bump nixpkgs

rm clanService/pingvin
no clanService warnings
2026-01-15 11:35:36 +07:00 · 2026-01-15 11:35:12 +07:00 · 2026-01-15 10:26:57 +07:00 · 2026-01-15 09:59:37 +07:00 · 2026-01-01 00:00:00 +00:00 · 2026-01-12 13:07:56 +07:00
92 changed files with 6645 additions and 198 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764799743,
-        "narHash": "sha256-MbbiNG/bhqe+4z7ml8TefIs4swSonmiV0CimCntXuCg=",
+        "lastModified": 1766984802,
+        "narHash": "sha256-SYZ/MXVtJEb3sRWxvPL/2HtpSL1CzQgu1o8ASXqCO98=",
        "ref": "refs/heads/main",
-        "rev": "ddc0f9fabf33ad000676a33e97be6b5df12a4560",
-        "revCount": 11417,
+        "rev": "052b66d8dc724c3e519b9003281c2f9a210fc380",
+        "revCount": 11770,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -49,11 +49,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1762942435,
-        "narHash": "sha256-zIWGs5FIytTtJN+dhDb8Yx+q4TQI/yczuL539yVcyPE=",
-        "rev": "0ee328404b12c65e8106bde9e9fab8abf4ecada4",
+        "lastModified": 1766977667,
+        "narHash": "sha256-LUALgG4ZpsA0k7pGYzMDto/r6T8aIPlYTok3lGlojjA=",
+        "rev": "3f852546b5d8bd2e9659a81c6b2cc14922e63a94",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0ee328404b12c65e8106bde9e9fab8abf4ecada4.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/3f852546b5d8bd2e9659a81c6b2cc14922e63a94.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -88,11 +88,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764627417,
-        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
+        "lastModified": 1766150702,
+        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
+        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
        "type": "github"
      },
      "original": {
@@ -121,6 +121,26 @@
        "type": "github"
      }
    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768068402,
+        "narHash": "sha256-bAXnnJZKJiF7Xr6eNW6+PhBf1lg2P1aFUO9+xgWkXfA=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "8bc5473b6bc2b6e1529a9c4040411e1199c43b4c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
    "import-tree": {
      "locked": {
        "lastModified": 1752730890,
@@ -162,11 +182,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764161084,
-        "narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
+        "lastModified": 1766784396,
+        "narHash": "sha256-rIlgatT0JtwxsEpzq+UrrIJCRfVAXgbYPzose1DmAcM=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "e95de00a471d07435e0527ff4db092c84998698e",
+        "rev": "f0c8e1f6feb562b5db09cee9fb566a2f989e6b55",
        "type": "github"
      },
      "original": {
@@ -190,11 +210,11 @@
    },
    "nixos-facter-modules": {
      "locked": {
-        "lastModified": 1764252389,
-        "narHash": "sha256-3bbuneTKZBkYXlm0bE36kUjiDsasoIC1GWBw/UEJ9T4=",
+        "lastModified": 1766558141,
+        "narHash": "sha256-Ud9v49ZPsoDBFuyJSQ2Mpw1ZgAH/aMwUwwzrVoetNus=",
        "owner": "nix-community",
        "repo": "nixos-facter-modules",
-        "rev": "5ea68886d95218646d11d3551a476d458df00778",
+        "rev": "e796d536e3d83de74267069e179dc620a608ed7d",
        "type": "github"
      },
      "original": {
@@ -205,11 +225,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1761656231,
-        "narHash": "sha256-krgZxGAIIIKFJS+UB0l8do3sYUDWJc75M72tepmVMzE=",
+        "lastModified": 1768395095,
+        "narHash": "sha256-ZhuYJbwbZT32QA95tSkXd9zXHcdZj90EzHpEXBMabaw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d7f52a7a640bc54c7bb414cca603835bf8dd4b10",
+        "rev": "13868c071cc73a5e9f610c47d7bb08e5da64fdd5",
        "type": "github"
      },
      "original": {
@@ -224,6 +244,7 @@
        "clan-core": "clan-core",
        "devshell": "devshell",
        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
        "import-tree": "import-tree",
        "liminix": "liminix",
        "nixpkgs": "nixpkgs",
@@ -238,11 +259,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764483358,
-        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "lastModified": 1766894905,
+        "narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -15,6 +15,10 @@
      inputs.nixpkgs-lib.follows = "nixpkgs";
      url = "github:hercules-ci/flake-parts";
    };
+    home-manager = {
+      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
+    };
    import-tree.url = "github:vic/import-tree";
    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
    treefmt-nix = {
@@ -61,6 +65,7 @@
            };
            packages.think = pkgs.think-gtcm;
            packages.think-be = pkgs.think-backend-gtcm;
+            packages.file-uploader = pkgs.gtcm-file-uploader;
          };
      }
    );
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -1,4 +1,5 @@
 {
+  imports = [ ./personal-computer.nix ];
  clan = {
    inventory = {

@@ -11,6 +12,7 @@
        b4l = [
          "rigel"
          "neptune"
+          "rana"
        ];
        phonebox = [
          "neptune"
@@ -160,13 +162,6 @@
          };
          roles.default.machines.b4l = { };
        };
-        pingvin = {
-          module = {
-            name = "pingvin";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
        paperless = {
          module = {
            name = "paperless";
@@ -200,6 +195,54 @@
            };
          };
        };
+        git-daemon = {
+          module = {
+            name = "git-daemon";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.repositories =
+              let
+                defaults = rec {
+                  write-access = [
+                    "10.0.0.0/24"
+                    "200:d7b1:c5d5:ea7:27ad:6837:40f6:404d/128"
+                  ];
+                  read-access = write-access;
+                };
+                PUBLIC = {
+                  read-access = [
+                    "10.0.0.0/24"
+                    "0200::/7"
+                  ];
+                };
+              in
+              builtins.mapAttrs (_: override: defaults // override) {
+                "9e" = PUBLIC;
+                archive-dl = { };
+                barrytown = { };
+                cleanroom = PUBLIC;
+                community-memory = { };
+                eris = { };
+                ftdi-sd-spi = { };
+                go-go-gadget = { };
+                hacking-the-kindle = { };
+                islands = PUBLIC;
+                kt = { };
+                legba = { };
+                llb = PUBLIC;
+                llc = PUBLIC;
+                lora = { };
+                mute = { };
+                navi = { };
+                notmuch-memoryhole = PUBLIC;
+                pms5003 = { };
+                thinc = PUBLIC;
+                toad = { };
+                yggdrasil-erlang = { };
+              };
+          };
+        };
      };
    };
  };
--- a/inventories/personal-computer.nix
+++ b/inventories/personal-computer.nix
@@ -0,0 +1,37 @@
+{
+  clan.inventory = {
+    tags = {
+      kde-desktop = [ "rana" ];
+      personal-computer = [ "rana" ];
+    };
+
+    instances = {
+      emmie-home = {
+        module = {
+          name = "home-user";
+          input = "self";
+        };
+        roles.default.settings = {
+          username = "emmie";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
+        roles.default.machines."rana" = { };
+      };
+      personal-computer = {
+        module = {
+          name = "personal-computer";
+          input = "self";
+        };
+        roles.default.tags."personal-computer" = { };
+      };
+      kde = {
+        module = {
+          name = "kde";
+          input = "clan-core";
+        };
+        roles.default.tags."kde-desktop" = { };
+      };
+    };
+  };
+}
--- a/inventory.json
+++ b/inventory.json
@@ -20,6 +20,9 @@
    },
    "buna": {
      "installedAt": 1765343708
+    },
+    "rana": {
+      "installedAt": 1768294839
    }
  }
 }
--- a/machines/adhil/configuration.nix
+++ b/machines/adhil/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "adhil";
-  clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
+  clan.core.settings.name = "adhil";
+  # clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";

 }
--- a/machines/almach/configuration.nix
+++ b/machines/almach/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "almach";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "almach";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";

 }
--- a/machines/alpheratz/configuration.nix
+++ b/machines/alpheratz/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "alpheratz";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "alpheratz";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";

 }
--- a/machines/b4l/services/nextcloud.nix
+++ b/machines/b4l/services/nextcloud.nix
@@ -19,7 +19,7 @@ in

  services.nextcloud = {
    hostName = ncDomain;
-    package = pkgs.nextcloud31;
+    package = pkgs.nextcloud32;

    settings = {

--- a/machines/b4l/services/pingvin.nix
+++ b/machines/b4l/services/pingvin.nix
@@ -1,45 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-let
-  serviceName = "${config.networking.hostName}-pingvin";
-  domain-name = "${
-    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
-  }.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators."${serviceName}" = {
-    files = {
-      subdomain.secret = false;
-    };
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Pingvin. Default:(share)";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "share" > "$out"/subdomain
-      fi
-    '';
-  };
-
-  services.pingvin-share = {
-    nginx.enable = true;
-    https = true;
-    hostname = domain-name;
-  };
-}
--- a/machines/buna/configuration.nix
+++ b/machines/buna/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "buna";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
+  clan.core.settings.name = "buna";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";

 }
--- a/machines/mirach/configuration.nix
+++ b/machines/mirach/configuration.nix
@@ -7,7 +7,7 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  # clan.core.networking.targetHost = "root@";

-  clan.meta.name = "mirach";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "mirach";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";

 }
--- a/machines/neptune/configuration.nix
+++ b/machines/neptune/configuration.nix
@@ -56,7 +56,7 @@
    "tls://astrra.space:55535"
  ];

-  clan.meta.name = "neptune";
-  clan.meta.description = "Radxa SBC board for testing. (With vi)";
+  clan.core.settings.name = "neptune";
+  # clan.meta.description = "Radxa SBC board for testing. (With vi)";

 }
--- a/machines/ramus/configuration.nix
+++ b/machines/ramus/configuration.nix
@@ -5,10 +5,10 @@
    system = "x86_64-linux";
  };

-  clan.meta.name = "ramus";
-  clan.meta.description = ''
-    A Hetzner VPS machine own by Alex.
-  '';
+  clan.core.settings.name = "ramus";
+  # clan.meta.description = ''
+  #   A Hetzner VPS machine own by Alex.
+  # '';

  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
--- a/machines/ramus/think-greater-chiangmai.nix
+++ b/machines/ramus/think-greater-chiangmai.nix
@@ -1,6 +1,6 @@
 { self, config, ... }:
 let
-  commonSettings = {
+  commonSettings = rec {
    APP_NAME = "Laravel";
    APP_ENV = "local";
    APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
@@ -13,6 +13,7 @@ let
    DB_DATABASE = "thinkgtcm";
    DB_USERNAME = "gtcm";

+    R2_SCHEMA_URL = "https://${R2_BUCKET}.${R2_REGION}.your-objectstorage.com/test-large-files/";
    R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
    R2_SECRET_ACCESS_KEY._secret =
      config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
@@ -20,6 +21,8 @@ let
    R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
    R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;

+    R2_BUCKET_NAME = R2_BUCKET;
+
    LOG_CHANNEL = "stack";
    LOG_LEVEL = "debug";

--- a/machines/rana/configuration.nix
+++ b/machines/rana/configuration.nix
@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
--- a/machines/rana/disko.nix
+++ b/machines/rana/disko.nix
@@ -0,0 +1,90 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/nvme-SAMSUNG_MZVL81T0HFLB-00BLL_S7XKNF0Y966645";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/rana/facter.json
+++ b/machines/rana/facter.json
--- a/machines/sirius/configuration.nix
+++ b/machines/sirius/configuration.nix
@@ -19,7 +19,6 @@
    system = "x86_64-linux";
  };

-  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
  system.stateVersion = "25.11";

 }
--- a/modules/clan/actual-budget/default.nix
+++ b/modules/clan/actual-budget/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "actual-budget";
  manifest.description = "A local-first personal finance app ";
+  manifest.readme = "A local-first personal finance app";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "A default server role.";

    perInstance.nixosModule =
      {
--- a/modules/clan/git-daemon/default.nix
+++ b/modules/clan/git-daemon/default.nix
@@ -0,0 +1,174 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "git-daemon";
+  manifest.description = "a really simple server for git repositories";
+  manifest.readme = "a really simple server for git repositories";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options = with lib; {
+          directory = lib.mkOption {
+            type = types.str;
+            default = "/var/git";
+          };
+          repositories = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      read-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                      write-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            pkgs,
+            lib,
+            config,
+            ...
+          }:
+          {
+            systemd.services.git-init = {
+              serviceConfig = {
+                Type = "oneshot";
+                User = config.services.gitDaemon.user;
+                Group = config.services.gitDaemon.group;
+                ExecStartPre = toString [
+                  "+${pkgs.coreutils}/bin/install"
+                  "--directory"
+                  "--owner=${config.services.gitDaemon.user}"
+                  "--group=${config.services.gitDaemon.group}"
+                  "--mode=0750"
+                  settings.directory
+                ];
+                ExecStart =
+                  let
+                    git-template = pkgs.stdenv.mkDerivation {
+                      name = "git-template";
+                      buildCommand = ''
+                        cp --no-preserve=mode,ownership --recursive \
+                          ${pkgs.git}/share/git-core/templates $out
+                        install -m550 $out/hooks/post-update{.sample,}
+                      '';
+                    };
+                    init-script =
+                      { name, ... }:
+                      pkgs.writeShellScript "git-init-${name}" ''
+                        ${pkgs.git}/bin/git init \
+                          --bare --template=${git-template} --shared=0660 \
+                          ${settings.directory}/${name}.git
+                        ${pkgs.git}/bin/git \
+                          -C ${settings.directory}/${name}.git \
+                          config set receive.denyNonFastforwards false
+                      '';
+                  in
+                  map init-script (lib.attrValues settings.repositories);
+              };
+            };
+
+            services.gitDaemon = {
+              enable = true;
+              user = "git";
+              group = "git";
+              options =
+                let
+                  firewall = pkgs.writeText "git-daemon-firewall.json" (
+                    builtins.toJSON (builtins.attrValues settings.repositories)
+                  );
+                  hook = pkgs.writers.writePython3 "hook.py" { flakeIgnore = [ "E" ]; } ''
+                    import os, sys, enum, pathlib, ipaddress, json
+
+                    class Service(enum.Enum):
+                        UploadPack = enum.auto()
+                        ReceivePack = enum.auto()
+                        UploadArchive = enum.auto()
+
+                        @classmethod
+                        def parse(cls, string):
+                            return {
+                                'upload-pack': cls.UploadPack,
+                                'receive-pack': cls.ReceivePack,
+                                'upload-archive': cls.UploadArchive
+                            }[string]
+
+                        @property
+                        def service(self):
+                            return {
+                                UploadPack: 'read-access',
+                                ReceivePack: 'write-access'
+                            }[self]
+                    UploadPack = Service.UploadPack
+                    ReceivePack = Service.ReceivePack
+
+                    def parse_remote_addr(remote_addr):
+                        if remote_addr.startswith('[') and remote_addr.endswith(']'):
+                            return ipaddress.ip_address(remote_addr[1:-1])
+                        return ipaddress.ip_address(remote_addr)
+
+                    service = Service.parse(sys.argv[1])
+                    repo = pathlib.Path(sys.argv[2]).stem
+                    client = parse_remote_addr(os.environ['REMOTE_ADDR'])
+
+                    with open("${firewall}", 'r') as f:
+                        firewall = json.load(f)
+
+                    for rule in firewall:
+                        if rule["name"] == repo:
+                           for network in rule[service.service]:
+                               if client in ipaddress.ip_network(network):
+                                   sys.exit(0)
+                    print('stairway denied')
+                    sys.exit(1)
+                  '';
+                in
+                toString [
+                  "--enable=upload-pack"
+                  "--enable=receive-pack"
+                  "--disable=upload-archive"
+                  "--access-hook=${hook}"
+                  "--informative-errors"
+                ];
+              exportAll = true;
+              basePath = settings.directory;
+            };
+
+            systemd.services.git-daemon = {
+              requires = [ "git-init.service" ];
+              after = [ "git-init.service" ];
+            };
+
+            networking.firewall.allowedTCPPorts = [ 9418 ];
+          };
+      };
+  };
+}
--- a/modules/clan/git-daemon/flake-module.nix
+++ b/modules/clan/git-daemon/flake-module.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    git-daemon = module;
+  };
+}
--- a/modules/clan/grafana/default.nix
+++ b/modules/clan/grafana/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "grafana";
  manifest.description = "Platform for data analytics and monitoring";
+  manifest.readme = "Platform for data analytics and monitoring";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "A default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/home-profiles/flake-module.nix
+++ b/modules/clan/home-profiles/flake-module.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    home-user = lib.modules.importApply ./home-user { };
+  };
+}
--- a/modules/clan/home-profiles/home-user/default.nix
+++ b/modules/clan/home-profiles/home-user/default.nix
@@ -0,0 +1,64 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "common-user-home-manager";
+  manifest.description = "General users' home-manager profile generator";
+  manifest.readme = "General users' home-manager profile generator";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default role for the user";
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          username = lib.mkOption {
+            type = lib.types.str;
+          };
+          kbLayout = lib.mkOption {
+            type = lib.types.str;
+            default = "us";
+          };
+          kbOptions = lib.mkOption {
+            type = lib.types.str;
+            default = "grp:win_space_toggle";
+          };
+        };
+      };
+    perInstance =
+      { settings, ... }:
+      {
+        nixosModule =
+          { inputs, ... }:
+          let
+            username = settings.username;
+          in
+          {
+            imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+            users.users.${username} = {
+              initialPassword = "";
+              isNormalUser = true;
+              extraGroups = [
+                "audio"
+                "video"
+                "networkmanager"
+              ];
+            };
+
+            services.xserver = {
+              enable = true;
+              xkb.layout = settings.kbLayout;
+              xkb.options = settings.kbOptions;
+            };
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.${username} = ./home.nix;
+            home-manager.extraSpecialArgs = {
+              inherit inputs username;
+            };
+          };
+      };
+  };
+}
--- a/modules/clan/home-profiles/home-user/home.nix
+++ b/modules/clan/home-profiles/home-user/home.nix
@@ -0,0 +1,24 @@
+{
+  osConfig,
+  pkgs,
+  lib,
+  username,
+  ...
+}:
+{
+  home = {
+    inherit username;
+    homeDirectory = lib.mkForce "/home/${username}";
+    stateVersion = osConfig.system.stateVersion;
+    packages = with pkgs; [
+      libreoffice
+      element-desktop
+      brave
+      firefox
+      keepassxc
+      vlc
+      thunderbird
+    ];
+  };
+  programs.home-manager.enable = true;
+}
--- a/modules/clan/jukebox/default.nix
+++ b/modules/clan/jukebox/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "jukebox";
  manifest.description = "mpd server, library on removable disks";
+  manifest.readme = "mpd server, library on removable disks";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    interface =
      { lib, ... }:
      {
@@ -111,19 +113,22 @@

            services.mpd = {
              enable = true;
-              musicDirectory = settings.baseDir;
-              network.listenAddress = "any";
-              extraConfig = ''
-                audio_output {
-                  type "pulse"
-                  name "jukebox"
-                  server "localhost"
+              openFirewall = true;
+              settings = {
+                bind_to_address = "any";
+                music_directory = settings.baseDir;
+                audio_output = [
+                  {
+                    type = "pulse";
+                    name = "jukebox";
+                    server = "localhost";
                  }
-              '';
+                ];
+              };
            };

            networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
-              allowedTCPPorts = [ config.services.mpd.network.port ];
+              allowedTCPPorts = [ config.services.mpd.settings.port ];
            });

            environment.systemPackages = [ pkgs.mpc ];
--- a/modules/clan/nextcloud/default.nix
+++ b/modules/clan/nextcloud/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "nextcloud";
  manifest.description = "Nextcloud server, a safe home for all your data";
+  manifest.readme = "Nextcloud server, a safe home for all your data";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/paperless/default.nix
+++ b/modules/clan/paperless/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "paperless";
  manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.readme = "A community-supported supercharged document management system: scan, index and archive all your documents";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/personal-computer/automatic-timezone.nix
+++ b/modules/clan/personal-computer/automatic-timezone.nix
@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  services.automatic-timezoned.enable = true;
+  services.geoclue2 = {
+    enableDemoAgent = lib.mkForce true;
+    geoProviderUrl = "https://beacondb.net/v1/geolocate";
+  };
+}
--- a/modules/clan/personal-computer/default.nix
+++ b/modules/clan/personal-computer/default.nix
@@ -0,0 +1,21 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "personal-computer";
+  manifest.description = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.readme = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "an only one default role";
+    perInstance.nixosModule =
+      { inputs, lib, ... }:
+      {
+        imports = [
+          (inputs.import-tree.initFilter (
+            p: !lib.hasSuffix "default.nix" p && !lib.hasSuffix "flake-module.nix" p
+          ) ./.)
+        ];
+      };
+  };
+}
--- a/modules/clan/personal-computer/desktop-environment.nix
+++ b/modules/clan/personal-computer/desktop-environment.nix
@@ -0,0 +1,4 @@
+{ config, ... }:
+{
+  security.pam.services."sddm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+}
--- a/modules/clan/personal-computer/flake-module.nix
+++ b/modules/clan/personal-computer/flake-module.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    personal-computer = lib.modules.importApply ./default.nix { };
+  };
+}
--- a/modules/clan/personal-computer/libinput.nix
+++ b/modules/clan/personal-computer/libinput.nix
@@ -0,0 +1,11 @@
+{
+  services = {
+    libinput = {
+      enable = true;
+      touchpad = {
+        disableWhileTyping = true;
+        naturalScrolling = true;
+      };
+    };
+  };
+}
--- a/modules/clan/personal-computer/printing.nix
+++ b/modules/clan/personal-computer/printing.nix
@@ -0,0 +1,62 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  allowManageGroups = [
+    "root"
+    "wheel"
+    "lpadmin"
+  ];
+  polkitAllowGroups = builtins.concatStringsSep "||" (
+    builtins.map (group: ''subject.isInGroup("${group}")'') allowManageGroups
+  );
+
+  printerMember = lib.map (user: user.name) (
+    lib.attrsets.attrsToList (
+      lib.attrsets.filterAttrs (name: value: value.isNormalUser) config.users.users
+    )
+  );
+
+in
+{
+  services.printing = {
+    enable = true;
+    drivers = [
+      pkgs.brlaser
+      pkgs.gutenprint
+    ];
+
+    extraFilesConf = ''
+      SystemGroup ${builtins.concatStringsSep " " allowManageGroups}
+    '';
+  };
+
+  security.polkit = {
+    enable = true;
+
+    extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        var actionMatchs = (
+          action.id.indexOf('org.opensuse.cupspkhelper.mechanism.') === 0
+        );
+        if (actionMatchs) {
+          if (${polkitAllowGroups}) {
+            return polkit.Result.YES
+          }
+        }
+      });
+    '';
+  };
+
+  hardware.sane = {
+    enable = true;
+  };
+
+  users.groups.lpadmin.members = printerMember;
+  users.groups.lp.members = printerMember;
+  users.groups.scanner.members = printerMember;
+
+}
--- a/modules/clan/personal-computer/users.nix
+++ b/modules/clan/personal-computer/users.nix
@@ -0,0 +1,11 @@
+{ lib, ... }:
+{
+  users.mutableUsers = lib.mkForce true;
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if ((action.id == "org.freedesktop.accounts.change-own-password")) {
+        return polkit.Result.AUTH_SELF;
+      }
+    });
+  '';
+}
--- a/modules/clan/personal-computer/wireless.nix
+++ b/modules/clan/personal-computer/wireless.nix
@@ -0,0 +1,4 @@
+{
+  networking.networkmanager.enable = true;
+  hardware.bluetooth.enable = true;
+}
--- a/modules/clan/phonebox/default.nix
+++ b/modules/clan/phonebox/default.nix
@@ -1,11 +1,16 @@
-{ clanLib, ... }:
+{
+  clanLib,
+  ...
+}:
 {
  _class = "clan.service";
  manifest.name = "phonebox";
-  manifest.description = "";
+  manifest.description = "A peer to peer phone relay network built on top of yggdrasil.";
+  manifest.readme = "A peer to peer phone relay network built on top of yggdrasil.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    interface =
      { lib, ... }:
      {
@@ -14,6 +19,11 @@
          description = "An Ethernet interface that connect to ATA box.";
          default = "enp2s0";
        };
+        options.ownerName = lib.mkOption {
+          type = lib.types.str;
+          description = "";
+          default = "";
+        };
      };
    perInstance =
      {
@@ -22,6 +32,7 @@
        ...
      }:
      {
+
        nixosModule =
          {
            lib,
@@ -34,12 +45,57 @@
              propagatedNativeBuildInputs = [ pkgs.spandsp3 ];
            });

+            machines = lib.attrNames roles.default.machines;
+
            user = "asterisk";
            faxDir = "/run/asterisk/fax";
            rtpPortFrom = 10000;
            rtpPortTo = 20000;
            ata-interface = settings.ata-ethernet-iface;

+            contactList = builtins.map (machineName: {
+              name = "${clanLib.getPublicValue {
+                flake = config.clan.core.settings.directory;
+                machine = machineName;
+                generator = "phonebox";
+                file = "owner-name";
+                default = null;
+              }}";
+              number = "${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "server-prefix-number";
+                  default = null;
+                }
+              }${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "ata-local-number";
+                  default = null;
+                }
+              }";
+            }) machines;
+
+            createContactListTiff =
+              let
+                contactTXT = lib.concatStringsSep "\n" (
+                  builtins.map (contact: "${contact.number}\t\t: \t\t${contact.name}") contactList
+                );
+              in
+              pkgs.writeShellApplication {
+                name = "create-contact-tiff";
+                text = ''
+                  magick -background white -fill black -pointsize 20 -font DejaVu-Sans label:"${contactTXT}" "$1"
+                  magick "$1" -border 20x50 -bordercolor white "$1"
+                  magick "$1" -resize 1728x -units PixelsPerInch -compress Group4 -density 204x196 -monochrome -depth 1 "$1"
+                '';
+                runtimeInputs = [ pkgs.imagemagick ];
+              };
+
            genServerSIPEndpoint =
              { hostname, address }:
              ''
@@ -102,26 +158,35 @@
                throw "clanService/yggdrasil is required";
          in
          {
-            clan.core.vars.generators.phonebox = {
+            clan.core.vars.generators.phonebox = builtins.break {
              files = {
                server-prefix-number.secret = false;
                ata-local-number.secret = false;
+                owner-name.secret = false;
              };

              prompts = {
                server-prefix-number = {
                  type = "line";
+                  persist = true;
                  description = "Server prefix number: indicate server to connect to [10XX]";
                };
                ata-local-number = {
+                  persist = true;
                  type = "line";
                  description = "Local suffix number: indicate local number on the server [XX00]";
                };
+                owner-name = {
+                  persist = true;
+                  type = "line";
+                  description = "The owner's name for this unit";
+                };
              };

              script = ''
                cat $prompts/server-prefix-number > $out/server-prefix-number
                cat $prompts/ata-local-number > $out/ata-local-number
+                cat $prompts/owner-name > $out/owner-name
              '';
            };

@@ -199,7 +264,6 @@
              package = lib.mkDefault asterisk;
              confFiles =
                let
-                  machines = lib.attrNames roles.default.machines;
                  nodes = builtins.foldl' (
                    nodes: name:
                    nodes
@@ -275,9 +339,16 @@
                      same => n,Set(FAXFILE=${faxDir}/echo-''${UNIQUEID}.tiff)
                      same => n,Set(FAXECHO=true)

+                      exten => 888,1,Answer()
+                      same => n,Set(FAXFILE=${faxDir}/contact.tiff)
+                      same => n,System(${lib.getExe createContactListTiff} ''${FAXFILE})
+                      same => n,Set(FAXECHO=true)
+                      same => n,Playback(vm-goodbye)
+                      same => n,Wait(3)
+
                      exten => h,1,GotoIf($[''${FAXECHO}]?sendfax)
                      same => n,Hangup()
-                      same => n(sendfax),Originate(PJSIP/00,app,SendFAX,${faxDir}/echo-''${UNIQUEID}.tiff)
+                      same => n(sendfax),Originate(PJSIP/00,app,SendFAX,''${FAXFILE})
                      same => n,Set(FAXECHO=false)

                    ''
@@ -341,6 +412,10 @@
                };
            };

+            environment.systemPackages = [
+              createContactListTiff
+            ];
+
            systemd.tmpfiles.rules = [
              "d ${faxDir}                            0755 ${user} ${user} - -"
            ];
--- a/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/owner-name/value
+++ b/modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/owner-name/value
@@ -0,0 +1 @@
+fake_line_value
--- a/modules/clan/pingvin/default.nix
+++ b/modules/clan/pingvin/default.nix
@@ -1,23 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "pingvin";
-  manifest.description = "A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient file sharing.";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-
-    perInstance.nixosModule =
-      {
-        config,
-        ...
-      }:
-      {
-        services.pingvin-share = {
-          enable = true;
-        };
-
-        clan.core.state.pingvin-share.folders = [ config.services.pingvin-share.dataDir ];
-      };
-  };
-}
--- a/modules/clan/pingvin/flake-module.nix
+++ b/modules/clan/pingvin/flake-module.nix
@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    pingvin = module;
-  };
-
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-pingvin = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/pingvin" = module;
-      };
-    };
-}
--- a/modules/clan/pingvin/tests/vm/default.nix
+++ b/modules/clan/pingvin/tests/vm/default.nix
@@ -1,42 +0,0 @@
-{
-  ...
-}:
-{
-  name = "service-pingvin";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        pingvin-test = {
-          module.name = "@clan/pingvin";
-          module.input = "self";
-          roles.default.machines."server".settings = { };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      services.pingvin-share = {
-        hostname = "share.localhost";
-        frontend.port = 3000;
-        backend.port = 8000;
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("pingvin-share-frontend")
-
-    server.succeed("systemctl status pingvin-share-frontend")
-    server.wait_for_open_port(3000)
-    server.wait_for_open_port(8000)
-    server.succeed("curl -H \"Host: share.localhost\" http://127.0.0.1:3000 ")
-  '';
-}
--- a/modules/clan/pocket-id/default.nix
+++ b/modules/clan/pocket-id/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "pocket-id";
  manifest.description = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
+  manifest.readme = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";

    perInstance.nixosModule =
      {
--- a/modules/clan/pulse-stream/default.nix
+++ b/modules/clan/pulse-stream/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "pulse-stream";
  manifest.description = "stream audio to attached speakers";
+  manifest.readme = "stream audio to attached speakers";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default role";
    interface =
      { lib, ... }:
      {
--- a/modules/clan/stirling-pdf/default.nix
+++ b/modules/clan/stirling-pdf/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "stirling-pdf";
  manifest.description = "Your locally hosted one-stop-shop for all your PDF needs.";
+  manifest.readme = "Your locally hosted one-stop-shop for all your PDF needs.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/clan/victoriametrics/default.nix
+++ b/modules/clan/victoriametrics/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "Victoria Metrics";
  manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
+  manifest.readme = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        config,
--- a/modules/clan/vikunja/default.nix
+++ b/modules/clan/vikunja/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "vikunja";
  manifest.description = "The to-do app to organize your life.";
+  manifest.readme = "The to-do app to organize your life.";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default server role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -3,9 +3,11 @@
  _class = "clan.service";
  manifest.name = "yggdrasil";
  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.readme = "An in scalable routing as an encrypted IPv6 overlay network";
  manifest.categories = [ "System" ];

  roles.default = {
+    description = "a default peer role";
    perInstance.nixosModule =
      {
        lib,
--- a/modules/nixos/think-backend-gtcm.nix
+++ b/modules/nixos/think-backend-gtcm.nix
@@ -7,6 +7,30 @@
 let
  cfg = config.services.think-backend-greaterchiangmai;
  think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
+  file-uploader = pkgs.gtcm-file-uploader.override { dataDir = cfg.dataDir; };
+
+  nginxNodeProxyConfig = ''
+    proxy_pass http://127.0.0.1:3000;
+
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host $host;
+    proxy_set_header x-webobjects-server-protocol HTTP/1.0;
+    proxy_set_header x-webobjects-remote-host 127.0.0.1;
+    proxy_set_header x-webobjects-server-port $server_port;
+    proxy_set_header x-webobjects-server-name $server_name;
+    proxy_set_header x-webobjects-server-url $scheme://$host;
+    proxy_connect_timeout 90;
+    proxy_send_timeout 90;
+    proxy_read_timeout 90;
+    proxy_buffer_size 64k;
+    proxy_buffers 8 64k;
+    proxy_busy_buffers_size 64k;
+    proxy_temp_file_write_size 64k;
+    client_max_body_size 50m;
+    client_body_buffer_size 128k;
+  '';
+
  defaultUser = "gtcm";
  defaultGroup = "gtcm";

@@ -33,7 +57,7 @@ in
    dataDir = lib.mkOption {
      type = lib.types.path;
      default = "/var/lib/think-backend.greaterchiangmai.com";
-      description = ''A place where to store states'';
+      description = "A place where to store states";
    };

    user = lib.mkOption {
@@ -142,6 +166,19 @@ in
      '';
    };

+    systemd.services.gtcm-file-uploader = {
+      description = "File upload service for think-backend.greaterchiangmai.com";
+      requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
+      before = [ "phpfpm-think-backend-gtcm.service" ];
+      serviceConfig = {
+        User = cfg.user;
+        WorkingDirectory = "${file-uploader}";
+        ExecStart = "${lib.getExe pkgs.nodejs_20} ${file-uploader}/src/be/index.js";
+        Restart = "on-failure";
+      };
+      path = [ pkgs.nodejs_20 ];
+    };
+
    environment.systemPackages = [
      artisan-be
    ];
@@ -244,6 +281,8 @@ in
      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+
+      "d ${cfg.dataDir}/gtcm-file-uploader/uploads      0700 ${cfg.user} ${cfg.group} - -"
    ];

    networking.firewall.allowedTCPPorts = [
@@ -271,6 +310,12 @@ in
          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
            extraConfig = "expires 365d;";
          };
+          "^~ /initiate-multipart-upload".extraConfig = nginxNodeProxyConfig;
+          "^~ /get-presigned-url".extraConfig = nginxNodeProxyConfig;
+          "^~ /complete-multipart-upload".extraConfig = nginxNodeProxyConfig;
+          "^~ /generate-presigned-url".extraConfig = nginxNodeProxyConfig;
+          "^~ /enable-bucket-cors".extraConfig = nginxNodeProxyConfig;
+          "^~ /upload".extraConfig = nginxNodeProxyConfig;
        };
      };
    };
--- a/modules/nixos/think-gtcm.nix
+++ b/modules/nixos/think-gtcm.nix
@@ -33,7 +33,7 @@ in
    dataDir = lib.mkOption {
      type = lib.types.path;
      default = "/var/lib/think.greaterchiangmai.com";
-      description = ''A place where to store states'';
+      description = "A place where to store states";
    };

    user = lib.mkOption {
--- a/pkgs/gtcm-file-uploader.nix
+++ b/pkgs/gtcm-file-uploader.nix
@@ -0,0 +1,40 @@
+{
+  fetchgit,
+  buildNpmPackage,
+  pkgs,
+  dataDir ? "/var/lib/gtcm-file-uploader",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "6f8c8d7dfaf5a0c1eb2077de1d6fb35ceaf3d4ec";
+    hash = "sha256-2mCdn8xGjWZrANclctGTmxQhkNc43VzlzMTVwVIFJcM=";
+  };
+  src = "${repoSrc}/upload-large-file";
+in
+buildNpmPackage {
+  pname = "gtcm-file-uploader";
+  version = "1.0.0";
+
+  nativeBuildInputs = with pkgs; [
+    nodejs_20
+    breakpointHook
+  ];
+
+  inherit src;
+
+  npmDepsHash = "sha256-JEp2F1CQfuV9fSYZRdRO+BiOE9dy1ReK6doJcqCuxu4=";
+
+  buildPhase = ''
+    npm install
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r * $out
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/gtcm-file-uploader/uploads $out/src/be/uploads
+    runHook postInstall
+  '';
+}
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -1,4 +1,5 @@
 final: prev: {
  think-gtcm = final.callPackage ./think-gtcm.nix { };
  think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
+  gtcm-file-uploader = final.callPackage ./gtcm-file-uploader.nix { };
 }
--- a/pkgs/think-backend-gtcm.nix
+++ b/pkgs/think-backend-gtcm.nix
@@ -28,5 +28,5 @@ php.buildComposerProject2 (finalAttrs: {
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-eXm1x3E9KHWojaT2RU4inMdZqQVcWdLCKlvzhOlIZrc=";
+  vendorHash = "sha256-wGfbprSDULBje1s5y3+ZiU/nCwYGDEULobZzyzGZ9bQ=";
 })
--- a/pkgs/think-gtcm.nix
+++ b/pkgs/think-gtcm.nix
@@ -28,5 +28,5 @@ php.buildComposerProject2 (finalAttrs: {
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-QV3hR3U3GwCqrCRxfkazmJwDpO1vFyMfA6YqUb4bjMI=";
+  vendorHash = "sha256-b8+AKUmjQiOdV8UC9GYfJzAHFs9+FRSH91YsxKt0rDA=";
 })
--- a/sops/machines/rana/key.json
+++ b/sops/machines/rana/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+    "type": "age"
+  }
+]
--- a/sops/secrets/rana-age.key/groups/admins
+++ b/sops/secrets/rana-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/rana-age.key/secret
+++ b/sops/secrets/rana-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:xkoZtvAxTFuTOtBu8Pc7X2aVgOdjFwSFHLuX92DuSLxBX3NW+YP0Qo/0y3dyVjwR/nPHj6N7LjSqHMC2aZLgcR1kYJchyjZ8ISw=,iv:CGJD7bDqMVbp1KxDswK3iizmV8vZiVcBUP5vUc7qqDA=,tag:K967EvYAzD6eOGwSQ4dTew==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUHhPbEROVjkwVFh6TE0r\nUW1KN1U4eTEzN0JQcUJFWjdvT2V2WnpUMlU4ClM0NWJmRzg3aVFRSFgzcllTOE1r\nV3lGVlJ5WkRMYm9xb0xoWGladlpYbVkKLS0tIFpoT0oxMG8reW1rRmdwcmp1NXpv\nb1VJZXZPZzB1dEJxWlJ5SEYwdWpObkUKqDFSxFQ9HSGWMF8K7v8K5BFAub0lbQ3Y\nNHDIy7mZjFinebrjhPzHxlzhdguoSRSDPfaKbnaIUdKY2cwvQC1zrA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyYVBlclRXWGJqcTZuMXNJ\nREJOcEgxc1lJQ2o4TmVlbnU3NkNwMGtjc1NJCktNS0VrbTlndENSaTBtYVRYVUVL\nSFljU2F0V0YwdlFLSHJkeW9IaDRwQjgKLS0tIFRNUFMrWEw1VGhWOEwrQ05EWHQ5\nTUVDcnRpeEtqVHh0QnhyWExGUWp5c2MKs3BRqjoXwok/BRIyIKGXYNTJbE+FIvbX\n40N4B/ZM3DhsAb2+zl/iaogycDx3HvlspljaWy0emzGJYLLBWBonxg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEViaTZla0Fy\nS3FnZjQ4ZkxuWFJuM1JnU2JrRXYzWlVRZVJ0ZHVwMHR6eTAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyZEtIMnNqREpuUk1rd2hWd280ZWFz\nb3c4TlUybzlOTmVOZW55Zi9ia20wCi0tLSB1NVNnbkk0V0lPNVQvcVpUQUNBdXVv\nSkRNRDh6bE1zVm5QdjhtWklhQUZJCjfd9Ce0sS3qEcF0oTfgA70StwrW6t0kyClE\nvGXH1b6caO6GuDqHlTCWtK8wXhPNmMvaHzuKIxRwcTlMjE0LsE8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZDTGpUWllm\nSGFlb2R4YXVDTldQOUpFMlRhMlBqZEZ1NUJLR3oxc3VDVUkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpkMGYzZGFNWlFpY09waFpOUE03TEdJ\nV0VEL2ZBeld5ZlZpTzZITWpDVWFzCi0tLSBSdGpPRzg5R1N1cDhxTWNldUlVOThj\nSy9Jc1BMMnRlWkN3RFlrTUZ0Rks0CvGs24pzjvolDKBG9qh0gRmzSvTHEftC98Ts\n7bKL/7kYENcsvHsRjJk7e2q85b/3NT9ft6O8cG1Poqh32Tka9gM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGlOQS8yQUtx\nTUtUK1V4azcybm1GZk44MTJZa2F0alRwamJtL3RwblVYUzQgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo1YXR0SE5XcS9yNFZzZXE2dHNKZFNh\ndC9WaHZTM1I2U1gwNVpiR3U4dG9NCi0tLSB3RG95Mlp3TCtvcHVJTFdnVS9DZVov\nMmU4Sjl4U3V6K3YrYkFOUnlIaTVzCtNFHyDhSOIXGiACkxPD9jV0glmRNqtJGZvf\nphqY7zOPd5OQQNDM5QQdp/P7DDl1CT4QjUPu84TgmFKO4HX7WFI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNNi9WYXVHZ3V1OHJFTzZh\nK3A5aU5yRi8yR2J5aVBlRTV1NW5IREsrSEdZCjFLQUpJWjhTY0FjV24zV3R1VCtk\neldBeU9Fd1FqYnVqYU4rQlNmVUp3TVEKLS0tIFM5WkdlZVJCNWJLWmRtZGE2WVFV\nZ0kwOGthcUxrMlhrM0tseURVTThYbHcK5ouDof7sD7XlbJquDOkv4BxT2DMmok+n\nzfGnlTy0KK/eptfV0CQrGD/QVMVyZpGrecnLDNZOeI7dJT++u5cMyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmTktaWVYzVk4wZ1dHeGlQ\nRkUwVGZvUitPdXQ2dlpoT0xsWjNPZmNYYVdnCkdjVmZPankyQm1QU0o0WU9tei9y\nTDhkNC81SW5GMU4xSXhUTkU2c3VSeVUKLS0tIERSUithQU8zZXZyWkU4MS82OHUv\nYThTQ3VNMUIyV3c3SXZNWUpWU2hFUDgKH1/7Xup8vISgDxJlmatxuAKdjRV3fA1f\nOI+zJCtR94wJvGALufqt5zPEkTkT47Z+ZijoNp6sAxQCCAiNLKO5LA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQVd4cWtKSkhrN01JNzJp\nb3p5dXFxaTJ0ZGdCcmNCTEhOWVpMNm9XY0hJClMzV0dRSnlKNnc3aEpSRnQ4YUNY\nWFBBcjkwVzlEOE1XdUdrMkM1US81aWcKLS0tIDF4U3RCYTNBb1dSdnJHL2E4b0RF\nWjJSVnBReEFBWFZQRktZNkFWUEkyWEkKsepkOgBIbIxNRU1118q+pQb4U6sVUsxi\nKZHu270Xd254fSqUUZ0nfYG8tk5jzzZ9W5Rpb27gA3gGYQ5r5h4zNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSzdyMmJzam5FM0MvRjg3\neTQveHZNaTBXdzJIdklQeEZuUkRVOXNQWWlnCmYvV3pJQWZFNytMOUpFa0o0UjhT\nSWdzanBoK3lhTnpCcENvajJkdW5sa1EKLS0tIHduV0NjQzE4T1VadDcySkFFVWYv\nanNNQjdpalIvNmtGZ2N1aTlzeC9ZcFUKvSsgRyL5u5+Ly42Ua+zDIaJ6O3GOyjZf\nIH6c4edkafCk1nUc2Tr9mBWGp51MX4VV/mLxAVse25u9YztTgcDlnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:54Z",
+		"mac": "ENC[AES256_GCM,data:Bl5dFPtFausLeGxCVbDuaUf8pj5K6JDUPkAqdDT8yOPYWXj88gPjDCt7AIuux9GCUJut6DrrfDs9cpIM9YwBA08EnWthBtjTWvE9qBcLfrCkGxHJ5O4Sff28AJiHq4XBZK4Y85RvjgMxeMX6c9g6taEk/B0QqG5xkvFiMuuwIRw=,iv:W+8iDE+jzCqlIYmLu4dhUsij4czfJceneNdJyRCLmso=,tag:SiyGeJqUh2BZedjmIVtjWQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/rana-age.key/users/kurogeek
+++ b/sops/secrets/rana-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/vars/per-machine/adhil/phonebox/owner-name/value
+++ b/vars/per-machine/adhil/phonebox/owner-name/value
@@ -0,0 +1 @@
+w-office
--- a/vars/per-machine/almach/phonebox/owner-name/value
+++ b/vars/per-machine/almach/phonebox/owner-name/value
@@ -0,0 +1 @@
+usa-1
--- a/vars/per-machine/alpheratz/phonebox/owner-name/value
+++ b/vars/per-machine/alpheratz/phonebox/owner-name/value
@@ -0,0 +1 @@
+usa-2
--- a/vars/per-machine/buna/phonebox/owner-name/value
+++ b/vars/per-machine/buna/phonebox/owner-name/value
@@ -0,0 +1 @@
+whitehouse
--- a/vars/per-machine/mirach/phonebox/owner-name/value
+++ b/vars/per-machine/mirach/phonebox/owner-name/value
@@ -0,0 +1 @@
+usa-3
--- a/vars/per-machine/neptune/phonebox/owner-name/value
+++ b/vars/per-machine/neptune/phonebox/owner-name/value
@@ -0,0 +1 @@
+vi
--- a/vars/per-machine/ramus/greaterchiangmai-s3/endpoint/value
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/endpoint/value
@@ -1 +1 @@
-fsn1.your-objectstorage.com
+https://fsn1.your-objectstorage.com
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxekSBcL5byOOEs2sq91Vas7BvggjQ65O28E3mflwUs 
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519/machines/rana
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:4DfyVoor5EuEDemCBS+7Nir8K0XlulK/hbSghmM39bNn6J1Y4VbIcUrvK3+HndEvEhQd3EgAVWzrNYIfI94bvzKkv3/s6VcmTgQ3/DbC3r1fLdQmDGD/qlyExbvug54AbJyTTyh+mrU3yBnNOf/7TPrndat8giUaOI3KsSjUIdYw+447Zv1U1cg4m31L7yqo9/EZTrIoSimjV1faigZxKZDpTOSuljQmjvA334FNIsuNMNMtMPQqOBB4rRdC0cX73qFH/4pvWENLYxPI92Ue/JtQ98swW+ewosLba4P2UC66MscW2zTxGG9JGGJ9Wb49bOYcWilLeaFyje744GgfFFY/g4X16gcOdZH+boKfMVlfimUJbijcH6ViNAIJu9cMpzeLLSirQ/vbNY+nQ3qvx8i7bPjOIf5wS/v2Jc4Wf4kCRgk4YCl03oEoQ4xbXmea+s4gFdC+SpN+M+Jw+Oo6GOMJ/VvGSQFx4c2Ol86WZMbhYBj10RxUJSCPcrvzebUGhEEB,iv:Y51HhH//qu5zpfRFFnTIKnCzpYr0utKpEiGqv1cCCnw=,tag:X6FYr+k4spNzbhfcBXnAjQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1dGEyRzEzYnlnVnNlOWMy\nYWtGUitzbDA4andyaEhFNGlrOW0rMWdDcldzClJwV2YzNjdUTFRXNzFsMlY4VHRR\nL2lYNlM2Uk9WT1NhTTkrbzh1cFMzOGcKLS0tIFVjWDcwQ0g0NVNKUXhHSmpKTUVW\nYUxtU0hHNmM0ak8vRDRwWGpsWFgxRE0KZYr6b3CPX6u4TF6t//YzkguOLaXxOAQd\nxkCygAnAJCITH0hHz8TyspNg7dR+J7E10Px6QC+6YjpTtmpZmbZl1Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaZUl6Tnh1Wm9jT0lFRVM1\nYi8wbmNNazZRY2Q1TW05ZHFRNndXaUNQT1ZrCjg2MnNGY2VrODNmb2tyVTRKVzhB\nRGpIaWNNcFc3dzl1RmM0TzhRV1JydDgKLS0tIEFGaDNDOS95VWxhS20xK2U4b0oz\nTFd0eDNkU1kwQzUwTnhzdEdXQkMvN1UKXmH5Hq2tIFfedG8PALnO+IbFjeYDBTmO\nf9aysra8Ait4TpWBNTCXbdf8KyqOQytV1spzsPBjVVTkNPwWaAwidA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBudFh6NlY0R2hNVEpIS29u\nTTlNdkkvQkRkekFKR3FGTCtjTXdHd3ptU3pVCmxiS2F0Z05DeDZIdkgxRDdpTUZz\nMk5OZEtjdEt5ckR6MmlRYTVKQU4zUEUKLS0tIGNsVXNNbWhoUHBteXErUUVVdUdF\nczR3L2dJcFptNnd6YUd3SXdFZXpZZW8KZtn+WIHD1H4qFZFK8idcS7hFgrnqaKiE\nt7ZpN4PyDH7mqH6rkW3Mn8o9ZsfvX9gV2HmgSkj8CITRLu7HfKGrog==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZTcTh6L2Nm\nUGNOck05Z2dibkVPUEhKYWk5aTZlSGlvTldYUmJoMXhmZ2sgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpnaUxBT1Z3ZHpTVzZKa3gwaDVvUlkr\nd1BiNW1vLytrZk54RFBHTEN1T3BNCi0tLSBHcHROSEFMOXZrcFRWNytxZGhNNm9Z\nRkxsQTdad2o3TzlzaHZuTDIvNW5BCjPnOg2RuHG5tAO/TpLjcIJ1spSujPEiQifn\nefk620zbb5nI6MAhWDX5BHNgHPCxDHJMo1mDgX63v+IXyx4DG6E=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGcvUGd6Zjcw\nRDcyV2MrK3JoSUtKMHR2ZnUwcm9iR3QvcDNLODRzTnBXVXMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpRdmRVZ2RtaHQzdnMrMkxLaHZyeTN4\nNTZ2OUpuNTFOeldnN0dZZ2RXZlFNCi0tLSBWZTBoTis2OCtOV2VUNzlUVnFURXEx\nU1RqQUQ0VW9MY0lEQ3FCdkVNZmtFCjwNPG3+79L13syxN+Ip9dMUN8qTOw4K7Isk\nRhlh38jv4j0jV7dGSjczBhnzh7nbskqCtqZ9mGa/vLx1fiDsBsc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG83a0JhZDlm\ndU1Dc3gvV2lXSDEwUDdpWkNQdmxpUXFmdEVQaTRhbmd6RW8gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4SnNydWY5cWR1WlNJR3JqNnl2NGE5\nWGpNU1BUT1Axa0NNN3lqNlZrQVhRCi0tLSAwcXZjRjlKK3BFZ3FpU25nQTlRakRN\nSU84dDcrVVlmSS9Zc0VWNDE4K2F3Cvq4zmsqOwoypsjf3BO9MfjdNGxxU2tkgsPx\nuRwQHEJhT5W8x5pnSEi/CzA6bnFvlvP6mk6pxCJUERPZGVgHYAA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArRGwrS1RhUGpKOTJ3clU2\nc3hLbENPSnRpdnVyMjJYVm1YZ2FUazNCeFRFCjFZZmpuZnR5a2ZMdEhqSW5zcUhU\nR1lzYitNaWUxZndiZ05ZQUFBSFhGS0kKLS0tIHFOcEdnVlE5M0VXYnl0aEtiOXpT\nZURBZkFPSitHcjNnQmlQVElnbDNLK3MK4ujldBhvw2+3fKhilUJxTkASe3CyruKH\n6NKTCqG1lAf1j+4HqN51C1knOom5F0Qcc/lXWMbtgZA2N/pAjoz0XQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvU0hvUi9GdlcvZk9rVFNG\nblA3dmJZNnhrektydlBMeVhUZ3hZL0p3K0JNCkIyd3NhRnF1ZVlYVmFERHJsNEVI\ndm1uWEU4Y0J2dG55cmdNM3pvUTNQcEUKLS0tIDlyWXFDSzVpOXBxY3hhV3orZ3Ry\naG5FNkRhQTVBaDJ6cUdTSENPdmYwK0UKZROa124CV2j0rF4FkdJYDbzcbNFfLI0i\n3mLA6ugNwao145Cd/iFn4g1hHBJ2taWBmOLcjk9aa/NwekLclJrqQw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtc0VHTS9rejZnbFhaNVZ1\nckFMWmZPaFRoczlEVncxQVQ5MHliTWl5T1hFCm16UU92NEczUFZZa2cyenhBZGV3\nQTVmY2d4QXRQN09jdFB1bkd4VDMyMncKLS0tIGtZQ0Q1bHMxZXhSTzJZSnRDUEpM\nWEtid1BKcmUvMW9odkRFWnVNOSt6VGMKapQACZKpzcgNTXEZSGLN1zYXi43gH928\nG9AhUv7RtCaIPmHByjFBhxemh8zdvM0jfxRllpxYwlEWWjw3ebC26w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WFpZR0Jlb0ZqdXJOSUxh\na0tHNGt1M1MwSWoyWEhqK3N4cXl1Z1RzOFZRCjBQMWRvQkhJMXBkNnlTeVZNU2g0\nMGk3cmt4dnJmWFZRc2Y2cU9SWEQraTAKLS0tIEhpWXRselhPZ0l2TWlNMTUyR3ZU\nam9tZEdvdFg0aUxlVlV5VGZjY1dXdmcKmim8Cq93FQPaT3I2mGQ6qX542Zowzzt3\nJ/PF2IuzlXNiO93DLP8Th7jyo1EV8/yu2ak8R+yOWPSJpArLYWrGIw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:54Z",
+		"mac": "ENC[AES256_GCM,data:4yVGgr5CBueGSJTumk3vJ9AGTRbSLgP5PwA7xlPyg4aZB+kdqTFC6aPRvj6oJgHTgLW2GPk9Phd3ECS/eo2OwePUA41669S6WDZx+S+5XY8bFmN2CSWFGLC4RdAfTv69YxuheA9FZf2yKUuNuC4eXWFRnOB0+pjnNOWTQ+a3E6s=,iv:N6JLVDXG5yI7ufgeiFGOCV+pjn5WXyAl8naVnpBtqvQ=,tag:nKwkTLCSig6Eq6UU+ZgDLw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/rana/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/root-password/password-hash/groups/admins
+++ b/vars/per-machine/rana/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/root-password/password-hash/machines/rana
+++ b/vars/per-machine/rana/root-password/password-hash/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/root-password/password-hash/secret
+++ b/vars/per-machine/rana/root-password/password-hash/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:i8C3sIwqpPXfoNnDt/ZKKqVMgDJNAFzvZeI+UeP2SAMQD9JbRnjzMJhDXd9Z8PNvx7g0y8M7qh/zubpfmme3fG81HZcn0gliuLqdpjPErpF5G2o2AQy52Y5IXYPAaicpsnpFzhSMnfMcZQ==,iv:BulJeE9R6EEDkrxMcHyIjnvN5CJlbYI18s7sYLSVW7c=,tag:1s/xo7ZvPgq9qmUqmTRTNw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhejdGaGYvNC94REUrajkv\nUjMxN25Da25lQ1o3ZHFueXBlTzBPUkVIVlRrCnp3Y3BxanRKSDNNT2NtdkNFMDZl\nSk04Y3VwM3hUZXBBT0ZzQ2hwTUlxNEkKLS0tIEExVU9xREU5d1FQd3ovdFAzNDlV\na0VlVmhILzN2bTlIeFpGa3B4RWhWbjAK2hnF26x18ETtSlP3u0AaEZZ+BH/iVQ/o\nnwpa/cxOeYsdXb/2oBBXLMtrHnuEX8bPfAks1EvUm4ekN2tTpGpJ+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpNHVPUW5JcDErNHpZK09q\nZDQzTWdjZWhBWjY0WXpkWnJlL0NlYzVYb2pnClZ2Um1qQzhwUFcxcHIzeFB1am5p\nNWpjdUVueERSV1VjRFFBQk93TEJHNDgKLS0tIDIyS2hWM3BjNmtkNmRxQXdieVZq\nam9xV1BzdjU4YXdVaDVNR3R1dmpDdGcKTWuulM9VO868v3r9iumbjjxM2TMJPERw\n3tnjbAmO0Rwg45HZD/xd7atiHCZvzxNH4Z/TBV92PAnHg9fZXeh6Rg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlUDlDSEQxZjJGbFBDTVZj\nYkZXajQ0L1R2MGJSbXhkY1N1a2ZJUjhnK0hrCk9HU0llRmxhN3JvUVB3MGNTZG1S\nRUZmOWR4S2EwOS9Vdm01cm1xYm9YQWsKLS0tIHAxY2VuZG9QMEhQYUxLa296VGw3\nVzZ4aDRmcGQ3MmpjellOK2tOWmQ4TzAKyvDTMDjyjeA2Emdv4wo5RJsx9l/J2iDD\nfu6gm+FD0BXga8G8pAgSClUJY/BP7PGMx43r3Jm+hPJQH2UTAcLy8w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHdZcUJTeFEv\nd1ByTnJvbW40b1YrR21MNHI5OVpncXh4d1BWaHo5Ymc4QzggQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpadTA1eDJUN0FOUXZVTEx0UGREQVpW\nVUN5RldWb0hQdktQU3hveVc3ei84Ci0tLSBXVUJvRHM1UXZYK2tNbllOQXcyNGtz\nL2wxUGJuOElKbmpTdnp1RXgyaGlJCoubZA2ZvTe35fyE9/AxNtoX+Tf9USaodHHl\n5Syjjm0kLMSQmutB5/zpfzKBTn/Y2cNqBjf6bRODzm3LKXP51F4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNZLzdJSFZ6\nUGo1Z3VVaWxORjhJRHBVak4ydS9BNE9xTTZVQnV5SlhpMlEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwplZWppMlJYTC9TSDdwTmE2bDdtdTV4\nZDM0WFo1bmZqSlBIOEw0OWwveFJFCi0tLSA1VDBRQ3MyNDdJRWNhUFc5RTM1Q0d6\nNEViYzlNTGVqZHFxOFFneG9WNDVJChqQvH/C16Fs/St/H6Td/zdNMydMoi6Zxx3q\nUX3FNV1O3OS1L85+WM1hzVoxGM1Fiap+2Bn3YV4HUnM8m4iyrUI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9qaVBNUy9W\nUHBEaW5EYW5wMnBYMXd5S0RlLzJVemdZdnpvL2VveEwzU1UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwplSU9rMUNhUlpLUGNiS0VFdklOR1l2\nRUZJWUxGb3VRN3BOZVRtZzFGeXZZCi0tLSB3dUs1YVc3NEp5cU5WZVpBYk1QL0g5\nMWZrYUN6Z3lBcU5EWmw2eklYMXNvCqi2vKIzq4Rqe/B/fb0KdFFi1VyhTOfAwZ5j\nxeEgcCo3cXK/x5QB6SWS03rJ4JurizhEyyupU7H4PvmXotJVcxQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1dHc1dDJkUklBb3VWY3BJ\nN3hSZnBOYnlhTXNPSC8vWEtTR1B2azV6NDFvCnpIbmV3bXpwTFRrNFg5SW9nZ0tV\nK1dDaWNvemJwbDRJWlJlTTZET0hqbHcKLS0tIHlmdkVYdkNScEFQOVNSbnU0TW5U\nVE54U2lqSXdCSkpQeEh2VmppRjR1cncK7JrYpimS2/93ueWyTvH9HdIXuAabOby3\ntq7V3PeAYJnxzqeNtQa5rASnpGOTYO84ETC8EF3InZg9rI2gkl33qg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGby9VWDAzNkVHV3pRK0NB\nU1h4VUxwVlVkdGtWYXpzVXAwT0hMaEd1QVJrCnUwOVlCM3A5ek1sM09VTWJiSkFp\nK3IzenhzekFGYzRTRjdtb3k3a1BTcmsKLS0tIFRkVS81bGNhTEJDME5LWlhSUHJZ\nWEV2aTRYT0J3dm9BNnB4NitUZTI5dm8KvmlWtCHAfoOQvQa6PAy2FvX7ZkWauCqq\nyjDxZuyMK33ZvhwVt8MtwwJUeGpHJ6gFjrcUvavlmv77KQAv+RZy5Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRFNweG5tWjBVc2ovTjN3\nSmdSbXBhMGUwbGVVQ1U4bUo3MEw0MVhyblZnCjQyN09TcmJIM25qMnNrbFBkMkJ2\naFhhNzZnN1BLWUFLT3VyaTFVYUU5Z28KLS0tIFNUSDZXUjVkaSt5QWEzMWxHdkky\nU2VGZ0tHUENsQkhUekpib2hGdkNZakUKsv/+PApCsND8s8NNz7onON6zBxUqd6WF\nrNypiNkN1Ww8mw4vvmN7fRHxU2wXUQwU141ycne5/3Ao25HQF/wicA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZNXNVT3ZiSHg3NGFBZWNF\naVdPTmhwU2hPcTZCcnBrM0xMcmo3SUhsZmc4CkhJMmdMZGFVZUpkNnA1WWtSQ3Vv\nbkUzQTJaSEFFNVlIcVFHK1dxVnBnQ0kKLS0tIDlvbjI5YlJDU3pReFE4Rlg5bklY\nWlkrZ1pqRjRaaVhhUGx3aEczYVFPSXcKZOULJ7oKQNj7nTVv6VRt7o9MofDG7TbN\nFV0S4raYatjNgPBMx4JCaer10PzbC/6IQBl0PZcK1/o+Hkug2deQKA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:55Z",
+		"mac": "ENC[AES256_GCM,data:LdJISLehuhnxYXc+xQszdx+xSoQK1zH7+Db5Y4M222Fac8jcEdykYzgPzCqzEvpDmT4zdDnoPnpHE2uk5MSLFr7g9++jeWRADCrvR42uOfWLoqBhKOxsaD7lbMw9sc+jQvk++gcnmucapNMPmxUQiMhGkjOPtGUNUYXmYo7poKI=,iv:+KRLeF69msX9k8koVAI69G6HytWqfzIUqo6XRN6UYGA=,tag:WH2P5CkZD9pVC5O+vztYQg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/rana/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/root-password/password/groups/admins
+++ b/vars/per-machine/rana/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/root-password/password/secret
+++ b/vars/per-machine/rana/root-password/password/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:hhcuc36SLu09Zl/orPiHrAfz47WqRE9NU+VVh7o6b+03nMrt,iv:ggDVEut8nHXRcL2FID+RQGUsqM7u9Kcp4R0DgZ/Vdyg=,tag:x9qf7SCtoZgQjH2Xt/xVmw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdm9obzJpK3YyeEhPZ01E\neDdWT0NkUFBjOFI5alMxY09XemMxWWFaZWpNCkF2YURuUnVTd2NoSW9hMHZJNzlM\nY01vSDZObjBXSVJCak9RNlR0b2x2blUKLS0tIEtDREcrdHpLNzNxbU9kVU04Z0dR\nZDhRbHBjVFg1cm9FTkpSb2R6L3VWc0UK8pNs1SgBGlKr3VOSmt4h8s4JkO/FRD64\nl7+HiCCl06B+ACBEZh7y6B1NMA6kD5em9plzzb8l2KbsVD60sany/Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmRCtxdlJWUTlwV05zbXl1\nYit4QzA0djVpeDJIbXd6SnpCVCtKUStqVGdFCnlxWjZ6aU0vNnhoOTJOMHZLVG1C\nVEhDZ3dyUmZwQm53NGdtYmZiZ1BIR1UKLS0tIExuRS84a3JuR2l3ZWE1SEIyMXhZ\nUWwyUENzM0VRQlhmK2VVT0UyY212emcKg1nBSq6I0XVf/qNmNLRsKKgEpz5Z1KkS\nSORG00uh7EXcnVdFPmLf3DEsPUnoNfXoHDgXOBEOP8kRwUEciazTBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDE0cksvdjhl\nbGo1Q25kRmNjaXhXMFNGNFNLc2Z0T1dWZlc5enNZTkNlMlkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpyOEVZTUxUajNpeCtqcEpyc1ZZRWxj\nSW41c0dZTWFYODJDQVpGZlVnaXlnCi0tLSBiUlZNemhRMlExazlQREFYOGsxQ2c2\nam93cVl5akRSSHlJZ2JGa1Bmc1FNCqPKgV0nM9IUgpKa2wWrZyn7Z56QrNrT4L+8\nHqPToWF24itWig7ohHckoc+KlHMCLn6DHWbON8zS5uwH05j9lLM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGNpdGN0MUg0\nSi81RFlXOStRM3UyM1YwMDNPZ2h6U0gzc1N1M3J2NWVTM0EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwoxRkNvYi94aS9QN1pzMVhSTituQTlK\neEFrZXdkMGZ4d0xDVmFOUyt2Zkk0Ci0tLSBLWVJlMFhKM1V6YW9DSEQrNjF3QU1K\ncSt4VDFUOFh2RlpmN2llTEhHVHdrCqam34rliA2MYqnsuOiCE2Qf6G0XDYV8+Y4g\nC7MZzhdr+DJ5L8EuovI8/mAkmwhMQO1DRsu32w+thCsfo9YASmU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdNQzBrQkNr\nR3phTGZkTGg1V3EzTjhzOVNpSENuRGxOcGFjQVE5TDdpU00gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpscmlUU005OU9FZHI5Q1VoREJvU05y\nTFJ3MFRGUDF2QzRCbFFFeUdzTnVrCi0tLSB5NDVQQzM4RnliSXdHRC9KS2hiYUV1\nbHE4aHozUTlNWi9reFM1NWN4bm9vCjP9hdbQLRnHOcTWbF/epfLuxf4P5lS5mEL+\nGDO9vOZzgdDVlrvuMGA2d38TOBW1mpR7fosz7N5YYE3gHmcj6hY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Zm1HR3VKenlyTTdtVnlL\nSW16NExJRG8zd0Uxc3VlN1NBeEplMUFpTGwwCnpCOCtSQUpmVnZocmpQYlNEd0tV\nelNUM3NXL0NyaXI2WG5hQVBOQ0duZlkKLS0tIFZhNlhCKzVlTC92UzJRN2JodlZV\naTZCUmNrQUhmaWJDNm5sQkhvcGtMU1UK3zBLa5XmFPImosmxB+wjT+xoibQn2cO9\ntmposaSKgnkyvMO7z8tZHqADG3Uw+BQYwOJMTHOEw5Ers0edP9cBHw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaVlsSlRKZ3ZyQ0hDVllC\nVWFtcENqRUttSTZYQSt2UjA0RUJPTUhJWGhJClBoZUVPSSt0SlFRazY5YWxiZG5Y\nWGdkZ0RwME8xbFNUcUpmQnVrN0RnVVEKLS0tIGxKRkYxbGJCSU1KVzJPemhqTUUr\ncm05S084ckxaRkRKVjlQVHp4NktpZTAKjUCtoHgdtcFuKK++Rc11065nghUMVCJc\n6hnsIo/oJ1fUHE+IfXpjOQ4eazSh0ggLwPYnRCUiqV0OvXAIgwzMTg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLa2thS1loc3Azd0RISjRB\nQ1Q3MFM4UnN0WisxaU4rOHJzcHVFMFFqSEZrCnpYTUltb29yOThUNXRodkpwZVQx\nb0FncERWTVhtZGM0NUVKR1d4U1RVMFkKLS0tIG5FSnZOL1pGYmZ0a0NWN01HRmR6\nbFdHUklrSjJnRWw3TFdRdHM2N1lQZjAKEN0qllgzMDcqrJd/oDL4f6pxFnKYTQ8r\nrz1Aa+wF9nasW7bkgv7NCxAn9yVldmKOc16cDDoqKfwnpmnugxgiEw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMMGVZUklDRC9jSlpwZXZ6\nQWVoaXVnSGhVY3EzQ0xjVXF2eDhLYllKSlRNCllXbTdqRk94R2k5UFllODZ6RG10\nMDVCRGp2WVhxVjA5UWZWVE10YTJiLzQKLS0tIDk0QkoxR2l0clgyemo2ZlZ1WmtU\nMGoxTW5kbFdic2dhRmZ0MDFBd0RIQ0UKJtDsYSmRizimNjNDuUJlTmqEM4rIKjIQ\nVz9n54qNYMuk2lIqeDdxbWVoeSC7AS+hEeiQRn0TK6Uy8sewM+l6QA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:54Z",
+		"mac": "ENC[AES256_GCM,data:oxUamNJ+iLQXKEHpBivMdpuWkKi+L9CsR+hhJDVdbHLsGuDtJrJB8wmItoB7CusgQJCtOnRBCcK79PXFlOOhlXIjm98XdfJgl0em1hQS0mGwxudo3dJ//AZI7thKE3/Ys3+OuFqXDZHgUPcuZVLCLMuiKVBIftyLrVtCaMQsPIE=,iv:nQxcOgWVsbvnbTegZy+pv3pIN4+dQdJYd59n7FFRAdg=,tag:MlF5nfs5EpFAvTPER+Y7aA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/root-password/password/users/kurogeek
+++ b/vars/per-machine/rana/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/state-version/version/value
+++ b/vars/per-machine/rana/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/rana/tor_tor/hostname/groups/admins
+++ b/vars/per-machine/rana/tor_tor/hostname/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/tor_tor/hostname/machines/rana
+++ b/vars/per-machine/rana/tor_tor/hostname/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/tor_tor/hostname/secret
+++ b/vars/per-machine/rana/tor_tor/hostname/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:TzVLzHDkqdn0WGLJAksBmvz+ZeiYIodD3gBb+NI7O7yvWdRQwFQZ+nG/xa3cni2JpBWqdb+VNuHl+C3pluCV,iv:lY00qkX42DceadABPdVGh/vns9f39MMvTzRRjG+YpnI=,tag:aoC+9425KQ0qWt3trqQP0g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6YTlDV25qQ1J0MXRvNU5I\nSC9RenRXTGZwVVRDc2JoTjFKU2x4Q2xpekRVClNiTkEwNkhKalFKUlNYRllneUh3\nMysxSENGN081N3E2NmZZRUpGRDFJMm8KLS0tIEtxSzdqTW9WcFNvcVpPWURYZFVD\nMmVwNWU4ZVF5RlJrKzVGQ3RhaHZkYWsKZISNjCQm+6NETaJmc/yMer53WZdA0Wv4\nPR2fi7Acw150TOjdcpDq/FbtC581ZXu5HU7RmyKSrW5EcnEjkgFsuw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBya05pN2VYUlNMOVRLRFhT\nY2NhNnpabDdZZ0RvN00vR1ZPKzlNUlFYK3pNCnM3dXB0TGl2aGFEckM0OUUrTHpG\nMDZkREJsUTdWVU1zRE1UWXZvOEo1WkEKLS0tIFh3cTJMT1lRMWp0Njk1aFVOS2g3\nUDNQZXNtZ3hGSXJQb1pNeWtvM0R0bFEKq9kSfkcRyDxaxE6PAr3jD0z3BpejytzV\nWV9ACZGllQhuLc4y4Kr0eTbVk6r3WPh1/Bmke8/94dawNuCk/k+gVA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZWZrMVZaQmJDRnNDcWFr\nUFZrUW9ZRnBra0w3SnlzVGNqbmZrNTBxTWdrCnNJYVZDWjRLbEpZRkQzSytGMWRN\nbVNOU1JDZW9jTzVjemtUOVJVbmN5eWMKLS0tIE0yT1UrN2J5TnFQeStVTEVSK3lQ\nSXNkWFp2djhNTUpCQTBUZXJaWll5SkkK3eGMiLFDKWkGX5FVcGDEvI+8fgOO/x51\nafw5F7V3uR+ebJhxtyjua46HdPGaEhNDolZCR4WokdIqtsHhBWQMjw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDdlRmxDaW11\nejRzQVdtc0dSN3BEaVcxdnFNbWlpMUt3b3hDVU1IMStTbkEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpZWVFjUGkxZ3Z2RGRlOUNtQW1BZGZn\ncFRBcklhYXRFQmdpSERnWnBISG93Ci0tLSByZnQ2My9PY2g3Z2Z3cEVEQWFKWFpa\nQlJ2MGV1amhZWGJyWnl6cFIzK3VnCmEnVWZ+XV4NJKh+7u7fD5yjqcendqYkQYIj\nlsOMusnNKEuKf3042WgG8a+s4V2/QELkXmxqIKebFeGB9pZuNUg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDFrTjZrQWNz\neXcxMVB1ODA1d0kwblVBY2RqT0M0cUw2UklPL2FFeXh4UmcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwoyZ3NoTW5EWVpSZFo0dlUwcnZheWJE\nb1czUU9GdzJiV1JiTVQ3S2tnaTBJCi0tLSBiYytybDVaSFdTNGs4Lzg0Slp4b0lF\nM3QzZ3ZBdGVESFM3WUtqNW9LQUk4Cu8sY4GX1SSJfSql8Ewa3ZQFWBYI9+JFxJmc\nT61ZmHZCe+zhILeiDQgSbvpVMUV+tvJS5adknFCMnzUb2AvbWlY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE1ZUmJRWEJW\ndWFoc2x1bjU3OHhBZ3hBc2dvOVVFNGdwM2REM3hBelV5VUkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpjc3FlRU9LeU5CcTVLUjVGS1o4QzE4\nbDI3SytLUDUzaDVYQURNVjRoWklFCi0tLSA2NFM2MWkySGkxRTZ6Q0R6VWoyclZK\nT25WdnlyMmVjc2pBQVNkeVdtb1BZCpelSmgjukzHMWtb8KH6xr5IcnMFbLqcda2E\nG32pKZ4Y9ibXJfqa3WL5mbm/O/TVJ0nOsag/DjXUVm3H6CVzgDg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEWFo4Mm1SbzdveW9DQ3Bn\nNkEvMXp5UDhjc0ozQWhYa0JOWG90a3AxUUFRCjY0QmRRU3Nwa1BUTldHVWd2RHYw\nNUwxenQ4STNVU3RqeEdQWUh0enVUKzQKLS0tIHh0MWYvS1dPczBLZFgvUkdhcmNa\nbEN3MGN3VnhReG1pVXVwelhZSTBMUDgK3NkdjDiLJwsxK72Vy21pP77B6FaVw3UV\nTBhg/mlHZfzj4tmjtJ0YMRbzVdLJBdnpUmxx89MPLBs9psXX/c2DDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVTE1xQTFpcExZaGZPVDdm\nT1ZlZktWRGtNUUk5VTd5MlFFNGF0N3poRDAwCmEzZ1pFTzY5bHltakovOG5CVENN\nb1hGN09pbGgyNG12bWpWSVJlMFRBaUkKLS0tIENScHhCTWVjQUxWZXI3OU5tV3F0\nTmIwQjMyRE5aNVppMzAzdDBOUG9jQmMK2E+3mhX1n4Lyp1c9TK7DjuggBUZxCBqd\nbRQXHz+APekrqM1fz1WaxcFxdUFuOFm6vXq46BxWnV2inUc2TqzUPw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyMUN6a1FPME1QMGpYWWk1\nTVhDdUlBK1lZdDc4NjhFcjduak5xMk83Tnh3CjM3MURuN2ZHbURCWTc5Q1MzeU4w\nSUxwL0RZNTBpQjU1RTJmZmNRaFB6QlUKLS0tIE1zVXVVZ3VZcC9LTlJyZko2Sm4z\nakhZd0wvdDR3SWJyeGViam1rTnU4dFUKyCPFRNUaY/xaSet4UMVuiDxcxaZlFPa0\nnmZBb7RrijB2Huhq9wktGBYUF0k7Lc4q7ZL8VwMRsuc4SfjCWqLwMw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmbmNVYXhlbE5pUktMVXEv\nYlpaVTNHYTJkTy9LNjJBbzdXNmkrZE9Bb2o0CjBhQW84Rlh1WjBFVDVaSUVLZndS\nRlJHRldxWTNQODcyS0ZiQ25ickd5aEkKLS0tIGQxQ3l4TTFRQzk3M1FGSXE1RXBv\nUWJTc2huVXh3ellUc0FtZFh4RG95WXcKZi8hCJ/T+gQHSVJiVBltVgTvq5i/JOql\nKPyA7C2T2jTabi0RFFeux+FnbOfjc9gATZ6nEbpuh1RBYTjCSt1KyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:57Z",
+		"mac": "ENC[AES256_GCM,data:HKSbSEeuew8iKJaJJA9SPmBD2JITc9j/JVsNl+EnHLIT+ccIT7/s5eMe6YXBS4DTxDV7WyKy7tP2ynWaiIo4RmUEkvi3TwY1kCfJ+VjpY3pheVFsJ2J0bjkPW3t8eFiMuTS8mUQlipkQjVtzeNn+WtW+pBmDS1tXwwUhwAP2XjE=,iv:JTSwcTrQAQIyM1EN7rXefAbGjkOhlSCRQ9L3WvDQDC0=,tag:BAo+jREHjKLrGoJrU1GS4g==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/tor_tor/hostname/users/kurogeek
+++ b/vars/per-machine/rana/tor_tor/hostname/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/groups/admins
+++ b/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/machines/rana
+++ b/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/secret
+++ b/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:57R0rt4GIDxJYQqtAJODglyySiAtRh8UMuSSvmhb9kP91jmHGAAOGpEvfZMUDnTX2l/lWuHJE0rF0QhL4XX9ANJarRXyivte6fJ4KGB9ThhJQOh9/q9hc1nuaa4MFpn1,iv:YaqEBVVLTo/7Fwnj4mJYR7EUbaPN+gvO+iCJRN0w9xU=,tag:EcLuLdIpL8g51PWghGZFhA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzek1qTmlGeDNHN21HK3U0\nZ1djQVBJUVZ5RUVYVE43cU5VZ0wzSU01eUNnCnNrd3ZMTWtsZnRNYzFyVWVGYm15\nbjlUYmNqZzI2TGU5L210Vkd4V2ErazQKLS0tIDh0UWc0bkpKNlFXaWJ1Ni9HT05L\nZHAxcDl2TTlvOTZQL1BTTHZxK0dXMjQKKhXcdE0g67jSY0Zb3WLx4cdVxI4+1Pcu\nHbanf/yzPfjwpAqAy8Xo1TVUzuy6CmgSx6vW5Ww0/YbbXoP3zQ812g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3RWhDbXRRdnFoMk8xRWVn\nYWI0Qy9wSHNoaHdHdXFIQ3VTeGE1UWI4Ums4Cm90ait1VEhiOFZmeGRZTUVXZUxq\nOWhjOUdVdVVhU2dBbEdESnZjSGlhdEUKLS0tIGV4S3ZXLyszblErVExQTmxFNmdl\nRmtNSGxma1BOOUpoTmJpenBrOE5GR0kKCO5wjXfFjRltMU4xFcZhh6V+dB4/vo+e\nl7Zsws7JfxI7bFCdXBhaDiU9NzMbv2zYK50E0+PyjFTBisqKaF87XQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwV2xxT0lWRkZCWDFnekM5\nZ201RUtieUs0bGhTMnJXUnRPbVNPdXV4V0drCkYxM2hZOGNFVitkd2did1dZNUNl\nZzkxR1dFVkFYVUNRamFNYVFBOFU0ZFEKLS0tIEdtS3hWeHh1MjR0bTFyVFhmZmho\nb2IxY2gwbHR2RXFodFZGTUxwS05JWTgK1vftYCAKRpsw8y99NOwNOHpD5YD2LgHC\nPTVSiJXwtEGmccAK3JtdKIvBY4Pj9izo/FDymRKhmsOMS02sF6IJuQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFI5c1dzWFFl\nSk1MdERsaG83NUtzTVVJK2RjOWRGM1NUUldSWE1PMEdsVDQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpQeWh4T2JLdkZxZ21NWkZLcnNTeHpI\nSkpITkI2Q0JWR2dHY1psVWtCSE1ZCi0tLSB5VXlKYWRoSDlmOE5JZEx2QlJ6dzRo\ncm93SkNxMWQxaGJHcCtQbFRWZ1RrCnMTWbuWZl2CER0eVHtMNxMTnwpUqkDDB6km\nvL+ojGoyWtByvTZJJ8YcVs0mBL5QybFV7LUHmTvDyaQtj6AHs1g=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhhZGt4Y0dM\nLzNBVkRWK2dMNTErVW5WZW9OaXNLUFUvRVludFlINnhEMGcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpNUnZFWWFrZnhyYnc5YXVINXd0UmxG\nTWxidENCUHE0QzBrWkQzWlViWWxvCi0tLSB0ekRsTEJrbzZxdHpMTERSUGtGbDEy\nY3VrN2RwZWY4cVBEdVZNdytXSEt3Cqb4HstAzCG+qTAu7odfLuk/3DeSr7fQ+nbb\nUDyIopz6KhJ7Q2JP0TxA5odkioA5nDXGV2adKUbQMOlBvWx6UU8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFdqKzJsOG5o\nRzRFWndlSkhOVDdqWUVXVUpEY2VjNGFnR0pEQlVkdHpTR1UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpZNmxkbW9HSHJBWHpuVGNPU0V6czRj\ncVRwMjVXQ1U0OUNiK0w2c2FmZVRRCi0tLSAvaXExNm9oL1dDaGZ2SWswN3N1RUdO\naFprU1ZscWMyK2hBOXdvS0tUT3FRCli/j9d/Qvu4EkQBaHnHgPWfglrfEKInuyef\n2zpR4NX2DeAUtfDymaGdsBbtzdZsRQRc0a8rK21ngfbfewDb7QQ=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZmtXY3pJWHM2SFJueWkv\nSjNoRlJuc1I2V0I4d0Zrc3FVYWxJQzkzSFVjCnRWaVJqSGNFYWlyRGR4T09BNGt4\naHlRVXBhUm50c05QVlJDTWRyZlhVU3cKLS0tIENRaW9ucklkcWhiYkozdWRZWTlS\nbGI0UHREaGxnWWs1bFh5WTM2VVdvMlEK/bTMmQWeHBzQm5fSKR3/+GLpDDQT2orZ\nuLwhKcOi05/5im0jMij7WrfpWkbQ4eHgjsScUTeRRv1CRxzvBrUp8A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cG10RklUckVOajRhbW1J\nVkJmeGY3ckhGZzYrWHBpQkNZdDRiK0M5cTBjCmhrZkFPbmFJZ3ZCUWNwMGhGWitj\nU1Z5cFNuL2hheGhvSFU4MzNsbVN2a0EKLS0tIHJ4SFBFNXIwaFBOeVlmUGMxS1Fv\nQWErc0lmRnRrdk1LdVBqUkRtTk5SdUEKBr09MFwPJm7Hwi2jUCNyXH9c/ps67J2O\nHsNbQRzYSa7hxW9dC7h6XDSP3ys0VVHqcKxV5uul8M+OtHx7v9wncw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJN0FNd0R3N0xCdCtjTHN5\nMEd5S2FSR3VUUXZNNk5aTmorZkNxWkszYkFJCnlnZWdXSnRDamt4czFxUXpackUz\ncnM3UkgzOEVGQWw3NGQxVEMrVm5vdG8KLS0tIHExeWNTOGU0VlBnb1lVaHVXOUJ2\nV2FLMHhxOEFraWFSVEVWcitiOHF1L0UKWHs5mUD8sNHxHohmkzwCwaSGsAXnbE7J\n+zFy8PZBYPs/b5jIK7RBYM1rQMnu3Mko/2n11pN9iYpwPe8hZn6ADQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkcXZ6U1JMZXc0bnl1aENE\naDAxUHdyTURRTkZvdGJmMExkV0gzZEJyM0RrCkRNd2JXRVZoamdwa2RJTUdNOEtn\ndzN1WHFmS1hzUitLT2tuOVQ2Y3RFMk0KLS0tIE9iTFYxSXpiNGJ4SmNiMFh2QnRN\nYWJxNitYSk1kZDNxSjYrM0JYU0JSa00K+R8551LeE26QHmYuCTse8d5kUVXiUuMK\nRhDysOpiiio0j3OS+DdhCqgiJLzjfCRTL9kR+Kao3SX9zub4WSCgGQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-12T10:53:57Z",
+		"mac": "ENC[AES256_GCM,data:rzOB9Younj9bapsIldRyytaiaXGsL2enpDSt6UkTPZS8b5mEh86Gx4pnrN0PXwrSdBidC1/nRsxH/PaDjV2ByCwu0UblETWUW57sLSMs3w8IHalpUU+HWHx/DBoFgpuV+vAZl4Dk8Q0k8oPxWKnqvOlY2DmL18V3lJGugz1CmCI=,iv:zWvCmYaDQzaC0TOXYNc9tVkACXTL0EEQAiUdJ7iRR2I=,tag:cEdRJHA3697r/YnLggNpmg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/users/kurogeek
+++ b/vars/per-machine/rana/tor_tor/hs_ed25519_secret_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/zerotier/zerotier-identity-secret/groups/admins
+++ b/vars/per-machine/rana/zerotier/zerotier-identity-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rana/zerotier/zerotier-identity-secret/machines/rana
+++ b/vars/per-machine/rana/zerotier/zerotier-identity-secret/machines/rana
@@ -0,0 +1 @@
+../../../../../../sops/machines/rana
--- a/vars/per-machine/rana/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/rana/zerotier/zerotier-identity-secret/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:yUOVTbLI7vWM1K4pnC+bqK3K0TBj/nC/v9bh/QUBnoIaHrC8YtiVpEYqUOohkxc8DghoYHNcDrR26Qulr3SI85+t9krBJ6B2JkxTNBNKL0cpttE49OH+/maWPRw7Lf8YznX9sBFAd6p7bRYDaIBu0HP9R3exsqYwmd+FnyaKhSssdji+PCAydeQBSbLhTHYSAGKJtNw9UrfM3igzImemvBZXV8qa57nf3Qi67a/d6gbdjaV6fwVPuI0z6pUd45T+kXI7hOChASyNxTQEbQavzM58MuPpIToy68Peu4efiiBMrUmYgaTXQw8Av6+C+1dGgZqyXKxHEeYR8YuWWCCCJpJBWb4K2dVIBZDGQJeq,iv:+PASIqOP9Kl9nCjqzafM7FMlrdWuAM02ouiUPU5/sog=,tag:mpgdImbYgzia9io/vkWonQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjam5Ia0J3Yjl1bGNyUUhx\nZFplK3JPb3ZaMEZqd3JsTlRhNXVUZktCTTNzCndoL2U4Q1BJem0reWZRNElwTGp4\nQ2d6eWk4eHZEN01nMUFqR3ZxRFhlOFkKLS0tIEVkUUNmQXBsVWFJWEJWc01UUHhL\nWWlGYmY4VTlKbm1jWG4rSWoxbU02ZWMKa2m8hH3nxWb1oiV+Ts2KJgtEBAAMv5gk\nN+2vFxndrfseu28kTKKMiAh56P0pfdiF/GS0WIdP4tigTby4FgE21Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdmlYdEJWOE91RWxqYTBO\nNGVzMGpjS2c4dG9SQVl2M201U1N1K01wTGxvCjQ1QVM3QlJiNGx0YTFaTHptL1hv\nc0lqMUJtNmJWbm9NVlNudFNZTUZ2R00KLS0tIGRxYzhHOWlFWExybTkrTkZORk5i\nZ1pEQ0tzblRmZ1MyZjVsbk9LZ2xmK1UKyHViPWllmDqKNoNpnyvUhJXGKOkDPO6H\nFBcLgokBal7Qb/2uRZ5LAYGZP1RleVANZYmx1dtRBmyLOGcjoA9jyw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3SDk0YUNVZ3htQkxrM0Z2\nK2Y4dTJqY1RBRDRycldTTTBLU3FJV3BWb1c4CmczNE1WNkRyaTMva1BJZm1jMkIz\nS2ZudWRJTXJ4VlIxd0xQcHhISm9wTnMKLS0tIFpFUHE4MDdoNWx1Ty9JS01rNmtj\nSTFaaU1sdGJpV1EwQmFBelhoTGw3MncKk8fHdw1hhJ4s3/p9X6/K3RBL0o/0/Vlo\nXnWiowpLI6oR+EHKZ2wQPVIwYPqEr5RiavupNBVdJQfJwO2k1Gk+2Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEF1ZmhOUlhX\ncU5seXJyTzJYbzFVYjNERlZJSDcrOHA0QUc3UENTT0t5RU0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQowQzVOc3Z0YWlHMzZRQlU2c1VSQURH\nRDJ1ejMwbW5MUVdSOW9FR2YrR2h3Ci0tLSBxNWRaM05BQVlvR1RUbWk1TjB5YjFL\nZ3JCS1JCaGFMV0g3alJLZkNMWnBvCo+PJk9XFaKbl5qsxVBCqPt4FIOgvgMinmAE\nha9wnYuIOseXxA2f9XJ78C/4OuDlcXhLpq6N9nYHe9BaJ6DgNzw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRWQXVBS2Iz\nNEVrRmxHRmc2b2llNzVvTVRxZjB5Q0h2WlgzVi9HendjaGMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpmd2Z5T1Y4VnZnN2ZnV3lDdURPaHRs\nZk5jWmF3Nk5qNHhpcEpwN2dtZ2JnCi0tLSBNa0RvNWdOc0JqSENTV2dGY3lkTndD\ncjdKOFczVFlOYWNRSDVwem1xQ3M4Cr6kGSazPYHLFFkAkepxpZ+hlA4vuZCzTl2q\npuoaAsqxDyFrywxCQTXALRr3bZoq7URuWEZQQryPUg6KWpz32aU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGI0aHBlRmd0\nSEMyWmRvSkl0RFREeGw3bW1DMnQ0RWZTQ3MvUmdER3dYeWsgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpTaXNjQUxUalkrNUIwenBrZnJzR1hD\nU1VwYkduWHRCUFExOFZsTXp5Q2V3Ci0tLSBteTdwYXpvSWQ1RUVrV1drMTVOSXRS\neHh6V2NSUUpBc1U4Qy92eXZseS8wCj9ILLyLzFDZcHfaLUB6H39/FKIHNp3hF3Ov\nxre6zPI7kuSqVuxnstzmyVakBUlHSyMSWhd4RPme0w67RPr17PY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBneHZoNHhNb1JHdjVnS1pM\nK05GYWJ1K1RCK290TzJ4b0dMWlNSY0QzMmdJCng4VnZDcHpoUkVBeFlFZ3Eydmp3\nU0JHZStmTWppejBvOWxNOHAybHFrMkkKLS0tIHdWWkFhOVpVeTJRNVNiS2hPU3hm\nM3EzeklYMXZkQnFMK3cwNFRCSlRHaDgKK1k/C0v+u0iezcRo1JPt+2Edx0uyohXV\nKKXqG4zgksh6Cbw0si6pKawgxafjzjrYJwo96jNz1YDBfDLpAUC6xg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtQU9IbHpXUWlOTE9NYmNW\nUFRYTUQwcnp4QTl0MDBMVFI3Y3duWkxUQ3hBCkkvVnBRV3ZQam9CUnpmTmJ1NFh6\nRi9zRHlNMHo0Y21wRHZOMW5UcDBTQ2cKLS0tIGNYMUQ4VWp3RytCaDhwbUpudElL\nU2NQWVlvZno4V29iOGliczhmLzdzYm8KNzGmyLLVO3A0H940KntObPdBGw/lZA1t\nF9bV1txctvZf+QHfbgUdFwuF4MORVjo0fCRRjjw5kqNUHosStHTynw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRY1FIMVFjZmg1V1RBblNM\nVlhlTWJlS0ZzS3J4MW1BNGNrWGRkemJVMkRBCk5HRktxaVk2d1ExYzNGMWR4ak5N\nR2lrQlVBcEVjUGRVNGJnSlJSSkdEcmsKLS0tIHVRbmlrbUFwUWQ1ZUx2VHNmYWpV\nM3czbXRZWW1GQ0VJSUhlSUhkeExjelUKymIxMBBlD67h4u518h0/7sarJtNowkD/\nE9ThbqRkCWt/JxGEykQnl4WYWlNX45N/vT1llEeVJmd9oOncHBY+qQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3aHljai9FK1YrWmdTelEw\nTkhQT1hpbkRDYkE3SzdxbDVYQWxkMndWZGlJCm1reGVuMytaYkhPSUdUNHpZR2ZW\nK2tFSEp4THhqRG5SOUwxOFZDSU5kbWcKLS0tIEhhVUlCQTZnOVRPU2xkQk5obGph\nb0dBMldUNlI5cmpDZlV4UTR0eDdmN2sKjvTgRnn6afEdL1mHbWbJwfR/AKWhJ/rC\nbSPW5q5rtqbVYq1gpufPUZK+/KUzhhaT+YfhEZrYMYpknbzdArqQ3Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-15T02:33:50Z",
+		"mac": "ENC[AES256_GCM,data:Wb1zaCFrFFy4+REhmA8OSRETqQLLAzKZyVomsvUCxHihTJ08reMpbg9oreN9FoMcRMmB2TgtnLGnZ4I2ogvnytzbdTNfknmmoT0JWJCxKRV2XdR61UXRJeUT2v6wm528aZmKrqt2QhArec7+h04zWD8WGUQsYHFrq0Ho2OFDO8A=,iv:r1nmy5OvuThlcz+nJc9wg4Lnl3PjP34FreK+y+f6Bjw=,tag:qxhUn7PFykKoB710u0vB5g==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/rana/zerotier/zerotier-identity-secret/users/kurogeek
+++ b/vars/per-machine/rana/zerotier/zerotier-identity-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rana/zerotier/zerotier-ip/value
+++ b/vars/per-machine/rana/zerotier/zerotier-ip/value
@@ -0,0 +1 @@
+fd79:fada:fbe9:8c5d:d899:93c1:e7fc:2733
--- a/vars/per-machine/rigel/phonebox/owner-name/value
+++ b/vars/per-machine/rigel/phonebox/owner-name/value
@@ -0,0 +1 @@
+b4l
Author	SHA1	Message	Date
kurogeek	f3d282b763	bump nixpkgs	2026-01-15 11:35:36 +07:00
kurogeek	a37a0cc7d1	rm clanService/pingvin	2026-01-15 11:35:12 +07:00
kurogeek	a629fa123a	no clanService warnings	2026-01-15 10:26:57 +07:00
kurogeek	d3c7baf551	rana machine: emmie personal laptop	2026-01-15 09:59:37 +07:00
vi	162ba62cb2	neptune: git-daemon: global read access to islands and thinc	2026-01-01 00:00:00 +00:00
kurogeek	5af1fa25b9	think-greaterchiangmai file uploader	2026-01-12 13:07:56 +07:00
kurogeek	87fe4ff8bc	clan.meta.name -> clan.core.settings.name	2026-01-09 15:23:24 +07:00
kurogeek	49449d70e6	clanService/phonebox: update-vars	2026-01-09 14:33:19 +07:00
kurogeek	c724a8ee2b	think-greaterchiangmai missing R2_SCHEMA_URL is fixed	2026-01-07 13:15:39 +07:00
kurogeek	ca9a8d458c	clanService/phonebox: phonebook feature	2025-12-30 10:10:16 +07:00
kurogeek	90c739991d	bump clan-core	2025-12-29 16:55:23 +07:00
vi	4e83773e21	init git-daemon module	2025-12-01 00:00:00 +00:00
kurogeek	322d1bd612	clanService/phonebox: use FAXFILE variable	2025-12-26 16:53:07 +07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxekSBcL5byOOEs2sq91Vas7BvggjQ65O28E3mflwUs`