XjL\n/7bDzOR72fIHtCG8h+KTvN2v5H/YgHTVf6GzDw9FRRByuQ6YrP5lHQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIT1prVStXZnBTajNYeFNh\nL1BMNWxuM2RYRENPQ2JKVWJjZ0w2M1RodkRFCmFWU2hmbDBNZ0tOM0tGRlZaMkpL\nY3JtNnl0NXVsNnJUZThidXRuMlhNRTQKLS0tIHZMaUVZa0RBRHJoaSt4dDNyUGk5\nQ2hIUXJKTkFpR0szb1BWRi9FZ2MvK2cKzSfNN4PPx/AeyavqTMrpIOxQrdOi1Pt5\nrXrMYf1flYJ0xy0qjiBOSQlTlbq98A9sdB6OvfHFIMZU5Gq6jrnieQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-02-11T02:53:32Z",
-		"mac": "ENC[AES256_GCM,data:0jinh78IsYiqCEAjxk2gE9KP1vMmWT7XCgODdwT0tpQwlJ3T3aym2QCuC2fSFSpjqFrLBeclMOMH1Yz6dU873ZeRYX3uVovTYzOBJCYip/8PIUslum8Rafq7P/R0am1gZ6fwGkuY7kjIwaSxNc38mwx4TvIBZKNRdmkdnN9ZmnA=,iv:XpJAlFi/KSDaoZiMS6cc8RSwAw8MhikzAy1VlHFW6ig=,tag:i6ydBPpn/hvY/2AGaVkxZw==,type:str]",
-		"version": "3.11.0"
-	}
-}
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/users/admin
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/machines/server
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/machines/server
@@ -1 +0,0 @@
-../../../../../../sops/machines/server
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/secret
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/secret
@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:n7e3+g4+mB7eB9fs6RShr8Weh/N58vuRTg==,iv:64jgKcVY4kJlL88hZujnN0w4Bd3BAvnx7qcL7jviaIs=,tag:qE0pNorMKPsQnguqSciiGQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzRXFnb3RMV0srYUUzSkg5\nQUo5cWl3RlRoYnRWV0N0VzU3aE9MUUlHdUgwCjRha0VwY2ljSk43b0UyUWtic2g4\nRFhWbmhBOWRpc2pDRlVMRnhObXJCMjgKLS0tIE1jM0hBeWd4eTNKanV6V2ZOUW0w\nNVFnMzNpR01tSU5HUHY1cW1SOWk3NUUK9PT0IV210rjorKWcdfP324IPojJqdFfn\nGAL2mbI96jat2nyqkg1uRfighvVzGlGJWkLpToAUpqJTWu5tRbMrXg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhUWVub0ZzMW8vWVJmK0pC\nUHMyNjFXZkhPV3BrUElwd1dFUzBRVFBhSUU0Cjh4NUV4L3F3RjYrclk3d0RWS1hv\nTEdlZUY5ZFYyQ2VkOG5xNUc2SFphU3cKLS0tIFc2MG9IVFJWbHBYWnJEMkJTZnZL\nMms2eUk2Nm03aURJYWJGclNJMk8wZUUKFz49E5sp23YLlewDHbjApgRxS2BZjBTk\nk4SVJYvvIoZiPdRTNzZ6HYZGD7p036WhYg43lduqUrq8AtCnEHPdbw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-02-11T02:53:34Z",
-		"mac": "ENC[AES256_GCM,data:0XlREuaKL02o1KlUm5K/xM9cFZP1APpO9152Bl3328Pm/a/j4XoAu70keSUjE26UG5TLcxAkT7m5bOW5Clo/zxzPORAMMv9NTho4gwkfOABwymcR0giNFjpZ10a3PBHgxMm5AaXR0mfehFE+NV32oKfe2htpOSKin5kFe+0kmLQ=,iv:qXE5c8hRLM2lALo5JbDA9YoCDjc4A0OxmWkXocUDHBs=,tag:AXZjnULGKuIMdDkywa3PqA==,type:str]",
-		"version": "3.11.0"
-	}
-}
--- a/modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/users/admin
+++ b/modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/modules/clan/stirling-pdf/default.nix
+++ b/modules/clan/stirling-pdf/default.nix
@@ -14,12 +14,6 @@
        ...
      }:
      {
-        nixpkgs.overlays = [
-          (final: prev: {
-            libreoffice = prev.libreoffice-fresh;
-          })
-        ];
-
        services.stirling-pdf = {
          enable = lib.mkDefault true;
          environment = {
--- a/vars/per-machine/b4l/grafana/secret_key/groups/admins
+++ b/vars/per-machine/b4l/grafana/secret_key/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/grafana/secret_key/machines/b4l
+++ b/vars/per-machine/b4l/grafana/secret_key/machines/b4l
@@ -1 +0,0 @@
-../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/grafana/secret_key/secret
+++ b/vars/per-machine/b4l/grafana/secret_key/secret
@@ -1,46 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:+Z2zooOo5dcjqd4TrwJdMMG2A1YCEFsrWgibckgTE1tlKh1mdoiSO9LZaCZA0zBp8IS1y2rYktDyILXqW87bua8=,iv:nTWSILxJuY1TNXF4LYJLF7Dk1oU0H/rZQxEv//cmb+A=,tag:zb/3si6B6yBs/8o0FMoR2w==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArdVhSbVhZVWM0aXp3ckVE\nbyt2VVVNdlYwdHFFUEpoNUIvNHhWUGJIeTFRCjJzQWk0dWZ6dWtFVnlCVXlrcjhE\nV09rb2hpdm5CSVkxRWlaYlBCL2ZFdGsKLS0tIGVKWmptd00vRjZNYkdnOE9YRi8r\nRHdqZVg2eTkrSThpYTZycnN0WWZNbXcKnZeo1c0Q/RUujSWkNxoebdZ9g7GATs1a\nutlDVtl14WLHa1x3KGBtaOFkSDjTxbwrwfIfNiqzl1RfSWtJgNDKRQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGTVFGSFNGVHdLVUt1d2h6\naU9pTmsyN2NvYzRsNlpTWHdKMTY0WUhHTnlrCnlKVEMwR2FuUXZuRUJKVmFTU2tB\nNHlkQ3dteGlQMFQwVmRaQVNyNkhoNm8KLS0tIGtjN1NoVDA2NDRhUnFieXUwTGdI\nM01VNG54b1NLMFZQcEFCbFh0cnIvK1kKyQKN0w9InSNKCb2hKRuBfpJnftekrA8f\nns7WD3T7vBFE1/BNuZpMN1AUQnY9KArlh7cPMmhQqbc5ckFPdWdvDg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNrelpDYlFq\nVDRHTlFIMDllTStJYTkzOWhxb2pOSXRXcXhSYk1WVndTR2sgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp1T0MrZzl0Y05nd3VETEtRdlFlQkdw\nSWY2WTJtcWgrVnBkRmhvQm52Z2ZzCi0tLSBtZUs4K3NiRUVtRGVHTnNpdE5kNWFr\nbzN4eVpQUHE4S2xCamdoT3RoWXBzChpsTQBKDrBlMHlDXzQtWXLt1+J75XNyB577\n9DtesuqFgKmmSKnJTtXlinNQ/ya92yR9gsvS9raFMCI1dA8Xdz0=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9PZDNsMzd2\nNXZLK1dnVEZLSjNRZWJWZkQwR1YydElMdHc2NjVGSjZ3QU0gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp0VThFb1dZWlFMV200SjlNRE1LZ1p4\nSFZTWXhQeGVuMms0ZExDRm5UOUMwCi0tLSBNNmIrNktHWWZ4dENzV2srT0pzYmMx\nSjJDVFA3UERyQW1ackVvMGkzVDhrCvF9pQwBP/WNFrTlo0mSzHCutOr1IowsgX36\nSUANao2WlTD//PEhy5ETCySkCYmvwTGksRKgLK94gOmIwxQ7354=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDB0b2JNcWJ5\nbDN6SWtaSitUM1VoYnBQeEM1VHN3N1d4c2VYR2pBSUJQRDQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3MTJhc0hIbTYxNllDOWdOWEZlU1lj\nakZzUVEvSEcyTTlFVHlNdVdob3RVCi0tLSBpYTBoWGVadWZkZ20wV1k3WUtETDl2\nRHExOUIvQllpbFpPMXhqUEV2eUNVCvt62eEaEg7UEbOAmMgpRqZUzkgXyz7Dmiqb\nbcyXCdnqlkR34TVL4uRWVoc669cNS/VwIckD0DoWK7TtTm2og+U=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKK25ZaVlUMDNmTnpUUlV4\nVTlnWWtKYk9McGNzdkxRRFFGNFJRbVJRSDJJCnptUnNUQ2JUbTYzN0lnaGpKd3dP\nRkxaUFdadjdCbS9TNm9ncWRxbHVMQncKLS0tIFNVU3BrRmgwTWs2dXFucVZtdlNR\nV2szK1RvOVh1NzVtNExEenRlVVNHSW8KYBi+/zyNkqeFgwOSkj5nFixq3Ut2qAur\n1KRFOF1yVCSDRpgT3WBplNXsQzyuLabL17OOkQdyaN9rbeHHxKrOKA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2b2l4d2tSNUpZS0d5bTN0\nSEFoWnJWcUFDR25WMHdROUI2dFlNVERGS0RjCkdMYnhrVXdPckhuUnNpQzJpS3JM\nQnRPc3kzRGVzOXA3MlJLRFhzY3krcjAKLS0tIFBkUGZ2V243Nm9jVVc5d0s4ZmVs\nM3NUekowRXhON0dPK0JDN0F4bkh4NXMK6KTm4rNpIbaL/Wy/sLkY90bvO27GGm23\n4lh5WAiUr0j9862JRawwiSjNhEJgoMI7Xj1FeUvb6oz/fZSSMHXoTw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQNHBoTnpzVVBiK0ZmL0dh\nS09uYktsN3lrd3l5VWI3MVVJYzZWRnNCSDA0Cjk4QlJnc3JjNUlQd2M4eCtZTlU3\nVzE2bGppcFhucmpGK1NqSTh6Yzd2NEEKLS0tIERVR1RzRkt1bWxhaDB4VFhWMW9j\nT0s1Qy9vOVkyM1hKTlFrVUw5dWFUZUkKh54GTMetxomX6mI9nsCaTlddQLwDf2lm\nMMJa6u9CFmiETF8+Qf67wvyGB1hI4et3O+0WD1ZeoTpySs2H4pVChg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZGZBUlFEU0ZPU3dWbkhG\na1F3YmdPbHU2a29sUldGSnRFVE9ZV2x3b2k4Cm1WNWYvQ3V0amdLUUZPYmk0Q2hl\nR09OUWlHR3J0L2lZRWVqM3FjanQvNGsKLS0tIExTeXBNQnllYmt2QWVQTnc5QnVl\nREs1TGxZbGJCM3lSTHNkMzdCWjV5VUkKFSBmmPVkqKz5PBzWl8FZJevp8Qvr1Oth\n6ci0yPZfuUGYlOZRZ17nit57bHl/lRA2MBD5Hkis4MwJPhBQ0gdSBQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-03-06T05:07:04Z",
-		"mac": "ENC[AES256_GCM,data:1ZE6/suAHcizEsOOI9e0Qykc+A7iq+lNSULVCtaLBHU+ayZA979rDO+gnuAJQk6EsCwGGgoVyNES89dTdIDa6985BP6Pb9xtuhsKdbdUi2mBqVWteh6KPBMWpFDAhwCmGAyjZkmAS9o7fYzETwJF7iVLV6SQwY2d71un4LXSais=,iv:QkzDYxTtEKGa1EdPc8PbwoScVUX+iGMcpsIvN0GKLTw=,tag:EtFKxdG8YJDWpMw90Fm0gg==,type:str]",
-		"version": "3.12.1"
-	}
-}
--- a/vars/per-machine/b4l/grafana/secret_key/users/kurogeek
+++ b/vars/per-machine/b4l/grafana/secret_key/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/syncthing/api/groups/admins
+++ b/vars/per-machine/rana/syncthing/api/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/syncthing/api/machines/rana
+++ b/vars/per-machine/rana/syncthing/api/machines/rana
@@ -1 +0,0 @@
-../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/syncthing/api/secret
+++ b/vars/per-machine/rana/syncthing/api/secret
@@ -1,50 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:SC9JkTHdDWHRX8nRJdcvNeiss3IMmXe1ZKd7FOxESgn4,iv:gJvGU7wjxVPSP1E4Yj9EcrblYv5Th7LHurm1xuwjh8I=,tag:sdD1PSULUNlIXvkaX89QwA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpT05QVVJDVUhGMERhcDJO\nK08zY1FXdVYwaVJ2SWNoNVZXZ3dxMExyTkhJCkx2eG41UUJBZzNPdU9Eb2pDTzRO\nY2c5c01mTVFBMHNVTTFDSU4zOE1KVVUKLS0tIDFvN3ZHUzBBblZhbmxFRm5TUVVy\nZUJqenlMY1NLNmtnMTF3b1EzZWVjUnMKo0LhgslgQ6pcF6ROkSjpcRorFydZTHni\n8aKdSg/GRaXVVWeldGl0T4HgEi208FAwi9FHKDnDaJ6A/a/Ky5Ru8Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5c2ZKc2h0NGVacVlLMUNI\nNVRrbkdnVDJYT3pZZ0NjaDM1MVRCZmVOTkRJCmw0VUNMVGsycXBpYnROVFdvSjFw\nN3JLY21sWS9qSUIydCs4ZEdRem03Y00KLS0tIE9zdHpmd3J6Q0dRT0wzU1lueUtF\nSi9pS0JwcFhEdmJydDVQdXJCNExwQ1kK91pLe47F4Zdh5WUbaV0EQi0ShoBILsLR\nBEaAQ8x7XQVVTVM4pILPq/YNvVme1bPZii5ihTSzuTLw/rSB6mrZPg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJNjY2T1NEOW1IYkxBNlBo\nVXhVbUROeWZFN0psMWRVMmRzbjNScmxSTmxjCkNITFJaaWZnQVlhWHpnUDFHbWxI\nVEJxYS9LUGVYd290T0Z4VDUxVEcrcmsKLS0tIE9SZUFXRmhFMml5UDZYNHFWR3dI\na25XdFNyaUpjUGQ5U1NtMFIyR3J0SG8KRwXnxgbHxBc654nzqJ3h/h5zhsNqs6q0\nLATw4XBWTYoMuXDmn6BBsCMaLXEVTkoII1wKtm+aiD4QgQKkvsJ5Dw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDhRM0E4UWl3\nOWhmYXBSeUxSQ1h4czBoNnI3dEpBb1ZLNTEwWXdQQVJCMk0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpKcld3NkFBblFRSklQOHlNMVV5clgr\nSHFkYzdJYXBKaEErTzdzNGh5U0djCi0tLSBzUTJBdXI5UGxiTkQ1TjR6a3N2VUl3\nUW1PclZrYUQwOHRab1gwNnlYcGxvCiwY8dpJPb84OGZZQ+HqhVAd12LTe+6EEg8X\nPnFeURaOa2POpZTA1zviCAlT354bYJ3GFdmebPaQx6/X3evyHCw=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEcveDJxbDJ6\nVjQ3VndUWHVkaldxUVoxbWtOa2o4SHNTQWlrWXJ2L2k3QkkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpXWDJiZWVXMzVzY1RQblNUeGJsdVdo\nZlcxR1E0eUlLVzRZcFFLdkdHTGQwCi0tLSAvbTVCcGoyLzEyQnNHYXcyQ1dMWnJB\nODQzYmpJa3g0ZzczSklZVGd3ZXdvCr23MbTQrT/LyUzFc5UmpvHEVO/gj2F3PSyK\n+bIZ5FEzX5H9jY2SVSPpE45VNr5AaE9jiiMXE7IvsBzceTjYB/8=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5QTEs0aGpv\nVksvbGVpQmRGeGRvaG40Qk4zQTZjSEI2dHNSWVh3RFB1QjQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpJa0NQaksxUDJ3a01XTlZFTWJVREVw\nMjJyTGZrMTNxQzg5Sk5pM2Z4SURBCi0tLSA4ejd4T05ZOE1HM2FJay95WU5YTVU0\nSWtuelEza1Z0QXdKM3R2M0EvYW8wCk1oCR+XSBLCWsMj/ao4K/QMAhHex1WJZGzJ\nnRh6RLsDBBHn5Pv1ma9tX146kimjx0PxL2ni2LOKFhq+HduAQkI=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIc05wekRudk1pVHJweHAv\nZDhRak9TSlZRQTBzUlNUWEJiQnFBd25ZWWprCk9iUW8xd2F2YkJiUERFK0R6ZkU0\ndUduZmUwaEl5cWI0c3ZwWDhKc1paUk0KLS0tIDJuTzIyMHFaT3c0QU04V2xBdS9F\nV0p3OVZpRml6VFNUU2dXTlZvTjJielUKltSZUIws87YMuE3GAONVOO7oStGRbhq5\nyyBFquiv/3i8NatjsW/9mLraN+f8sYiy2W4QkDBqVx7kkBksIv+v5Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwY0UrNDI2UGV4K3UyRHRQ\nOTdWWlhQRjluVCt3cmxzY2VhOHU0enBKclhFCitkdHNoZUxLYXBwK09QTlV0VUNF\nWHRzY0RoZGQwc1J5SEZkM1duZXdoSUkKLS0tIDNQVVFHQmlaWjZ6NnhwdENhNHBY\ncmJhUDB4YlVvTEc4L3ZYV2tsbkVJU3MKiQcvZxhRM1vKP46kNGVz2WTvkQWaHZC+\nzjc3vp1b860VfuNvN4TGwqknbti5H8x4f/AAKSs4foPWzlIXIXYoew==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5eTNvREV1MjhDV0Jkd0Qr\nR25OdUhjTG5TNWk2QzNiVEhsd3ZDL010L3hRCjdZM1BDWFdkUEFvSDJvRzBhQVJk\nd2hZL3BYaE9IalhzQkJvTG5OTjdzR2MKLS0tIHUzZ2hWNVNVckVxTXFYdFJTZnlF\nM0VaSmJNdGRBbk1DZWJ6Z2I0YkpMZkUKFOnbmjzSKIF2mtdMun+hIu4ZlttbdGV1\nkEtYOjaWztwpgNqSiM2Wr+KTnFcggQma0SGomml+iTM2pLAVjOTKMA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4ZHlUQms1WXg2eUxsZEtP\nRnBILzhFS1hYMzVSaDhZR1l5L3JwNjFRcTJnCmFJWG9GVGNPTnFucmJyZDJtZDRW\nSStjM3FpN2xYSUxZMmwzUzJZOGNjeXcKLS0tIEp6R2JGd0svazJqdnAzYkJZTEdY\nWnBVVW1xa0JOdXBOS3MxTDE5L3RBcTgKF3JEpxHnhBebGasr/psF74yqIezUW58A\nzGWG50ZZKxhbUmC2cRcI4m5TxrS+P3iUjryFrfvlTMYKjX0OlXDsIQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-03-06T05:07:06Z",
-		"mac": "ENC[AES256_GCM,data:IXaMQxNTLzFEMu5ULH4rLUMH0cc0BMpg7MHRwkm8o2gZI6J7eL5bY+tTXW0Xi7oVdn8SmsqcV7xI0XeuGB9BsVC32RwPeVl0eXYhNN+Pcr/McpYKnlJ7XN39JVjD60qh2aGPG7JYCTrWJkO91437znNiG0PVZxkUV9m91HUUkM0=,iv:37jOajFc9dIJkfKrRuZoJinPt0rEDWtq8xeliMAHj9c=,tag:XRDT5gAYWCGrETLde+eNQQ==,type:str]",
-		"version": "3.12.1"
-	}
-}
--- a/vars/per-machine/rana/syncthing/api/users/kurogeek
+++ b/vars/per-machine/rana/syncthing/api/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/syncthing/cert/groups/admins
+++ b/vars/per-machine/rana/syncthing/cert/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/syncthing/cert/machines/rana
+++ b/vars/per-machine/rana/syncthing/cert/machines/rana
@@ -1 +0,0 @@
-../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/syncthing/cert/secret
+++ b/vars/per-machine/rana/syncthing/cert/secret
@@ -1,50 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:wBueyyue2UeC6dySjuYVp2Vb7w94D4HCASrT3Ewgen/BMMAt0YwqkaJifi7hgvC+bfhAvaH6/5TFt7UK8nmmilkGookQpo04BIQzao9Cpwl9+6rPRWBbJFwWIqruKCZfHLL6qxzpWGnXgbA+Y/bVPDVwrlMzahR5HDMyytLwCaei1IX5UA+b8Vkp6hBvf3tvtKpl8lmEsoDHIozm79nTPEZnMHe9+MQplADrSBrQnO1ROu/5ISO0AygSvcAJrfHHDPdZeE5GgT0+LswaMxO5IUbdRGS3iLLatMBtPXQBYkWKTUyaM2WnmcIg+s6PmDL5hco04rexbcPpt7nVFscGfTVd2o0STx6cIb56V7mUi72h9C0B/3tvjTqb27CwiuB6Ca3bDf9JMJDjqV7u544rl97iL4zKfRQlMbg8FD1EoJQ8ikGhuQt5xMTBkmW9zvQatA48n1B5nL+jHCo/FuH1Bs6+EzKOs+GGTA24keuxOzYMMvDnSLdzngGmcxaVxEx98MCdGsaZ6145LOHISJLFI9jX9bajWiuHtsmg2Zbiq3wvaRIrgIohegdhxGoxaj5WZOuRAOTBpSH08fmB8gEVF7/rCxlYN0bMmWhVSqZYXan7Aoi+BwpJ8joKYoYcvsBH+88FidEE1lpUPtApa8uNiKxRICUiO5EmDQPpr7aJybU795tKi9NsVQ7MPYd2ifJuzjzy8k8i/5fIK2GwkRrGgQJb49TomGQFIeuRq4n2PZiMJJfXp0CHSSGVJEO+eBAmhbwvPvYeYd1dCtRbaJD2+iujRcb6FfdhnmJzgNl00CnSPM32gzYlIGCh6assItk=,iv:kQ/klAv5XgccjW+e7NwYSYUdK61n4WGp92cM1bejYxs=,tag:aAZrExB5wj+u7s7QWdtLdg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhSTdnMVVlNXRYSmxXUzFP\nM0tvMk1KY2ZTanRJam1UQUJGRHhUYkU3WVJnCk9jbE1EL1pqMU9IeHNVWjQxeUs3\nSDlSbTN6M3ZlTmZnUEx6eUxiY3FjMTQKLS0tIE1tZFhLOXFuVm1kdmtobGFUbW8z\nMWtkYmN2cDdhai9Yd2FheGVtaDlXUE0KCBU4eAgw6g0z3aXASmENJrLpQuOEgZ8t\n59BIOnV9MCv+ETnTtlEYvMOCc7sV3Wf316dixp78EjTJ1h+ZPWcLmg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmV1VGVnhpNzNQUHBTa1la\nR1FKbE5MY1lXTlJPVmswWDVVYzFiS3VBV1ZBCmg0NUJ1QVBkWDRBY2RoNEdRaldG\nUDFXeGNodUFwNXpsajNxeUdvaURQRlkKLS0tIEI2NU1wMVlyak92QktJK1g5NHlR\nRG5zYm90UFM0aDMzSVJBOUp0NkJKVVEKsKvv1hwIrkQdGNXeakimaXJYxP+P+iji\nPI/zsLtIO//q8GdhTpVSqsVcTJt3dABZd8J5YJv/45qtIduvl2P0HQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TlFlaXNnTEJYOFk3NmRq\nU2FRdzJWNkIwMnIrVFdTTTFPU2VFNXdlV1ZNCkdKcmZhU3NjMTJETnIyZ21vbjNs\nSHBiTzV6VmlnRnoxWk9kZWRoQmJrcTgKLS0tIFZxUDg2VW41eWpFUU5zaTFOSEZv\nWG1GaE1VK3NBNnJOcGp1bjVBT3lRWFEKfj8neQQpf9VqU2VGkZ3vslR8P6VovlyM\nqaIZw9TlM4gHifO+1f4gwKHxwx9O8pEINLSRR94LAWBBR6y6fjdeUA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG44K29DTkNt\ncXJtREQrRUpzVmFTUzZ4ZExVTG15VDNtVWJEa3BSdGxLa2MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo0NkJ3QVloUDVEeTZxNUIvelRwMDdC\nTE5DaUhVU1BWRktmWWFYZ3FFVE1ZCi0tLSBRY3BpZzZXNWFEQUZlbU8xeGpRcXNO\nelFCZFRXdDhEemJVNzk4YnN3dWZjCrxtewKoIlWOi+/EAo0vtFUJd77A/hDUhdf2\nJosQ5Wk2A8SG96gTNzW00dxg1xBsbnFmNhsr/ycne1sBJ9WedKE=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGVEY3p2Y1NE\nWVVtWlByVFpZcUZLT2s5cDlUeFZrenYvNlRIWnZKam5zbUEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp5OTh0elNyYm4vdkNLZEx5YnlzdHFM\nOTNqNW5TVWNIUGk5TEZpZXJwR2pnCi0tLSBDaDdtMnQ0RUZlczE2elJ4ajArcWxm\nZVplSklESWIrOXpWV1JBbldiRWRzCnen/ofzBDTorllI5d1+qeBUfVJhxa1YyP7J\nNVk/hxzm0fZKpcHWvJSbeGxK7c23YRqKatIU8x/60hhwa5PptJ0=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEozYkUyd05r\nVG9kYkh4MVZIaTlINldQeFJqUUl4Nk9pU2RWajV1VGt1MzAgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwozRytuNkxtUHNJM0hkTVJ3Q2M0ZWlU\nYy9uakphMmphUlV3bU5nZmFmaHBnCi0tLSA4b2lyeUV1c2tpV2haSC9vL3J1blk0\ncjIrTXU5TTR0Um9lZmY0QzZOd0dRCkZkSLThuOj9lEomvMkZiynkfZ66KpIvjGOA\n9sjTCAWAq45p5YPN/qcJjGlingNVP62uieG+HpyQrOvkwCBGI6E=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjM21uOHRXWXA3c05BUmZS\na0hQNklsT085TG0vNll4T2VHL0hIUjlQTlhrCmI5OGVSamRnckMrSWN4bDdKMkti\nSkZ4VjB5cWlXbEVuMllQbXlBWW1VUEEKLS0tIGxJYVp4eGlHVXV5QysvcHFuWTBQ\nQ0ZWOEpzTnZnaDc2ZWJFVHBDTUd5WlkKfo1WFZhTFpwQqH7l4URdhIbohfaEC8DQ\nX4Jz6qowiMjsZ+8Y4QDqBJ0Ff2JnGbfImthhViqgsyO//DuXFaLPbA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjRlBrTDJkRlY4Ukg2ZmNn\na2x5TFUrZWRXUm9FTEYrc2JVQ1BLOUpna0EwCjVFbHFVeVc4OC9zR1BNQlYzWk1S\nSTZMREExUkxCTklqZ0N3aUJXN29WeWMKLS0tIDgvQVQrMWFFWEFoQStNWXpUenhk\nK2hvVHp5NHk3aW91NVY1cHRvT1dOVVkKnnf58gvxpoxuCuYW5F4uQ8QGf7i06P4m\ngtUYpQaBVBXwG9mYw3bivPMuTLPKbEPWmgL8AFlJTWFeZwydFNWnDQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEK29Kb21WYjVLMjdpUDFM\nbVc3MjNFWDlBZm15d3NweGtjSjRPQjFhSFUwCnF5ZUdDdjRYUTdadHpKNUJEVGp3\nUDhaZmQrWjhyaStmWUYrRm9qVE9HcFEKLS0tIE9aRnhwcGJSdTMvU0pscUJNR25I\nT016M2didS8zY0E1eHE3SWNCV1FLQUEKTyrYAUHw6mLbaG3nq975NqtVpCj8wdTF\n8M21Rw0sGydYQEBpESZwQx0/UpRUNcpRTLfBLVlZ/XS9MlpTM7KmBA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPS3ltaGxIby92ek5UREN1\nendnYW5BM00vZ0IzMUlhWW53UVJIMUpkRjFZCjVJaVRodTdjRDAwcTkyL2JyNVlD\nYklXN3FINEI3cDV6eTFyQ0VtMWVCMm8KLS0tIHVwaElHZE10U29Nbi9EYUU3aDhz\nL2w1bEtzQ0crOEk5dFNtTnlxME5qRWMKUQnTqCK+wI5BJoa5921Xo4Ud9+8QXGxV\nnEGqTED+9fI2dmokZXnnGHfYYYNRZAQGoQRvD0IrfJccabFJmxmo4A==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-03-06T05:07:07Z",
-		"mac": "ENC[AES256_GCM,data:CVybnAh0IIzBDHMmXTlve/5viX+3usqJO98YZ1VpR8K/PAZUpRBDBeXe4l+yNlLiG5lC9a83oqFU0aRdhDmmZ8QClrOXZ2j3+q94ZgbyM4GEWTy14fzuHVRMR5Lp3T0Di4GPh0CWiZ/o7F1fRzNmdYe42bcR/MTJX1xA463DuVQ=,iv:HlmpbV+IHvXa0Xp8a4tYQQVMW2nVVVDrUjaB7YOaR7g=,tag:iQjEPe1XM1WMONCXGqpsFA==,type:str]",
-		"version": "3.12.1"
-	}
-}
--- a/vars/per-machine/rana/syncthing/cert/users/kurogeek
+++ b/vars/per-machine/rana/syncthing/cert/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/syncthing/id/value
+++ b/vars/per-machine/rana/syncthing/id/value
@@ -1 +0,0 @@
-ZPPEFYG-VKXCXPS-NY7RRRC-6XF7FWN-MZNW2CY-RKNSNE2-IU6MS4R-S5BXWAV
--- a/vars/per-machine/rana/syncthing/key/groups/admins
+++ b/vars/per-machine/rana/syncthing/key/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/syncthing/key/machines/rana
+++ b/vars/per-machine/rana/syncthing/key/machines/rana
@@ -1 +0,0 @@
-../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/syncthing/key/secret
+++ b/vars/per-machine/rana/syncthing/key/secret
@@ -1,50 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:k8BzFg60hR5LIcWNdqXCB63J/BxBqTY1trEwj9juCF5Gg4Ag6mmPeHnQWYvVeOHEfSnx/OK4UC6rwssu7Lx9R/19+0qVwJKeg2y/4cYhT4uXgPGZa+XabdLHSASSiPqUWHQPGEdLSk4sk3N3fl2t0TYLR8GWI5Y=,iv:CdiOCZIyGpmPGqQ+EbJGeNDe/kVOOlk3E+D/OiFc4aU=,tag:6vBQRPLaY5ZpLz5FEehdQw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5TnJDWmpjaktraFcvOUI4\nc2k1NHhGTDJQUWpHYnJjNm8yTlZMSitjNkZzCjlqV0x1bEw4ZXJ5c2owS25ZK3d3\nb3ZqamtBVVg1d096clNvZTM1dFRPWDAKLS0tIEMwNFRaWkZ1NGhVYldFc2thTXNh\nZVpLUERGcmVXbXFnY3N2eWtGd1p2c0UKGuvDXwRRCPDL2ZV7BTWR2Jo2X+Sh3y6Z\neLaCbrtQV+sO/ZyfJYFuRoiviKWD+Hb1wAJcnWz5JGUZjUYfIVLJMw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxNitsUkpOZTNYZDUyYnZm\nYjhTWWtURytDdEtvQXJEUWRWa2MxKzRrMkYwCjlCSzA1c0N6Y1pIMmsyNnRaZnVv\nRFVvb29DVERrcmNuRWxVdUV0YnVJWmsKLS0tIHJ1VVhscGlaY3NyUlhEYVRraVNs\nNStvbmRCVTRudFhrbG9jRHBUKzRWY0EK4O94mhpQfqjdUwopmI/zMMIGepdPvLvE\nDa9XoKzHh9a7ce0tl78i91hmzDTSBbnFSrhOXRYfMLFQhmxr+cGavw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiWjJCZFpiSllPQWtmbnVw\nSnBjTkd3SmtSbU1qTjdXdFdnaWVYQVZVdUdjCnRCOHZic2dPWFpPSmRtVmNSU3BV\nSnB0QjBoUlRjQjcxQ3lpTE1RRWV5eTQKLS0tIHZwY3UzakV3VFhFcXpWSVZoN203\nRGdsRUFEcFRZd0poQkY5UGFpOG1yaUEK8Z4PWPfhENZ+UMrO/KDHhvzavurgZxNE\nl31yz7sMrdhcKbU1/Y36Ywe4mRVU9KM83Kw3Qx1WDRGdYEW7I9g8Ig==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZldGNscFpk\nZ0ZtdGNLbldDSlRhbjRHMUpKSnJRZ2dQMktDZFNjRVI1Mm8gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp0dEttMlY3OWE5UWpmd3puQkNhV1NY\nWmRYMUQvaVZBQnI1b1M5MnZPWWZBCi0tLSA0SXpSV2lObkxsNER0VEpGdHdTQmZU\nTlEvYm1CZXBuRlFQR2VGZjdPVG1jChCXJHWiQm74Ndp6F2RjKH1gzGVkYcx/Cd/C\nozLE5Ro5CyJvN0PwEPl4CTp06B+u9wYrkw53JIZhQtuPIXgFvrA=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGtISDYxKzBX\nY0ZqRGhJZCtXRmRLWmxBQmd6RmlZK3MzY0s1Qkp4OUwrV2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpjemJJZHluWnl2cVdmM0RPYnZtSXgr\ncTVMUHhScmJJQ2dBNzVLYzJKTk0wCi0tLSBTZGN3VWthQ2NIYUFLa3NPK05aY3Np\nRk9DbzNXMTA5WDlXTWttaFZVTFJRCla1lJoWBsEpam9aq4jgf1S5oyNxboAiQyxF\ncCyHz3ht4qHW9UdrEgQxaZ/0Qj6hAahiyCFJYFB4c4JRtz/IaWk=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFBpNzdON0VR\nVkFjemMzK1A2ZjZFZXYzaytnOFEvc0hNUXozNS9VVEZDMDggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwplb1dxTERYOWZhSlhpRk16MUxKT21L\nM2NCVjNjdlVBb3ZIWjlWMlVoYlJVCi0tLSBzM1B1aVptMnpxdWhvS05sMElpMjU2\nekRuOHNTRmVydXA2Q2V6R3dTY2MwCgvfLxotpHVy/lNd1VZFAg7azgt4iyY6rhEb\nmhYPB/3034bzWIiZSExnrtegMNv/zc3FtqtTSb2BISQk4Hhgu2Y=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2SWFOekhwMGVGczBRRC9P\nME1IWFUrOTdWUENSZVVJVHlEb1JJNVJxL1NJClpBK3ZkM0I4UnlPOW9xa3ZRUXJl\nYTczWG5JNGxOa1FnYUFhYWZFMTRUcVkKLS0tIDVacUVtNVRybkRzWHEvUDRMNEJO\nN1ZRSjNPNDVndk9rb1gvUThTWXdtckEKAMaOSRSYRrDk7dDJLZuua/SU5BelKoei\nKMrFHnGflVxu4exa2W+A8YGRnTy8qttsByPvqiND8QRDpjJApI4tjg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqckEydjFrYXE5ZDhOQzdn\nOFUxWVdhTXFsK3NDSnhsNi9uN29HUVlkMFY0CnZoY1NCTytlZ1RzQ1cwQ05VQ2g1\nY3ZMZUh6WjhiSy92Zkx5UWRtdFZRbjAKLS0tIDlVWEUyWjBEQ0lhSEdUZWcxU3hy\nYUx2anhoNTRwWFlNQUJMMVp3OGtHZU0KgwUDNZjya9so8gq9nvra5B6N0+pWl0gG\nruOiX/SzjINi2+HGxEQzO2ti99O9Su6VDL471453r+s2gAChIHtQpA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAreW8rTmRrTTZ2d0diZk1T\nNVFJcGQwb25ESUk4Q0V6Z1JyNnI3Qm8vZXpnCktud2xUYkliY2xxR0JmVDY0MW9N\naTJHaVR3TjFndWdmTnhwQjFSZ2hET3cKLS0tIE5ENUxUOTVjOEdZSGZHenJSNTZx\nWVVLQ3M0OEZ4VHduZmx3d292WjRXMlUKfeeQ7ZlDSIGFFN0vkXPn23An8QG+clL1\nTihhPe6uGt8O3Y4o7kwQZXHShcUIJrwd/mvoGCXPzErc1D/46OpdsA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxc3QxekgyTlZVMjdTbGxu\nU2ZNVjBzQm5NbC9wYmpNRjZVQVQ3b0tTZzBzCnhLSi9Gc3RBVmxBTFV2UVZPS2w2\ndTV2UnpPV3NYa1RIRjJJa2pFcXBDblEKLS0tIGY2aFowK05ySHk2Z3dWcnJsdTRG\nb1FQMEc0ZVdneU0wMFJpczBoVGxWTkEKKMLoIPyTzP0yrSFgNVHnOWRp8aKRRuSM\nVOnH4QGNHwhhRQWR7cYlxF91Dwt+tDsvOjLvogG9wPvPYUGu108kug==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-03-06T05:07:08Z",
-		"mac": "ENC[AES256_GCM,data:gvB8LPXjuw8EumbAcRZxD5/hwZR0Sb141ccMKCtkjgoX3TZpa2JZVKuFQRJ/dAFfmembbheqjSv7u27TVMzh7NH0vKnEZ96r6WzMjo7IKmN5H0CYQkN11xfGlSMAxSA/cY14WA9z2BJ0I5bXGlbYpeXSbyDZ4DZOuTTz4Kdr2Gw=,iv:bcq3KjHBKbcGoAi/THiTOJyo9JvcdFzmveVxPyPdNa8=,tag:VoDfvnf7ArTGFp0mCvFySQ==,type:str]",
-		"version": "3.12.1"
-	}
-}
--- a/vars/per-machine/rana/syncthing/key/users/kurogeek
+++ b/vars/per-machine/rana/syncthing/key/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/sirius/w-smb-password/password/groups/admins
+++ b/vars/per-machine/sirius/w-smb-password/password/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/sirius/w-smb-password/password/machines/sirius
+++ b/vars/per-machine/sirius/w-smb-password/password/machines/sirius
@@ -1 +0,0 @@
-../../../../../../sops/machines/sirius
--- a/vars/per-machine/sirius/w-smb-password/password/secret
+++ b/vars/per-machine/sirius/w-smb-password/password/secret
@@ -1,50 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:yLAriT7uR/f+cH+9YmAtEPxd06nS,iv:jBGuP1T0HolOjuiFRcv66ANEimn0xUrP4jfhz+8skAM=,tag:eSpLwlKjzgHZqd1qdCJ5zg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQ1VRcWxmcDlBOEdUbWtL\ndk0wU0VJamk1enRWaEFDUDVhNXMxRGR3QzB3CmNscmYzbXBJRzN2UXBxWk5Oajhs\nTWdZU0J5ayttMEdUWDl1enFkR2NhcUkKLS0tIHV1UE00YVlvckdVN1EzUGVaZERw\naXF6Qm9wZnJDeUxURlJmMHFKbFNGbXMKsQh7ixgiiUbZrpeVPLoRhyUtU3vThrZg\nN/fxoEBxZsa48kW0FA9oPCVA5zKY90WjgqPeTNfUh1hsm6WdZb9kCQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age16aerzyy7adcymezr4ewql3y7chq8wuvjpzsxm5um0u9jvvtdncnqmtsw05",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtVVk2Z2UzRTkrai9DM3Av\nYi9sbHVsd2dBbnBDVC9hanNwWjBwYisvVzA0CmNBcXNhWWhrRmlxUVhXS294eEFI\nZmczNjJyM2tvOEtzNFBXQ1BpWk1tVE0KLS0tIHNNT3ZvbVpIRDJwVmxOemo1aXhq\nYjRTbE5XY0Q3bUErUmIvUnRkZFVUY1EKsxcXC840I6avsAlEolerQI5Vl295rDvb\n3hfFzanIpgDeE7ylN4ycd7RD0kpFvb9qQZPdVmRUCeIti4XzTOlfFA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmWXpKcHl3N3pzK3RubE8y\nWm5OODBXZ0tzT3gxamUwS1BibHZPMDJxU1dzClB6RkhpbzZxWmtFMnhrQjdzMEgy\nNVJzOWs3a1ZXeW12OUp3SHZDaTNDZ2MKLS0tIDdTNWFNWHNVNFdEdWZxbkU0MHBm\nRXVERlhmait3U0l5ZldydzgwRHJ5TGsKXEl9ojSeZgpb0Oy2h0f3ZhnvFuC2QpjI\nrPhaKOVIoQqBeSHN2oz8WGaEyVMFy0GdPk0xulyE7u0Mvx0+knV/Nw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEFlN1hBd0N4\nMkp3NXVvcWxsZ1lrNG53cUdJbU53OXIxdXpoV0R3STJxamsgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpKSWNhVUpoeFBrK1A0YjNGYTJkY1Np\nVXlkWTEvcXlPMEJVeXZrQUJMd0ZJCi0tLSBaaFlLeVJJVnRUN3BPQlNsQkthNWlw\nbWNkZGhKYXdKZ2lVVUt2bEtyS2xFCioUTdxV4LH16zlUyBZmtMvLDujTJievIpW/\noLZlqOKbhOZkSHJ5OKZAXkXmsFQoXuHyyjyc9O+a9ZQNdGLY83A=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGR1RnBXdGN6\nY1RjblkvaS94ZHdmMzR0S1EwTGNOMzVEZVlTWDVWb0xFeWsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpBVGpsaHc5czBuWnJvaUwvamFCTjU1\nT3Q5V0h4ODRuQ1lLSW8rQnF4ckdBCi0tLSBxbmFIUmx5SXZuRnRPTk85aFNJUU5i\nM2x2SVNDTTFHUXc0VnNWMHduZFhVCq5lzyrHhHFcS6fGSmNwHqVCvkDJGEFSitYq\nKiXza2W0H2y/Zg1CniRCDgB5mhP6BJOTLPSqmYAVj/Dxg1bQvno=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHVWZzFZOVVE\nUGUzMUpBSHJQOWVQRTI3SnQ4Ri9kTHNhaytOeWN4YUwxWGsgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpScWZOa0IveGFWQ0x5RDl4Q3R5ZFNq\nNEtxSTEvY1h1NlJITG5XRnl1YUJZCi0tLSBmVm9HeXZTMmhCaWgvVFZ3YTFHS0h5\nOHppUlh2K0ZzeVR1Rkg2eTlCTTdVCn8cLPK6JXIvLOSUeeLzWmG2GtbtIL09awO3\n1cR1p4tEzAl5C0zlyEgXOxlHxOPiGnCL5V0H5ePuWo21Va/xw+A=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjYnNGV0d6QkJWcS94T21E\nYTZaK2RYbFRVUVc4cjN1NVJQZFlWclVYZm1rCmd4d3UvQnhuOHlJN3JnRjVTalRB\nVlR2VXVHMS9rV0o0TEQrNEg2VkYzdXMKLS0tIHlhS0FFODNJUFl6dWovdWEveTJ5\nTE15SFVld2RzcEl4VlZZSDVqbXRmMG8KjyV+Csx9EPNB19fbY0tRMYmxSXE7ykBU\nJZVcEJN0KQbmgQXNqVq3pE0rYmNavZ9ovpo6yFmlLp8g/WYfGjlI1g==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibThZeld4MUN3WW5YVUM2\naTRvc085RFlrTTJhMzlBNENYYS9pemxaL1YwCkhLL00xUFBqZ0oreWh1Mk03REtm\nS3Q0clBYeGpOQVBiSVZGcnFWMUYyOHMKLS0tIGlYVnZOSkFpVUNaYWhSd1NnMkFQ\nK2hYUDE0VlZLQzh5eDRZb0ZSR1RLL0EKJ1h1uVkGtaDVOpR55W6cSsBz3cf1iyyU\nQq18HTweW8dIfwVdq+7I2V3ZqLWPd/83Syu1Wk08jj8rppEN9sbJaQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZGZTVWVXTkFITmtDZjAy\nUW9QRVlFakVlNlZkakUybW8yZml6SmNBeURNCnpCL0EyTmZ2VjhXcStqQnEra3p5\neHRqc0VCMEZXemZISk4zUFE0SFY5R2cKLS0tIGExWHp3ckRDUTVFd1NGYm9PcXZK\nL3QyWUZoRUhKZWdXZ3lrczAxNnpUencKALhwRnzEpux0jaCzTljo+uGZfuV5wQ8o\nLUa/TzULbhUsh1a09BwNrGSZWQ8hXN8jFHiGRomQK+mDToildolOaA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUeTUzSmx5ZWVnY0VOd3Z0\nbXdoUFBSeTlpeG9CV3JVNEIxdVZrNjZqcTNRCnlGdjk0NzEzeHBSeVl5TENROU5k\nRWl0cDB2RS9GbHpLTC9iM1RNRWZNcUEKLS0tIFVDb1pVS2VMZWROYVdXOGZ2dWEr\nUmpPczZXdVAzMDl3dnVIL3ZYdkduVjAK7ytoCdWcNe2sUzucPuP1gSnhWFVRPpA2\nyiIOBumjQrricLHOv1FFxmLgxx/reaVlK80oS0EzDyFp2N6DDZT3dg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-02-13T04:14:29Z",
-		"mac": "ENC[AES256_GCM,data:tCipieSazQgKulsci8czftQINVUYQV5bIGHkeV9xPwePQ05KpKG8PHJmPtB/VjG87wWqiQNlZOagt9WjPH8IYMHIWO74zyGk9N5Tw0Kb8SzR+NOFUTt7r5zMN2eOMbjPokZIyDx//Uk49f0LdJXKrBfMYO+gKJf0JFbw8R0ThUU=,iv:m9Tj14GJxeF3FtDlaWgpT8vc8CFMf09kkuGgrl9LeY8=,tag:+cX7/pDcGRSHvBTRqTffJQ==,type:str]",
-		"version": "3.11.0"
-	}
-}
--- a/vars/per-machine/sirius/w-smb-password/password/users/kurogeek
+++ b/vars/per-machine/sirius/w-smb-password/password/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/sirius/yggdrasil/address/value
+++ b/vars/per-machine/sirius/yggdrasil/address/value
@@ -1 +0,0 @@
-201:e111:117e:7b21:f37d:a929:51dd:e8a2
--- a/vars/per-machine/sirius/yggdrasil/privateKey/groups/admins
+++ b/vars/per-machine/sirius/yggdrasil/privateKey/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/sirius/yggdrasil/privateKey/machines/sirius
+++ b/vars/per-machine/sirius/yggdrasil/privateKey/machines/sirius
@@ -1 +0,0 @@
-../../../../../../sops/machines/sirius
--- a/vars/per-machine/sirius/yggdrasil/privateKey/secret
+++ b/vars/per-machine/sirius/yggdrasil/privateKey/secret
@@ -1,50 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:jr9a0x73ipdhKv7GKCdrNqe00VFDh9LLcDha7notVjh8KIDfKhzsNSw+rNTCnpRN8BeXxkeuHaaaf1S8ywoiwL1FI/tJiurc0Do54pDjNV7wWjbAaQQ4f51395o/TMlyH4qFaRirpx0xQZlf0ZyMgezZzxumaR8=,iv:z4v0g6v5SfoB/vdt9q8Ii9eTiZBwUSC8fgGWMT6rl80=,tag:UNZw54WTA0YFkqfuXZ9tNA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArODRXRnBHaHQ1dU04aDhI\nUm1vd2wydFRxUTA1SnFlUXRZdFpudURKR2swCmFBMitraUJDUmcrbnNDeHAzZ0ln\nbzZKVzBjR011dlhRQ25lalZBVldpYjgKLS0tIFcvN1MvUjRJYzh6V0NZYW85Tk5m\nOHNGeTFSODZvVFQ3SWFEZ0pMalhOREUK4rEPS63ViaDfOjPC2jYb90WMU+ZvWhKp\ncxXxmM+HozvLtj1j9xM0LT9abAanPKHmRU8QkcCgBkzSMestsGJb9w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age16aerzyy7adcymezr4ewql3y7chq8wuvjpzsxm5um0u9jvvtdncnqmtsw05",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKVzBINHJJajVxVWNMY3lV\nTk9wSHZOdDhuVnhNcmYxYTQ2dXMyZEhhRG00CmQzTExoMDBEVm1IK25aZ0NiV291\nNkNVNHlIZSs0N2VOTHN6cmQwRjAzdncKLS0tIE1tRkVMZ1VWNHI2b3kvUnhPRk1o\nMERqMXZTRlJTcXNUeU94TGVadUQ5akUKDD6MaUdEBcQxnh9NKtTUBe50ikb4FLL/\niuWjNYaIEyUp3TR+m0L4HQB6iDLEpWxoqycU7nMMJdVi6knvuRLAEQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYL28ydWwrSzdzRlhrTyt6\naWpxOU95Ym8zWFMyMjZvTWtwOWtTd3dSZkZVCkNOYzU1ejF3bHY1THZSUkFqN0VZ\nQ1lPdTUvWFRvYmkvU1pFTFNXMi9HTjAKLS0tIHpXVHNBZjBzcWZCbjZ1a2ZZVWZR\nakZ3djBwL1NMaHd5MTdpMExDWHl6TEEKrclVI2SRuwTi3hdVrgiMac1jRT1D+qjV\nHWF4o/pP5c8hHM7xQQu5M+yKJLKzZhwQAxf0pF4wV7f21bkVD+7eCw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEtQZ3kyNm5s\ndEZPUi8yYjJQUlQ0RkRjckc1Ry8yTlRjYUdGVWtZQ3Q5R0kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQorY0JucTVhRnJQd2o3Z0ZVckMwdjJQ\ndVltcmNXR2Vlc09IakI4Sld5QWs0Ci0tLSBFRTUwQm9ZdlFKOEYzVVlkc2JnQUZp\nVmhxMGlTOGM2TlBVdER0by9TSm9JChCdHdKyNk/1LvIkMv/gQUCQOVUX62ESUVl3\n8kYwECMi2aLWUJ4WNDqfcfDKqKNeN/5zxtbhf5BUCNac9U7z3Hw=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEtDbnBpTWVU\nbVhFckJ5OFh5Y1BJSGhYQ0lrSjZzMDNvLzY5UW9RaDUzRGsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwplMWRteXlTcURmNVE1WTZ4V0xwSlFR\ncTliSWNpS1JLeWJXd1BRRk1RRGNVCi0tLSA2M1VHUUlpNTd2WVlUZG5Iai9pWFVo\nak93dVN6QXVVaWd6NkVSTlF4aEo4CncLgOXO7UixjTzV8E/nY0RRAm43C2eqSry3\nq7E+tmiRSAxEfm3YytwqFn5j0s6Cf0nowsnYMXT9i36j23VeXyU=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFVPTTNuMHZ6\nMzNid1Q5Qk1QYTFtRktuUUowYmlmNkl4Z0YrWFpvRjJPeFkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpON2JzU3dwOGRXNUgzNnlIK1JzQnBu\nd1ZZc2ZJS3JIRVNPQ2F5OVRwNFVJCi0tLSBBUEhoUHBRUDlrNDZLNEVLQk5LWERH\nZWlVZnJMakJuZ1lOaytucDhuUlZjCvsQfDI84809RS8295VtmzYXIb77gzbURL9I\n3gptOBg7AqGSqPuAkTXDbpNsNHHQoTAZAN1l/7cMKSmkPW4bihY=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArcEdZMHBPWWhBMUhuUW1L\nN0Fza2o2U1RKa3RrbS9SMGM2MmtFU2JGblhzClA4SFVKWHVsQkxseVpxTEFYZ24z\nZ1ltS3VEZnF0K0oySFRManpQUjQvNmsKLS0tIGpIUVBXb25MVXFhU0FUUkYwRVZQ\nZFpvR2s2bHcvZXFtam1QVGVZS3ZTSUUKGWvAdjvS6le5xKSw8iqakUjGlbskkwN1\nEuG5J5wRRkzbYphXKon+UkXfvsN6FX/TzRKfW1h6ooFrM+nFI1ba4Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjb1AwSTlzSFNVL3NhRU8x\nUmVJSCtHKy9KSzladFlpTHdRTWJHNS9TYlVBCmY1RjdYK0xXeHZCZlZKRnpQc3A5\ndVN2KzVEWkthRGZnTUlRYTRua0RsQTgKLS0tIEk4aUxQMzBYTk9DSzhKTFpWdmxD\nczdibXhRNjIrRDBOREsrckJxL3EyQk0K3vH9VstuafaXw+8P0DVYXUWHm3GMhGPs\nVygIKxq6kKue9s+WMZ7VieDI4sCmS2y88B5tBD7ND0Nj5uqIM17NYQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAydGluLys5cFREWVRiL0lr\nU216SGYxT202NkM3ZWt0UW54UUNINEd5VlZrClhwd0pEMXVOSnJTc3ptTzVPOWdS\nSU9VOUZMUUNZWGxMZDlLcldKdk5EVDgKLS0tIFNLalMwVzJUU0tDWkIzWGNDWWpE\nVldlM1NTMkd4alVwNTJzRWc5N0dzVG8KgsBGsNge4VtfkzmbZZM4REInYcPoV5Sd\n9CNDschMQ41GvWbZtVCP89dBSLm4XQ3KfxtA9JpFKXgLlSfpUWCTqg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2akJ3RUVqMEJGTE9ZZUdT\nTFArRlczNDF1S2kwMDlLVldHaVBHUm1FcGlNClRBa2Nrd0dQakpEWFg2djZNM2Nz\nbVNESGEyUDY0TWpRRzZROHBPREpjOXcKLS0tIElMamwrYXpQL2crem50eXB3b0xr\nek4xcW92UVZ4U1hydzdsbW42LzU0NTgKzz7zJvGF7t8ZRSSQlgqY+ryG3Pwunx2H\nt8qI44K9EWpDdbZ1+ykccI1kmI+1H2N8Msk+JnVW24KO27+lTmlcKQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-02-13T07:40:20Z",
-		"mac": "ENC[AES256_GCM,data:9CsWU70jzx8QstqfCW1z6biOUREYpohGTC2mj+VwSgDIRr18HBh6jWelgKWjNNm1gf0gFZQk+cW18/D+PvgplqIExxr6t45D6vlCwfu5J7CcGlzMtnrBCN6p5Pj7soo0jk/TQDXX6bfp5wkJUY/EZ1I4ZSqm2UeLU63Q1JUp2qc=,iv:+etudEqbxmoYhxntjdbbW818kO+iEG9a1UOSkqv4khk=,tag:fgmX40j9/uVK3Z0lkX1jAw==,type:str]",
-		"version": "3.11.0"
-	}
-}
--- a/vars/per-machine/sirius/yggdrasil/privateKey/users/kurogeek
+++ b/vars/per-machine/sirius/yggdrasil/privateKey/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/sirius/yggdrasil/publicKey/value
+++ b/vars/per-machine/sirius/yggdrasil/publicKey/value
@@ -1,3 +0,0 @@
-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAR7u7oGE3gyCVtauIhddE0qcq+d3+0MzGGXGtTW2Kr70=
-----END PUBLIC KEY-----
Author	SHA1	Message	Date
kurogeek	bfc9416c81	mob next [ci-skip] [ci skip] [skip ci] lastFile:flake.lock	2026-02-03 18:03:04 +07:00
kurogeek	c1efa8b91e	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/rigel/configuration.nix	2026-02-03 17:43:46 +07:00
				`@@ -1 +0,0 @@`
				`ZPPEFYG-VKXCXPS-NY7RRRC-6XF7FWN-MZNW2CY-RKNSNE2-IU6MS4R-S5BXWAV`