mob next [ci-skip] [ci skip] [skip ci]

lastFile:modules/nixos/inventree/default.nix
Update vars via generator inventree for machine rigel
2025-10-10 11:30:04 +07:00 · 2025-10-10 11:29:57 +07:00 · 2025-10-10 10:00:24 +07:00 · 2025-10-09 17:23:24 +07:00 · 2025-10-09 17:22:20 +07:00 · 2025-10-09 17:20:13 +07:00
86 changed files with 1515 additions and 957 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-run-vm-*
+
--- a/flake.lock
+++ b/flake.lock
@@ -136,24 +136,6 @@
        "type": "github"
      }
    },
-    "liminix": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1760426231,
-        "narHash": "sha256-r8c5PKtsxAvtQ/k17GH+WNvP47Lr+AbExLMPdLtvAKE=",
-        "ref": "refs/heads/fix-gl-ar750",
-        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
-        "revCount": 1574,
-        "type": "git",
-        "url": "https://git.b4l.co.th/newedge/liminix"
-      },
-      "original": {
-        "ref": "refs/heads/fix-gl-ar750",
-        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
-        "type": "git",
-        "url": "https://git.b4l.co.th/newedge/liminix"
-      }
-    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -225,7 +207,6 @@
        "devshell": "devshell",
        "flake-parts": "flake-parts",
        "import-tree": "import-tree",
-        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
        "treefmt-nix": "treefmt-nix"
      }
--- a/flake.nix
+++ b/flake.nix
@@ -21,10 +21,6 @@
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    liminix = {
-      url = "git+https://git.b4l.co.th/newedge/liminix?ref=refs/heads/fix-gl-ar750&rev=3f1f7c08d440130cce9262a93ce78ed7969d93cd";
-      flake = false;
-    };
  };
  outputs =
    {
@@ -41,8 +37,9 @@
          ./fmt.nix
          ./shell.nix

+          ./overlays
+          ./modules/nixos
          ./machines
-          ./routers
          ./inventories
          ./modules/clan/flake-module.nix
        ];
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -5,10 +5,6 @@
      tags = {
        glom = [ "vega" ];
        b4l = [ "rigel" ];
-        fax-bridge = [
-          "neptune"
-          "rigel"
-        ];
      };

      instances = {
@@ -52,21 +48,6 @@
          roles.peer.tags.b4l = { };
        };

-        yggdrasil = {
-          module = {
-            name = "yggdrasil";
-            input = "self";
-          };
-          roles.default.tags."fax-bridge" = { };
-        };
-
-        asterisk = {
-          module = {
-            name = "asterisk";
-            input = "self";
-          };
-        };
-
        pocket-id = {
          module = {
            name = "pocket-id";
--- a/machines/default.nix
+++ b/machines/default.nix
@@ -1,4 +1,8 @@
-{ inputs, self, ... }:
+{
+  inputs,
+  self,
+  ...
+}:
 {
  imports = [
    inputs.clan-core.flakeModules.default
--- a/machines/neptune/configuration.nix
+++ b/machines/neptune/configuration.nix
@@ -1,22 +0,0 @@
-{ inputs, config, ... }:
-{
-  imports = [
-    # (inputs.import-tree ./services)
-  ];
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  boot.loader.grub.devices = [ "/dev/disk/by-id/FIXME" ];
-  fileSystems = {
-    "/".device = "/dev/FIXME";
-  };
-  networking.fqdn = "b4l.co.th";
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  security.acme.defaults.email = "admin@b4l.co.th";
-  security.acme.acceptTerms = true;
-  services.nginx.virtualHosts."${config.networking.fqdn}" = {
-    enableACME = true;
-  };
-}
--- a/machines/rigel/configuration.nix
+++ b/machines/rigel/configuration.nix
@@ -1,16 +1,62 @@
-{ config, ... }:
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}:
 {
  imports = [
    (import ../../lib/auto-accept-zerotier-members.nix {
      memberIds = [
        "dbe44c0287" # Alex-gateway
-        "b0e0b84fd3" # Alex
        "2bd36db8cc" # kurogeek-thinkpad
      ];
    })
-    ./networking.nix
+
+    inputs.self.nixosModules.inventree
  ];

+  nixpkgs.overlays = [
+    inputs.self.overlays.default
+  ];
+
+  clan.core.vars.generators.inventree = {
+    files = {
+      secret-key = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+      oidc-key = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+      admin-password = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+    };
+    runtimeInputs = [ pkgs.pwgen ];
+    script = ''
+      pwgen -s 32 1 > $out/secret-key
+      pwgen -s 32 1 > $out/oidc-key
+      pwgen -s 32 1 > $out/admin-password
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  services.inventree = {
+    enable = true;
+    hostName = "rigel.local";
+    config.site_url = "http://${config.services.inventree.hostName}";
+    secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
+    config.oidc_private_key_file = config.clan.core.vars.generators.inventree.files.oidc-key.path;
+    config.adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
+  };
+
  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
--- a/machines/rigel/networking.nix
+++ b/machines/rigel/networking.nix
@@ -1,85 +0,0 @@
-{ lib, config, ... }:
-let
-  ata-interface = "enp2s0";
-
-  ipv6Subnet = lib.elemAt (lib.splitString "/" config.clan.core.vars.generators.yggdrasil.files.yggdrasil-subnet.value) 0;
-  ipv6Prefix = lib.elemAt (lib.splitString "/" config.clan.core.vars.generators.yggdrasil.files.yggdrasil-subnet.value) 1;
-in
-{
-  # clan.core.vars.generators.networking.files.ata-interface.secret = false;
-
-  networking.interfaces = {
-    ${ata-interface} = {
-      useDHCP = false;
-      ipv4.addresses = [
-        {
-          address = "192.168.254.1";
-          prefixLength = 24;
-        }
-      ];
-      ipv6.addresses = [
-        {
-          address = ipv6Subnet + "1";
-          prefixLength = lib.toInt ipv6Prefix;
-        }
-      ];
-      ipv6.routes = [
-        {
-          address = "200::";
-          prefixLength = 7;
-          # via = "${ipv6Subnet}1";
-        }
-      ];
-    };
-  };
-
-  services.dnsmasq = {
-    enable = true;
-
-    settings = {
-      bind-interfaces = true;
-      server = [
-        "1.1.1.1"
-        "8.8.8.8"
-      ];
-      # enable-ra = true;
-      domain-needed = true;
-      domain = "localhost";
-      dhcp-range = [
-        "192.168.254.10,192.168.254.240,255.255.255.0,24h"
-        "${ipv6Subnet}10,${ipv6Subnet}240,slaac"
-      ];
-      dhcp-option = [
-        "3,192.168.254.1"
-        "6,8.8.8.8,8.8.4.4"
-        "option6:information-refresh-time,3600"
-      ];
-      interface = [ ata-interface ];
-    };
-  };
-
-  services.nginx = {
-    enable = true;
-    virtualHosts = {
-      "_" = {
-        locations."/" = {
-          proxyPass = "http://192.168.254.96";
-        };
-      };
-    };
-  };
-
-  boot.kernel.sysctl = {
-    "net.ipv6.conf.all.forwarding" = true;
-  };
-
-  networking.firewall.allowedUDPPorts = [
-    53
-    67
-  ];
-  networking.firewall.allowedTCPPorts = [
-    53
-    80
-    443
-  ];
-}
--- a/machines/vega/configuration.nix
+++ b/machines/vega/configuration.nix
@@ -10,7 +10,6 @@
    (import ../../lib/auto-accept-zerotier-members.nix {
      memberIds = [
        "dbe44c0287" # Alex-gateway
-        "b0e0b84fd3" # Alex
        "2bd36db8cc" # kurogeek-thinkpad
      ];
    })
--- a/modules/clan/asterisk/default.nix
+++ b/modules/clan/asterisk/default.nix
@@ -1,69 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "asterisk";
-  manifest.description = "Asterisk PBX server";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-    perInstance.nixosModule =
-      {
-        lib,
-        ...
-      }:
-      {
-        services.asterisk = {
-          enable = lib.mkDefault true;
-          confFiles = {
-            # Dial plan config
-            "extensions.conf" = ''
-              exten => 1001,1,Dial(PJSIP/user1,20)
-              exten => 1002,1,Dial(PJSIP/user2,20)
-
-              exten => 100,1,Answer()
-              same  =>     n,Wait(1)
-              same  =>     n,Playback(hello-world)
-              same  =>     n,Hangup()
-            '';
-
-            "pjsip.conf" = ''
-              [transport-udp]
-              type=transport
-              protocol=udp
-              bind=0.0.0.0,[::]
-
-              [endpoint_internal](!)
-              type=endpoint
-              context=from-internal
-              disallow=all
-              allow=ulaw
-
-              [auth_userpass](!)
-              type=auth
-              auth_type=userpass
-
-              [aor_dynamic](!)
-              type=aor
-              max_contacts=1
-
-              [user1](endpoint_internal)
-              auth=user1
-              aors=user1
-              [user1](auth_userpass)
-              password=user1
-              username=user1
-              [user1](aor_dynamic)
-
-              [user2](endpoint_internal)
-              auth=user2
-              aors=user2
-              [user2](auth_userpass)
-              password=user2
-              username=user2
-              [user2](aor_dynamic)
-            '';
-          };
-        };
-      };
-  };
-}
--- a/modules/clan/asterisk/flake-module.nix
+++ b/modules/clan/asterisk/flake-module.nix
@@ -1,18 +0,0 @@
-{ lib, ... }:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    asterisk = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.asterisk = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/asterisk" = module;
-      };
-    };
-}
--- a/modules/clan/asterisk/tests/vm/default.nix
+++ b/modules/clan/asterisk/tests/vm/default.nix
@@ -1,39 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  name = "service-asterisk";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        asterisk-test = {
-          module.name = "@clan/asterisk";
-          module.input = "self";
-          roles.default.machines."server".settings = { };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      services.asterisk = {
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("asterisk")
-
-    # Check that garage is running
-    server.succeed("systemctl status asterisk")
-
-  '';
-}
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -1,53 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "yggdrasil";
-  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-    perInstance.nixosModule =
-      {
-        lib,
-        config,
-        pkgs,
-        ...
-      }:
-      {
-        clan.core.vars.generators.yggdrasil = {
-          files = {
-            yggdrasil-secret = {
-              secret = true;
-            };
-            yggdrasil-ip = {
-              secret = false;
-            };
-            yggdrasil-subnet.secret = false;
-          };
-          runtimeInputs = with pkgs; [
-            yggdrasil
-            jq
-          ];
-          script = ''
-            yggdrasil -genconf -json | jq {PrivateKey} > $out/yggdrasil-secret
-            cat $out/yggdrasil-secret | yggdrasil -useconf -address | tr -d "\n" > $out/yggdrasil-ip
-            yggdrasil -useconffile $out/yggdrasil-secret -subnet | tr -d "\n" > $out/yggdrasil-subnet
-          '';
-        };
-
-        services.yggdrasil = {
-          enable = lib.mkDefault true;
-          configFile = config.clan.core.vars.generators.yggdrasil.files.yggdrasil-secret.path;
-          settings = {
-            Peers = [
-              # US Peers
-              "tls://ygg.jjolly.dev:3443"
-              "tls://[2602:fc24:18:7a42::1]:993"
-              "tcp://leo.node.3dt.net:9002"
-              "tcp://ygg-kcmo.incognet.io:8883"
-            ];
-          };
-        };
-      };
-  };
-}
--- a/modules/clan/yggdrasil/flake-module.nix
+++ b/modules/clan/yggdrasil/flake-module.nix
@@ -1,23 +0,0 @@
-{
-  lib,
-  inputs,
-  self,
-  ...
-}:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    yggdrasil = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      # clan.nixosTests.yggdrasil = {
-      #   imports = [ ./tests/vm/default.nix ];
-      #
-      #   clan.modules."@clan/yggdrasil" = module;
-      # };
-    };
-}
--- a/modules/clan/yggdrasil/tests/vm/default.nix
+++ b/modules/clan/yggdrasil/tests/vm/default.nix
@@ -1,37 +0,0 @@
-{
-  ...
-}:
-{
-  name = "service-yggdrasil";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        yggdrasil-test = {
-          module.name = "@clan/yggdrasil";
-          module.input = "self";
-          roles.default.machines."server".settings = { };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      services.yggdrasil = {
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("yggdrasil")
-
-    # Check that garage is running
-    server.succeed("systemctl status yggdrasil")
-  '';
-}
--- a/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
-    "type": "age"
-  }
-]
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:pGMobS67sLp2GN2Xw7A/trcLYnQdVZCUbjtlwS/AShXxyXgHXzkqRee6R765GZyCpDwM8A1IuMZYctrqWxVXrpIAiJpwvwy7vDM=,iv:ysRf5xAXN+dFSx+sFHNDt1GcVQx7RLej4c12v60iSI0=,tag:yXYpWhWLdsz9BOOoKpZU4g==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UmhPdzcrSnFhVUxRNDBL\ncXlGRzdMdWxCWmFlUkE4RnJRQ3psMlBqV0Q0CkRjTXFoQitQbjRhMlVjaDc3UDN1\nR1hBeXlCeWxvdnZoVWI1ZkcweHF5VncKLS0tIHE4YVFhYTZTNko1MnJINjFPYXh4\ndlJJZThGZ0JIaDJWRTNXbXk3alNZTnMKgd+0535zoTu6xW2778uNReu4Z7LStN6d\n1O9SXAB+s1iOZ3xGEICiQTVF/6p8RE6lheV2oXgoMiXXrFNH6INLsw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-17T05:34:34Z",
-		"mac": "ENC[AES256_GCM,data:YIpKJlOI6ASgOYqv9ipu+T3c+PlM5HwvdFVH8gh8hVeSbmxD1baPPmVSWlLv+u61Q1/C9PK4mczaASopaGiLoswep+Hc1Gn7sSeP9wO6Djx6fEIEyE1VUhUbTqi/nHYiB21yB/wegfpqzNYIn1nO0oFCmDmSS5qIowcT1fhYIjM=,iv:lzxll5oC7poLvC/hZPexUGAcAdf67xZGRXUpj6O3p6Y=,tag:9xu17Y5MtW5XNzGBsWwA3g==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
@@ -1 +0,0 @@
-../../../users/admin
--- a/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
@@ -1 +0,0 @@
-204:5ce7:aa27:579b:ec90:6907:4ddc:177
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
@@ -1 +0,0 @@
-../../../../../../sops/machines/server
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:I6yalWQ2u5hI84lJTUmh07JxUBp4EZukJrSGSN7wsGiUGlFa1v/RT1XkTiXuRjDtUVYCLmQmfSCAp/OqFscxF8KL+s24iTDrG4e3S6AeKLa3oZrNJIt1EJ06gWrPNoh1ttmwXSd4Y4Bsk4Lg8vIjH4qw3Bx+KrufxYTqe+anfMdoXKnW8wOWud5O7HMvCh+sf4dNcf6PIQ==,iv:SF5qExXNPyif+LIcNhHP0PKELUBXaFsPj9B3wvUkEp0=,tag:QEkZXDrIdcpNiZ6l2ljOPw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENDhrWVRuYjRnZktROU4v\nSHNtODFGMWl0NDRHazIwcWl0WGtNY2dYMXhnCmZQQ0doS3BTaU5hRHVsVTB5THl1\nWUNDQUNiMVJFeFZnQ1ptYmFQdTJQc28KLS0tIEtJdUQ5Y1VqSThkSVVNcVNVNEFr\nMzBCRjM1L1V5TngrZG5rR0VHY3Z6TDAKPQ6P96upDeh8xwQDrX4Zcf71Dah5zkOJ\n/F5eODEBadzQSRmJuyp3+uRMFf47eR6Q5bVah3NsVxFquXOL3CtNlw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHb0EwT2tuMVE5SE5XaWdQ\ncGR0bFFhOUQvM2dGUzdlUEFFbzRnTHBWWUVnCjFGTXcrWW1vR0x5dXBUamtkS0dF\neG9weUVwQzhhNHhPRUdqV1VnWXJyNFEKLS0tIC80b1ZqRGFOenpENDN1Vk5vRUhY\nVnJzZ1Q5VzZ6ZEZtZE13YjQ0VVhrTTAK5y0BjKBRg2AXuO416JWLMLyM/pCQChKn\nVKZMXcT6cc5hHDuqbp9qUofknF68XnzlH6nOyLB1ZtnELyeZuf29fw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-17T05:34:35Z",
-		"mac": "ENC[AES256_GCM,data:Y3k83RaeX64LA3rsIkQxyKw+LLUgXVsqr3F2UHkv9h73gkyChc6k1oE/FLR4CsZZWsfLNjCkPMuenqToA2mKqQK0aADwPDYo0aVm0hr1PGX5j3Py6EmP56NFvxlAQsExRWo32eqdkeCkY23hfcmUYlaB+bo/fsrRVj67zag9GYA=,iv:p18i8cV6jKXpuZ1Xd7KYCl8BMe1/8CW9YnCuVrTAqy0=,tag:IJnLzdZOn8Clu+lCKT6zvA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -0,0 +1,5 @@
+{
+  flake.nixosModules = {
+    inventree = import ../nixos/inventree;
+  };
+}
--- a/modules/nixos/inventree/default.nix
+++ b/modules/nixos/inventree/default.nix
@@ -0,0 +1,386 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    ;
+
+  configFormat = pkgs.formats.json { };
+  cfg = config.services.inventree;
+  pkg = cfg.package;
+  configFile = "${cfg.dataDir}/config.json";
+
+  inventree-invoke = pkgs.writeShellApplication {
+    name = "inventree-invoke";
+    text = ''
+      export INVENTREE_CONFIG_FILE=${configFile}
+      export INVENTREE_SECRET_KEY_FILE=${cfg.secretKeyFile}
+      export PYTHONPATH=${pkg.pythonPath}
+
+      exec -a "$0" ${pkgs.python3Packages.invoke}/bin/invoke -r ${cfg.package}/opt/inventree "$@"
+    '';
+  };
+in
+{
+  options.services.inventree = {
+    enable = mkEnableOption "InvenTree parts manager";
+
+    package = lib.mkOption {
+      type = types.package;
+      default = pkgs.inventree;
+      description = ''
+        InvenTree package to use
+      '';
+    };
+
+    hostName = mkOption {
+      type = types.str;
+      description = "FQDN for the InvenTree instance.";
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/inventree";
+      example = "/var/lib/inventree";
+      description = ''
+        The default path for all inventree data.
+      '';
+    };
+
+    secretKeyFile = mkOption {
+      type = types.path;
+      default = "${cfg.dataDir}/secret_key.txt";
+      description = ''
+        Path to a file containing the secret key
+      '';
+    };
+
+    config = mkOption {
+      type = types.submodule ({
+        freeformType = configFormat.type;
+        options = {
+          adminUser = mkOption {
+            type = types.str;
+            default = "admin";
+          };
+          adminPasswordFile = mkOption {
+            type = types.path;
+            description = "Path to password file for user `admin`";
+          };
+          site_url = mkOption {
+            type = types.str;
+            default = "https://${cfg.hostName}";
+          };
+          static_root = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/static";
+            description = ''
+              Static file storage
+            '';
+          };
+          media_root = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/media_root";
+            description = "Media root directory";
+          };
+          backup_dir = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/backups";
+            description = "Backup directory";
+          };
+          oidc_private_key_file = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/oidc.key";
+          };
+        };
+      });
+      default = { };
+      description = ''
+        Config options, see https://docs.inventree.org/en/stable/start/config/
+        for details
+      '';
+    };
+
+    serverStartTimeout = mkOption {
+      type = types.str;
+      default = "10min";
+      description = ''
+        TimeoutStartSec for the server systemd service.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStartSec=
+        for more details
+      '';
+    };
+
+    serverStopTimeout = mkOption {
+      type = types.str;
+      default = "5min";
+      description = ''
+        TimeoutStopSec for the server systemd service.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStopSec=
+        for more details
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ inventree-invoke ];
+
+    systemd.tmpfiles.rules = (
+      map (dir: "d ${dir} 0755 inventree inventree") [
+        "${cfg.dataDir}"
+        "${cfg.dataDir}/static"
+        "${cfg.dataDir}/media_root"
+        "${cfg.dataDir}/backups"
+      ]
+    );
+
+    services.inventree.config = {
+      plugins_enabled = false;
+      plugin_file = "${cfg.dataDir}/plugins.txt";
+      plugin_dir = "${cfg.dataDir}/plugins";
+      database = {
+        ENGINE = "postgresql";
+        NAME = "inventree";
+        HOST = "/run/postgresql";
+      };
+    };
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "inventree" ];
+      ensureUsers = [
+        {
+          name = "inventree";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    users.users.inventree = {
+      group = "inventree";
+      isSystemUser = true;
+      description = "InvenTree daemon user";
+    };
+
+    users.groups.inventree = { };
+
+    services.nginx.enable = true;
+
+    services.nginx.virtualHosts.${cfg.hostName} = {
+      locations =
+        let
+          unixPath = config.systemd.sockets.inventree-gunicorn.socketConfig.ListenStream;
+        in
+        {
+          "/" = {
+            extraConfig = ''
+              client_max_body_size 100M;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            '';
+            proxyPass = "http://unix:${unixPath}";
+          };
+          "/static/" = {
+            alias = "${cfg.config.static_root}/";
+            extraConfig = ''
+              expires 30d;
+            '';
+          };
+          "/media/" = {
+            alias = "${cfg.config.media_root}/";
+            extraConfig = ''
+              auth_request /auth;
+            '';
+          };
+          "/auth" = {
+            extraConfig = ''
+              internal;
+            '';
+            proxyPass = "http://unix:${unixPath}:/auth/";
+          };
+        };
+    };
+
+    systemd.targets.inventree = {
+      description = "Target for all InvenTree services";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+    };
+
+    systemd.services.inventree-config = {
+      description = "Inventree config generation";
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      before = [
+        "inventree-static.service"
+        "inventree-gunicorn.service"
+        "inventree-qcluster.service"
+      ];
+      serviceConfig = {
+        # User = "root";
+        # Group = "root";
+        User = "inventree";
+        Group = "inventree";
+        Type = "oneshot";
+        RemainAfterExit = true;
+        PrivateTmp = true;
+      };
+      environment = {
+        INVENTREE_CONFIG_FILE = configFile;
+        INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+        INVENTREE_AUTO_UPDATE = "1";
+        INVENTREE_PLUGINS_ENABLED = "1";
+        INVENTREE_PLUGIN_NOINSTALL = "1";
+        INVENTREE_STATIC_ROOT = cfg.config.static_root;
+        INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+        INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+        INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+        INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+        INVENTREE_DB_NAME = cfg.config.database.NAME;
+        INVENTREE_DB_HOST = cfg.config.database.HOST;
+        INVENTREE_DB_USER = "inventree";
+        INVENTREE_ADMIN_USER = cfg.config.adminUser;
+        INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+
+        INVENTREE_SITE_URL = cfg.config.site_url;
+
+        PYTHONPATH = pkg.pythonPath;
+      };
+      script = ''
+        set -euo pipefail
+
+        umask u=rwx,g=,o=
+
+        # chown inventree:inventree ${configFile}
+
+        ${pkg}/opt/inventree/src/backend/InvenTree/manage.py migrate
+      '';
+    };
+
+    systemd.services.inventree-static = {
+      description = "InvenTree static migration";
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      before = [ "inventree-gunicorn.service" ];
+      environment = {
+        INVENTREE_CONFIG_FILE = configFile;
+        INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+        INVENTREE_AUTO_UPDATE = "1";
+        INVENTREE_PLUGINS_ENABLED = "1";
+        INVENTREE_PLUGIN_NOINSTALL = "1";
+        INVENTREE_STATIC_ROOT = cfg.config.static_root;
+        INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+        INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+        INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+        INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+        INVENTREE_DB_NAME = cfg.config.database.NAME;
+        INVENTREE_DB_HOST = cfg.config.database.HOST;
+        INVENTREE_DB_USER = "inventree";
+        INVENTREE_ADMIN_USER = cfg.config.adminUser;
+        INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+        INVENTREE_SITE_URL = cfg.config.site_url;
+
+        PYTHONPATH = pkg.pythonPath;
+      };
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg}/opt/inventree/src/backend/InvenTree/manage.py collectstatic  --no-input
+        '';
+      };
+    };
+
+    systemd.services.inventree-gunicorn = {
+      description = "InvenTree Gunicorn server";
+      requiredBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      #wantedBy = [ "inventree.target" ];
+      environment = {
+        INVENTREE_CONFIG_FILE = configFile;
+        INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+        INVENTREE_AUTO_UPDATE = "1";
+        INVENTREE_PLUGINS_ENABLED = "1";
+        INVENTREE_PLUGIN_NOINSTALL = "1";
+        INVENTREE_STATIC_ROOT = cfg.config.static_root;
+        INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+        INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+        INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+        INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+        INVENTREE_DB_NAME = cfg.config.database.NAME;
+        INVENTREE_DB_HOST = cfg.config.database.HOST;
+        INVENTREE_DB_USER = "inventree";
+        INVENTREE_ADMIN_USER = cfg.config.adminUser;
+        INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+        INVENTREE_SITE_URL = cfg.config.site_url;
+
+        PYTHONPATH = pkg.pythonPath;
+      };
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg.gunicorn}/bin/gunicorn InvenTree.wsgi \
+            --pythonpath ${pkg}/opt/inventree/src/backend/InvenTree
+        '';
+      };
+    };
+
+    systemd.sockets.inventree-gunicorn = {
+      wantedBy = [ "sockets.target" ];
+      partOf = [ "inventree.target" ];
+      socketConfig.ListenStream = "/run/inventree/gunicorn.socket";
+    };
+
+    systemd.services.inventree-qcluster = {
+      description = "InvenTree qcluster server";
+      requiredBy = [ "inventree.target" ];
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      environment = {
+        INVENTREE_CONFIG_FILE = configFile;
+        INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+        INVENTREE_AUTO_UPDATE = "1";
+        INVENTREE_PLUGINS_ENABLED = "0";
+        INVENTREE_PLUGIN_NOINSTALL = "1";
+        INVENTREE_STATIC_ROOT = cfg.config.static_root;
+        INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+        INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+        INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+        INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+        INVENTREE_DB_NAME = cfg.config.database.NAME;
+        INVENTREE_DB_HOST = cfg.config.database.HOST;
+        INVENTREE_DB_USER = "inventree";
+        INVENTREE_ADMIN_USER = cfg.config.adminUser;
+        INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+        INVENTREE_SITE_URL = cfg.config.site_url;
+
+        PYTHONPATH = pkg.pythonPath;
+      };
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg}/opt/inventree/src/backend/InvenTree/manage.py qcluster
+        '';
+      };
+    };
+  };
+}
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -0,0 +1,7 @@
+{ inputs, ... }:
+{
+  flake.overlays = {
+    default = final: prev: import (../pkgs/overlay.nix) inputs final prev;
+  };
+
+}
--- a/pkgs/inventree/default.nix
+++ b/pkgs/inventree/default.nix
@@ -0,0 +1,145 @@
+{
+  stdenvNoCC,
+  python3,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  nodejs,
+}:
+let
+  version = "unstable-2025-05-09";
+
+  src = fetchFromGitHub {
+    owner = "inventree";
+    repo = "InvenTree";
+    rev = "e0acfaa762da0dd7b2822b567202210ca8b7dbd3";
+    hash = "sha256-K+cqErDUmgPO7625P3jp7+7BOYEfyJ1nElae6RlJvvI=";
+  };
+
+  frontend = stdenvNoCC.mkDerivation {
+    name = "inventree-frontend";
+    inherit version src;
+
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${src}/src/frontend/yarn.lock";
+      hash = "sha256-KpWuYCrkGN+4UnwV1STEbTL0FWcLZ7Wq8a8ST55OpGM=";
+    };
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      nodejs
+    ];
+
+    patchPhase = ''
+      runHook prePatch
+      cd src/frontend
+      runHook postPatch
+    '';
+
+    buildPhase = ''
+      echo "Running lingui"
+      ./node_modules/.bin/lingui compile --typescript
+      echo building lib
+      ./node_modules/.bin/tsc --p ./tsconfig.lib.json
+      ./node_modules/.bin/vite --config vite.lib.config.ts build
+      echo "Running tsc"
+      ./node_modules/.bin/tsc
+      echo "Running vite"
+      ./node_modules/.bin/vite build --emptyOutDir --outDir $out
+    '';
+  };
+
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "InvenTree";
+  inherit version src;
+
+  format = "other";
+
+  dependencies = with python3.pkgs; [
+    coreapi
+    cryptography
+    distutils
+    dj-rest-auth
+    django_4
+    django-allauth
+    django-allauth.optional-dependencies.openid
+    django-allauth.optional-dependencies.mfa
+    django-allauth.optional-dependencies.socialaccount
+    django-cleanup
+    django-cors-headers
+    django-dbbackup
+    django-error-report-2
+    django-filter
+    django-flags
+    django-formtools
+    django-ical
+    django-js-asset
+    django-maintenance-mode
+    django-markdownify
+    django-money
+    django-mptt
+    django-redis
+    django-oauth-toolkit
+    django-otp
+    django-q-sentry
+    django-q2
+    django-redis
+    django-sesame
+    django-sql-utils
+    django-structlog
+    django-stdimage
+    django-taggit
+    django-user-sessions
+    django-weasyprint
+    djangorestframework
+    djangorestframework-simplejwt
+    djangorestframework-simplejwt.optional-dependencies.crypto
+    django-xforwardedfor-middleware
+    drf-spectacular
+    dulwich
+    feedparser
+    gunicorn
+    pdf2image
+    pillow
+    pint
+    pip-licenses
+    pypdf
+    python-barcode
+    python-barcode.optional-dependencies.images
+    python-dotenv
+    pyyaml
+    qrcode
+    qrcode.optional-dependencies.pil
+    rapidfuzz
+    sentry-sdk
+    tablib
+    tablib.optional-dependencies.xls
+    tablib.optional-dependencies.xlsx
+    tablib.optional-dependencies.yaml
+    weasyprint
+    whitenoise
+
+    psycopg2
+    fido2
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [ django-slowtests ];
+
+  installPhase = ''
+    mkdir -p $out/opt/inventree
+    cp -r . $out/opt/inventree
+
+    echo "Installing frontend"
+
+    mkdir -p $out/opt/inventree/src/backend/InvenTree/web/static/web
+    cp -r ${frontend}/* $out/opt/inventree/src/backend/InvenTree/web/static/web/
+    cp -r ${frontend}/.* $out/opt/inventree/src/backend/InvenTree/web/static/web/
+  '';
+
+  passthru = {
+    pythonPath = python3.pkgs.makePythonPath dependencies;
+    gunicorn = python3.pkgs.gunicorn;
+    inherit frontend;
+  };
+}
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -0,0 +1,27 @@
+inputs: final: prev: {
+
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (py-final: py-prev: {
+      django-dbbackup = py-final.callPackage ./python/django-dbbackup { };
+      django-error-report-2 = py-final.callPackage ./python/django-error-report-2 { };
+      django-flags = py-final.callPackage ./python/django-flags { };
+      django-ical = py-final.callPackage ./python/django-ical { };
+      django-markdownify = py-final.callPackage ./python/django-markdownify { };
+      django-money = py-final.callPackage ./python/django-money { };
+      django-q-sentry = py-final.callPackage ./python/django-q-sentry { };
+      django-recurrence = py-final.callPackage ./python/django-recurrence { };
+      django-slowtests = py-final.callPackage ./python/django-slowtests { };
+      django-structlog = py-final.callPackage ./python/django-structlog { };
+      django-stdimage = py-final.callPackage ./python/django-stdimage { };
+      django-user-sessions = py-final.callPackage ./python/django-user-sessions { };
+      django-weasyprint = py-final.callPackage ./python/django-weasyprint { };
+      django-xforwardedfor-middleware = py-final.callPackage ./python/django-xforwardedfor-middleware { };
+      pip-licenses = py-final.callPackage ./python/pip-licenses { };
+      py-moneyed = py-final.callPackage ./python/py-moneyed { };
+      pytest-pycodestyle = py-final.callPackage ./python/pytest-codestyle { };
+      sentry-sdk = py-final.callPackage ./python/sentry-sdk { };
+    })
+  ];
+
+  inventree = final.callPackage ./inventree { python3 = final.python312; };
+}
--- a/pkgs/python/django-dbbackup/default.nix
+++ b/pkgs/python/django-dbbackup/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django_4,
+  pytz,
+}:
+
+buildPythonPackage rec {
+  pname = "django-dbbackup";
+  version = "4.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-dbbackup";
+    rev = version;
+    hash = "sha256-GD+f9mbImGPQ6MOUK3ftHqiGv7TT39jNQsFvd0dnnWU=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    django_4
+    pytz
+  ];
+
+  pythonImportsCheck = [ "dbbackup" ];
+
+  meta = {
+    description = "Management commands to help backup and restore your project database and media files";
+    homepage = "https://github.com/jazzband/django-dbbackup";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+    mainProgram = "django-dbbackup";
+  };
+}
--- a/pkgs/python/django-error-report-2/default.nix
+++ b/pkgs/python/django-error-report-2/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-error-report-2";
+  version = "0.4.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "matmair";
+    repo = "django-error-report-2";
+    rev = version;
+    hash = "sha256-ZCaslqgruJxM8345/jSlZGruM+27H9hvwL0wtPkUzc0=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "error_report" ];
+
+  meta = {
+    description = "Log/View Django server errors";
+    homepage = "https://github.com/matmair/django-error-report-2";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-flags/default.nix
+++ b/pkgs/python/django-flags/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-flags";
+  version = "5.0.13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cfpb";
+    repo = "django-flags";
+    rev = version;
+    hash = "sha256-WPMfFYoP6WaVzZmVtqAz4LlY761aCRyPhd5npc8bOOI=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "flags" ];
+
+  meta = {
+    description = "Feature flags for Django projects";
+    homepage = "https://github.com/cfpb/django-flags";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-ical/default.nix
+++ b/pkgs/python/django-ical/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+  django-recurrence,
+  icalendar,
+}:
+
+buildPythonPackage rec {
+  pname = "django-ical";
+  version = "1.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-ical";
+    rev = version;
+    hash = "sha256-DUe0loayGcUS7MTyLn+g0KBxbIY7VsaoQNHGSMbMI3U=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    django
+    django-recurrence
+    icalendar
+  ];
+
+  pythonImportsCheck = [ "django_ical" ];
+
+  meta = {
+    description = "ICal feeds for Django based on Django's syndication feed framework";
+    homepage = "https://github.com/jazzband/django-ical";
+    changelog = "https://github.com/jazzband/django-ical/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-markdownify/default.nix
+++ b/pkgs/python/django-markdownify/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  bleach,
+  django,
+  markdown,
+}:
+
+buildPythonPackage rec {
+  pname = "django-markdownify";
+  version = "0.9.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "erwinmatijsen";
+    repo = "django-markdownify";
+    rev = version;
+    hash = "sha256-KYU8p8NRD4EIS/KhOk9nvmXCf0RWEc+IFZ57YtsDSWE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    bleach
+    django
+    markdown
+  ];
+
+  pythonImportsCheck = [ "markdownify" ];
+
+  meta = {
+    description = "Markdown template filter for Django";
+    homepage = "https://github.com/erwinmatijsen/django-markdownify";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-money/default.nix
+++ b/pkgs/python/django-money/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+  py-moneyed,
+}:
+
+buildPythonPackage rec {
+  pname = "django-money";
+  version = "3.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "django-money";
+    repo = "django-money";
+    rev = version;
+    hash = "sha256-eL26NsreUqtMJ26TmvmB53EJI4Sjs7qjFDnnt4N0vdI=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    django
+    py-moneyed
+  ];
+
+  pythonImportsCheck = [ "djmoney" ];
+
+  meta = {
+    description = "Money fields for Django forms and models";
+    homepage = "https://github.com/django-money/django-money";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-q-sentry/default.nix
+++ b/pkgs/python/django-q-sentry/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  setuptools,
+  sentry-sdk,
+}:
+
+buildPythonPackage rec {
+  pname = "django-q-sentry";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "danielwelch";
+    repo = "django-q-sentry";
+    rev = "d3a43a90c82734244d5ebf3295652223053f1354";
+    hash = "sha256-3C7A+X18c7p19HWD/uPRtAMf29VjmrfXXh2z5PPOREY=";
+  };
+
+  build-system = [
+    poetry-core
+    setuptools
+  ];
+
+  dependencies = [ sentry-sdk ];
+
+  pythonImportsCheck = [ "django_q_sentry" ];
+
+  meta = {
+    description = "Bringing Sentry error tracking to Django Q";
+    homepage = "https://github.com/danielwelch/django-q-sentry";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-recurrence/default.nix
+++ b/pkgs/python/django-recurrence/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pdm-backend,
+  django,
+  flake8,
+  pytest,
+  pytest-cov,
+  pytest-django,
+  pytest-sugar,
+  python-dateutil,
+  sphinx,
+  sphinx-rtd-theme,
+  tox,
+}:
+
+buildPythonPackage rec {
+  pname = "django-recurrence";
+  version = "1.12.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-recurrence";
+    rev = version;
+    hash = "sha256-Q33zyMa1wI13RNLxynGAJHlagahpnFHCmZbHp0aPC/w=";
+  };
+
+  build-system = [ pdm-backend ];
+
+  dependencies = [
+    django
+    flake8
+    pytest
+    pytest-cov
+    pytest-django
+    pytest-sugar
+    python-dateutil
+    sphinx
+    sphinx-rtd-theme
+    tox
+  ];
+
+  pythonRelaxDeps = true;
+
+  pythonImportsCheck = [ "recurrence" ];
+
+  meta = {
+    description = "Utility for working with recurring dates in Django";
+    homepage = "https://github.com/django-recurrence/django-recurrence";
+    changelog = "https://github.com/django-recurrence/django-recurrence/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-slowtests/default.nix
+++ b/pkgs/python/django-slowtests/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django_4,
+}:
+
+buildPythonPackage rec {
+  pname = "django-slowtests";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "realpython";
+    repo = "django-slow-tests";
+    rev = version;
+    hash = "sha256-gW9AZiMpXJp1m2X1cbm6GdZ9cH+TFqjNLQJFmsvGjB0=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django_4 ];
+
+  pythonImportsCheck = [ "django_slowtests" ];
+
+  meta = {
+    description = "Locate your slowest tests";
+    homepage = "https://github.com/realpython/django-slow-tests";
+    changelog = "https://github.com/realpython/django-slow-tests/blob/${src.rev}/CHANGELOG.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-stdimage/default.nix
+++ b/pkgs/python/django-stdimage/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+  pillow,
+  gettext,
+}:
+
+buildPythonPackage rec {
+  pname = "django-stdimage";
+  version = "6.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "codingjoe";
+    repo = "django-stdimage";
+    rev = version;
+    hash = "sha256-uwVU3Huc5fitAweShJjcMW//GBeIpJcxqKKLGo/EdIs=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    django
+    pillow
+  ];
+
+  nativeBuildInputs = [ gettext ];
+
+  preBuild = ''
+    echo "bla bla"
+    echo $PATH
+  '';
+
+  pythonImportsCheck = [ "stdimage" ];
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/codingjoe/django-stdimage";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-structlog/default.nix
+++ b/pkgs/python/django-structlog/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  asgiref,
+  django,
+  django-ipware,
+  structlog,
+  celery,
+  django-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "django-structlog";
+  version = "9.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jrobichaud";
+    repo = "django-structlog";
+    rev = version;
+    hash = "sha256-SEigOdlXZtfLAgRgGkv/eDNDAiiHd7YthRJ/H6e1v5U=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    asgiref
+    django
+    django-ipware
+    structlog
+  ];
+
+  optional-dependencies = {
+    celery = [ celery ];
+    commands = [ django-extensions ];
+  };
+
+  pythonImportsCheck = [ "django_structlog" ];
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/jrobichaud/django-structlog";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-user-sessions/default.nix
+++ b/pkgs/python/django-user-sessions/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-user-sessions";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-user-sessions";
+    rev = version;
+    hash = "sha256-Wexy6G2pZ8LTnqtJkBZIePV7qhQW8gu/mKiQfZtgf/o=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "user_sessions" ];
+
+  meta = {
+    description = "Extend Django sessions with a foreign key back to the user, allowing enumerating all user's sessions";
+    homepage = "http://github.com/jazzband/django-user-sessions";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-weasyprint/default.nix
+++ b/pkgs/python/django-weasyprint/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+  weasyprint,
+}:
+
+buildPythonPackage rec {
+  pname = "django-weasyprint";
+  version = "2.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fdemmer";
+    repo = "django-weasyprint";
+    rev = "v${version}";
+    hash = "sha256-eSh1p+5MyYb6GIEgSdlFxPzVCenlkwSCTkTzgKjezIg=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    weasyprint
+  ];
+
+  pythonImportsCheck = [ "django_weasyprint" ];
+
+  meta = {
+    description = "A Django class-based view generating PDF resposes using WeasyPrint";
+    homepage = "https://github.com/fdemmer/django-weasyprint";
+    changelog = "https://github.com/fdemmer/django-weasyprint/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-xforwardedfor-middleware/default.nix
+++ b/pkgs/python/django-xforwardedfor-middleware/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-xforwardedfor-middleware";
+  version = "2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "allo-";
+    repo = "django-xforwardedfor-middleware";
+    rev = "v${version}";
+    hash = "sha256-dDXSb17kXOSeIgY6wid1QFHhUjrapasWgCEb/El51eA=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "x_forwarded_for" ];
+
+  meta = {
+    description = "Use the X-Forwarded-For header to get the real ip of a request";
+    homepage = "https://github.com/allo-/django-xforwardedfor-middleware";
+    license = lib.licenses.publicDomain;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/pip-licenses/default.nix
+++ b/pkgs/python/pip-licenses/default.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  prettytable,
+  tomli,
+  autopep8,
+  black,
+  docutils,
+  isort,
+  mypy,
+  pip-tools,
+  pypandoc,
+  pytest-cov,
+  pytest-pycodestyle,
+  pytest-runner,
+  tomli-w,
+  twine,
+}:
+
+buildPythonPackage rec {
+  pname = "pip-licenses";
+  version = "5.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "raimon49";
+    repo = "pip-licenses";
+    rev = "v-${version}";
+    hash = "sha256-6xw6BCuXSzNcwkpHaEFC5UPpubPUwhx/pg6vZq2er7A=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    prettytable
+    tomli
+  ];
+
+  optional-dependencies = {
+    dev = [
+      autopep8
+      black
+      docutils
+      isort
+      mypy
+      pip-tools
+      pypandoc
+      pytest-cov
+      pytest-pycodestyle
+      pytest-runner
+      tomli-w
+      twine
+      wheel
+    ];
+  };
+
+  pythonImportsCheck = [ "piplicenses" ];
+
+  meta = {
+    description = "Dump the license list of packages installed with pip";
+    homepage = "https://github.com/raimon49/pip-licenses";
+    changelog = "https://github.com/raimon49/pip-licenses/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/py-moneyed/default.nix
+++ b/pkgs/python/py-moneyed/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  babel,
+  typing-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "py-moneyed";
+  version = "3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "py-moneyed";
+    repo = "py-moneyed";
+    rev = "v${version}";
+    hash = "sha256-k0ZbLwog6TYxKDLZV7eH1Br8buMPfpOkgp+pMN/qdB8=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    babel
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "moneyed" ];
+
+  meta = {
+    description = "Provides Currency and Money classes for use in your Python code";
+    homepage = "http://github.com/py-moneyed/py-moneyed";
+    changelog = "https://github.com/py-moneyed/py-moneyed/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/sentry-sdk/default.nix
+++ b/pkgs/python/sentry-sdk/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  certifi,
+  urllib3,
+}:
+
+buildPythonPackage rec {
+  pname = "sentry-sdk";
+  version = "2.26.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "getsentry";
+    repo = "sentry-python";
+    rev = version;
+    hash = "sha256-Wl8yq2X9GuPcqaS93hkKXs2cDzz282Xceaai4NjbVZY=";
+    fetchSubmodules = true;
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    certifi
+    urllib3
+  ];
+
+  pythonImportsCheck = [ "sentry_sdk" ];
+
+  meta = {
+    description = "The official Python SDK for Sentry.io";
+    homepage = "https://github.com/getsentry/sentry-python";
+    changelog = "https://github.com/getsentry/sentry-python/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/routers/default.nix
+++ b/routers/default.nix
@@ -1,9 +0,0 @@
-{ inputs, ... }:
-{
-  flake.legacyPackages = {
-    whitehouse-router = import "${inputs.liminix}/default.nix" {
-      device = (import "${inputs.liminix}/devices/gl-ar750");
-      liminix-config = import ./white-house/configuration.nix { inherit inputs; };
-    };
-  };
-}
--- a/routers/white-house/configuration.nix
+++ b/routers/white-house/configuration.nix
@@ -1,120 +0,0 @@
-{ inputs }:
-{
-  config,
-  pkgs,
-  modulesPath,
-  lib,
-  ...
-}:
-let
-  secrets = {
-    firewallRules = { };
-  }
-  // (import ./secrets.nix);
-  wirelessConfig = {
-    country_code = "TH";
-    inherit (secrets) wpa_passphrase;
-    wmm_enabled = 1;
-  };
-  svc = config.system.service;
-in
-{
-  imports = [
-    "${inputs.liminix}/modules/wlan.nix"
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/vlan"
-    "${inputs.liminix}/modules/ssh"
-    "${inputs.liminix}/modules/bridge"
-    "${modulesPath}/profiles/gateway.nix"
-  ];
-
-  hostname = "whitehouse";
-  boot = {
-    tftp = {
-      freeSpaceBytes = 3 * 1024 * 1024;
-      serverip = "${secrets.lan.prefix}.148";
-      ipaddr = "${secrets.lan.prefix}.251";
-    };
-  };
-
-  services.sshd = svc.ssh.build {
-    authorizedKeys.root = secrets.root.openssh.authorizedKeys.keys;
-  };
-
-  users.root = secrets.root;
-
-  services.resolvconf = lib.mkForce (
-    pkgs.liminix.services.oneshot rec {
-      name = "resolvconf";
-      up = ''
-        ( in_outputs ${name}
-         echo "nameserver $(output ${config.services.wan} ns1)" > resolv.conf
-         echo "nameserver $(output ${config.services.wan} ns2)" >> resolv.conf
-         chmod 0444 resolv.conf
-        )
-      '';
-    }
-  );
-
-  profile.gateway = {
-    lan = {
-      interfaces = with config.hardware.networkInterfaces; [
-        wlan
-        wlan5
-        lan
-      ];
-      inherit (secrets.lan) prefix;
-      address = {
-        family = "inet";
-        address = "${secrets.lan.prefix}.1";
-        prefixLength = 24;
-      };
-      dhcp = {
-        start = 10;
-        end = 240;
-        hosts = { };
-        localDomain = "lan";
-      };
-    };
-    wan = {
-      interface = svc.pppoe.build {
-        interface = config.hardware.networkInterfaces.wan;
-        username = secrets.l2tp.name;
-        password = secrets.l2tp.password;
-      };
-
-      dhcp6.enable = true;
-    };
-    firewall = {
-      enable = true;
-      rules = secrets.firewallRules;
-    };
-    wireless.networks = {
-
-      "${secrets.ssid}" = {
-        interface = config.hardware.networkInterfaces.wlan;
-        hw_mode = "g";
-        channel = "2";
-        ieee80211n = 1;
-      }
-      // wirelessConfig;
-      "${secrets.ssid}-5" = rec {
-        interface = config.hardware.networkInterfaces.wlan5;
-        hw_mode = "a";
-        channel = 36;
-        ht_capab = "[HT40+]";
-        vht_oper_chwidth = 1;
-        vht_oper_centr_freq_seg0_idx = channel + 6;
-        ieee80211n = 1;
-        ieee80211ac = 1;
-      }
-      // wirelessConfig;
-    };
-  };
-  defaultProfile.packages = with pkgs; [
-    busybox
-    iw
-    iptables
-  ];
-
-}
--- a/routers/white-house/secrets.nix
+++ b/routers/white-house/secrets.nix
@@ -1,20 +0,0 @@
-{
-  wpa_passphrase = "";
-  ssid = "WhiteHouse";
-  l2tp = {
-    name = "";
-    password = "";
-  };
-  root = {
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387"
-    ];
-  };
-
-  lan = {
-    prefix = "192.168.1";
-  };
-}
--- a/sops/machines/neptune/key.json
+++ b/sops/machines/neptune/key.json
@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
-    "type": "age"
-  }
-]
--- a/sops/secrets/neptune-age.key/groups/admins
+++ b/sops/secrets/neptune-age.key/groups/admins
@@ -1 +0,0 @@
-../../../groups/admins
--- a/sops/secrets/neptune-age.key/secret
+++ b/sops/secrets/neptune-age.key/secret
@@ -1,47 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:XXV5r3FnMpt1rX8L4LtxLbNeEZ+tLkFeMQOTvyH93fRAEltE4Uszy5khsvyX9c/h33uxyGFQAymHUqSN8rBlBfbJ0bIf8DfoaJA=,iv:rYt5U/usIK7+glVjRclgCkNpQYwQoZ+UPSzanqbI9bA=,tag:c34l9laQnhQOZlV6bj9KCA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmY0szY2IvRzhId2l3MTFI\nUjFrV0hEWXJIOGcvTmNoaDkvZDlrN0dlRWhnCm1CR2tBWFhJb2NyVndkZTlYWmg1\nUlJHVTkyVGdWZFVVSkZtUzZIQm9DRGMKLS0tIDJxVnB4RFRkWWZ0Y01VeFNIV0hM\nQlphalhKeDQySEVoWWdGNmRaWUhDbm8KnTdaaJsw3YqkjSDQREQuOjeHqKjMbw8q\nfgeetuG7tI/30tKgggTr48rk6mHVHoZE0JHugjYTt0mfoM8Dqct/Sw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvK0R0TC8zZVFkRyt0cEJa\nam9XNk1oenZ6d0lyd0l2cVByZW85TDR6R0NjClFKeXp3ZzFrUU5vQ1dhczRtbGRN\ncVd0dm5uQ1NIeFJneDNXcEwwb3JkWDAKLS0tIGczcEhEWlFBTVJYNWxLMHhCUDY2\nRFhZdEN0NEJHRHpHL24wdjdNUEVmWDAKYVTOGiD/4zZ8ME3F931LDzjoloy6JESj\nGVcgg1ISR/GMeYGxqTGxTQhHVVXv0+djdTnK+RAg2wUJy0VbFTzqTA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFh0UzRLMXhN\nL1Z0QWJxaEVFRDQ5YnQwRGFLdGNzSzQydUJXbVpDTE1sV00gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpmcGdiQkVKSUxQZkJzbEVhay9rVlZS\nV2ZoNmg2WS9aWC9zbGYvdDNkUDlBCi0tLSBqWHM5alJISkNWaE4rcXV0OTZPU1Bh\nY0tFWFl5MnB4L3VrZFREVW50UFkwCqW2sa+4LVWIwcZT9xJ0evJsBva3Lmpcj2SF\nV9YHl7EmGb4pJBslgYUFMQkvTr0/w9VC545YLP3ECn9loC3hzxM=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxOOVVrK1ZR\nWjFIcmpacjhUT29LRzlBcENjaWVKWW9BZzdVYUZDWFRIM1UgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwovWlU3RE5aMlczZlJocll1MDZlMG1Q\nSm9CZGZ4TjdYaCtDd04rcjdzQUE0Ci0tLSB3YnMrVGowTUFoNmlzYnRVbTU0dnFM\nb2tuVW1OanYwZm0yTVV0WlZkS21zCmRJ7ij8d36hIM0ZotpU/+ooyWKkHYSgRILa\ncm3F97UZGQ/TkNVaJvMlm7IlX4g/6hONDb41me4/29EmJsJHhKs=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExBUmFLZlNY\nK0tHY2NSRzZtR0Rwci8weWphekM2bWZvTGFEREdzSG5pQTggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpsRU1ndC9FekMyTDMra2dYeTlDZFVC\nTURLTG1uMHQ1ZlBEL3ZadnF2R2k4Ci0tLSArWFoyRFdzeFh3cEd3L1hKT3B5a2xS\nQjFEd2Y4NzROTDNmWlYxK015TFRjCjbR7wDmMMuCZpzMq4bbKJNj5P0OH+GclyvT\np84RX7o2CzmlJQXmYwLkv6FICe7U904QURuhPywyU0RXGhKUqhM=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVVU1M1M3VURheitScDRw\nbGhETlhUOXdPVVptUGgrUkM1QnRrckJCZERnCkhyY3dhSnJ3a3VDWEs1L3RrQVJl\nOHI0OXBJY2dDQm1vOUFpMzJQcGV3cG8KLS0tIEZ1SHdweDJkV1owRE9RanR3cTd3\nMWFlSDJuMHR1bXVHc1dNODlJejQ5N3MKhKq69LY9/9PXKm3TlsWHYW8PbMgWwgWQ\nUAC4WqLvKYk/MAbKbMOVr/TfrRbkrFJtbP1H0X6A7yzIrAXnsPfyRA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzZGJQTkRFcUh5SEM0Ritx\nLzNhNWxSL3g2Zm1kNUtmT1AyZ0VzOGh5eHhFClJmcm41Q1BFUVk3cWZ3d0VxV21X\nVmFKSzRkeTVWMzMzZzJIeXNDcWJFNkkKLS0tIDYrbWF3Z253ZDQxUkF5dzdGSlJW\nRkxReGYyV0tTcHJQR2JwUVdBL1I5TzgK5kZPf+5N0P/NeuqpQ04Lb8Sme+bocqYk\nk9Ld7vFSxXyjTTnhwKGv4+q85IkDq1xGLj+7iM7QfRfpZS6tBpKJjQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4U0VWYlJKM1JYOXRoU09r\nUjhzalA5aHRCVTVZWXBmODJZZnAvSEI2MFI4ClZEeGh6WnZsNUtTSW9lU0xnL1kx\nbDV4UGIvVXRra2VvdzJwNFdINmdlT00KLS0tIDJwMnpCWVVkVmtYVmxSNXJqNkYz\nM2lCbXQ5VEd1RE9TREF0WllGRWFjeFUKouFFBKiW7JQ+c41t5hwnBndUKZKhdwpm\nYCzF7/2YlZtNYdxip1+lZ5YEqyaXygcOZBjjZ/4s1B7ihEscQskLhQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBidzFMU3pQRm1HL3IvS2NJ\na1ZjcFhyRTljb1lQeXhjK3BBN1htdjhCUnpRCmM2MnJEeE1UZ3N0RDRvRitLMndX\nZXpWNk53d3FXWjA5Nnd1Vm5idEg0Z0EKLS0tIC9RaXE4ak1tOXMzU3dsZWh1MFR5\nQnlqTnBGY2pMd0dZYVpGdHRaTzFuTmMKqixum2H5jyBFdxdXAVlLZ4Wn5ZfeUJNR\nnNNsDNsjMctBn3gbtGHkx2wEnlKS4a6jbk01wVdSeyOFWlR9KKXF7g==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-17T10:23:57Z",
-		"mac": "ENC[AES256_GCM,data:xVNbw/RamaR6701df6IHPGjGDoYsZH7gwOWeVpb8A8VoaxYNHQVnRkV6jL58AQqI4DR+HisrpkBoN4Ui9o8t5u7PRbGyjUgUr6tvuwh4MMpk+osUmlH8eNdzi0W3SarhFZIWtcSHkLuhOj92yk0qd+W3TmWd3iMCrdVpkDe2kU8=,iv:uuUYoGcDQTZu/vGgVkt0x4QMQNkcNWCcwOlM/XQBx38=,tag:J49wr+on3MJdlNASbr+tMg==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/sops/secrets/neptune-age.key/users/kurogeek
+++ b/sops/secrets/neptune-age.key/users/kurogeek
@@ -1 +0,0 @@
-../../../users/kurogeek
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
@@ -1 +0,0 @@
-200:ada9:8363:202b:faf:be:92ab:e46d
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
@@ -1 +0,0 @@
-../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
@@ -1,47 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:NSyWVWXMxoTR07uaLUYX6rHB17wsIB53FZHSsPxgDKJQ2wHBPFNaHSYh+BiSo+IrX+YcdUUqJFhEkjWDyG+vXaNZHrMbg/pzZ/cwTK/lPbYISkwtOhgr3zCA0H6DmQcHVmvR6fsdRDkFwl7pHtn1RMjEORQdbBINtscZfzZFcAF2L1t+WPFxgRKQDNT/9l3f4SoBcuakyg==,iv:/5JbEZ/vj/4I+eEElOY0cnhiYzqqPw2ZKLv2M/xkstw=,tag:23exDL72g56bP7ZbMsK4mA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTYUFSZGpmd2tmdzB6bkp5\naytPd1RhVWFqeXF3SDZia3QzUmRNNGpzcjBFCnl3VElLdXFvV0tFSEFlV3hRMzFH\nbnBnWVZ2QkRHZ1BoTEZxdFg4QWE4ckkKLS0tIHhSMlBKakxmM0xyeUphKytLTmpk\nVW90V05hTUEyTVNMQzZHN2xhYTBZRGcK/nJOIM4m56TE7KKmn/QH89g053mmuKKG\nQYs/86SWdLPqwL35FstQg2xDIHSxkDcoMSGc+C+/xdOjWV3qLil/DQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaU9idi9RZzhNeXhTb0pp\nUkZ3UVpsZlBka2kvZDBqcVhiRVdMNVFZbEJNCkhvdmFaVTBGcVAvalJPSlFuZHhi\nTE9qeTBMMjk2djhFUEdJbWZmTnN3WnMKLS0tIDludThMRDFDUHhCZVV3bUtVdVBZ\neGg4TzdqVjJPeUxYbnBWNURRSWRrMkEKBCACDZgHG5eVKcSdjHDITJZqgR7cHdHq\n9y8qS3YjaFZ37Ui6Lmb9vJEzDCEy3wEupBy4sbAX4okVapGPJ4fmwg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHJtSTZrY29X\nVTZNQm9XS3JsbEZCNDFUR1gxZXpObDdKRmQzUnRZMytOaFEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpYN2xlOFVDZFlEOHhTMGZTVDNjdjdU\ndWlqd2ROamdmelp4UjAyVitnYVQwCi0tLSBZWmVWc2J4YVhLN3VyMTQwamtYRW5K\nWVovUEp3YlN5WjA1VE10MElWMllvCiLrLLekRkmSL5ekLIcFMoqgeEPXSrn15JDd\neKT9sbYtwhB7vt2L57fDRfaF/+7wNb9y6cv2oi+EdDoDXp/EyB4=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxiRWYyUmwv\nVjlEdS9LOVV2K1NwdDFhYWM5RS9LcTZFNkNaMWViMkl5bmMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpUQkk4NGZPVWRTbG5MNk9CTStSUXFi\nbXlGemlJR2o2dTB6QUE2Q2JKSnE4Ci0tLSBzZjRva2NtNHlRamNvQWpoZW1UWFMr\nQVdNYXBpOFVhaEVxWm1KNFM4UHJvCnebMj6d/+e0vp00Gb02qJtUp2+mEpF/jUpD\n25cxeoSAWPAhfnBgE+oLzQqnQSq5dCxsWteE/1eOXC68koeT9FY=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9udm9sRDBJ\nNFM4dFA2ZDdJMlBXeXYvakM5RHVzNlcrRitzUHF6dnBvMVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpKZnBka3YzK0tUQ1hXTHVheE45Mzkw\ncE04aVVPQWM1eURmb1JaNlBwVlFFCi0tLSBHTlY4UW5FQXExK2cvMUJDZE9NaURy\nOFUxN0dvczJtWlVRc29QWlZ1bGg0CvUoAmTgDVSF7SPpqnkFhkCUn3N/Yr4Tzodw\nyCiD7U/KYFavEIxGIeg+ClhLF9o4fYq9kk8ld0vU8qUADXBdRDE=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTUEyUndkSk1iQTB3eUpp\nb0ljaXpwdi9QYmdNV1J3L0NhWElRVzlnNTFVCnZ6Q01ESWRNMHRxdWZKM0lYTXBX\ncko5VitPdWk0UHpwWDhGNzFVZk4yYzgKLS0tIGVRdG5rWkYwOFlCQWNIWFBRalVE\nMmFtOHBvbUw5YXAvMG93MjBrRjdmMGMKlopySr6HS6vfFHiRcwlJz/qy7jzyS1Nf\nw4lw7QnOrvOkoutiK3HiIia5N6V0jd0TV7nJqIu7tz/zYksbzps7QQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVTZNTUM5UXowWTlPRDFW\nVUJTbStFcldHbTVDUVRJYjNiaklWRmowTHdnCkJNbUtmdk1jS3kyaVNWVFlOTytX\nKzBwTmxoZi9NdmJuRFNMNTUyRThNUDQKLS0tIENSMHZ5TGwxQ0xuZkZFQ3RJdGEv\nSXIvYW9WY243cTdzZEtra292K0JFVlEKMWhG/7R00uqLb5l5lU3p9Vt4pre6J85r\nIFWtg1G/54KaFt8aiWcD5RUSSARGZ3r4qVtO+9eWP+gA4DUpSNkWNw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WVlWMHJNbERKUGx0elgx\nUEF1Sms4VCtNRVRraWdvUkFEaTRzYTJ0TTFZCnl0aTIxR1QyQ1VsU0RFNnN1NzBr\neTVQbHJHQjAvYklFVkZkUDRXRGxvSkEKLS0tIHdINHFyQVE2V1V1R1ZxWEFuMm5x\nUVRjSVp6NStGSkQyQ05JVHlXejBEbWsKBlMvtw9MCReN1eSHKMwwsWaEF8kq1Pns\nLNSYEeWABZ5bbPB1xBvmIIlVFThJqgy5mBVJLzQMUwqb0IvixAgFxQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaSmNiVWlRSy91Mm5qSWJ5\nd2Z4WnEydE9ncWwzUVVCMDVoek1wRTFyOFJjCkZjOVZrVHY5d3FKRmMvaXJQWUtU\neGpSZkZITkJaOERkdWZpelA5dTJQOEkKLS0tIEtZOUNJSytYTFpSTWNuY3JjcnJv\nbFZpTXQxc29Pd1FIN0xrcEJYc3ZlV0kKyO/PLn2WNdVtTqM8cG1XFqV/5YdSqPAY\nvroStGVsLliV7W4T2MAmACeyjoMde9/gVosKfGc6awE+Bi2BUxrqpw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-17T07:22:09Z",
-		"mac": "ENC[AES256_GCM,data:OxeLto6aeiTOX8OffRsQzxyluSdva7y3j4j67c+MI1ost+QCZyGAW/5pr2mMaoU2XrwYqUjZTKBhJ9p1FY6C29/EhyzrNhGUTjC5iTcXO1lbLUTgoSDN8KPmVea97sTa+easVHoSgnPLxisG2yCALv95k9/eQ7vF9FRjBBNTaIU=,iv:FQeojhtnKOlqWuQNJo1TmI/PhjYbgwtvK24gZMjbbpM=,tag:Vwum5bSSZRNNDQ3Yudw4hQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519.pub/value
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE09U7Tuvn3/icqFhjKuhp4hG+V6E6IFKhX1W2hVvyVj 
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/machines/neptune
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/machines/neptune
@@ -1 +0,0 @@
-../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/secret
@@ -1,51 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:w0u/GcCzPgiQMK5NpXb3kBO4Y+cknIMebBSv8yVISZG3rQn4ndimELcAoxbbmvB4N5x8uHSG6YxVdKRGCr7J4Xw9UOLIr8XPeMst8ZqRZRvJQFqRbjyuBjp27JSPrrkFcohfWmjHIIaqDQ29mPCOhbY8bPfl0MM8p6Iyvft2VtQpo/A5dKbDtn8/e1/5ChTtmBQWdtIfw8LBILChlc03RTZmW0b0esNqLUwn9UFTGKjxF/CFjJKSpxLM1vdYFipHQ7VZWD/HRs0qtAlldXQmWu5d0ypI73NQ9dNAo000zcraf55DsjcwjLhjMdnm2heEovAqVBUpgdr+tHSnu3SKq4L+JFUVudxIHrQXsdUkV32QZddYitQANlwC4jjCK9jr4we39RV/AJzs3krkKcG+3tKWg/NCZeW1KwGfgdOuc+wPb1N3OQVIHcC9YgYlXViAW5NO1vT75UvLLNTxbnQRKKADvYVTuxo+ZIaxFBmd8ZUNXJTFbnZJ6e5MH7QbqOwrTDA9,iv:Hc6d3IxfBdHF5XmgdV2zvAU1XZhrgi53/kAKEk6cFiI=,tag:H9CYzcaHbr/LI518IB8YOw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMUh0ZzFCbWJxenpJYlBP\nelEwWDlTYmNuVE9GcXZRUERPd3lyaGhoRFZVCldEcDZUTmJueCt2dmhXS2x4c2Mv\nMENYTFo1UzRLM1lZWGdYRGVkb3hLN28KLS0tIHZhUWNzcXNiUnNPbFZQa0l1SXNl\nSzd4QU1DandCb1lRUEkxUFFNSE5rUUkK7LHoggdi4wj9K39A6KaH0+MFbJ4wzaIt\nRYZxyUdWtrDMm4tEPbHT3DgBYC7RdGfWbxct9KwihlwSWMhNTyXAbg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOb1lOQjRYOEd5S2lEeDho\nNkFLeWhnM1Zjdm9ENXZtUnQwbUlMckhBd2c4CkFLRkVJL25ka1hnTGNnVmRjZ1pz\ndFFFZ2NKZUU2REF0OXV0amVOL0VTZVEKLS0tIHFtcnJ1b1dWVnlPWnExeHJPYnBm\nNEVkNHJBRW1GM2p1Rlh6ZlZiTmYzZ2sKT21d9OMGWuPxkITTvl6XUWzHyGqqzZty\nitwdfFm3YpzGK/FLN6LH+KSXqfo/ntUMmOIAai+geefuT8mSW9n/Ag==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYOHhKWlAwMDBUZFBRamNT\nOFg2Ky94M0xvZTlsS0pEekxkRlYxN1lDVGpvCjZ3T1AzaEV5Qlo1TlAyazQzRUR1\nWjk3d01USzdNaHF6bGpPVWhEbENUZ0kKLS0tIG9TQWlkQmlFdklETXh4cUphUFdZ\nVVhuM3h6NFpKQm1IeGNDR2RxaEUvR2sKoXaltJrkQ4EzTRkrrO74CrCmT67Fef3Q\njRi8NcuYAFN/CrsBLGQA34JwTdKhmS0skkJsDEsofPuepebNc6IHCg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZyWndNQ3ho\nbTl4YXh4UkdyeUNTZzlyZXNIZGpOWklwSXp1Ykx1amZzQUEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpGMDdjSzIvUGtIaWR6eTlaSG51Z3Na\nSUJHWTVhcTRaRGp4NzExcDZTVVJJCi0tLSAvU1JPeGtLT25sNEIrdmJHUzYrTGky\ncURjektPeE1HTHlKK1M2VWpidlgwCimWuV36gFbk2wB7H1X8HJjfq3RJHjP0r5AF\nFY5UYFLvlftVdPizm0LXo5KQbnbckDPZxrlwvkcJP12PR+FOyh0=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRpczlmNVdz\nd1BUUkk1OUZwOWhCY1lkbm9xUnBiYmltVWw3MFg0TWEvVVUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpCODRxNWYxNzdCdE51bkVGZU4xbENx\nZTlPTXh5VFJMWFl3ZlhSWElMRldRCi0tLSBnMXExUWtrL2Q1ZmdiaEpIdHVsWHJz\nSFJuRGRvWU01ejYvcFJTNVRqRUY0Ct9eLGkzb+9Zf5Au/Zg+EbQxzgoxTKByhtij\n2YSL2jfn+MiQSoEWeXYP2x6QiZ3gh7yp5WY1ghD09Yvf7x7UAPo=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHAzLzNCa0RK\nOHBML3RQWDZPVk1SZlh3NkxqSDQ2eXd0amxiZHpzeEd0aEkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4NEkwbHhqUTZydmJOMm9xbjB3eGVU\nQmRtZW9ETElXdXIvK3NQb2ZjVHJrCi0tLSBzUUxtMnpYUFdyMlg3czg4RTBWcWdW\nUFFvN3N2WEI1Y2RWZWFwR1p6Rm9RCoMt8vokyKfTEPJ5nj/lKIS9OrBEe9QPADTG\nQ7HWrId0rRFkXXb8urU8APRJgUFKeap5mUtQ7LjNPMz0dhbccew=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwZ2ZoZElaeldaVE0xUElK\nelFWN3ZrS1VzYkFZbENjb0ZMQzA3TWFFTngwCkM0NUJseE5LUHZqUUxxbXB1Rndz\neVBMcWsvdGdNSURsR0xFOFJ3N09lOGsKLS0tIDUyaDRDL3QrcnltaDZHL3dPYmxs\naU1Xc1ZjYmhwV1lINk1UMTcxc1Q4SDgKTt5+DspGwjI2ODiemPgLkGzHnyo05u6y\nJpewiruQhL4WsZgI48Us8WFfyHNc+dLaGplBgJrUadh6S3Fo+QpiVA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcWFwdVFaMHEySmlKTUZq\nNWUxT05UMkhFall3Mzh6NTFIcDZoZUxpZkZVCmJQV0ZmYnFJbTQycXNBWGtLZG5s\nZ2ovc0Nydm1YcXBwdytuWHlRTWFCc2MKLS0tIGFnbzdMOWR1UzVpY2RvWnJFeXlO\nYmU0dWxWNjVTYkFLdW14Qk9jOTZOcUUK6BCenu5Mh8fg6Lia4CBcQgNVTQsTY9Z1\nxSlqi4zOvKRDlE9PNRW/dWas68F/bJCRa8KhUPQ5ZF475Q5FUrbNoA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrWUhZSEl2ckJwZWwzc1Fi\nQ3g5R2RpZzZVdUpFK0ZyTlcvQnZSWkFlaGc4CitPeTM3SDhvb1Z1ZFh6WmNpWFBR\nd1RURnJPbnZlTWtBTHNsa083M2VRZDgKLS0tIFl2Ty9JaGNUWE5VSzU4ZDhUOHBx\nVEtlL3Nwa0ZpWjl2K2ptQ054WUlSSjAKhxcMLryYi7O8CKnFDphV1ojcDaSYFXPL\ngzaX32vI1LOo/doAq0dLC+yLtj1G7f/tE6tK2ax7SCUsAEhTn8QJ4A==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHalpIQWNJemFzaDRjM1JC\nUTJydzJPcWhoU3dPQkpjQWF3QVpUc2dhSkVnCkVGbkZQT3V6bWVqdS9KenBlcEpj\nUVdLQzdaRUlkdDIyeEV6bDhPU0VsQ0UKLS0tIHZYUHZVT1M0bm9oN3hwL1NkdWZW\nVVN0SWc2cTAwQWNoVUUrSkdwWHlSZUkKgsejUHV0bc70zNYwQk29KPetAbhiUMBg\nB3QxI8i+D8mJ+/EKFZzllakXK0NeHVDHTcALcyaI3SvIa95PMBczuA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-17T10:23:57Z",
-		"mac": "ENC[AES256_GCM,data:g054D4imoqjlpf/2HLfKW62cEJvJxGswSnNS+snyS1mx3+86E1kM256AJhETWl5ZC3qdfzgeobxRIIS1m3U8iajQtYn2nOJ23Njnfu2s9RTAQSCsnJevV+HfmaBDxqt/uS/q6DaXylaXmPINlmsA8Jwr4AiJtIKovm173P9/2hg=,iv:37tf+FpGFw1bv2q2Anc4gu6C9zacBjgh+Z5Xise6jKw=,tag:7HrVKWWkGE4CBF3TsisdzQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/per-machine/neptune/root-password/password-hash/machines/neptune
+++ b/vars/per-machine/neptune/root-password/password-hash/machines/neptune
@@ -1 +0,0 @@
-../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/root-password/password-hash/secret
+++ b/vars/per-machine/neptune/root-password/password-hash/secret
@@ -1,51 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:H2KsH0uMgHC/NjEHH04I5hm7k96ZjOITsZ+kzL3y2CEAaauvmmTh7wNxpvG3E7SswbkYx200KXZTxgfY7z+0pmQxvwMzRukwIjpKZLLxUIIfvlZc9qmwpNH+7wo3pwjLQmYJ0OhMO9tzFA==,iv:EmAv1RrWtasq0ViKkAH+TrPYRXdhH+SdLH9hHfFBpnI=,tag:+0TexZJUMyMd9Kt647iM3A==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNb0VqN1h0QVdkendqTDVW\nM01kSGtZQkx3Ukw1UFBocUY4OVVxa2JLdVgwCkJEeGpHdlJCQkxnSW95ZlR0UVQv\nRFpmZzdpNVVYeTYxeWdyQUo4c1diZVkKLS0tIDBpdUdSNUVpamJvVy95QmhJbUhO\ndVpJZE5DdXJuSFJDaU5HT3FqNTA3amcKnmQ9DED2jtzConYx8tEQ0O5wkWLLuO/R\nFlpeMWrolziCbcBgraGffbFM3tk6jHqEdWB4r2SH/4U0HtNKBXSJfg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlMFY2cVpWd04rMTlGSWxq\naFNXSGtVU1p1U0x0NVZYV0hGb0wrdnJQQVJjClVkSnkzaVFjNTlrMjNjVGVDSGVF\nd3BJbmZvb3RjV2JkcThuaUNCZjRjNG8KLS0tIE5TbHNoYy9QdTdHZlZ0bHZEUHd1\nSUJ0Z3FpZmVWRWxqVmJUZVYxck8xWnMKVbTYt8zbGkKMuz7f4yOG/EkdYYqfmj03\nKDCVLPqwsRoibsBRpyRine5oOUwzN+PtQeXwHj1vRTjtGzZIgpQIQA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWUZwN1kwTTZHUjNJWUw1\nY1htbUM3dnJrNUFPTStOOGJ6MW1DeUJWcnowCjRObXdGT0pUbjFYZzExaVpMbjhi\nWmF3QzAxaVlSeUkvNUpzcSt4TG1wU1EKLS0tIExDTnNtR3lVRllwRFh1RW05NGRl\nNTVyRWRDNFl0aVAwKzVYNkFKcXNRaUEKv84/fA4ydX7MjuWJA3oYhYkmWHXl3LyN\nIHpWk+7JuZlWaHJGVO/ywQmnEj+aaETpVvh99cKQhHk68dzzSV36lg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHN5MVAyQmRk\nWVRodG5EY2pRc3ZYL3FiWVJCSURlYmd0VTlkeU1FRFE1ZzQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprSEFITXhnVGZhcTE3OTlSdzhmOXF1\nZFA1Zm5ZQVRLUDcrL3NBblhUVEZzCi0tLSBzUUFyR3V2UGFLYVQ4dG03RHZzZmZK\nOGtLMHJWbEYxOGQxL2NnRzVUdHN3Cun6V7ieogvJq02jePVUnX+IOHLnu3RRuVGX\n/PVGf0jRVQLP6u9gXsTa+GO/Ah6hYRsmV9lzq1S27gly5U0CbDI=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhlcE9GVVVL\nN3JvTDRxUGNGZTE5ZngwYzVmTzM0ZmJ1N0Z4R2NYSlFobWsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo2U3NMTHAxTGlxU2FSYmVLb1JBbXhZ\ncVpDc080VVpRUHhEaEJQSHVFbzV3Ci0tLSB3bmxZQmNHbThMSEtPb3BjS1JhTmRu\nYUNWMWE2eVBFbk53Wi9HSFNZejEwCigdlrPSwK9e3LcE+U5ZMfy424+gjcXCPtJI\nhDQPkKQ0htljBYFDz2izD/s7qwKOqzTia8u6UPLTopMcGyXpSbs=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE9qdHcxd2pS\nRkRXNjlpQWE1UVdudDdGRmdzcEFPditmWTRCbXpobkg1aXcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo2NkRIT3J1VnJzSEhCWjZLM1BtNWkz\nRjFMclJuMVB0U2ZsYkIzaUNEc2lBCi0tLSBQZ3IvK0Vvend0dThqalBwWFE2dExt\nYmk0NVhlY2E3Q2JWbXpMWE1PS1hvCv/w4TeDBqWbyBueaiypFgUu5InTNNuHRKOp\nvr1obhIlz4alQ62mhbLdGB+P3GB0yBkuamUlaOhfNNIk1kuMpt8=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzdDdFbnY4OVpDdDcvT2pN\nQXNqdmYxaldmM0R5bGFmWWhlVzVoRWlMMjNjCkdXcUx1NU9KYmt4QUZCLzBYRUNo\ncFNqcjYxcUhFSWE2bjRqU0pzbjRrTmMKLS0tIG91K1RSWWxLaGdHazY2RDQ2VjA2\nV1NpN3p3Tm5sZ01jUUlhazlFNW1VQTgKj6wMVKN354bMWIs1OKAqCFu2+XSQ0KK4\nNxj0kJ3mimOpkZjTCAojuD784feb70gBx+Tgf3Z05jtR/EQBv5TjNQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeFBrbUJaWER0dC9ueDM4\nVENqQTkrSHp6elJuLysyaGliOTVPY3ZEb1RFCnJRUWZMQy9tVEZjYlh0ejY2RVBB\nWFlPWXJHcXBTMnRjSjFvblNDQld2L2cKLS0tIHBvSkdST2o5WmRNYnFodkJ4aU5G\nQktFcTdBM2pnT1ZINWkvWit6d1Z3dFEK9abGvVqxqXfSH+vKT85RhlyMUTQjAink\nW/0bH3ToYJpIoqxXk7ZxGWBlA+6To6HUZ5y8fcCFg100LIVtcqT9Ew==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwYTE1cG5kUEN4U1I4b3lP\neXVJRCtzekc2azdWalJTWUJmU2c3N0c5NWk0CjFUelJnMytKbXVCY25YZ0F4RDB0\nRENtcXpwanMwV0xZZ3VYNy9BUjQwck0KLS0tIDZ4TkhXUGJKVnM2bkVHdnZCT0Jp\nR2hYK0dqU3dEVHJna0hsVjVzOVZDR1EKq2/gNYgUozNgWx+A1eWWN/1ci+JGLuC2\n6MSoCDx0ZUg4e5EOmBLRl4CwRUSBJklfhzeCGVh0lOznNBlr0WfMaA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBScGhnbklHZllqMXNrK3NH\naGZtZTNKS3IrU0ZEanFJeG9iaXhmaDNMbkN3CmlybXhLbERkMEVwcDJDS1h6TGEz\ndCs1VHh2MnNQcGVzU2JMVmk3MDZLSTAKLS0tIHVoOU8wN2lSUU16Vjl6ZVJlbUw1\nMjh2U0JoK3pCY0tOWWpxZWcyaGdXeGcKBMyrTPy/8sIl6wLoasD9P0/+D4MI3uMk\n8U9hL+4Hw/8BdRt9rYwbcRX04/oKNXcPiyByHmIjYYF1AJTX07hFiQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-17T10:24:05Z",
-		"mac": "ENC[AES256_GCM,data:TQi5XJZPZOhJrYNVqyr9azqo0QAs0Q30qB4BZXQdTN/+mfmDqx+mdJdkMQpSlJaFpbzCZhVGW0reSzCbFOtam73LFsBJZUr0c0RYXq3f8U91FE11czMp9+oau2yY4D/6PzDQbHdJVywj0t2qTrsSHHdF4b/0BdpTpi0goNgbacM=,iv:+xpi5If3k154cekAvrT3/rtII4BsrRg2YFDDRaLjNds=,tag:4GoEX5ZxSkaY8XofCSF8Iw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/per-machine/neptune/root-password/password/groups/admins
+++ b/vars/per-machine/neptune/root-password/password/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/root-password/password/secret
+++ b/vars/per-machine/neptune/root-password/password/secret
@@ -1,47 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:JatEWUAYacgbFT1oRM0i3oHwoWh2URg+ZX6y9qafiPZujagsx6Ks2AQrGg==,iv:Dd8djrt+mnVkrWgGnfLWOByretizJSJ3+PfYW3bbGVw=,tag:fK3lGIgr2bMtKUifKK7tOA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WU1mbG5UMnU1OVhRQ2p4\nVHU4VUkxTXR4V3VlU3ZQdDYvTzZ5K1IvSXc0ClZGeTRUc2ZyaituMkh5ckFmbzFZ\ncVNycHNDSXZ0dzNPVXJMZlJ0QTk2UXMKLS0tIFNEd1BLNVVXdUM5M2JQT3VLaXIv\nTzFKbW1BYkxPZDFueEs0UEVGUDVBNUEKfP73bJLaJn+xsE0t4kz5PE1+LJqMxwGe\n74m0W8YoVweZHnpUeRcOnsxp0egDAwhgqg+sqpxLfY08L+zpeNSpIA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQUZDWnpEZzVuWWJmUC94\nN3NwSEtNL1ROMnkrUy9VdjNUSFdub1A0VWl3CnhPRWpyUzNvajI3SitZZmVLQ1pB\nc085RU1CUHo3M3Q1em52ZmRnSnhqUFkKLS0tIHM0Qi95Q09CbkZDdEp2cTR3cGZw\nSkpjMjE5aHNMVFFGb1VYRWc0bi96RzQKhi6eXNUbhBeqofDl8WOvzLiD7mGiE7bk\nsctMjwCtHxpQTW0oD7hIMsNyJTduZ9/9rxPfRkmSDcCWYAsVFcBevA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEYxK09HUFNB\nZnVaUXp2RllSejJqTitBa2EveEZFdXpIb0VleHlHK2hweEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo1SlkvNVhtRXMraWtLQWxINFRuNy9E\nZUU1RlBqQ2d6eHQrMDJVK3B1Yys4Ci0tLSBwangzV2xtdHUreTRpLzFnMENQb1VE\nTllTc3RVYzVIeGtZMnhjNllSS1hjCleRr8GWtMiXRvk5IXgIKimKlJ6US26iHz3H\ngJhLHc9WzATHQFoiSnRsYLMRfXXfQDJ62GM6FX9MOZ8bbDdUZ78=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGI2UWIrOVdV\nbml5UmM3WU16YUVDMXJPRElFZVV2YlZtekJURnhuSU5zMkkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo5SDhoYUxHQUJTTUNPa2dYWnA3NlBE\ncFZoTGRjVEpNb055emN3OE96UzBJCi0tLSB6ZEZqc0txNmQ5K0ttN0s5YmpxQU1M\nTEI5MFZaQ0IzL2ZIVi9LZ0pjVkg0CnnCHiCzCg9iyOw+jjei0TmnQDuuhEpxTvLB\n78+JpBnOnVZRMZM/RrguHup2lAMVXSBtu0zddf5wSivr0renXRk=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEZiTVJZbzVC\nQ2gxTG1PblRpUmM4QUQ3d2hhZ1YvRjBnT3IrcWljOEp0RE0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpyTm1leGQycmp0bXJqKys2S3VPblFu\nV0pwSS9GQUNFL2N2ekNIUFpVTGM4Ci0tLSBLbUpnVlJuRmpJOVpuRTE0WmlEbEQz\nY2pQbmFCaThtN0ZCTUtGbFVhaDdBCpg+8OIwptyv+WHA/1w0qWXfZH7RIj6Ao1L7\nHQyjOyEi2Y4sRYmgNg9xFKS9bT0Y6jamyXmemCeSmhZg3wg154M=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bEZDOHQ0cGdTa2JTNkhM\nclgwZWducDgvcVp6dlFScTByVHBxdEJWVUM4CnBnYWcxMHdERWNuOW9YRGkyaTBM\nV2M0QnJuWFZ3VXV6V2xIM01LQ21RK28KLS0tIGVyamo5cElVMFYyclZsWEgraW15\nbUxEc0R0SGRoTS9VbTJsZytvbWdCZkEKgwfGoXJgmvmM/QW+7WN6ssGgZuzQLmCz\nCrQWifImc4k9YjUPLyLc+rV5lnUBKiqJZug4RLRCmUvYYlEZBxqWRw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VjBkMnA4ZWloc2NUd3VL\nUHlyL0Q3c3Z4YkJuYTFiMXlwdHpUMW1HSzBBClBUdVQvaW5kRUE1eHpoY0ZMUWNC\na0s3Q3lVTHB2NGpFMk80anZQZzM5SFkKLS0tIFQ0c0QxbFdnTUFLbDdqc052R0tS\nYU8wbWwrWFJTNmdBZzBPdHN4VTMyZ0kKdsJa1r1GA/Ya93rbh/FkVEhK1QcfV+UF\nQMqjRfe9s2UIdRiMk+osPyV2Fr9L9ncIMw/5Eqdh1cJm04m7rAMN7w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TUxlNmN1SWxxbVA1bHdO\nL0RFS2hDbzJ5Mk1sNVZVYlVvZ0VFTVp4d0RVCkRjZ0lhOEhnMVM4cDBQMjJVYlll\nc25rdWo5VTdyY0w5Mnhxdm1ubXdnbDgKLS0tIEZSQ3Z6c0lzQTJDOFZSR0dTR3BH\nbkorOWNLZkFSY0hYY1hIODFqMGNpczQKgnl7vH2fRrW2sGCxAlTnf0/9aTGWbXGX\n6OtGMfAIv9vZWXi65CpVwPFfx5f8yoydWTLOc8Pf/e5N+ZOZP3U2JA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3TmZmdk1qV0ZFYVorZXdy\nR0d0bUhkbGdqWTByM21kZForMUpMbTk2UG4wCjN0dURpRytnWW1peGRYL2Uwc29R\nSWF2ZENjWXlpQlpWamJEeE5SUlVrVVEKLS0tIEgvbjR6MFJVM0taMU9zV2orMmVB\nRVdrcG4xOEp5aFdpYlRtL050Q3ViR0kKZ8SzmPVVgDYshXyoFXiGvgvAnAKNI5qm\nQsV6tKCbuY+07yTSEtUo7B0htfS3k7YQqxC6dBEOODtM5C0yXcxzHA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-17T10:24:04Z",
-		"mac": "ENC[AES256_GCM,data:yWNfoYh1Yj6PctGH2sc0XHb32PkK7fH+pC7KdVBjqL6jOEeUmJeJUV1Krxw0lzHG/Z7iDsgVryVxT0CkZ9pmQsNe6HAVM33gd3snqhdSm9x690vAezWde3rqu/JelU01HTgrLnxWVdJcv3R1XM06BvJ64rzZPs0N4kjuketeIKk=,iv:oHOAzASEVZunFHUcXPTXFoXUw10hBeEwxYBRdpQI1cI=,tag:obZUAhewwsLVdrdHxLYg5Q==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/per-machine/neptune/root-password/password/users/kurogeek
+++ b/vars/per-machine/neptune/root-password/password/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-ip/value
@@ -1 +0,0 @@
-200:6f1e:6b42:c153:5461:a48:bced:d936
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/machines/neptune
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/machines/neptune
@@ -1 +0,0 @@
-../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/secret
@@ -1,51 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:mE1tSqDTrnvGFZIlA/Hzceg6NB0ZMGpu0XACSYlpLMyobqEa9RSsTUX+hyBrmTo0A9PosHTscmI4NmHWU73UAnTwOFkMwi6jebEKXDdIZU0YX0kus5blToe5Li0HTMhTR56GNPptywGjZsPGa3+zAOIh3TH8YMD4W8opdlisegTgG1d4On/rp+l6jcwRehCbL36pGmYKJg==,iv:cEK7BnP6CFLV4Fbrxs2CU68pvVxs6baR2/xXsAr8Gu4=,tag:iS7BahlN0GEjP+yj7FMo8g==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkL0lNSm15QzlTQWZPZHVx\nRHp3UHJSR3hrQkVZYVVjOTBoMjhDcVE5elI4Cm83eGt6RXZLYzdsbk1QcndPWS9j\nanBDMTJwNEJ4enEyMy82cmc1ZHRyN1kKLS0tIHJsRzRSQVRNOWhFYmZWcFlRQlc1\ncGlFOXY4aHhlQU1iOUlJMlpvZktKNkEKRBvYL41kpcRYQhB112CYn3mAAGhzgH9O\ntl3dx12ziBAu3w2NNi9Kx56FTVwP/5MC5fa0z7/FEitW2qkVzXerXA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByckhBVmRvMEZCQWpHaTRv\nMDVlVzgwZmsxQmVhV3RHOHNVUlVVUlhYaFFRCjZ2ZmYrQkVuaVV1VjdCUkpieUVl\nUXRGektvdzNMTGdSN25IM1ZNSVVQbUkKLS0tIFNlMFRia3VBQ3dEZWdVb0tyU1l0\nZFJ1ZzBIMUM0OVVyUGRuOWxjT09xU0EKtwMOhar5P3NZlBnvugSzjTOUzG+3EzQh\nIKtn4ZtHVGL91VFYJwl6GpYmuaZM+bBQ9DfSf9xTtDelADJlv0NGVQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNQXF4Njc4MTN1Sm41VG5m\nR2UvS0pGajNlQjAyUHZUUDRyOWhqdmZnWFI0Cm1GUXZnY3VrbGpET3BoVTNyMTNC\nVldTcFprQ1dsK3JRbDB6eGh1R1FWbEUKLS0tIE9ib291VWV5dC9JaVVHODA3Rlh0\nalpnaE5sWUtGMzhhZWd2b0d4aHJLQmsK4SbS4M4n92o0Lk1ZnSjuXHvjKhwNBmlj\nMUZBAnXaPYRpvGNWdXmTaSkxXcJUTtJvrLqctBDDbIciEHyHOueQLg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFl3R3A2SENl\nWkFsdXRQOEs0dlFaSmVsYU5acWJxcWVrWGtUN0hDRXNvbVUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3K0pSN21ZUnhRRDR2TUo3b0MyTERy\nVTRkY1BTM1ZDbDZ0d3ZvZlJlM0t3Ci0tLSBITmlWMHpld1YwRmc4WmFLZDZsVzN4\naEk0aGVvTzBzcTRPUDJSekhycXJrCsW1R583IwdojY4bUSQspEdGVDXci1cWrScb\n6dpeYu9uWB0JiesaDJ/arF4FbA7bDMKC3WT6t8dvDdqPzwaMTyM=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1xQ2YybXI1\nTFhEaXg4all6TVJFNW5WTEtKWDBRci9Zd3kvaG5odlB5aVEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpwd0UwcnZXemxkRDQvM2ZlWXRicEIv\nMDNra0txZkRTblRWbDQrMHBETkZNCi0tLSBNckdIT3h4aGF4N2xvNWtVakxIWUx6\nMUM1MlI3R1lqQ00yNkhMaSs1OG5JCrhuqHWE8aSoir4rYWtmZ8P+vL+gyxdvL3+n\n9iFyRiq9k74iyZ5qojiIOYhJIIis5Ygxygi/qDQm0/tqr7Vg7gE=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEJBKzlIK0pY\nbmZpR0ZxYzBXVkREdmx4Z0pudDBHWHA5MVZkQ2R3em5WMncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp3SStKRzBTQ2loWkpidkJSZWdSYk1k\nNmFvOGpVWUhhNjJvckxKbDFOQVBzCi0tLSBEdE55NUhpSDR6U1FMRHhsVDVuYWZt\ncXBNVHBRVGQ2dm5rYkwvNTB4OEFvCl0/SrhvHrMD5O6bjUeOoXDeZjwsFdq636kz\nQvzC2t1rtthWo7oCKsTDV7wDCRIhqUeKnQlc5vb3ssQTzWByn1k=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYQnIxVUNJV0JDY0xEZkFs\nc0F0QmNuY0xyM3l3MHYyOUJ4MVprbXNMVGpBCnpuUXJkTUZGb2RlMWdiYkpTZVRn\ndWpDSUtiT3pSNlVaaWZNVWR1NWFrRmcKLS0tIGFNTGt2N3JUeDNmQmRkZTBoUVJF\ndVhuRnJFa0ZWM1ZKSWUwMTRTUUlsRU0KkrDp96Evmf4vNnBeB0DWI7j6/t/3+T+C\n3OtG4xohL1R1tPzsaWeKRoSAzAMgAYWC2eSnJPT2xyN2ppGqu1Hu2g==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqU09xVUJoU1NiQ2FwSG1E\nUElvVzJUTXNGMEtCQ2d5YVdkcWZpY3crVVFFCmc2My9XRzd4bzducHRwblcwOVhL\nelE5SHh4SXczVVF3c1dZaHR1WUpsS00KLS0tIFdCcmwyN1IzUmNRd3preUxxNGpD\nZzE3WVZyOG1RdWNRNXZ2ZUNtdEJnS1UKzmYfhhYiwmeNvpqFWgJdU5ogN5COd4j1\nc6aJ0QrdU7fnKQrAeYTbUCm3Hb0M02pzPLUiYgJVB86Nwlp8u/5TQg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Q3lwY0RZVC96NWNQUkhC\nOEpFYURlOUlpZjZHd3hBTVJhOVQ5azAwZUJ3Ckt5bXRWWmttUXduWTBZeWJxYkh2\nQ01QaXNicEdTcFpENTJ6Ti94YnBnZ3MKLS0tIGxCZUQ5ZVJXdDZxUWxMQ1R0ZU80\nSGUwZkRuM2hnNWNCeXhsRG9MNWViR28Kza+JHzNBnoSXz63q6nPEP+Zg//S9kn0J\nZj2GEgaK5X/VENf16blgwMvXuY1xGj+s91X+H4ZLudIQD4b9i6lk4w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5bDdONmpwaC9PNFhYTGtj\nQm9RNUJoTUxPWG5BZkRqeGVRa2Fyd3VUQkFJCkRUZENaQndmcDhqRG9KSVNmN3VS\na1JlaWdWNW1lUllqa1hUZXdRTGVJdXMKLS0tIHNxUG5rdWwvTTQxeUhmbHE5a3Jv\nMy9jd1B0WHZxMHk0QXRIS0R4WlFUN1EKlSYbI89l0FaFSe2m/bTuccqP++0vNcBq\nbdD+Y0weyMuh9NvdbH+4wL2do/MgXNrGKKiBk8lIcwb6cUdbY5du7A==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-21T08:57:30Z",
-		"mac": "ENC[AES256_GCM,data:YV48MhAcKoE7BfYnAE4UrAl32Nv34KeliHuWhpf4hs5XE7675w/7nibYGOjgwLk5DO4HlalbRKHQzpxZJUHKZcWaNddc5k0rZIUm8is8n1B7MMA87Z1ZPuB5L/fRAhv9mdHCxBKL27X0FagiLxv5hZ1KXmxwu1HnP5s/V9+4ZlE=,iv:xqYactk9mfoMCyxtFUn/4iHdDsmtzxlntBvZjOR+p08=,tag:kF4bDKj7svRYeZvd5SwOMQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-subnet/value
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-subnet/value
@@ -1 +0,0 @@
-300:6f1e:6b42:c153::/64
--- a/vars/per-machine/rigel/inventree/admin-password/groups/admins
+++ b/vars/per-machine/rigel/inventree/admin-password/groups/admins
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/machines/rigel
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/machines/rigel
--- a/vars/per-machine/rigel/inventree/admin-password/secret
+++ b/vars/per-machine/rigel/inventree/admin-password/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:vhQqYi6Y3JlGVhf6S2W5zbaxCqK3zod1dzkIRQx3oixU,iv:az8ep1zGUauVTjmry5zvEj2eRmiJwcL6CTdtZcoc114=,tag:Tctee5xnbQohrVbNY7epqg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFYXZmYmdrU3pReCt3L2px\nSllxTEd6TVV3TGlSdkZ2dEw3NnRZTVVlaTFjCnliNGxueGhhNE94ZFZ2R3JTM1JV\nWVBjS3hrekVFNlNuSjUrakU4dnJMTlkKLS0tIEhFS2xnTit0UVozL0E1T09BNUYr\nNjE4S0NiSTFsNjFpMndKTVVHckJuNmsKmC3cW4TGNszcUSqrtIteYlPkhvaB3YdR\nRAFz3MKdDRFgfztxWeU10nolIaAqGNna0cz60x8dyB26SsU37KLY2Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbTJ1aytsbHF2YW44VG82\nYkdxTjcyQm1KS1pkdGJkRkN1QkdYYkljU3h3CjhDYlo1NGJ4YzRuaG5PdGdNVzBQ\nV2tFcWczYUNaaUdLMVJsRkFlVGdvMUUKLS0tIDN0Z0RZK2RyUnpSVVVMRklrN3R0\nVDRhUkF2MXJ4ajJvWnVRVFZ2eVZYNG8KMM8WNH4N0dHhglE8/gdXZhgCeaV3QTgr\nOA3UK41DSdN3T3FTEKYXQDxKo6wquTa7h+qAOjNrOmw8cQPoozMs/Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFphcTBBVkYw\nSlJiZTE4a1FrNlRrWHErajBqYStTNVZXRm12TU1xcGNoUWsgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo2Y0l0Z3R2cnZaUjFSWHBqWllyeloz\nOGd3a2hFdmZJZnR5cVdFSDNFTWhrCi0tLSBxaEE2L3AxUUdObkRWR0kyZnZjcnBF\nWFRqaFZnUFVxd3FSZGxJUk9rOHZnCpOZuxpY4cZYHgC4adHjP0B8sWPGgZa4ec7e\nGS58MieJY5AMj7/e4VKnbFtlM0W7Tf93WxMo6w8sAQg20EbsoKA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFBjMWVTZzF1\nQ0V3bi9Kem0rQXBlekJEZTBtUnNhZ1ZXSjU1RzRuSlV5M0kgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp0ME04YXJNWDBtSFNvWDBEbDhVR3NP\nQ2RTUUlnSHNtT3RRS0dVYXg1NFlrCi0tLSAweXY2TVU1UC9RRG1OQjEzcWs0djhv\nQjFncElmcENDUDJ4ZUtXZWJudmo4Ckmy8991Lgn6vWb4CR0Gn6BbKqUhwFf/xWAt\n1DN8YjHe99ZK09iBdeHAqPxpert2+oQG9RhGA8eF0LIw4Pfnd1E=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIERvQ0hRRGYr\nQmJ1eHQ5M2cwWVFMdnVnWUFkUlNoYno3K0NxSXNTWHJOR28gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4aHpWdUVoU0tGdTl4R3F4S1hBbVdM\nWUNGOExWSzFvN25Xd09lYURlOXZNCi0tLSBVNmhYQVBHNXROa0RsN0xTZTFBR09H\nbnBGU3VHUVFDRklaRC9wdjJpRnRZCmIOmLm0FPiQ1FyXBreD5H6Nbp6MddvDKvJF\nX3Ix1tZNH0zUiWRVInYmO5MlXT/3/ADXEnGa7K8rpNpjyfBzI50=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwK2JIVjFwY1JSMUs2MkR1\nL0taSG9aR3loVmk1eTB3YUhITVVtMkIvR1FjCkdYR3h6WHNXZXFXWktGNU5vMVJv\ncXRHOEtDUHhCcVQ5U2FUOUVwU3dIemcKLS0tIE5oVWwrME1RTEVEVms0eGRkRG02\nbFNRNTcxNlJUbWs2eFg5RDFvUHRoVk0KKONQVhmhiNH+tmOs1l05ynzDHPJhEX9/\n0lr5vf8TuEoam9M5VTkzo2nL5p/oy1o6GSa/TEcHWPLuti/k6ub3QQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0NGRZVDA0Rkg1RTU0ZkZx\nUENJWklRLzg0c0JjdGJIU0RGMWZ2SXZqd0VVCkZPQlhsT1V3bk0yd1lEaDNLcjRv\nVU9kRVIvY3Fkc0ZoQ1ZVR0lDa005ZjAKLS0tIGo2SlZ4cGhGWHpvWEhoRnRaUi9h\nOXRvZFJnUFFXZUZnVVNEVThjUFJFTVUKQZ41dQF80MvrjhQ/XJILb5q9zLDa1XHE\nroQj7/ut2rPdDp51YY3qYC02Z3Rz17uJp+hwL2LNeKAu+dCcbPsyaw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQWJQR3c5WjVSeG1TRE5i\ndGIxL2ZpSU50RjRHL2c5VkE1WXBTcmVuY2dZCkhacXllcG1QZWpicTM0WFphb3JF\nZ3hjU01TVWJpclRpNjBmZDJxL0RvTnMKLS0tIHpvNElxQ1libTFlbnowMENpeUNh\nUUgva0VkUnIzUXlWSU91S0JpcG5hQ0kK9S3W398e82mKaBzrmZUb8mQjGsg8khQ3\n7k+M0wa6fXM7Mib5mtN8XAuw9exvGfhZNhLm7AcXnN19G8CRdm5kUQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFYlpIYzY2VC9uZTRpbjhL\nT3lJS1NnR1g4ek1xQXcvSkxSNCsrMjFOWVc0CklGNGFTM1UwUWp3QkM2U1BXMUFq\ncm1kRXF2U2MyRWEvQkJBSlAyOXdiZEkKLS0tIFBNeGpiK2M4WFB5L3NHVTdPYzZW\nc29HVGxRMTU3eTc3WHhaSUl4anpnSFkKC+4C5JXGTozFfafA3p+EpDGkdzFDr4WU\nvjgANppwnLzB1yb+f99ZCQjsYHTkfhqSk96meWWk/I/HHdWBQG0mYg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-10T04:29:57Z",
+		"mac": "ENC[AES256_GCM,data:VbqZK9fbx+OTXk072otY3cu8UVdxHT6ASLGYuVlDVJH/ggzF9yxiRcwOXIjxRx5ERaowE8LF1U0pi+vBWs2mRT/hXf3mF17dFAAY9uO/OMIRlcDJkOqjiKmqehgRBZj4efTAfCQKuwqf+Lqj3Aqcoy0c3oYCjGpmDUNxb4E0aGc=,iv:ARHWNe+DFBMa7JguY32EDrWMB67/CMeepQLQ98jfA7M=,tag:Htelx3JuI4tOKmyBJqz9ug==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/rigel/inventree/admin-password/users/kurogeek
+++ b/vars/per-machine/rigel/inventree/admin-password/users/kurogeek
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/groups/admins
--- a/vars/per-machine/rigel/inventree/oidc-key/machines/rigel
+++ b/vars/per-machine/rigel/inventree/oidc-key/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/inventree/oidc-key/secret
+++ b/vars/per-machine/rigel/inventree/oidc-key/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:P5B7geqtu4wRT6QQKdDH03uYo61O57gl7Bnom8P94SAO,iv:ZiamWCRaWnlJWsngrJrBDR4lgkEM/DO9435pmw8umKo=,tag:4fWAFOJOTxu2WgCx6bA3Lg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBQSs0NzhSTEdTS1QyWkVJ\nVDZ1Lys0TWYvR3l3RDFTZUc4YnZ2OU5ra2pJCmtYQ0Z5NjQwSVpOWlBGZXU5Y28r\neEkvVWIrVzloVWU1VndrNnl4VUk2V28KLS0tIENScHN4Z0UrM3JJL1RJUHdic0l0\naExjM09VQ0dSRThwSk1BQmpkM05HZUkKtoZ3prC5M61KUtcIV0i6EGVPshI7/wfa\nFR3ur/cMQkhiEOOLNOOcFxkw1AtGb2P0+t6wvY3EA4Cu4Axtlf9t9Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3VDF0NzlZbllkbFZmUXFV\nVUxsQkRXTmJObnlaNk10OWNrOFlWYjBpRkFzCk8wVmcxb0VJMXRUcWRVRVk5b2Zm\nOE03cHVTdVJKK21XcXRhUnBOMTR3bVkKLS0tIGkvWGQ0azZQQUs4VlZESTh0cjdL\nbm5DWVhGQkVZbmNVenc0MEZ4bnB1U2cK0KtmmFTdUw6ryUDKxLD7Tjs6zFkppfPQ\n+8aFo3hC49YTple5LUFyf9dkVEYzTYOY1qnNmvYGRwcd4GqrsVxGkA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxGSGprUDZT\nVUhreGZIVjJTRENGV3ZlenVTNmVVY2NFc0tUbEUzQmZVM2MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo5eU9QMElTczRucFNaR2VVMmR4VTdF\nTGlZc01TRXk5NnJZMncxbEZ2Q2lZCi0tLSBZK2h1bUNrMW5OaE4zaHl3S1ZXMmoz\nWmZUZkk0U0NNRmJWREIycFd3b2RrCtDYK05B1lmubH/Nf1lpeBkrtdb0RMinSZBu\nAEF27OkqPjFhU24muDx62lsuc27z79j0Xywu8Ia+1YRapwvEbh8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEVTTnN1UnRu\nY1UyNmJPNlhoM1VmZjd6SlFqbHdJUFpiOG9PUUs5bEliQ1EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpZWVBQZ2RtMCtuamwrMm1RZTR1R1B0\nTmEvMGpZM3YyRTY2SW5zMGczOWFnCi0tLSBySThqMldSQ09LUmZYcVN0RjVQVHZJ\nL2lNNnZaRzBsRFJVMGNscmszSmtnCv/qtno+YEI0kytXSbOeASuWmI7a3TK2s/G/\nUkEN9WJn1QWCuBUla6MzIk98BFJ17yOkhKUpyipf7or3t2b9MQk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEZZV3B6TVJI\nWHJ2OE0rQ09rOWMyTFJGbXo3UTlveXlLaUFwdS9ZbVBhVWMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwoxeXZSUmp5djBMT21SZ1RhYzBEWllq\nSjNZL2tUQ3VXdWlyRGxhb3B6dWpBCi0tLSBybGNnd08yVmR3R25tYWRtb2N1bzZw\nV3N5dmVlcDNLcDVITXlubldxa2VFCkpsJjjbx1EIW0YmOHgXhk/vlg6IGPy3KZgp\neBranomSEeTzcBJFbilaFqUXsoBVZgetUKjGem87ssmZJaZ3Yqc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDSkc3U1Q2akpmMFdrVkE3\naGl2MkFuS1hJYTNsaElHbWMwbTF4OCtHSDJZClZwbkY1WVB6NUlpVGt0ZExSd1d1\nM3YvZHFFTWlTTWt2RjQxRElQV2NCaE0KLS0tIEl3R3h5UW1nR0ZuSEFxUTFNcEha\nWUorUmhFR1JieWJKWWIvaStiWm1DcFEKm3o6YgtGAyBE4kX/OAzEJa7eCKMSwlvO\nFTPjz5UfwZ3UUlCKxCO5VvYZO36uxI35DJnxaQhyboWYRlT4Gl2kZQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLaHFxSVdoYWNQYmJVNmUx\nSnlzemdnNzlCanE3U3BFLzFORForQmdWOVdZCnhxVkhBL201Z1FYakEveU52Tytu\nblFieVlkVFRKbzVub3UzeFdha2Rndm8KLS0tIEkwOFhHTDY5ZkJUWXV3TXpML1B1\neVJWUS9HeGNkNm1EelRTcktLWExVV3MKp/eAeidlL7eybWnnqxFFOKaAQ4gvTORv\nTWKPo5WeDTP7+57sW8f2PlSkLkLYiwtEqg7pBkCYlwV2C62e8I4GAg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvcGQ0ZC9nL3ZRa2w5RWtG\nS20zdWhjVi8wRlZSZWIxUTBEdHRGdEk1azBNCkFRcjMvbUdaU2hhOXZXNWlFbVpZ\nRDNWNkFyZ2h3T2E1WEFITEZmWXNOOE0KLS0tIEdkMmk5aGJaVVAvVkRMWFdVMW1o\nWDdEcDBwR0VzNnc0MDRVYnBrTHU3OUUKK5Ez0n9N+wuvqDG4uxfeiMAfoI4fJlUX\n6vVoTYvcHjS1nB9NEX6ZyYZ6mMo9awQHWaKzQXt0X2iKSAJrkfFHag==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhLy9MMDY2TzNnN1paUUIx\ndE5oK25rUUNJcUoxcVA3eWNvcTF5dzZLS2xBCndmc3pURmU3OVZ0Z3VpQitlbDBl\nZjN1emxTSnZMUEJFdXNQZzJhWm1ydzQKLS0tIEl5eWpHQ3lXdEJaU01Kd1lnK3dt\nNGZSeXdXVjFEb2UyYXBnYXdkdHBNbGMKgjh+mMRpIrc1CgTVMVNQ5+5F7xCbuF/J\nnjx+hrOD3OjXyt3Z8yGqqL3IWQGDUPCdNExg0IIl000TioInB/Kg5A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-10T04:29:57Z",
+		"mac": "ENC[AES256_GCM,data:iptYfqbqq7tb0J+heUCXdVvR8Z/gppvLlQx3Tt6/o5np/3OiQwe16guqM3yraWjU9kHRJloxKN68HTcIjG3CXbcp/QakawWqw1l5dF7mH7Pm+guhxaa/J1PBeySOiKEutaNUFXs/O+o8pbUbb7+lEVfZJWa1HATrn5L/nkuiFd4=,iv:QK9EEW60WKuAhxT08OEHJ8dm4XalOhpNwhYQs4ErQTg=,tag:EOxtXRx1dAOX+spU69hm5w==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/users/kurogeek
--- a/vars/per-machine/neptune/root-password/password-hash/groups/admins
+++ b/vars/per-machine/neptune/root-password/password-hash/groups/admins
--- a/vars/per-machine/rigel/inventree/secret-key/machines/rigel
+++ b/vars/per-machine/rigel/inventree/secret-key/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/inventree/secret-key/secret
+++ b/vars/per-machine/rigel/inventree/secret-key/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:rUW/myRBc+qXzfKz5QKrCZhbpNPtiXmRYJA/HjTB9NYM,iv:vjooDGiODUzw70SL0Nx65gPr1yuCa3DWgLvf34J8aUM=,tag:6scAl8xXdhhgFgtZf00VHg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQ3R6Z0U4eFFSMDZaeldC\nc1ovcGh1Zzhud1Z0cnJMeTZvMjJrMytGTHdNClQ3LzVJWG1xcWpjMWRBZFU0cWtq\nR0Z0dFZqU0RMOFBEcWhRb2VZNWFhN3cKLS0tIHpsYzFRQ0Mva2NGNmZFcnZvWjBN\nOFlCTjRJMFl2Ry9rODV0czRIL1VUMWcKJyQx4Z1JR0emXfUX4cElNhnznLHjSdq1\ndzYuYrg1PT9mJPkFVe5TbKJdiuYdV60X3EwA7vLPOUhs/R44Hnh3Qg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuU3Q2cGp0SjVBQW5QT083\nY2RpdWEyUjdiR0RXMUNrUW0wcW12bnRhOXhzCmp5YUtTWXZGYW91NUIxQ1puaEZp\nWGJNTTladys1bVNYY2hnRUhkT3BXajQKLS0tIE0reEVRN25YOW9lbk1abVNzclho\nUm1RbzUweXVma1YvbHdTRlgraWZucG8KW5UPHie6Cc90093GznUceiPGScmwSoo0\nHE5S+SpOltWUx6ZtGJhxwxWG9G5Puh2G5wLRGKA7zIbp0GdHbNxSBw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHFySzRuSVdy\nRGNQdldtR0ErczdMbFRiTnRYK25pcEdOMWU1VGUwK05WSE0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpaTHkwaXZjVTVIbVlDbDdyWHlubWY0\nYWI2KzJOR3hkTE5iamUwUUg2SWFVCi0tLSBSaUxRQUVTU3hLbUZGZWx4NEtEZUJT\nSXYzQ2NJdWR2TUNMenNtSmxTMktRClu1+Vb/C3OKnbETl9Lu9ljkGVXLhpwAuWmt\nEpnmsaZUKvKzI71Nvi9ga8Mm22tEX3nb9e0BOTyfYneia5OTcSo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGtmVyt2U3Ji\nb0VVck9kc3N4RDQ5MVg2blNoN3ovOTRxZEc0OXlnWVBpa2sgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpTTHh4dDFwN3d6cXFVa1hFUVdvZnFC\nR3QyQTlwMHFyVUJ0c090djk3T0pjCi0tLSB5dGtPcTZNRzY0QUpKR05jUUQ3ekJ3\nUnVnSXZvRUI5TWhwOUVHamltQThrCr4RImXCVs3nlSQxTz/rDOFOox5UNg47g8Uf\nlnMfZUKVATvSy7aGDDpyRf+E2LjwNkLdinU3mLCQpf3gz+3PEdY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9VZTRSQXVt\ncWh3VXRiMTdFcEpqZDlOV3lSbjV5b0NwMVdlMkQ0OFJtU00gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpWa3p0cC9EL1cwS216L1VrQXpTMkhn\nTFBCR2pqQnkxby9nd2tNM0ZRM3NjCi0tLSB0L05wemNPK3pIYmlGVVQwaXpiaVJZ\nckx1clZYRjVPTWNiNkNmQ1dxZ2xNCn1KmNtFL2JgthpvIj/Afzqe+CQN8Y/PKATT\nesnocGA1MNbHDbuqstvUJvpPz+W1AIqcjiYPWe46/JzOpfWrmRQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmNm0rSmNadWFVdHBxbnNs\nZUNyZXVMWWcvTGpwaGVjM2ptZDBHdnE0TVRjClk3UXJwRStCZXpXbHBPdHA1bEpk\nY3VvcEQyWC8wc1lsV1VvSHQ5N0xQMjAKLS0tIENtK1lwcFBteG1nWnBBb3hjbUpT\nOFprVmhRb3JKbTNrSk5lb0tNL3ZqMU0KLa2yxF93r+4WXpNavoxLV4sJx5VDb2mX\nLuHWJHBce1b9fM+R1Y1WEan8OuWKFjI3ufZO9sOP0A0IYrWcYBJgug==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2aVk3aFBuMDJTTW55bktO\namYyRGRBQlh3czV3K1ZZRUt3Tkw4S1MyNW53CkNBSDlPVWZrY1FCZHU0a0JrRlZU\nZzIyTG5RMkhKQzFLazFmMFUrUDZMMmcKLS0tIE9ybTk3S2xhZ0N4emNkU1JjOXpD\nWmVsZUZ2aGVPdnlTeTR3TzgweGNPb0UK7aObkq/KV+348KYWyXCEZ2bvtdVEYxHs\nESnAr/vZCfNvBrqS2qlJx17zYuEDc4V63ym0KqRqhvhsXS+OQgvZgQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQ05HdS9telBXaU1ReUFz\naENSZE5haGlWWG9WVEJ0UzRnOGdtdjBxUkU4CmF3MDVXZTNSNkFtUkdKSXEzUWV4\ncS9RWkNjblQ5b3ZVb0k5VnczMFZtejAKLS0tIGM4UXdTK3FJUHErYStuK2FIZTlh\nTkU2RzE2eUttandQb28xc1UyUG1XQ0kKizb01CPcQEJMZTGmsN5jwBH9IYaLATcH\nTyW8IQMwFv72TajMnZenNFzfSYIiiNkG3LrqNuLijr2oB9luN+pRJQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RGxxUzBET3RUeG53RWtE\nY2ZHWGNoQ2FRdDdjSmFlL0FXYXd6aDZzVUQ4CnJjajlKLy95SlY5TXZ3aG1sb21M\nWkpOalJoTHBPTHpiU0g3VFEzRWNRQUEKLS0tIFBEOGlUei8vaEtJRmlBZzlYa1Rj\nbTBmZ0NaelRBYzloSmx4MS84cVpYak0KuOnfskwLSRko1RlXjRx1g9zRTMzvjG4m\nrHYNMVeo1SddZgJwLF3HuAk0gEypxFJ0j6JJNnQt4HhLDq/Nt+/pYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-10T04:29:57Z",
+		"mac": "ENC[AES256_GCM,data:SrY4j67349ESFOm3cKLMRZMJDln4YH1Rsvq+1IoRl28leaRcHGSLVmtbEDaOJaBlgaKy7B/aYgMyyoi1TEwXOP+vnGRrjFiPD8ZBtVqtt8jTlzQ41QSEtvT65pR41vmD3jx7/w5ZA3Evrx9BEHS1Q9xwccwemuMZpJz1GwJ0btc=,iv:+JTjMo+qWLuqTg/r4BwUO0V15UTtb2niGQzDrp7XKqE=,tag:1rubeggMWQ+SCKJMuuObig==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/neptune/root-password/password-hash/users/kurogeek
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-ip/value
@@ -1 +0,0 @@
-200:8572:6695:fdef:15d6:6c5:698f:3ba4
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/groups/admins
@@ -1 +0,0 @@
-../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret
@@ -1,47 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:1dMtSGsh6eNkg3U4ReHxGbrGzomkthx8mtui7E58pk6f15tj7hFWpa3IKwGMXgszMWdnfIYIKT/eImz57P3/2Y/goBYZFCY9NuQztuSJx4BVgKn5vHJyGTWPRoEn1wKq1Py8PFubmsGmqxCSdtzRjc3q6ASoE21aknzg1E6suGOgX/Udt+ClQftaTqqardTGH/+QzzWLgA==,iv:0IGBhwFZzgeF3Q3BKsPoPStuvtBo+59N2NHR3wUUgQ8=,tag:9+HPTQK8uu+eeRLkMkUKWg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSUkRPSDR2ZTRNYmFVRXVa\nWU5LUTh1amdmSDFVQmhzZUp5ZW9Dcm1tYm1NCnJsVHdTWUYzbWV3UkVVeWVDRWlD\ndGJHQ0JkMU9RL2dNZnR3Vjc1blBMNkUKLS0tIHoyVnJmU0lKTG5seWVKTlN2UmFu\ncXNPcXJUOXpzMzl0MkZGejAxZ3VGc0EKS8OAKVR1APSdneX2wG0kOLPAcQqk0pXi\nuyzQvir3fJLsn27tnQ28owTRRZ+bF8W4hXFOhhFKMW9I0QfCEcfWng==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYdm9tYk9WWEUxUnpsYTNa\nMU1oYlcwOHRNdHhHamlBcHFWbW54Z09sMkg4CnFocWFUVXlQd3U2cUxmK0pXL2t2\nWUtOMEpNdmZnSDFoRDRGejRXVnd2RVEKLS0tIHVuV3oxSDJjZGpkS1NZMHMyR3Nn\nUXlkMXJzcVhMbmVvU3ZvYXltUkt5dHcKR8vpS/UKyMJ2hbtkBisJhR40RQFgBOa1\nE6l98MmLTRqzXzWcGUtx0KJIn1N5WYzObLDL+Ozame5tPPyXh1LufQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9zSmFScVJi\nUkFjVGRUbmpYMkNxamd2WHFidHdZT1NMSDJoQitYSVRPd0EgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp2bXJqWmNDRXc2V3l0SVdVNlIwRWJQ\nMGhmdDE2c2VzV2hyTlJDNzQvN1A0Ci0tLSBpZmc1RU9JTExvNGhVeGdYL1llRnFD\nclFjR08xVkhhdURaVDIrUVlxb2FvCsGgkwtlSkVYuv5ryExZ4pPW6nhzSfRRWU3S\nONCdxRzFZvRk2pjQnAVh/kZjahUXnBkIVhcq1Q3eYA2lyXxct1s=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHpaRGZhSlBa\nOE0zK08vZVpjaCt2cGI2aU1TcGZXR1UzSit5U0c4S3VnMHMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpzK250Skh6bkhzc0NyM2lVeWs5T013\nVFJ3R2J6VU1qdGh4N24yQmgxamVrCi0tLSA5bVNrYXhnSVZnNy9ZM3hxczFMWWJs\nRitlWFcwelZ5cEFxWFNWOTBoVlQwCjEqDW9t4SvIF2Ssft+vpnIYQ/FqBGaC6MOk\nhJMa1SxEyCJ4Ey4w/3EzlRybAZpSOfrHKsYi81IjN53zMMuCk9s=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5ac0Njd0lJ\nQ2kvcVQ5dTBhUmV6eUk1cll2K3lydWR3aXQwUlVHa3ZlQ3cgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6TXdDZEJvREtYblhuZ1pXVmp3Y0RE\nZyswOWhXZ0owSDRFQW40WFU5WVQ0Ci0tLSBDVnd6R2tBS1Y2M2NWd1owSDRmOXdO\nbEtOT3BNd0IzcHo5azVaWnBnQWh3CtPclvQu9at0hYpBkRywzG+Ar399azaEM22K\nHTikQgyAt3hwnxanAa6DFEtK3mggHK9bUQeFcAZd2/jCYprpNsA=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTcnVBZ3Zid3NYdEdML2VG\nMDEzOFkrSDRuYkp0YThtKzBHQVRrRWlFa0VFCmIvQXRhRXNzY01hYTJiZkd0LzFS\nVm15K08zV3hzd0YvamhNNW1YQTVCTTQKLS0tIHYzNGptSkRnT2cwMUh4Ym44d0Ex\nd0owbzFUeTZUQmNNUHFEdzgyZ2NCZXMKm6vZhqi0LCyRZXNtF3M2pGfitexaBi9j\n5OuNC19YiNfTzLm0LRMuDjpzuypGJwzo3oSZH322aZNqvhgDfgx9WQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZWE1JcHJvU0pPMFRvU2tX\nejV3REdJUWxtYnk5VVlyR0doMVNiMUdGWFJNCmY2S3FacDRQR1FhOFN1c0dmOSta\nQkdyaTd4RnNYK0ZsOEhnUVEzdmhETE0KLS0tIFVSV2VFUmxQWGIyNWc1Mmx3cVhu\nZ0ZESURhcEc4cUw4T3haVVVTR1VuL1UK1YNbgSTxHAk9/5zuQ+44qSBR05Rx78Ln\n9g28PwfmccyizNNcuRVP71MOosATDS+FAkEIT02N+A8l3MeaSZ19Xg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5UDBQNHM2TzVKU0krOHZy\nRjl6cy9QME5GTUtxWU15K1ZrL2YvUjNzNEQ0CnUxd0tqNGxHVGZ5RWxLc3ExMEFj\nMGhzZm4rdFcwa2FBeGhvRUh5UnYveUEKLS0tIDBYQTdRQmhhVHR4U3d0amhJUnhU\nbXBPTCtoR1YrT2orQ1V2RkNlYkJuMmMKPD65HPvOQgPvuGp//PvDR/Pa87nTGeRG\n682MvdjUmDxLi5liRhoRvnMYN5P5aNP79/L5PSp0BrqDM1Dqxx8ZTA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3Z2lZcmhGSENRcDR6RVBx\nT2xLSEVleXJ3ZXZ6SkFJR0RMYzc0T0gybkhNCkthODZkbWptbnBKU1BpaVdBbGJX\nQTh6dU9CTlhDRjhaUnVxYy9yaDIzdEUKLS0tIGphcjBKREhPc3NHYmZMYVpLbnpR\nMEQzME05VCtxWFVQcVlCUXZEdUh0UlEK3PKmi8lZAFP80wbdjkXjU0a2xjw9xX9b\n5eGV53ULQXMpWaDHwpjYMxxi20bDjEVOgzphrhxyJt3hy+kSNBYN7w==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-10-21T08:57:45Z",
-		"mac": "ENC[AES256_GCM,data:bG7lqye0VqkkK7wtR8zoGqJPuphSOYw7QVNqxq7q0dr35yVjesGkJ7Y74+D/1qaeUXKbWnrDTGIAqYfdHXrWuyIuc+Ry77PA4keKFGbaa78GKuvUXrW2dTDd2G02YDGavpsYKbP1qUumPYjZ5NLkwZnHEo5GHRbdfj2l4AYrTEw=,iv:0qu47k2G/Yt99nGhz3fL6ScjScO11CdDLbU79Xkl08E=,tag:31lBmsiBRY4akCQTPIZ66w==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -1 +0,0 @@
-../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-subnet/value
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-subnet/value
@@ -1 +0,0 @@
-300:8572:6695:fdef::/64
Author	SHA1	Message	Date
kurogeek	31858a7d80	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/nixos/inventree/default.nix	2025-10-10 11:30:04 +07:00
kurogeek	8d9b257db7	Update vars via generator inventree for machine rigel	2025-10-10 11:29:57 +07:00
kurogeek	61a875e438	Update var inventree/admin-password for machine rigel	2025-10-10 10:00:24 +07:00
kurogeek	a6707fd610	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/rigel/configuration.nix	2025-10-09 17:23:24 +07:00
kurogeek	1573a18d5c	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/nixos/inventree/default.nix	2025-10-09 17:22:20 +07:00
kurogeek	875c1bdbdb	Update vars via generator inventree for machine rigel	2025-10-09 17:20:13 +07:00
kurogeek	7c98ff800b	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/rigel/configuration.nix	2025-10-09 16:57:33 +07:00
kurogeek	1df60c35d9	mob next [ci-skip] [ci skip] [skip ci] lastFile:vars/per-machine/rigel/inventree/secret-key/secret	2025-10-09 16:42:56 +07:00
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE09U7Tuvn3/icqFhjKuhp4hG+V6E6IFKhX1W2hVvyVj`