mob next [ci-skip] [ci skip] [skip ci]

lastFile:modules/nixos/inventree/default.nix
Update vars via generator inventree for machine rigel
2025-10-09 17:22:20 +07:00 · 2025-10-09 17:20:13 +07:00 · 2025-10-09 16:57:33 +07:00 · 2025-10-09 16:42:56 +07:00 · 2025-10-09 16:42:23 +07:00 · 2025-09-28 13:30:10 +07:00
52 changed files with 1613 additions and 270 deletions
--- a/flake.nix
+++ b/flake.nix
@@ -37,6 +37,8 @@
          ./fmt.nix
          ./shell.nix

+          ./overlays
+          ./modules/nixos
          ./machines
          ./inventories
          ./modules/clan/flake-module.nix
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,19 +1,7 @@
-{
-  inputs,
-  self,
-  lib,
-  pkgs,
-  ...
-}:
 {
  clan = {
    inventory = {

-      machines = {
-        rigel.deploy.targetHost = "root@rigel.local";
-        vega.deploy.targetHost = "root@vega.local";
-      };
-
      tags = {
        glom = [ "vega" ];
        b4l = [ "rigel" ];
@@ -73,7 +61,6 @@
            input = "self";
          };
          roles.default.machines.b4l = { };
-          roles.default.machines.vega = { };
        };
        stirling-pdf = {
          module = {
--- a/machines/default.nix
+++ b/machines/default.nix
@@ -1,4 +1,8 @@
-{ inputs, self, ... }:
+{
+  inputs,
+  self,
+  ...
+}:
 {
  imports = [
    inputs.clan-core.flakeModules.default
--- a/machines/rigel/configuration.nix
+++ b/machines/rigel/configuration.nix
@@ -1,13 +1,63 @@
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}:
 {
  imports = [
    (import ../../lib/auto-accept-zerotier-members.nix {
      memberIds = [
        "dbe44c0287" # Alex-gateway
-        "1b495eede9" # kurogeek-thinkpad
+        "2bd36db8cc" # kurogeek-thinkpad
      ];
    })
+
+    inputs.self.nixosModules.inventree
  ];

+  nixpkgs.overlays = [
+    inputs.self.overlays.default
+  ];
+
+  clan.core.vars.generators.inventree = {
+    files = {
+      secret-key = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+      oidc-key = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+      admin-password = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+    };
+    runtimeInputs = [ pkgs.pwgen ];
+    script = ''
+      pwgen -s 32 1 > $out/secret-key
+      pwgen -s 32 1 > $out/oidc-key
+      pwgen -s 32 1 > $out/admin-password
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  services.inventree = {
+    enable = true;
+    hostName = "rigel.local";
+    config.site_url = "http://${config.services.inventree.hostName}";
+    secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
+    config.oidc_private_key_file = config.clan.core.vars.generators.inventree.files.oidc-key.path;
+    config.adminPasswordFile = config.clan.vars.generators.inventree.files.admin-password.path;
+  };
+
  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 }
--- a/machines/vega/configuration.nix
+++ b/machines/vega/configuration.nix
@@ -1,7 +1,6 @@
 {
  inputs,
  config,
-  pkgs,
  ...
 }:
 {
@@ -11,12 +10,13 @@
    (import ../../lib/auto-accept-zerotier-members.nix {
      memberIds = [
        "dbe44c0287" # Alex-gateway
-        "1b495eede9" # kurogeek-thinkpad
+        "2bd36db8cc" # kurogeek-thinkpad
      ];
    })
  ];

  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";

  nixpkgs.hostPlatform = {
    system = "x86_64-linux";
--- a/machines/vega/services/nextcloud.nix
+++ b/machines/vega/services/nextcloud.nix
@@ -1,92 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  # ncDomain = "${config.clan.core.vars.generators.vega-nextcloud.files.subdomain.value}.${config.networking.fqdn}";
-  ncDomain = "${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators.vega-nextcloud = {
-    files.subdomain.secret = false;
-
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Nextcloud app. Default:(cloud)";
-      };
-    };
-
-    script = ''cat $prompts/subdomain || echo -n "cloud" > $out/subdomain'';
-  };
-
-  clan.core.vars.generators.noreply-mailer = {
-    share = true;
-
-    files.host.secret = false;
-    files.port.secret = false;
-    files.account.secret = false;
-    files.password.secret = true;
-
-    script = ''
-      echo "mail.b4l.co.th" > $out/host
-      echo "587" > $out/port
-      echo "noreply@newedge.house" > $out/account
-      echo "" > $out/password
-    '';
-  };
-
-  clan.core.vars.generators.nextcloud-secretFile = {
-    dependencies = [ "noreply-mailer" ];
-    files = {
-      secret = {
-        owner = "nextcloud";
-        group = "nextcloud";
-        secret = true;
-      };
-    };
-    script = ''
-      echo { \"mail_smtppassword\": \"$(cat $in/noreply-mailer/password)\" } > $out/secret
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  services.nextcloud = {
-    hostName = ncDomain;
-    package = pkgs.nextcloud31;
-    secretFile = config.clan.core.vars.generators.nextcloud-secretFile.files.secret.path;
-    # settings =
-    #   let
-    #     address = lib.splitString "@" config.clan.core.vars.generators.noreply-mailer.files.account.value;
-    #   in
-    #   {
-    #     mail_smtpmode = "smtp";
-    #     mail_smtpauth = 1;
-    #     # mail_sendmailmode = "smtp";
-    #     mail_smtpsecure = "ssl";
-    #     mail_from_address = builtins.elemAt address 0;
-    #     mail_domain = builtins.elemAt address 1;
-    #     mail_smtphost = config.clan.core.vars.generators.noreply-mailer.files.host.value;
-    #     mail_smtpport = config.clan.core.vars.generators.noreply-mailer.files.port.value;
-    #     mail_smtpname = config.clan.core.vars.generators.noreply-mailer.files.account.value;
-    #     mail_smtpauthtype = "LOGIN";
-    #
-    #     mail_smtpstreamoptions.ssl = {
-    #       allow_self_signed = true;
-    #       verify_peer = false;
-    #       verify_peer_name = false;
-    #     };
-    #   };
-  };
-  # services.nginx.virtualHosts."${ncDomain}" = {
-  #   # useACMEHost = "${config.networking.fqdn}";
-  #   # forceSSL = true;
-  # };
-}
--- a/machines/vega/services/samba.nix
+++ b/machines/vega/services/samba.nix
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    GLOM.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "Glom Vega";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -0,0 +1,5 @@
+{
+  flake.nixosModules = {
+    inventree = import ../nixos/inventree;
+  };
+}
--- a/modules/nixos/inventree/default.nix
+++ b/modules/nixos/inventree/default.nix
@@ -0,0 +1,385 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    ;
+
+  configFormat = pkgs.formats.json { };
+  cfg = config.services.inventree;
+  pkg = cfg.package;
+  configFile = "${cfg.dataDir}/config.json";
+
+  inventree-invoke = pkgs.writeShellApplication {
+    name = "inventree-invoke";
+    text = ''
+      export INVENTREE_CONFIG_FILE=${configFile}
+      export INVENTREE_SECRET_KEY_FILE=${cfg.secretKeyFile}
+      export PYTHONPATH=${pkg.pythonPath}
+
+      exec -a "$0" ${pkgs.python3Packages.invoke}/bin/invoke -r ${cfg.package}/opt/inventree "$@"
+    '';
+  };
+in
+{
+  options.services.inventree = {
+    enable = mkEnableOption "InvenTree parts manager";
+
+    package = lib.mkOption {
+      type = types.package;
+      default = pkgs.inventree;
+      description = ''
+        InvenTree package to use
+      '';
+    };
+
+    hostName = mkOption {
+      type = types.str;
+      description = "FQDN for the InvenTree instance.";
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/inventree";
+      example = "/var/lib/inventree";
+      description = ''
+        The default path for all inventree data.
+      '';
+    };
+
+    secretKeyFile = mkOption {
+      type = types.path;
+      default = "${cfg.dataDir}/secret_key.txt";
+      description = ''
+        Path to a file containing the secret key
+      '';
+    };
+
+    config = mkOption {
+      type = types.submodule ({
+        freeformType = configFormat.type;
+        options = {
+          adminUser = mkOption {
+            type = types.str;
+            default = "admin";
+          };
+          adminPasswordFile = mkOption {
+            type = types.path;
+            description = "Path to password file for user `admin`";
+          };
+          site_url = mkOption {
+            type = types.str;
+            default = "https://${cfg.hostName}";
+          };
+          static_root = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/static";
+            description = ''
+              Static file storage
+            '';
+          };
+          media_root = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/media_root";
+            description = "Media root directory";
+          };
+          backup_dir = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/backups";
+            description = "Backup directory";
+          };
+          oidc_private_key_file = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/oidc.key";
+          };
+        };
+      });
+      default = { };
+      description = ''
+        Config options, see https://docs.inventree.org/en/stable/start/config/
+        for details
+      '';
+    };
+
+    serverStartTimeout = mkOption {
+      type = types.str;
+      default = "10min";
+      description = ''
+        TimeoutStartSec for the server systemd service.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStartSec=
+        for more details
+      '';
+    };
+
+    serverStopTimeout = mkOption {
+      type = types.str;
+      default = "5min";
+      description = ''
+        TimeoutStopSec for the server systemd service.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStopSec=
+        for more details
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ inventree-invoke ];
+
+    systemd.tmpfiles.rules = (
+      map (dir: "d ${dir} 0755 inventree inventree") [
+        "${cfg.dataDir}"
+        "${cfg.dataDir}/static"
+        "${cfg.dataDir}/media_root"
+        "${cfg.dataDir}/backups"
+      ]
+    );
+
+    services.inventree.config = {
+      plugins_enabled = false;
+      plugin_file = "${cfg.dataDir}/plugins.txt";
+      plugin_dir = "${cfg.dataDir}/plugins";
+      database = {
+        ENGINE = "postgresql";
+        NAME = "inventree";
+        HOST = "/run/postgresql";
+      };
+    };
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "inventree" ];
+      ensureUsers = [
+        {
+          name = "inventree";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    users.users.inventree = {
+      group = "inventree";
+      isSystemUser = true;
+      description = "InvenTree daemon user";
+    };
+
+    users.groups.inventree = { };
+
+    services.nginx.enable = true;
+
+    services.nginx.virtualHosts.${cfg.hostName} = {
+      locations =
+        let
+          unixPath = config.systemd.sockets.inventree-gunicorn.socketConfig.ListenStream;
+        in
+        {
+          "/" = {
+            extraConfig = ''
+              client_max_body_size 100M;
+            '';
+            proxyPass = "http://unix:${unixPath}";
+          };
+          "/static/" = {
+            alias = "${cfg.config.static_root}/";
+            extraConfig = ''
+              expires 30d;
+            '';
+          };
+          "/media/" = {
+            alias = "${cfg.config.media_root}/";
+            extraConfig = ''
+              auth_request /auth;
+            '';
+          };
+          "/auth" = {
+            extraConfig = ''
+              internal;
+            '';
+            proxyPass = "http://unix:${unixPath}:/auth/";
+          };
+        };
+    };
+
+    systemd.targets.inventree = {
+      description = "Target for all InvenTree services";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+    };
+
+    systemd.services.inventree-config = {
+      description = "Inventree config generation";
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      before = [
+        "inventree-static.service"
+        "inventree-gunicorn.service"
+        "inventree-qcluster.service"
+      ];
+      serviceConfig = {
+        # User = "root";
+        # Group = "root";
+        User = "inventree";
+        Group = "inventree";
+        Type = "oneshot";
+        RemainAfterExit = true;
+        PrivateTmp = true;
+      };
+      environment = {
+        INVENTREE_CONFIG_FILE = configFile;
+        INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+        INVENTREE_AUTO_UPDATE = "1";
+        INVENTREE_PLUGINS_ENABLED = "1";
+        INVENTREE_PLUGIN_NOINSTALL = "1";
+        INVENTREE_STATIC_ROOT = cfg.config.static_root;
+        INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+        INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+        INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+        INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+        INVENTREE_DB_NAME = cfg.config.database.NAME;
+        INVENTREE_DB_HOST = cfg.config.database.HOST;
+        INVENTREE_DB_USER = "inventree";
+        INVENTREE_ADMIN_USER = cfg.config.adminUser;
+        INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+
+        INVENTREE_SITE_URL = cfg.config.site_url;
+
+        PYTHONPATH = pkg.pythonPath;
+      };
+      script = ''
+        set -euo pipefail
+
+        umask u=rwx,g=,o=
+
+        # chown inventree:inventree ${configFile}
+
+        ${pkg}/opt/inventree/src/backend/InvenTree/manage.py migrate
+      '';
+    };
+
+    systemd.services.inventree-static = {
+      description = "InvenTree static migration";
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      before = [ "inventree-gunicorn.service" ];
+      environment = {
+        INVENTREE_CONFIG_FILE = configFile;
+        INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+        INVENTREE_AUTO_UPDATE = "1";
+        INVENTREE_PLUGINS_ENABLED = "1";
+        INVENTREE_PLUGIN_NOINSTALL = "1";
+        INVENTREE_STATIC_ROOT = cfg.config.static_root;
+        INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+        INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+        INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+        INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+        INVENTREE_DB_NAME = cfg.config.database.NAME;
+        INVENTREE_DB_HOST = cfg.config.database.HOST;
+        INVENTREE_DB_USER = "inventree";
+        INVENTREE_ADMIN_USER = cfg.config.adminUser;
+        INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+        INVENTREE_SITE_URL = cfg.config.site_url;
+
+        PYTHONPATH = pkg.pythonPath;
+      };
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg}/opt/inventree/src/backend/InvenTree/manage.py collectstatic  --no-input
+        '';
+      };
+    };
+
+    systemd.services.inventree-gunicorn = {
+      description = "InvenTree Gunicorn server";
+      requiredBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      #wantedBy = [ "inventree.target" ];
+      environment = {
+        INVENTREE_CONFIG_FILE = configFile;
+        INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+        INVENTREE_AUTO_UPDATE = "1";
+        INVENTREE_PLUGINS_ENABLED = "1";
+        INVENTREE_PLUGIN_NOINSTALL = "1";
+        INVENTREE_STATIC_ROOT = cfg.config.static_root;
+        INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+        INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+        INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+        INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+        INVENTREE_DB_NAME = cfg.config.database.NAME;
+        INVENTREE_DB_HOST = cfg.config.database.HOST;
+        INVENTREE_DB_USER = "inventree";
+        INVENTREE_ADMIN_USER = cfg.config.adminUser;
+        INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+        INVENTREE_SITE_URL = cfg.config.site_url;
+
+        PYTHONPATH = pkg.pythonPath;
+      };
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg.gunicorn}/bin/gunicorn InvenTree.wsgi \
+            --pythonpath ${pkg}/opt/inventree/src/backend/InvenTree
+        '';
+      };
+    };
+
+    systemd.sockets.inventree-gunicorn = {
+      wantedBy = [ "sockets.target" ];
+      partOf = [ "inventree.target" ];
+      socketConfig.ListenStream = "/run/inventree/gunicorn.socket";
+    };
+
+    systemd.services.inventree-qcluster = {
+      description = "InvenTree qcluster server";
+      requiredBy = [ "inventree.target" ];
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      environment = {
+        INVENTREE_CONFIG_FILE = configFile;
+        INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+        INVENTREE_AUTO_UPDATE = "1";
+        INVENTREE_PLUGINS_ENABLED = "0";
+        INVENTREE_PLUGIN_NOINSTALL = "1";
+        INVENTREE_STATIC_ROOT = cfg.config.static_root;
+        INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+        INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+        INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+        INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+        INVENTREE_DB_NAME = cfg.config.database.NAME;
+        INVENTREE_DB_HOST = cfg.config.database.HOST;
+        INVENTREE_DB_USER = "inventree";
+        INVENTREE_ADMIN_USER = cfg.config.adminUser;
+        INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+        INVENTREE_SITE_URL = cfg.config.site_url;
+
+        PYTHONPATH = pkg.pythonPath;
+      };
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg}/opt/inventree/src/backend/InvenTree/manage.py qcluster
+        '';
+      };
+    };
+  };
+}
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -0,0 +1,7 @@
+{ inputs, ... }:
+{
+  flake.overlays = {
+    default = final: prev: import (../pkgs/overlay.nix) inputs final prev;
+  };
+
+}
--- a/pkgs/inventree/default.nix
+++ b/pkgs/inventree/default.nix
@@ -0,0 +1,145 @@
+{
+  stdenvNoCC,
+  python3,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  nodejs,
+}:
+let
+  version = "unstable-2025-05-09";
+
+  src = fetchFromGitHub {
+    owner = "inventree";
+    repo = "InvenTree";
+    rev = "e0acfaa762da0dd7b2822b567202210ca8b7dbd3";
+    hash = "sha256-K+cqErDUmgPO7625P3jp7+7BOYEfyJ1nElae6RlJvvI=";
+  };
+
+  frontend = stdenvNoCC.mkDerivation {
+    name = "inventree-frontend";
+    inherit version src;
+
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${src}/src/frontend/yarn.lock";
+      hash = "sha256-KpWuYCrkGN+4UnwV1STEbTL0FWcLZ7Wq8a8ST55OpGM=";
+    };
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      nodejs
+    ];
+
+    patchPhase = ''
+      runHook prePatch
+      cd src/frontend
+      runHook postPatch
+    '';
+
+    buildPhase = ''
+      echo "Running lingui"
+      ./node_modules/.bin/lingui compile --typescript
+      echo building lib
+      ./node_modules/.bin/tsc --p ./tsconfig.lib.json
+      ./node_modules/.bin/vite --config vite.lib.config.ts build
+      echo "Running tsc"
+      ./node_modules/.bin/tsc
+      echo "Running vite"
+      ./node_modules/.bin/vite build --emptyOutDir --outDir $out
+    '';
+  };
+
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "InvenTree";
+  inherit version src;
+
+  format = "other";
+
+  dependencies = with python3.pkgs; [
+    coreapi
+    cryptography
+    distutils
+    dj-rest-auth
+    django_4
+    django-allauth
+    django-allauth.optional-dependencies.openid
+    django-allauth.optional-dependencies.mfa
+    django-allauth.optional-dependencies.socialaccount
+    django-cleanup
+    django-cors-headers
+    django-dbbackup
+    django-error-report-2
+    django-filter
+    django-flags
+    django-formtools
+    django-ical
+    django-js-asset
+    django-maintenance-mode
+    django-markdownify
+    django-money
+    django-mptt
+    django-redis
+    django-oauth-toolkit
+    django-otp
+    django-q-sentry
+    django-q2
+    django-redis
+    django-sesame
+    django-sql-utils
+    django-structlog
+    django-stdimage
+    django-taggit
+    django-user-sessions
+    django-weasyprint
+    djangorestframework
+    djangorestframework-simplejwt
+    djangorestframework-simplejwt.optional-dependencies.crypto
+    django-xforwardedfor-middleware
+    drf-spectacular
+    dulwich
+    feedparser
+    gunicorn
+    pdf2image
+    pillow
+    pint
+    pip-licenses
+    pypdf
+    python-barcode
+    python-barcode.optional-dependencies.images
+    python-dotenv
+    pyyaml
+    qrcode
+    qrcode.optional-dependencies.pil
+    rapidfuzz
+    sentry-sdk
+    tablib
+    tablib.optional-dependencies.xls
+    tablib.optional-dependencies.xlsx
+    tablib.optional-dependencies.yaml
+    weasyprint
+    whitenoise
+
+    psycopg2
+    fido2
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [ django-slowtests ];
+
+  installPhase = ''
+    mkdir -p $out/opt/inventree
+    cp -r . $out/opt/inventree
+
+    echo "Installing frontend"
+
+    mkdir -p $out/opt/inventree/src/backend/InvenTree/web/static/web
+    cp -r ${frontend}/* $out/opt/inventree/src/backend/InvenTree/web/static/web/
+    cp -r ${frontend}/.* $out/opt/inventree/src/backend/InvenTree/web/static/web/
+  '';
+
+  passthru = {
+    pythonPath = python3.pkgs.makePythonPath dependencies;
+    gunicorn = python3.pkgs.gunicorn;
+    inherit frontend;
+  };
+}
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -0,0 +1,27 @@
+inputs: final: prev: {
+
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (py-final: py-prev: {
+      django-dbbackup = py-final.callPackage ./python/django-dbbackup { };
+      django-error-report-2 = py-final.callPackage ./python/django-error-report-2 { };
+      django-flags = py-final.callPackage ./python/django-flags { };
+      django-ical = py-final.callPackage ./python/django-ical { };
+      django-markdownify = py-final.callPackage ./python/django-markdownify { };
+      django-money = py-final.callPackage ./python/django-money { };
+      django-q-sentry = py-final.callPackage ./python/django-q-sentry { };
+      django-recurrence = py-final.callPackage ./python/django-recurrence { };
+      django-slowtests = py-final.callPackage ./python/django-slowtests { };
+      django-structlog = py-final.callPackage ./python/django-structlog { };
+      django-stdimage = py-final.callPackage ./python/django-stdimage { };
+      django-user-sessions = py-final.callPackage ./python/django-user-sessions { };
+      django-weasyprint = py-final.callPackage ./python/django-weasyprint { };
+      django-xforwardedfor-middleware = py-final.callPackage ./python/django-xforwardedfor-middleware { };
+      pip-licenses = py-final.callPackage ./python/pip-licenses { };
+      py-moneyed = py-final.callPackage ./python/py-moneyed { };
+      pytest-pycodestyle = py-final.callPackage ./python/pytest-codestyle { };
+      sentry-sdk = py-final.callPackage ./python/sentry-sdk { };
+    })
+  ];
+
+  inventree = final.callPackage ./inventree { python3 = final.python312; };
+}
--- a/pkgs/python/django-dbbackup/default.nix
+++ b/pkgs/python/django-dbbackup/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django_4,
+  pytz,
+}:
+
+buildPythonPackage rec {
+  pname = "django-dbbackup";
+  version = "4.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-dbbackup";
+    rev = version;
+    hash = "sha256-GD+f9mbImGPQ6MOUK3ftHqiGv7TT39jNQsFvd0dnnWU=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    django_4
+    pytz
+  ];
+
+  pythonImportsCheck = [ "dbbackup" ];
+
+  meta = {
+    description = "Management commands to help backup and restore your project database and media files";
+    homepage = "https://github.com/jazzband/django-dbbackup";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+    mainProgram = "django-dbbackup";
+  };
+}
--- a/pkgs/python/django-error-report-2/default.nix
+++ b/pkgs/python/django-error-report-2/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-error-report-2";
+  version = "0.4.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "matmair";
+    repo = "django-error-report-2";
+    rev = version;
+    hash = "sha256-ZCaslqgruJxM8345/jSlZGruM+27H9hvwL0wtPkUzc0=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "error_report" ];
+
+  meta = {
+    description = "Log/View Django server errors";
+    homepage = "https://github.com/matmair/django-error-report-2";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-flags/default.nix
+++ b/pkgs/python/django-flags/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-flags";
+  version = "5.0.13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cfpb";
+    repo = "django-flags";
+    rev = version;
+    hash = "sha256-WPMfFYoP6WaVzZmVtqAz4LlY761aCRyPhd5npc8bOOI=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "flags" ];
+
+  meta = {
+    description = "Feature flags for Django projects";
+    homepage = "https://github.com/cfpb/django-flags";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-ical/default.nix
+++ b/pkgs/python/django-ical/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+  django-recurrence,
+  icalendar,
+}:
+
+buildPythonPackage rec {
+  pname = "django-ical";
+  version = "1.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-ical";
+    rev = version;
+    hash = "sha256-DUe0loayGcUS7MTyLn+g0KBxbIY7VsaoQNHGSMbMI3U=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    django
+    django-recurrence
+    icalendar
+  ];
+
+  pythonImportsCheck = [ "django_ical" ];
+
+  meta = {
+    description = "ICal feeds for Django based on Django's syndication feed framework";
+    homepage = "https://github.com/jazzband/django-ical";
+    changelog = "https://github.com/jazzband/django-ical/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-markdownify/default.nix
+++ b/pkgs/python/django-markdownify/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  bleach,
+  django,
+  markdown,
+}:
+
+buildPythonPackage rec {
+  pname = "django-markdownify";
+  version = "0.9.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "erwinmatijsen";
+    repo = "django-markdownify";
+    rev = version;
+    hash = "sha256-KYU8p8NRD4EIS/KhOk9nvmXCf0RWEc+IFZ57YtsDSWE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    bleach
+    django
+    markdown
+  ];
+
+  pythonImportsCheck = [ "markdownify" ];
+
+  meta = {
+    description = "Markdown template filter for Django";
+    homepage = "https://github.com/erwinmatijsen/django-markdownify";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-money/default.nix
+++ b/pkgs/python/django-money/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+  py-moneyed,
+}:
+
+buildPythonPackage rec {
+  pname = "django-money";
+  version = "3.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "django-money";
+    repo = "django-money";
+    rev = version;
+    hash = "sha256-eL26NsreUqtMJ26TmvmB53EJI4Sjs7qjFDnnt4N0vdI=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    django
+    py-moneyed
+  ];
+
+  pythonImportsCheck = [ "djmoney" ];
+
+  meta = {
+    description = "Money fields for Django forms and models";
+    homepage = "https://github.com/django-money/django-money";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-q-sentry/default.nix
+++ b/pkgs/python/django-q-sentry/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  setuptools,
+  sentry-sdk,
+}:
+
+buildPythonPackage rec {
+  pname = "django-q-sentry";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "danielwelch";
+    repo = "django-q-sentry";
+    rev = "d3a43a90c82734244d5ebf3295652223053f1354";
+    hash = "sha256-3C7A+X18c7p19HWD/uPRtAMf29VjmrfXXh2z5PPOREY=";
+  };
+
+  build-system = [
+    poetry-core
+    setuptools
+  ];
+
+  dependencies = [ sentry-sdk ];
+
+  pythonImportsCheck = [ "django_q_sentry" ];
+
+  meta = {
+    description = "Bringing Sentry error tracking to Django Q";
+    homepage = "https://github.com/danielwelch/django-q-sentry";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-recurrence/default.nix
+++ b/pkgs/python/django-recurrence/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pdm-backend,
+  django,
+  flake8,
+  pytest,
+  pytest-cov,
+  pytest-django,
+  pytest-sugar,
+  python-dateutil,
+  sphinx,
+  sphinx-rtd-theme,
+  tox,
+}:
+
+buildPythonPackage rec {
+  pname = "django-recurrence";
+  version = "1.12.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-recurrence";
+    rev = version;
+    hash = "sha256-Q33zyMa1wI13RNLxynGAJHlagahpnFHCmZbHp0aPC/w=";
+  };
+
+  build-system = [ pdm-backend ];
+
+  dependencies = [
+    django
+    flake8
+    pytest
+    pytest-cov
+    pytest-django
+    pytest-sugar
+    python-dateutil
+    sphinx
+    sphinx-rtd-theme
+    tox
+  ];
+
+  pythonRelaxDeps = true;
+
+  pythonImportsCheck = [ "recurrence" ];
+
+  meta = {
+    description = "Utility for working with recurring dates in Django";
+    homepage = "https://github.com/django-recurrence/django-recurrence";
+    changelog = "https://github.com/django-recurrence/django-recurrence/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-slowtests/default.nix
+++ b/pkgs/python/django-slowtests/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django_4,
+}:
+
+buildPythonPackage rec {
+  pname = "django-slowtests";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "realpython";
+    repo = "django-slow-tests";
+    rev = version;
+    hash = "sha256-gW9AZiMpXJp1m2X1cbm6GdZ9cH+TFqjNLQJFmsvGjB0=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django_4 ];
+
+  pythonImportsCheck = [ "django_slowtests" ];
+
+  meta = {
+    description = "Locate your slowest tests";
+    homepage = "https://github.com/realpython/django-slow-tests";
+    changelog = "https://github.com/realpython/django-slow-tests/blob/${src.rev}/CHANGELOG.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-stdimage/default.nix
+++ b/pkgs/python/django-stdimage/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+  pillow,
+  gettext,
+}:
+
+buildPythonPackage rec {
+  pname = "django-stdimage";
+  version = "6.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "codingjoe";
+    repo = "django-stdimage";
+    rev = version;
+    hash = "sha256-uwVU3Huc5fitAweShJjcMW//GBeIpJcxqKKLGo/EdIs=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    django
+    pillow
+  ];
+
+  nativeBuildInputs = [ gettext ];
+
+  preBuild = ''
+    echo "bla bla"
+    echo $PATH
+  '';
+
+  pythonImportsCheck = [ "stdimage" ];
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/codingjoe/django-stdimage";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-structlog/default.nix
+++ b/pkgs/python/django-structlog/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  asgiref,
+  django,
+  django-ipware,
+  structlog,
+  celery,
+  django-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "django-structlog";
+  version = "9.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jrobichaud";
+    repo = "django-structlog";
+    rev = version;
+    hash = "sha256-SEigOdlXZtfLAgRgGkv/eDNDAiiHd7YthRJ/H6e1v5U=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    asgiref
+    django
+    django-ipware
+    structlog
+  ];
+
+  optional-dependencies = {
+    celery = [ celery ];
+    commands = [ django-extensions ];
+  };
+
+  pythonImportsCheck = [ "django_structlog" ];
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/jrobichaud/django-structlog";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-user-sessions/default.nix
+++ b/pkgs/python/django-user-sessions/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-user-sessions";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-user-sessions";
+    rev = version;
+    hash = "sha256-Wexy6G2pZ8LTnqtJkBZIePV7qhQW8gu/mKiQfZtgf/o=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "user_sessions" ];
+
+  meta = {
+    description = "Extend Django sessions with a foreign key back to the user, allowing enumerating all user's sessions";
+    homepage = "http://github.com/jazzband/django-user-sessions";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-weasyprint/default.nix
+++ b/pkgs/python/django-weasyprint/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+  weasyprint,
+}:
+
+buildPythonPackage rec {
+  pname = "django-weasyprint";
+  version = "2.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fdemmer";
+    repo = "django-weasyprint";
+    rev = "v${version}";
+    hash = "sha256-eSh1p+5MyYb6GIEgSdlFxPzVCenlkwSCTkTzgKjezIg=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    weasyprint
+  ];
+
+  pythonImportsCheck = [ "django_weasyprint" ];
+
+  meta = {
+    description = "A Django class-based view generating PDF resposes using WeasyPrint";
+    homepage = "https://github.com/fdemmer/django-weasyprint";
+    changelog = "https://github.com/fdemmer/django-weasyprint/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/django-xforwardedfor-middleware/default.nix
+++ b/pkgs/python/django-xforwardedfor-middleware/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-xforwardedfor-middleware";
+  version = "2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "allo-";
+    repo = "django-xforwardedfor-middleware";
+    rev = "v${version}";
+    hash = "sha256-dDXSb17kXOSeIgY6wid1QFHhUjrapasWgCEb/El51eA=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "x_forwarded_for" ];
+
+  meta = {
+    description = "Use the X-Forwarded-For header to get the real ip of a request";
+    homepage = "https://github.com/allo-/django-xforwardedfor-middleware";
+    license = lib.licenses.publicDomain;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/pip-licenses/default.nix
+++ b/pkgs/python/pip-licenses/default.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  prettytable,
+  tomli,
+  autopep8,
+  black,
+  docutils,
+  isort,
+  mypy,
+  pip-tools,
+  pypandoc,
+  pytest-cov,
+  pytest-pycodestyle,
+  pytest-runner,
+  tomli-w,
+  twine,
+}:
+
+buildPythonPackage rec {
+  pname = "pip-licenses";
+  version = "5.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "raimon49";
+    repo = "pip-licenses";
+    rev = "v-${version}";
+    hash = "sha256-6xw6BCuXSzNcwkpHaEFC5UPpubPUwhx/pg6vZq2er7A=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    prettytable
+    tomli
+  ];
+
+  optional-dependencies = {
+    dev = [
+      autopep8
+      black
+      docutils
+      isort
+      mypy
+      pip-tools
+      pypandoc
+      pytest-cov
+      pytest-pycodestyle
+      pytest-runner
+      tomli-w
+      twine
+      wheel
+    ];
+  };
+
+  pythonImportsCheck = [ "piplicenses" ];
+
+  meta = {
+    description = "Dump the license list of packages installed with pip";
+    homepage = "https://github.com/raimon49/pip-licenses";
+    changelog = "https://github.com/raimon49/pip-licenses/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/py-moneyed/default.nix
+++ b/pkgs/python/py-moneyed/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  babel,
+  typing-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "py-moneyed";
+  version = "3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "py-moneyed";
+    repo = "py-moneyed";
+    rev = "v${version}";
+    hash = "sha256-k0ZbLwog6TYxKDLZV7eH1Br8buMPfpOkgp+pMN/qdB8=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    babel
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "moneyed" ];
+
+  meta = {
+    description = "Provides Currency and Money classes for use in your Python code";
+    homepage = "http://github.com/py-moneyed/py-moneyed";
+    changelog = "https://github.com/py-moneyed/py-moneyed/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/python/sentry-sdk/default.nix
+++ b/pkgs/python/sentry-sdk/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  certifi,
+  urllib3,
+}:
+
+buildPythonPackage rec {
+  pname = "sentry-sdk";
+  version = "2.26.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "getsentry";
+    repo = "sentry-python";
+    rev = version;
+    hash = "sha256-Wl8yq2X9GuPcqaS93hkKXs2cDzz282Xceaai4NjbVZY=";
+    fetchSubmodules = true;
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    certifi
+    urllib3
+  ];
+
+  pythonImportsCheck = [ "sentry_sdk" ];
+
+  meta = {
+    description = "The official Python SDK for Sentry.io";
+    homepage = "https://github.com/getsentry/sentry-python";
+    changelog = "https://github.com/getsentry/sentry-python/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/vars/per-machine/rigel/inventree/admin-password/groups/admins
+++ b/vars/per-machine/rigel/inventree/admin-password/groups/admins
--- a/vars/per-machine/rigel/inventree/admin-password/machines/rigel
+++ b/vars/per-machine/rigel/inventree/admin-password/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/inventree/admin-password/secret
+++ b/vars/per-machine/rigel/inventree/admin-password/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:gRe4xfV66Cq/6ykFWAf2a0PeER28pOjegJLhCKckKAYU,iv:JhYqNAvXTrmmdzocNKTShn6SemgxhX6wjz6yVleh7sg=,tag:AYCdyRrvhQcfRLOrHUCA4g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPUmNQczl1bEhIaFQ1SEFa\neHg0MDhDL2FkZDU5YWRlUFFEemUvaDV6VkNFCjBVSk5tcXVEdC9RSk5KNlhDR1Qw\nVllPR1FHYTREOHhrOElQODNiL3hndUkKLS0tIDVYeEhncGdKcVJpeGtOZmYzKzRS\nOVVjbHZOVnpCdjdGc3l3aTdDdzJvUU0KpVWW4vPGdhe9WoEM0KFYkawPRTGh7d+l\nQflVtMGq363t+M6BbU1dqDMhbIL2dE0yhj7zlwr/629ARIgtMiPQcw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRSzM5ZEhKWEdldDdtVFRC\nb2UrVnROVWdxeklCaXhHeDNEOXlSeVh4dm44CjlYL1pFQzVxVmxNZ0FTUjRJZ2Q4\nOGE4eDRiSVlxUU5tZ296ZWxKUG9MU3cKLS0tIGJVaVVmSUw2S25EeTNabi9lTzM5\nN1FkQzErWmRzNmVJSlRwSlJTWEZlSncK1vgeqKbIczdlL2OBYP32z9WErPoNo8Al\nFcP7K1fhbHBPh1MKy77hTxMFNRk+sBWerJauGIbCk6Cu61cq64U3eQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDB5M09DNk5h\nczhzWnpoVTBpVXY1Q2ZVZkloQUJhc1crZTFqejcrLzhtd0UgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpqd3dJY3hvUThabnJPQTVUditaR1Bj\nWk9LMHhpdVVLRERFK05ZTnhzS3dzCi0tLSBjdUtPVi80bTI5Z2V0czdHcXVkbnRp\nQ3piL0NQa1J6NTA0SUhQaWdiaTZzCk4YhX+9bbw5BqTS17a3h00v52QUOU8S21ea\nzdRKAjTGgfOKFhhoNx/8jqRV9efCZwf4JVCkdvgRAtG04x7k3vI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHM0b09KM3ZL\nU3Y1V3FqZFZTcTdHUVhOQm5nTVp0QjBtWnd6dGJvdU1oem8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwphVEp3NVFCckNRSFNRdUxQVmdZWFhR\ncmtLN0NNUE8vZVlCcHRHMlNFOFpnCi0tLSBZbTNEWTl2NGVNTmxuVGtRMXFYando\nL1lSNVdacXdCRjBWTDRRTk1zek5RCi5EswO5JgMNtqqO2i121rYpgPTvvuKuGtVV\nfQ4tpekJ/YfkdmSLhQ81jQMZfb7Qps9MhIDdwuUQyqFNcLGtOFs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGwxYUU1OFZq\nUTl5UUduaDhPV0xRU1RFaGtGK1Z3bFE2ZkxsT3Nwa3d1MTQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpYNk4yZXNZZVpqRU9CMDNFQXk2cWxE\nZjVGaStjaVBtV0VXRE5xSVQyam1jCi0tLSBkbzVSTElJNTFGdG0zblJwcVV1VjA2\neWVTRnlLcDFVZmJKSjB1Z1I0TVo0ChV+nOMAup0pI/Gh93fM/nz9+/vmzz2CveEK\ncwbKPpgyTj5oUG5cXPLdC1WhTg3YT0qpv/m9pJFCPVIG8TLAPIc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZ1piTUlyWFhrWWVjVkl2\nVFF1bTRxVTljTlBCM09EaStVRU1zWE85QVFJClA5Qk54NUZwTVRMM3ExRXRjenhZ\nUVZNRXMweDRuQlU4ZGo5dGtDNWFkL3MKLS0tIFhPbDY1eXdhVENZZW42RDcwanBl\naG8vUmxNQWx1QzlyT0J6ZEJmSi9hRGcKwlS6eWlsHp5fcXJdjm4qkG4LnG1+zJGK\nCZi6jX0O1b7q+SGvKa1cUmZW570czpFOvkhFvLBSPCYThRzls2unvQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHbjA1Ri9FSDl0WGFBQmFY\nU2pua0ttK0RkaFIrTXkzSHY0eUF5S3BYZG5VCkFzQkxINFQyQmZ5TVdkKzc1UElq\nWUZPRTEvZFFhZUxjS2RKK3Y0QXJYUVUKLS0tIHlZT1ZNZS9TcVVTV2JxMGU4MGpP\nMHdFelNYU2Rqa0JuNTFqNU9KRjQrekkKR/u3BvFxvM8towU1AR3Fc8avPCogLcqd\nQVvLmwi/3xc0QKWTMHkgYDKNN9ZXss4uie+0ZB+uQZnQzVDQJ3RDKQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKbU9wcHRDZ2pkUDhlc0FQ\nREg3cFNlQ3NkSmhNNjVBY2xHcndPSklNa0dBCmFjV24xU0g1Z2cvYm5LWUE4aDBF\nY3drQ2JxblRlemNPeDZWOFZWYzBQMlkKLS0tIEhmcGRUbTMvUEp3Vm9PaVBCQXZ4\nTlF6bHZSVzF5V095VjRuVThIa204RlUKWfCq/6RM0Dksa4RSszmf93U24Ap+PY1y\nM1ZgzpIEY6X5qAu+1yegYRWHG5qqu//Ao/H2yzxlZJZqI7a6DmvRgA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0amhMbDlUVUtkWExYK3ND\nbWNvNUlvdUVRYTgrczdXVlp5bXYzNU9Sd0RVCkV0bUtrNXgxcG9UUmx5UXdnQjNS\nT0dHcEdRV0huQVNkU1c2dDRicHZYaEUKLS0tIE1sMmJyZVo1byttMHY3bXRWZVk1\nTXN2RGt5ZDZadDJYa1B0Z2N4SGFORFEKDJjr9BnmFsTwnlzYC19XFeVHtguzOe/5\n0makyV8ZnEKyUS1kfnb1JOQLqptJGyNYyVYUedTXrv89FuWdPgYLIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-09T10:20:13Z",
+		"mac": "ENC[AES256_GCM,data:LcPJPan0/S3o4aA0bRS6TXZ0YtPi96z7L/sGH63uFHQpMpF+CYguxmiTmqTvw9eCUuXMw204R9lsgp7EwxDH0TDs52/Wrs3QNnizwn35OcpBvKHopZ93IQc17ZRqbDyDA3xpKUUv0EeUnfpTgKZSKZj4viRAjsmphR+1gAKSrYA=,iv:j4Gggh1clO5FYRYWBlROJrnlp7Qly0/jj3Hqv9Bd/qs=,tag:oQXrnO/oCrYUEiQt2gjNcg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/rigel/inventree/admin-password/users/kurogeek
+++ b/vars/per-machine/rigel/inventree/admin-password/users/kurogeek
--- a/vars/per-machine/vega/nextcloud-secretFile/secret/groups/admins
+++ b/vars/per-machine/vega/nextcloud-secretFile/secret/groups/admins
--- a/vars/per-machine/rigel/inventree/oidc-key/machines/rigel
+++ b/vars/per-machine/rigel/inventree/oidc-key/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/inventree/oidc-key/secret
+++ b/vars/per-machine/rigel/inventree/oidc-key/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:pkCti9yWiVy7Ngiz1bSDGKLDqV3LXFo/hSXePepdk+ss,iv:8dKbIkveu2lBeG/MyuIz08lkmXs3k6uSeJIxXyQQDG8=,tag:kVsQ52/SvWhZP9jmA2fiBg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDc1dVRXJXNStIb2pmc05u\nUUhZaHdRUkRNTy8vREtrbHdNS2FLTzArSEVVCkQvdmE5bHcwaUIyN2Jhb2RxeEhh\nRXpyTmZCY1p5U2RTdGRiTHhRb1BZcUUKLS0tIEJyQ0E0bE1vU00reldaYjlFcmNq\ndDZaelJ3UWtRdnlvZXljbEE3V01uOE0KX6FF1/EoWwu+r+/1+E729UkAkNvhz+Sn\nIXH9+RpdwFq4zzOwMw9Z/rmImX6zHUgRWw6rtqfPXb2l5Djvt4csow==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGU3loZ0RUSTNJczhnWFJq\nQ2ZZVFBoUXhMeE5FS3lvSzJZNG9mSDVKWVVBCmFLaldMaFU1QTRPMW11dHNMcmpC\nem81VDFiV2RDbU9aTXR4RWRxVmVjU2MKLS0tIEpFaVZzNCtoSUtrVTdGUjdBY1do\nMVkyWGJ1MHorT2tYdXFnOU5SRWk1RGsKAS73jL6Ge6hW6GzMkutq+1NwzqnGVk5A\n4T9x47mZ91gMdvcRGyFzqPh6ls1HbEnKqOUXGw0/WY+Ct0C84Vp91Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHM4WksweTBW\nTkFyVjZCaDMyT3F1all1b1dkZTczNEw3YnlSYTdycXVEVEkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpkanYyT01pTnhWSVN4ZjBFL0dRR01V\nRFFFckZnQXFYMTJ1ZktWbWtKTURvCi0tLSB4cVkwWDdRcEV5THMvdG44Q0tCY1N6\nc2ljd1BtbHFLRExYV05IbDFlWWQ0ClYDvjMGa9naT3zgJxPIHqWDYjN9Ygb0gLnp\nizNzu+EIF9jpTNHsNuhArTv8DGyX8SwrprqJ9/31IV5gbl+F6r8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpvTHJtaHB4\neUtjcCs4SWJGazR5TEdOMmt4WnBCOThKVDMrUXZuTjlSbGsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpUeExmOS9vaWxCaW1vU3N1clRjT3N2\nMHh2clZ3cGkrT3gzRlV2cG1vYUtFCi0tLSBmdHlLSmV6cUxJeWlNUks2Tkc5TzhN\nNHM0NHAvQzEyK2J4OVhLWmxhc3k0CmZahj+dwLNVN0fhaLV5MYEksKffoNOAt8Z9\nvgY2H26MS5pGub+1KDB+mv6vYWDNrAQUyjAqKGswXGE4qCHLKVw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGVNR052eXNW\nSURJSEhTYnFDMnlEdmV6RG1HSE5QWlVQUndzTmhteDhiUTAgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo4eWpGR1hLSGcxcDZOR0F0S293dzFh\nMkZiVlVnVUxnWUtETHIrcUdFZTFJCi0tLSBvejlnVzJjM29iU01va3BmdjhrZTBh\nbUN0cUNoOFZQN0ZHVzk1Y3N5M2xRCkxHdSo5Lk87DDyTZKnoazGIcO9pwiyiWpmS\nG2C2IwCAor9/g1TG3/B3SMpVaBZTNxZYQH6cT337zlgYJdSV3/8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZWIrMjBxdHgzdTR2dnRI\nWStUb3IxcFc5eTNWSzFLQXlmUUpzYVJJVHhNCjkzaHdVUGtuRGZ5NEhJK2UxYWcy\nMVFVME5DOHVMME11L2MzVjVhOUE0c1UKLS0tIGR1SGYxZllTYkhkb3Nab005Nmxj\nbVN4OXpRbXNLbWJ1cTBOdDRGMlU3THMKB2o5XocUUeetpDn9u+wRDnhHbyYaMv10\nKO9JiFsOk9BO8zoQaOjx3TAntl9p1OxflMiRPvzm/7Z4DTxECISgjA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZXhkYTdrOHNSUCs5WUhl\nUyt4KzJYb1B1cmQ0K09ja3ZUbVo3b0UyL3pnCkxBSXJZOG53RTEvRmxyUEthVlg5\neUU1UFdFKzl3T1R3UVB4VlhpMHBBeDAKLS0tIFkyOXp2aFZtbGo3TndiNHhjVGdh\nR2FqYXJ6T20rQmxOZFhJTTIrNTYzcWMKReHBtogWdX6fzCcygb7p6AK8BgBP23FL\nh+j5HEbRnnW3D7HTkM0Hb1//f0DhW1Mf/7D+Id8iiMS3ATtuK0dryQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYLzVUOWZySWdnS3VNYVNV\nZkMzMTFBRE9GSzNNakUreWxaZkVNanVsa0JBCnZnOTcrK3hwZFlhNFMzbFhRZ0JR\nTVVVRy8zNGwyRlhXUGM1MmRIa2orMFUKLS0tIDUwVXM3V1VQWXhUNE9pUzJDcmtv\nWDVBN1dtQ1l0RWI2elFUbnpSUngzR0UK17hEqXwmcB4PBqzFwvjH/S1RucsfiD1N\np6/tPKpN9SOm3+GwO6h6ztvmLdorMwCN1jSg+CGMhAitz/hU+QzSvw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzQ3p5Mkt4VWpiNGZjUGZ1\nWFQvb1lmd0ZyMFI4Vmp0SDFybXBNN0hjZXc4CkxDRlEwWEpVdkd5OGtzUGxSSktG\nSmJqaEhhcGE1REZGaTlwWnFNbFgrSFkKLS0tIGd6TE9tbHc2aWRiY1NvcHhoRVVq\nbUtlTFcveU5zUWxSbzAzRGtCSG42ODQKJZbVBL+8+HVe6+Jwh3gE7WkTZOERTrG2\nX4XeqBP/fw2qtgi+xBIt45JLc6mWfjLM4vrz5oYhEWBZvbcU3/KPSQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-09T10:20:13Z",
+		"mac": "ENC[AES256_GCM,data:OvTB885hx+RQZ1yM5SUcWKNUeNzXlIJXSJr7LbBOzOo8kJphSUCFy57X/JVgyXUU/e29H+U1OyF6d4YKc6tGVBiUz7E/KtHmRAhelQYViKFoimd985eVXbcOhBbjw+xoeJ6lQfdqbafl6Lo9lLoPceS3so1vRPNoijGK60nAqts=,iv:OYC5ndXZ/dpgrmVmNIHcNACmkEm7mizelcAd+ryCrd0=,tag:W/o1twuJ42k55T/23EZ3cQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/vega/nextcloud-secretFile/secret/users/kurogeek
+++ b/vars/per-machine/vega/nextcloud-secretFile/secret/users/kurogeek
--- a/vars/per-machine/rigel/inventree/secret-key/groups/admins
+++ b/vars/per-machine/rigel/inventree/secret-key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/inventree/secret-key/machines/rigel
+++ b/vars/per-machine/rigel/inventree/secret-key/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/inventree/secret-key/secret
+++ b/vars/per-machine/rigel/inventree/secret-key/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:Zq4Pspmi5GzM/FnUtriOz+CEGciVPqg2Wuz0G7GsbtUO,iv:liuB62+GES8cMDtuClxLml6dzD6JZpyQVtdnTOTlMeM=,tag:OFbpHeX2ZofgMypze/aUhw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0VGhwMjIySUdBNzd3M2NW\nYWQ5QTFrdEF1Y2JFbUJ1ZWQrUWg2YTFuVm4wCml4VTdGVlRNVFNBYUdkQlFWc2hl\nY0wybHBvT1NUQ2ZSUHNPcjdYSTRqSHcKLS0tIGlhZUpvNElVcXducVdZY0hSeWJ4\ncmRERmg4MmlNMmMyNmh5cDJ3b3E1UlEKx49EouSjd2FdWHWJEwBg+jtPitxUutHq\nmlCCU/r+3Jyfv8g8/H/UTcFsdRfF7vc5uQP9eE2TSQsQlhQf5BQcsw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvaXZNWFB3TEFDcFJycTZT\nUVI1d1lTRUJCdDJXS1FIZGlENzFSdFI0VFZVCjFoWmhFdWFnWW10Uk9jdm8vUU5G\nQ2RxWFdodVhjZ05UMmVocHJ2QTFxbkEKLS0tIEUrSk5aY2JPM05EQmt3Sm1sMGNh\nVG1NenNrQlduSXEvdEVNdWpUdG5hSFUKxFjxctJXJUQE/KCpJmzIHTSJitG7QlPb\nzqVN5xagLpg4Haeezuf1NRTlpSXijzhCIols23u51pIHgFBqMMHwvQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNZM1RnS0Iv\nMWltSThTeGtkYUgxbi9QU2J1Z3BGdzhMRFFKamErd3c1elEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpaUmpGaGRoTGhwK0YwSGFGK1ZKaG44\nMVcxdUpUZzBWTS8zdDN6RSt6V3pjCi0tLSBldjVzRnk4ZTJ2RVRHbUpKaWR1TTVW\nQzhPajB3LzNBeVhmTE5lYVJYb29zCuaIahi2SjKLLnCkv4FncVD9N/YdE4C5GCm6\nL8nqxHRM2aSyjDUvfRDQ0j0M2WjpHpv4L1UnHIIEOdJXsKsEJTs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIERnNTFrRmgy\nOXJRcGEyRWNWTXRhb3pldk1OZG5UWW9yQVREa2p4azdFUmcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo5TTB1SmFERlU0STVKSGhBaHcvbHpQ\nUlZBQWNnZnNiNk1NTGFua2tTalBZCi0tLSAwcVhZWFN6Y01xSUhyOGxPdWQ4TWJq\nc3JubWwwdXlMREtoakNJUTFSTnpFCl50Yl5CHedbSTaK1LB6ElGZw78+Ea+Q8oJi\nfmsB5vgxFpcRTtiz97/Nc7pX0C0Xvlc4XIRUEc6okfHOVoIKN34=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDFVc2U2Vm9o\nMzVLeVptZ0lJUzkrN0hrMG9hNG1IZGdkajJiMGhxakpEVjQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpBeTdpbE9CbHk5eUdFajdNb05pU1pG\nR0EvS29PL2N6UFdLYUc0Tm9qQ204Ci0tLSB6M2NLb1pSclFKL0NYUGV6NkhUcEk0\nZEJOYXE3M2xDeUNtQTdJQjlWOUlzCn0a/kziCd+GXp9E8/sFMjXU5ytdhBBGT8Gz\nWCU1pSVDkc7UHfzfqe9uPm7Zclw8yg6jHKjuayuKWoa+rBFp8ok=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSjdzNzFvc2RaSjJ4THJ4\nUnYzQitrcjNiRXRpbnE2anRXSFpRVGlORW13ClZRN0xkdWhhaWxJMUFySnJKWjkr\nZzFTcWdQckdvUStmU0w3RS8zQW14NDAKLS0tIGVnOTNZUmRlQ3hCUTRRamh6MlFB\nY1NqNnBVOVVRdTRNMFBTQXZrWFI3b2cKCBVSv+a6IEI8G9qwpdlP60C0px788Lhl\nem0CbSLF9+zZOAVsfIGygwpf4geBXhHlphZ0edaEZn43UTcTJ+CHoA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQjdSaVJIb3ZsZ3BxeDVo\nQW0xbEY2RWtHZm5uVGJBY1JBd21rUjJlSHk4CjltN2ZwRGFEMkVxencydlU2cmxl\nRFB4NzV0MllnaWUzaVBSK0JQSE4zU2MKLS0tIGM4ZFJKL24ya2FTZGJnR3VwMkx3\nd1Q0andXeEEvZmk0SzZwazhLK2ppdGsK5vwP9K3ICpCghqRbs7G9u0+g70arGzeQ\nVpQAhBKz+ODaveQED0V/lat/d6ur4EaEhPVuCGhWWAxQwKBIPi4YlA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByU2RLSCtXa21Ra3htVFpZ\nckgvZ0RXYWNJdXhVNk5lckR5SGQ4Q0tEVjJBCmhrWEhXWjd2Unc3dEU5UkNpN21T\ncTBNZjltdkZGUFpyaG1XY2FteWFiTEkKLS0tICs1Mzg5dFVBcmx4S2FKQjFJT1Nm\nR3luZWRKRUVYUU1WREVic3pjSzFQUFUKzgY2iY45XaTGwISbZ1IhZ6DM8wQpj8C8\nud/JY/xyv8aRQLf3pOldsmJxVLdkyw8StCHZtFMOpyUO5RiG6erYHw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArbkhuYmNWUnFkOU1DZURx\nZ1FtR3c1bXg4M3YzNHFVSEZkSGo4eTE3NGxvCjZtSWdlcjNhSWdMckZPYThVM282\nRjBYSjZXTzBiSFNSVW9weXZrRHRsczQKLS0tIHpNais5NzhwZ29OVmRNSEVSemdp\nR1hOZ1JBRzljMnhNQ24wcGI3T1VMZmsK4M54cwYZ4TQoLnCbW9iNS7SiT1ApTjCg\nZA3IuJAO16LF0Eoh/VmtAZssmr1pMEHYjWtb48dgzdxN07MpyJeEqw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-09T10:20:13Z",
+		"mac": "ENC[AES256_GCM,data:aHv0LZ5SHDihteMMlGX9J+qnTw1pOtqMYOuRrRlDOrKM0Ko9vUc/CfYD/unVHYwkVrHh90FYPIRmi82M+MefeujAlrzOtT54yWpnSRBHolJuSXSgpqZXLihvx5871BVE4JBdbQry2lKE4C2IsIsk4sIEU9kB6Fswwezk5ra0TXo=,iv:6BY/RVYoRKINtZzOIH/3TX1cb9mlKUSnt2XU0NSR8jk=,tag:Mp6BvO1tPpvfN3EPQIJVXA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/rigel/inventree/secret-key/users/kurogeek
+++ b/vars/per-machine/rigel/inventree/secret-key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/vega/nextcloud-mailer/password/machines/vega
+++ b/vars/per-machine/vega/nextcloud-mailer/password/machines/vega
@@ -1 +0,0 @@
-../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/nextcloud-mailer/password/secret
+++ b/vars/per-machine/vega/nextcloud-mailer/password/secret
@@ -1,51 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:dGRLB+Zrb45vhx6B4ue7zcI+rIxa/5F42OKfilTX7puzstQW1u810nMOYnH+5w==,iv:bux7vqNuSz3Rtc26fiNtI9dkkZNKTOdGEmtZ0tl8KPc=,tag:OAh1utKd/Wbcn62bbQ+zEQ==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3cUJSalArN3B1WFVUc0gx\nZnZLaDdVczREQWxBU1Nia2crOHBVQWw5TVY0CnJxZWVqL0JieEp5MFlmTU9wMWNa\nOG1YK2drTk1lcW9RR0tSSHBYTW82emcKLS0tIDdMcGVaQm90Y1FmeW1RcHg5VTY5\nYUw1UzJlcXlTRndUaHFrVDZSUU9kNWMKCdYFrkW9oy8xy+1sQSuY1QK5nqaKem61\nJ+yOR5hJrXg60Xs+7raKdejh+nG0q4k5wNMSNpxNXmn7aIPpdy4MgA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6Q09oQmJjM3RpRk12RXBP\nd2JnWXVuaHRoaisvZDc3Ull5NU5DMldsRG5VCjNSQlBTMmQwZ25oYng4ZUdVM0Fz\neDNRQnIvL3VyTEVnTmlsUlhsV0d2dG8KLS0tIDlrSWJSbTNPMDhqRG82R2d2RnBu\nblEwQ1NvTXUvMlhtQ2RuRkk1bG5VQlUKHLqwB4xry6XeBbM4UBQir+HMCz9Jyfcc\n670jb3uIDcLFcCxmizbtjvf1yLn7k+OP3JAfwLsLCwLqOnV9DSGtYw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFZEUURGVW5w\namZpTUFiZFVlK0RDYVhIVzkvL2E2Y29KVnk3L3RCbDZBQWcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyT3dBck93V2lvdGVoUGdEWmdpYWFw\nczJ4eFQ0S3F2dHdRQ3AzTnRiakdFCi0tLSBLR2FLL0FGSm8zTXpWVVQwNU9aaVc1\nTXM1MDA2THorRis4YThkZjhpNTBBCqPfb28UE+yKhzFONYYxCYLBNhRiD1SIwX2Y\n/hgjNS1iG8BiHctOOp0DFpYT6l4YtgANuRUz0Ng33rQ9wL23y4Y=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZqb0dtd0k1\nT3dSSVNrTUViRmJWb0pNKzNacUx6VHd1N0RXa0ZZOVJPVW8gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpiRW1JRGJPdDhJM3VzVWluekxNVjV0\nSCs2OFFoc3JkN212eGRIZ2NxeXVZCi0tLSBQdCtvSytCQnhGS2pCVVRDeDExK2ha\nVmpOSk45ZGtGMlB6VVFRZ1hQVzZ3CvATWNKu7aabxet1Qx8En9/GBddKMh38K8hb\nOJ8T0bKCtJE87pKYHuoYMuajOw6IFRRhRcfmrwfoXP0TIVCqO4w=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFhqU2YyVTRa\nWlR2TGJqUHJ1dmVZVEY5MmZoRVVDM2QraXZLVTJ3RHdPam8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpLb2FlT0FaaU5meG0rOHNSQ1RhdXdN\nQVZMSXJDY1lLU3Q0M3FNR3BVVjU4Ci0tLSBIUHlWMlJpbGh5RFErTWJvSUpvcXRv\ncDVlbng3ZGtWOG11emVwMEhkVjVFCii3K5uqq+x/iGVy8KD/erOp+63g3fbfC/vr\nbM1J1O7qx3Zs5NUOb08metITHxUWSX8frh0tcDBl/gFtGNZn8ho=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZU1jS0N2aWwvbnZTQzkz\nTGRBS2l4VG9WYUxhcXd0WFc2K2FUWm4rVlhNCjl3Nkl0aUVsOW55NlhOMlMrczBq\nN3AvbWk3TGYvSE1aVmlRYnd2dk4wOWMKLS0tIEh3NGZLQkxjM0wzYXlUQTB3MmZO\nN3pZbmtQYXdYQzd6cTExSmpzRHNxVEkKLZujBdEmlnH411EQwHKEcjpOE1D9F+Qi\n9f5G/4fLipwpO2+sREcOHc5TI/NNOtFOuVZjHjt5ZkfHlg9mM9C9DA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVYmF4TVJQdkNCTWpOZEwz\nN1UvdlBsUUhLajBHWjFlNzZtOXcyek9wV2tBCm9GL0taT2kyZ3QvcWNLb0NFMUZO\nTHRFL3YrdHdSOEQ4dTY3ek5sa2NRS1EKLS0tIGVISFdFUjFObG1LdVozVXd3N2xq\nQTUyTHJBMXpUYzlwRlNicEx1K3ozUVUKs/3CDfEXOmOyllZ3rT/6LZGQKcKP/emF\nbpPBNRN/NflQNKwb4N8sJ+6IEpGFJbiPsVpUbb4DhBKKmjcW8TpzGg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiUldMWm5RbVZ6K1hHRkpY\nQ1pmVFBQQkRHdVJhQ0VpMGk4S3EzMCtGeFM0CmFtYmNNRkVwd1hHK2tJNWdTa01X\ncW1OdVljL2k5UTZkakdHcEdlUWRBUE0KLS0tIDNuTXdCL3J6SWVQOXBCMG1Cd2xr\nQS9acVBSRFNqQXRnNHVZT2F6eHEvblUKtRsVIId25zCF9duxan88n5rBJRQ3ustH\no50BrKvlqrPibcP26+dDcKGiBxBStWLJgi2W0/ww1gTBZZ3dNEXvzw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVZnNyaHNwRjdEYXVBOGxO\ncHNVaEVhRml0WG1aNXhpUUV5VElHa09Vc0ZVCm42WkppR3VZNlV1QnlmWWtlM2NC\najRRYnFRZUx4Z2lFdVd1VUNtSzNPVWMKLS0tIFdPZ0VrR2FQTE1ZeDFnbjBLajB1\nWkFYVFU0Y0hLdzYxa2lXaTRlZk16dTAKSfSD6vHmf9a5qc6r2qWSKtMvWoKNStGl\naEjbB6JbcAjh2TIy3Ocus2mdp4HFVahLuJMuyPq6ScEu+G31y3XlBg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RDNINy9kK2J2RFhLS2xG\nMGpwV3RLOTNUanNwLzZzZmFUblFpVnhNTkdFCnR5SHdYWDhGWjRZeEZncFJCSXBz\nblZNaERXWFo0QVNKUUx4OXp2SDhIM2MKLS0tIHY2QzFibTcwd1VKYlRFVG1Ha3Ey\ncWNEYitzL2k3dEMxYloyblhqQzhKb2cK7OrMyC8tWLl+otdIhFDMBnvt4uz0oSyh\nUhl5TaN+PO1O0dOJ7eM13k4cafSxp84DPTKelN01LAq6XVLzT+5nCw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-24T15:15:42Z",
-		"mac": "ENC[AES256_GCM,data:HWaqqJ5q5pgGIOcHt+klojYHePFLnuku6WYnrRSAJ6mdwpS9OAa73YKjPXe3T9i7vH0xC9GmexhkSHOkD/A7VxIVCV/0bP7APoz3zDPdyibPS046cxLJsA9yalGHd6UiiKB/9+sjR7wwnS6cE144m7N8q7lhnIaJvAGLiI+E77E=,iv:7jWjsgCdbUQip7x+sky8SgixNlG+p36HuNrAPALRRos=,tag:acvYp6uLalOIqDttUHb4CQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/per-machine/vega/nextcloud-secretFile/secret/machines/vega
+++ b/vars/per-machine/vega/nextcloud-secretFile/secret/machines/vega
@@ -1 +0,0 @@
-../../../../../../sops/machines/vega
--- a/vars/per-machine/vega/nextcloud-secretFile/secret/secret
+++ b/vars/per-machine/vega/nextcloud-secretFile/secret/secret
@@ -1,51 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:YGO7gnJ4Kk9r3nmwHrZVGo3xzWai7hz6mbfINX1PgtNxN2N3uqDouGV+dkRMPuU=,iv:9/GNabnqQQs8gO6UmrW9+7P7sc8rp3bPpgN7N/digrU=,tag:mNvppslsmvxyeWC7DYsEVA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyYUQwYzVkWkFsZTNkTWw2\neGovKzFCQWhvWUloMzRyUitqV2JHN0lqeGwwCkw4Z0V1MXI4TFU2Ly8rczgrOENa\nV29IbCtxVlF1OHBMY3lEc1Y3RXhZblUKLS0tIDdDYjRnVDB0NWVFYW50U1pjSWJQ\nNUNUYlF3RkEzUDZTaVpmT1hORXhjVGsKTWJDBVupYDRtpSM0qkFZFEb19jZxd+ro\nYoD2eEx9ZM7wXkS9jA73m027Zkczem05fM/4uqkSfdxTyNQQThm3xA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1RDRISUUvU2FScGpsQmJB\nVmI4SUZxQUZQQlZUaGNHcWNNckNTY1VMajNZCjBZN3ZKRU92RUlDUzBmcU9sTEpx\nQmN6dWxrQ1ExeGpUQ2U0TVY3YXpHcGcKLS0tIGJObGRnZ0w2dkxCRENseGFTUFpy\naVo2b0Q0OUtTRFZlRkJ1SWpjLzRrQmcKkDDpBZb8VnfyBX6EuCxBLE7bX0TwrfOd\nxSNl3AcmYmnXTYiU9cb4DM2uuHAc6aYBgTtGTrZfjIEPdmwNRaMpow==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGt4b01mT0FY\nTHRIR0pPNEphSmx5UERNY2dUZXEzTFlaWTM4MVBHc2JFM2MgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo1MkM2NHdXWHBPdXFaZjg1MnFmejho\nWFJBVGovWEZmZHB5R1FIaUU3czBNCi0tLSBYTUtwc1NlWVVINTFpRlFoemRUVS8v\nSVMzRFNUYTNQVnJjb0VGaEJwZ1dNCusi9d6xodfIqDAip0DKlSm8an8T0/LIcPRS\nZFHcUa2IxsvclY4/ktdDMlLNZK110BgGwFAew1soCilksYezFSQ=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9lUjFwS0gw\nZlQvOXh2OEw5Szc1QmhCTFBiMFhBYVZ3UWhpNzNabW5QMDQgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo0eDlWNjZBb013RFhzWDZvNWVaR1I2\nWjBhZ2dKTHdseG81ek1jdDZVcDJrCi0tLSA5TWxHWmZrcXFkSjI5WW9KYmQ2SzNC\nMFhJU0VFRXBwUFQ3RFkwejQrV1F3Crw2kCk78Ut3aBEc8zVmonTi7ThXmCiEy7vD\nEoo1qC1/LsqfxSdq7JG9mmeOc5fC4JUG15sZUgL72rPO0jgyJYw=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIERTaStPekM3\ncFJ3ekdYcEcwZER2N3R2WkhRRUttQ1BLUzEzakYySENWbmMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpNclh0OVRPSUozTkxtbjVkcE14K1Vn\nR0xXQXdKQU9ZR2JRWkgwV3l6aEtnCi0tLSBjZnpDNGV0Y2hjWG5iNktNMWIzRGFP\nMnZhUnJWcmNUWG5mcXdwQkhrTnRVCmg/9FIkhoEcHwZH9N/c3O1debqohX6g4ipd\nkH4lGCJXpGYGnGFazIVxzgyAscQrhtufL/WFZH6wBy7BohwXWbs=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByTStXZExXSUR5aU5DZmdp\nYXN3M3pKRWN5aU1RcFBYZXdnbklNVDY2VWhZCjRFVWhRU2ZzaTlYOU5iMGdjZzlK\nRUM3bEtCM0VLZG1KTXZDU21Ia3I5ak0KLS0tIG5UbmlLN0FsN201aXdFU3JzN3VU\nVjNCOHhQbWVlclZ3bzNJWWZXVVpEbmcKGCsRHk/f0j1Nfm4b/t+0NHybSpzgOvEM\nPr/uTgVdmNb00LD6JgTw6cTaPoQ2vCrmoNAKGUhfq7cwNcCw48D+Bg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTTlhNmYvRlZRWGxIQndy\nbFlETDE3UHpLemdCaFBOWUZSbVdzMjFHSlc0Cnp2VnlkY2ppdG0wZGtlU0hMTVpQ\nRUF5ZCtqRkdvTWh4Wk9rcDVvVDh6K1EKLS0tIFE1dkRocWtzRFp4dmZiZE5sV2Q2\nazN2aVJVb1V2VkZtYU1SMGxocktyNE0KSQuAC95rXYcjMgWEp06Be9smkWn76UOE\nkhKfG383zjFjR9/yikmqxU6t7LA2hTZ2/HkFE7qV2rUy1HnYe3+3OA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VVRLNDM5dmVhb2QxNmNP\ncTVETzBmMHRyREhrWUQzUFdMSSthRitCb2xZCk42N0l0Qk04SGVFNXhBamk2ek9n\nRUp6M0xGalY2aUlKTFFUdnZaNDJTTDAKLS0tIE1Qb0ZZdDdUeEhTRUNGY25DQXJa\ncnZTZDZVTHVjRmFYZzNkNG9SZER3a3cKx9sK/kyC1j+YSEWdCClLOhxMh8kK8EWE\nP/VWCKOQIRFHcust0P9hXV5WkGN7L3zUObZsg3GJ2QPBmKF7BlOgVg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoaHRpRGljZFhOMktjQVVn\nK1hoUFl1dVgrUzhERnNLMHlIamxGY1g2VkdVCnh6OUdlZUNWVExBdjBNVTFkNFRJ\nNDZ5SmRpUmVsQnRYbHRwSzJxOEIwVGsKLS0tIDM3MjRzblZ0SDV2RGVncnpoNmU1\nZkFGcVNkUUx5NlpoMCtyQ201RFdPemcKPtl7SlptzaAXxsN6hvW53iBoLoQr0/DZ\nV/qAD8Kwdcx7BBnU/H7LJOYbg6NF2W8OhsUgSRP7GAf8dC7icfOb9w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhNE83V2x2ZzNVU2xMcTF2\nS1J5TnA2MG5nL0dtTmZKQjVaY2JXZkhDNGxJCmgrM3gxbVBRQVZBK1BERDBJcFNI\naHg0QnkxbnVSU1lZbUNvVkcxNXdLdTgKLS0tIEdCa3lkd3lySVNrTktnVmNuUTZw\neGRjdEIxeFROSmYxbXJZOFQ0VnVEY1kK0AbJIHAloBCDrbqa1TDh/4Gkg7i3F7H+\nnBuMZNxJV/5ncXn7CssjMUgFe3DIxm0qmJOQHX6o8D5PsXFXjcfGFA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-25T03:07:49Z",
-		"mac": "ENC[AES256_GCM,data:qZxrDZRawvNVoq2dpkW5XXEZYwB6sh/Pik1Wd+vMYSlPE7t3HxXoBw33wTGq+yt4u5OxJrkjoOKT4/9eyhBJX+sxMYAjud/KlM1d+FEFoz6li1rboaejN4EEhyZuwWgl1gav7qlli3+C37PUMy4qdATH214a3Mwm9xAXic6QnhQ=,iv:5t0TG2cbjpwUvTnNvcXZlo2RIX1WbFvqBo2OGeoRo0Q=,tag:DOZlw26vT0BqbVQrNICkLg==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/shared/noreply-mailer/account/value
+++ b/vars/shared/noreply-mailer/account/value
@@ -1 +0,0 @@
-noreply@newedge.house
--- a/vars/shared/noreply-mailer/host/value
+++ b/vars/shared/noreply-mailer/host/value
@@ -1 +0,0 @@
-mail.b4l.co.th
--- a/vars/shared/noreply-mailer/password/groups/admins
+++ b/vars/shared/noreply-mailer/password/groups/admins
@@ -1 +0,0 @@
-../../../../../sops/groups/admins
--- a/vars/shared/noreply-mailer/password/machines/vega
+++ b/vars/shared/noreply-mailer/password/machines/vega
@@ -1 +0,0 @@
-../../../../../sops/machines/vega
--- a/vars/shared/noreply-mailer/password/secret
+++ b/vars/shared/noreply-mailer/password/secret
@@ -1,51 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:goH36diqouRwWG8QtsOeuRdznfvP,iv:PAdnJzsevmorPWSgDkOqpilxDFdXi9v9UYwlqRo3efk=,tag:fW6Syk0czolzpixzuK5Vmg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoc1lMVW5aY2pBY3BKaWRL\nRUhWaXNEV0pBdTVSQkVQU0k0c2tFMXBkRUZFCmdjMjZ0aDFhNU01clFWVm45dFFm\nem9IQVNiM3YvbFMvRVh5ME1kSDExcVEKLS0tIGlXRWp3SGVHVEVRODc3ditLMXVt\naVVobis0Ukl0UDg2aStlWHpjSVRZUEkKAMBTH5OwlsYAm7Fr+TmXDzL9fdnMyNSA\nEpOCvhSL5OuiCtfiDfS2mtO9ZofGRVpKyhGAUbRX0XN+etXTF0iAVQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArZGR0eFVoZUk3MUZVMjll\nQTNWMitKdk1Xemo1V1JnQWdsNDRwYnU4VVhJCnZpYlo0dFlxNVF5Z0g5aHRrQms2\nZ1RlY0NQOU9BNmRjU280R0lnc3U5alkKLS0tIGhjNDQ0OU5keERWaEZZcXkvTDdo\nL0pkZjlvRGI4TkUySDZCenNHWkVveDgKcwCSJR2X6wPxTtkCxcEENDCFiH9G6tiO\n37jo7fc6IRZIBmOM+58aFp08tt1FBHPN8uyCL+zS+BQbHCYoVZE7TQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHI2aGpmbDQr\nRXZlMElSSnpQc2gzNFE3dGRPNmZPRGRtdGo2SUZqRlFnbmsgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpWQ2lWdHBaK09BU1BGczU5Q3JoamJ5\nNHh5MjhBR08xSTJyRFA2U083T2NRCi0tLSB1U2VQMStSdlZiN1UxQmN5WGtXbVdV\nUWtVSkozYXVTSGFMUHoxZzVKVFlnClO8aAkX9aK4odsYA5BzTK0Rzq3u3M7MPkUv\nTE8LIsetWGdjQ5UJ2KT6BY/cKuD+hyyeLKpuu5SdxOGKjfGsvuo=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEZjOWFzUzBu\nQXp4ODZrd1RiSmpLYzJ1TldMek5LRGR6Nm1IWFJ6eTlLSHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpPNFpoK3hUZFByeXlmcS9Wai9jd29L\nN25PemtqaHhaQzBnajdvVHpkREg4Ci0tLSBRQTRUQ2VvQWtvMnA0ZWQ4aE9kcjMz\nbFFGTC92d3ZpWkloYy9BWk5TYU5vCvT4/4+FxMTXGmowMMVZCxlRTuKJL945L0Xf\n9MxWUaufHsL5oiY/9HSVvvklLDRms9L504aIQRTJwtUD6VHmo7U=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGl5TzVlWlJ0\nQmNGK2dwRkVTRWhDTlRxSXRKUlRkMTNWZHl6RW1uL2tZQ0EgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6SHptRWlTOE5jM2h1bzRjNnA2MkpJ\nTjJuRE9WQkhVdisyV2VkVmZsNDFzCi0tLSB2VENqWE5tbG44M2M0ZGo2aTlhSTJh\nM3hSQmd2TWpkdHlBMkJZVGlPc0I0CmDB6BwqQNeMOb8DZsbAtQDRMs8HFZ9/3x4F\njVn79/Wt8PQ1Q+5EtS7UAMfCOMaPUWXSY5AH0QcBwtEb0gUZYhs=\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZWRCUytYN2hoOEdCQTA4\nUEFVUG5LUVNub3RkbnNNVjhZT0FjY2NlNmpnCmxVcWxEODhTcStxbzM3QTdrYW5H\nUTdBajhIS0VvZXg1NzZlR3VJYXQyVkkKLS0tIHhVZkZlUkl3U2RsRWZyd05ob1lS\nODVLQUdsMjM5NzQ5WVJ2empXZURyQ1EKD/cHD0McDCvedGINXyobsCEpVuPibwUR\nZGKaNCX4o6XjbSAeQQo4dHqfSxu531n5NrV5sYV6y9KPyW7x7aSrGQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1pl3nej4ayvuk75cydwyz5ttzelqqdkun8hweu40vypvspzh9j4vqp9rl0j",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFRTYyMkRuc2FPa0NxYUN5\nNVpiamJPUWNTdVViTVV2Y2xjbTVHUTljMmtrCkFPWHdod3RUMERNbVp6bThFRzhG\nd0FhZTAzbTRsaGFwdzFlNnNuOHo5ZnMKLS0tIGJpV281ejFlN1NjR1hzeUhVTHZI\nN2QrWkdUakNWbWtDRWF1KzlwSDJPSHMKX+3z1BQBS9qddMCF8ZqY7/OQULijcwIH\nfURwER/yhEXHJ2vz5nYUjLyaL+SL0eIomh2do8bIzgWj9lZxq7+NAw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhWDd1M3QwSDh6Vi8zeVE5\nM0Q2RWdwOUUxRTVadm53dlhwZk9LZVJNd0FVCkZCUHZQV2x6Vjh4SDVkZCt5UXVC\naExzczZIV2NkNE5OYnB3bG1jME9lRUUKLS0tIDY2a0p3MEFKbUlPZzZhUWVVbkZx\nOXZOeTYxRW1udHM2bU5MOEx2SE1aMXcK0h+5VjtOuaN/sKvODacWSDpGbFRF1tom\n5zibCEtKU6WGCcDCde6Uvm/oOI3U6sK4qGms8YZA1MjJCPrUF8OTdQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5S25kLzRNd3g1aGV3SW5K\ndTdLWVhQRHVuNVdRcWo1NDFyMHFjMG10NnlJCmdGamtJWDVNSXJuR3UrSzZ5U1hl\naU8rLy8rK1pYc0NaY0hhSldXYnUyQ0EKLS0tIGxqT2ExNW9tVjl6ZDVzRkIybzBo\nWncrcEVuK0JvdjIvNUxnTnVjd3JNeTgK/TguCbwotQfP6rYvOBBlbScSTCZhKZqo\nY++lDjS6rGme5s7yy8oOg9YwBRdJ0aFu19Lf+B2DVW7roJhLwpdl4w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0V3NZLzJodXZFcUxjQ1dl\nZGthZ0hucWxHK09hcDhyOTBONy9oNXBWbWdJCmlvQkxNaTdPSjR6dEhvN0ttdTR2\ncWZLVHVINHQ4eThlY1BQYmpSU1Iva00KLS0tIEVtQUtmNlRoVG5KbDBialRpOG1h\nZHFSSGFHSUI2RlVWMWRvaW5IcG5IQlUK81TgYnGT5azmiG/I515jc3NS4zA/qlRJ\nBFRxjYGOgx+40yR9DZsCICZCDmrE4bg+ejg+cC80BoouVExuU2AIgA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-24T09:57:50Z",
-		"mac": "ENC[AES256_GCM,data:TIoqDAhQ+RgQ3lISLJAijbjIst3++r4aFg5wI3IgUuDbMx4OXeK6UGbEGT+SP3BoOJnQi0L85sdkbw6kq2Q7XPpScETAyYJo9jLpwa56oh57gt7QlH14CZ9IATv/1EGiyMLo/8/MtXkn1/jgk1OClxnM9RSAyoICB6uJ6YvJs10=,iv:wLMDB48RpbHsR3q8YAj6erh/ZZOeYOE+nNLsVhEuQ0U=,tag:mhahAzkcnz+EjvK8gT4uEA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/vars/shared/noreply-mailer/password/users/kurogeek
+++ b/vars/shared/noreply-mailer/password/users/kurogeek
@@ -1 +0,0 @@
-../../../../../sops/users/kurogeek
--- a/vars/shared/noreply-mailer/port/value
+++ b/vars/shared/noreply-mailer/port/value
@@ -1 +0,0 @@
-465
Author	SHA1	Message	Date
kurogeek	1573a18d5c	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/nixos/inventree/default.nix	2025-10-09 17:22:20 +07:00
kurogeek	875c1bdbdb	Update vars via generator inventree for machine rigel	2025-10-09 17:20:13 +07:00
kurogeek	7c98ff800b	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/rigel/configuration.nix	2025-10-09 16:57:33 +07:00
kurogeek	1df60c35d9	mob next [ci-skip] [ci skip] [skip ci] lastFile:vars/per-machine/rigel/inventree/secret-key/secret	2025-10-09 16:42:56 +07:00
kurogeek	04fafa32d3	update kurogeek thinkpad zerotier id	2025-10-09 16:42:23 +07:00
kurogeek	ed4e045ffc	rm unused args	2025-09-28 13:30:10 +07:00
kurogeek	fd6edd83c2	machines are accessed by zerotier ip	2025-09-28 13:21:46 +07:00
kurogeek	65faa70fa3	no nextcloud on vega	2025-09-28 12:45:29 +07:00
kurogeek	377b63437c	no write permission on GLOM samba	2025-09-26 20:26:02 +07:00
kurogeek	43e8252459	samba for vega	2025-09-26 16:46:00 +07:00