tor connection

Update vars via generator tor_tor for machine vega
Update vars via generator tor_tor for machine sirius
2025-11-28 14:55:21 +07:00 · 2025-11-28 14:54:35 +07:00 · 2025-11-28 14:54:32 +07:00 · 2025-11-28 14:54:29 +07:00 · 2025-11-28 14:54:26 +07:00 · 2025-11-28 14:54:23 +07:00
147 changed files with 4963 additions and 314 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-
+run-vm-*
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754535625,
-        "narHash": "sha256-RdT3/DskBjwx74cvHJHb/mLSO2XeSHitSYViNmYGU/k=",
+        "lastModified": 1761768376,
+        "narHash": "sha256-AZL8SPJ520NRnLft9Xz4trTECBB510YPRXJnE1OUeXw=",
        "ref": "refs/heads/main",
-        "rev": "f69e28a1333527cdbadb233966a7e19d4b35a1a3",
-        "revCount": 8886,
+        "rev": "bbc9486f0e6306f68e11f8aefa243da9f1c8c56f",
+        "revCount": 10924,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -49,11 +49,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1753067306,
-        "narHash": "sha256-jyoEbaXa8/MwVQ+PajUdT63y3gYhgD9o7snO/SLaikw=",
-        "rev": "18dfd42bdb2cfff510b8c74206005f733e38d8b9",
+        "lastModified": 1760612273,
+        "narHash": "sha256-pP/bSqUHubxAOTI7IHD5ZBQ2Qm11Nb4pXXTPv334UEM=",
+        "rev": "0099739c78be750b215cbdefafc9ba1533609393",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/18dfd42bdb2cfff510b8c74206005f733e38d8b9.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0099739c78be750b215cbdefafc9ba1533609393.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -88,11 +88,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1753140376,
-        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
+        "lastModified": 1760701190,
+        "narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
+        "rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
        "type": "github"
      },
      "original": {
@@ -136,6 +136,24 @@
        "type": "github"
      }
    },
+    "liminix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1760426231,
+        "narHash": "sha256-r8c5PKtsxAvtQ/k17GH+WNvP47Lr+AbExLMPdLtvAKE=",
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "revCount": 1574,
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
+      },
+      "original": {
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
+      }
+    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -144,11 +162,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1751313918,
-        "narHash": "sha256-HsJM3XLa43WpG+665aGEh8iS8AfEwOIQWk3Mke3e7nk=",
+        "lastModified": 1761339987,
+        "narHash": "sha256-IUaawVwItZKi64IA6kF6wQCLCzpXbk2R46dHn8sHkig=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "e04a388232d9a6ba56967ce5b53a8a6f713cdfcf",
+        "rev": "7cd9aac79ee2924a85c211d21fafd394b06a38de",
        "type": "github"
      },
      "original": {
@@ -159,11 +177,11 @@
    },
    "nix-select": {
      "locked": {
-        "lastModified": 1745005516,
-        "narHash": "sha256-IVaoOGDIvAa/8I0sdiiZuKptDldrkDWUNf/+ezIRhyc=",
-        "rev": "69d8bf596194c5c35a4e90dd02c52aa530caddf8",
+        "lastModified": 1755887746,
+        "narHash": "sha256-lzWbpHKX0WAn/jJDoCijIDss3rqYIPawe46GDaE6U3g=",
+        "rev": "92c2574c5e113281591be01e89bb9ddb31d19156",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/69d8bf596194c5c35a4e90dd02c52aa530caddf8.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/92c2574c5e113281591be01e89bb9ddb31d19156.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -172,11 +190,11 @@
    },
    "nixos-facter-modules": {
      "locked": {
-        "lastModified": 1750412875,
-        "narHash": "sha256-uP9Xxw5XcFwjX9lNoYRpybOnIIe1BHfZu5vJnnPg3Jc=",
+        "lastModified": 1761137276,
+        "narHash": "sha256-4lDjGnWRBLwqKQ4UWSUq6Mvxu9r8DSqCCydodW/Jsi8=",
        "owner": "nix-community",
        "repo": "nixos-facter-modules",
-        "rev": "14df13c84552a7d1f33c1cd18336128fbc43f920",
+        "rev": "70bcd64225d167c7af9b475c4df7b5abba5c7de8",
        "type": "github"
      },
      "original": {
@@ -187,11 +205,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1754278406,
-        "narHash": "sha256-jvIQTMN5EzoOP5RaGztpVese8a3wqy0M/h6tNzycW28=",
+        "lastModified": 1761656231,
+        "narHash": "sha256-krgZxGAIIIKFJS+UB0l8do3sYUDWJc75M72tepmVMzE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "6a489c9482ca676ce23c0bcd7f2e1795383325fa",
+        "rev": "d7f52a7a640bc54c7bb414cca603835bf8dd4b10",
        "type": "github"
      },
      "original": {
@@ -207,6 +225,7 @@
        "devshell": "devshell",
        "flake-parts": "flake-parts",
        "import-tree": "import-tree",
+        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
        "treefmt-nix": "treefmt-nix"
      }
@@ -219,11 +238,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754328224,
-        "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=",
+        "lastModified": 1760998189,
+        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4",
+        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -21,6 +21,10 @@
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    liminix = {
+      url = "git+https://git.b4l.co.th/newedge/liminix?ref=refs/heads/fix-gl-ar750&rev=3f1f7c08d440130cce9262a93ce78ed7969d93cd";
+      flake = false;
+    };
  };
  outputs =
    {
@@ -38,8 +42,10 @@
          ./shell.nix

          ./machines
+          ./routers
          ./inventories
          ./modules/clan/flake-module.nix
+          ./modules/nixos/flake-module.nix
        ];
      }
    );
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,22 +1,15 @@
-{
-  inputs,
-  self,
-  lib,
-  pkgs,
-  ...
-}:
 {
  clan = {
    inventory = {

-      machines = {
-        rigel.deploy.targetHost = "root@rigel.local";
-        vega.deploy.targetHost = "root@vega.local";
-      };
-
      tags = {
-        glom = [ "vega" ];
+        glom = [
+          "vega"
+          "ramus"
+        ];
        b4l = [ "rigel" ];
+        w = [ "sirius" ];
+        fax-bridge = [ ];
      };

      instances = {
@@ -42,6 +35,28 @@
          };
        };

+        tor = {
+          module = {
+            name = "tor";
+            input = "clan-core";
+          };
+          roles.server.tags."nixos" = { };
+        };
+
+        w-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."sirius" = {
+            settings.allowedIps = [
+              #kurogeek
+              "fdfe:7bf:a795:4524:4c99:932b:d36d:b8cc"
+            ];
+          };
+          roles.peer.tags.w = { };
+        };
+
        glom-network = {
          module = {
            name = "zerotier";
@@ -60,6 +75,21 @@
          roles.peer.tags.b4l = { };
        };

+        yggdrasil = {
+          module = {
+            name = "yggdrasil";
+            input = "self";
+          };
+          roles.default.tags."fax-bridge" = { };
+        };
+
+        asterisk = {
+          module = {
+            name = "asterisk";
+            input = "self";
+          };
+        };
+
        pocket-id = {
          module = {
            name = "pocket-id";
@@ -73,7 +103,6 @@
            input = "self";
          };
          roles.default.machines.b4l = { };
-          roles.default.machines.vega = { };
        };
        stirling-pdf = {
          module = {
--- a/inventory.json
+++ b/inventory.json
@@ -1 +1,7 @@
-{}
+{
+  "machines": {
+    "ramus": {
+      "installedAt": 1764139649
+    }
+  }
+}
--- a/machines/ramus/configuration.nix
+++ b/machines/ramus/configuration.nix
@@ -0,0 +1,15 @@
+{ config, ... }:
+{
+  system.stateVersion = "25.11";
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.meta.name = "ramus";
+  clan.meta.description = ''
+    A Hetzner VPS machine own by Alex.
+  '';
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+}
--- a/machines/ramus/disko.nix
+++ b/machines/ramus/disko.nix
@@ -0,0 +1,84 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_107266387";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/ramus/facter.json
+++ b/machines/ramus/facter.json
--- a/machines/rigel/configuration.nix
+++ b/machines/rigel/configuration.nix
@@ -1,13 +1,16 @@
+{ config, ... }:
 {
  imports = [
    (import ../../lib/auto-accept-zerotier-members.nix {
      memberIds = [
        "dbe44c0287" # Alex-gateway
-        "1b495eede9" # kurogeek-thinkpad
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
      ];
    })
  ];

  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
 }
--- a/machines/sirius/configuration.nix
+++ b/machines/sirius/configuration.nix
@@ -0,0 +1,25 @@
+{
+  inputs,
+  config,
+  self,
+  ...
+}:
+{
+  imports = [
+    self.nixosModules.common
+
+    (inputs.import-tree ./services)
+
+  ];
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
+  system.stateVersion = "25.11";
+
+}
--- a/machines/sirius/disko.nix
+++ b/machines/sirius/disko.nix
@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-FIXME";
+  vdev = [
+    "/dev/disk/by-id/ata-FIXME"
+    "/dev/disk/by-id/ata-FIXME"
+  ];
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/sirius/services/samba.nix
+++ b/machines/sirius/services/samba.nix
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    WhiteHouse.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "WhiteHouse NAS";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}
--- a/machines/vega/configuration.nix
+++ b/machines/vega/configuration.nix
@@ -1,22 +1,26 @@
 {
  inputs,
  config,
-  pkgs,
+  self,
  ...
 }:
 {
  imports = [
+    self.nixosModules.common
+
    (inputs.import-tree ./services)

    (import ../../lib/auto-accept-zerotier-members.nix {
      memberIds = [
        "dbe44c0287" # Alex-gateway
-        "1b495eede9" # kurogeek-thinkpad
+        "b0e0b84fd3" # Alex
+        "2bd36db8cc" # kurogeek-thinkpad
      ];
    })
  ];

  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";

  nixpkgs.hostPlatform = {
    system = "x86_64-linux";
--- a/machines/vega/services/nextcloud.nix
+++ b/machines/vega/services/nextcloud.nix
@@ -1,92 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  # ncDomain = "${config.clan.core.vars.generators.vega-nextcloud.files.subdomain.value}.${config.networking.fqdn}";
-  ncDomain = "${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators.vega-nextcloud = {
-    files.subdomain.secret = false;
-
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Nextcloud app. Default:(cloud)";
-      };
-    };
-
-    script = ''cat $prompts/subdomain || echo -n "cloud" > $out/subdomain'';
-  };
-
-  clan.core.vars.generators.noreply-mailer = {
-    share = true;
-
-    files.host.secret = false;
-    files.port.secret = false;
-    files.account.secret = false;
-    files.password.secret = true;
-
-    script = ''
-      echo "mail.b4l.co.th" > $out/host
-      echo "587" > $out/port
-      echo "noreply@newedge.house" > $out/account
-      echo "" > $out/password
-    '';
-  };
-
-  clan.core.vars.generators.nextcloud-secretFile = {
-    dependencies = [ "noreply-mailer" ];
-    files = {
-      secret = {
-        owner = "nextcloud";
-        group = "nextcloud";
-        secret = true;
-      };
-    };
-    script = ''
-      echo { \"mail_smtppassword\": \"$(cat $in/noreply-mailer/password)\" } > $out/secret
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  services.nextcloud = {
-    hostName = ncDomain;
-    package = pkgs.nextcloud31;
-    secretFile = config.clan.core.vars.generators.nextcloud-secretFile.files.secret.path;
-    # settings =
-    #   let
-    #     address = lib.splitString "@" config.clan.core.vars.generators.noreply-mailer.files.account.value;
-    #   in
-    #   {
-    #     mail_smtpmode = "smtp";
-    #     mail_smtpauth = 1;
-    #     # mail_sendmailmode = "smtp";
-    #     mail_smtpsecure = "ssl";
-    #     mail_from_address = builtins.elemAt address 0;
-    #     mail_domain = builtins.elemAt address 1;
-    #     mail_smtphost = config.clan.core.vars.generators.noreply-mailer.files.host.value;
-    #     mail_smtpport = config.clan.core.vars.generators.noreply-mailer.files.port.value;
-    #     mail_smtpname = config.clan.core.vars.generators.noreply-mailer.files.account.value;
-    #     mail_smtpauthtype = "LOGIN";
-    #
-    #     mail_smtpstreamoptions.ssl = {
-    #       allow_self_signed = true;
-    #       verify_peer = false;
-    #       verify_peer_name = false;
-    #     };
-    #   };
-  };
-  # services.nginx.virtualHosts."${ncDomain}" = {
-  #   # useACMEHost = "${config.networking.fqdn}";
-  #   # forceSSL = true;
-  # };
-}
--- a/machines/vega/services/samba.nix
+++ b/machines/vega/services/samba.nix
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    GLOM.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "Glom Vega";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}
--- a/modules/clan/actual-budget/flake-module.nix
+++ b/modules/clan/actual-budget/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.actual-budget = {
+      clan.nixosTests.service-actual-budget = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/actual-budget" = module;
--- a/modules/clan/asterisk/default.nix
+++ b/modules/clan/asterisk/default.nix
@@ -0,0 +1,69 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "asterisk";
+  manifest.description = "Asterisk PBX server";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        ...
+      }:
+      {
+        services.asterisk = {
+          enable = lib.mkDefault true;
+          confFiles = {
+            # Dial plan config
+            "extensions.conf" = ''
+              exten => 1001,1,Dial(PJSIP/user1,20)
+              exten => 1002,1,Dial(PJSIP/user2,20)
+
+              exten => 100,1,Answer()
+              same  =>     n,Wait(1)
+              same  =>     n,Playback(hello-world)
+              same  =>     n,Hangup()
+            '';
+
+            "pjsip.conf" = ''
+              [transport-udp]
+              type=transport
+              protocol=udp
+              bind=0.0.0.0,[::]
+
+              [endpoint_internal](!)
+              type=endpoint
+              context=from-internal
+              disallow=all
+              allow=ulaw
+
+              [auth_userpass](!)
+              type=auth
+              auth_type=userpass
+
+              [aor_dynamic](!)
+              type=aor
+              max_contacts=1
+
+              [user1](endpoint_internal)
+              auth=user1
+              aors=user1
+              [user1](auth_userpass)
+              password=user1
+              username=user1
+              [user1](aor_dynamic)
+
+              [user2](endpoint_internal)
+              auth=user2
+              aors=user2
+              [user2](auth_userpass)
+              password=user2
+              username=user2
+              [user2](aor_dynamic)
+            '';
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/asterisk/flake-module.nix
+++ b/modules/clan/asterisk/flake-module.nix
@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    asterisk = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.asterisk = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/asterisk" = module;
+      };
+    };
+}
--- a/modules/clan/asterisk/tests/vm/default.nix
+++ b/modules/clan/asterisk/tests/vm/default.nix
@@ -0,0 +1,39 @@
+{
+  pkgs,
+  ...
+}:
+{
+  name = "service-asterisk";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        asterisk-test = {
+          module.name = "@clan/asterisk";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.asterisk = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("asterisk")
+
+    # Check that garage is running
+    server.succeed("systemctl status asterisk")
+
+  '';
+}
--- a/modules/clan/flake-module.nix
+++ b/modules/clan/flake-module.nix
@@ -1,4 +1,7 @@
-{ inputs, lib, ... }:
+{
+  inputs,
+  ...
+}:
 {
  imports =
    let
@@ -16,12 +19,7 @@

      # Create import paths for each valid directory
      imports = (map (name: ./. + "/${name}/flake-module.nix") validModuleDirs) ++ [
-        (import (inputs.clan-core + "/lib/flake-parts/clan-nixos-test.nix") {
-          inherit lib;
-          flake-parts-lib = inputs.flake-parts.lib;
-          self = inputs.clan-core;
-          inputs = inputs.clan-core.clan.self.inputs;
-        })
+        inputs.clan-core.flakeModules.testModule
      ];
    in
    imports;
--- a/modules/clan/grafana/flake-module.nix
+++ b/modules/clan/grafana/flake-module.nix
@@ -9,7 +9,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.grafana = {
+      clan.nixosTests.service-grafana = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/grafana" = module;
--- a/modules/clan/nextcloud/flake-module.nix
+++ b/modules/clan/nextcloud/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.nextcloud = {
+      clan.nixosTests.service-nextcloud = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/nextcloud" = module;
--- a/modules/clan/paperless/flake-module.nix
+++ b/modules/clan/paperless/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.paperless = {
+      clan.nixosTests.service-paperless = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/paperless" = module;
--- a/modules/clan/pingvin/flake-module.nix
+++ b/modules/clan/pingvin/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.pingvin = {
+      clan.nixosTests.service-pingvin = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/pingvin" = module;
--- a/modules/clan/pocket-id/flake-module.nix
+++ b/modules/clan/pocket-id/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.pocket-id = {
+      clan.nixosTests.service-pocket-id = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/pocket-id" = module;
--- a/modules/clan/stirling-pdf/flake-module.nix
+++ b/modules/clan/stirling-pdf/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.stirling-pdf = {
+      clan.nixosTests.service-stirling-pdf = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/stirling-pdf" = module;
--- a/modules/clan/victoriametrics/flake-module.nix
+++ b/modules/clan/victoriametrics/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.victoriametrics = {
+      clan.nixosTests.service-victoriametrics = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/victoriametrics" = module;
--- a/modules/clan/vikunja/flake-module.nix
+++ b/modules/clan/vikunja/flake-module.nix
@@ -9,7 +9,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.vikunja = {
+      clan.nixosTests.service-vikunja = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/vikunja" = module;
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -0,0 +1,53 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "yggdrasil";
+  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        pkgs,
+        ...
+      }:
+      {
+        clan.core.vars.generators.yggdrasil = {
+          files = {
+            yggdrasil-secret = {
+              secret = true;
+            };
+            yggdrasil-ip = {
+              secret = false;
+            };
+            yggdrasil-subnet.secret = false;
+          };
+          runtimeInputs = with pkgs; [
+            yggdrasil
+            jq
+          ];
+          script = ''
+            yggdrasil -genconf -json | jq {PrivateKey} > $out/yggdrasil-secret
+            cat $out/yggdrasil-secret | yggdrasil -useconf -address | tr -d "\n" > $out/yggdrasil-ip
+            yggdrasil -useconffile $out/yggdrasil-secret -subnet | tr -d "\n" > $out/yggdrasil-subnet
+          '';
+        };
+
+        services.yggdrasil = {
+          enable = lib.mkDefault true;
+          configFile = config.clan.core.vars.generators.yggdrasil.files.yggdrasil-secret.path;
+          settings = {
+            Peers = [
+              # US Peers
+              "tls://ygg.jjolly.dev:3443"
+              "tls://[2602:fc24:18:7a42::1]:993"
+              "tcp://leo.node.3dt.net:9002"
+              "tcp://ygg-kcmo.incognet.io:8883"
+            ];
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/yggdrasil/flake-module.nix
+++ b/modules/clan/yggdrasil/flake-module.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  inputs,
+  self,
+  ...
+}:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    yggdrasil = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      # clan.nixosTests.service-yggdrasil = {
+      #   imports = [ ./tests/vm/default.nix ];
+      #
+      #   clan.modules."@clan/yggdrasil" = module;
+      # };
+    };
+}
--- a/modules/clan/yggdrasil/tests/vm/default.nix
+++ b/modules/clan/yggdrasil/tests/vm/default.nix
@@ -0,0 +1,37 @@
+{
+  ...
+}:
+{
+  name = "service-yggdrasil";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        yggdrasil-test = {
+          module.name = "@clan/yggdrasil";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.yggdrasil = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("yggdrasil")
+
+    # Check that garage is running
+    server.succeed("systemctl status yggdrasil")
+  '';
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+    "type": "age"
+  }
+]
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:pGMobS67sLp2GN2Xw7A/trcLYnQdVZCUbjtlwS/AShXxyXgHXzkqRee6R765GZyCpDwM8A1IuMZYctrqWxVXrpIAiJpwvwy7vDM=,iv:ysRf5xAXN+dFSx+sFHNDt1GcVQx7RLej4c12v60iSI0=,tag:yXYpWhWLdsz9BOOoKpZU4g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UmhPdzcrSnFhVUxRNDBL\ncXlGRzdMdWxCWmFlUkE4RnJRQ3psMlBqV0Q0CkRjTXFoQitQbjRhMlVjaDc3UDN1\nR1hBeXlCeWxvdnZoVWI1ZkcweHF5VncKLS0tIHE4YVFhYTZTNko1MnJINjFPYXh4\ndlJJZThGZ0JIaDJWRTNXbXk3alNZTnMKgd+0535zoTu6xW2778uNReu4Z7LStN6d\n1O9SXAB+s1iOZ3xGEICiQTVF/6p8RE6lheV2oXgoMiXXrFNH6INLsw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:34Z",
+		"mac": "ENC[AES256_GCM,data:YIpKJlOI6ASgOYqv9ipu+T3c+PlM5HwvdFVH8gh8hVeSbmxD1baPPmVSWlLv+u61Q1/C9PK4mczaASopaGiLoswep+Hc1Gn7sSeP9wO6Djx6fEIEyE1VUhUbTqi/nHYiB21yB/wegfpqzNYIn1nO0oFCmDmSS5qIowcT1fhYIjM=,iv:lzxll5oC7poLvC/hZPexUGAcAdf67xZGRXUpj6O3p6Y=,tag:9xu17Y5MtW5XNzGBsWwA3g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+204:5ce7:aa27:579b:ec90:6907:4ddc:177
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:I6yalWQ2u5hI84lJTUmh07JxUBp4EZukJrSGSN7wsGiUGlFa1v/RT1XkTiXuRjDtUVYCLmQmfSCAp/OqFscxF8KL+s24iTDrG4e3S6AeKLa3oZrNJIt1EJ06gWrPNoh1ttmwXSd4Y4Bsk4Lg8vIjH4qw3Bx+KrufxYTqe+anfMdoXKnW8wOWud5O7HMvCh+sf4dNcf6PIQ==,iv:SF5qExXNPyif+LIcNhHP0PKELUBXaFsPj9B3wvUkEp0=,tag:QEkZXDrIdcpNiZ6l2ljOPw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENDhrWVRuYjRnZktROU4v\nSHNtODFGMWl0NDRHazIwcWl0WGtNY2dYMXhnCmZQQ0doS3BTaU5hRHVsVTB5THl1\nWUNDQUNiMVJFeFZnQ1ptYmFQdTJQc28KLS0tIEtJdUQ5Y1VqSThkSVVNcVNVNEFr\nMzBCRjM1L1V5TngrZG5rR0VHY3Z6TDAKPQ6P96upDeh8xwQDrX4Zcf71Dah5zkOJ\n/F5eODEBadzQSRmJuyp3+uRMFf47eR6Q5bVah3NsVxFquXOL3CtNlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHb0EwT2tuMVE5SE5XaWdQ\ncGR0bFFhOUQvM2dGUzdlUEFFbzRnTHBWWUVnCjFGTXcrWW1vR0x5dXBUamtkS0dF\neG9weUVwQzhhNHhPRUdqV1VnWXJyNFEKLS0tIC80b1ZqRGFOenpENDN1Vk5vRUhY\nVnJzZ1Q5VzZ6ZEZtZE13YjQ0VVhrTTAK5y0BjKBRg2AXuO416JWLMLyM/pCQChKn\nVKZMXcT6cc5hHDuqbp9qUofknF68XnzlH6nOyLB1ZtnELyeZuf29fw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:35Z",
+		"mac": "ENC[AES256_GCM,data:Y3k83RaeX64LA3rsIkQxyKw+LLUgXVsqr3F2UHkv9h73gkyChc6k1oE/FLR4CsZZWsfLNjCkPMuenqToA2mKqQK0aADwPDYo0aVm0hr1PGX5j3Py6EmP56NFvxlAQsExRWo32eqdkeCkY23hfcmUYlaB+bo/fsrRVj67zag9GYA=,iv:p18i8cV6jKXpuZ1Xd7KYCl8BMe1/8CW9YnCuVrTAqy0=,tag:IJnLzdZOn8Clu+lCKT6zvA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/modules/nixos/common.nix
+++ b/modules/nixos/common.nix
@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    screen
+    ncdu
+    vim
+    lshw
+    pciutils
+  ];
+}
--- a/modules/nixos/flake-module.nix
+++ b/modules/nixos/flake-module.nix
@@ -0,0 +1,7 @@
+{
+  flake.nixosModules = {
+    common = {
+      imports = [ ./common.nix ];
+    };
+  };
+}
--- a/routers/default.nix
+++ b/routers/default.nix
@@ -0,0 +1,9 @@
+{ inputs, ... }:
+{
+  flake.legacyPackages = {
+    whitehouse-router = import "${inputs.liminix}/default.nix" {
+      device = (import "${inputs.liminix}/devices/gl-ar750");
+      liminix-config = import ./white-house/configuration.nix { inherit inputs; };
+    };
+  };
+}
--- a/routers/white-house/configuration.nix
+++ b/routers/white-house/configuration.nix
@@ -0,0 +1,162 @@
+{ inputs }:
+{
+  config,
+  pkgs,
+  modulesPath,
+  lib,
+  ...
+}:
+let
+  secrets = {
+    firewallRules = { };
+  }
+  // (import ./secrets.nix);
+  wirelessConfig = {
+    country_code = "TH";
+    inherit (secrets) wpa_passphrase;
+    wmm_enabled = 1;
+  };
+  svc = config.system.service;
+in
+{
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/vlan"
+    "${inputs.liminix}/modules/ssh"
+    "${inputs.liminix}/modules/bridge"
+    "${inputs.liminix}/modules/health-check"
+    "${modulesPath}/profiles/gateway.nix"
+  ];
+
+  hostname = "whitehouse";
+  boot = {
+    tftp = {
+      freeSpaceBytes = 3 * 1024 * 1024;
+      serverip = "${secrets.lan.prefix}.148";
+      ipaddr = "${secrets.lan.prefix}.251";
+    };
+  };
+
+  services.sshd = svc.ssh.build {
+    authorizedKeys.root = secrets.root.openssh.authorizedKeys.keys;
+  };
+
+  users.root = secrets.root;
+
+  services.resolvconf = lib.mkForce (
+    pkgs.liminix.services.oneshot rec {
+      name = "resolvconf";
+      up = ''
+        ( in_outputs ${name}
+         echo "nameserver 208.67.222.222" >> resolv.conf
+         echo "nameserver 208.67.220.220" >> resolv.conf
+         echo "nameserver 1.1.1.1" >> resolv.conf
+         echo "nameserver 1.0.0.1" >> resolv.conf
+         echo "nameserver 8.8.8.8" >> resolv.conf
+         chmod 0444 resolv.conf
+        )
+      '';
+    }
+  );
+
+  services.reAddDefaultroute =
+    let
+      threshold = 3;
+      healthCheck = pkgs.writeAshScript "ping-check" { } "ping 1.1.1.1";
+    in
+    pkgs.liminix.services.longrun rec {
+      # dependencies = [ config.services.wan ];
+      name = "hack-default-route";
+      run = ''
+        fails=0
+        while sleep 10 ; do
+          ${healthCheck}
+          if test $? -gt 0; then
+            fails=$(expr $fails + 1)
+          else
+            fails=0
+          fi
+          echo fails $fails/${toString threshold} for ${name}
+          if test "$fails" -gt "${toString threshold}" ; then
+            echo [+] adding default route
+            ${config.services.defaultroute4}/${config.services.defaultroute4.name}/up
+            ${config.services.defaultroute6}/${config.services.defaultroute6.name}/up
+            echo bounced
+            fails=0
+          fi
+        done
+      '';
+    };
+
+  profile.gateway = {
+    lan = {
+      interfaces = with config.hardware.networkInterfaces; [
+        wlan
+        wlan5
+        lan
+      ];
+      inherit (secrets.lan) prefix;
+      address = {
+        family = "inet";
+        address = "${secrets.lan.prefix}.1";
+        prefixLength = 24;
+      };
+      dhcp = {
+        start = 10;
+        end = 240;
+        hosts = { };
+        localDomain = "lan";
+      };
+    };
+    wan =
+      let
+        inherit (config.system.service) vlan;
+        wan-vlan = vlan.build {
+          ifname = "wan-vlan";
+          primary = config.hardware.networkInterfaces.wan;
+          vid = "10";
+        };
+      in
+      {
+        interface = svc.pppoe.build {
+          interface = wan-vlan;
+          username = secrets.l2tp.name;
+          password = secrets.l2tp.password;
+        };
+
+        dhcp6.enable = true;
+      };
+    firewall = {
+      enable = true;
+      rules = secrets.firewallRules;
+    };
+    wireless.networks = {
+
+      "${secrets.ssid}" = {
+        interface = config.hardware.networkInterfaces.wlan;
+        hw_mode = "g";
+        channel = "2";
+        ieee80211n = 1;
+      }
+      // wirelessConfig;
+      "${secrets.ssid}-5" = rec {
+        interface = config.hardware.networkInterfaces.wlan5;
+        hw_mode = "a";
+        channel = 36;
+        ht_capab = "[HT40+]";
+        vht_oper_chwidth = 1;
+        vht_oper_centr_freq_seg0_idx = channel + 6;
+        ieee80211n = 1;
+        ieee80211ac = 1;
+      }
+      // wirelessConfig;
+    };
+  };
+  defaultProfile.packages = with pkgs; [
+    busybox
+    iw
+    nftables
+  ];
+
+}
--- a/routers/white-house/secrets.nix
+++ b/routers/white-house/secrets.nix
@@ -0,0 +1,20 @@
+{
+  wpa_passphrase = "";
+  ssid = "WhiteHouse";
+  l2tp = {
+    name = "";
+    password = "";
+  };
+  root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387"
+    ];
+  };
+
+  lan = {
+    prefix = "192.168.1";
+  };
+}
--- a/shell.nix
+++ b/shell.nix
@@ -10,7 +10,6 @@
        devshell = {
          packages = [
            inputs.clan-core.packages.${system}.clan-cli
-            inputs.clan-core.packages.${system}.generate-test-vars
          ];
        };
      };
--- a/sops/machines/ramus/key.json
+++ b/sops/machines/ramus/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+    "type": "age"
+  }
+]
--- a/sops/machines/sirius/key.json
+++ b/sops/machines/sirius/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age16aerzyy7adcymezr4ewql3y7chq8wuvjpzsxm5um0u9jvvtdncnqmtsw05",
+    "type": "age"
+  }
+]
--- a/sops/secrets/ramus-age.key/groups/admins
+++ b/sops/secrets/ramus-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/ramus-age.key/secret
+++ b/sops/secrets/ramus-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:lc5PP4xpLq/JXq2LkG/5zkEY5luxKC7EZHx0s6exiwd+UtuGb5rjIOq0kUBFuJWYFWduqcvNS62kR76oQpRfmjIkq2t02NxZ1lA=,iv:eZsHK9u5Rvt886Elz7Vm+PMD8urm1UyoNbNNwnlJtj8=,tag:inCrDdsNmLb+L+LpF9k4Ag==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0STRlY1h1NTVUdDJRM1NO\nc1hacUg4TUtlK3Y0dVZqaE5LdUlqMkFKNmtVCllTYXFHdXM0NVdUejhHZWM1TnVx\nUURvd1JrQmR2K0N3RlZIS2d0RFhTRUEKLS0tIFp1ZlJSNmd2V3dpN05LYWh1VHNC\nbFNkdkY1aUhTZmM1R1FKUWlGWThSdE0KYxgpuknCD07awfN85PkaJjPohYyqT1wL\nbjUcGo6TmFQKIgEzTzNj+in1dm9wz0AnYl1teiHa9WjK/Udd2BANBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCd2Z1aTFYenowSnczWk05\nVEZ3d0FUNFNkV3RlWlpFWk5jd3QwazVES0ZVClVjY0Y2eW1hSGEraVVpSjdoaHMr\naS9lWFUvbFl6Nzd4U2l6dUhXRHBlT0kKLS0tIFNCYTlSL1VnNURBQUxoYVozODZw\nVVRkVGVINTV6SXExN3dCT1JmRmNFdlkK+jNS9cUz4TzBBzrtxuYcoiEmxKcRNTlt\nqksdFqnPWzKI+edJSWq3rkBYeuI7c4wmxTtsgVtHbv2jwbD1kJar1g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGNxVDh0SWNL\nOUt4TG93eGVjaUxzczhnVjNYRlB1Vy9haWxjYnN6aGI3ejQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpxSEtwcUxGcVY3RzNjR2REYmdrRWV6\nYWJyTjhXMVNtVFVpczRDc2dDaHRBCi0tLSA3NUVyR3YvMnVsd0l0TXIxQS9odUZO\nZnJWV0MvRlpwU3luNm9FOGtDNkhzCm/yGJJvQf5qvBRyGLrmCeiI31qHr+JoZ2Av\nbqMUeg3Vv82ffTLT6GX+JjiG0wQFcYAX3/k0noVN9JMR/boiWIc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGpMZ3JmMVFy\nU3AzeEFFa3B2TGxSL1NlQjhSa28waGtLQUlFTkp4N0hVeEEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYVDJSdCtnVHIzVXhSQ0lXRzE5dlJo\nS1NHa2F1WEpJK2xJQUQwa0RNNCs4Ci0tLSBBdmpiZGVSOWJwanRiUjUxT3JMT0VT\nM2k5bE0zOW5SVWg2ZGw0QUVvcWVrCrc2TjHS6Pp38MTPU9H59q2seVYlESH80V4+\ny1/qjB6fK8lnnyi5TLrSo+M9MAcG5T4EGvCcAPuzjTvF/DO7hxk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9jZllPWWhO\nV3pDa1MxSzF2ejRJMXJBWDlNMzZqcG1JdVB2Y0xjMlJKeGsgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpwSUdWWlFFbW55aXVkZ0pSeUVPRkF2\nTm5tTnkrTGNmcEdoWE1UckwvcXFBCi0tLSBnN1J1VlQvVnRXbkEvOWtLbHhzVzNN\nU01XVkpRNnd4bCtYb3poNjR4bno4CirmDl+6Kebk0jMjgRp00d8kpkzGtQFsZNht\nm5MPBM+FXVzpDcEWQGUlLr50yDKYVzHdIeeuGsWZ3KaI1GM8pdg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOEQrR1Z1K3RETGgzVi9H\nNXIzUW04UHFCMk5vQVZEN0taRWJwV040Q3h3CmpaVWV0WDZNemFSTHF1TTF4YXI3\nL1loMnA5OUNCbE55aGUyR2EwbklaczQKLS0tIEpnTkkzNStsNmdNS01HWDhXY2s1\nZ3hMNXA1dXUxVmxucTdtbWN4akQ2MTgKAolaT+61/BN/yzljENx7YZTrFRGA8zwN\nsquQs9vnFS8yduVMoaemXrCLTpiQ1KGCAWVX8pPtY8+GV9YKLZsV7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtTlNuQXN3VU9TVTlQd01N\nYVBpN1BxcjRLYWN5SUg3TlhUbHl0UzkrOWcwClZ5OHpOcGp6V2craFBkWCtwcktp\nWDZYYWR4ZjVhaVNPdEN4WmZ0UlJqR3cKLS0tIEx2WXdQL0x1Zm5rRnJGMmJQWFVW\nNW1nMFlac2lyY1ZuOW9OZmNWSjJxbTAK72xqJBlpV3UWAFhGlUjudEILQSnGDhQm\nS4U51sUc8rrUZLlmAivWg1nxCUAdrhLo/r9OuITR6QX9DeFsaeR9uA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6WmVUUDJ0V2sxS0Q1UFZv\nWldFK0tRSlViUkc5aXFTV0JDdDFVbVVXR1QwClUwLzg0eTAvbUtaTVRFV3ptZkJQ\naDR1REl6MXZ2cDlsZzk1SVI1N3pocGcKLS0tIFlUbGFPUXAxWVBvNXhjZ2QzWGNh\nWTkrMklIQnl2T3ZYL0Q1c3JOTU85bkUKL4h+PDQSnVbls8iuioUHTBVpVh5Yhhx5\nrK9ELFCYGPAVzbx5cFoOapnIJcTQUAPZdBpmlm7kgRmMLXptMdGkGg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZ3lPeVJyZUF3cVEvWnhH\nbVBwRmxaQUhaaExQSVRyeVJNZVFSRkFrU25NCkZDcklIcU5TQWplQkE1ZkFTUXB5\nLzZ0VFlEdks3OWpGM0JMSi9ZOVNndnMKLS0tIG11UFZkdWRYdHZJNk9TSDYvaHcw\nQUk1dGxIOFhwaXJZaEZNdVppWWlpdUUKQJ/UjgWIaeKa4o2El4cFkwv+O0bi9SOp\n13XExCNLB+BtwOGPREWbrmW/Z15c8koBEyrW7iuIhu0Pgz95oAF2Sw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:15Z",
+		"mac": "ENC[AES256_GCM,data:ovjPl0pJ6DSJGjGz+Zt5GLbwu3ZTMwOKNSsYxIx1NcjWAiGYpPNFcFrD5OBciVQ2K7VxlRoWW5WqbJt7mrvQXDO69LxvQqiK1+qHeFJOHRd6Sp29fRA1aqEz+kOif0SSzaEkHOXAp1kzk31CnEfIG2j5yQ3oMyrSqNnhnVrx6F4=,iv:NdeCrqNo5SV1Npu8aqPJcZDhPMGfUviyBQi2CUjYZOM=,tag:yM6P7P2vLUMs9GdT284Gvg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/ramus-age.key/users/kurogeek
+++ b/sops/secrets/ramus-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/secrets/sirius-age.key/groups/admins
+++ b/sops/secrets/sirius-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/sirius-age.key/secret
+++ b/sops/secrets/sirius-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:nb/jvXhD1eQqAWDgmfLlLvuzNbftonrkwrpGNBvbxTKIy0nhB84o03LIgBZbtCDR2q0MkyKe4w4FzY9WvCJCteCoGsuOSkBa86o=,iv:+mBkcXbZxglL2NfzSWUROZacNuvIZfMFmJec82zhf7U=,tag:gtjTQ4CztEqDUbCxEpo7fw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIMW9qRGl4N1NVTlRubmR1\nUXRlQ2NqR1NZaEhGanF2Vk9uZWQvcG5qMTJFCm14ZDFxRWJpakNHTmxsTXBiN1JI\na1FiOU9rR1Vrb3NzbURQcTJVb1h4YU0KLS0tIEV0OS9vQlhsMVMwUmJHcXZITDYw\nUzZWbG1iTzk3LzB6V1Z4YzFYOWpkT0EKiQINdNMEuGIIzY50seuRcwb2s3TdgELP\nYkIJ5GBseK3Q3nVvIyNhuU0bCaVSFnxuTazeygMAKjhW22y2/ui4Wg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONU9hUkRIT3Q0TnNGcC9v\nTVM5YWtyMjYvL29ZTDFqRzlYU2FUTXkvUjBvClNXdk93K2t0L0wvdDgvT2lTTTVX\nRDUwYkc3aGwvT2xFcmZlNXRtdFdZOUEKLS0tIGIwc3FpRXdNQlpQTnhVM1M4YS91\nZXYyL08wa3EvWlB1MDdWVWVORUIyTFEKP2w2cG4d/AE7XrbcscaEIVJ6XQG9FXHY\nNKgBjpGZONp8dEYeuJ23nel5AO3+sm0EN/DsuqoWo2dJCHp4ZXkl7Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFV0S2pYYTFi\nc0IyVXZwMUliQWVwdjZnQmNwSjJTd0dRMisxVmsyM0ZpV2cgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpaeW1RNzhmbjNkNFFZN2FqRnRZc2tS\nZWRlQ0hPZlBsLy9ocFFFY2tiYmtBCi0tLSBFQVNQRzhQblJXSmQyUUYxOEw3UjNV\ncG41b3h0MjhaYXU4SlpQZE5YLy9zCmKxo/IAczzcmAnYhYh29gS88lQEVgoNWMGt\noqldqIgarW2yKSqlbnJYRg60yohiYNn34aHKlNVNPhm7NhfZ6y8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRVZmluZ0JN\ndnRvSFZZeWR1aytjT3oveUdZTTRDZnhOaG51Ym1QditvVTAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpGNi9YaDJWR25rYm1YSnF1bXp1enRU\nQWMvaGlwSEY1L0FLeGN5MjdzS2RJCi0tLSBEOStqZzVZTmQyR3dOZWpoazcwaXFo\nU1RCU29LRHNUaVl6dWd0YTlFaVNJCn7iNwdtKkrQC3e8JzWP1vrt1uMtaYI1FmZC\n/Tug0VKBcShMjmi0MaM2jA6Bo2rHmxQPZTVa4x4myjB1ZwehmQk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGwxK0E2K1Zu\nZHo4ZlQwejVoaXRWUEZ0MGxteURmcGIzdjZjNVFsZVFQMDAgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo5MG02bWxaSmttREozSTNKODk4ZDhS\nZGxtcXhmQnV3YlgybG1MUVRUSUUwCi0tLSBQdUloWE8yMFpQN0NTYWg5cWQ1UzRZ\nYi9VYklCNGlTb2JIUUxPaXJZWGxRCi64TvD9BnC41+HbBI1lIqG8uAr8UnDMvuUy\nEHPAIcvPWbO2WahxEUcL4hBcK81pa3XaQOWo/qRbAHv5fKIA26w=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2b09RdU5jcGRBRHBJREhy\nOU04MTVwZm5TNVUrVmNTUkVtUUJFWGd2aGpRCnBYQ1Y2SnJBbHhaNHJxOFVHM0dC\nZzMyUndHM1M4bTFsOStna3JXM1lVaVEKLS0tIFdnNG9WdzB6cUoxdmV2aTBhVDIr\naDRFQ3JsWlUvNTRRdHNpWVkyb0xWYWMKXSnCes/5K8Qw1WHbxPhL63G+yKtwxnhn\n9fXqnemlQJoscBy1mrpxXYXM6mFl4tnEAh1hB00z+n1AFZS91EwRxg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSGRHbHhyVGE0NEFLbFpn\nM2E3WndLT1oxSVZnOHRiNzVMaFlpL3VhY1ZRCkhyTFdqQk1LM05HZFQrOFd4Y08y\neVgvUk1lZ3dqRzh5OTFLajNlUk9hNXcKLS0tIGdMSlRHcEw1Y2ZFQ1JyTHZ1NFcz\nMzJXNEtaWEswSWdCZ3BLYVVja01DbUUKr/n9DLCjKBYac2+dAk96Snx78qeQAxwN\nnGJf9z3i5NRtN3Kapbrt2vPN7c590YiSTgYdiEEb3oq89g5Ya3hNnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBURi9aRE9jSWI5OFhYRGkv\ndDBIWng5Z2hFWllXdzdkY3NlbWtLMkppc1hZCndTSW9nTFlITzY2aHcwY3dLcTNT\naTlwb1E0c2p3dFcyUzhOcFlLdTdPNDQKLS0tIGx4ZWREalkzNXpIMTFmR3l0cXkx\nRXFnT2JEYWs4VHd6VUtPbXlGSURUTUEKgEkcgDhB/OdJrAfJ5hZohZ0OU4VNXraZ\nvIz5inx8I+/6r46qMoJat3BIcN5IRllHc/iMBPRq+n7EPtaceEZBhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPRERSVWlnT1lQMDZGcTQv\nV2MyZ1F5MGN2WE01ZVhoNTdHMnZROWRpMmhvCm9UQ1pzRjNpdS8wRklTUnV2MlR5\ndzNFVy9SM2hCR0J5d3JkbEVTOFp6OE0KLS0tIGNqNVZtV0dZQ3ZpU0lmK2JsMzNY\nZkMwVWZYN2MrZUtVN0dacjBXSDhZYjQKbtg1xpYwEfH6hArFQ5w7UBja00sYnDte\nQLE6FksPXv6RPxICQ2+bdhEh/QwmGYDAX+8HnYx5GNs54iUnnj3nDg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-10T05:07:06Z",
+		"mac": "ENC[AES256_GCM,data:WLgG9s2UEZ5pySqjGWHVGCeeKI4dZbSoUuBNzqw/D1c4XtK5RS4Dy0iKSDziI+GcIXyfmG4DhxXuUdNLffAKSb8pSu6nvhlAlX+q7fM18GmAXkD/TwrIr7AUvjWXZicIcLvlZ5mEkkj6lrWe+IyA8xJBcFjLji6lwNewBz3PoeM=,iv:PkKt8d732tY289IjCEprlgnUvC3Vt9/1GYSYjlSlLi8=,tag:RZecNrF9NHuwxZbCGUSllA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/sirius-age.key/users/kurogeek
+++ b/sops/secrets/sirius-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/vars/per-machine/b4l/state-version/version/value
+++ b/vars/per-machine/b4l/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/vega/nextcloud-mailer/password/groups/admins
+++ b/vars/per-machine/vega/nextcloud-mailer/password/groups/admins
--- a/vars/per-machine/b4l/tor_tor/hostname/machines/b4l
+++ b/vars/per-machine/b4l/tor_tor/hostname/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/tor_tor/hostname/secret
+++ b/vars/per-machine/b4l/tor_tor/hostname/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:kKuKG9d4/M1QbJFDG7lIqsLxv+UuHnjefOLIrwlJevDjZ9WXFF7t9wEdKI97ks0P9QjCYwCWLpl9KvnnWGG5,iv:NfDT4aRKT09OCGCkeqjM7nCpn4uvAmxjM+vrM3LjbzI=,tag:HA941KSFSWou+r83K3GlPg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5V1Z6U1JYSDAvRUR0Q2Q3\nS3V0VHcySjJUSk1jUGlSeWp6MVNoSkJsSDBjCnAwMWFrU1hVY2FMQURQWnRyMnFI\ncGFDdjNqUVp4Um9hZzM2aE5OQ3A5YzQKLS0tIEtDUHhuQ3dQSmJ1Sm5qYVdvZlFD\ncDRrck8vOFYxdUJYdmxyZkVjMWNJN1EK5LMgNkrtbtGnB1/WCMnINutQxC4J6H8O\nyW8VXF7Vkoc1UJwWdgLIOILq2wgURgmlcjN6QRxqnZ5+SpEEpfmwSA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtYlJObzVFZDNnWFppQjRp\nMmpIdnh2UUk2aFA3RFJnbnNQemRYOXk0V0FJCnBVNytpdlgzNVBCOVBPcXovSjJD\nS3RwNk1Odkd5VUlDOC9mMms1akIxVEkKLS0tIFJjcW1yb1VOdmFzSWdiUkx2MjM5\nL0k1UmQ0NCtBd1dyci8wbFhzZzJhL0EKC3ccLIbdodeHtLuMr0rhlXn9xzv7vV0s\nu5jKgkLcJsQazR/tTOJsFa1YSW214b1xzkQ5UOjGGr3QKdKieoCmfA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGtaQzlvMkFW\nRkdzeDhhWGlEVGpYeisyNUx1VWxPY3d0cXhtSjdqZm9hbm8gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpWTUlEeTU3WEN3NlRxc3QwaTlpRmVn\nYkVQTVJnbW9IVFJOeXl3V1I3M2UwCi0tLSBJMnlKVlQ1eE91eFBFRDgrdUY5Vkl4\nRGM0bDNFYXMyM2Nya3RJUU9GTXljCj2ud36cyMXx5yg93iXZiESeaAd4kPdcTbgc\nCgv20gxASeuq2U61h/UMHJM8tEeQi/HT3tld+yGghtp/QPYNgZc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIENSNEpjc05V\nclEwTHNzTjBHeS92UnBYYng4Z2p2Zm9mb1M2V1l5VUdqMXMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpIWXZ2aXJTNC83anczMU00NCsyUFJG\naWE1TTlxbDZuQnRsbFFQTnZ1eG5VCi0tLSBoc1hqcElEUFkwWVRrd1dIYzlIczBk\nNmM1OWhRLzV5Y1dXTHN5c2pJejJvCmrYj1VSjz+XIHz9sy+U1hIRkmdKt+/ylRRc\nXoCqIK16mArX1S1FMmV0Gk7zcUOJEVECVLjuCUOIVcRvT39ymlQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG16bGlsOXdP\nNHZZd0tweE5JM2lXTmE5TXRZMC83MjBFSmhmKzdHL1g2bkkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwoxc3E0QWFvZHNHOTRWZnZ1TkI2ODgx\nZHdJRFRQYnQ5aHhMdktyLzRoZlM4Ci0tLSB2UWFad2hJNnY0MWs5NU5RREJqQXVs\nbTI5K0poRVIxSW9WOWEyMHI2TnVvCh9RV0ss7qxpVLlR0TKIgt9Cbf1u59Nx/j5m\nb8exNGAsf9Bw/VX9gidU0Ij4Aeu7b0XPtI+cvLsGoNyxmTf5SRY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoYjJRUmdaRVIwTXNjNCtS\nbDBRa21lb29rYjcwOHhxME5PQ2duSkxuN0Q4CjRQdFVQVHk0U0tibUp1MEJ4MUdS\nNVc3TnQ2ZkZpZXZVTmRUREpGTGZCNFkKLS0tIEJ3QzJKTlNGWnZqU2EvSWlma0Ja\neUk4dDR0cThISCtTbXZsTGF0VGdlQ0EK0lz1rjM0ygAg6QdusYHmi6Ehetou7GhI\nw/3hjerPobGZj32fy+EJ0LdcpILcx2lvvtOcDSap8/17Hbf6LKMi5g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJNjBzeUJNZGRYd24xZkJv\nOGJuL2ZwZ0pibGFtNWMyQzJ5RVYwSXJtTEY0ClZHUFRXT2pwWGIzU0FWM2ozTVdO\nMGRmNU1POXd2cm80TkZPcFYzczZkakkKLS0tIGMzd0dNdjVqWnRQVjlLNzkrd0xE\nb1pxeU9uYm00WHhOSjlDRnRGT3RESHMKHLpP7DNaaidt5Tc/9za+Zq5UCIVMtefF\ncPqKLvOH5iF0qDErVY3zqoXlQxx5rssUhVXn/OXC2n1/ubSuQHx4RQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsZ2ZlN3VxL3Q0R1ZPdnAw\nV1F3YkwzeEZTYWhyeHVvbnFTUjZqWlBQM0hBCjVENlJ0aEZDRUI4bjBtNG1CNUJo\nOU5FcUlaMWMwcUdxazJ5aXFyUnNNOXcKLS0tIDU1ZzFtSzY4SlZreE5sekZjOFhO\nTk9XNW00MjlCMkw0UUlKU1AzeUY3MTAKGf+jwWUm35Fi2CBrH2r+hHgW1pwGPft5\nNoxxmNn1H28MHSLz6aK1x7J0+TA+Wv5wZPnNVG0vrXSt17NWOi1BXw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvWWVoK2hEVHF2NERaL0w2\nMkErTHVUakdxenhTTEY1eWVrTFZUYmJ4RkZVCkZtNU9zWHc5YmVyRFlHRnVQWDkx\nanJHNmMzUUQwR3BUWXk2QkNZUEIvTU0KLS0tIFY1ODVSK1UxYlpSa0YrN2lidjAx\nQ0JBTGhaeUgzMFVKRFVJWWNxWm45MFUK2MQVFWgk7kaisGzxng0oG5CYOU6CX7jC\nfTMTgJ2ewEXdPa7b0Q/EcS6BvNDpz6jRB+Hr7mqqrnEQwt1YItIOFQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-28T07:54:23Z",
+		"mac": "ENC[AES256_GCM,data:wdtnhaoU/NMb1nqzjKX/uapwlbWZhbBrCO9VvYv5lYJrpkWRsFEMAT6XZzmkHoEBh5eZYO5fKth0tMyWkbptjcsPKnvFc8UmtFQ5lQ0u4asM/Fj9itLj6mtCqo34Uu7CzEhmfHKdThooZxNZ71qPGeu/uhiQFGBma6VLOz+AMQ4=,iv:BHju6UE77Wwz64njwQKCfouGXU5TtD+iCbCPDj3ng+g=,tag:MXM7dFiDSfvPUpDyqdWHzw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/vega/nextcloud-mailer/password/users/kurogeek
+++ b/vars/per-machine/vega/nextcloud-mailer/password/users/kurogeek
--- a/vars/per-machine/b4l/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/b4l/tor_tor/hs_ed25519_secret_key/groups/admins
--- a/vars/per-machine/b4l/tor_tor/hs_ed25519_secret_key/machines/b4l
+++ b/vars/per-machine/b4l/tor_tor/hs_ed25519_secret_key/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/tor_tor/hs_ed25519_secret_key/secret
+++ b/vars/per-machine/b4l/tor_tor/hs_ed25519_secret_key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:lKIk24xi6Ob9mlU/L81PywvKd22juE/lyqv4mFA68MbEq6i/ktZHmnPfinfwmjjZEp0pJPYbqgfwT9rHr+a4msEW7XCSe/BKzllDpYezPmVOwOf2OB5Q0Q2O286EMfXg,iv:KmFaMllFeMvHz7ucNtPP6hd6rAqEsgOGskk1N3vylgg=,tag:DoqcW6UfJi4560GA+ZNBXw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDUTdLa2hkVXVWZDVEN3RB\nMUhkb2k0QkdtZDdnYlhIelIrTmpGNG9NOXlNCmgvNEpLQXQzZ0swQnUyRkFOQUd3\nUXN1VGZvR0R5OWRIU2RiUWx4eGxPZ0EKLS0tIE1pejFaNUpLMk5JRFdvQ0FoWkZj\nYmtXMXNwMDZoZ3V4bEVXeXJKQk1NMmcKAiBg6+ZlQYl5gY4RKd3IQxSJc0HoRRoy\nm6SHYvutY4Pv6i9gEuyYXIHiUI5WNmqQjgcK8ZpNVB9kcSiCkDtHPw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEd003N0FhZUtWSStPY3dE\nS1d2U1RkZTFPVitsM2wzblhybXBzUlJlbTBvCitsMGpVNDNYNktEbEN3dkx2a01m\nNU1GMkpicTJ4TkNQenhuYVNOTXdGbncKLS0tIEZYZnlPVlI5RnFMN2hFZHN5LzdW\nK0FCSXBqYkQ4cWN2cVJCdUloT1FoVFEKSDw5Bl8CTjQiyX5iEZP4ageyDWI/VYFJ\nPMFbGrGIo/Yjn1GUXy3U8WCUL0Pf0t51uryYzxlugXGN2xDas1zqPA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHRFaEcvVXU1\nZzVJRFl0ZWx1U3g1MENFem91NFEwaC91bjB2VW1KakdrQXMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpIeE5GSGNaQkM4cGRGMU1IZGZvWkR5\nOWdMSks3VEZXWTJhOElRdkpMNW5jCi0tLSBPcXQrUG1DNlhoZzdUdnRNRTZ6ekVh\nUHlCY2VVOVhXQ1ZFNllmM2I3UUJvCs3ids9ynH69xwiQMy5H8W+gqkE4ro8YugWY\nIx/BHKaceRCrrhBr94ut9J4sssmXc+IW8KR59cfqlQaIzv4bw0g=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG03MkxmSXhS\nWlk3eXlNMTlOT2hqaVRZd2grYTY1WElweVlWUDZmOFcwQVEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo3SlBVZzgzdkFsSjdBQ240czRVZStw\nM0taTUM3L0l3dUVwUXh4V3NlMUpRCi0tLSBJU0xzSDF1SW5BMkZGVURjTWptclA2\nTmFIdDFuYVFobTFRcjEybmYwUHpNClHm/GaJ3cJ6CD6qtRZeA+0IaZXQVIIl10gq\nXXky+9m4k9QqzJk0WNlQVTKESXEZmH7ZJpFozkkBl3pvsjcP76w=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDJLNWt2VEFl\ndkRHWVU5eHV2Nk16NHVTUWRZVjFKN0gxTzBwUWdnUDdCZ00gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpxRGRKeGZzbDlhR1R0QjRxQ0Y2aDRU\nOUU4aGppdzZMMW5neXBpd2tKTnpzCi0tLSBpZG8yWnRLQzFUWXpBNGhVUTVEQ3JY\nZTEvYTErTmF3UkNIKy8zaE81MFFBCvNUXKxBem+mYQYPTwUaBfdcgbW2/ox7MHWu\nprO+wkgytG/dowwxYN8ojE0jTL5gEm82IhAcBefUozgUrr99hTw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcGZZcldCWHhnUktTdVVr\nbytSSFdCblRGOWdFZTNJNFNnSUlUMzFYTkNrCk1ZaDBtb2NwRkpPQ1MvQXYva3dz\nTFI5WHhpaDN5SlR6Y2Y3L1AycUVsaFUKLS0tIGkrM01ndVE2bnB1N0RsbTZqVWpX\nQUV3ZjRScURwRXZxN2p0YURJREloMjQKNXNSDKR2yHHd79VswrACRMAbjP7xhaBG\ns0QecfDGnvzehMTRgtxLZ1boN48ltBgiX2w2kattklKFC/DPZf9arA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFNEp5NW5jSXhqUC8xNUdH\nYktoYVh4S1VuME5COWVXK0twdGVBYmxqSVhVCjNDdzNLMlFtTlNCR0JWSjVTMzcw\nUUg0TjZDcjA3eFhVa0luTGtiL0dUdFUKLS0tIDcwVUtSRnN0MUd3M3JDM1BBL1ZN\nQlR3L3FEbUlkcCtneHRIZFYxeUFqNGcKVwSlw/DkUct4N88zmsdkZdmfOZkcyX4t\nTJHTIzUQ8DfEiAImw+4gp7zGgIAniSRMS+gaCo5dNyUedkP8SKf7JQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzNXUwOHlMSHdGRWxYM0VQ\nZ0YxR3dvYjJuNVFIRnpNQXptWDl4U2xPb21ZCnRheUZnU3hyeU04aE9wR1dQVVFw\nRVR6KzhaMDVuSHhGdHhUOUs3S3h3b1kKLS0tIGZDNzEyWjFBcjhueDJMKzVCQkNm\nWlpScjB0bWlnbENhcTNiNzMxaXNYdU0KyF3yxe0mepsFVJHW/pSMpHLkyF66M0Sl\nzm+biucmH+6aR4Pc+IvQ2PogEetx09hhCME7O2Okz5IZI43Xh40meg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0xqdENLL2JCcE5NR25S\nMWtqWmR5b1RSdEdoV2hDMDYyaHk2ait2OTBFCmE3RHZPQ2RBZDB2anFaOWpCcFhB\nVWNLNjhaRzFPTm43VkpabHF4b1B3ZzgKLS0tIHcxV3BJU21vZTdYSldRNlRYaHVv\nVEhPZmE3SEFMTmN6ZTZFdm03ckN6ZGcK3OpuSsmD4EbUNOoQlz7oOfbKws4exwvD\nBDpMRp6XhYG9YXYoLuvuKu3Qq7YKrfv0ULaQD3iE5KpruEBlHpfR1A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-28T07:54:23Z",
+		"mac": "ENC[AES256_GCM,data:Zd03+YZJUO+kBJv5pbOxaebKeppTU/+iqJn40LyP3N4vWlXQ/1uJGE48oonLMSwZ6LpWlmekl3hVWQIMvysHsFY8mGVb3Xb/UrKFm1IF9Qd8NynRfR1bu1TdIA7Ums1fXn47OT0zUWhFaxz0xHBRmavusrHmFIAlwq5YQUNCUMQ=,iv:aac6D8jlG+Ct15ht0nkPMO7UONXnRFga6542XfMAgiI=,tag:nKvNDfqmQJEco03EZcBz4A==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/b4l/tor_tor/hs_ed25519_secret_key/users/kurogeek
+++ b/vars/per-machine/b4l/tor_tor/hs_ed25519_secret_key/users/kurogeek
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:ada9:8363:202b:faf:be:92ab:e46d
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:NSyWVWXMxoTR07uaLUYX6rHB17wsIB53FZHSsPxgDKJQ2wHBPFNaHSYh+BiSo+IrX+YcdUUqJFhEkjWDyG+vXaNZHrMbg/pzZ/cwTK/lPbYISkwtOhgr3zCA0H6DmQcHVmvR6fsdRDkFwl7pHtn1RMjEORQdbBINtscZfzZFcAF2L1t+WPFxgRKQDNT/9l3f4SoBcuakyg==,iv:/5JbEZ/vj/4I+eEElOY0cnhiYzqqPw2ZKLv2M/xkstw=,tag:23exDL72g56bP7ZbMsK4mA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTYUFSZGpmd2tmdzB6bkp5\naytPd1RhVWFqeXF3SDZia3QzUmRNNGpzcjBFCnl3VElLdXFvV0tFSEFlV3hRMzFH\nbnBnWVZ2QkRHZ1BoTEZxdFg4QWE4ckkKLS0tIHhSMlBKakxmM0xyeUphKytLTmpk\nVW90V05hTUEyTVNMQzZHN2xhYTBZRGcK/nJOIM4m56TE7KKmn/QH89g053mmuKKG\nQYs/86SWdLPqwL35FstQg2xDIHSxkDcoMSGc+C+/xdOjWV3qLil/DQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaU9idi9RZzhNeXhTb0pp\nUkZ3UVpsZlBka2kvZDBqcVhiRVdMNVFZbEJNCkhvdmFaVTBGcVAvalJPSlFuZHhi\nTE9qeTBMMjk2djhFUEdJbWZmTnN3WnMKLS0tIDludThMRDFDUHhCZVV3bUtVdVBZ\neGg4TzdqVjJPeUxYbnBWNURRSWRrMkEKBCACDZgHG5eVKcSdjHDITJZqgR7cHdHq\n9y8qS3YjaFZ37Ui6Lmb9vJEzDCEy3wEupBy4sbAX4okVapGPJ4fmwg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHJtSTZrY29X\nVTZNQm9XS3JsbEZCNDFUR1gxZXpObDdKRmQzUnRZMytOaFEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpYN2xlOFVDZFlEOHhTMGZTVDNjdjdU\ndWlqd2ROamdmelp4UjAyVitnYVQwCi0tLSBZWmVWc2J4YVhLN3VyMTQwamtYRW5K\nWVovUEp3YlN5WjA1VE10MElWMllvCiLrLLekRkmSL5ekLIcFMoqgeEPXSrn15JDd\neKT9sbYtwhB7vt2L57fDRfaF/+7wNb9y6cv2oi+EdDoDXp/EyB4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxiRWYyUmwv\nVjlEdS9LOVV2K1NwdDFhYWM5RS9LcTZFNkNaMWViMkl5bmMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpUQkk4NGZPVWRTbG5MNk9CTStSUXFi\nbXlGemlJR2o2dTB6QUE2Q2JKSnE4Ci0tLSBzZjRva2NtNHlRamNvQWpoZW1UWFMr\nQVdNYXBpOFVhaEVxWm1KNFM4UHJvCnebMj6d/+e0vp00Gb02qJtUp2+mEpF/jUpD\n25cxeoSAWPAhfnBgE+oLzQqnQSq5dCxsWteE/1eOXC68koeT9FY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9udm9sRDBJ\nNFM4dFA2ZDdJMlBXeXYvakM5RHVzNlcrRitzUHF6dnBvMVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpKZnBka3YzK0tUQ1hXTHVheE45Mzkw\ncE04aVVPQWM1eURmb1JaNlBwVlFFCi0tLSBHTlY4UW5FQXExK2cvMUJDZE9NaURy\nOFUxN0dvczJtWlVRc29QWlZ1bGg0CvUoAmTgDVSF7SPpqnkFhkCUn3N/Yr4Tzodw\nyCiD7U/KYFavEIxGIeg+ClhLF9o4fYq9kk8ld0vU8qUADXBdRDE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTUEyUndkSk1iQTB3eUpp\nb0ljaXpwdi9QYmdNV1J3L0NhWElRVzlnNTFVCnZ6Q01ESWRNMHRxdWZKM0lYTXBX\ncko5VitPdWk0UHpwWDhGNzFVZk4yYzgKLS0tIGVRdG5rWkYwOFlCQWNIWFBRalVE\nMmFtOHBvbUw5YXAvMG93MjBrRjdmMGMKlopySr6HS6vfFHiRcwlJz/qy7jzyS1Nf\nw4lw7QnOrvOkoutiK3HiIia5N6V0jd0TV7nJqIu7tz/zYksbzps7QQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVTZNTUM5UXowWTlPRDFW\nVUJTbStFcldHbTVDUVRJYjNiaklWRmowTHdnCkJNbUtmdk1jS3kyaVNWVFlOTytX\nKzBwTmxoZi9NdmJuRFNMNTUyRThNUDQKLS0tIENSMHZ5TGwxQ0xuZkZFQ3RJdGEv\nSXIvYW9WY243cTdzZEtra292K0JFVlEKMWhG/7R00uqLb5l5lU3p9Vt4pre6J85r\nIFWtg1G/54KaFt8aiWcD5RUSSARGZ3r4qVtO+9eWP+gA4DUpSNkWNw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WVlWMHJNbERKUGx0elgx\nUEF1Sms4VCtNRVRraWdvUkFEaTRzYTJ0TTFZCnl0aTIxR1QyQ1VsU0RFNnN1NzBr\neTVQbHJHQjAvYklFVkZkUDRXRGxvSkEKLS0tIHdINHFyQVE2V1V1R1ZxWEFuMm5x\nUVRjSVp6NStGSkQyQ05JVHlXejBEbWsKBlMvtw9MCReN1eSHKMwwsWaEF8kq1Pns\nLNSYEeWABZ5bbPB1xBvmIIlVFThJqgy5mBVJLzQMUwqb0IvixAgFxQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaSmNiVWlRSy91Mm5qSWJ5\nd2Z4WnEydE9ncWwzUVVCMDVoek1wRTFyOFJjCkZjOVZrVHY5d3FKRmMvaXJQWUtU\neGpSZkZITkJaOERkdWZpelA5dTJQOEkKLS0tIEtZOUNJSytYTFpSTWNuY3JjcnJv\nbFZpTXQxc29Pd1FIN0xrcEJYc3ZlV0kKyO/PLn2WNdVtTqM8cG1XFqV/5YdSqPAY\nvroStGVsLliV7W4T2MAmACeyjoMde9/gVosKfGc6awE+Bi2BUxrqpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T07:22:09Z",
+		"mac": "ENC[AES256_GCM,data:OxeLto6aeiTOX8OffRsQzxyluSdva7y3j4j67c+MI1ost+QCZyGAW/5pr2mMaoU2XrwYqUjZTKBhJ9p1FY6C29/EhyzrNhGUTjC5iTcXO1lbLUTgoSDN8KPmVea97sTa+easVHoSgnPLxisG2yCALv95k9/eQ7vF9FRjBBNTaIU=,iv:FQeojhtnKOlqWuQNJo1TmI/PhjYbgwtvK24gZMjbbpM=,tag:Vwum5bSSZRNNDQ3Yudw4hQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvItw14tB6fc6gdZalSkZPOUSWGsTNyLnXk4yLAnkrb 
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519/machines/ramus
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:AzcnY511v0LvR5Z3MIjTY2QWnCgvd5cJ3ezs+E6LdXvzp/nf8XM2zyVpl+2tVlSdAgZs4TvxwtHihOanWQ8yLdNnXT8jP0hUgtYUs9RGLagsbxjLZQ4fKc/Qj3lXDrJdHtV1Ycx7uPXJ10acn4TDiO4GgoghbaRQJWkXaWSxNB2aTVV+76fswLcIimm8D8sLo7NGi3X767/u1xOoz7/jnAke9VCF502EtwK59DhAJvcuuwHGTuHwi1H7BQCs6WTNS4cvfSV9sB4EWmj+J3x65IvAp3uo9KfSlRdAIScJulHm9pOhBU/edTb1goSKAXHfahWrQArcKFOjGW54sWN0MakmHN0UFQVlZF1sqEpmHEXNOyjCPLJYpRxaRmjWBeUuJ/2xHvQWVQVBLC2RvhbGdE06lClrX100EX31txzuIJVUirAHR2owbY7+jOOTZuZtLcXZkHGRVgREej6KmDZWr7yNw9NJ178oD7x5/zivajnlAxYEIUoin7UofkDx3T+sMU9N,iv:Q1YlntA6bScOu9hCOshG6MAbhYIBWw6EbM/5z4nJVvQ=,tag:TFZpP9CeOAmOb3GpCVqRWg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1RDc4WTlWVnBvVWJMZFZR\nL1M2ZWxib1NZM0M1aDM4SlhVaXEwTzF6Um1BCmJiRDdCNXVPaDRDdW1CdTNUMjQz\ncVVIMWZRd2YrV1o0M3NjVkRlZW9XZEUKLS0tIGNYazU2a0pqTzhXczlsbUxBUlBP\nUHJlUHgzdVVZdHdyTjlLQTRpdlJWS3cKHghMTLA/S6F60y56nL/at+iECyoEzZmO\nECJhGSDyQ0vbGgEAnskfseoA2xtzNvkj1sO2kbnPg3pCvlIDGaAX7Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBESGo3M3J5S0FLK21HUHZv\nd21uUTZiMWRVaEhZeGR5MFVLcHEvMnd3UmxzCis3K1poM29LY3BBU2pYRXc5azV1\nYnNpT3lZeFRndmhHb0xHZFZzZTBEOUEKLS0tIGZHZXpESlBjNWpWTkFlMDZERW1K\nRDM2aUF6bzNMZ3hLbStOTS9aUlI2bkUKIzTIQ69JjjIlJl3xUUa8c67+WOLXIcxh\nLN/p58/sGa1PH5X9uI9yBxH+7dmn2u7xwZKGcHt/1D1BwH+1f42eyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsaFgrWllHdXZxQUFGSWV4\nZHMweFpkRHZRV0FEOVBDVFh6MU83SEhpZmlvCkJCUmNIMm5kemZFbzUwYU1POFVx\nVk8rTC9HRi9pQUo0Y0JBdFphWGRuT1EKLS0tIC9PUmZvVC9URks4VitMWG5zSmh1\nNEJldTNEd0dsQjQ2V2JUbVU5UHFNSGsKKV03KeObcSAM5tMBNJp+F6hdDpziyABY\neEAJxMr9BuGoPwvAHLAAvIsIuOw6Zw+wfbxeZK+szhwiFmMdZMCffQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE1xbW85Wi9V\nOTdhdk9jWVBlZm9HbXV1SUh6WmFmdnN4TzdRcm92N2JDa28gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpjVVhQU2lLSlp1Z04zcjJjeWNEamEx\nWGltR2FtdlBDTFRpNGNYRTg0Mm1RCi0tLSBVbWV2WVRUbnFySGp2ZEFnNG9Xc3kw\nTzMrV3dEOEMvL1RGTXJ6L3l6b2t3CjxtxJah0sEljMT01ch9x30OeFzvE/HNzXSb\npnG8Dh0rYjv1lJ2unja8zZdfrl41avHP7BeHqSb5QAMVxZj3h8s=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5CM1NOOUdl\nZHkwN3I0YkNhaDNYWnMwRFM0bnBPRXlUSy9BZUZYVGRtQjAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwprYkxXMUpZZjhjcjdYYno0NWE3b0ND\nSG1nT1d3dGZEUXE1enMrQnlsU3pVCi0tLSBNMitqcnhkeXdueFFIb2ZSNEtmZmhE\nemdYbGtpV2dadTRscnlidzJNK29jClycgQIySOi0Pb7H9G2fbff+VRhbQY4wqliB\ntGyGUMijiTPpKC5CMqoVz3RsMdZkX2NuwfL3p0oZXpHx2gWCPLA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1yS21OR2JC\nY2xKWW5tdWhGWUxZNEVadTdkQW5NeGhtb0xtaml2N0hnR0kgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpXa2ZmN1ljazgxQmRKUitGQlJhMHlk\nYzNrdVJCaU1QeDlMdGZHTWhjajE0Ci0tLSBmcWhNUmlzd0tWNHVHcW5Dd29rRFpF\nUUl0VkNKb0ZUcWpKaWZvT09VVWpFCuvNqV9L0/XREyuFeNA41+G53wx56k1qzfhz\nk407lcOzWtlo9e4GHzSeV4ZEAP4Pxt56AtoIlSM4LNrlEpBpP9M=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0UzNQcU9Zcmt3Y25BeC9X\neU9NRllWYmNQSkdlakZTbDc0RVhQMElnbDJJCkpMVDRRUm00eG1GN2QxdHppRDVn\nK3kwNERzeWx4YnYrWEFZQUd6YWdlVEUKLS0tIFRyNC8yOUtqdC9IN0lCenlFY1R3\nNlRnWXo4ZTQ2endweHZvRnRldnVHVEUKjNVzo097eHcaQdt3l36ptfzkfAaXNsDJ\n5b6gyjs/arzYj8ygdv6UyDdTNjlZfvATSMgfYIjrCKKt/9EDHfXhRg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSWUl3WlNQQTF1dVdmQjVS\nRnNRK0pNUStjV3VuN0QrK051ZHNPNVZZdlJFCndMRmJRSnFMcjJlYjJOa3hjYzAw\nSHRpaDFFUnd3UU1EdjZFNktzczZucXMKLS0tIHNhUXEzOEFIRDdBdHBrOGhKY0ww\nNEFUMlJLakd4bUUrK1BDNDQydzFPRzgKNJUKAxK/8vTbnHM6/gM4J+FibHkvx6dt\n4hbLPRcXAp/5mVJCMAIGHxsuyG4ypSaOkF25e43PiI7f6HacJkw6AQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbVlpY2RxOGQ1NjFaMzUy\nSU1Vd2crYmNrcjhWRFpkdUl4ak03b0c4SEQ0CkhieCtFc0hPQUtsQmNwRnBhdkY5\nMTBOaGVTKzNtUWl3QUIrU2VRYWhWMEEKLS0tIE9VNmFWaGF3KzdKcmJCbHNTZllx\nSnBtNVZUdnJHYVRuZ1NQUWNoRkp0Y3MK0x4epBjs6Czgzpp525Z8FMpJkuQn5LQ2\nbaL3VJJxdjpKKk3AeS3rnIUJ5XV10qtsG4eaQ3wgAQGdXl45jcvDaA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3L1pLSkI5YkdWV3d3TDV2\ncW9lWUNodXhBN2xGcE1KaElaTmxRR2V0eUc4CkF6M0ZCd3NTMVhUZEpqTERnVEt1\ncXE5STdJckRwaWdJdE5SNStsajh1dTAKLS0tIFhrVzEzL1ZGOFVOL2oxbmFDQ1ZS\nTEc1UmM0V3F3YU94WVBDYk54SWZtZUUKl7eW0214fmkJ88J93O9uudjxxZfQ1kFl\ndeZfjYg1N2UEGImL4sZgz05+m8ehxLh+FntlGgJ7MHFrqAE/g6UF1A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:15Z",
+		"mac": "ENC[AES256_GCM,data:Ve2ded5v+sZaMocncuTS+y9g5nGP6wWvu2bWsBn4AbYigZnfp9eROIf7ewCT2pxcu7VFGdYv1DjWrizwvYu1PkRvVMxJZy2BgZeYwtmSVWW+x7m82QFb8kapO5j+8hK6V2tyiaGUw8xwNDtN/QyUhlpS1kjfmNLwy1sBM0rinLo=,iv:G5oif6tMGzS3TAPRk/6LZeHLDvyognPPCjuwxoX05YQ=,tag:M8+mU2/C3MNwc4TABkR9Xg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/root-password/password-hash/groups/admins
+++ b/vars/per-machine/ramus/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/root-password/password-hash/machines/ramus
+++ b/vars/per-machine/ramus/root-password/password-hash/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/root-password/password-hash/secret
+++ b/vars/per-machine/ramus/root-password/password-hash/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:6/cp0K3a8htco1rlIfExnL+ppIgNg0+/XlPPAx0Ylp/KtDfkQg3OI+Y9zWRX2UN1dHjVVBJ0vDrqKv5OaijQbl14E6U46HH4EjevBmGeUCLmDrsFTNIPqGw+D12LoYuOGwkfonsRO5LbtQ==,iv:Beb8wBVdZvkKA69aCtxGMxuQ9fProDLN4WWKtvKPbvc=,tag:+rpJT78McFuf1wJq6DWyoQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpMUllOTM1RUtHSWJ3bDN0\nVnRTWDErQTV3b2lHcEYzanp2VVhoQllyNmhzCk5zN0xwUVlDQjB2RDRLUzlvVW9u\nYjh5eDdnWGRXRWxoYmp0ZTNEam94NDgKLS0tIHBTdHREQ2dRR3ZFNHFhZXV6cDgx\nRk9OOVUrSWlVZGZHTksvN0RocHFyWWsKfhDdr6qFmtt7dAegVIIb3JH01rGxzvyN\naQv6F6BWbhvMUU3/eJNVerJti1Y/RinGxBLSP58SxksJiDTFBv/jWQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMZHQ2U2tsd29qTFQ1aVBP\ndW94RXJqbE9LUkdXeXVsQ0F4TFUxdGo5ZFg4Ck1PWHJGWHVEeTR2QTRTM1NGWVkx\ndG1HMmZUS24yNHNQbjFPMjVNeE83aVUKLS0tIGtiZXEzY1g5QS9FcHlOOWpxbE8y\nbUtrMngrQ0lLdlQ5N2Uwd1ZVWkRYaGsKD+xmS2gjw7o2Wohxh7+4dk2+9Uf7jK75\nFz2RmP6oLNIcWanAENygOR8etcuBMcCPAc08VSEGtjDg9JUC4lV2mw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYVJmUDNNMWVHSSt0RWk0\nNHlyOU9uYjg2aytjaXVnV21NNDFGUVMyUDNJClBYTUFzNWRxOTNKVmxIdm9pQlRq\nRGQ4am5mSytDOFFjUklGNkJZQ29tQk0KLS0tIE1jQkkvRGltYUExazhKUDlhZlF6\nSDUwNFR0NFdJSC8yNy9yOWxHYUJxSEkKf7bxUdVDAvHnU8kscXInOcIy6vuxj5pL\nBaW5dYJ5yQiroXuv2U9rDygTQYAAiE0g8xZRjp98qzTHT25lG0pgzw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDc3Zjc3blhq\nOVpLSWF3dHRLVitOd1BtWTNISVBPVHREMkpJdkxJUTZHbHcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo4cUZZRXVrMzFiV01QenVJd2oyMXJv\nVENRYmdtazROVnU5d1RkRGp6NVVZCi0tLSBabmQvcjdQQkU3SGZNU3BwVUltN1Er\nZ3hxS01ZeFRFSkZVYjc0UXFqTTZjClLbO5vhBcv+lIMvSEPeuztAL7/L2OttICB5\nEJghMMExc7/kgM7d88q75qEsPsVNgE/4BWzyesrvKXb2gWLosQg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHh5M3BYQ0di\ndkhjL0hDWVZqbU0rTjlkV1NZZTZ6eERTc2JLc1l1b1N6d3cgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpXdEY5MFhNeXJRdlJuREw5emJSakhT\nL3pqNFBpOFozcXRaT3NreXJERVNvCi0tLSA4Mms1NzZRdG4wbnUzSVFVVStueXJ5\naUh0NWd3aVJUeDFQSGRtMjdaNEtrCtQQU4t80k6OnmsBcH6Z0hyBPTLFsb9n+/2h\nxWFf2MsBTboevVnOhvEGaA8XhBB2/MrUCGTbkFStfdf+8jyVj+k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHU0dHI2L2FH\nZ3loaEZxRUY3NW51Ty9pc3FYd25OVGtwNG84OUJUdWFCMVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpYU3FIZ0crV3NWTkNLR29BNFlvbFJZ\nRFNzZk1iWGRvRFdRc1NGMVlpZGNnCi0tLSBmK0FXeW5SbzJLV1c5Q2wxMDkzL0Ew\nMTZoRklJL3JIaXcvcFJ4bzFySm1jCvY44UAa+HixIuoFn5n8BBqWigjNYS0bhFTr\nTLOcMxGb26VeoWMULZs/SaONRAVbbtCYAbv+ZXFu3GH7rn9xx48=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0dmJacm4vYjN2WlJNTFEw\ncHpPamdqa21FZmJKRnRtRUNodE1NNFNZWWp3Ci96R01JWDY3NFNINHg5MVRTbWNU\nVytLV0hyUmI1YkV4dGJ5MXpuQzU5eDgKLS0tIHhlS3NjVWZId1lIa2ZYY1VFUmE1\nc0UwaTR6NEFZcUg1OVh5MG9RSHFKUncKGnRavc/A4Y24WK9g07ofpdw4jf/Dzs14\n2MesaajLi2pHwSeb48V3c/iYgS3cK4j0iosY+viWrfvV3vRG9FE0Tw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMGNtaHl1MEFFSWwrOW10\na1JQNnZIcjNnMGREMTlXb0lwWS9OMC9uNlZJCkxBSXVJSGdzMC9mU3dldkk5K0Vo\nOG5uMDM3S05jZjdBY0ZyNGZSR3ZQQVkKLS0tIEN1WGRDaGNva3dJWGczWHBVVUtw\nTzZad1FCeTB4UDNsZWJ3Tml6M25FVGMKzXCnA2ehQ/bfV32Xc8mflXfWAim/v/+u\nEqU0fp3Bhn1FIWFCBvh18o20kw+MsE3+zpiY6FxxI2EtrVTMyobXuQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCMmtNaDJLL1hhb2tCSm16\nck4zcEVabjh3OXpuMHFsbnd3MTIvbnVmRTMwCjFhRWNWSUlZbmtuUDBVakRaL1Uv\nSVlYeXJtOWd2UWVuVyszQjNkdldrbkkKLS0tIGJnSThzQ2Z2TFkrNExQVWI0V0pD\nMXNBUDZNWXpSb1doYW9teEZLMW9PdXcKa3zgLXVDJ07cEMlHVGNCKOcUtajRBy7x\nssbScq1+iCZeBk/4k1Ex3kyZ5yfmMe3nE8fS8Mx1HtXxvrHcxLmbgA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtakZaeWUvVFROK3ZpQ1ZB\nYTVKTWtNVkdQVE5SeE9veFdtcUJDQXF2MmhnCldYdmZZT3VyZmV3eTNPbHIxWEc1\nYTNSNEhZbExrblRKdWMzUUplQmFGNHcKLS0tIExjQUhKanpmV2xuUzI1ZnBMdHJU\nU05OL2ZaYTEvWWxRTHIzUWUwbU4vODQK13v0k5tac1CYvsESefWacZe+xXUOXWPy\nn/soHGUVG9L2RdiSh4RcZc7n7Foq6GwJqi9wDc8Ms1FpzvuaVdOF/A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:16Z",
+		"mac": "ENC[AES256_GCM,data:QwBGFbzWLFEdzT1bVjV77rtWCZwKXXf9P3byS0+SLRbfyxzRY0+BkzTa+vxj153udYwFkimJX9ywWISUDfqm6FJs6a4jqG8Xmwk1AmSyg585dc2Z26PC30nn4rBcezWBMF2IVFw+pJ65dZq8NSG6EmyHgmzedTOHMis9NZmm/b0=,iv:i/5MNOcH3TcKYRojVKCy0Pw5tHzSzvS8YLLYn0pwQ6s=,tag:96JAFD/kjUKPv1ZnGnEzMw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/ramus/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/root-password/password/groups/admins
+++ b/vars/per-machine/ramus/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/root-password/password/secret
+++ b/vars/per-machine/ramus/root-password/password/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:nSFIQBxSi3uDpuzA3bOUgBaVLxgAMt2mBfrJFqE1BxNpez5eFvDvXcAvRhtj+rg=,iv:Zd+A4RCKxo4FnDQklNKl9OXIjAJi4Ec69SksSSfsnM4=,tag:c4LuluVLBD5X090JeYYV4g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPZys0OC8xSmhLd1RUeVFs\nVTJteC8vWTZGZkYvOFRSZHd4Z1djZXN4NXdRCmxCZkw0aWJLMzNPV0FFdHV0OGNx\nQy9yanVPUzRYUXg4L1prMkhtdWFsQjgKLS0tIFhXVlpmTUlPTTV5VSsxVHc4R2ts\nUXh4d2RCRFdVSWxDVzBJOEZCK0ZyNkEK97mBLq3AYu/2UDBM9vUx6ssS+076ld5I\nMW2JnHVOcVZpxVKdRBNuT++ZnxmDCGe5gIn2/rChZWZ/BnjHkvDDsw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERk5SSm5Pc1BqbmZKeDZF\nT0ZzdU8yMTkxMTd6ZGl3K2NaUGc5Zkk2dW44CitHbC9PbmhPTHU5eHhQYS9HMU02\nOEg5clpqRm5SR01rQ1NVOVpHR3VKRm8KLS0tIDVqUWh6WnA3MXUvR0NFeUlsK0xz\nUlZWL2JZNHE2eHdUOUpORS9iT1NVZVUKyaJNVRUepQssPLcyg5rYhhsoHGfawApM\nLisr6Yo48eSNcwxeiRc0bljmPEGjn9Na5rqPUFV/YwKL9OhkKIuwpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFY3Z3RRdGxS\nWEVDblVPK2pWUjVMTDZDalpLcE9vQ0YvVHRWVDMvT0lZelUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpFY1hXSlNiZVVzd0s4UTl3UHNoUnZ2\nOHRjRThOVzFUSFdFZ1Fqc2o0VDQ4Ci0tLSBMTXQ1aitWVWg0VUI3YXhKNEZzbjVq\naXhjN3NvcEpHUy9RMDdseVJYdGxJCh3+EmDMaHvVZEHPQHfXrIg5uq0/DXpGb6eK\nRfFHXOhH31NOIr3KiwiPlm3B2NmNyHGgZlwwy3xcZQV12ZRy3xA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFp4cjFKM2Nm\nR3NTMXF3RE5zNE5FQldMWVhtUm1nK3lhK3FmTmVuaWw2V1EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo0VVpnenpuSjFDYmsvWXU5L0kwdjk3\na1RWMlFIUjBCN3BOWWZMQmhZRk5nCi0tLSAwN2pUcVF6RityMzN4NkV4UjBXRzU2\nQ0J2QUNWd0pIam93ZXZmQjAyRjNnCgqa0WSEnaK+qU0BK5FjZwsUAgtNdH9ujG4S\nEK9w50mUf6sL7frwnYHVFHDLrdCezNxGvbfNT3ed0vr3Tj4VZmk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHdYTXlqeU92\ndGk4TzBCY0E1MGc1bHA3QU5qYjBMdFQ1TkZxQmNQQnN4MFUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp1VE1XQUptQTc1TXA1dWlTQlNMV2R3\nNG1sZEw0WVJPTEg2aDBTWnUxd2s0Ci0tLSBpbm9CaTU3UlF0ZEI1a04xdmVxTkh6\nSHBXWE1QTmlMdEtITmN5VWxJL05VCk/sMVWhDp4vWSWjPhFdaCoZ6FyoQQPnYWKW\nQ8TApAcEfj1WQ4JwuVlgFTkiq05do5EpVdcFiOCOT+85OruS9dU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKeEJJUGU1Uml2T1kzajBq\nOXlTSHJMTGQzbFROZDg2Z2N2UjdFb0l3dUg0CjRaTngwa1RQdnJHM243d1NpQ2lZ\nTEtSYktENjN5OHVFOU1zaXJuaDIyakUKLS0tIDBtbUlueTBSRTgzQkx2ejRwejVi\nRlVIenZaS05JUG5leHRILzRjaU9EN0UKKgKUO9OoOH1oDwuITR4uteDxzZBQi/Bj\nrlaVgUFuqlwNaeRRwtn3dheKmKuXIl1kOQWN1aEPZ08Bg6o0j7KTVg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1SGRla1BlREVqek9EdEh2\nTFRoRmg4VGpaUlV0aWRQZ0w0dm4wRnhnTm4wCk40NUdyaC9XZStMd2Fkc2lOZkR2\nU2w4WWhOUDVXalZuNGt2V3VhY2xVVmcKLS0tIEh3akdjSlhSTnA3ZEVYSDFpZXdZ\nL1Y0Wi9DUFNwTHU3d3d5OEFZMUpuZEUKSg2TBM6UzY54Zx+dfF9ykU6hy/5bANbb\ndDDsmyJ7wwVmmqs1sJAPjcKgb3o/OcdGk6AUaaSToDkOQ9mDQmZDhw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOWldVNDExcnJsSkpCU1Rt\neFNscHl3Y1VzZ2xXWWdNL2lmMlYzdHFjeW1ZClliNFhzQWtZRW05QUJ3QkJuRXIr\nMytaeHNIS2RwWTNSYWNnblpPbFdyZWMKLS0tIFZjNTF4akhMZ1pNRUdiK0ZhR0Rv\na0dXS3VWbjF0aENRYjdsNWgreG1MSFUKZjR7FaHpHJofgXUBNP0eaM3GzVf9bb7j\nwNKqEs2xmGlw9yzBxCNkkmqwRaT38/2a4r3CfIzVMEWeHP9/4LTFhw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxTzZoVXN6QStEMitPZXNQ\nbTB0S3lwL1JaeVFRTmpSWVVtSW5LcUJBclRnCkNTTnUwYXBpU2dJTWF4allLY1VP\nNUo4LzdGWGdGNGRkQjNYby83U1BEQlkKLS0tIDlHVkJ1YVA4ZGJ5TFg4UDYwejMz\nZFUyMWNIeEI5VHhIc29rdHdSYk50V0UKyJXjwEZ3amIFPp45PulmPHI7aTXPa4wd\n0p4Y3DaXiLtf6hRZ2Xa/uz+wExUFhEdQFnMaBbdVufD/VK4MA/ZmLQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:16Z",
+		"mac": "ENC[AES256_GCM,data:DpCzrb2qMkmcTpIV8LhzRzT/hagY3zDw+aRucyey0tLoego95ZO/pPPRd7gzfacWlYG3eioPvcwnY/brCmU0tyByEW1gNT2AHii8VIiLoHzaSJnDYiwJOt4ocXhuLw+CRK+od1TtGXO8JJimDvG6YThkR1cNgkFibz55DrL8QLk=,iv:qCNMZXNmjhEAJy1u9Mh/ebn/ob9ujoQoTqeYQ2YhFiQ=,tag:XGoM06/Y6QZv5b4QEgterg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/root-password/password/users/kurogeek
+++ b/vars/per-machine/ramus/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/state-version/version/value
+++ b/vars/per-machine/ramus/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/ramus/tor_tor/hostname/groups/admins
+++ b/vars/per-machine/ramus/tor_tor/hostname/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/tor_tor/hostname/machines/ramus
+++ b/vars/per-machine/ramus/tor_tor/hostname/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/tor_tor/hostname/secret
+++ b/vars/per-machine/ramus/tor_tor/hostname/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:O8wgyBCYMCCJGb1B03E+vc0X7XNL622vGUa4Tii/46LZvoweJvX3S6cQckqd1JjXaT4vj1cZ/jVBn3dsLhjg,iv:kG0YGJGCCTfVe8K4YKrT7ftLZi8d6ySZ+0YD8owgWAg=,tag:psjpCVf2cGMRip3BIVh1zQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQVHdCT2tBRzlBNElWTm1R\nOGlLN3FiakY4RmJjaUJCNWlZbVNZU2ZYc3lZCkh1Z1IyUjdOS1dYaGNwTUx3Nzdh\nWE9HM3FLb29CYlM3WTFndmJXVTBDeTAKLS0tIEVYUmMyQ0NIeVVLMDlESndNYmMy\naU5ZeDRmQXhBRUt1SVVQQXBoRHpPR0EKgQ3WcbhndlqXEsLHKAc74gxUMUXCeHEF\nMjJ0e//Csqg/+jVuCp/IYw0uEKooSehs1hvtz7ZPGKRdW9bsncxc0g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFWGFqajRJS3NBWUcwREdM\nRFI0dW1FRWRjT2lQbmlaRWF6OW1Gd1A3QW1VCmxzd09pV0JRbXROcXo1MjJpZmxl\nZ2NzTGpoamE3Q0xIbFJ1eUd3aHFFcHcKLS0tIHRSUmtiaU9Ma0R2ay9pMzVGdXlo\nVEFlK2x3OFRoSVV0eDE0UXNnNHIzeE0KC4PisOp+kK3oApKhrHKaW74+sN3ExcoH\nS/6lEFO6TyLONqAKzK199n36ZeWtQ4/TDQfS6OHs5092yCuEBsA5dA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOM0RxK1V6aWh4MlRVWUZL\nNVIxMWdKOE5pMDJLeDVoREYzbXlNS0FFL0FRCjJHYlFENVNaY0wwZUgzK0krR05Z\nZjhVUElDZUdoMkVha25obU0zS213Q00KLS0tIFd2T0lYZmliSE04UFdEVml5ZUE3\nb01pNVJ3QjZuNU41NzJ4RUdlOUNlSncKW8yzymtjHOYaIvlX3ZZ/UyD88hZdWAaV\n2j1hEZaUDvQBtfIXdFAGV5EZdlh4KN0V/o59wRQKIe4SUsY62NJoxA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpKZ0cycGpJ\nM2UyVVFTemx4MWZWc2s4amZqV2hJOFIrMm1yeVNzeEZvM2cgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo4TWppcXQ3M0VHQm5IOGk2NWNqSnE5\nNHc4eFl5bEY5cFI2TjVENXdyTkxnCi0tLSBnMmRzd2FNV3JKQXlnNmlnRzFvelIw\ndnF1cnlSOHJCRlVyZVN3WkNTL080ClORWSmBattkhGb8CBUDkrLinpdkZscFQxwx\nQOKwJ0ZqSLRucXBC+0DUN7MhAQY0U+JH7YOYHGqHtZHZc4Jyt9E=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHR3RHdrVkxY\nQlBRU1FiNEVBckxqZlNLa1NUTW1oNkdtZ29Gb082QVhKQkUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwppb0dzTEd2UUhQVG4zcjQxcTNCeTJJ\nUEJYK3FrUkV0WnNBaUdJMkNaT1VzCi0tLSB6enNYNWZCbE4zK3dyTWhXSUd0VjN6\nOURheFFDcXc3WmJyNzVpV3VYTkVnCt9nWs684U44p5578giBIExd1SmUXnoXRl0c\nu9JXv4r+1I7S5fVdaAFA1EPnxi4DNYxTxkI/UTrsRjtdVFdP5DM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGF0RDg2aUlw\nRjI4cUtXTGtKOFhwVVJtbUdQVjlyeFdyaHZ1clEwa2VKQkkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwoxTlpjRmxzMDRiOGxDOURXMnJUbnlQ\nK1dSa29iSUVVZDJQZXNGNGU1U0pjCi0tLSBzSlUxL2Vva2srbWt5ckorc3owTU1t\ndWNRaHF0NDhBaVVzZFE5c2hka2drCiBm5tcYUdm2W+OKe7Jl1wJoc4nxcyjxCVX3\nrRUkUviSTWz6q1+YFdHbn8flgjtxTiCHasm6qoCp8T3FwbNyR/s=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByRVVJQ2laUTljdlZqUGhD\nRndrOEJYTDc5cFM3Vi9ZRVFEcStQNWxqYlU4Cm9kVWJiRVRSUUdXWTBTYnFMV0hG\nczFUVzZ5S3I1ZllLakZ5RVNPMTRhWXMKLS0tIGJza3ovRVRHUEZpY1FYaGRFbHRp\nbHQxem1ncHZERjV3L0JGaEUzQnV6YWcKdMWQKHtTWkb851f9c5KXo7SMfkmQH6tl\nc8qmHjP4LSK8pkltFNi7CY3sAsKP7yqRuFNgjX4o39EStXyG8K7e+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5QnpjRngwTSs4Mk1LeER4\nUnR0VUY3ZTJPNU0rTDhQS3UvVk9QdHByc3gwClZKcWhZM1lCRitrUlNHQ2Z6Tm5h\nYmF0bzA4SjVMT0oyaGwxQ1RIN3BSeUkKLS0tIE5pWnJIOXFpVlg2b3BZMVR5K0RS\nMU03L1JBcC8ydXZCOEx0OVBoME9FK1EKT5HOMbu0jdYVywWbj9Vpi/ENVpyKaIKZ\nGDjPXAbtfKm5o8NKnPu0LvcZ+m/mBtzI49+O5U0O7pv86ccIafzQ0Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArWENWNkFmcldpWjU3K21N\nWGs0ZWlxTWhhQWsxZWExdzBlYTEwZmVXbEZzCmU4L1RQUVdNV3kwZHpSWkRSbTF4\nRHNReUVqYmtuOVZHeE8wVG50bnNYb1kKLS0tIFJQNnloZ0NNb0V6TkUzWjJCVUNh\nQXpPVEZZU1QyY2kyOFlvY0tWRWlyT3MKfiEPCDNdQtheZS+eSa0fVvpSgrCpxb8N\nuTMa6nMDbZbdq5EIeb6Ik/dvdt9hp7oD6rfOw7Kjoa/gpgj1OcFiTw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBTlN3eEpUMytUeUhadE9q\nb3F3SFJxOUNXRVBpQkdKM1VrSUMrdFV3cGw0CldMOXJJUkgzTXk3c0VZSXo0bW5H\nU204NS9kK0d2ZDhpSnhBd3BSK1BNYkkKLS0tIHY3NG9oaCs0dVVrYXJBMFZ1T3Iz\nVFBaTmt5TjV4Q2k2a3p3N05rV0NJVE0Krlo829RhTrF9c7wShMdzQiNibpZLtD8l\nPhOrG/Su4InWaQh0OGDDouxI4Eqm2UrZhqVqAxRJ2g+7X2Pf/Wt02g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-28T07:54:26Z",
+		"mac": "ENC[AES256_GCM,data:JvRD52lIEIsvbzzwp++0y/h+/6atpRjOh/Xr/YwfAlMS1AjiFaBLWmP/xnAiJCUQP9t9v7U2OiiHVo1vmQVaMzh4E7v+bR6O8YuwEKfPH9LeFmZPkSHCBZZpwXylDAJFJg8jF3tzFbbuKLn6RvSew20EJ315EKh2eQJ/+jxNm80=,iv:mzgupwJ8JVb6m2URvJvzoBjDoHctS8bW34x1sPhQHQA=,tag:cUhi1C2OKrvcWqEX2wcaxQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/tor_tor/hostname/users/kurogeek
+++ b/vars/per-machine/ramus/tor_tor/hostname/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/ramus/tor_tor/hs_ed25519_secret_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/tor_tor/hs_ed25519_secret_key/machines/ramus
+++ b/vars/per-machine/ramus/tor_tor/hs_ed25519_secret_key/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/tor_tor/hs_ed25519_secret_key/secret
+++ b/vars/per-machine/ramus/tor_tor/hs_ed25519_secret_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:G80mWuSb7bJ6HNdk4loFypfV+yq4cg/mXN0PJXWgnfhY9FcdEfsY1V1YPdizoVAFiEAcLRryxsY1daHvWDvpkhQlXGIM1gA9X0yHLCCidbJkFBHc6Im727jfFsIR4V/4,iv:QlV3lciRLUieIFszKen+i8Uvy1PKQ4VSQ3rFfnzpyWY=,tag:But89s6We8mrmXKJqFG11w==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6VE9uSkVxZGVIWjhXenJv\nZUpYOWN5K2xFSEdCbWlTU1psNnVsbGR6N21JCjNKRTV4VGdua0E5T1VXNkpocGEr\nRFJudmlhTk53UUNDVk50NnlYRXI3djgKLS0tIHRWQkFGMEV0bDUybHNPdEZHVWt5\naHU3YW1nUUFzc21xNjJ4Nm1mQlJ1VHcKsUZUgR8QA0TQEawls6DW0EnVIbqCk6Hl\npwGjkqnguivb4f/lgxGT5aBMRv+jnor422rxqp+kuOe6R4k5+s0Hug==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3NEo3Q0huOUN2L0d0bmpB\nOXZlNnVtQXRXL2ZkcFJCVEpjTHJhZEVtalU0Cjhpak1tWE4rSW1XM1pLbUlwbjFH\nM1F5WHJGVjd3NFpzTm5JSzkvU2FrUjQKLS0tIGEzM3NhVVM2OURTNHEvVlRML2pD\nYUZSNldoQzhCcGN6Qy9RUU5LN3dYb3MKweLKP62ur/Eeh75sIhFOoVveMybkLPRB\nvtiWRWATiDnYZNmNlIci7jOtSJ/Z96q/11UaNp81Ghk7kQEkqv4Xkw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRWmFGSkNjbFRIWERFeG1F\nM1FTcVgxbTJRSjYrNEFCZ0MzaWdEYjRXZHdrClV4RDNydVlnOFVLNTJYcm5XeWdZ\nRkJpS0pDN3k2K0FHcFQxUU1ZbnFiTGsKLS0tIE9vTlV1S25OQ2J5VUFFOFhNMGJa\neVJlT1FtNFpEWWFNNGVXellYQ0hRdU0KXydH3UO8xW693FY+OIrcVU5RCbUdec6T\nQI2WZbwZwF2FpLbUnf6x2PJ2ipg3ei6XSBgp1ktcaUgeol7aw3WyQw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDBFRG56Qllx\nckpkWmxiUjV0eHYvUEhTS2o1a2hRdGkrZ3dDZkVpTnFIMkEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQozbWtaQWRNS0l0ZWgvblRXR01kNWtx\nMDhYZmdZWnBRQjJhUUlMZEh0TXVnCi0tLSAzMXc5QmFkVFFzWFc0Q010cGFmVk1B\nZFg5bC9PVkVhMTNTQVhjTEhRSHQ4CgB10JWdIuJZChIZG5E3eXhwJ+xHnbgA3CCT\n0waHJvPdZNmNswcs1KORDzkacpJO4pd6IYCr3bZpF3BqptHxYZ0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFYvWE42Qy9o\ncDRlOUxqd0JETVJ1ekRwaU5mN050MFlBQTNGVTdrM1ppUXcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp4cjRxdXhhMzlGcDEyUGtMc0Y4bCtw\ndzV3M1ZyWTVUdnBWYzJLbTRWallBCi0tLSAweG9wanhNUUpSMFFzd25tUEo2ZUVO\nWU84cDVuWjZtSTJxZmlERWQ4YWtRCqhcxU5CYqDGpblCHzvW3bL49aW9daZLwVkC\n3FI6bQOO+1+oA8yhaWY6BKEqyibx4jOwrLnyVONrnlShuVzkUAw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGlWbjdrL3JF\nZ0ZZVUxubTZWL1BZR0tiRWZUVUVScWNmcStua1RUWmx1a3MgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpzTXcranBCRlRKUEk0TGZySE1jMG1Q\nbGdhaDBuRzJjOHBtSmNNbHNFb3ZvCi0tLSBNRE5xdXZWbnNiZVhSOVlXbjZKRUFq\nMDIzREQwYi9oQ3BqRURQQmtLeUJrCjvOLQcFS900yJFdKGlZIkE431lhiS1cDn+8\nmATXAgwuunuVXyJYOHNlC1kvup0aCKJUJP+u74MuNUEVnks52jw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5cGlwU05Xa3U0ek8yUVdz\nQkFQWFRGc21hdVpLc09MUktGZDhzU01iUW5jCkZWY0xQdkwvbUJBaTJwaVFyL2Z3\nWDF0QUg5ck05N2RvNFVYcmgvK3BnSjQKLS0tIEdnNFJTemNnT1Y5azVwUUx6cHJP\nSU5OWGdCbnBMNzZVYUU0SG5kM0RmL2MKIYO5UDMMZJPsqWoJsjP7e0jJ0vtqq79o\nGrm3dE2Cq/nG/hZHZlZ57is+NWIH9WoEI2VaO0YqsQ+Zdp8eWOK/ig==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Ny9Kcy90V1pOd1JONk9q\na0RGd3lIZW85NHN5cjNwNkowVXBhL3F3bVg0CkIyRnl3cmg5UHdRMHZjNWgzclFZ\nc0NLODZ6cllmejl2bk5ZalJ1a1JMc0kKLS0tIHBNMTc1K2xhd1QzWWdXQndKaTU4\neC9jYk4xZ2FobzVNaExlbE5QMUwxZzAKfYGVLCVctVVtq0XlZJv+5gU1iejWy88H\nuLC6e/K2HJWHZ2XFCf1udWzp2eIB1ddM97m7vnAXcMDKfPRPdyI0ZA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Z1BsTVI4QTUrL1UwRDV5\nSHljMXN1bGlaR2s0NTFCa0YrVWxWT2gvYlZZCnBUNnZPbzdlQnIwYkh0d1diMGp3\nTkNzaTZyTHBXdFBWL3JwaFRFQVN1RjQKLS0tIHhGc24vbDFYR01teWhZQml5eTZU\nbHJNR2tDSHBBUi9EUkpNa0p4RENzcGMKc+TMZEWPWd3yGPGdmXNxeJr6nzDa9Erl\ncl/bZyLthkoSZnYj6u3gRarx3pvLLC9Z0SgLCxgN5ep9DwQtXa5X7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmeG15eU5SOWkwUnZmQmZB\nY1NJOE5ZY2xBV2podTBUN3hCcDVkd3JrYVdzCjFQeGN4azlXVWw2eXVQak53WjdC\ncytoaUhqWEgva3dhTVp4WFdqbnZQSjAKLS0tIEV4Skowb2xPVkw1TFlpaUhwRG1D\nNDFpR0NzOFFRVmN3ZHdjaTJOUEFZL0EKSykvmqjT0QMUvmNhQ/1amP9CMsce41D/\n5Dk7/UuJZX7UsfgRF4qDDYb1CA7Ol3zOF4k5wNRXn0Bnki3ykBsWww==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-28T07:54:26Z",
+		"mac": "ENC[AES256_GCM,data:Tkf+Pg9E3Ip7SQkhhIQIPYvYgVxDz8pStTFoGXcnSA8cXhLaN43jhxz5M+FoBMg3oxU3u2pKeCzFaSyCwHdeXQZkfRwMirH7+QRj0kV5Nki9jlLPo0VRUc3aaF2BAYM14Ol3V0LbWxUGQKDwK/HONLqCtR4pKuhaDuJwgL8iSPM=,iv:w9v57yRsLM0TvcCXOQBUGQnDrMWwU2O4dLh5UKbwon0=,tag:FXs7YrHzvdhA1/xjuCU7mA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/tor_tor/hs_ed25519_secret_key/users/kurogeek
+++ b/vars/per-machine/ramus/tor_tor/hs_ed25519_secret_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/zerotier/zerotier-identity-secret/groups/admins
+++ b/vars/per-machine/ramus/zerotier/zerotier-identity-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/zerotier/zerotier-identity-secret/machines/ramus
+++ b/vars/per-machine/ramus/zerotier/zerotier-identity-secret/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/ramus/zerotier/zerotier-identity-secret/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:WY6kTgFo+10SoJYmL7+PJqmcdJQCEXvph/mo5Rc5aXM8x4yuBZeCModRwYBOYNDrMtaZI6xr8wIrZ1vb3dh9/CgxwiWRyu0zTB+d6MhgHCLD3uZA184A29HFQJmLPV1jbh1EopPLQlBztw5dzFqN2+vzwWvt6nFS4mCFJvVq+L0TYQD6r7SJzrIofJpGnBFwiFqVh5NVpmAhmlMJbbK3vKy06//AUBP5e/JNz5+J9MkPGhiehBsEA1TkrZ2fuevwOlOONAF2zWLNyuvMpMH/+Tf8KFwQB76/IGXLdRzRECB+A1rn4lSDeft3vnfZcqwIjfCOgTcVjQSPdkwIdblVpHiKBV/t3msyirVKhvfr,iv:fW+jdFVFfpWWy9jpa5yQxbcYJYMIVWlEWmUjBXRqtE8=,tag:3RfYjX88RuQoyoTOWk4UHA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEYTM2V0FTSEZGaEZnbzA1\nZDE2aUNGK1dHZmh2Z3lDUjJYbFZxS2ZTL3dRCnF3NGJ6VVJkRU9hdmlWOWMyMzNP\nekgvM0QyZFFYVUhFOW5PZDE0dURWcWsKLS0tIFRRR2xuZ0RqZnM5clNHdlU3SFN4\nTSsxajg2M2cxakpmZ29iNUVpOFBOaDgKRgDL0V1nC+7kKzQvMKhBRTUt2bG0BBYu\nYmhpay3KKWsG324MuV+n3J6ibPRSwNhYg6VjdO0lT+VfhT++JPg6Yw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVeC9sN04yeXF1OXBpSEZ2\ncnQ3dWFFQnY1Um1TczVIdzBBMXE4em1pL0FNClhVUEFpcDJpWmhFRWxydWNnbFUw\neVNEZmRiS1Y3TFR0d2dnUWMrMVJpYUkKLS0tIExOMUpzKzZzb0JPaC9VM0M0aFk2\nc3RWcTR6NW9ibDVjMWdtY1BIUTUxdzgKkoqAtuMI3ibOx4BhjaFgka8c/5OCXyow\nUJOrfZtqVJMLYmmtAN/BZbk3beLljkmXie17MjGtH5eVO/QhAcDH7Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkZGZRZUJBRTBqUk91UHh1\nZDRMN3VTbk02YWdnSVVqZ29zb0Vmc21HaUhnClJLT3V0NC9QWVF2Z1labWkrLzBj\ndEQ2cVNUR2xOUGhvaGYxWEkxQ2x6UDQKLS0tIHU5TnhxWVhRSXpaQkdFb0kyVEpP\ncnozaHcyVXk1MDVVNm1UeXNDSkFOa00KiG6pbbAW2KfjUfovP3q1ny8eEZ5zDkV1\nMa1UBEoIOV01P+vCXeVm0bGmR21/53lAUhIgQyJcFJIsGFuctKo0Og==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9tYm5qa3B2\nbW96bjFsZDNZbHd1T241QnI1RE5MR3NxS0dtbWNZWDhXeGMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo4bFRwbEt5dHFXQ2tPN2J2WEI1RDF1\ncUQxVnFDbDEwSCs0dVhEVS9OeVJvCi0tLSBOb3l2VjBGZGlwRzFtYXFyM3hBRVg2\neEtsS1FNdU5CVks1UWtmWkxob0h3CnD57mICPa91qa5uh/9OpSuwkKIzUynRESsc\nvaNYEGbHB5UI1gysjKr8CkjJu9jRvGYF58CSQMr5UXuXppVb2oE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFFJRXBVcEt6\nQVpBRGlrS0JtWmlXVFhkSkptc3RlOVFpWjhPRjRlNFMrd2cgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpWZHpTWmNpVkhEWWlGS0pHajJQSUFV\nb0cweXpaOU4xNGw0SkFWbXN3RUMwCi0tLSBQRnE5UE9zZTRSbUc4OTdZTjJMK3ZP\nM0JjdHEzWDVYNWh0emtBakRwRyswCnQo99tq/B+eABVaxmNrYJgiPsURV7AV97+9\ndokjrWgaceiIWGoElr88TzefzZn9NGsQtdhrpqYMBmYFepZLW8A=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE1BWWtSRDFD\nYWpwakFGQS9qL3hmVWswMElsSThIaUxDS0I3RVVmaFJOVXcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4TEhiQnFwQUJOMFErSjgrcTQ2L0Mz\nemZCckQyYk5aamRYVWV2OEVDZzBnCi0tLSBoeDBsOTBUOUN2S01CUndnS1F1SXhJ\nRG5hbGZhK1JYK2d1VzRQK0h1RnVRCoB/9J5g6DeTm+ZtyU7a0OAXYdI8jgBCMCHe\nslOAG3rdxXIEVnzLJbCqApAbpCaWPfR6uV9klezqcLLn/S7NwFk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjQnltSEdQSFJzS0RBVG10\naFkzRis3ZGxLUTVEMXFaODQ4VUwyWTlvNndrCk51eXM1cExSdENNRnpvWFRDaXFY\nMXhSREVwb1Jzak5MRFdDS2FjVFRFOGcKLS0tIFdjV3YyTUU4eHJ6R21DNkt1ZFFh\nQ1JUSjhDbm9lc1FhRFBOVnh5dWE0dEEK80RUCpj6DS6qq8HOC39J2BwRPe7WSDPp\nU+gnoIQjVg6ZtSF2BLakK6ZIylTGn2cZihfUgvEnyBU7QR70naccmQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1emkrMldpSGZGak1FYW5L\nUEFZTHo5dmJaYk9tVzZxeGNaLytseXpRbkRBCmxJbGhRQ2lnVU9TTjd6Zklxems5\nOWtFWlhIQkJXVm9KeEtVckJoS0o4QlEKLS0tIEZqRDI3VjRHRVFLOXJVOEdhYkEy\nbU1jaUJ1TGUxeG5qMjJBRjh1TUtQemcKCVVn8eyZhg5rL2nBIJeLaX7r2kNN5QNN\nIvd3avnE/FSz11JXXPtOdMx6NZUsqoYAgXz5BazcJHqcr5r3o4xknA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBa2lzMWdFTTkzajlzNEVz\nYW83aWl3ZnE2Z3lMeWZ0UW5KbGxZbTlwSEcwCkh4M21ES3h1UUYxSzhIdGlIaSs0\nRzhMMGhUb2doajJuSkVYVEtMQzI2dVUKLS0tIHU1SEpQeW51SnVTYVVnVWZCdVl2\naGtBTllvK2F6QklTYnVmNE5MRHF3aFkKou1VSbbf8AZbH/QW/gfSRGMolku3VFyX\nTsquZfgHUL4T0aPO9kDMT08I+Q9B90g8/9Hn89uCvAks0XwjGfpULg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ajFQKytkTDMrT1huakdY\naDVBdXV3UHJKd1pqcUZiRXNhejZmeElQWGk4CnB0OG04aGNXbUxlUmVaNDdSSk1D\nYjN1bkhscDhkU0hGV1p3eFpJNFo3NmsKLS0tIEp2dkpzMVh6TjloZWU5UDUxNXRn\nRmtZRWVOSGdWaFFES0NHZlA3Vll5K1EKOZH9n811NgBJ7ULdaMGUrUNKu0xgOV7k\nIIIOZFfRGs2Dk614XhqLu8HrZFjkmHRvQYXd41TsqUGEjcli2SbIMQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:19Z",
+		"mac": "ENC[AES256_GCM,data:f3sm1jjZNFehuasCEtcsWbh5Co+qinsFvvr7cSLp+GoBN/ZU8xjjHsdwc1VMznHmgaYv0m5SueqQXKQmrx+mkfBUHpWrY2X5ZdyjnDpBpInn6TtH0sQ+up0cS/x50WbIkL1eOlOcERHisd9PMOPpjm6lwLGFtK58tVL7cNERuPc=,iv:A38W51dRFKHj94KRNavFoCX3zXScWVzpYfBf9ryLtiQ=,tag:OPgLqBylcwlU24f35ml+Xw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/zerotier/zerotier-identity-secret/users/kurogeek
+++ b/vars/per-machine/ramus/zerotier/zerotier-identity-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/zerotier/zerotier-ip/value
+++ b/vars/per-machine/ramus/zerotier/zerotier-ip/value
@@ -0,0 +1 @@
+fdf7:d53f:344b:8562:2599:9369:62f:7f3
--- a/vars/per-machine/rigel/state-version/version/value
+++ b/vars/per-machine/rigel/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/rigel/tor_tor/hostname/groups/admins
+++ b/vars/per-machine/rigel/tor_tor/hostname/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/tor_tor/hostname/machines/rigel
+++ b/vars/per-machine/rigel/tor_tor/hostname/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/tor_tor/hostname/secret
+++ b/vars/per-machine/rigel/tor_tor/hostname/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:e1PQg24BAyC/h/TwLf5Ml7qZ8LwRtafcFZfhaDXJKjHNYWsn6VUL9xsDsAs7Eg8oCcuSsuZ56JVxVBRa9Qzx,iv:r6mWwkK50GGGY6yZhTcB6lBfsVJ9AZ423YP4bRAZEyk=,tag:TNjYH6l7twUqh9OElovhCg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTNDhiQ2J4dEtaVEFBR284\nRWxnSlR0K3lQZ1g2cnVHMFE2VldUdURCUmpZCjQxaWRJdWRXS1RkUWFqSFVkVlBB\ndHRGdDZNOElZQ1JUU05adnFDZEUwcUUKLS0tIDB0WE5hYU5keDFCRFlOYktkRXRu\nZFZadFc1VEZUYVhTV01ocFljb0xmL0EK6SnTbayrIDMEd8gNS9q8ZNtObhfCfTVZ\nIfiaQSXM6JYKk7HeighAVBsImX9FhS2KXNNvGVF4SqfJpmdCmK/wLg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZnN1dFJUR1hVT1VPVU45\nS1R5MFpCM2lTRjI4Z3NLeE1NWXNlVExnanc0Cmx3QTFTZm42eUczeUtucUN4WmJG\naVc2VVY4L0tsZzdRblJzdTlPaE1KbkEKLS0tIHNIbVV3eEtnSE5odVFhaFFsSDZH\nd250a3hYeFpCVlpBcUw4eWQ4RkZlcU0KG9W60ipSpyxTivKSPz1RaSxombsnPpPU\nq9nNL2qDalk9fejRKzuaB9Dl/CeTzFINWcPOeNB3btFNvaB2co2rIw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGNvOWZhL0dC\nS1czN20rbWIrYi9GWWFWZTZacERmTnR2elRsQjZwcFhpa0EgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpxUEpjMjVNaDFyNjJidlJwWEJONmZF\nU3RkelpOeFgyeHJvWUczaDVyVTU0Ci0tLSBlS0FsdGZmblA1ZHhRM0dqRkpZaUJm\nYUttNU9aY2RIZHhKS3FoK0UyTEtvCuvJ0ubcMiLpb8BAy4S8YcLh85YNOOH8bL7R\nx/DUPMgNNTUOcTQCIxd3uVDpEogPZpU7kPGCNLrzLy++VZ89DGA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDVqeFhXOEtP\nWUx3dVlDdyt1ZlovMkVnOTNaeFFqWUcwSUlwM2JrT3RDQWsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwphWUJVRE53Wm9MTGI0aDJIbk91Y3py\nMHVXcS9YTC9xMWhJRERieEE4V3ZRCi0tLSBTMmhqbENKU1pHVTdzTDI5RmxueTIx\ndERlaUJxeFNnSnpJZURla2dWVDlzClJmwTADzWkCmPYcCuMUtzAmBL+vADhpR0e6\nk5AjAZMTWmGUag6CAJ3wBkvTl/bDJa3lDTacoJGjx0lzby11xRA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEVNa1BWeDVP\nUzJGd2h1WU9Zc3k4VjhLZ3Nyd2VVTkxVcDFUbjI5OGhTVjggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpKU05Ca0dDVnB6SE9PbUZremJybTlH\nSXVBbi91R3dzRE1SVmpzYlZibVdVCi0tLSBRdzY5QVk5SUZYVWdmVGVGNFlkdkU4\nTk9YRGh0YUtnRURRL2xFdzRXUGdzCppDAlBHkWAlaCYvIXSRKebW1iSvfsdB++z1\nFC9BQTuvc2Mb8TqRfb3v6SsYUpYzJRzP6k7mXDC7MyLHZzYcOoY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VGt0MFJDRlkwMXlUbnBq\nVC9CVllqUTdmRGJEZmdTczBhUmQ4bG51VGlZCk5QSk05a1dnVll0QW1POWJZSzFR\nZFJaQXVuMFYxU1ZmWnFmdTVOL2FnUm8KLS0tIFUzSTB4cWQyWDd0RGtUKzA1TUNi\ncVRoaE1mVlQwSk8zS2x5VzUwemdKRU0K3GACITCbRHvY4uOPxRkm8i/sXAxLA2p6\nsej8dfbn32MOnuMQfJNcFEV5mHtOPccrdcrYcvsvbXrnzCDn2sLZTw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ZTBoZFphMzJGOFlHczAr\nVFhVQmJJSVFQTGhLdGRQczBxbGxDN1NvVmlFCktZdEpVVERvQlBtR2xYVG5VRWtF\ncEF1dERhYjJIMDZmeFNHZFhwckNZOGsKLS0tIGZLeUpKVlFRV1B3V3ZVa2ZyZnZN\nQU9BNGptVjc5eUNqcTNsY21GNyt2ZUEKYyScXaKz+w1ZnR3gDQmcC4ZNCycYN+D6\no3lRzyOTIQDm4d82KvcHN3ZZulJ8KY3Qp2RhkEWTbXXbrrKdtk4oJA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPN2s5TldERlRGWHl5VTl5\namxEVGVKaC9DT0I1elZKTTdyaXBndTJRQkRrCk5QK2Q5dmlCc3B0d0ZuV2R1UUVM\nTlRScVppYlZWd0g2b0VueDJTcWVYeE0KLS0tIGtrazhsaldlRkNmaVVWT3FtbVcx\ndUMrUTcwMXRHUkN0aERHd3RGWkgwb3MKCVtknJ6vfMz+MprKzma4o3xYMP/9dsfq\ngKuivAk5ykUusEmaoXKlRykco0z+WQ4wT8K3SBgmpaSy4dsoZp/qTg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRTFpVi9qSStsSzg0YUw2\nYVN3cWs1OUdqdGEvdXUxZUhTVHhESUx5cDBJCnR3aWdaVmVNUytFbTZ0VVRJZ3RT\nOGJtaWl3ZWVpTUl5TGlJc3ZKd1l5aEEKLS0tIDd1NnhDdEl6V1RreEtkMDIyckRp\nWTBkRURteWFzZjZMYWVWQTNxbHMzWmMKJQEGckqfS1mQ+SdT/yZCCdb/wzUjWfsP\nm7sYOdgnVfmA6GvU7mrAhs3Fpne45EIcG9jJuoI/tQhgmzY2y4Jxuw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-28T07:54:29Z",
+		"mac": "ENC[AES256_GCM,data:zmmnwXeXQwkx3PLQLHIM5wpnMEaqulvfK9ThnOTl38Mo1SUyuuSbVwSz1CCuewlr+VBHeSOMQ6ETrSthjAeVCr840pa2FDSULqg4300eXV3IcbmZXSEgJ+law+SSUd49lPBAlBYLPZ5goYYXMuPQSPnHB8u9QC6EEiKXMd55cZM=,iv:zktgJ52cVMq2xPbWtI/nizLrMGFAhBe0ozPMfCKYruU=,tag:F/iqRpeiRtRWkNuaEHpp0g==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rigel/tor_tor/hostname/users/kurogeek
+++ b/vars/per-machine/rigel/tor_tor/hostname/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rigel/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/rigel/tor_tor/hs_ed25519_secret_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/tor_tor/hs_ed25519_secret_key/machines/rigel
+++ b/vars/per-machine/rigel/tor_tor/hs_ed25519_secret_key/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	7a381a310e	tor connection	2025-11-28 14:55:21 +07:00
kurogeek	36c31507e2	Update vars via generator tor_tor for machine vega	2025-11-28 14:54:35 +07:00
kurogeek	bfea371501	Update vars via generator tor_tor for machine sirius	2025-11-28 14:54:32 +07:00
kurogeek	ff0bc698d4	Update vars via generator tor_tor for machine rigel	2025-11-28 14:54:29 +07:00
kurogeek	11c109970a	Update vars via generator tor_tor for machine ramus	2025-11-28 14:54:26 +07:00
kurogeek	ad95a8710c	Update vars via generator tor_tor for machine b4l	2025-11-28 14:54:23 +07:00
kurogeek	e6760d320d	ramus machine	2025-11-26 14:01:11 +07:00
kurogeek	bfeea4156b	disappearing default route is fixed by a hacky way	2025-11-21 16:53:55 +07:00
kurogeek	3aa93c1333	nameservers whitehouse	2025-11-18 13:58:59 +07:00
kurogeek	b541e9ff4c	Update vars via generator state-version for machine rigel	2025-11-10 14:48:37 +07:00
kurogeek	bdf1e3e5bc	Update vars via generator state-version for machine b4l	2025-11-10 14:48:37 +07:00
kurogeek	ab88d74226	sirius WhiteHouse NAS	2025-11-10 14:47:09 +07:00
kurogeek	162707546c	whitehouse router: add vlan on wan interface	2025-11-07 15:04:26 +07:00
kurogeek	2c9592c542	more packages on common	2025-11-06 15:57:01 +07:00
kurogeek	0bb6314a03	Update vars via generator state-version for machine vega	2025-11-05 16:22:09 +07:00
kurogeek	13df0a8421	common nixos module	2025-11-05 16:21:50 +07:00
kurogeek	4259d8014e	use upstream clan testModule	2025-10-31 13:53:16 +07:00
kurogeek	71a3ca375f	nixpkgs go back to rev d7f52a7a640bc54c7bb414cca603835bf8dd4b10 since the new one has issue with clan tests	2025-10-31 13:52:52 +07:00
kurogeek	891504f173	rename checks services	2025-10-30 12:03:24 +07:00
kurogeek	5ffbe0ed9b	bump clan-core, nixpkgs	2025-10-30 11:59:22 +07:00
kurogeek	7115a93a0b	clanService asterisk	2025-10-22 16:40:59 +07:00
kurogeek	b5f3adacd8	clanService yggdrasil add vars yggdrasil/yggdrasil-subnet	2025-10-21 15:55:18 +07:00
kurogeek	2eb52251cc	clanService yggdrasil	2025-10-17 16:58:43 +07:00
kurogeek	be25560858	WhiteHouse router configuration	2025-10-16 14:53:41 +07:00
kurogeek	e4bf326191	add Alex's laptop to networks	2025-10-10 15:38:28 +07:00
kurogeek	04fafa32d3	update kurogeek thinkpad zerotier id	2025-10-09 16:42:23 +07:00
kurogeek	ed4e045ffc	rm unused args	2025-09-28 13:30:10 +07:00
kurogeek	fd6edd83c2	machines are accessed by zerotier ip	2025-09-28 13:21:46 +07:00
kurogeek	65faa70fa3	no nextcloud on vega	2025-09-28 12:45:29 +07:00
kurogeek	377b63437c	no write permission on GLOM samba	2025-09-26 20:26:02 +07:00
kurogeek	43e8252459	samba for vega	2025-09-26 16:46:00 +07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvItw14tB6fc6gdZalSkZPOUSWGsTNyLnXk4yLAnkrb`