mob next [ci-skip] [ci skip] [skip ci]

lastFile:modules/clan/yggdrasil/default.nix
Update vars via generator yggdrasil for machine b4l
2025-10-17 14:22:36 +07:00 · 2025-10-17 14:22:09 +07:00 · 2025-10-17 13:15:08 +07:00 · 2025-10-17 12:42:02 +07:00 · 2025-10-17 12:11:58 +07:00 · 2025-10-17 12:08:01 +07:00
107 changed files with 5656 additions and 47 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-
+run-vm-*
--- a/flake.lock
+++ b/flake.lock
@@ -136,6 +136,24 @@
        "type": "github"
      }
    },
+    "liminix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1760426231,
+        "narHash": "sha256-r8c5PKtsxAvtQ/k17GH+WNvP47Lr+AbExLMPdLtvAKE=",
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "revCount": 1574,
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
+      },
+      "original": {
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
+      }
+    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -207,6 +225,7 @@
        "devshell": "devshell",
        "flake-parts": "flake-parts",
        "import-tree": "import-tree",
+        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
        "treefmt-nix": "treefmt-nix"
      }
--- a/flake.nix
+++ b/flake.nix
@@ -21,6 +21,10 @@
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    liminix = {
+      url = "git+https://git.b4l.co.th/newedge/liminix?ref=refs/heads/fix-gl-ar750&rev=3f1f7c08d440130cce9262a93ce78ed7969d93cd";
+      flake = false;
+    };
  };
  outputs =
    {
@@ -38,6 +42,7 @@
          ./shell.nix

          ./machines
+          ./routers
          ./inventories
          ./modules/clan/flake-module.nix
        ];
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,16 +1,12 @@
-{
-  inputs,
-  self,
-  lib,
-  pkgs,
-  ...
-}:
 {
  clan = {
    inventory = {

-      machines = {
-        rigel.deploy.targetHost = "root@rigel.local";
+      tags = {
+        glom = [ "vega" ];
+        b4l = [ "rigel" ];
+
+        fax-bridge = [ ];
      };

      instances = {
@@ -21,74 +17,102 @@
          };
          roles.default.tags."all" = { };
          roles.default.settings.allowedKeys = {
+            "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
+            "davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
+            "vi" =
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387";
            "kurogeek" =
              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
+            "matthewcroughan" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo=";
+            "matthewcroughan-1" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo=";
+            "matthewcroughan-2" =
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo=";
          };
        };

+        glom-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."vega" = { };
+          roles.peer.tags.glom = { };
+        };
+
+        b4l-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."rigel" = { };
+          roles.peer.tags.b4l = { };
+        };
+
+        yggdrasil = {
+          module = {
+            name = "yggdrasil";
+            input = "self";
+          };
+          roles.default.tags."fax-bridge" = { };
+          roles.default.machines."b4l" = { };
+        };
+
        pocket-id = {
          module = {
            name = "pocket-id";
            input = "self";
          };
-          roles.default.machines.b4l = { };
+          roles.default.machines."b4l" = { };
        };
        nextcloud = {
          module = {
            name = "nextcloud";
            input = "self";
          };
-          roles.default.machines.b4l = { };
-
        };
        stirling-pdf = {
          module = {
            name = "stirling-pdf";
            input = "self";
          };
-          roles.default.machines.b4l = { };
        };
        actual-budget = {
          module = {
            name = "actual-budget";
            input = "self";
          };
-          roles.default.machines.b4l = { };
        };
        victoriametrics = {
          module = {
            name = "victoriametrics";
            input = "self";
          };
-          roles.default.machines.b4l = { };
        };
        vikunja = {
          module = {
            name = "vikunja";
            input = "self";
          };
-          roles.default.machines.b4l = { };
        };
        grafana = {
          module = {
            name = "grafana";
            input = "self";
          };
-          roles.default.machines.b4l = { };
        };
        pingvin = {
          module = {
            name = "pingvin";
            input = "self";
          };
-          roles.default.machines.b4l = { };
        };
        paperless = {
          module = {
            name = "paperless";
            input = "self";
          };
-          roles.default.machines.b4l = { };
        };
      };
    };
--- a/lib/auto-accept-zerotier-members.nix
+++ b/lib/auto-accept-zerotier-members.nix
@@ -0,0 +1,21 @@
+{
+  memberIds,
+}:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  systemd.services.zerotier-accept-external = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "zerotierone.service" ];
+    path = [ config.clan.core.clanPkgs.zerotierone ];
+    serviceConfig.ExecStart = pkgs.writeShellScript "zerotier-inventory-autoaccept" ''
+      ${lib.concatMapStringsSep "\n" (zerotier-id: ''
+        ${config.clan.core.clanPkgs.zerotier-members}/bin/zerotier-members allow ${zerotier-id}
+      '') memberIds}
+    '';
+  };
+}
--- a/machines/b4l/configuration.nix
+++ b/machines/b4l/configuration.nix
@@ -1,7 +1,7 @@
 { inputs, config, ... }:
 {
  imports = [
-    (inputs.import-tree ./services)
+    # (inputs.import-tree ./services)
  ];
  nixpkgs.hostPlatform = {
    system = "x86_64-linux";
@@ -12,6 +12,7 @@
  };
  networking.fqdn = "b4l.co.th";
  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];

  security.acme.defaults.email = "admin@b4l.co.th";
  security.acme.acceptTerms = true;
--- a/machines/default.nix
+++ b/machines/default.nix
@@ -6,6 +6,10 @@
  clan = {
    meta.name = "NewEdgeClan";
    machines = { };
+    secrets.age.plugins = [
+      "age-plugin-yubikey"
+      "age-plugin-fido2-hmac"
+    ];
    specialArgs = { inherit inputs self; };
    inherit self;
  };
--- a/machines/rigel/configuration.nix
+++ b/machines/rigel/configuration.nix
@@ -1,3 +1,16 @@
+{ config, ... }:
 {
+  imports = [
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 }
--- a/machines/vega/configuration.nix
+++ b/machines/vega/configuration.nix
@@ -0,0 +1,62 @@
+{
+  inputs,
+  config,
+  ...
+}:
+{
+  imports = [
+    (inputs.import-tree ./services)
+
+    (import ../../lib/auto-accept-zerotier-members.nix {
+      memberIds = [
+        "dbe44c0287" # Alex-gateway
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
+      ];
+    })
+  ];
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.vega-public-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base public domain for Vega machine. Default:(glomglom.fun)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glomglom.fun" > $out/name'';
+  };
+
+  clan.core.vars.generators.vega-internal-domain = {
+    files.name.secret = false;
+
+    prompts = {
+      name = {
+        persist = true;
+        type = "line";
+        description = "Base internal domain for Vega machine. Default:(glom.newedge.house)";
+      };
+    };
+
+    script = ''cat $prompts/name || echo -n "glom.newedge.house" > $out/name'';
+  };
+
+  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
+  system.stateVersion = "25.11";
+
+  # security.acme.defaults.email = "admin@b4l.co.th";
+  # security.acme.acceptTerms = true;
+  # services.nginx.virtualHosts."${config.networking.fqdn}" = {
+  #   enableACME = true;
+  # };
+}
--- a/machines/vega/disko.nix
+++ b/machines/vega/disko.nix
@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-CUTB42_0x95d14f9e";
+  vdev = [
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5RYRG"
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYD5S02X"
+  ];
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/vega/facter.json
+++ b/machines/vega/facter.json
--- a/machines/vega/services/samba.nix
+++ b/machines/vega/services/samba.nix
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    GLOM.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "Glom Vega";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -0,0 +1,54 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "yggdrasil";
+  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        pkgs,
+        ...
+      }:
+      let
+        user = "yggdrasil";
+      in
+      {
+        clan.core.vars.generators.yggdrasil = {
+          files = {
+            yggdrasil-secret = {
+              secret = true;
+              owner = user;
+              group = user;
+            };
+            yggdrasil-ip.secret = false;
+          };
+          runtimeInputs = with pkgs; [
+            yggdrasil
+            jq
+          ];
+          script = ''
+            yggdrasil -genconf -json | jq {PrivateKey} > $out/yggdrasil-secret
+            cat $out/yggdrasil-secret | yggdrasil -useconf -address | tr -d "\n" > $out/yggdrasil-ip
+          '';
+        };
+
+        services.yggdrasil = {
+          enable = lib.mkDefault true;
+          # configFile = config.clan.core.vars.generators.yggdrasil.files.yggdrasil-secret.path;
+          settings = {
+            Peers = [
+              # US Peers
+              "tls://ygg.jjolly.dev:3443"
+              "tls://[2602:fc24:18:7a42::1]:993"
+              "tcp://leo.node.3dt.net:9002"
+              "tcp://ygg-kcmo.incognet.io:8883"
+            ];
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/yggdrasil/flake-module.nix
+++ b/modules/clan/yggdrasil/flake-module.nix
@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    yggdrasil = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.yggdrasil = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/yggdrasil" = module;
+      };
+    };
+}
--- a/modules/clan/yggdrasil/tests/vm/default.nix
+++ b/modules/clan/yggdrasil/tests/vm/default.nix
@@ -0,0 +1,41 @@
+{
+  pkgs,
+  ...
+}:
+{
+  name = "service-yggdrasil";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        yggdrasil-test = {
+          module.name = "@clan/yggdrasil";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.yggdrasil = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("yggdrasil")
+
+    # Check that garage is running
+    server.succeed("systemctl status yggdrasil")
+
+
+
+  '';
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+    "type": "age"
+  }
+]
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:pGMobS67sLp2GN2Xw7A/trcLYnQdVZCUbjtlwS/AShXxyXgHXzkqRee6R765GZyCpDwM8A1IuMZYctrqWxVXrpIAiJpwvwy7vDM=,iv:ysRf5xAXN+dFSx+sFHNDt1GcVQx7RLej4c12v60iSI0=,tag:yXYpWhWLdsz9BOOoKpZU4g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UmhPdzcrSnFhVUxRNDBL\ncXlGRzdMdWxCWmFlUkE4RnJRQ3psMlBqV0Q0CkRjTXFoQitQbjRhMlVjaDc3UDN1\nR1hBeXlCeWxvdnZoVWI1ZkcweHF5VncKLS0tIHE4YVFhYTZTNko1MnJINjFPYXh4\ndlJJZThGZ0JIaDJWRTNXbXk3alNZTnMKgd+0535zoTu6xW2778uNReu4Z7LStN6d\n1O9SXAB+s1iOZ3xGEICiQTVF/6p8RE6lheV2oXgoMiXXrFNH6INLsw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:34Z",
+		"mac": "ENC[AES256_GCM,data:YIpKJlOI6ASgOYqv9ipu+T3c+PlM5HwvdFVH8gh8hVeSbmxD1baPPmVSWlLv+u61Q1/C9PK4mczaASopaGiLoswep+Hc1Gn7sSeP9wO6Djx6fEIEyE1VUhUbTqi/nHYiB21yB/wegfpqzNYIn1nO0oFCmDmSS5qIowcT1fhYIjM=,iv:lzxll5oC7poLvC/hZPexUGAcAdf67xZGRXUpj6O3p6Y=,tag:9xu17Y5MtW5XNzGBsWwA3g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+204:5ce7:aa27:579b:ec90:6907:4ddc:177
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:I6yalWQ2u5hI84lJTUmh07JxUBp4EZukJrSGSN7wsGiUGlFa1v/RT1XkTiXuRjDtUVYCLmQmfSCAp/OqFscxF8KL+s24iTDrG4e3S6AeKLa3oZrNJIt1EJ06gWrPNoh1ttmwXSd4Y4Bsk4Lg8vIjH4qw3Bx+KrufxYTqe+anfMdoXKnW8wOWud5O7HMvCh+sf4dNcf6PIQ==,iv:SF5qExXNPyif+LIcNhHP0PKELUBXaFsPj9B3wvUkEp0=,tag:QEkZXDrIdcpNiZ6l2ljOPw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENDhrWVRuYjRnZktROU4v\nSHNtODFGMWl0NDRHazIwcWl0WGtNY2dYMXhnCmZQQ0doS3BTaU5hRHVsVTB5THl1\nWUNDQUNiMVJFeFZnQ1ptYmFQdTJQc28KLS0tIEtJdUQ5Y1VqSThkSVVNcVNVNEFr\nMzBCRjM1L1V5TngrZG5rR0VHY3Z6TDAKPQ6P96upDeh8xwQDrX4Zcf71Dah5zkOJ\n/F5eODEBadzQSRmJuyp3+uRMFf47eR6Q5bVah3NsVxFquXOL3CtNlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHb0EwT2tuMVE5SE5XaWdQ\ncGR0bFFhOUQvM2dGUzdlUEFFbzRnTHBWWUVnCjFGTXcrWW1vR0x5dXBUamtkS0dF\neG9weUVwQzhhNHhPRUdqV1VnWXJyNFEKLS0tIC80b1ZqRGFOenpENDN1Vk5vRUhY\nVnJzZ1Q5VzZ6ZEZtZE13YjQ0VVhrTTAK5y0BjKBRg2AXuO416JWLMLyM/pCQChKn\nVKZMXcT6cc5hHDuqbp9qUofknF68XnzlH6nOyLB1ZtnELyeZuf29fw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:35Z",
+		"mac": "ENC[AES256_GCM,data:Y3k83RaeX64LA3rsIkQxyKw+LLUgXVsqr3F2UHkv9h73gkyChc6k1oE/FLR4CsZZWsfLNjCkPMuenqToA2mKqQK0aADwPDYo0aVm0hr1PGX5j3Py6EmP56NFvxlAQsExRWo32eqdkeCkY23hfcmUYlaB+bo/fsrRVj67zag9GYA=,iv:p18i8cV6jKXpuZ1Xd7KYCl8BMe1/8CW9YnCuVrTAqy0=,tag:IJnLzdZOn8Clu+lCKT6zvA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/routers/default.nix
+++ b/routers/default.nix
@@ -0,0 +1,9 @@
+{ inputs, ... }:
+{
+  flake.legacyPackages = {
+    whitehouse-router = import "${inputs.liminix}/default.nix" {
+      device = (import "${inputs.liminix}/devices/gl-ar750");
+      liminix-config = import ./white-house/configuration.nix { inherit inputs; };
+    };
+  };
+}
--- a/routers/white-house/configuration.nix
+++ b/routers/white-house/configuration.nix
@@ -0,0 +1,120 @@
+{ inputs }:
+{
+  config,
+  pkgs,
+  modulesPath,
+  lib,
+  ...
+}:
+let
+  secrets = {
+    firewallRules = { };
+  }
+  // (import ./secrets.nix);
+  wirelessConfig = {
+    country_code = "TH";
+    inherit (secrets) wpa_passphrase;
+    wmm_enabled = 1;
+  };
+  svc = config.system.service;
+in
+{
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/vlan"
+    "${inputs.liminix}/modules/ssh"
+    "${inputs.liminix}/modules/bridge"
+    "${modulesPath}/profiles/gateway.nix"
+  ];
+
+  hostname = "whitehouse";
+  boot = {
+    tftp = {
+      freeSpaceBytes = 3 * 1024 * 1024;
+      serverip = "${secrets.lan.prefix}.148";
+      ipaddr = "${secrets.lan.prefix}.251";
+    };
+  };
+
+  services.sshd = svc.ssh.build {
+    authorizedKeys.root = secrets.root.openssh.authorizedKeys.keys;
+  };
+
+  users.root = secrets.root;
+
+  services.resolvconf = lib.mkForce (
+    pkgs.liminix.services.oneshot rec {
+      name = "resolvconf";
+      up = ''
+        ( in_outputs ${name}
+         echo "nameserver $(output ${config.services.wan} ns1)" > resolv.conf
+         echo "nameserver $(output ${config.services.wan} ns2)" >> resolv.conf
+         chmod 0444 resolv.conf
+        )
+      '';
+    }
+  );
+
+  profile.gateway = {
+    lan = {
+      interfaces = with config.hardware.networkInterfaces; [
+        wlan
+        wlan5
+        lan
+      ];
+      inherit (secrets.lan) prefix;
+      address = {
+        family = "inet";
+        address = "${secrets.lan.prefix}.1";
+        prefixLength = 24;
+      };
+      dhcp = {
+        start = 10;
+        end = 240;
+        hosts = { };
+        localDomain = "lan";
+      };
+    };
+    wan = {
+      interface = svc.pppoe.build {
+        interface = config.hardware.networkInterfaces.wan;
+        username = secrets.l2tp.name;
+        password = secrets.l2tp.password;
+      };
+
+      dhcp6.enable = true;
+    };
+    firewall = {
+      enable = true;
+      rules = secrets.firewallRules;
+    };
+    wireless.networks = {
+
+      "${secrets.ssid}" = {
+        interface = config.hardware.networkInterfaces.wlan;
+        hw_mode = "g";
+        channel = "2";
+        ieee80211n = 1;
+      }
+      // wirelessConfig;
+      "${secrets.ssid}-5" = rec {
+        interface = config.hardware.networkInterfaces.wlan5;
+        hw_mode = "a";
+        channel = 36;
+        ht_capab = "[HT40+]";
+        vht_oper_chwidth = 1;
+        vht_oper_centr_freq_seg0_idx = channel + 6;
+        ieee80211n = 1;
+        ieee80211ac = 1;
+      }
+      // wirelessConfig;
+    };
+  };
+  defaultProfile.packages = with pkgs; [
+    busybox
+    iw
+    iptables
+  ];
+
+}
--- a/routers/white-house/secrets.nix
+++ b/routers/white-house/secrets.nix
@@ -0,0 +1,20 @@
+{
+  wpa_passphrase = "";
+  ssid = "WhiteHouse";
+  l2tp = {
+    name = "";
+    password = "";
+  };
+  root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387"
+    ];
+  };
+
+  lan = {
+    prefix = "192.168.1";
+  };
+}
--- a/sops/groups/admins/machines/b4l
+++ b/sops/groups/admins/machines/b4l
@@ -0,0 +1 @@
+../../../machines/b4l
--- a/sops/groups/admins/machines/rigel
+++ b/sops/groups/admins/machines/rigel
@@ -0,0 +1 @@
+../../../machines/rigel
--- a/sops/groups/admins/users/berwn
+++ b/sops/groups/admins/users/berwn
@@ -0,0 +1 @@
+../../../users/berwn
--- a/sops/groups/admins/users/davhau
+++ b/sops/groups/admins/users/davhau
@@ -0,0 +1 @@
+../../../users/davhau
--- a/sops/groups/admins/users/kurogeek
+++ b/sops/groups/admins/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/groups/admins/users/matthewcroughan
+++ b/sops/groups/admins/users/matthewcroughan
@@ -0,0 +1 @@
+../../../users/matthewcroughan
--- a/sops/groups/admins/users/vi
+++ b/sops/groups/admins/users/vi
@@ -0,0 +1 @@
+../../../users/vi
--- a/sops/machines/vega/key.json
+++ b/sops/machines/vega/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+    "type": "age"
+  }
+]
--- a/sops/secrets/b4l-age.key/secret
+++ b/sops/secrets/b4l-age.key/secret
@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:wcR+EaC64JexQCShFc1I6mncHGQ+bMfjAOMnoTq3/bOa0T+NCqcDmrxoHGdR2q/TV453uMiokeAm+uggpZNQ9/1Kf5mX2KQsJtE=,iv:FcyIA1uAOISu/+mfTtdQ8lgyieoCObbZ6BMvkmIVoto=,tag:ew7jg+oXP0JUBBfDJoir7A==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsdnlFYjVtdGhHSmczV0Nk\nN0IwL0dLVTdkTWhIK2tmV1E5bE1wZjcyZkVnCkV4VEhlL2lyVkxXMzFQVTZ5dHBY\nSUJWRUh2MjgwZ2RmaVRFVHdmQm00ck0KLS0tIG1oTlE1alJDK0FuNGhDQmcrKzZk\nWDhZNEJIWmd1QkVJc0pLemVOSjhqQ2cKMDYUbT8wQ89mNBJFYp2igHB2aQtxBFtM\nilUU83E0stiVKWHrCnBlmQng4UDr0rPxOWa+JpbR4bSbLPXyKIPtrw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxZmVHaWRsa3Y0TGNIM0dx\ncThRc09ZdU5YVkpWdTdzTlRXa3pjMTRVd3lNCk4waktab2lzNDJhZ0hiOTh5MFVu\nTzR4clA5Mko4Y0o3cFMra0IyTUUydU0KLS0tIC9RWXUvMEduUkp1VXpSdjNUUkQ1\nN1NuTFY4ei9TdkVjK1lUQldOVG9sc1EKFwRbPZyd7TARXkvHD74DGqwvxOjIty+X\nBHFw8H5CWp2FCCQ+9bebMamG3ShzhM21Hju9uVbMXA/WACU/9dAJhg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQ1JCN01wWHVETDM5Q3Y0\nUDNPanFKY2pjeXZJTlFMQWtIYVluMWZCZ1U0CjNwSmEvTkNZbWdmNlRBbXE5Vzhs\nbFdxMDNUclZETlNDeFlZeHBDV0xoR0UKLS0tIGF6ZlpsRWRJajk2dlFKR25RRkdG\nL1FOQWRIcE1XNkJSWkhLSFBIRHhuWVUKEOkLKs2OFUwGMXeo9Fn/3cEZGgMLbXnO\nthqX0FRS22BE092jx2EuxK1HQYo/iTojPwg0LP692R9DZMZ1bKfqQw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOekRKMG5VdWpmcm96WEdK\nTnoyL3piaCtxVnN5b1E2RXh1SzZ1cGU3OFdrCjNNMGUxMDF6NzFUNFpPb0VNa2Q1\nL1VacitPRzU3MHh3dXpTNWxYeGFxeFkKLS0tIHV3TUkxTG5mQ3haZVRSTTB2bFBk\nU0dDaGQ0ZjhEOGdqZTFEQXlPczZWdm8KiDHBQQRL4qTnStFr8nmdhet+7gBELCvd\noRvky46oEsS36L9o477ZH134wrSqAcD0NCOO06hA/jEXNvLFig9yHw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T03:23:25Z",
--- a/sops/secrets/b4l-age.key/users/berwn
+++ b/sops/secrets/b4l-age.key/users/berwn
@@ -0,0 +1 @@
+../../../users/berwn
--- a/sops/secrets/b4l-age.key/users/vi
+++ b/sops/secrets/b4l-age.key/users/vi
@@ -0,0 +1 @@
+../../../users/vi
--- a/sops/secrets/rigel-age.key/secret
+++ b/sops/secrets/rigel-age.key/secret
@@ -4,7 +4,11 @@
 		"age": [
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQzVPVHBBb3l6RzFtNUwv\nSGVkQ1BuMnFiREVjY0lJbnppUjRxNnNBQlZVCkdqN2lGMmp1OFZUNG1tbmFZRklk\nL0xzMEdvemtSQnNGOVNjOXEyM21NYlkKLS0tIEdwWEZpY3JZK1phRU8rSmExVENR\nWkZnRjhKZ2duNDZkVnpHQU1FakpGYzAK/wnN9n5MMUnzDJC7PWrOcO+TbiuTbSPX\n5BKJbuBLw3Qokbh8fT9VUX8UsExw+UaaPnXPcbYX4xhBhiZ0RTmyMw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWk9KTEJHR0d1WTRDWGFS\naW16L3E1WEFBNFpwSVZ3T0xUMEZBcXBrSGs0Cllua20yVHV2djEzOE55Qk5zKzlp\nQmo3UVMreVFKVTJTVGl4ajdVZ0FZNk0KLS0tIGF0VWVJNGU0M05ZajF1Q1NscHpC\naG1vblk4NmY2KzIzN1V6bWVrYW01OUUKAfMKTPzIhVd0W8yfob9No53RnaNC67Fy\nMohQHZ38caz8LhqFfDzm1vm8xi1F8kcaW6ugcPH532fdDxkS6dfnoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6YnFMZ3F5cjJDa1poTGpD\nRURZYVZNLzByMzgwZytWZDhBaVFIbndmbldzCjlvYnRVTnNwRWVKRG40MWJrQXJz\naENEWWh3TFE4Uit2ODhncWJHZ1hvdk0KLS0tIFlIUmlqVWRlQzRxcFZHMFlzVmJh\nYkdBSzJlT0pnYlRacmhINFRyZzVIdVEKJJL7XFqZafNQmfzwwjVDMw/cPob830oI\nsVQe1HaUK7IujWTCbD8l0uoqsODdaWOMDVwxuiKr+yHY4iwar+rI6w==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-25T02:12:20Z",
--- a/sops/secrets/rigel-age.key/users/berwn
+++ b/sops/secrets/rigel-age.key/users/berwn
@@ -0,0 +1 @@
+../../../users/berwn
--- a/sops/secrets/vega-age.key/secret
+++ b/sops/secrets/vega-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:3WgicB2mjBGo3YWFG9mVBYnapj1ZoH6ohwxIUcA9byWVTCS0ZKyIJZlPeyvKWEzX9ZnxgLd1DPDfFfppwsnkxYOvEJsBAf0AanI=,iv:OKSKHu3h8Kl/qAlQ1xiYElDjaql0FdIWVPJYicfvH8Y=,tag:Xa9RfEBC8l8VgHbJHTr4jQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCK0NJR2VzVU1xVGZBd3Fh\nU0xEdmFhTllBU1dpMDM4V3NjTjB6dWxoRGdNCmdMS0duUUV1bVdtVmF1Nml5YTRV\naHpLMExzTGxKclJDZkl2UWdFUHRxY2cKLS0tIER1ajBQdEFuTDQvSERQTDZialBp\nN2RJdS9tVk8wb1lMclNrQzBCTWx3UUUKVKrK0KHOAcd0oMlzeCbN9xX35QKG+za2\nMqEmG/duejDVVzxjIcMBhsXD3EytUMw6IJ/dQtGYS3lJUXH0tiq1Iw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:12Z",
+		"mac": "ENC[AES256_GCM,data:Nvb0JIeARvwzDQSiUkqNMsTFQpGLDTtM0v8ZDyYzQY9yloS1AsGtehbWPgq9Rzr6L5I71bubw8LWpa6UnlqQSrC8GLOy+ojvu/KknkNaVrWQFCw0BDJk4ypBUaQk8n3dGjkG8UUvKCy7dkwwkP3nNbsQ8HA9R5zSYHNakZmWpes=,iv:iozu9qC8nY2XCPG5aBPihCjoNIxXV3kKLcoesFYPSj4=,tag:NkqiJVwj35VY5teW7eTtsQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/sops/secrets/vega-age.key/users/kurogeek
+++ b/sops/secrets/vega-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/users/berwn/key.json
+++ b/sops/users/berwn/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+    "type": "age"
+  }
+]
--- a/sops/users/davhau/key.json
+++ b/sops/users/davhau/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+    "type": "age"
+  }
+]
--- a/sops/users/matthewcroughan/key.json
+++ b/sops/users/matthewcroughan/key.json
@@ -0,0 +1,14 @@
+[
+  {
+    "publickey": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+    "type": "age"
+  },
+  {
+    "publickey": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+    "type": "age"
+  },
+  {
+    "publickey": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+    "type": "age"
+  }
+]
--- a/sops/users/vi/key.json
+++ b/sops/users/vi/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+    "type": "age"
+  }
+]
--- a/vars/per-machine/b4l/b4l-grafana/adminpassword/groups/admins
+++ b/vars/per-machine/b4l/b4l-grafana/adminpassword/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/b4l-grafana/adminpassword/secret
+++ b/vars/per-machine/b4l/b4l-grafana/adminpassword/secret
@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:9v56r2ZaEixMv61TGiCOmeAru2v9ZDUJe6v+Y5TdzfV5Rg==,iv:8kvq06/hfad+9af2PW+50l6Pzs99E5E2x8m3AIz5y90=,tag:aemnUje/OlGc6Hdzzkfdmg==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaQnd5emFNTEhDeEFBMXM3\ncDB4ZThGb3RDTWVqMG9KQlcySnpTTHFGS0JzCkkxZk5KY0lHelc4V1FDQTRVZmJk\ndldYQnkvMWtWanpsVHJFQ01nMDFRRUUKLS0tIHlRM050cFArcVVEL1R6YVBYMi9z\nWTZLMG82a0MwSEp0RHQ5ZUVXUHUvUEEKwar6u4Hdcz2Wz/AYpK7jY74Ksr6DyhPG\nc8aEAMcICMiO7kQn049JSbUuOKu24cY1zColB0ANwrG0RRX6s2oTsg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdPVWcyRlVS\nblB0RmJ3MjRiazZ0emFkY0RaeUF5cHEzQnRpdHcwTlJWeFEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp4QVRIYVZpNlM0MExNanlNUjdGUkly\nc3dwVWhZWWZWRkFlWXFzT3k4WS9BCi0tLSB0TlBWSjJ0NmVYVmVNUjljR1VPdHZY\ndVJpLzJnTk5mUC9rNXlHZmh1VU84Cl0Lz74FOE6hWFh1BtmeFTBgrCEhf5znSAfI\nDqCy/WNgyLWuqM5TPMu6+S2JDop1xUpCarW+jTNOFKSZe3imPFY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZUFaNW9GNXZSMnVjTG5v\nKzJlVWxzMnRSbC93a3BHc0t1YVlhQmRGOEZFCkFFK2NQNXJqdWd6cjFxaFRRR2Vy\nZE5tdkcwRXV6ZzVrdGdkcndCQ01KM3MKLS0tIEtDOG5qOG9MWWN4RnZuVGF5ajJN\nMjk0TkJvR3duZHhGTjQ2WVpqRmkrOWsKjPbLas4eDUXdhZyE29AXklDDM+czo2b7\nqvOAY2c+TyMatGpMRMPogUqGC9mj5jTZe+ZfHcxIfytDXbOgldRPow==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtR0NIYTg0ZUw4dVBaS3Uz\nOVoxZi94Nk9SQkdFWks0YUtDcXpIU1Uzc2wwCkJndUV2eS9hY25JZi9VR203Wjlu\nOXFQYUhwaW5rbFBOczlXU0xPZ3AyVXMKLS0tIEdydy81ODFRbjk4LzRCOUJMTlg3\nWU1VU1Bra1hOajc5R2ZBaVhmWjEyZ1UKMyDHIhC4vT5mjLEq36hDx42okoEcd52i\ncT/wolZOSS/D3oA1Si3cV3ls4UCvJvMTC9VnxjX8UNHw7Qjji8G0eQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtZ3NrbEEyMUpoQTRFL2ZT\nMXNrUTZsSWV3aWRMdGZUNXV2azAwOUJ3cFFRClNmMCtVTXF0VU9PM0NxTWtWSXBh\nMDVlc3BpS3ZVSUlEQit4c21IZy85QW8KLS0tIEMvWWhYM3VyTWk0TnRJbHhublpa\nZEhKSitydFdMbmVWZ01mdlVtSWV6S2sKY7L+wbtpIlo00xQukuj1Fv4iKpC3BftP\n4+55dUhp9cc7VxqV/3TkfPxeyr95OltVZOHhhwSnEzcyCP9XQ16DIw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWaHBPa0pCNERiMGV3amwv\nNkN0REtUSlZhRGY4WDhJT2hqaFVwT3BvUm44Cmp4dU1aNGpPMStyMjJUOG44NWJG\nNjFKVUlHZWg0SnlUWVVNeVZ4WWJ1TG8KLS0tIFNaMklraktRRXRCaUxzZTVyTVAx\nakcvY05SbFM1NmxwQTZVbi90dkV5dEEKj/ibSS0aqnYPmqpHmmGIbJLoMXwQfvkK\nYL7XFp0s1GzSvXHeZ8o3J0O12A4CDKsI5zgvNFPE24O9oqD4wDFa+A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6cmtaZ3V1VHpTTDhPL3ZW\nSFZhbWtKQ0k3M2hlR3J0b0YyeGRVN1RDUzNzCkNuWmR2MTErMmZJZUYrSzJ1TEVs\nNktOUEF3RjRKb203RC8rNjI5QVlVZlEKLS0tIHQvS01hVjh3ckYrTW0ya2VRVm5N\nQ25wTFRuV21PVHpob0dHVzQ3U2hCZW8KY7sucGDzga1YvOXwHOvkEJbry2rLalfX\nDnM2CyUnDKv84pZsiY4jI/7sFrWl6UITpBEV90RGnPz5Hu0NuOTwqw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBjV1lmS3gw\nL3ZCc2pUblZmbXRZQXBsRFErRG16andwOFNZQ1pzditKR0UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBZ3Q1ZlZ2a0RkMGxtTGpXQk0wNHpG\nRUpFQjV2S2psZERJVUp2MGlqRk9VCi0tLSB5OG5kcXVoWGNRNDZWUjZKQXVZVXkx\nQTZGRjdkU0FNTFBRM2NkKzkrNS80CnBwMVRKUu+WxbYWKYLdXPRAAHS8bNPTlZa1\nd1FJnQJZcTv6RKQMCD1l2RaXGAt8tSkDQ6L6dKFhzkODjKfhCiM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGZhSStlUkIr\nNGdTZldnY1ZZaHpDVFZoeEJ3aFNmR1ZPTmlLa2Z6Q0ltRE0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpMbmorRU1lVEZuSzJtbmxzTTlBU0dr\nMDhsTEZML3F1NmlhcXovN1hYc0owCi0tLSBkVmRyOHkvdFYwL0t3Ti9ubEd4TXlJ\naUtETERJV0ZaL3Z1NTFNVGZ6RURBCksOxShfsYmRCkROmLNqbYACLRSRJRgtkxRM\nJSLcsuO4+TrZMXWxaNjICMPhq+L6AkUUthCl19xhT2+XmvFB0Hc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOR2t1Q2c0aFB3ZUsyLzB0\nbUFkblB3UlpOREpZdzM3dXI4bktVN1FOMjFrCk9rdmNvTHlzajRrZ3FoYXBqMWZL\nbnhLdnhvRm5ETkRETmlqSXF1N1RKazAKLS0tIDlZNXpNME9mQkRQTW1TcDRUd2pL\neW5RV2g4VE5HQ0IreVowZjRLdkNpbzAKzd6eJIpFpXptOANWTVHZNW4efd+nBABA\nvSWpJpDerYev62P3lvq8V1pvypqCjmNf5hKTWG5aAX+mzXqJaK0aFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETkZJTzFSUlNHTVRCdFBS\nTWVLYzYvc29aNDZWVjc1NVZ1aGRtTWhzdlJvCk43RUpGTC9vb2hRaVRlT2xpaGNh\nU2JrWmp0VnB5NGpha3BndE9YTkluZ1kKLS0tIEQyK1dVMzFaaWtSUkI4WnRJMjlY\nbGF5M2tlL1lVVTdQVHRZbVlNcjBGM1kKdy6B+grOB4Bt14aEi4+XfLIQTNIGQX/W\n4v4CGKs+0vYaaCPS87rcuR2z3jf4hkGa4qNMA3+fxE9UZBNiYWI6dw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-08-01T09:25:47Z",
--- a/vars/per-machine/b4l/b4l-paperless/adminpassword/groups/admins
+++ b/vars/per-machine/b4l/b4l-paperless/adminpassword/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/b4l-paperless/adminpassword/secret
+++ b/vars/per-machine/b4l/b4l-paperless/adminpassword/secret
@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:NsbmiB/AWbAHRotImbG89mQjINxWyCYx5QJExqv9eVpnUg==,iv:VKGzSmYZkKQzG/Fvs3Lk6KBexqKzoVOCk33Lw0ovUjY=,tag:4kWuchFThyRuqIA/tpEL2A==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmcjloZHZxamR4Sm9RdW56\nSzc5emNlZzlrVEhxQk5GTmJSU091bXM2UWdzCkVGallpSFkwcHh0TzljdUQzWVVk\nTkovR1pHaGFBSmkvNUlReHNyQTVaY00KLS0tIEpaWHk4NkRzTEtKQlZlRGF1NzJY\nYzcwazhFK3BiYjlGK0xEemFwQUtnblkK7NKnJ7QwJLMytdjDt+UchcP//Lf3P6Ud\nT5Adt5I5MTcPcBTqLNlWvFjoW83fDJ9c8rNdq8Ymy5wycffiekbW6Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNzR0wvNFQ0\nZUVRQVBWd2JOZzlXSVBuUjdtMTNkcHVoMGNOSTEzNExKSHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwprTWQ1UnRRaUN6VE52Z0NzeCtqQWlW\nRmNtbG90U3k1bU44OFduVmdjc3dVCi0tLSBGY1RSaEtEYU1vQUh1L3NCcElhWkM4\nTWhOeTZpNjBjemdLcGUzRk9aN2ZFCrx9cEAAWSRW0BcWmBE15pEQ+ZAANTVF+NeF\njZaqq7RF+cFxX/A7LW9EC7Lht98FerAx6jjhpV1EjFwpS83bjvQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxS3F6cmZQN0V0bXpSbnhJ\nQUVwa2U5cGVVLytJWjdKWnErN0tNNjFhaEJvCjRZMFFSNEdFMlY5Q2J2R0pURUt2\nMkpuWUNrT01waFVGSnhxeEF2VGhPT1kKLS0tIGNpdU4weCtza25kWExHVHJlTThw\ncXBEK2Z6RWs1ZVdjbjdPK051Yk5JVEEKrWBxciIubjp2CfLdSMuSoRaWoFEzh2Ni\nQgsFK4B/1k1nAt7hT6ihRHdaZLRGR3oZljD6obQuZt/CQX4XK/vhpA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2OUVhRHJKSW4wbXNTUytj\nbE4yN1Jpa2g2S2ZZRTBUSHBLWjJKNHdHSDNBClZybTRab2lxN1dHVjFXUE41YWNX\nWVZDNEp5Y2NUUWJhWERLZjQ0UzdrRGMKLS0tIHNVTTlucVJhejliRnhLb0FsTFh5\nbDB6bFMzclZ0dG1RQnNWc1VYSHBRSmcKaW5he1XOT64NIHG7Iut/7lMeht+kqvg5\nUrhM65sxwUMEU14LTXjrzUtl6+pxMgiaXDxfAvWrJbEnFaf4ZNOo4w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMzN5cTlrdlZhaTNxaUQ4\neHhCQWR5QVBKMEVnclFtQ2dUYzZKTitJWHdJCkFOTXVldjRJSVhmb29MY0RHcEk4\ncGtYMHZUcUIzcE0zVlp6cE0rNUlYMVUKLS0tIFhuckdZb2tFcFNIcm9tQjVyckJm\nZFVleEp4cG1GMUdOT2lhcTNKanZGR0EKwAHiw87p1/k+cOlC7TdM5ba7IrQ5nGSQ\nAWPSFjc3sX86aAQzkY/SBeQulj1tC3i4ryg09xUFg+oSPDXexpGp8g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsVmRWaHFzWTE1Q2ZNQ1M2\nU2FobFV1WDZHTjNVNjZhbVJodC9MNTBmMEVzCjJTQVl1dWxkYVZ0bWdzcDgyY1dT\nTXRsTEd6Vyt0ZWlWSTlFT0pXandoQW8KLS0tIEtHSDRDSmNteXFqTng4a3FCRmJN\nOXFlbTdySmtLbTJZeXlDa2cxQUNTaGcKUNo8VVjwtQqYHj55FWv3RXtgC4wKV6kl\nwZk9e3X1YeXWj6az2d1qfr8jppFhHNAWEmMxbceMZh1KBApFVV2UWA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSC9IQThMa0RaNVJkTHJR\nZm1XVHFVdlJxMVIrUUlhRjVJdUpFU3JDMmdvCjRYVUh0K2lSZDFNSTJTK0ZSZU16\neGhxTXFBVzFsRlpwcjVGWFVhL282dFkKLS0tIHd2Y3NLWEJiUHNCajlKaE9wQThN\nWE05S2V4cmE3TG9keVFaeVphN0ZtY0EKV1FUztf4KoKFZoqgU8rVSU7v5eblF7Ya\n2rvKTb1GtITo9uijfd2FZpoBIEl2Ej3EijhIDsTKUZ1o+YArletatg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIElLdHRLaVZz\nUlduUi9IQzFWbGFqbWJuaW9hM2JPOTdDc1lwd0RpRkNsVW8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpQczBubDlTWkxNeFUyU2RTNlJ4d2R3\nTHQ0amVjU2VQTndoQlFORzhkYzlvCi0tLSBObWNGNE9uS2xpZ3c5NWtETUpuSW5U\nTU5JVC9tM2cwSzNDaE4raDhhYUxRCuwnhfFV5DowmgqLzFoO+ZoRi1nmK3gkdbMe\n1MTfV/6xr0DYg3ceizb8f5hXOvmeZ+ZfFoUskEXkUqPSycvevk0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHh6ZkFoaVB6\nVS9aT3dhZ3Ewby92WC80S1hNanBPbmF2NDRzTW1SUnYwQ00gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpJK1BCTDJycHFIS1hKanlJYXpvZGp2\ndDBTVVZ5bDhhd0c3cVJTYlcyVGJ3Ci0tLSBYU0lwUVowNmlYQkRMQmhrQlA1U0N3\nS2dFbG9JR3g3QVZuMW5RZm1ubkFBCoHDH5E/OhgJNoF4l2oQEpsV7BbG24PDVMzP\ngKB7gFpMkOBCLaiRPb+3nAgd6w0aHISD6dA4uUw86Lka6mdm62Y=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQU9CU202cmQ3VEF5QVEz\nUVN6SmRkUm04aGRiM2FxcUh6YngxTGFYZkE4CkhqMUE4Ri9Mc0l0NnR0RHJOMnNt\nL3p0OTRhSDZPbGFld1duc1lsakFEOHMKLS0tIE5KY25uWllIbGpkV3lpdGJQSTRj\nZUd5dGJEOXhRY0R6Skw2VFZJT1ZCakUKeRnOh7dQz1oCMOQN2rhAyI46c/Ui+21l\nOH3+knnJV5cXRsb27Ou6pTgKXWn6PJ+2d5qTWL/IZ7q4ga3H63yQnA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZ0hNczFqTHlDWjhtMXBY\neDc3Z0xSYUtpYUFpRkRaR3A0MzZXWXlmZGprCmxTbDQzLzA5T21CRzdaN1ZtWlgx\ncVZ5NHN3bkVIeDZ5Qm40cWk1TnpHU28KLS0tIGdOOG9SRE5VMUc2MWswL1BJT0R3\nN3NWeGcvTUJRSFBXRmZiRm54QmtCMG8K3QbVU6Q7OYpe2GzXTVUbuUx+A8JkHGyX\nMXBrF80AkZd10mEEs0Vs9ZmLKE9u45z+xxpk0lhTxhlRxKFDAsRyYA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-08-06T05:23:42Z",
--- a/vars/per-machine/b4l/b4l-victoriametrics/adminpassword/groups/admins
+++ b/vars/per-machine/b4l/b4l-victoriametrics/adminpassword/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/b4l-victoriametrics/adminpassword/secret
+++ b/vars/per-machine/b4l/b4l-victoriametrics/adminpassword/secret
@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:YpPv9DuLRdwX2CrLIU0Zr14KcrfaK2MW6N7VYBpIvw==,iv:DS2qhq/BMAVXqaGqYDH1cK3mv2nSWHbN6O+KCe/jXBk=,tag:mRvbZv/qSsAWVKmdqxrzpQ==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWWVWYXM1TTAwZmUyMUor\nS0dTeThyRWVWQWZPQ0lFR0M2ME9rQkZod0VFClNvT2JMMnl4TWIvTjA2QklTV3I0\ncDVpd3dhZjVrZmxKeUg3NXRpVGMrVEEKLS0tIEVNL0RvQXB2cS9JZkdlWm0vVWdF\ndFI1ejJkYkNhOW5VU1JZYmdvVllBUDAKCcnA63zxZRfSq6praFJU7u09J9RzPD0Z\nF4FAzBwTCcPA9BPt6e/pAitumSEOTzjuaUmblbXRD7EzBqPERUkXjg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDFoaThlaTJ6\nOFdLS3VrbWgyY0ZvaDVoc3hncktEQ1kzbVRqL0lOV3k1aG8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwppdnV6ZUd6T08wcFdMYXorbGZtWm4w\ncWE5dkVMZmU3cHN6WUZJcXIwTnU0Ci0tLSA4bm93OXBJV1ZzRjNtNTlaODlxaGNU\nWDlwMkN0cXJhRE1OMWF0YURvQno4CgrJXizOnwb2miZwh9AdOo45MVPaWLkb578I\nYYB0ZumzERCh42r22ObshmRMJJ3Xnq8YmukRHJgvEji9DlxSu78=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDeHFRMXFwd3JMakozY3po\nWUo1eDZRMmVkWGVPemZURk5tUUpKay9tc0ZRCjN6UWZ3OVBIQlRReFJUelEwN25y\nZlNqWGVJZjZtaUFKT3lLOW9CcElOMjQKLS0tIEVUSE16aWhYZHdSemViY3AvRWlN\nMnQ5Yk1rODZLOUpaZWovV0RPTEt5UHMKg9GsMtLAfX5y1yWULgdbj8GrXyYhMIMr\n+G4sLcp+HJjsIo0DFvlp0TJUeRuOTVi5XXw+IsFhFTsSqjV/YFFzjw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmaER5OFdjT2tDcHBRL0Rv\nME9XQWJvVjJuU054dWxDbDJtZ1hib3dPdjNvCkVzM2JhR0Q5Ykh3c2s3c1NJTEs1\ncVRRNi9vTUE0QUlEaCtZUHlXbGlVcFkKLS0tIDRXUDFFWnV4U0h5L2FMMnVGZ2hX\nZG5URXB4U2l6S0JyUG1UTG90cDMwa2MKOqPY/J0/D6PxrJbezM8gBEkfnVSJvjab\nxMnFX5IIL4+styO9Gu5sB9CM9tkf3px7BxGIaSHkDsBU2IgZWO8AMw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBamVSSDNuczB3UTJ1Vmoy\nbnM1Q0VDVlQwYU9NQ29vL3FCbjFsSitLWmxBCld6MlAvV3JNZjlsRjVqaUpzZExp\nUWtRS1o5VDQ2RXl1bHNPWmVLTEVGT0EKLS0tIHhkdmdiNUxBTkNPNldLNnZZOUdl\nTWtyaGFsa0NnMy9lQm5mR3FEMXN0TVkKgWedpfvq46qOOdgeFH76OkO7QQyVor/w\n30Rv1n9cqfNdqBog/gPvI/sTPqFfXPpnFJjYZLNG/rnJjPHAM0+hhA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLcnBhVEk2L1N2dTZmSEVS\nblRqMVlJZDBDaVZ3K01xZzNNak9Wb2dLTVVFCnMvOGJHM0Z3OW1oWDhIZHFhM3dK\naFVGdTRaSTBVSS9MMWQwMHdraXdIbDAKLS0tIEdiWjdiVmhFZm1YSzhFdFVBUDNm\namZJaU52aTY1MXpscHo3Q1dIUWhNd3cKL0Tw/Cr3AfzQKYH9JzcMLvhBrcHnTDUI\nMUn95VCc9saD4Oqq+IUB2RaK3y97CMgFnv236u+BwYQ+QgRsSBziLQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQOUs5LytTZExvVTFuSi9a\nVXNnOHNEM1RaYmJJalhORWNDcTAvcFRzc0RVCllRbTJJRVdiM0FMdjFZVkl2SUUz\nOWRnQmlrWnJLQWNLN3JOYzR0RTAxWE0KLS0tIHVjc3BhWXM4Q3F6ZW1tR3p1TG1M\nS0NwU0ZEcW9kUHgwRFQrQU1TRHlTQVEKXNyup8YhTAKrpkOkoV6EUX5O4wClEXVI\nKxGGxjxZq9bNnoJ30F0/OYZraEa0z9NzUPMUHFK0zUCmAtwMLX4gRg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGt5SU9OM09s\nWmxFbGkrT1hGVkJoRHU3VTh5M2NoM2EwTXlSTmZsUHQvVjQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjR1MwR0YxVTQvc3p1QWQ4OGg0ZmRQ\nR2lCeTlqeFlTTW1YSEt5MG5vMlI4Ci0tLSBad3ZQYzYxaXZ4Wjkzd2VSOXFQaVlk\nU2JFYmI0SUt0amhUWXg0V2RwL3pNCmmqyW0tlBhk7Ul5gIZAeS6Qp2BSPo9/qE8w\naCyZKUwco/xgFFSY4Aog3qlwaGyFg6x4sKaAbctE8kNy8HlCyjQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhPY1VPajdx\neFM0bXdDSHBKTklRNUZzdGxqOG5ZQmtUdDZVb3U2SkVtVDQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpKQ2NoVFRQdW8va2RKc3B3T0ZnVEZM\nNElLekI3MjhxUXVMSTBqNHhkYWhJCi0tLSA5WmVidmM1aG9iUUZYVGFHeEVobmJ2\nbzRwQU9NSjh0UmIzUkM4R1NFZnJjCusMZwh5Hiq+Tu3oa4CPdG7Pmavl7xl17PZP\n48gUig98UJJJsQTLqktljBKtoZPKVPzKkwf8HrgmA1s36VsXrhc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZVFE2OVA4bXBkL1NaaURD\nV3BSdGkxTnlaSXlPbVBhQ3FJcCttQWtpZEZzCmgzNE1xYUtVUnlKZ09wOXhIZ0tS\nVWg4WGpKT3U2MlRYOG5OMlRhaDJPWVkKLS0tIEExUGx6ckp6bkp5NkQvMlZmeGlI\ndkh6ZjRibmJTOTByRzlYNzh4WUptdDgKad29xfd3n43XY+x3yZhpYUV7bYHOufiA\nOQdqkdYkNfbmLX66WobF+cAiekfq00tzkOJpV/OJukMOjCfyMv/qNA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZM3M2TnI2NW5yWnhyZkJ2\nSnQwZlV5WS9hc0FaSEl6NC9GM2F2WWFwb1JVCmVSbUFWbzM0VjBQbXIzQ1pwWEwz\nSktxVVYzN0dkRHhPL1MzQ3ljUnRoNUUKLS0tIE1Tay9TaUZ4eEdrMThkZEVVSFlt\naHBtU2RGcnhtdytWWTlSUzBNRllITFUKs6mnVWoWASUEK65VyDpkhVtPKPGKKKbN\nXvBSKZE5odvM4x9aohZB7dGC/geLTZ16+HdxEy7rISadlB1Uqzjn+w==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-31T08:48:18Z",
--- a/vars/per-machine/b4l/nextcloud/adminpassFile/groups/admins
+++ b/vars/per-machine/b4l/nextcloud/adminpassFile/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/nextcloud/adminpassFile/secret
+++ b/vars/per-machine/b4l/nextcloud/adminpassFile/secret
@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:OgzVf3R/puWxEQ49D+Ex5Ldqh+WBFu/8dGnTEA9GY7Qm,iv:X1DFwWVkf5vqYpH6XxLCpN0LSqriaw2f0s1VDoNAMu4=,tag:V4Aic2ttraDvOiZDu5RcCw==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnS1dPSm9GN2VNbDhGYnZK\nMnkzWE9wbTZXTmk0aTB4RmZyWmV5bkZ2SkVJCmpQdXJwWHVxaS8yTUZSdXJiSUtx\nakRVU3JlZzJnTnBWVjA2RUlVQytFVk0KLS0tIGhwYWdycUIrYVE3MHd1bDdBUWlB\nYmtTaXhSQ2FmS2VlRVpTOEtNbGtObGcK6LXf0aHZhh3MvRUKn6cTKH9ZkgWQD1JB\ng0G1SWeQNq1gwlZB/1IofCokJCdUZesX11yAHstk084gGOVYVsmDtg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFdLQWx1TGFS\nQ1JYUWZKY1ZnQkEwZTJIMVpTTUpNM2FYdFRaZzdzcXRVMncgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpKNTBneFZWMy9oTHd4V3VDZXJYMmR1\ncklkVkJXTnFkVzJwVGxnSDJqRm1ZCi0tLSBzdDZwRVI0VnlNVGo1SUJPL2Y2eHlr\nQ3BWV2RtajRwUVlRUUdOeEdOQWxBCqi/B3bUN0XMP7zf8uoUpufc8iEj8Lo0ktW4\nxUaqv7KUkk+ANAYDSB2jq+HtQLMWip5+p7Jet/4rRiL2Y26IPho=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcmJlZFVvTHZDdGtCV3ZV\ndys5TXJVbkFhcnhDZS9ESDBRc0FPV2NIaDEwClhJbzRENWtEdUoyOW9xTE1KNExD\neUdUNTZFcFFvZXZWNjlVNnJQZ3ZaOUEKLS0tIHFhNXpydS9HVVpGUGxxZWxZRjhx\nUEpUYVhPZkFVMEIydUtnNS8zNlplQTAKyONTjik4yiJHjIz4XlLCL8Pn6zQCWJ+8\nH16EvR2IKvfWIbOVghJCgIdzR98ilvbBAmfO4b0d/7BRBdcRsX5d1A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMHpmR0ZhV1NMS2p5MWhn\nU29iZWdDNEhTNW5TdTFCTXQvRlNVKzY5a3h3CkZRcS93ZktKMk1hRGV2ZDlyekpD\nd1NVeklZaGxDY1dnUU1YN3Yyck83SzQKLS0tIHpjbkU3MGNNZzgrNVh6VVJvMHNq\nemt0SzBxYmNJRUdUeStMOXhuS2N1WEEKoyoLi3NffN6yYcumGuu6jgDDVdlkUR9y\nzIwwM68DbC/clKH0bKhPd7YX9ipdKfMv/dcIjUtxoLELJnrCY3FMLQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCV1FQeWhpVm9FZzNtc3dh\ncXhsZnVVT09jTXFYZEw3bWFlbVhhemRhV2xZCm9SaVplN3lKQ2NlM2RGVUNGeE1N\nV1ZYRkExUDUwY3NnS0J6VmVCNkVHMUUKLS0tIHM4U3RqdUNDYzBNditIUTZLMGR2\nUHFGTnJ5K0hKaEZiTjdJMlF1MVB3d1UK9GwDc1dVTUpowFoiQvYJqXigHMRLNURY\n2D7UKQX5wwwKfAwFwP6HQdxX4WWsNefaxUSzW53zqnbJn0kkqi1Mhg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOYkJhMjh4Z3hkZHNtOU9l\nRVhnb1FCc3Nqbmd6enowNThGb0JoNzMyQUZFCi9menFkbXFFNzZZUEEyaVBrYyts\nMllmSGRhdkFRNWMzWFI2cEhUdFI3ZDgKLS0tIEs3TjJjRkJXcGJremd1TzhVN29F\neTh4ZzgwenhlRHdDQ29XTzlJNEVKV0EKYImcALRS2gUcPIkF34+QTPppcAHAYHF6\nLDsTbJsEcGV/OQ7GwFW0seC/aSMNkb7psB/xUhAMgIhnsgJbinOrtA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTNGhqN1lRQTlxM1F3YnQx\nMlRWOVh3UTlZaHpPWWwrcFdGRHJ3V213Q1RBCklLTDNqY0VSQWpNS2pXTHNYbE0w\nS3N1Mm5KdWsyVDJ1THF2bUVXNVBHNVkKLS0tIGxsazZIUS9hTXIyc0k0d0RUdzhn\nQmk0OThqanorcDJZRjFFaXZ0ODZ5UzgKyi9Cdvmp+dzGQ0AXv+VtGLtEI+rOCKgV\nv+44GG3qjUy/kMWE+HJr/4g7SCevDwZohqFIJCFnM3WBttpJc+UF6g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIENTTEY5NXU0\neGZISEZHTERlWU9Pa2ZrWHBxU1FTRUF6Vkg3Q3BlVlUyV1kgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpvS3EwMWN0dG8wS0FNcVhMenJTODZB\nWmJUQVJRWXYzWGxRSlhBRk1YblJ3Ci0tLSBIMXJ6dGN3NlpnYVJTY1ZZSXBQbyt0\neGRrbk8yaXd3VHdUUDJ0eVhnRHlJCh6lamysjjrZN7h9nVyy4pmprp00l1n4m8kR\nTNXGQ7Y+kB62eUfQBsCN8L22+3TIX43Tg+CJ2r0LABdZyJZq7MM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExaaVN4Y1lE\nM2NPbXI4ZmxkS3FsSlRnTkJ3OTg5NWZ4VkREMVRtdzkxVU0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3WXZuMitNQzhJbjhROVR5SmhBS2RM\nSU5pdndFTkVjTVFoWUZKMGFuOVFZCi0tLSBtV0JKRmpxaTlxSThZdG0raUpBWWQx\ncnY5QWQ1UzdyT1B3YlRqYnBxMDljCh5LHx6qX+47VWBTxRp0J3Ww6gs2tDe80oXv\njzh2HHGWVtGfsxwEg8AcnR89LZXBq9MXKYFVLJxvsmIYF6Kh63k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0M1UyMjZZcDlSMFFiUzhl\nY1I0TzBFYnRaWUF6V1JVMUx3blJaWlJxWnpnClpkdi92U2lnaGVJOG5sWm5tWVd3\nTXZNV2tORUg5L2t0b2F4N0lFai9Tc1UKLS0tIEs5bklPZUlUTkhHdTBZcCt3eEky\nZHpDc1JTa2MwNEgwWWhPUTJFdFI1RHMKp1OjwDOnP/Q2NpHVooO8XLexz58BgAhX\ngsAcoy7AngaYbRUSOaSX69Pwc8WmBNJOC2dPf20/W+Phxze7NNLvLg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bENxMEZpQnVGN2J1bjJo\nSmt5eUVxZEdmb21LbjFENUtzU21nNXQ4VEg4CjZqS3ltY0s1cVd4aExnNkdSWHho\nZUNIaGNOcldCMmQ2RnB6SjNONkxITWcKLS0tIGVETy93UWh1bnlnbWRpelNJZ3pu\nVWlGenFBQ3BDQ0lKWW9YYlVnUmErYXMKY1j01WnlFey13mf+HIPb2rN8SSkIlC4Y\nxxESnu/pFUrn5t5CmD0mKhkZTkEWeYKiXvlHhwWP1vE613jNbPi+PA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T09:48:21Z",
--- a/vars/per-machine/b4l/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/b4l/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/b4l/openssh/ssh.id_ed25519/secret
@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:DWmQdG4FDFczm/aCY7WT/p4ysuF6aY/7nprvN8frhEnD6tuu++IEfE2XVNpEDka91rYf4XZrGXrVK8nWdi5AEbFIvXJC1JaZD4dTkBE1F4aJSSXsL3PxBZ1pIUWsLQ9QZ9pzuhVPgGuCS75+44pAGCtYnOPwNPOH1PeMEKVCeEwMKmQKPpqFKz9SpqOZFmzS+qgjm3Jic9dCcsiJoDHobmE3Olp+PZ9mJksOUG75ATXJ3zJ/8gUt39pAJUy2jYHscEECNMc/PuJg4dSZua5M0y+J9vwB6MVhAiyuPj8Ac7SMwbTB8l65Tko9GWR6CknF+4z8ky/EtbY/2hO18tkVLegRwM7UvqFWxXFIC79KCiC1+/pG5BUdOhIzlYwohn9BZjWgdzcy6Sg9cSgJWuDC7rX94vTcV65If7is5bGvAsNB2L5CCoPfq+dU3KNsFwo7mlFOyA69NLYqZEV3EhKdqn4uj5Y9qGqvCz8ew0Y2NP7BgkpsR1qyFqYoIYPhRlC4Iy14,iv:jUBLVPSN+FkcRdkKq8l99udzTOHEio8KZSc4pBOYHgc=,tag:Ml3Fr8Qj2ZjwpE6CYju5Lg==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1UVBhV254a0V5YVpJT1d5\ndW54RlNQWnV4WW93ZlNJai9UQkcxY3UvZ3pFCi9Cd0Yya3lpbWxkbVBMRUprSjB3\ndlpiYksvTUNLcGRWM1JHQVpveXg5QUEKLS0tIDhtS3gyTGwvTFNKemxIRjhrZUE4\neDhpNWZISmY4VU8wUXRsZ3UycjhGbzQKJuS6ipirrxFNNFN/S6O1uB1/W8ZTLhBb\nUygnYFcSAUGU4sg0/GCfYhJL8M0QCKWUdkIGHD0rBf3DLaCSHluQQg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGR0aG5TYzBy\nZW9DQWJNOU9UbW9TbW11b1N4c2U1NnZlMmdNQm5zWGRrREkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwprTzRHRFpuZ2xURmhGc0J5cHFTSjR4\nemU0UEY3cS94Q1NZbGt2dkVIakNZCi0tLSA2alF3SFIrTy9XbmJQUExnUFc0SjMy\nUjl6NGZxblZUUS94WFRIMEZsV0Z3CrvC1icmymgdpQsC+8m8mrKTbRG4HHmfKCEd\nIizhBO1pS/6a3pyXyEPiiJbaUQwhny3K8j8/CsY2adldIfvZfrc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZWc0RjBSVzhFSWpIUThG\nTEY3eURDSnhtMVdPOUZBZWY3UWFjdmsydFQ0ClF4dGUrM2FLZWtuNWVmVVFodUZY\nYm5aNy82UktHOGoyOENXMVYyMGJWc28KLS0tIE1qRDY5L3AxSnMwZ1J4STZRcUt5\nWjJad1dpVTY0Z042aUFKWE93eHlJbmMKBWKpYztqSKuOLPx1hXE9BqEQbdZJwQF/\nrWpAzjVvVHnVA/CfqXOMzGqQKc98lIZeJEBGxRWNHZBMbf4QrE8eIg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwOUl3bzl1dVdzQzV3L3Av\nRTJRN0x2YythVDNHNWE5UEE5SFUyT2FGR21rClNVZFMxSk5IYjByN1YzZXBTOWY3\nVG0rU1d2T0xjSmNPWkR4UFErT1U1UXMKLS0tIEttNU5wS0tyTmcrRmxVL054ZTYx\nbkJVWTRieUhHL3IzZFdwbVllVTRHNXcKUyxic3yJZDutMB42VmisFc5tz0ZlLXO6\nCm7R5q1TSx4ME26oCJ+KoHhLUiILhdcSYQt5T6MZ45s4bh3Wno+amg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4d1FRYSt0czRoZjBWYXRl\ndjIraUdKV1E0RUtFVStmSVYzT0FZU3MxTWw0CnVDcXYrUXQyVmVlSmNtWVNTbDF5\nZGRrU0JCV1ZhVkt6YUpOU1dKZ2N2QTQKLS0tIDdsamZGNGZ6T2dpVWhvdVI2b1JJ\nUm5DTFN6dExhL28yRjk3djZ2a3N2amcKm0Tm6wE6BJ4tKvwAAGdlSTGCwZD12ME7\n02UJt2KC8RcNWwWuBngkKSDRim8LMwanl3vFjPkXVCsubyRLCdnaxg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpc1dYazgrM3FlWk51SFRE\nTEZJU0Q0VFpEOVZOb0w5dDFUbGxMdEZlTEFVCjR4UTRYcjdPWmxVUHh6c1NGeWto\na0M0OUNIc21LTXVaQ1pHMnlJYk8yWUUKLS0tIHRsOHJDSDQ4ek0rcXpaeGk4WW5V\nTjNnMGhHRVBnNkFaQ2FrNTdSTW1hbHMK+1CItA4KzGvtGsZZdqRqyUQgXCtWeNva\nYKBoeLRSfxkeiGlFvr/7AjaQHSfZ0H+oXVcvFgqFrIlyWr5lLcPWTg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdjAyazRKS2ZRdEErL2pl\nYTBpWkF6TUxqNFhVUExDYWZSemF6dG9Sb0E4Ci90aTRpSElSVlk0Y2c0bk1TMDht\ncjlnUXp2ZXlIQTVoMVNxZjI5QmtmSE0KLS0tIGxSNUNIZ3liYkdFaUcwK2FzeWVH\nOEpBMlNKUzByN1NyS2Z6SjZDRndtU2MKS4HPEtj9X65jrGJ4VnpxB41fDzNBUy9U\nQ8UtUJ/OaUk4gmft32No+rdWqwSr9doWMRey9eKb4aDQ5zWuflnSpA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDlVa2xyaUdk\nZ3lGY3hwNXROTkpZM2tPMVVKU3U5WWp0dVhDK2EzL3dBWEEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZworT2tLS0RXVjRBcTNzRHIzN2IyNGlq\nMWhvSXJGTTJ1S1J1ejdSblNGUjJjCi0tLSAyYzFQRUttM3ppK0VDWUd1R25MYXVQ\ncEsvYk9uVkoyZy9wTWYzdW5RaXFNCq+QqTvrf+NuD9aZlxMbzz1CvnmtuZNfCmKC\nwqq0Pmzrev+LIoJWDrKEFve2GDS8YWvgWRCEh5Dw5UAM37jUu+k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFoWEQ1ellK\nSDR2TU5NZ3hPRkIrMDJnYTZaQ1UzZU9Mc1BQWGs1U0tpQUEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQoyUzU1Y3ZGbmlBdXN3UFdmS0FMbm5I\na2JESkh3U1VMSzZMVVRaQlh6SzVZCi0tLSByVnVLcE1pVThLVHRGM040VElxZU9a\nMy9aTExBZktxdGgrK0loUGdzUnJNChdlMJ/9GbNzjTgRE5T1T4KChFlMAplnnSEj\nXm6QO14w9zGNjE9R6SMdwmJxJsJVF84p7j0JqyDxYqsHn0lXFHI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaldRZ2RSK1htdFgyZ0JC\ndEU4VXU2WDhCVjBVbWtGTkxiZDVQMHBBOUg4CmZKKzBxMTVaUDRyckNSQndrTFND\nVkloa1JwNU5xdU1pY1U2QTJRZks2Q0UKLS0tIHB3cThzRllPc24xZnd6YktURmJD\nNUVBVVVFTFNTS0RoQk00blNFVXcycDAKMIgk/feI8cCpVi889HGYE7N2UHoNsRgs\nQ9oylsSj2exEurM2bOobzbD+hlqKOvmjY6Op62dUE7Q96lfraJMBzw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSdU5Ed29QYURvMnhqdk9m\naWlxN29OVjNkNHJ6YURzRTVRa3ZNbnhyY3hvCmFuVVhCbjYzOU9NMklsRXRRN0sr\nN2RpaDNZRWsxZnhpVytqLzdpOW9TQXMKLS0tIHBhYWhqZ3cyYzZTNnJacnNQcmlZ\nZEluckNoeURqek5jcFRjSUJJU1ljYU0KOEhr7W3KlrWTHuItIjN15r9fFmLAwXMM\nx+7+JAgvVPDb55iImZpGS6IIE3F/FBiKPAdTQhuez0rS+qCuxkrhPg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-25T01:45:44Z",
--- a/vars/per-machine/b4l/pocket-id/encryption-key/groups/admins
+++ b/vars/per-machine/b4l/pocket-id/encryption-key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/pocket-id/encryption-key/secret
+++ b/vars/per-machine/b4l/pocket-id/encryption-key/secret
@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:Z+f/21lCA4byBi52MuwK8K0xs5KkjyZDGJo0pQL1c2pM,iv:pfqOkBOch2n8PhFQxQorC3sY4O5ri1t5lul1UOOPmxg=,tag:L1T5b8MRkNxElXf3jIcEAA==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWeWpYQnBLTEVOWGhSZXU0\nUTVFaGlTQTBTU1dLcWdQMGV5cC8xVmdUdURZCkdCWUNiVmxhRUVDY2VHTktBVGph\nWjNpOTJhc29WVUdrL2psTHJIZ1l1NkEKLS0tIEg4MVdRRFg2dnAxRkFwVGhQbXE1\nODErMnZaejFXb0tZamJtNHFrZkkyV0kKkaF7WmEsHzKNyQS9wBmvVtSP5ChUgwPi\np5NUIYLAk+WUHTVenyOXEIZwsV8acEiKu6A+dTTzg1dhYpa1jgBKBw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEFyT29VRy83\nYVhYT2FQeUNoakd0WStsYTQ3Zi85OVZvaGJBdFdyUmd3aWMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpWWmc0OGJtRm00ODA3RlpXQnJObTBs\nZWhteUFjL0RjdEJzZzZWTXFqdlkwCi0tLSBpUHJNRTE3MlA5TVNTZDJwaUVmZkNZ\nLzJLOWlJWGNDbWNDMUYvTmRXc1BNCs6EOq9tLCBfd4ZkeNuqKlX+T/q3bRYwclyN\ndsWNJ2QZ8/Wj4m0xbC4tFfdCIoRxd282hTSurw65R/8dY4zFCw0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwc2VJTWlGUEJnWlBvVHFn\neGFqUE93TmNLQ1NJZnZ1eGYyNGpWUkw1R1RRClV5T0dMVGlQK2VrTlpCQlJBV1ps\nTDFCdmE4cTdUMjZucVVGcGNmUUErWTQKLS0tIHkwODdJMWQxVFFubUV5ZTFneDFS\ndURNay9hWk81QTI5QS9RWS9HVWhNelkK0GXmKGfL2cfsziBKu6pllmHRQno6K0FA\nzHky0yt2H1w1svDfFw2+FyKHfHAwaQs+X2qXXlvIZ7jwtPj+wQXubQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZzA4VEs3OEcrRk5VOWdM\nbVNjUXNkUGl3YTRCcHkzOUxna1kvWlJwYVhvCmIyS3k3QWhTdXh6cG9KbUEvVmJM\nNlNrVDFUSC9kU3dpdHJQU3paK1VMVjgKLS0tIHdQTU11TE42eGNsOVFhT1A3Mlln\nVVZrRy9udlhFaXNYWS9qd2FZYmRkeG8KDOai9pGX3gLSObePJ/E/+nJiPpqgkkjK\nGvJjKIb7LGdugIZ6h6HECwFcAbYl3UY/VWQL4YkqC5Yq0WqBx7svIA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoU1BqKy9HZnVrQ2ZudjBK\nWFVNQ0xPUHBOaFB2bEZvRVA0bEVQb1VYM3o0Ck95blBwckUxY3BZVkZZdHdINXlH\nYkZGdHNVQnE3ZmFja0xPaml1Y0tVWE0KLS0tIEVpNmlGanp6L1dRZGd1VVUxclZs\na3dBWmdIcFExbldFeW0zc2ZwRDVCckUKTjmYGY1RqzcijNepBd0wzDuWuywYN6oS\nQGVUhY1Tm2H+SUtIsnuNWkNsLC8LnDBIfx4DCWCYbLrC3HYmalpqPQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXbWJ2RzhjbXMzVVVxVG5K\nbzZGcnpCRUNtUzdHdHNaUHlicElhd281S1R3CitCMzdLbWtqUmpCTDVsOWtBTWxX\ndnRMQ0IzTEhPYjFyampzUm4xdFZBQmMKLS0tIEswRXdFSXdWa0FUMktiSkVYaXhF\nWDhZd3NzMkRZY1lLdWxoQlBuV1RaVFkKRdr7k3q2ftRwphuwXhXZnRKgI0EjpIXK\nZAlx1gnXRem30kPgBkdIVvtcS1EiQF402DUzFbDfiSCoTWtfyZJygQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2VEd0YkI2b2JLMDZ3THRV\naDVJYTRuMk0vS25OMmkwUE9KaVN2NTlkQ1NnCkxlMzNyNU1OQVE3S25OTm4rRTlD\nU0ZNaFRwWWRDdVJldWRFTWg0b3FJWmcKLS0tIG5tZDNoZUt6L2VoUjR3T001SEVG\nYThnQjZXcHV0NFduWDlXUGZ6Y3JRbW8K8t6TjUETVS0FPdoBmY1skyU8zzd0lHtk\nQw0W4A7mknt5s2yyRR+2awRGiW7NWlVRknHFrQuZwkO8wz3he3yNWQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1uSkVhWHRQ\nNUtvclEzaHYzRjVucGs5bEVKZXBhOUdGNUt2ZnVzaW5EbFUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpzcER2WjVzdkl1MFcxYmtvSHBXOERp\nOU9uTE40ZlVURXluQ1VrR0ZGd1ZBCi0tLSB2d0dhbGh2T29FenRQalk5QjdzRFRn\nTyt5UHptUndUWUdMdG85K2xxYnNVCiZEJdH+i+G9WkRgwE9KTWaDb/EGwXocn/dI\nvmMc/fXcGtA9RE29ym4dJxA2lOlmFMXR92S/cT7svZOkLoVorQI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhkYUIvdnRu\nYUd6ZlBSdUhBMzFZM2YyUXg2bWhzNUdlb0ZHWVJud2dtM2MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp6aDZBYXByZ043My9QTlIvRkp1RUxJ\nQ2QwYk9xdmRWeGNPN1RQTFpOVVlBCi0tLSBtRXNLYmkxdGZnc0tSdGptMDgvTXN2\nUjBkazlxbFFmZlFhVFhCZWkxZWxJCvKlVcCcatRxSpLPNSbWW1zXY/ZcitGVOMXi\nv4wYGqGRIMPtxSbehqN8XYnPjrbnUwpQo8yxs46SpjR0qd2Ecrc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnM2hxZFZleFI1OTVId3g3\nTXJCQ0NyMXZjbG9TUEN5OVRxdG5BcUJtTHhJCnZQbnB6Yk5MQTBKcHU5RjdoSFBv\nSDI4cmJpdmNKdDFoMStHYjNTckt1T00KLS0tIFY5bXhURlNwMUdtUGVtWmY1WXVE\ncktQTnN4MXFNc2hUaFJSZlZFMmNXOXMKvqXhj8TQGznCONlhqcdqBTvVxX9Uut4E\naj8c4NI49bbBJ0WNvcv+INWI4oP0Sht4WXn1KSa2gVwLgi4z4ZQr5A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaW9PelBoVzd6bWZLS080\nL2JWVndGeEtjZlhtWm5PZVNSWHpFZDZ1ZkM4CmZQWmkvVVZCaTBxZ2ZzYVl2a3Rt\na0toL00xZ08vNHJzbTJZaExNVXlUcEEKLS0tIDBzVjdBVEpvRzMvdkhkTzFsbnhr\nbGQxZzNYbDdmam9ySUVtVWNEbzRKZTgKkb9xV2KTfJB8Arj4ktjwggRxE0ZJT63z\nF/Dk0uHQHzUcNYEXVyCLz9C+TQpj297qbawQ1ZpVCw5N4EViqhe1qA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-30T02:42:06Z",
--- a/vars/per-machine/b4l/root-password/password-hash/groups/admins
+++ b/vars/per-machine/b4l/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/root-password/password-hash/secret
+++ b/vars/per-machine/b4l/root-password/password-hash/secret
@@ -2,13 +2,41 @@
 	"data": "ENC[AES256_GCM,data:yrBL5S3EZfwsGstoEwUxWQ1uR6Vm2WwXSRdKvWKQi3uL213CyQg4SQtzKXY7oXAS3iejFZUJh4hkFdhv1y24QYKbmbIuPjFqYK52D/XpQPrvtrtmJ4USfTkHL9Vd30ubGkFUCxYJL9Cpwg==,iv:9nmEnMO8mqXpzJUfEjx17AMQDe+0deK7jokXpl0UHxQ=,tag:SPXYD3ERXCmfUN35G7KzUw==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvQURJQmZVRGhYOUovNmVl\nMW9vdk9Nem1LOGttQXFQMk04Vy91UWJkd1RNCndCemlzLzBra3BmTVdlRW9lV2xX\nWGFuL2FCS3BxK3B5OStMMGpndlBRNE0KLS0tIDBkYnVNa01IMjNoTzBTT0k4Y2hv\nd21NZFNMcHFwR0tQaHNTQTFVQjdHcUUKPM7bIpw2uUIahH+0LJOPg0BZ2d/x2jDK\nAm3pPnLl4W7z+kA6ReIa3B+/3XhYRv9t0YowfcFA+7dI9OldGoikBw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGREcXd2eU1q\nelA3aHVxWTVWVzNrYnFjUkJTQURJUXh3aUFNSnVLUTZ6M2sgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpseTNMOHVkMVQxcHEvcHUvTlY1YWlt\nY2ZTUEF0dFpBRjBxcHg5Y0RLVHVZCi0tLSB5eTJQRUdzQ1N1dzlVYWRUcm1jQit3\nV2V3SVZlOXRVRzJIa3FYVldtSjk0Cvxf9HS28JPObz3+y1+e9w1HueQCWri65BVh\n4R7MNNwjSJ6+Eha1tItQcyIiiI4hMcFJVbI6ReZVpJ24agTdOcQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1RnBEOXYyNzdlYXhVNkJY\nUDRHSEl5enhYNlY1d0tVRW9uWi9YVm5rVFdvCmkrWGdMTVJZRlc2YXY0ckZnMU4w\nNTN5NjB2cTVadWpvWjBmaUdSaXpjc00KLS0tIGVweTh0azhFVXhneC9tdWZ2OE5C\nS3Iyc0hSc2FsVyswczBzM2g1citxTjAKLiMWl5VYLIg6M3cSbR56lxXQMFptCqXS\ns9Jl/l/ew+J2onwBvxZy/mbZvQq2eVSXNlWJynBqDHRVT0pTAUQikg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlWUNEcnJlUXQ3eVYzY25L\nbTM2VzFRQ2IvVEVWQjRHOU0rVlRmelA1NmpjCmRLUnhHdGIzRUhjVzY2cXRxd2Ja\nWjV4QXpNSWM1cE9zNHhVSFZJcDZwNEEKLS0tIEpITE1uT2hwNnZSRk5lcXNVRHZo\nU3ZEb20wQzg0ODhSTHNhSnQwbkRORE0KHCUialMfX6t7z3GDyDnklSBpwlunXmLK\nVesI0CsuptsWyEaN6nYU0di1OfLDz7iWQWNw/tFAw++23g/GdjbfUQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLTUpFc1lzT3ZkY2RZYmg2\nUmNCbGtFdWVVaFJURjR1aXh2dmhPbklVanlrCkt4aDVRTlBOL3RQUHJHTDJhQjJ1\nbzVYbFh5ZEE3eExjdndYeFFoTXdSbDgKLS0tIG1SeHk4RE1TUjZucVFuaU0zWmM2\nNC9abU9INEdjcDZtcXhhSksxeDBleXcKTMH6P04s/2PxCRRc+Cb7QqtTMG9cIjaF\no6Ip1Uf0X4yJuSYTKkdMysJDaLYWusUu0KNXyTOouH0wjNZwAeytNg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuRURVY3pQQTJpTjFmcjVO\nRC95ZjdGM2dJQWx3bVpDSkYzYlBzNzRGc2tRClFBN1hKMVhGbUNSQXNxMzBqeW5O\nNHRpMVVYNk1GRk4zSml6aS9NV2laS0kKLS0tIHRzWTd1NWxPTHVJaDQxOHlaMFlu\nQ1BZZSswMy9IZkJkOG5EbGp4cWFhd3MKuC4crWCVb0Tjv5Ngp/KVzNSsl+ZweHbP\nGrubzZ+PjQ0o78WpF7r1fTWnHxIxxxu70DVOqDHhGqBJYvVfw0x9cg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0WnhNNCtpVXRRK3B3SzFk\nMG0yNGJXaUNMU1VXRUJIdnJzQTE4QXNzQ2tRCnFoRHZOeHFzTGx5TTVHcnNBYTJl\nbnc5T2xvWG1PYk9LYitSblFCaWNKanMKLS0tIEJjb045NU5lTTdqYUg2L2crTDNi\nZVJaM3BCSVMrb2FFS2x1eHF6a3lNZzAKxQkwSQevtxLWhusZoAY7DjHhkQUQpobu\nIqBzKyjiV0roL0w9H9wHU85FuIQ6N9W2UixvypG+LQLndsWmycZPtA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHY3WTE2ZVhm\nenFyWWlvcUwvdm5QZlp3UUlmSHJRM1lDdEVRRDFzUjR6QXcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBUXk3YUIrUnFraEVEMlBnK3k1a3l1\nSHpOWHM5K2lKRW9SbERDTHU1TG44Ci0tLSBoY2h1THNjRXNnQ2t3RXlsTVdVTGJS\nSDc2c3BQRXBleWp5TC9uWWhUc3h3Ct5mF7XcKzEk/MUO1QBFajmkr0iLWgC92Q3j\nnEbLpkbeBmzIVttWfKbjBuYeLcxL3v4e2+g1kVfNhxdoNwpmhsE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNNWGsyVGdq\nck9Sc3MrT3J3bmxzUmNUUy9ycmpwcHR6dHM3cDQreVBWSHcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpNc1VscFkrMVNENUh3L0k5d1VXZDNI\nd2tvY21yQSttVS9UYXk5ejZlQW1NCi0tLSBmY2luUUoyUzluUWJOYVh5Z0svNDBq\nZXpRS0IyTUhrWXlldGd0bFdLazVzCtHTDdfwnsMq1LrqQZOXnSTFvuYrBR6YwmPP\nZIuT0eoE+QF9fOeh6auVoJGVMs8FM10irnp+0Vno3KRoUu3jwXE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPZnhDOUxpeXc1TS9tYkJm\ndkNaTUVaNnM5bmNhZ0d3YjZ2SVRCWkdzK3hrCmpqWXFqRTZvSWMxV3V5Z0E0cVhU\nSktYakx4R3lJWXF5ZHllRTJLbEFDTWsKLS0tIHdvbVVTQXBub0xoVnJ6dSt6d1Bv\nL3BSSExoZUVFK1dTMnVMT00rUktIb2cK9kTBk4izlLQc67rdep89IedPALV0CQWP\nPKCOaPCD1MvSWI80thpzvAb+5ZxWP0ZFAE6tA4hktbVDv3Y4IRfTmg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0RzdiTFZPc3RLVmppRkIr\nSFlNZlFVRmNNU0JjMTJ2OXQwQmpGRG16a1FrClg4VlVUc2h0cE5zVlBTMWl2V0VV\nM1BYcnl6MEVFUjEwVE5xNnNEL0FGN1UKLS0tIGRZdTVoNFVwN0VpQ2c2UGpGcUkw\neWd2Q3k5cHZvSVhlVjkrcG91MTNlSVEKwu3rIsUwcyGS6xsFgM1zJz1qsJtdNisN\n4bTGA6ZxSrQYkgMZqOeS2Ka1PLH+3cvg7G4N5Z/hShyf0cjTMAexFg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T04:02:20Z",
--- a/vars/per-machine/b4l/root-password/password/groups/admins
+++ b/vars/per-machine/b4l/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/root-password/password/secret
+++ b/vars/per-machine/b4l/root-password/password/secret
@@ -2,9 +2,41 @@
 	"data": "ENC[AES256_GCM,data:7zPJY5ubDS33FfryNbnEfrWeQDpom6I8QMbISAU=,iv:QqPnPb2yr4Sns1LL04Z0ADngbDSUPbOmaXcASafK7LU=,tag:7nI+ToEzaY26lCJEAr9x2g==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxUHB3NFd5YUNQa1ZrZHVj\nK0FoclZHNThUcy9WRU50QUE3aFpab0FyUmx3CldXU1BybkJDSzAxemZLdjRlNkts\nRUZkUzlmNFI1UzgyMmVhUitSSUNxNGcKLS0tIG40MGtMTUYwYXp4OTRld0xLQkNS\nalhSVWFDRmhRbnJWNUlWdEZRVGE0N2MKjhvfLFO+7W5QokrJI0Vq8zwcYWGJic8Q\n4FbDilsckWB76tAFEJiMvFNWLsVo7/2stncG3M74P+Ofb/QZZNfrrA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG96SlBBTjF5\nd3hISFV4Q3ZWd2pETmQwZExDMjAvM2dYYWo3TWdkTjFyazQgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp1UFlsU3pFMFVLTlhWdVU2MS9FTll0\nRHhWQlJxeEJDcG1BWXZqbTkrekpjCi0tLSB6R21kZWc4ZUFXVDhvMEM4bFExK2Yw\nNWprQXVRZHdsZlBQRjY2VGpKN2RRCpra4Ny0t+LGbVEzLXrVfa++ezfA6R1WqfvK\nalPzO2tYwGxHODsvffdOVay+GWz9jiUHB5rIx7ycv2hIZeGht20=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4NGVBV3pEYXB0dTJMdDAr\nM3p2Mk5FNVp3emNVSG5jeXRwZkhIQXNtY1M4CitpZkpsRVpiU0VlcjZkTDhYaTlL\nVG9MRWl2YW5NMStpL2tvdHFWc2x3bEUKLS0tIHFNMXhkUmRId1RJZTRxU2VUVGJK\nSS9lTWs1bmgxS1dadjlBV1JVNXpXTVEKUqHfVGQJsGCxkACDJdvgghKhGKo9MALv\nZ2IZ3kzDJ4pCFDIbhiYC+6iINdUQQJ5XUTKSLiBcPsBXrSaqnRSqwg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcXhCcE5BR1NrbkU0UU45\nRGF0Q2xvSkNoMzVubWdNWXE0QVhMbW5welZVCkdSTzl6MDhRY3o4blJuVnEzdmw3\nZGJld1JJNUhjMU16MlVFQzliR1dNVmcKLS0tIG9BdmpXeGE2TDEwWmphRjRRRWo3\nd1o1Qis2bTJhbmF3SXZOMHJGeURJNWMKK4Ro7QIApt108zraMDVUnHd3wPViukei\n4g+1Fy8pDxIRlrvuZn9nhplM0YH8gWXfpcFnZomIX4FiVF2b8t8/CA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRElwNlFtZ0FBWHp4Y3Qr\nVDV0V1B4a3l1U3creDBMbHNKWVQrRUMzbVhZClYxWUV2bndzZG8vdDdpOVJQMmZh\neERuKzB4Y0xDSXRtNEtjUytVR1h5RVEKLS0tIEhMTk0yVjV0N0p5V09KZk1hRGx4\nSS9RM1kxQXN6NUtLTTM4TVlsUkVxUzAKuMiyMlIdcpYg/KrKK9XAdcEvKPbplBFf\nJVA2eoTlQsxDnR0Y13YeoDXp+fq2FslB5CU0KCDYetSnvuyPBkN4rQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqekl1RndGM0Exb29YekZV\nMDJXRStXV25Vd01qZk5hMnE5UGpjSDBuZ0RNCjZtSXRWWFdmVDZtclQ2U3ZqbWJD\nNHk0eXJLN2tVaENxbXVYK3d6S1lVOTQKLS0tIG1yR01md2lUT3F3dCtVbTErejFQ\nTUVZS09Fcmp0QzcvMmUvRFZiaFVHREEKafj5XAx7v7SsJJOgw8C1/TAYt+tb3z7n\n3vQ7ebsXSBKfDEI283w1tu91rQklKk21RfilSBUpC8J2vnXejuPvEA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDgxQjRkMmZ2\naFgzNFk1L0NJcHhrSndrdEF0bkN3S2NhT0VYTWdqTFVZUzggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3ZjZ3RnhMVWQ0QXN2b2t2YllOeVg3\nOUZWQWZCTUR2K0VmRllxNElhU0c4Ci0tLSBINFJGcHVQN09mOTlXcDBQR0lGQis2\nczJVNFJEaTZtNXQxZlJwaHZEOTc4CnNookjAFy/zPxEZF9RoWXs6SH1w98SnquxC\n3KDqNeA1JZkeKFOY3lsSkpUIkRuq8AdbXxVa890ejUYLYkU/jr0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9qS3ljOXJJ\nUlNDRUJkWktIckg4T2tuS1VRS1BVd3d4cloxb1kvbUxrbkEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpSRkFabkhYRm9HTnNUUXorWHNHZTNV\nalQ1U0l5MXJ6L0hjbXdqdmVmRjdNCi0tLSBSRkw5eDNDT3NTSXNlT1NZVFFJVkND\ndG5DNzNFc29iQmNOc1ZLYklObWlZCkyPPZko4pJqOTW1uWDMbyNsVIyKZmNy4Mz1\n66fWH4Q+rZhwah8VNb1eSCXYvSj2ZyM+/yvN4JQMHhfVcWLWYgQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEMi9uSnlJbW1HZlNnSEpv\nMjhneEk5dm9IcHIxZjVuNWR0MnVWbURCWWtzCk41dE44VVBJWTJCUTFEY0ZlS3oz\nekVFeEhzakJjaUhMVVlGc0JselZNa0UKLS0tIGdManZCdkZ5OU54R2pJZlhWTGlN\nZzF1QjVyK3pCeld6NldTRkxVN1VYRDQKMHRLCQdf1Rlwdb2APiZrJpYZok7KnBeH\nGazo6O1ahtOSAs+mFHSYBMwik99Ss1YBVSGsRm1Iu3vGIn4fEzXCvA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4S0I0UFl1R29la0ZuMFJD\nb2ZLREVlZ3Z0UDRZbGtwWmJsTHhXUXJqbENzCmthdEM4S2g4K1pxOXh3WVd3czFj\nVStCS2JKMk9XZ2NtelZMMDBWRUFya0UKLS0tIDhkSWo4WStRSWpxalFoTUs1UmVZ\nanBtcXJoM0FGaDNYZ3lPUGovcEZNM0EKbhP5BR7wntLaFHayF4Phyj5LN5mllda3\nSDptf8ivTxxec6WFBDnX5WTWdb2UAdpTR7/eLJkMMGeSMa7+Gqn9FQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-14T04:02:20Z",
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:ada9:8363:202b:faf:be:92ab:e46d
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:NSyWVWXMxoTR07uaLUYX6rHB17wsIB53FZHSsPxgDKJQ2wHBPFNaHSYh+BiSo+IrX+YcdUUqJFhEkjWDyG+vXaNZHrMbg/pzZ/cwTK/lPbYISkwtOhgr3zCA0H6DmQcHVmvR6fsdRDkFwl7pHtn1RMjEORQdbBINtscZfzZFcAF2L1t+WPFxgRKQDNT/9l3f4SoBcuakyg==,iv:/5JbEZ/vj/4I+eEElOY0cnhiYzqqPw2ZKLv2M/xkstw=,tag:23exDL72g56bP7ZbMsK4mA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTYUFSZGpmd2tmdzB6bkp5\naytPd1RhVWFqeXF3SDZia3QzUmRNNGpzcjBFCnl3VElLdXFvV0tFSEFlV3hRMzFH\nbnBnWVZ2QkRHZ1BoTEZxdFg4QWE4ckkKLS0tIHhSMlBKakxmM0xyeUphKytLTmpk\nVW90V05hTUEyTVNMQzZHN2xhYTBZRGcK/nJOIM4m56TE7KKmn/QH89g053mmuKKG\nQYs/86SWdLPqwL35FstQg2xDIHSxkDcoMSGc+C+/xdOjWV3qLil/DQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaU9idi9RZzhNeXhTb0pp\nUkZ3UVpsZlBka2kvZDBqcVhiRVdMNVFZbEJNCkhvdmFaVTBGcVAvalJPSlFuZHhi\nTE9qeTBMMjk2djhFUEdJbWZmTnN3WnMKLS0tIDludThMRDFDUHhCZVV3bUtVdVBZ\neGg4TzdqVjJPeUxYbnBWNURRSWRrMkEKBCACDZgHG5eVKcSdjHDITJZqgR7cHdHq\n9y8qS3YjaFZ37Ui6Lmb9vJEzDCEy3wEupBy4sbAX4okVapGPJ4fmwg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHJtSTZrY29X\nVTZNQm9XS3JsbEZCNDFUR1gxZXpObDdKRmQzUnRZMytOaFEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpYN2xlOFVDZFlEOHhTMGZTVDNjdjdU\ndWlqd2ROamdmelp4UjAyVitnYVQwCi0tLSBZWmVWc2J4YVhLN3VyMTQwamtYRW5K\nWVovUEp3YlN5WjA1VE10MElWMllvCiLrLLekRkmSL5ekLIcFMoqgeEPXSrn15JDd\neKT9sbYtwhB7vt2L57fDRfaF/+7wNb9y6cv2oi+EdDoDXp/EyB4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxiRWYyUmwv\nVjlEdS9LOVV2K1NwdDFhYWM5RS9LcTZFNkNaMWViMkl5bmMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpUQkk4NGZPVWRTbG5MNk9CTStSUXFi\nbXlGemlJR2o2dTB6QUE2Q2JKSnE4Ci0tLSBzZjRva2NtNHlRamNvQWpoZW1UWFMr\nQVdNYXBpOFVhaEVxWm1KNFM4UHJvCnebMj6d/+e0vp00Gb02qJtUp2+mEpF/jUpD\n25cxeoSAWPAhfnBgE+oLzQqnQSq5dCxsWteE/1eOXC68koeT9FY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9udm9sRDBJ\nNFM4dFA2ZDdJMlBXeXYvakM5RHVzNlcrRitzUHF6dnBvMVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpKZnBka3YzK0tUQ1hXTHVheE45Mzkw\ncE04aVVPQWM1eURmb1JaNlBwVlFFCi0tLSBHTlY4UW5FQXExK2cvMUJDZE9NaURy\nOFUxN0dvczJtWlVRc29QWlZ1bGg0CvUoAmTgDVSF7SPpqnkFhkCUn3N/Yr4Tzodw\nyCiD7U/KYFavEIxGIeg+ClhLF9o4fYq9kk8ld0vU8qUADXBdRDE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTUEyUndkSk1iQTB3eUpp\nb0ljaXpwdi9QYmdNV1J3L0NhWElRVzlnNTFVCnZ6Q01ESWRNMHRxdWZKM0lYTXBX\ncko5VitPdWk0UHpwWDhGNzFVZk4yYzgKLS0tIGVRdG5rWkYwOFlCQWNIWFBRalVE\nMmFtOHBvbUw5YXAvMG93MjBrRjdmMGMKlopySr6HS6vfFHiRcwlJz/qy7jzyS1Nf\nw4lw7QnOrvOkoutiK3HiIia5N6V0jd0TV7nJqIu7tz/zYksbzps7QQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVTZNTUM5UXowWTlPRDFW\nVUJTbStFcldHbTVDUVRJYjNiaklWRmowTHdnCkJNbUtmdk1jS3kyaVNWVFlOTytX\nKzBwTmxoZi9NdmJuRFNMNTUyRThNUDQKLS0tIENSMHZ5TGwxQ0xuZkZFQ3RJdGEv\nSXIvYW9WY243cTdzZEtra292K0JFVlEKMWhG/7R00uqLb5l5lU3p9Vt4pre6J85r\nIFWtg1G/54KaFt8aiWcD5RUSSARGZ3r4qVtO+9eWP+gA4DUpSNkWNw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WVlWMHJNbERKUGx0elgx\nUEF1Sms4VCtNRVRraWdvUkFEaTRzYTJ0TTFZCnl0aTIxR1QyQ1VsU0RFNnN1NzBr\neTVQbHJHQjAvYklFVkZkUDRXRGxvSkEKLS0tIHdINHFyQVE2V1V1R1ZxWEFuMm5x\nUVRjSVp6NStGSkQyQ05JVHlXejBEbWsKBlMvtw9MCReN1eSHKMwwsWaEF8kq1Pns\nLNSYEeWABZ5bbPB1xBvmIIlVFThJqgy5mBVJLzQMUwqb0IvixAgFxQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaSmNiVWlRSy91Mm5qSWJ5\nd2Z4WnEydE9ncWwzUVVCMDVoek1wRTFyOFJjCkZjOVZrVHY5d3FKRmMvaXJQWUtU\neGpSZkZITkJaOERkdWZpelA5dTJQOEkKLS0tIEtZOUNJSytYTFpSTWNuY3JjcnJv\nbFZpTXQxc29Pd1FIN0xrcEJYc3ZlV0kKyO/PLn2WNdVtTqM8cG1XFqV/5YdSqPAY\nvroStGVsLliV7W4T2MAmACeyjoMde9/gVosKfGc6awE+Bi2BUxrqpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T07:22:09Z",
+		"mac": "ENC[AES256_GCM,data:OxeLto6aeiTOX8OffRsQzxyluSdva7y3j4j67c+MI1ost+QCZyGAW/5pr2mMaoU2XrwYqUjZTKBhJ9p1FY6C29/EhyzrNhGUTjC5iTcXO1lbLUTgoSDN8KPmVea97sTa+easVHoSgnPLxisG2yCALv95k9/eQ7vF9FRjBBNTaIU=,iv:FQeojhtnKOlqWuQNJo1TmI/PhjYbgwtvK24gZMjbbpM=,tag:Vwum5bSSZRNNDQ3Yudw4hQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rigel/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/rigel/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/rigel/openssh/ssh.id_ed25519/secret
@@ -3,12 +3,40 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSHNvb1lZWnpkQWd2UEs0\nUk9CL2E2d1VSdzhpSTVKTnM0cmRqWndNb3hvCmtreFBacnQwdGNpSVFmY0J6R1Nl\ncFczTkpjaEpxcGdtcW1JaUpxUHpKZkEKLS0tIFBndDA4aU02M040U2ZuOE5HcWxO\neXdzZUhMSURhNXVFaDVwNzFqZkNhUWcKrjanrjMbRpJvXqKG/K1LvZxDFatcYYiO\nWs/Bg+3pLddus87Hv3qTqL7L25BdNeHfZjrxo34t0u+0b5bYTGwEgQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2NHA2MjFnWVBNMHlwbTF5\nNUdreEFORU4wR3JIZUhIT1VicEhIZGRjN3pvCmp5Q0dwQWdDc3FZRVFkMzBDL2hy\ndW5tRWUxNENiVXFTdHBHRUpERWVqMFkKLS0tIHBQL0c5Q0ZuT2RyRVZIRHRSbHpD\ncklSTmxkdU1HOHNJRTB6UDNZT2lVcm8KgHEhB7H771DULZ/4z/t+XnijY0aJsTDk\nl2tC/WIlyUlbIa82FmZ7Q9R77krp14zGBeXuLuCTjKUsnMypZ7pAGg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3T3ZBdXZYYVdabTBMbk5J\nMUJScm1pTC9jK2ZEQWh2RzdkWjlJVENBd0VzCmI1cGVaczFlWU1wUWpXZy9nZFkx\nRmtBb1c5Rk5Jc3NoOWdMbXRNRTRpWXMKLS0tIFdJV3ZQak9sQS9Gb0pWUzl4anRV\neUVoMHVMNFN3VEpneCswNktVQjhSRkUK2aU2tZ9zhKbQw8FnjqEsnjjDc7C6DGoO\nOyUkJOqt9QexJJzYosXp5tUW0vI2R5Abc4NsBWD4qTFaQLSeiVwq3A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFemR3NWZpUVBuSUl1dWVT\nOWlYaTluL3RBWEgwQVprK1dSUlNISmVNMkIwCkdCL2NjOTF5NUREM2lsckhwS0cz\nNWNRdEg5dWZoNVlFdXRVa0RqNThHVnMKLS0tIHFkVjlXQVlEZTNpM2d6TE45azFR\nVWhsTy9EVHFYQkU2M0pka3pFTlZUSzQKg9ghMroz+STa0QFd62EIFF33A9qgBmFB\nM7o+Ls+ZKXVT1alx1Q1+g8weQWT301AtB5yWvdB7+QzT3ndmUCELjA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGIrK0cyVndo\nT1dMdW1IRUxmcEsvZ2RjSkFzR1lMUGxCSjkvYkJ5Z0NNaVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwphN3RHanVLWEtMTlg4Wi9rQUFydE91\nUEx3Q0pYNlkxS0xaSXBhSGU3TzNnCi0tLSBPL0pFV2RZOU1CRnNOVWQwM04yU3p6\nTEI0NGpYR3lvdEwwckJ2dUpNZFdzCg+ImqWOjEtdIxx7a+4XiV9NsbtDD881qmxr\nh/hxakyJ04h6FZgduZh3UUr9TVnc/8NzmGBgsM6MwvWNE8d9S8g=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdzakpUcUdK\nQ1F6SDVJdGRXdXJYMGl4QXVLenhrdHhMUDBTWFVrV29md2cgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQoxT1pXV2E1U0lpZlZ5NHkwNUN2ckt3\neTk3Mll3Wm1IUHlrdVZ3Nld5S21jCi0tLSAzT05aWTdrY29GTmU1eVlobjVnamM0\nU0tWTW1yaVk3c1FxT1V4V0k4T1hnCv4IWAAD2wpfDu7dqEtnnFjAIOwwaNLV53A0\nmorBeavIHOO77lUjPOnGVuLyN9RSgwF4Uc4KFEybN8ovRwvmrfo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXeU9wM2dDU2s1RldHOXZS\nd3lxMzB0VjBzaVVNZUY5a0hXcGwwNUZJNXg0CjE1ME9xbDMyL2x1aUxpY3VRRW44\nWVhvWnVOOEc3bE45dm5HakhtNERLTlEKLS0tIGczRUpycTA3WVo5cWQ1RnA2OHJ6\nZE0wRXV0ZlFIRytHZXVSNDFkZVF2bm8KxRZaHHElp5djSM/6WC3LqxaXBib3k/gJ\nfq9B+21UJGP7Q2UOprVoZswd29979L7gA6Xm+s9ycmfeuItbAcR9JQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6OFdiWWhwbUpDcjJoRW9V\nNGZkYVdYb284cFI2OUVCN2lRc2VkTGIvclIwClRyb3JlN1NlMVMwK2ZHZ29sSDBz\naFhIMWxRdDF2RTMwS2FrdTRpVUxWRjQKLS0tIENmWmYwTmptMjZjOWNQMU0wbTB4\nQnJRNDNlTzVIQURoWXd5dUlHVGM5WUUKQVpBMjVXjA9RZl0tMADeyme7mrNyp/ri\nxWkWET7X9DG2alLLhdUojQeJqfXJ4iLYROFV73kgUYMqaHE1ULz16Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMHVtUFpPWXQ3SDBTdnlv\nMUFSUDgrV1Y0YXdaRkhaUVlEN3VRQ3E0VEVvClJxaWlYUDdPTkNWeGlRYzJaL01Z\nbHJTWHprN3dkWHhGemRnbm8xQzRTL0UKLS0tIEc1QjMzSHpBQXQvcVk0eGJPcHBp\nS25LMGlIVk8zZVNCdWE5Rm82bGQrTlUK+FoWEPTHRJtoCrPlR6CYyNPK5gfFCtKn\nEvx/0sJmxk1Saa6fgPIs7Mpy7FdzfFsDEgG+kPK4npQQ9AWzFp1Ckg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpFeEFYTzFD\nZmxsaXB1VmZzZ2xXOUd0SWpRNVFtY00zQi9rRVNiVmJxak0gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwowbXNOMGlwOFNlSnVNRmJubFp3WlZ3\nbFg0bkxLcTdpSHVUZGtSZTY0dk9VCi0tLSBUWGdQS3NoWGtTUUE3R3RaZmF1VWtM\nZ1htbnh2MlpSc0RtQW56NGxWWUg0CtDvD6oNIzfFDvcocYcGNQwysSWiEzhdGLej\nespCcxXyIs79jU1aHArqdAgpmlm4Fw6Tg6HIEKwJF8TmrCqa3v0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaUnFDUDEyZEFSR0ZwaE1Q\nd1MrR2tETkNRM09Mc3ZhVFNHc3RRbnBTL0FFCkZNSlBOMU5BN0lHeXZmRktLdmJH\nNVlqQWY0NDU4SFVvSnlEN08xbm1POUkKLS0tIHBQWnpZNU1DblVEWExkVmo2dDR5\nQnozOXJKZkhQK2E4eE45cFVXS3R4OUEKJaYL302QnhrOwnAhYB0+jMFeKiTNiIOq\nd+UCHT592OMAwsggS3/F2iIuw0bCiM3FqYttxTgfjz2X2Vesm54T6A==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-25T02:12:20Z",
--- a/vars/per-machine/rigel/root-password/password-hash/groups/admins
+++ b/vars/per-machine/rigel/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/root-password/password-hash/secret
+++ b/vars/per-machine/rigel/root-password/password-hash/secret
@@ -3,12 +3,40 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4LzEyVDNDY24wVU5tdlUx\nSnBlWVVVbnBETVpKM3pqMWY5S0UzVm9MRVJNCm9OMzk1SG9DSmFPUEJWMUVpdDRC\nV2NBV3dLT0sra2hBZWFkalRMRUpGU1EKLS0tIG1FZFpIb2svdlhYOXNRcnBtSkRO\nbTZmcE90TFRrcGhBRndmd3ZqYXFyM3cKuGcOwRhp1PL1jQ7/8sunlGawJatHcd0u\nQxyndvAPO9J3YAe8xLLPoLNtPODc4UdGWvOBYr+PHAN4YXwfoRi95g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAveEVQL291c1VmYkxXTnRq\nTmZyV0JNbCtqczJZd1pYN2hCZUxpZ24rOWljCnZMeE5XZ1FvSmF2ajE2V0ppZGZS\nVFJtVXRVWW5oS0t5OUV2ZzBtUXdEMXMKLS0tIFg2VVVWZUpBcW5uUUZPNG0zaVM4\nZy9pazRJZkpBb0VIdXlGcVllNVMrSUUKXGcej6SFvzTNhGNCwF4L+IknIQR8vFgk\nh8uDPvkuAzCjL8Pi6cIIHNVMClN5lLKEGQEcwPgZmoloU4XOvme8pw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4YXVSZ2JLdlY0akFUMTZY\nODJTSGhleVcvaEdHanJKbGl4R01BZFF4M1cwCnkwZWN4WTNENWplNElmU2FiRXhG\nYjJHTEU4RTd2NWtjVnZkQW5RRkV2T2cKLS0tIFYreTZ0dzd6czNtdzNtbkJaNGdj\nMEpxemovcVZCZDRQNHgvRWxFdzRJY2cKD+WyAv9IfUzWHG518Ytv9ARpRM2pHs0w\nIxjKG11O7pxzUZYpjtZSxNmimWb1+dq/VAxkq2afeWYBxTzzOAmh6A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlbnovengxVEpCd0xSOTlh\nc1V1VkI2RUl1MFJycmRDcGFYTnUzdVhCWmt3CkxLOFJ1UkhpY2FXWEFDWHl0MjJU\nYUNXZGo5UVRQSmFRT051RHZZUlhPNEUKLS0tIEc5c2tVejRzVG9ZMTQ4bGJhUmc3\nMGE1YTQrK1VLR1oyM1ExSXY3VWgvQncKHlRWGCBIYXGT0cnI77LPLCPjnzy3Y4sM\n591hMX0SQfZbV42BEdm41hqRAj4GS5sEPa/dsIkco9Y7RoLtr/Ytxw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHhKUzI0Nk5T\nSjJTVE9JbGdNZ2doc1IwZmMwSXRGOUU1SWN2K3ZyblNTbFEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpaVTl4RHBJM2UrYjJ6N3hlQnpkMjFx\nclZzaUNhS1ZZMnhVVFVxTmk5TkE4Ci0tLSBtR0p5TWNwZ2ZsN0YreU1wN29ERHIw\nK3VWR2xIdjBvYW53NFBhdm5NaHlBCv27lkCHstxxEMFVGq8srX5oWVueAmaluOd3\nfaL6sBozeWU9B2F43mb0YNk1QBjS1Uq+bwXLYhpQkb+XRbP9RIk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIER6ejdWN3hV\nYzg4azQrZzVpZjdRQnZ6MGlmSzdpekJwbFBIS3dFdE9DWDAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpZVGw4SlNUdzJrMUlaRlNvaUdMK1J5\ndkZscE5PSlBtVS9MTE84TXBuMHZrCi0tLSBTRHBQbWttNzJ1MTJwNGUvYmJQdGpL\nRFN0cW9WTEZqUjlnRmd2Wk1BSE1VCv54yFQCuJ7/w3fnqroBmW0pTdSmj4TrHrH1\nn4LKPxcp2vqh2nYIiMxzj46T5RXDgPU82KX/odtRLyb/WFIcii0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvejgwWDlwUkJ3REdTU3ky\nL1FVK2dqUDNNdnY2ci9iY1ZKZ3NTWWJ6ZHpRCkIvT0tPNDN4RzA5ZUlIUk0yUnRx\nZjl2U2lYdmlrL05VTER5a2V6RlA5UGcKLS0tIFVZdlR4UEJPMTQ1WmJpcWg4Q0JO\nQmN0SnNuT25DY1JHa21wUkhiQVIxcHMKc7pmzJd5DT3uBMHpu8X0eTGam0VS5HyK\nQ5wfpdMc6i8Dujz3gKsXOxUzxY/PNOgq63R8WpbIF9aOqYRJt9siHg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VFN5aU5JQ0J6TEF0djU2\nZHBobE1FNjFrdFkzRXpESDNhY3BVUy9UdVU4CitKd2ZxSkpuZ1hBUmh2Z2k2WW5r\nbXBlbzZrNVA4UFEvWlR3TThtbWptSWsKLS0tIElwaGEveXVDTzVZQVFQbmNleFhR\nK0I5MW9pV2trQ3lIUHNlVnQ2Y1pmSUkK9W9dDXsIvv11Z1J9wcbp3lO+/Q63LGzc\n4SorHlP2X+IYOmpPqZKDiG0qkxJeeA9qYH1TWYZUEhtd9zXJ+aZaAg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4cFdQRS9LdkkwdHUzMDVY\na1psc2tqdU9GcTEzdWprT1lUNUdDTmxYelJvClM1OHNQU2NEa0pJQmhOZ2VERzlQ\nczlnQU16MTZWWU5MWXRkKzlQMURCZG8KLS0tIFk1MUdLVXZQazNWWDFwQjJGQlRp\nUXo5RW5NZnN0Z2NZY0pFcEdhMDkwelkKqwv71dnahWRu9kJTGU7XE3aryyvgz2B+\nyqmGJfGkh9snHc+lRgJXjBVRw8o5dy7ZSlNTRBMtltcF1pEhiOg1SA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDgrUUp6RE9Z\nNWFWT040THUyZlZUZEtGNUNlU2N4blFKRWFzckdRK1NiVGMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpkbGkxUEIrRlpURTJXM3IySURRWGgy\nK1daVFNkbnRoODM3bVdSTlR1dUswCi0tLSBMQmZMenh4amx6WVBTcForQ3ZjRSt4\nSzgrdGo0MGJxdlVCdGZkcUZRdTk4CsNj6yPX9gpB2+cIirYARkz73/9HBwfuLYc1\nBaf/Hae3hQEyJnsoTW9ITYsycNP6SGAZk2XL4j5iZIPyzigkRL8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPTDRNVnhibzFrNW0xdnVH\nNDlzME5DdE5SMTE4U2NWSDVEWmloWEQ1MERvCk9HZ3FzcVlFbTJNaS9yVS9yVG9s\nVTZESXUxdURyU20xY0Zub0Vab2V5YTAKLS0tIDRLRGhSb0ZFeWU4L0taTFZVYWlr\nWERHL0ZGOFdXKzBTcXA2WFByMHZGSWcKaCvJwGHSQBTJEWY0ZTVF9QsSVVEzBEsQ\nyYBKNbZEUnbHolvK6diCOvqmmV+HVaZsGlAOcqyVPDMnG7r4K58SNQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-25T02:22:53Z",
--- a/vars/per-machine/rigel/root-password/password/groups/admins
+++ b/vars/per-machine/rigel/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/root-password/password/secret
+++ b/vars/per-machine/rigel/root-password/password/secret
@@ -4,7 +4,39 @@
 		"age": [
 			{
 				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUWld3KzIwNkpoZ3U1NU1R\nVkRZaSt0TVE0OWxWU29JeUt1L0RwOHhwd2dJCmhqMERRTStHRklxeWpaTW5vZ3lZ\nQUg2dzI0Z0tBWk1lL2JOY0VGR3FqL0kKLS0tIHM0RXRZMUZ6VUdUbjBrQmVRdXdW\nSVQvVXdxb29RellHVTI0SlRVR3huNm8KPecjjCf9DxHj0oBJ82w1GTtBKQIdsHar\nmHCHk6n5Pp91SH/Xq/fDMWzi11eVSShs6XEG/fJuMCamXpOjxOQkNg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSUhXSlU2dXF5Y2FsMWFn\nYm5hbklEcEwzSnhaVFdsdkJ1cWhubW1tNjNRCmZCUVNyMjY4TEpLNTY4Z2xYT3Rk\nWmQ4NDdLNUk2K1BIV1NhczBhUjRWYk0KLS0tIEhtbzZyZS9UMTR2b2F0OUZFdzVx\nMk1rbk9vSFBpRzhNR2E5ZGZsVFdEN2sKpdr3S8O5S4a/cDOTUviD+rCCYsMAt5pO\n60LwPMVETYAERCBlhITHsVIznBpwasBbp1MdaNuzJHQqun9XlQusWA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoa3pkQmJVZURXOG90eGRG\nYUNPTDdha2hvZDBtWUVDNnNaVmJ3Z3MzZ2tVCnpGUDd4c0Y4V2s5R1Q0MDNIM0xU\nZktud1F0QkhqZThnZzcyUU53N0VmU28KLS0tIFNqNlNnTzdYa3NNQ2hkQ1h3a0Fo\nc0VQT0ZHZ2s3S2FlSzU2OGxINjJHbGcKBF7odaMGwaxh5yCv9WKEyCJ2Y25QKtE7\ndsNAULctb3E2W+8Brfh5gUJ5lRY8t6NNaqyw+B6g98cRkQjBGCZoWw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZxdEJHcCsz\nSEFsMStjVkExTUZLeTR5SHppcSsrWVFwOVovV1pJdmxhRVEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4RmpXZE0wNVg0Rk83QzliVGZmOElz\nSTlWdFk5MUc4d1YzUGgzdlNUbVRvCi0tLSArUVc1VGtUQW96aTB1UG11ZEIyMEVh\ncFkvOWlwNEJMNWpIcmw0L2JxRlBrCll4AszpUMQDWYktZdSLAnzL7y1lskUL7LH8\ntNEmYh4Dkjf+Gdj4h/MbskDpi/RiYujxc5WlM/F2zdbuxicqw5U=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNQNXlMNGlV\nRjJHS1lHS1d1T3lLMHVQNVBQY1pBOGZiUmROaUl3TWYwakEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpoT2lZYkkrTTJCQU9IT3B6TzJCQmIy\na0QxKzRMTWIvTU0wbzh5MXEzUUVrCi0tLSBIV1BKQXdBQTljdktOb3ZVTE1vYlhI\nT3B3bWtwR1BJTDVSWG9iVzI3YW5vCu94TOPD/LtmCyJ9XEbjztyXPZB43447JXH1\nX+HWVE3ofOTSE2UAWdShX+cLtHIiDyMbxjIBbugRNxRYHd2ASfM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5SGxDbGh5NmhrT090eEo3\nL201amtORnFscVRWa3U0Z2JnVWxuamlQN1Q0CnQrZ1R5YVArRlkxKzNwUXdVVHFU\nUFBNZHBkaXZBTWNTWjZ0NnFOTUVRa2sKLS0tIEpiMS9JcnBkVEwyaGF1enFOYUpW\nUjYrUkNhc0VSK1lBSEFiZzgwaE5HRFkK/e4o+EE/rTJr6mPYFP6+qoTCqRUlqTAy\nkL+Pl1XZGjuaLH18m/rOcMoELDwBBkVDN+eMXFVNWsJqQRJTw3QTew==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEUzlZZWxOQmV1VGRobjY1\nM2NRUnExcmRlZ3YyMlAzMXR3VHNsTlRLU3dBClNUZi9ib0hUYkIvaEo4L1ZUUnlx\ndlFhSEFHVUVJTGFDUHhQdWdZRTQveDAKLS0tIG5jTUhkeUQ4aTZwdDVJUjhjWHVh\nYTI0WEFPS2cvUG9tWUhuLzVtdDFzc3cKLz8/Htm83yRas9UJbflxXwNUrpMPjcW0\ncINgfuk/u64AfHDbrdMXJiOszKp7Z1Xh53LPd3KSEkmaKwx9gHjdDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOU29GVnBpWVNrYXpyRWRs\nVzNha20xNzlML1JQZVhEd1J5WXkxUHVZTFg4CnduNVpzUDkwemEzaXhxeWM2dzVl\nMzdDUjN2cjhMK2IzQjc0cXlYK3h3aUkKLS0tIEVsQlVNNi94dzZVV2JyTStWUTh4\nNmdNZHZxVHNYN1hDRHg0bUtsYml4TkUKBYZNJdh3u/3JmmJwHuKMvZKgTuUcLlw0\nozRn35F0maiMsprCKagNub3HqX3XY0LZ8t3QLswMaBWZAIzk/N89Mg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHU1SG5sTHNh\nN3QzOW05RG14ZS9KZEVTUUx4bUdka0lUQkVBNnVyYk5DVzAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpKNmZXamF1VnRSSlZFZ1dURnNPaXZx\nNjlaSGNFc2JheTJ3YlpvVGtvVXNZCi0tLSBKb0VDVnNVVXg0SUZCb3VkNkY1YWlK\naE5QTjdkMHFWdXZVcUN5VmJBUkUwChKsvtUo42AAXl3ZLPKzo2hEGKJMgWBhsy1h\nwG7srETzhPwkBDsyExqun+St2WHPbq8TAe4oYgRw/y10uI7qskE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTzNoUStubzQ4UC9xd0py\ndjVVbDB5VHlETUJBbHlTcU5tSXpwUzB1YWw4ClV5L2NtNmJxN3F4bFdTeG52YVAz\nZFhzQmNCNGt5Rk0rYmgzVGRBdzJGTmMKLS0tIDdjTmxwSjJxME5ua29IZmVCZ2Fk\nMkM1aE1zUXhSS1JDblhHTVRGLzNmdlUKnDY5NXj7Vxltk4wAQytmC3S0hkJyKV/4\nSaaB4EAS1xsRM5CChQ+8p1LXiO4KB04uMeb4+jI8thW47ogdEHRXTg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-25T02:22:53Z",
--- a/vars/per-machine/rigel/zerotier/zerotier-identity-secret/groups/admins
+++ b/vars/per-machine/rigel/zerotier/zerotier-identity-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/zerotier/zerotier-identity-secret/machines/rigel
+++ b/vars/per-machine/rigel/zerotier/zerotier-identity-secret/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/rigel/zerotier/zerotier-identity-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:HyP/Y+xjRTrixNZ6sZS4wMix3KXEYckSEhOBzUA2qS3XSB+1VyVPUCfAQjyV0jjzUAvXa8cYo5NpQIqV6whLasTTX8TgROkjlh1bIkRzrxVfZ3Rzsp25y7ZtyvTOZT12OJqmQb9LVI14eL5aG7JRRwpsff2VxqXbfynz2G3XvhCsaF3cb0rGVaE1AhJNN7E9jLkmLyxFTYkuFNZBw4FmP3CMeQTwnRsV8PUAs1HLeGoU/8rs3apK0VS7UXeFSXxIMK7tygPa3Bzu9nEqFTfL1fOIHXjiMwWisn7Rs0sIKVd6vBY5WPclV4Q6mk1KJD+BfhljPWs8Wu9a98A/j2imKXF1TQe1aGVFLTMDmhMM,iv:A8WntsxBmFW3fp2bVSPhfcxj1/K3MRr6e4vxquY0YG8=,tag:vqKuaeEPH0oI19iTEF5/jw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUaWlpWXZJRno3Z2I0K003\nQk5RVmYwS25GdStuYU1taVB1a2cwbXVnSHk0CmpvbEhsdVl2RTlUcHlMRjhNZG9j\ndDJqQnBIOTNYWTRYLzQ1OTRueGFvaGcKLS0tIEN2SVB2QUhTZUdGaDl6SVBHak9G\naWtkT1ZDLzBQVDhHV3krZ3F3OGUzN0EKggPAMl3Z/U+1xOGB3syCnBG5IkkYp3k8\nEVI8ZNqP1AfKK8Cnc16lZ8ImLBjZnh8OdNJUSdemrCfxYnkxk9bUoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvV2I0MFNnTERvTGExb1Q0\ndld3VjBNQjhVaFpJdzlxYWE0N05tc0N4YVY4CkUxU3RIdzl1Y0dSTTFVZ2UwUjRG\naW5FaG1vaHBzcVU3QmMvU2swM0lLWTQKLS0tIGRLYXZ4Ly94RExMeER1UjJ5NUlB\nTGV3MWFlNHJDTisvZUphWFc4b1hRd1EKZ2IQcUpBTZq2+SkPbsLHNgsb3K/63QNu\nNQr886LiO8ERLw9NZ87WG2p50FHRNKAviTZm9XZf/AgGdBH+cpvg7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFk5ZzRCeXNx\nZ0pUeWlSVXRTYjMyeHRJRmNCSitDL2JEeFc1czU1VUpxVEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpGSlY0dkduZWREK09tRGtmeWVzMW1o\nOTB1WmJ5YTBKeVJZUTJHYXM2dlB3Ci0tLSB5Mnk0R2VQOHNyUVlVaytKUU5GMGtx\ndW5oTGtLQ0RQRUxKRktNeS9FSEF3CgG0zNOuH54TxGzBFFgvMVCtDh/6nyhwWi/m\nUNOtZrlcT7qwaqBvMSjGjnWAEqwr+s15P9wi2lPX/UdVUpXa2N4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEVvNzJ3YlFW\nd0YrenJZcHdQK2YyYzNGa3BqY2ZVeElyQmkxMlJuSHlVMHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwowbDB0akhEZG5weklKNmxxa1VzbmhY\nR1QraHErWCtZa0F5aTdkWGVKRkZzCi0tLSBOR1NNQkdDWmlwZ3NaSTVhaW4rN1Nk\nZkUrMklBb3NmeXN0QTY0cGFXRUZFCkzEyNFrzpKxFENcq84i2dSsBp6ltOAIt3CZ\ncHDCmL29d5/LjWrb4Qbp8lPYPr94kJLbtAoL1JmN+hAJqCY7JVI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpNaUFzYmY3\nQk1ncEFYM1RkZTJQY2JTR0RWbWFENkRhalVtUDcyZXNjVU0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwphNkVjYUcwRnN3RWJCMTRXT1hlcVA2\nMGFWUzFRTFlUbTUyR2Z4WlVDbk9JCi0tLSBBVFhlUnlxbWQ3WU9KL0t6a0tNMkF3\nTjBybHZWOVhnL0oyemxQR2Zwbk1NCmQL+jg7YhafYZMP00eQvJpNwvXK4sSJ6pPd\nONYhdpYWSqorv6O53ch9ipDhL6X3RPgHRyX3R+fIFstArOtOWvs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNTFiRjJud3FTN1lZNDY3\nTFNKQStzSGVzaC9MMjI5ZVJ0Z1BzWW5TSkVZCkhwNit5dTkwbWRncTRkNm1URDJN\nZlJrNlMyL1dRRWlRTUYrOXFjamVtVk0KLS0tIE1Wd0pTdkVRdXFlQjhhTnY4WlNV\nclRacUV2bGZmalV2bkhVWEtWbXM0blUKpjB3n1v/2ZGSHwZB6VqQDmvBpQJ+C8lM\nThKdQL9BqWhizig2Y1sYuXSSbktcsme6AabDNh/7FkrfRW8HGbXj6A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQXZpbkMvc1cySk43cWdN\nSzZTdTRpR2czR0crMXJtTUxNazBjU0FkV0U4CmJmcG01SHhOTk5wVjNrNmE0N1VD\nYVMyZGg3Zk15MlZwRTZsS1Y1Q2lxRzQKLS0tIE5zditwbkc3dU10RVlPUWJCWEUw\nUHZpbC82bG0vdy9veXhtazA1ckR0MjgKmwJI23KxoGn7QPkcxYnOYQfHG2qdQzzK\nm2+qXvA8Iful/7sB71GvcUoSFMqvR8jDo84PO3tUuFPZvgf3CfITJg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrODlOWnl3R0lVM2ZJYVQ1\nczdKcnZWTmEzS3U0akhvL1RZbDc4ZFJNU2hRCmplQlhOZU9kdy9iUmV1eHk2M3Ns\nZTJDdDlnZ2tEd3dtVTNVVmJCME56K0EKLS0tIEoxTUwxcmYrSHdpbzlnOEVSYS84\nUlV3RlNNa25RZXpQTXNTUXp4ckxnd0kK2sRFVRZ/7uaB8S9wfEVO05fNlwXH7Cf6\nT/rRpXAvjGSABWq6Fwzt5dPvIf7iKntYHHP3RHsB3dBoxhQayEFoZw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxa1hzSlFtNndUeWNad3g1\nZWFsV3dGQjRVem9SZS81WU5iWTdDNGtZRXhnCkFTT0tOSng1RWtRODROZStxNmd1\nODNQQndGSk1wcUFvdjlRYUM3ZHJMMjAKLS0tIDFZS0dlMXZ2QTdLdFRhT2szSksz\nZitZcU9MendCbkQ5NXVHSDY4TXByRncK8CajXcPrPFpMnOGWlx0Cp1boK9fujUbc\nN8Uz7J++4wsZF68Pri2a1fCHXXDRtkPYQi2IDvuAtVslC21rFJp5pQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-24T08:01:35Z",
+		"mac": "ENC[AES256_GCM,data:0U1N+gx4OChXGJBoXLurTsiCshv1kx1aQLnDT+Yu5+igWS60XgtIrkbriy7SMbL1eGrEZWjtuIKw4QEN0alkNWFb1h6T1fYYKQaenKK/dUTautgpfAyxElDNJZ9bBVnYAH4axCvYuR7W5kgqvfLagXQU2D6fpargfdHWxG41J3g=,iv:czkt4doampkV+5X2NXIG23cEzJIrBSN0co2IzRQAMks=,tag:yWyBfOwg9cRzc5xoMFiW7g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/rigel/zerotier/zerotier-identity-secret/users/kurogeek
+++ b/vars/per-machine/rigel/zerotier/zerotier-identity-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rigel/zerotier/zerotier-ip/value
+++ b/vars/per-machine/rigel/zerotier/zerotier-ip/value
@@ -0,0 +1 @@
+fd79:fada:fbe9:8c5d:d899:9379:fada:fbe9
--- a/vars/per-machine/rigel/zerotier/zerotier-network-id/value
+++ b/vars/per-machine/rigel/zerotier/zerotier-network-id/value
@@ -0,0 +1 @@
+79fadafbe98c5dd8
--- a/vars/per-machine/vega/nextcloud/adminpassFile/groups/admins
+++ b/vars/per-machine/vega/nextcloud/adminpassFile/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/nextcloud/adminpassFile/machines/vega
+++ b/vars/per-machine/vega/nextcloud/adminpassFile/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/nextcloud/adminpassFile/secret
+++ b/vars/per-machine/vega/nextcloud/adminpassFile/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:8WNZYX0r9a8TGoO4JiogOZmgv3jDEQ2B5Ubc6JE5dNdokQ==,iv:WupqJ9NLHRdKEcMFd3JviX1CL0FSrri/hxL4ePnPs/A=,tag:kvlS0bwOikdSsyhIo6Gbow==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGZPY1hZL214\ncVJ2bm9qTmR0MHZFY1VtVjdDT0h2c2ZPUTVIOFFVWDdNd3cgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo1NjRpNllvOFhJNnI4VDRHUWtnMndw\nUVZDTzRTK0FLb1orYm9WaXR1d3ZRCi0tLSBnWSt6Y2FaZ3NTRmREUGpvc0QxWFdz\naUQ4eVlpRlQvYXlhTmRiNjZZR2RVCjadjzYus2Ao4x8UvciVQl++kU3ie6I4tu2F\nhpZdq9+knbzUopWX4A0jdrBwUlu4im1IgBqqJlWxG333ThcVBdo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExMZzU2Y3do\nck1zRktzT0hYT01rUmlQWmlodHVjZW1EYzdoUlE2enhyVDggQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpFR3hrcnJYdkx1NWMzeEFPOXVic29h\nYUdpOGo4SnUvRkFKTGlRZmdjZ2dNCi0tLSBGQlFPeGJsU1IvcnNUMTdVQmZiajc4\nTkFKMU1vYURseWR5eGFCT0FpaHIwCkwK8EXaRMCtNqqzR3gaklpTULy+2ACNDeAw\nyJVRm+Svx+4/bjt/LoKcNtaMEjIPuUHR66ffs3H0Dd9bLSetHu0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdHZ4ZlZJWXFRTzFIKzdB\nNVh1TVFnREhvVGM3MU04RWRNcE92bk8xWno4CkNOQkt0TERzMWFXYmlSbXJZWCtI\nYTdCMzUrcVJaNmR0U3lBUENIazhlRWMKLS0tIHNHb1JiV2JyRmVKRDkyV2VlTkNq\nVmVLdWk4SnJCMEcrZysraDFhS2hwYWMKlpCitnwEx8yzJ5tcPukGXrJLvSzP4gk+\nHk51WG4V8M/wLJ01CPniCSmkC8s5uUCeiEbsTieWik+oLc71ZqbzUw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpTU45bVU4SDZPb1hUMEJ6\nYUZlRzBpM2d0ZWZHZ0piVU5RQWpSVitxSUd3CnVqMFNvWGRJQXNTakJOa1ZJTXdV\nSDIyZkNkc1hGVDJpVk1keTFtSkRCRjQKLS0tIHFKRWZCSjROdWEwdDJHQThqYkk5\nc2E3QTRyZGRLZ3RoaWNRREhVSkJFUzAKUKDVxGcDm2+0l8OxcuEMJhwJuhc2uH3K\n4qWQP9YeFwTh79Dltq8+mBSxKXFzM4HVvMhUl+2WrDccwDK2UUN1Xw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqKzhERDBRaGtReVZ1UmNN\nMlBianQzaTRWcEZPWlZ6cVI2ZENUQ3NuWVVZCmJvRHFyK1Jzc2h4UDVoZkZYU2lT\nZCtCczZPWUdvOVBvb1FUUVJlQk1XM3cKLS0tIG5kYU81N1ZRS3hWTzRyTE5CbWJ2\nalJkZ3B4VXh0OFpSR0gyK3BSQ0tWZ3cKa78Y1SpbIsQvRKhUyEkIwHZSc5Rw3GBV\n/7OlMibkSzNm1tgHe12jA8c+z6wj5qxS6LxPOdRnvKZlqBzA/QIMIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2NVRGbzFCY2RKMktSMHpo\nRE1Lc2VpZGxmNktWdE1XTHd6VHB3Z2ZwWEY0ClovQkMvS3g2Uk9OcTBzUnUzdm9x\nT2RudkRNT0JlbHNNVlpYZ3dDeVNwdmMKLS0tIFZUcHU2dk1nQWt5S2NGbmtpaWp2\nQW5SN1p5VGRyekQ2M3Y1NmFCSXJkQncKEXtJZnjAPmxWqch3sP4ZMwCYNttsWIfK\njZEJxZqJOmbgGYGRoXy8J1+/BQHSiqRwSJLSxW+2KlFq93gv9Cd0zA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBua3A3am03ejZ3ZGZYZjBP\nMXJNUDY5MmtzMkdwQXJDNzFTcS9Sc0Z4MVFvCnBoZkhJZUdYdHhnc0VtZWRMOVNm\nbTd5TEtJY3NTcWtqSS95ak9CNHBuL0kKLS0tIGtXVlp1Nm5jUktzK0ZYbUNlTExV\nbUhhOEM3NlUxRVhydDFKVVRxS3RCRGcKgdKLJasZC1nNakRHoRVl++T4huNIOVzJ\n5wgnP51BRfi/SAtKfGcBoK4gBB427EUwUClVe4fdWF5MG3YK8M2fmA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRlhOeU1BY0lpMTM5bTc4\ndlkwOW0xbVJrQkM2a0tPR0ZRZit0TXUzQkFVCjd3K0JRelF1L1V2bDVBRFJEejY3\neGpWeHdZVDJnTTZRTkFJZjZ3TUtVc1kKLS0tIG9IS2owUUJBbFBnVVM0VkVNL3J6\nQmtqL0JxRWIzc2dKMzNQc0JkN3Y3aGMKs7r7yenHL+rTlv7mqS6MEeyVKtCrwnjK\nu92lVy5QGnx7+/I8Iy+blaLAiQlsN+AEFHun6aH26+cK66T+SVzipA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cW9rV1VrVXVHNDJENVQz\nb2sxNHVGSzFtMFdxaWUwSnRzcW54OHViRURzCjFJeFNYSnk4b3ZVbXlxdGQ2L3li\nc2dTQTVFejNRbE4xblJrYnBpb01SeHMKLS0tIHNtLzdkcGszemdRSHNmTzRGTk9Q\nU3hMeDV0SFI1VzlOaTBuK3Z4WUZreDgKjA9NFwaNXzQamVgmTxReONTfXZCGlixD\nwxpJjC0V6P03Eu9B9HB8T4sSXSXsRKL2k3H9BcGCKu5xNhqG6zAUbA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHg5MlNGdHdP\naW4zbHhBa0Z2L0tpS3J6MmFlV2QzVmxJRlBVL3dQWEl4WDQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3QytPSkFDUFV0d1h0UTFOWm0yT2lu\neEVPSDVBRC9aV0hzZmEzYXpyT0c0Ci0tLSBQc28xZ1RlY2dIak9ITHVuMUF3VGZa\nNDdEVkI0c3ZXdi9FRWdWSG1nRWhRCukr1O74W/LgHpNExNf21Ph5mCs2vdV3yqJS\nX3GRWmwqGKNxl4c4TOacQ/gvJIDg7LYH5KQEXxcvNnFwBx87F+M=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T07:08:26Z",
+		"mac": "ENC[AES256_GCM,data:q1ZwaPw1WOhfFvkBltOHh3LXfhDReHy9AD9VN9NUhY5eiPUwEIAjNu4z2vdknaNtzPCwYp6uERdH66D9l4saxyGOROhUKl8GDDsPs+cYXderSHXQeOEB0knW851/BQaaicmSzH2WbpbDUqmwCdDfz2rJ51r0KRB9X0HUHnTWzZw=,iv:jKIIHUCQWxLuuB5vipslI/3JC45d27yyyaXX5N/uKJU=,tag:nx9zwXVAQ/zfQPfQI1MK4A==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/nextcloud/adminpassFile/users/kurogeek
+++ b/vars/per-machine/vega/nextcloud/adminpassFile/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPv0QjFM0mBgOprFKcStm105vdgH1mbx6f+1X7P5UH7j 
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519/machines/vega
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:vYNRYtA8xBb5eqlVk/cnWUCr2EfvyGW0imm0tV8Nnqeik7qVDQe9hyHNdvMrD6zpICor5LfNQAb45fYGtsIRPyV3cSU7HrD0qmNeDLP9lgsQFrAHCJaQz2Om0tOM0tHLP0fuUpWpaYtjPIl+5P7PiQV4rzO79cGc0mO2VfQbJI68ugRBb4md6zEF7UarKx1bi/tlKlrix1F9PpQvh4Sd0fJDFs3yiOz/tQLiXqzW4Fk1olqSZcqU4Ogdbs5tASmlCdzqrM2Qr77Gr33FmrvG+A0DOM3FUSCFVCJjaYRyC+bof0EbSthG0pROyx0vA+rPIXiCq6lr9xBocC97m7dEtIQEZlQKwJv/ulxnX/9YL3Km9tIBrm5ir7nhU3D/5alfjPHPPKJ0BUTCUku3A+3CeeorgGVrZupcX3rDlk9rd3i8M2+ucbr5X3/xMfvDXDCNx/Fj+e3gX6iMcftldIKNi4bY9zET1Do3NAsJtMxUBNgsBtKw0EuccN2H0TV25lCTiAqx,iv:Tk/ZfnU78z96EN81ixQR6XyL5C8lG9d94MJ81xW5eFQ=,tag:gpt1ACabLL4YGWxZmL0ECA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZRUDJDMmdM\nZTQxNDhWYjVCMHpXVWFac3AxVU83UktnQjZFTUJlWFZSM3MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp4NTRpbzkvVWtvNWplanFtQlhHVHo0\nSmpDUTJwTGxtZHB1bVNaTlowc1lrCi0tLSBtWFI3Q2g0eXdkRGRPakFiOTVQUk9Q\nYXNJeHZ4ai9vYW1hNGdITTNBRjZBCu3l23xWd61ULPtmz51vZp5XkuaQSNF6gmsN\n2HIqpwUA/2OnzXfpzWwZySlIoFdVe+J3UAZBZ7K+eYAzoSc3BDo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdjbWRnd0RP\nZUErbWlOQ290SHJSbFdaazVnZlZIQVVObW1pd2NrY2dzVk0gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpFSDRjcWVYVm4ydnFuNlI5aGlvbnBp\nbWJCaGtDcy82UWphUlpWM25QVmNVCi0tLSA2MkN6c3MzOTlEdEVIVnlFTGZJQ3VP\naWlPOXBvUCtHRWl3a04rM0ZYdkE4Co8mML7PcjvnmNiCICZGw8YmT4WjMbP24fb0\n9yU83OiRSVlcKYKekh2jSNf95mxn7D8Dbq+ZAZRIxQ2FkefW6hg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpNXJ5SFV0bmVaOEx5SW1J\nTjFnV1h4SktDZ2xmVForN1I2ZjlpdTRidWhnCmRZanlVK2x1NjNsd2x2OVVsQ0du\nUmM0MWo1SEJ3eVVsQWs2V3ByN1V5QncKLS0tIDVMRis1NERwRHBFZHc1NkY3MG1R\nSkZWY1RoZzdZYVMyZE1uMkZUZ3V3M2sKKiBWZF/eKHAvn45mHFl1zOWOIU0QBruK\nb7zySBdND82AbJ+Lqp6pE4jlFpEjGFH8wJf5xNsrJqp2KHPZgbA13Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrM2lPdHplVVFHTGd6ZWRl\nMVhabVZXYkpRRlp2YUxnWU1TZHRLNWVoTmtRCmEzTGI0RnVkY3F2QWRFdFNvazBG\nd0lmcG1LSFhtckV0VmR2bFNhR2ZBQVkKLS0tIEY2MEJ1UTN1UUxDU0dsOWUvMzYv\naWhpTjRKeEhGbE9HMzF1UlpITFpXTzQKYvjqH9OEppWUt1756/uVZZDEcxvaVng4\nzAI64N3g0H2+XSHiZTbSuUJEznqkd+fYmezQRbElrP+OZKP64/1NfA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoZmFvWWduUmtTbDZuaXJx\nZXduOE9BdHZMKzRTTXkyRDMwSDJIR0VyZ3prCkJyc2d2SzcvZDBuMDBiQ0NPZCtj\nNGsxbVR2VEtaOGpydjRwWlc3WVRJbjAKLS0tIHE4T09mWTZFZjhsZi9UQUJ4Tkp4\nUnhPSUtyVDNyQ3FUOTg3c0doZ2tSaE0KklIZLnHGddAwqFjT2el5HsXSw0ptE8mo\nRv9QUp8/c3RukPsG5vE/BsWjJ0Q/cYfEXCWabsvxaFDGounHPJknuw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3UTFqQjl6d3p2ckRFU1V6\nbkRBUVk0MkVldzBJTURvMDZnTFBqOTgzYVZVCi9sQXJXL1lPdjlSSU01cjZqL05m\nckZyTnpwcW1la2xTM1IwQUJXTWdQRkEKLS0tIEkydGxzUjFxZlJ3VmxYNXpZSzFi\nVEVDenZ2dGZrN3lkS0xIVW1mek1ibmsKZkWJyZfGAcWbVMVc6964JaBleTT4ZKwI\nm68OfaNAmA57y09/O8Xnxp5FsnkbdULBRbccv6s5rBimr/5GgfIARg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmZHMrL2h2QlZySldjR2NB\nVnVxYXIrY2ZHVEJPU1oxaG9CSHpvOE01K1E4ClFqai9jZkc5bW9LNEU3TE5ZQmZa\nbHFuR21YVGs3bkU4cnYrN0k2QU1BYVUKLS0tIG1vT1E2c0JWME9nMDNNYTdYL3dp\nNHc0RWJYdVFsME5pRUpMTGY0UkFpRU0K8H+FfF4mGKag2dsx1BjBu4/e6XkTu8Pq\neDEe0zwCD0z/emYaLslZ50NDgAgvGkl6Q2y8Y1vcaX2X2BREH0kzzQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZWVwcitjSklXdTNYYVAv\nWDU1VzNxbVdDOUo3b2hXNFg3V0RqMUFwVDNJCjE4UXdZb1FFTWp2VjdSMFd2NWpC\nUjZmUjVYYXRvSWUzVk1mUkMzSU52dmsKLS0tIHpFcU0wUEROVkV0YXFoODhtbmZi\nWVFiWmRrRXNNaFVsZU42V2ltQjhGREEK7qXMJEtDMMVU5BJJeOwn4ticQXNaTQS+\nyvYjCE+U5080PtK+9l1LnlOpYxIKXw+Cn+jTUkGmDwEX0oifPNIUvg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBna3djTDBqKzlTWFpFaUhX\nVkNuQnNTN3VuNTFuUE9RalI2djdVOFdLaHhrCis1S2EyenlGZDdHSzhPTEFtMUdk\ncjQ0akRYU2huV1pzOEhDUWtLN2JWZU0KLS0tIFhPR2YzQ0Z2V2phc2xrNTc3Rmpv\nTnE5NzB6aENZNFp0U09QTUVDOWhSblkKd7bqI00jFdfYlLFooTSfsME6oXDPBFrc\n8GrniJr9sLSyPXUCGZQ+ZWF5ooW/szlB4HYL7/MPXhDct82/TeaUMg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFdXTExVcmZG\neWl6WUFDMk95N0RKNVpNakhPUjhjL0RqaWNaMEtiNHRPU1kgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp5QkNLbWhHVTNIdjBiSnBPMUlNY1Ft\nMzRHNXlVVThlNVowQ2N4bjFMcGRFCi0tLSBSZnVwaGhNUW40TDVwVGRoWERxcVho\ndE1xUmprSXViWWpmREhjaXg5SGZzCu18I0Dsq3bHy4XBiCpw011tO8EgGUSPCfZb\nZXyFvh0gZOFKvNkkGDHl52ejzO7PuNx0g8oH9OSTfrNNJKhLtJc=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:12Z",
+		"mac": "ENC[AES256_GCM,data:md8/9N/a9LX4xTCfuWIaFkxc/Zg57oW97qPVOcyx0EA6FpxH4IBXdLfQ3Mnw4onet5JUwxMbZUU8nQuHMNdupjf7W8zeemdns3nDTYxU55G5Ba+Ku3QXdPXryJycVOoPsv+uTN4iucMCruCEApqNFyhBP15Ev8PPcri/OLdtr0g=,iv:7s0JMSmZCM+TzxHMBw3HRqN9AgkisM394aOQc2rgijA=,tag:gHvLHuK8HtER3QB8QJTxig==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/vega/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/pocket-id/encryption-key/machines/vega
+++ b/vars/per-machine/vega/pocket-id/encryption-key/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/pocket-id/encryption-key/secret
+++ b/vars/per-machine/vega/pocket-id/encryption-key/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:EdRWRXZnTG8lhatXpy+ldTDad1E+lyjtFBFrPXUAvsrz,iv:zjqe5vnMPYv6Op4pBBGMJLCgdJ3nUtbXs7b41bpPwRg=,tag:hkkRkvRFo6tUc4REJu/ubg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3cHRRckpQUHdMYmNwZVdk\nY2ZSOHNTcXZaeUdqT0djTTh4RzdRNWZPRUQwCmRwc011UzZOVHhHL3dSUDRQVTB2\nZ1BKRFRCenQzMVhMVW10S3MvVnNsbGcKLS0tIDc4WUF1OXFLVXFVZi9paWtNY0Jj\nMGRCdVd1UmlHbmdBQ2dMbWt2MFFzVE0KyymVPmsYPe5zD9eDKN+zjzlpJ01kfwcj\nuVh70RA+O2zfzF292H2kqntfsbbW05LXAr15yMXHrnwEBxqZdyyHPw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsUlRlQkt2MkQ3dVdKcytt\nUzdEL1JCK3BJdFJyMk9uVFJSbG42ME9MQmkwCkhRTklrdU1Id3NBWlJtUG95ZHI1\nMjBNZzM1T2lENUllekNpYUc0OFo5TjgKLS0tIFlOWVdhU3BLdk9ybHRzVGJSSmdQ\nMzhraTlZYmUzcXZHdkJ6c3pCamZtSGsK0WsS2pjVkHVr6Zv3gdv3Y36RcLEqB+pj\noIMXJa6g2qnzlpyzF5jrMiK1ZZHInBn1QljZlKjqILTuiX8rzyxuIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T07:08:28Z",
+		"mac": "ENC[AES256_GCM,data:pmYh5nxAPXG9dUd85L3zBjpzwbDUsUFj+IJinuThLyBS+2NshJmEoa2N7GcVSCd+OvDGeW+yHTrewgX/i/G+G0Kk/2x3koHLAebYEwYPRkqz7YEhBHA/JSRDa+C4V3CFt8l8NyfLnoqtuPFNhHG0cGpV5EIKsS65sQ0NLzT1TP0=,iv:hx8jCYESaokgLXjvxnn1WNEq4oHZQ6N91zplhDJKxNw=,tag:279TaUllCUi1YHUU1SFKPA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/pocket-id/encryption-key/users/kurogeek
+++ b/vars/per-machine/vega/pocket-id/encryption-key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/root-password/password-hash/groups/admins
+++ b/vars/per-machine/vega/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/root-password/password-hash/machines/vega
+++ b/vars/per-machine/vega/root-password/password-hash/machines/vega
@@ -0,0 +1 @@
+../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/root-password/password-hash/secret
+++ b/vars/per-machine/vega/root-password/password-hash/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:PU3fH7ode0Sj7Om9kIDHQ9CjLz7KZSdhaSTPsfzRhmr8w4YRQHTf3YGx7beMTGpx3mnxXljBAuGXdoK2NLfGaJJCrIRF0HU3+Y9idokp2BnH3LW5dNTV+KVpVVDcuVqCw/eLTL4O3RqbvA==,iv:p1rv8LSAJLPf1BeUoPUh1gEsWEG8m34WYsohefCA7Mk=,tag:XPetfNGYOeJW1cgVlrxUSQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEhwY000OEwv\nSmduQjNEVWpPdVVDdnZjM24xOEJVRWN5c3ZXR3ZiVDU1bncgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyd1pZbFNIQTlMekZ1dklFTXNRaFdk\ncndEK0tKaWhnQVUyT2doZWtMOVV3Ci0tLSB6WFBrUmUxMFE0VnFMVzNCcXJ2QWR5\ndm85SkI1d3JtT01TYmYzVHdPYlNFCquhBwkMovf6wPqg7NREA4TSqJbHr6W00goe\nyGJhWDnXVMWhkyssqi3u80pYNKM1G9Rq+zSsCKRtRo/if4RjCu4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGMvSmFDSVdo\nQWpKMzI2TjRRM1lLNWNxSHpCaEl3TUFaRmx3UGlhczZZaG8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo2VnU2T1FsSG1hMFlOWVZpLzhVOXp1\nVnQ4VkVEeGNDQmVVQk9CN3NVTlNjCi0tLSBTSmthSlYzb1RKQWZIM0Z1TURCYVZ5\nb2k5SzRDS1Y3TU52and3ek5VZThBCtiCy4AjKW2gf33FluA4UVMMAaIe16rSn4mn\nPEtYUsM8gJfR9m7XRuQNVBz72h4abWP10qGOUrCegFglaCGKvqE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjbnFKdkNwRmJvUDhWakIw\ndVpiUDFxdzAvRWRHWGx5MnpNK3NJaDV5VHpVCkVvUWwvQTJqdzE3N1VpVmg4cUho\nTjgycmtXZ3Q0YTUrZEt5UFYrVTh3OTgKLS0tIGpmYU1XUUtURkIzUGM4RkVRK0d1\nNkloUXZXdFBIdkFqL212UUovVkxsdHMKBARoORZa7HkDB1QWCxjTT1QIuKYWoVii\nlrhd7/wmJ3wb8iKQygsK53twx3ujXUGH2H5ThCwfKxfBO8wpDGxkFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1SDJRYUZuYW55T25ubGda\nWjdDMHQyM0VQV0drZnNWRnFxY2ErTGNTcGwwCnBGeDhHNmJwN3BhNWdaSWpReVVP\nZHdxWlBLUVdBQ28xMjE1Vng0YWI0L3MKLS0tIG9TRG1EaVZlcEQzNFI3dU05OEt1\namFiYWFmVUZ1QVhLR3gvSWpNRUpzRjQKiMowQiEraMlYoBLqAdQ7y7Y3sO1cjz7d\noCKatPJkJ0ub4Y3Wg01xnwKaNClk6vozNvsp6SKy07RUhHSjlk0dFw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSL05nRE8vRnRZdkV3SWZk\nTGN6VlRBenVqYzJhbER2aUY5MmJIR1JFZEZjCmc2R1ZZQVd0aFVDNk5SUVduR2pI\nZlB3RVNBV1Y2VW5TaGM1T2RxTjZtZXcKLS0tIGFsOGd5OGVYMHFFY3A1Y2l1M2kw\nVmgzQklwbFV3bkMzUHlxa3lGdVZMYk0K5y9ISsL1lMyBuT+R0M1Q9T/PBIwOuvce\njTGiOYYytpWqfIuUIwVP+k2g002WI8ILipD3lhX8SNqy82F3maCVPA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQd2FnN3NMcVZYcVNYc2dk\ndTVWMWxNY0NHK0EwOFFBSGdiUUxrTmFMTlF3CituVFNiSXR5OStNQjdGTHE3c3hy\nL3VFUmZ4eDQxaWZwaUFXZlBOWDhxTWsKLS0tIHFCQjdRT0dIYmFKQWVmK0lQKzQ4\nMVlVRlp0cUF0ZzFEcCt4c0Yxem9tdHcKgzHyrDi8oa/a6QRojRqoYxNzwcGaZJ0u\nasn0hyLiLiOhaJs1EOvg4Sp7rGpxIKKSBMI9qQeGlISRJi8pCvqKOA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMmtod1R2dGdDdXluRUV5\ncEZNODJPbStUV1ZsQXJRTk9MbGNsL05RY3pRCmVsMFB1QlRQTnljMVozdmRMM3o0\nWWdaL25CWk1idjhOeDZRQzVidVRBbWcKLS0tIEFIRmJjK21OS20yL2lZekRVRi90\nSVMvNklEYTI5T1pSSXMvbFZtOXhsTXcKuyefORMk0im4AWP1p1YbcRk65DDDCN9G\n06xvBCjAsxA8kjKqfMWVdzE2E+sAC6fuYym2+NJdf2GJDg8MEK8/Jg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3N3hVdk81SVJXUFIzRjI3\nbFFNUGtPWHJDRnhUVmVtSG1WdTc3TWVseXlvCmhacnQrRVVLYlZySUpIVjVBMnpM\nWFIwMUJ5eU1yUmZRRyt4bTI4ZFFCNG8KLS0tIGljc0pSK0pLQ2h2RmFHZzBEY29S\naWxNUDFFdlZiWmQ3QlNHckM2ZUNYZmMKP8xLp3Q5sZldJDTuQ9zO064ckHG3ryBX\nmGXtp9l+SDyKL7VHAV2Vxl6tRhQ4Dvfy9pfSXog9mynXrDY4JT4wPQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZ3R5MytPZnE3dnlEaFI5\nSEVYQnlYcm1aSGllMWVSOXR0T2U2ZXVQZWlvCmhrSm1WZHVBTlBqWVJPMWZzb2JD\nWW1GQ2FnbzNFOGlsS0g2V3Y4clR4RUkKLS0tIFpiRjhadHZZYWhxN2lUZFNiMDVi\nTUpGK04vc3VTdVB5eSttWWxlWHlnK00KgHQVIFtPtkjldEdSguBqItHkrXIfKcDT\nnYKyAj4EH6H4/miqJ1nKo/a4bSpAA05HbCfashmqIU3J6ED/UV+XXQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFlUWUtDeTl3\nMHg4a0lQcm92NTNPTm9YS1dTOC9nNFNCYWdlTDJqeE1GVFUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpENVBkeCtqU3FucXg3VmYvYU5yb1BZ\nTkZYWGh4Q3QrVm95amZJVjVuQmJBCi0tLSAzZDVYcWlYalM5MWhibm1MQS9jQzNP\nU3ZiQ3RMMlEramFiTENVU3hMcEJzCk+0tLWVj/tvtVr5NOvMej4k+0BJs7RUEkIP\ndlF8mTIQ+IVhOgSEkEDgaWemMihiaJC4FgKu80IWg/HlXsMIUKs=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:17Z",
+		"mac": "ENC[AES256_GCM,data:aBlQlB4fvyiW83pgQr7+06F3XWQAR2wiHIE3TXb/HYHyGsMoGsOK3CTi//cq3gsa3tahRPb7YyMmV21iGvLWBMUwoEKxD6CVnLYjKZxthkgJ4L5O9kTudyZBUcRcZj/3LVQRqdBEnMjLBZPdSYNcAorkGxgOlha1wtZS9uJb4D8=,iv:a3h3syMqSVkZFWaOPFjDdtXsMoY6tlHh84l0a7ZsGWw=,tag:KFn09QfVB7EAjl7vCmfyMw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/vega/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/root-password/password/groups/admins
+++ b/vars/per-machine/vega/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/vega/root-password/password/secret
+++ b/vars/per-machine/vega/root-password/password/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:qoZ16d1q7SyZq6BEEfi4DDZVbF8Dlm3AmS+m1GbJSs0mXI4j,iv:uCN8zWAhVyGBessK5K6xlpBOcPV1mn4YUe8FUuQjlwo=,tag:jx4lt9NzEdb1NUjmI7N65Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGg0cUhRYmdj\nejFSQm9GY2NzUEhaQ1N5OHFGeGkzR29mT2duQ3RmTEhabU0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp5TmdPZzhobVBrQldmR1FidENKek5G\nTXQ1ZFNQNWVVY0pHcUNSeGIrTU5BCi0tLSA3aE51RThtQU9JUHlGOEVHYjNORzlH\nTWdVUzdrRitxRS9rYmRCU2xSNUpFCj7MTRh2deMUTz2tyMMjuy63KDiEd7tQ0Dzy\nlThWRu/fos9UdIdrFtS4oQfp23+UCp5E3fZRAEivi2JrZszoMfU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdvcEhEa3VB\nM1hPNFF0ditNckdXc3RiOUs3OWg5NHRyQ3IvdndjQ2crVEkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp5OHNTZmZzUWNGMGJGWFZvRkF3S0tY\nbW5XdnVKeGtXZiswYTdyUWZoaEJJCi0tLSBUSzBRY0ZPNjM1TUtkQ0VwanE2UFZh\nVElFMUxPQVM1WDhKZFB1L0hyQmFjCqsLBmzhIuYCanm2RdrjB9AVjX4vh8XY1yrr\n5x5rnEmCafGnH3+wrKlyHox+n+AKPuNt4SOpyWK9VTKWmT7AXNw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eHRrOVQyaHQwY21qc1JE\nNENkVzF6VGxzODB5SnNxdlJSV3VyUExIaVdBCkJWQnZ0bTdpT0NYMG56amlZQkxN\nbEhPbW5wb3l1WDJPV3FWV2lGaWVDUmcKLS0tIDJCdzh4dHNzRkE3OWpuZktkYTBI\nTVJlNWE0cXAwRHlZNlk2eWV4YkhCaW8KuGJlV1iFieVfdahrjZohOszofRMmvHU1\nWY8MeWUBiIxeBcvErr0rHo/ecwn10Bo9b1rer0Fc/wa4hiuL2D9i1A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFME9QbkN3YXB1clkwZncw\ncW5lR3JtakV4SDRwL1dMR3VFd3VMZGhQYVJNCk02UXZLcEVkNkFaTVBxaitSYUQ5\nRisvZ2xCMEw1MksyMlNrYnkyZzNYZUEKLS0tIDNsSkRtdWJwbFlsSkVrOE1reUFu\nNXRaL3NwVG5VRGNXU3cwWG9FZVVkUHcKgsRKXiMJmoO2vv7oECkpt4t0b8mnpQCW\npFCGSYiVBrycIQtnYj5VAvhDaGdIhA4NGvMKEkvFXE+SZay8kpgMUA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpMHJVZGphbERLWFZIZ1Zh\nK2FJNktTMG5PU0ZVZ09jM2JhUUdENGwyTkNFCmhYMUN3VEs1czRzdXNoS2s1L0NS\nMTRjSytZb3JTMjBJOUhZRmtLWmRBekEKLS0tIHZ1RW9HNnUxdktZQ2lUVlF3eWRG\nVUlrVXlnNit5SFhCUzlMbmtoZUY2ZWMK/6DcAfzcsLD5zM7kz32Zs6oShOvlCFUt\nc+r/FvlFKH5BD2WWL8hqwqk5OOfV+r+JeD5KFJ1f/ZZHG/3erE50Lw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWTlNldVZoOVhHWC90VzN6\nWWZTQi9NMnFIZXNBay9Db0VmWUpyTmYyekdNCkpaYkpnNkQ4dnM1Zm1ydExLTkI4\nNXhTeFovTE9ZckZKbTNEQ0M1aUVaRjQKLS0tIDZadHJBVlhRL0taSUl3LzVyT1py\nK3pkeGdIVU90SENsYSszb0VSMjRwcnMKHfELyOWyv/r3cRfbwfzQx3o4y5Hww5+M\ny9w85WTgaG5q81cqZ2gPZZ1L/UQspUrsDee+H93G3kq8s6RB+4zcJg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYMlMvQlVDVHViYXlsVFND\nK1lwbTBuS0d1Z2Q2YmJieDdxUmhma0h3WWdRCldUUjFpWmtnUE9GTHdFRnVRU1Zl\nY1lzSkdFSkFidEd4VUJRZi9VcmNWa00KLS0tIDFZcjJlTmhiQWlnTHRpWWk2cmNO\nTldDMlNvVGVhdVVjdkdyZ2RXUVVxaTgKzVIoGyFLRgaRM/iKc/QWNiMptTkpkr8/\naBykdoiBStexDJ2LYwGgCtR/4kq6BcciJJ1jFQrFSWgeIznfNlfWlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVWUgwYVNHSHpIVnJPRG5j\nOWkrVW9CNlVtY2daak9EcVVMeFFZV2xMbmlVCjIzWk4xK0VKT0tEREkwUzkyTENU\nU2wxaVloaTF1WHJFU3FuTXlnTUp2SFkKLS0tIGM1V0ZQeExST1dSYzMwc1R5aVZK\nSEpERlJRd0JoOUJhNkxjOXZqM0dvczQKeNqVhh9CX+sURWXo26LtVVxF3B8rep/1\nSk8nqzk/PpZh2UoKTeIykVN4l+z8ugrnCZCSG1cqx7reysehGLxKcg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHBEQVFGWUR0\nVlhrWjdROWd6RVJxMWY4LzhFUHR4YzFEY2IwT3pQWVlMaVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo3aC92TkRGUnpjalZTdXZDNUk4WlVG\nR3RES3NGVjlzM0lVZk8zeVpzdXZRCi0tLSBucEZHWWVkTkxnNldFTTdDMUp0d2RN\ncWJJSXlBQ1ZveXVjY2Z1cTMyVlJVChqwHohrYRFIPco5FyQqIMxLbueuUfo7S+pt\n+u3NDGr7AN7iAt/qUpvX50y58+MEAm6vV3Qgvf8bnxmPUTgB4kw=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-09-11T04:36:17Z",
+		"mac": "ENC[AES256_GCM,data:oVgkprOgs3sEG4ojcZYcXFHVk2GEuyQF22QB035VVYkw5S3eOPLzc3jFFdkFbW/S61QstSfV2X37RZdJ1knKlfr2+uFbkIje5TfmnVTeonvOAVJIF2E6I978ogobHDDkmokv7YatLOVdsuZE8ce3ghc/q4ULf9AuYCTuWcAwhtI=,iv:T2mb1fDhn72pkR80LewvDJ5T7pT3Pj5YgoGw5f57Gss=,tag:M5Wkax8QtHX+VnqeGUSonw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/root-password/password/users/kurogeek
+++ b/vars/per-machine/vega/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/vega-internal-domain/name/value
+++ b/vars/per-machine/vega/vega-internal-domain/name/value
@@ -0,0 +1 @@
+glom.newedge.house
--- a/vars/per-machine/vega/vega-nextcloud/subdomain/value
+++ b/vars/per-machine/vega/vega-nextcloud/subdomain/value
--- a/vars/per-machine/vega/vega-pocket-id/subdomain/value
+++ b/vars/per-machine/vega/vega-pocket-id/subdomain/value
@@ -0,0 +1 @@
+auth
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	198c9a8c11	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/clan/yggdrasil/default.nix	2025-10-17 14:22:36 +07:00
kurogeek	c497a1ba86	Update vars via generator yggdrasil for machine b4l	2025-10-17 14:22:09 +07:00
kurogeek	43b8bf0ffe	mob next [ci-skip] [ci skip] [skip ci] lastFile:inventories/default.nix	2025-10-17 13:15:08 +07:00
kurogeek	e1114189f2	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/clan/yggdrasil/default.nix	2025-10-17 12:42:02 +07:00
kurogeek	ad1c98be75	mob next [ci-skip] [ci skip] [skip ci] lastFile:inventories/default.nix	2025-10-17 12:11:58 +07:00
kurogeek	da33b3935e	mob next [ci-skip] [ci skip] [skip ci] lastFile:inventories/default.nix	2025-10-17 12:08:01 +07:00
kurogeek	a02f64a615	Update vars via generator yggdrasil for machine b4l	2025-10-17 11:29:35 +07:00
kurogeek	2ab9fc4ad8	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/clan/yggdrasil/default.nix	2025-10-17 11:25:54 +07:00
kurogeek	16a2fa0526	Update vars via generator yggdrasil for machine b4l	2025-10-17 11:25:02 +07:00
kurogeek	b8dc4757ed	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/clan/yggdrasil/default.nix	2025-10-16 19:07:45 +07:00
kurogeek	79fa8eef01	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/clan/yggdrasil/tests/vm/default.nix	2025-10-16 18:01:00 +07:00
kurogeek	ac731c2f38	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/clan/yggdrasil/tests/vm/default.nix	2025-10-16 17:22:45 +07:00
kurogeek	c9f23f4c0a	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/clan/yggdrasil/default.nix	2025-10-16 17:19:09 +07:00
kurogeek	be25560858	WhiteHouse router configuration	2025-10-16 14:53:41 +07:00
kurogeek	e4bf326191	add Alex's laptop to networks	2025-10-10 15:38:28 +07:00
kurogeek	04fafa32d3	update kurogeek thinkpad zerotier id	2025-10-09 16:42:23 +07:00
kurogeek	ed4e045ffc	rm unused args	2025-09-28 13:30:10 +07:00
kurogeek	fd6edd83c2	machines are accessed by zerotier ip	2025-09-28 13:21:46 +07:00
kurogeek	65faa70fa3	no nextcloud on vega	2025-09-28 12:45:29 +07:00
kurogeek	377b63437c	no write permission on GLOM samba	2025-09-26 20:26:02 +07:00
kurogeek	43e8252459	samba for vega	2025-09-26 16:46:00 +07:00
kurogeek	800500f57e	vega on new device	2025-09-26 12:04:02 +07:00
kurogeek	8b7007b2b8	VPN for b4l	2025-09-25 14:46:26 +07:00
kurogeek	c0f50eb2b5	Glom NAS machine vega	2025-09-24 14:20:21 +07:00
kurogeek	cfbf3a30a0	re-encrypt rigel	2025-09-24 09:56:09 +07:00
kurogeek	6f0d7aa7de	re-encrypt b4l	2025-09-24 09:55:25 +07:00
kurogeek	a5ffcf6773	add age-plugin-fido2-hmac as age-plugins	2025-09-24 09:37:39 +07:00
kurogeek	1ad1dd82ea	rigel machines sops.defaultGroups is admins	2025-09-24 09:23:36 +07:00
kurogeek	45e4389f78	b4l machines sops.defaultGroups is admins	2025-09-24 09:23:24 +07:00
kurogeek	aa2eb91339	Add user matthewcroughan to group admins	2025-09-23 16:03:13 +07:00
kurogeek	99c24c0b10	Add user vi to group admins	2025-09-23 16:03:06 +07:00
kurogeek	8d31f56092	Add user davhau to group admins	2025-09-23 16:03:03 +07:00
kurogeek	950d34a7fe	Add user berwn to group admins	2025-09-23 16:02:57 +07:00
kurogeek	7cb1b483f0	Add user kurogeek to group admins	2025-09-23 16:02:53 +07:00
kurogeek	6c806c1e70	Add machine rigel to group admins	2025-09-23 16:01:59 +07:00
kurogeek	921629216e	Add machine b4l to group admins	2025-09-23 16:01:46 +07:00
kurogeek	83ebe8933f	Add vi to secret	2025-09-23 15:53:02 +07:00
kurogeek	f9ba5260ab	Add user matthewcroughan to secrets	2025-09-23 15:34:08 +07:00
kurogeek	4cf19ff4aa	Add user matthewcroughan to secrets	2025-09-23 15:25:38 +07:00
kurogeek	a3a776722f	Add berwn to secret	2025-09-22 16:11:51 +07:00
kurogeek	e182dcb248	Add berwn to secret	2025-09-22 16:11:34 +07:00
kurogeek	db5e0e55ce	age-plugin-yubikey	2025-09-22 14:37:02 +07:00
kurogeek	aa19ffa9ba	add matthewcroughan to admin	2025-09-22 14:36:45 +07:00
kurogeek	d344790bfe	add vi to admin	2025-09-22 11:59:50 +07:00
kurogeek	3937ce27db	Add user vi to secrets	2025-09-22 11:59:35 +07:00
kurogeek	c78048d53a	add davhau to admin	2025-09-22 11:11:59 +07:00
kurogeek	0fb4199965	add berwn to admin	2025-09-22 11:11:16 +07:00
kurogeek	4dd06992e0	Add user davhau to secrets	2025-09-22 10:29:57 +07:00
kurogeek	dbdaa8ae22	Add user berwn to secrets	2025-09-22 10:27:37 +07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPv0QjFM0mBgOprFKcStm105vdgH1mbx6f+1X7P5UH7j`