clanService/home-profiles: emmie-home is a separated user

flake.lock

@@ -9,7 +9,6 @@
         ],
         "nix-darwin": "nix-darwin",
         "nix-select": "nix-select",
-        "nixos-facter-modules": "nixos-facter-modules",
         "nixpkgs": [
           "nixpkgs"
         ],
@@ -20,11 +19,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764799743,
-        "narHash": "sha256-MbbiNG/bhqe+4z7ml8TefIs4swSonmiV0CimCntXuCg=",
+        "lastModified": 1772411144,
+        "narHash": "sha256-WhXudztwPNnKXaqGX4DOqNfHzHdBSiGCvKGHM20pscw=",
         "ref": "refs/heads/main",
-        "rev": "ddc0f9fabf33ad000676a33e97be6b5df12a4560",
-        "revCount": 11417,
+        "rev": "92cc85bc24eb31ce5725e1e72753129810ce3fe9",
+        "revCount": 13201,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -49,11 +48,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762942435,
-        "narHash": "sha256-zIWGs5FIytTtJN+dhDb8Yx+q4TQI/yczuL539yVcyPE=",
-        "rev": "0ee328404b12c65e8106bde9e9fab8abf4ecada4",
+        "lastModified": 1772273147,
+        "narHash": "sha256-Wzhoc6ifjTDZi8aVRH3fuLJPdd4ouNTTwwVhgoMcMek=",
+        "rev": "d5de7a8d9e5726e678c94e62fe8ac3a809fee5da",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0ee328404b12c65e8106bde9e9fab8abf4ecada4.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/d5de7a8d9e5726e678c94e62fe8ac3a809fee5da.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -88,11 +87,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764627417,
-        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
+        "lastModified": 1771881364,
+        "narHash": "sha256-A5uE/hMium5of/QGC6JwF5TGoDAfpNtW00T0s9u/PN8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
+        "rev": "a4cb7bf73f264d40560ba527f9280469f1f081c6",
         "type": "github"
       },
       "original": {
@@ -121,6 +120,26 @@
         "type": "github"
       }
     },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768068402,
+        "narHash": "sha256-bAXnnJZKJiF7Xr6eNW6+PhBf1lg2P1aFUO9+xgWkXfA=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "8bc5473b6bc2b6e1529a9c4040411e1199c43b4c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "import-tree": {
       "locked": {
         "lastModified": 1752730890,
@@ -139,19 +158,17 @@
     "liminix": {
       "flake": false,
       "locked": {
-        "lastModified": 1760426231,
-        "narHash": "sha256-r8c5PKtsxAvtQ/k17GH+WNvP47Lr+AbExLMPdLtvAKE=",
-        "ref": "refs/heads/fix-gl-ar750",
-        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
-        "revCount": 1574,
+        "lastModified": 1773253359,
+        "narHash": "sha256-LogvYVd2NfZnTlxAkl5K9tqX9c7wEEPdnYJsW9WTSG4=",
+        "ref": "refs/heads/main",
+        "rev": "7f23c5dc0f442de9fe07c076297c3a74f2a34e72",
+        "revCount": 1656,
         "type": "git",
-        "url": "https://git.b4l.co.th/newedge/liminix"
+        "url": "https://gti.telent.net/dan/liminix"
       },
       "original": {
-        "ref": "refs/heads/fix-gl-ar750",
-        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
         "type": "git",
-        "url": "https://git.b4l.co.th/newedge/liminix"
+        "url": "https://gti.telent.net/dan/liminix"
       }
     },
     "nix-darwin": {
@@ -162,11 +179,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764161084,
-        "narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
+        "lastModified": 1772379624,
+        "narHash": "sha256-NG9LLTWlz4YiaTAiRGChbrzbVxBfX+Auq4Ab/SWmk4A=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "e95de00a471d07435e0527ff4db092c84998698e",
+        "rev": "52d061516108769656a8bd9c6e811c677ec5b462",
         "type": "github"
       },
       "original": {
@@ -188,28 +205,13 @@
         "url": "https://git.clan.lol/clan/nix-select/archive/main.tar.gz"
       }
     },
-    "nixos-facter-modules": {
-      "locked": {
-        "lastModified": 1764252389,
-        "narHash": "sha256-3bbuneTKZBkYXlm0bE36kUjiDsasoIC1GWBw/UEJ9T4=",
-        "owner": "nix-community",
-        "repo": "nixos-facter-modules",
-        "rev": "5ea68886d95218646d11d3551a476d458df00778",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-facter-modules",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761656231,
-        "narHash": "sha256-krgZxGAIIIKFJS+UB0l8do3sYUDWJc75M72tepmVMzE=",
+        "lastModified": 1772173633,
+        "narHash": "sha256-MOH58F4AIbCkh6qlQcwMycyk5SWvsqnS/TCfnqDlpj4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d7f52a7a640bc54c7bb414cca603835bf8dd4b10",
+        "rev": "c0f3d81a7ddbc2b1332be0d8481a672b4f6004d6",
         "type": "github"
       },
       "original": {
@@ -219,14 +221,39 @@
         "type": "github"
       }
     },
+    "plasma-manager": {
+      "inputs": {
+        "home-manager": [
+          "home-manager"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772361940,
+        "narHash": "sha256-B1Cz+ydL1iaOnGlwOFld/C8lBECPtzhiy/pP93/CuyY=",
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "rev": "a4b33606111c9c5dcd10009042bb710307174f51",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "clan-core": "clan-core",
         "devshell": "devshell",
         "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
         "import-tree": "import-tree",
         "liminix": "liminix",
         "nixpkgs": "nixpkgs",
+        "plasma-manager": "plasma-manager",
         "treefmt-nix": "treefmt-nix"
       }
     },
@@ -238,11 +265,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764483358,
-        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "lastModified": 1772340640,
+        "narHash": "sha256-1nq7+Kt5IUBD8Hu3nptVPbMf+22rNJoHT0t9L1X+GKA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "rev": "dec4d8eac700dcd2fe3c020857d3ee220ec147f1",
         "type": "github"
       },
       "original": {
@@ -273,11 +300,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752055615,
-        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+        "lastModified": 1768158989,
+        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
         "type": "github"
       },
       "original": {

flake.nix

@@ -15,6 +15,15 @@
       inputs.nixpkgs-lib.follows = "nixpkgs";
       url = "github:hercules-ci/flake-parts";
     };
+    home-manager = {
+      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
+    };
+    plasma-manager = {
+      url = "github:nix-community/plasma-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
     import-tree.url = "github:vic/import-tree";
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     treefmt-nix = {
@@ -22,7 +31,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     liminix = {
-      url = "git+https://git.b4l.co.th/newedge/liminix?ref=refs/heads/fix-gl-ar750&rev=3f1f7c08d440130cce9262a93ce78ed7969d93cd";
+      url = "git+https://gti.telent.net/dan/liminix";
       flake = false;
     };
   };
@@ -61,6 +70,7 @@
             };
             packages.think = pkgs.think-gtcm;
             packages.think-be = pkgs.think-backend-gtcm;
+            packages.file-uploader = pkgs.gtcm-file-uploader;
           };
       }
     );

inventories/default.nix

@@ -1,4 +1,8 @@
 {
+  imports = [
+    ./personal-computer.nix
+    ./emmie.nix
+  ];
   clan = {
     inventory = {
 
@@ -11,6 +15,8 @@
         b4l = [
           "rigel"
           "neptune"
+          "rana"
+          "petra"
         ];
         phonebox = [
           "neptune"
@@ -21,6 +27,10 @@
           "adhil"
           "buna"
         ];
+        global-network = [
+          "rana"
+          "sirius"
+        ];
       };
 
       instances = {
@@ -86,6 +96,20 @@
           roles.peer.tags.b4l = { };
         };
 
+        yggdrasil-global-network = {
+          module = {
+            name = "yggdrasil";
+            input = "clan-core";
+          };
+          roles.default.tags."global-network" = { };
+          roles.default.settings.extraPeers = [
+            "tls://ygg.jjolly.dev:3443"
+            "tls://[2602:fc24:18:7a42::1]:993"
+            "tcp://leo.node.3dt.net:9002"
+            "tcp://ygg-kcmo.incognet.io:8883"
+          ];
+        };
+
         yggdrasil-phone-network = {
           module = {
             name = "yggdrasil";
@@ -109,12 +133,6 @@
           roles.default.machines."adhil".settings = {
             ata-ethernet-iface = "end0";
           };
-          roles.default.machines."rigel".settings = {
-            extraClientNumbers = [
-              "01"
-              "02"
-            ];
-          };
         };
 
         pocket-id = {
@@ -166,13 +184,6 @@
           };
           roles.default.machines.b4l = { };
         };
-        pingvin = {
-          module = {
-            name = "pingvin";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
         paperless = {
           module = {
             name = "paperless";
@@ -206,6 +217,72 @@
             };
           };
         };
+        git-daemon = {
+          module = {
+            name = "git-daemon";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.repositories =
+              let
+                defaults = rec {
+                  write-access = [
+                    "10.0.0.0/24"
+                    "200:d7b1:c5d5:ea7:27ad:6837:40f6:404d/128"
+                  ];
+                  read-access = write-access;
+                };
+                PUBLIC = {
+                  read-access = [
+                    "10.0.0.0/24"
+                    "0200::/7"
+                  ];
+                };
+              in
+              builtins.mapAttrs (_: override: defaults // override) {
+                "9e" = PUBLIC;
+                archive-dl = { };
+                barrytown = { };
+                cleanroom = PUBLIC;
+                community-memory = { };
+                eris = { };
+                ftdi-sd-spi = { };
+                go-go-gadget = { };
+                hacking-the-kindle = { };
+                islands = PUBLIC;
+                kt = { };
+                legba = { };
+                llb = PUBLIC;
+                llc = PUBLIC;
+                lora = { };
+                mute = { };
+                navi = { };
+                notmuch-memoryhole = PUBLIC;
+                pms5003 = { };
+                thinc = PUBLIC;
+                toad = { };
+                yggdrasil-erlang = { };
+              };
+          };
+        };
+
+        samba = {
+          module = {
+            name = "samba";
+            input = "self";
+          };
+          roles.server.machines."sirius".settings = {
+            globalUsers = {
+              w.writePerm = true;
+            };
+            sharedFolders = {
+              WHITEHOUSE = {
+                allowedGuest = true;
+              };
+            };
+            dataDir = "/mnt/hdd/samba";
+          };
+        };
       };
     };
   };

inventories/emmie.nix

@@ -0,0 +1,44 @@
+{ config, ... }:
+let
+  username = "emmie";
+  userhome = "/home/${username}";
+in
+{
+  clan.inventory = {
+    tags = {
+      emmie = [ "rana" ];
+    };
+
+    instances = {
+      emmie-syncthing = {
+        module = {
+          name = "syncthing";
+          input = "clan-core";
+        };
+        roles.peer.tags.emmie = { };
+        roles.peer.settings = {
+          folders = {
+            Syncthing = {
+              path = "${userhome}/Share/Syncthing";
+            };
+          };
+          extraDevices = {
+            pixel7a = {
+              id = "CEUJMEG-SOHXIJF-G2FT5QB-6MZW3EN-PONI3QN-HPEIOSU-IMSLGW7-XUU6BQK";
+              name = "eris";
+              addresses = [ "dynamic" ];
+            };
+          };
+        };
+        roles.peer.extraModules = [
+          {
+            config.services.syncthing = {
+              user = username;
+              dataDir = "${userhome}/Share";
+            };
+          }
+        ];
+      };
+    };
+  };
+}

inventories/personal-computer.nix

@@ -0,0 +1,50 @@
+{
+  clan.inventory = {
+    tags = {
+      kde-desktop = [
+        "rana"
+        "petra"
+      ];
+      personal-computer = [
+        "rana"
+        "petra"
+      ];
+    };
+
+    instances = {
+      emmie-home = {
+        module = {
+          name = "emmie-home";
+          input = "self";
+        };
+        roles.default.machines."rana" = { };
+      };
+      chocolate-home = {
+        module = {
+          name = "home-user";
+          input = "self";
+        };
+        roles.default.settings = {
+          username = "chocolate";
+          kbLayout = "us,th";
+          kbOptions = "grp:win_space_toggle,grp:alt_shift_toggle";
+        };
+        roles.default.machines."petra" = { };
+      };
+      personal-computer = {
+        module = {
+          name = "personal-computer";
+          input = "self";
+        };
+        roles.default.tags."personal-computer" = { };
+      };
+      kde = {
+        module = {
+          name = "kde";
+          input = "clan-core";
+        };
+        roles.default.tags."kde-desktop" = { };
+      };
+    };
+  };
+}

inventory.json

@@ -20,6 +20,15 @@
     },
     "buna": {
       "installedAt": 1765343708
+    },
+    "rana": {
+      "installedAt": 1773134236
+    },
+    "petra": {
+      "installedAt": 1769064458
+    },
+    "sirius": {
+      "installedAt": 1770974584
     }
   }
 }

machines/adhil/configuration.nix

@@ -7,7 +7,7 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   # clan.core.networking.targetHost = "root@";
 
-  clan.meta.name = "adhil";
-  clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
+  clan.core.settings.name = "adhil";
+  # clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
 
 }

machines/almach/configuration.nix

@@ -7,7 +7,7 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   # clan.core.networking.targetHost = "root@";
 
-  clan.meta.name = "almach";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "almach";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
 
 }

machines/alpheratz/configuration.nix

@@ -7,7 +7,7 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   # clan.core.networking.targetHost = "root@";
 
-  clan.meta.name = "alpheratz";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "alpheratz";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
 
 }

machines/b4l/services/nextcloud.nix

@@ -19,7 +19,7 @@ in
 
   services.nextcloud = {
     hostName = ncDomain;
-    package = pkgs.nextcloud31;
+    package = pkgs.nextcloud32;
 
     settings = {
 

machines/b4l/services/pingvin.nix

@@ -1,45 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-let
-  serviceName = "${config.networking.hostName}-pingvin";
-  domain-name = "${
-    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
-  }.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators."${serviceName}" = {
-    files = {
-      subdomain.secret = false;
-    };
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Pingvin. Default:(share)";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "share" > "$out"/subdomain
-      fi
-    '';
-  };
-
-  services.pingvin-share = {
-    nginx.enable = true;
-    https = true;
-    hostname = domain-name;
-  };
-}

machines/buna/configuration.nix

@@ -7,7 +7,7 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   # clan.core.networking.targetHost = "root@";
 
-  clan.meta.name = "buna";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
+  clan.core.settings.name = "buna";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
 
 }

machines/mirach/configuration.nix

@@ -7,7 +7,7 @@
   clan.core.sops.defaultGroups = [ "admins" ];
   # clan.core.networking.targetHost = "root@";
 
-  clan.meta.name = "mirach";
-  clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.name = "mirach";
+  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
 
 }

machines/neptune/configuration.nix

@@ -56,7 +56,7 @@
     "tls://astrra.space:55535"
   ];
 
-  clan.meta.name = "neptune";
-  clan.meta.description = "Radxa SBC board for testing. (With vi)";
+  clan.core.settings.name = "neptune";
+  # clan.meta.description = "Radxa SBC board for testing. (With vi)";
 
 }

machines/petra/configuration.nix

@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}

machines/petra/disko.nix

@@ -0,0 +1,77 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/ata-TOSHIBA_MQ01ABD100_85N8C2DPT";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+}

machines/ramus/configuration.nix

@@ -5,10 +5,10 @@
     system = "x86_64-linux";
   };
 
-  clan.meta.name = "ramus";
-  clan.meta.description = ''
-    A Hetzner VPS machine own by Alex.
-  '';
+  clan.core.settings.name = "ramus";
+  # clan.meta.description = ''
+  #   A Hetzner VPS machine own by Alex.
+  # '';
 
   clan.core.sops.defaultGroups = [ "admins" ];
   clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";

machines/ramus/think-greater-chiangmai.nix

@@ -1,6 +1,6 @@
 { self, config, ... }:
 let
-  commonSettings = {
+  commonSettings = rec {
     APP_NAME = "Laravel";
     APP_ENV = "local";
     APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
@@ -13,6 +13,7 @@ let
     DB_DATABASE = "thinkgtcm";
     DB_USERNAME = "gtcm";
 
+    R2_SCHEMA_URL = "https://${R2_BUCKET}.${R2_REGION}.your-objectstorage.com/test-large-files/";
     R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
     R2_SECRET_ACCESS_KEY._secret =
       config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
@@ -20,6 +21,8 @@ let
     R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
     R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;
 
+    R2_BUCKET_NAME = R2_BUCKET;
+
     LOG_CHANNEL = "stack";
     LOG_LEVEL = "debug";
 

machines/rana/configuration.nix

@@ -0,0 +1,12 @@
+{ self, ... }:
+{
+  imports = [
+    self.nixosModules.common
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}

machines/rana/disko.nix

@@ -1,11 +1,7 @@
-{ lib, ... }:
+{ ... }:
 let
   hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
-  os = "/dev/disk/by-id/mmc-FIXME";
-  vdev = [
-    "/dev/disk/by-id/ata-FIXME"
-    "/dev/disk/by-id/ata-FIXME"
-  ];
+  os = "/dev/disk/by-id/nvme-SAMSUNG_MZVL81T0HFLB-00BLL_S7XKNF0Y966645";
 in
 {
 
@@ -52,24 +48,14 @@ in
           };
         };
       };
-    }
-    // (lib.listToAttrs (
-      map (disk: {
-        name = "data-${hashDisk disk}";
-        value = {
-          type = "disk";
-          device = disk;
-          content = {
-            type = "zfs";
-            pool = "zdata";
-          };
-        };
-      }) vdev
-    ));
+    };
     zpool = {
       zroot = {
         type = "zpool";
         rootFsOptions = {
+          encryption = "aes-256-gcm";
+          keyformat = "passphrase";
+          keylocation = "file:///tmp/secret.key";
           mountpoint = "none";
           compression = "lz4";
           acltype = "posixacl";
@@ -102,40 +88,6 @@ in
           };
         };
       };
-      zdata = {
-        type = "zpool";
-        options.ashift = "12";
-        rootFsOptions = {
-          mountpoint = "none";
-          compression = "lz4";
-          acltype = "posixacl";
-          xattr = "sa";
-          "com.sun:auto-snapshot" = "true";
-        };
-        mode = {
-          topology = {
-            type = "topology";
-            vdev = [
-              {
-                mode = "mirror";
-                members = vdev;
-              }
-            ];
-          };
-        };
-        datasets = {
-          "nas" = {
-            type = "zfs_fs";
-            mountpoint = "/mnt/hdd";
-            mountOptions = [ "nofail" ];
-          };
-          "service-data" = {
-            type = "zfs_fs";
-            mountpoint = "/var/lib";
-            mountOptions = [ "nofail" ];
-          };
-        };
-      };
     };
   };
 }

machines/sirius/README.md

@@ -0,0 +1,21 @@
+## How to setup this machine.
+
+This machine cannot be setup the same way as other machines are setup. Meaning that `clan machine install` won't work. Because of `disko` issue. So, below is how the machine is setup.
+
+1. Build an image to flash to an sd-card using
+
+```
+nix build -L --show-trace .\#nixosConfigurations.sirius.config.system.build.images.sd-card
+```
+
+2. Import the `zdata`
+
+```
+zpool import zdata
+```
+
+3. Update configuration
+
+```
+clan machine update sirius
+```

machines/sirius/configuration.nix

@@ -1,6 +1,4 @@
 {
-  inputs,
-  config,
   self,
   ...
 }:
@@ -8,18 +6,68 @@
   imports = [
     self.nixosModules.common
 
-    (inputs.import-tree ./services)
-
+    ./hardware-configuration.nix
   ];
 
-  clan.core.sops.defaultGroups = [ "admins" ];
-  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
-
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
+  image.modules.sd-card = {
+    disabledModules = [
+      ./hardware-configuration.nix
+    ];
+  };
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+
+  nixpkgs.hostPlatform = {
+    system = "aarch64-linux";
   };
 
-  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
   system.stateVersion = "25.11";
 
+  services.journald.extraConfig = ''
+    Storage=volatile
+    RuntimeMaxUse=30M
+    RuntimeMaxFileSize=10M
+  '';
+
+  services.udisks2.enable = false;
+
+  nix.settings.log-lines = 25;
+  nix.settings.auto-optimise-store = true;
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 15d";
+  };
+
+  boot.loader.grub.enable = false;
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  boot.zfs.extraPools = [ "zdata" ];
+  boot.supportedFilesystems = [ "zfs" ];
+  boot.initrd.availableKernelModules = [
+    "usb_storage"
+    "sd_mod"
+  ];
+
+  fileSystems."/mnt/hdd" = {
+    device = "zdata/nas";
+    fsType = "zfs";
+    mountPoint = "/mnt/hdd";
+    options = [
+      "nofail"
+      "zfsutil"
+    ];
+  };
+
+  fileSystems."/var/lib" = {
+    device = "zdata/service-data";
+    fsType = "zfs";
+    mountPoint = "/var/lib";
+    options = [
+      "x-initrd.mount"
+      "nofail"
+      "zfsutil"
+    ];
+  };
+
 }

machines/sirius/disko-ref.nix

@@ -0,0 +1,150 @@
+{ lib, pkgs, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  # os = "/dev/disk/by-id/mmc-SD64G_0x8336354b";
+  vdev = [
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYDBVV7Z"
+    "/dev/disk/by-id/ata-ST20000NM002H-3KV133_ZYDBSJRE"
+  ];
+  configTxt = pkgs.writeText "config.txt" ''
+    [pi4]
+    kernel=u-boot-rpi4.bin
+    enable_gic=1
+
+    # Otherwise the resolution will be weird in most cases, compared to
+    # what the pi3 firmware does by default.
+    disable_overscan=1
+
+    # Supported in newer board revisions
+    arm_boost=1
+
+    [all]
+    # Boot in 64-bit mode.
+    arm_64bit=1
+
+    # U-Boot needs this to work, regardless of whether UART is actually used or not.
+    # Look in arch/arm/mach-bcm283x/Kconfig in the U-Boot tree to see if this is still
+    # a requirement in the future.
+    enable_uart=1
+
+    # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel
+    # when attempting to show low-voltage or overtemperature warnings.
+    avoid_warnings=1
+  '';
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+  # boot.tmp.useTmpfs = true;
+
+  disko.devices = {
+    disk = {
+      # "os-${hashDisk os}" = {
+      #   type = "disk";
+      #   device = os;
+      #   content = {
+      #     type = "gpt";
+      #     partitions = {
+      #       firmware = {
+      #         size = "60M";
+      #         priority = 1;
+      #         type = "0700";
+      #         content = {
+      #           type = "filesystem";
+      #           format = "vfat";
+      #           mountpoint = "/firmware";
+      #           postMountHook = toString (
+      #             pkgs.writeScript "postMountHook.sh" ''
+      #               (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf *.dtb /mnt/firmware/)
+      #               cp ${pkgs.ubootRaspberryPi4_64bit}/u-boot.bin /mnt/firmware/u-boot-rpi4.bin
+      #               cp ${configTxt} /mnt/firmware/config.txt
+      #             ''
+      #           );
+      #         };
+      #       };
+      #       ESP = {
+      #         size = "2G";
+      #         type = "EF00";
+      #         content = {
+      #           type = "filesystem";
+      #           format = "vfat";
+      #           mountpoint = "/boot";
+      #           mountOptions = [ "umask=0077" ];
+      #         };
+      #       };
+      #       root = {
+      #         name = "root";
+      #         end = "-0";
+      #         content = {
+      #           type = "filesystem";
+      #           format = "f2fs";
+      #           mountpoint = "/";
+      #           extraArgs = [
+      #             "-O"
+      #             "extra_attr,inode_checksum,sb_checksum,compression"
+      #           ];
+      #           mountOptions = [ "compress_algorithm=zstd:6,compress_chksum,atgc,gc_merge,lazytime,nodiscard" ];
+      #         };
+      #       };
+      #     };
+      #   };
+      # };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}

machines/sirius/hardware-configuration.nix

@@ -0,0 +1,6 @@
+{
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+    fsType = "ext4";
+  };
+}

machines/sirius/services/samba.nix

@@ -1,93 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  sambaUser = lib.filterAttrs (
-    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
-  ) config.users.users;
-
-  sharedFolders = {
-    WhiteHouse.users = [
-      "w"
-      "kurogeek"
-      "berwn"
-    ];
-  };
-in
-{
-
-  services.samba = {
-    enable = true;
-    openFirewall = true;
-    settings = {
-      global = {
-        security = "user";
-        workgroup = "WORKGROUP";
-        "server string" = "WhiteHouse NAS";
-        interfaces = "eth* en*";
-        "max log size" = "50";
-        "dns proxy" = false;
-        "syslog only" = true;
-        "map to guest" = "Bad User";
-        "guest account" = "nobody";
-      };
-    }
-    // lib.mapAttrs (share: opts: {
-      path = "/mnt/hdd/samba/${share}";
-      comment = share;
-      "force user" = share;
-      "force group" = share;
-      public = "yes";
-      "guest ok" = "yes";
-      "create mask" = "0640";
-      "directory mask" = "0750";
-      writable = "no";
-      browseable = "yes";
-      printable = "no";
-      # TODO
-      # "valid users" = toString opts.users;
-    }) sharedFolders;
-  };
-
-  users.users = lib.mapAttrs (share: opts: {
-    isSystemUser = true;
-    group = share;
-  }) sharedFolders;
-
-  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
-
-  systemd.services.samba-smbd.postStart =
-    lib.concatMapStrings (
-      user:
-      let
-        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
-      in
-      ''
-        mkdir -p /mnt/hdd/samba/${user}
-        chown ${user}:users /mnt/hdd/samba/${user}
-        # if a password is unchanged, this will error
-        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
-      ''
-    ) (lib.attrNames sambaUser)
-    + lib.concatMapStrings (share: ''
-      mkdir -p /mnt/hdd/samba/${share}
-      chown ${share}:${share} /mnt/hdd/samba/${share}
-    '') (lib.attrNames sharedFolders);
-
-  services.samba-wsdd = {
-    enable = true;
-    openFirewall = true;
-  };
-
-  services.avahi = {
-    publish.enable = true;
-    publish.userServices = true;
-    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
-    nssmdns4 = true;
-    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
-    enable = true;
-    openFirewall = true;
-  };
-}

modules/clan/actual-budget/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "actual-budget";
   manifest.description = "A local-first personal finance app ";
+  manifest.readme = "A local-first personal finance app";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "A default server role.";
 
     perInstance.nixosModule =
       {

modules/clan/git-daemon/default.nix

@@ -0,0 +1,174 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "git-daemon";
+  manifest.description = "a really simple server for git repositories";
+  manifest.readme = "a really simple server for git repositories";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default server role";
+    interface =
+      { lib, ... }:
+      {
+        options = with lib; {
+          directory = lib.mkOption {
+            type = types.str;
+            default = "/var/git";
+          };
+          repositories = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (
+                submodule (
+                  { name, ... }:
+                  {
+                    options = {
+                      name = lib.mkOption {
+                        type = str;
+                        default = name;
+                      };
+                      read-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                      write-access = lib.mkOption {
+                        type = listOf str;
+                        default = [ ];
+                      };
+                    };
+                  }
+                )
+              );
+            default = { };
+          };
+        };
+      };
+    perInstance =
+      {
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          {
+            pkgs,
+            lib,
+            config,
+            ...
+          }:
+          {
+            systemd.services.git-init = {
+              serviceConfig = {
+                Type = "oneshot";
+                User = config.services.gitDaemon.user;
+                Group = config.services.gitDaemon.group;
+                ExecStartPre = toString [
+                  "+${pkgs.coreutils}/bin/install"
+                  "--directory"
+                  "--owner=${config.services.gitDaemon.user}"
+                  "--group=${config.services.gitDaemon.group}"
+                  "--mode=0750"
+                  settings.directory
+                ];
+                ExecStart =
+                  let
+                    git-template = pkgs.stdenv.mkDerivation {
+                      name = "git-template";
+                      buildCommand = ''
+                        cp --no-preserve=mode,ownership --recursive \
+                          ${pkgs.git}/share/git-core/templates $out
+                        install -m550 $out/hooks/post-update{.sample,}
+                      '';
+                    };
+                    init-script =
+                      { name, ... }:
+                      pkgs.writeShellScript "git-init-${name}" ''
+                        ${pkgs.git}/bin/git init \
+                          --bare --template=${git-template} --shared=0660 \
+                          ${settings.directory}/${name}.git
+                        ${pkgs.git}/bin/git \
+                          -C ${settings.directory}/${name}.git \
+                          config set receive.denyNonFastforwards false
+                      '';
+                  in
+                  map init-script (lib.attrValues settings.repositories);
+              };
+            };
+
+            services.gitDaemon = {
+              enable = true;
+              user = "git";
+              group = "git";
+              options =
+                let
+                  firewall = pkgs.writeText "git-daemon-firewall.json" (
+                    builtins.toJSON (builtins.attrValues settings.repositories)
+                  );
+                  hook = pkgs.writers.writePython3 "hook.py" { flakeIgnore = [ "E" ]; } ''
+                    import os, sys, enum, pathlib, ipaddress, json
+
+                    class Service(enum.Enum):
+                        UploadPack = enum.auto()
+                        ReceivePack = enum.auto()
+                        UploadArchive = enum.auto()
+
+                        @classmethod
+                        def parse(cls, string):
+                            return {
+                                'upload-pack': cls.UploadPack,
+                                'receive-pack': cls.ReceivePack,
+                                'upload-archive': cls.UploadArchive
+                            }[string]
+
+                        @property
+                        def service(self):
+                            return {
+                                UploadPack: 'read-access',
+                                ReceivePack: 'write-access'
+                            }[self]
+                    UploadPack = Service.UploadPack
+                    ReceivePack = Service.ReceivePack
+
+                    def parse_remote_addr(remote_addr):
+                        if remote_addr.startswith('[') and remote_addr.endswith(']'):
+                            return ipaddress.ip_address(remote_addr[1:-1])
+                        return ipaddress.ip_address(remote_addr)
+
+                    service = Service.parse(sys.argv[1])
+                    repo = pathlib.Path(sys.argv[2]).stem
+                    client = parse_remote_addr(os.environ['REMOTE_ADDR'])
+
+                    with open("${firewall}", 'r') as f:
+                        firewall = json.load(f)
+
+                    for rule in firewall:
+                        if rule["name"] == repo:
+                           for network in rule[service.service]:
+                               if client in ipaddress.ip_network(network):
+                                   sys.exit(0)
+                    print('stairway denied')
+                    sys.exit(1)
+                  '';
+                in
+                toString [
+                  "--enable=upload-pack"
+                  "--enable=receive-pack"
+                  "--disable=upload-archive"
+                  "--access-hook=${hook}"
+                  "--informative-errors"
+                ];
+              exportAll = true;
+              basePath = settings.directory;
+            };
+
+            systemd.services.git-daemon = {
+              requires = [ "git-init.service" ];
+              after = [ "git-init.service" ];
+            };
+
+            networking.firewall.allowedTCPPorts = [ 9418 ];
+          };
+      };
+  };
+}

modules/clan/git-daemon/flake-module.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    git-daemon = module;
+  };
+}

modules/clan/grafana/default.nix

@@ -3,19 +3,38 @@
   _class = "clan.service";
   manifest.name = "grafana";
   manifest.description = "Platform for data analytics and monitoring";
+  manifest.readme = "Platform for data analytics and monitoring";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "A default server role";
 
     perInstance.nixosModule =
       {
         config,
         lib,
+        pkgs,
         ...
       }:
       {
+        clan.core.vars.generators.grafana = {
+          files = {
+            secret_key = {
+              owner = "grafana";
+              group = "grafana";
+              secret = true;
+            };
+          };
+          script = ''
+            openssl rand -hex 32 > "$out"/secret_key
+          '';
+          runtimeInputs = [
+            pkgs.openssl
+          ];
+        };
         services.grafana = {
           enable = lib.mkDefault true;
+          settings.security.secret_key = "$__file{${config.clan.core.vars.generators.grafana.files.secret_key.path}}";
         };
 
         clan.core.state.grafana.folders = [ config.services.grafana.dataDir ];

modules/clan/grafana/flake-module.nix

@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ self, inputs, ... }:
 let
-  module = lib.modules.importApply ./default.nix { };
+  module = ./default.nix;
 in
 {
   clan.modules = {
@@ -11,6 +11,7 @@ in
     {
       clan.nixosTests.service-grafana = {
         imports = [ ./tests/vm/default.nix ];
+        _module.args = { inherit self inputs; };
 
         clan.modules."@clan/grafana" = module;
       };

modules/clan/grafana/tests/vm/default.nix

@@ -1,8 +1,23 @@
 {
+  self,
+  config,
+  lib,
+  hostPkgs,
   ...
 }:
 {
   name = "service-grafana";
+  result.update-vars =
+    let
+      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
+    in
+    hostPkgs.writeShellScriptBin "update-vars" ''
+      set -x
+      export PRJ_ROOT=$(git rev-parse --show-toplevel)
+      ${
+        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
+      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
+    '';
 
   clan = {
     directory = ./.;

modules/clan/grafana/tests/vm/sops/machines/server/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1chfz220hkkxvv25x4cmqsen38ppat9erplqus8gvynv0ajnu4uaqgfq3tj",
+    "type": "age"
+  }
+]

modules/clan/grafana/tests/vm/sops/secrets/server-age.key/secret

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:ZGt489y6VugKlhVLz6hC5sL+E+IDT6MkHS7jMU36WFWK9Co9btY4HRo+JtH/3C5iVuGLf/0j7n6W8SYZXigVCUTUQJvE56RfZ1s=,iv:rQM4ZZhN345KE2A16J9/ZKMZ9O+Qvb5y6kwXA/6SuZg=,tag:C+oeBtNFcImKd3HV/6yFCQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZU0hqYmtDKzBRWDVMNVdm\nUW5XMXd4WDNha0ppbENwOHk1bk1mVWxVV0F3CktYT01XdktyenNvUzU4UXBReEVp\nZXJKS05kS0NsbFNqamlXMkVzRmRhUkEKLS0tIEgweFVCT2tOZmMrdERDV0FBN3N2\nVjZPZXR3L0x0dER4T1Q4cTBlV20vUjAK9QJ2p8VzNqVY/lrcKwL56YF2JBfJp11M\ns801/6IQ5WvMPziG/E/nppv/9zL0kQTh9EPGqevy0juGcvqQgn1KQw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-02T07:38:10Z",
+		"mac": "ENC[AES256_GCM,data:ShP6xVJaIIyj5kqRJeIbTNJBkY3H/xvj/RgbEl65RZbJNVE0HTHkTmartKVEyROWQlMyhwesJr8FEKAnOrWysUOKQUKV9Cgfvr6J/IXZj1ZJkXbE9NcFmsRshv4Po4sCig7Hq7qt/hQLBqutUjXnpvLaKgARz2dcOv8HSoVkCKU=,iv:bvl6lFb2z8DGQkShEWe5XlYmhtXNf3bL5RHSsk9LAXs=,tag:HomMsFH3jEHCR0L6aXVsBw==,type:str]",
+		"version": "3.12.1"
+	}
+}

modules/clan/grafana/tests/vm/sops/secrets/server-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/grafana/tests/vm/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}

modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:xXGuIJCmajuSHV3rBaAC0+XZZekqPd3rTr1bTKjMIU34IF9ueairclcSAUjFHakRG5EeGJ90PTosuC1vnqk/emQ=,iv:9Od0lV3SeTlT9sgJHY6yw/tLz5WNbaMDDFfjvIMO76M=,tag:T4ybZEUDGrp+p4I5NEr+Xg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1chfz220hkkxvv25x4cmqsen38ppat9erplqus8gvynv0ajnu4uaqgfq3tj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aUc5Yy8xOU0xcW02eDVK\nR0d5eXVtVU50dVk4L2dnZ3pObTJjOGQycHlnCjJBSndpdGNhRWVxeGZGdTJwZklU\nekdQTjZ1UTUzYklRVDd6WlVFeko0cEEKLS0tIDB2SkVpRXVEcG9nSGM0OG5hYmlR\ncXBMdUZ2MHdZd2hCaFF5Y1duOVlzc3MKgFUx3NZSoXiALUWj0gxPZLbmwfzRuq5w\nSc3CPCuEEALGq1unzndXJLSg+q4u/PAsZ/Q4l2CDHxuk5INct3Px7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTmxFL0UyNlhCaVhKWVJ5\nRUpLV3ZJdnNpYWZLa2phTlVNMmpzd20yd0FnCk9sOTFOZWQ3MzRHb3EwNUdzRDZ1\ndDk4eDVJRGFrOVIwd0xsb3c1b3VpWmcKLS0tIG16Nkc1TmlvbDNaYWZwcUFHYkV4\nT3Y5M1VOMWF3MHBMVlNMam1sSXIwNTQKRVvOVcV5GWua5hfS2ijKT5+C6Y5rZsXN\nKVzvemCk7pEGjVRSi4P0hrPnD37A6uwwj8FJqiLd7Y1p3hIVvBqR3w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-02T07:38:11Z",
+		"mac": "ENC[AES256_GCM,data:HiiWGBruyPo/vGDdz/Zc/8Vd8oB2aMqoDjJCTybe9tRTJAojiSYZR4YyBO2ApCnYDyStJqXL0ZRjjRB73dwvldaNASz2odl/GGprmxcCH3T0A+Zrgu2gN9yNA5i+LkBLC2URXYwra4Den/WvIOTnrvvQcszN9SUBs+MOJM56KZo=,iv:+pjWMIf0+wBvWzkvsvqP7CI6zJpO3+8sqaZUEocXkXU=,tag:yp2CpOb38Kp13f2CJSzHEg==,type:str]",
+		"version": "3.12.1"
+	}
+}

modules/clan/grafana/tests/vm/vars/per-machine/server/grafana/secret_key/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/grafana/tests/vm/vars/per-machine/server/state-version/version/value

@@ -0,0 +1 @@
+26.05

modules/clan/home-profiles/flake-module.nix

@@ -0,0 +1,7 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    home-user = lib.modules.importApply ./home-user { };
+    emmie-home = lib.modules.importApply ./home-user/emmie.nix { };
+  };
+}

modules/clan/home-profiles/home-user/default.nix

@@ -0,0 +1,64 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "common-user-home-manager";
+  manifest.description = "General users' home-manager profile generator";
+  manifest.readme = "General users' home-manager profile generator";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default role for the user";
+    interface =
+      { lib, ... }:
+      {
+        options = {
+          username = lib.mkOption {
+            type = lib.types.str;
+          };
+          kbLayout = lib.mkOption {
+            type = lib.types.str;
+            default = "us";
+          };
+          kbOptions = lib.mkOption {
+            type = lib.types.str;
+            default = "grp:win_space_toggle";
+          };
+        };
+      };
+    perInstance =
+      { settings, ... }:
+      {
+        nixosModule =
+          { inputs, ... }:
+          let
+            username = settings.username;
+          in
+          {
+            imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+            users.users.${username} = {
+              initialPassword = "";
+              isNormalUser = true;
+              extraGroups = [
+                "audio"
+                "video"
+                "networkmanager"
+              ];
+            };
+
+            services.xserver = {
+              enable = true;
+              xkb.layout = settings.kbLayout;
+              xkb.options = settings.kbOptions;
+            };
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.${username} = ./home.nix;
+            home-manager.extraSpecialArgs = {
+              inherit inputs username;
+            };
+          };
+      };
+  };
+}

modules/clan/home-profiles/home-user/emmie.nix

@@ -0,0 +1,127 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "emmie-home-manager";
+  manifest.description = "Emmie's home-manager profile generator";
+  manifest.readme = "Emmie's home-manager profile generator";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "a default role for the user";
+    perInstance =
+      { ... }:
+      {
+        nixosModule =
+          { inputs, pkgs, ... }:
+          let
+            username = "emmie";
+          in
+          {
+            imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+            users.users.${username} = {
+              initialPassword = "";
+              isNormalUser = true;
+              extraGroups = [
+                "audio"
+                "video"
+                "networkmanager"
+              ];
+            };
+
+            services.xserver = {
+              enable = true;
+              xkb.layout = "us,th";
+              xkb.options = "grp:win_space_toggle,grp:alt_shift_toggle";
+            };
+
+            programs.chromium = {
+              enable = true;
+              extraOpts = {
+                "BlockThirdPartyCookies" = true;
+                "ClearBrowsingDataOnExitList" = [
+                  "download_history"
+                  "cookies_and_other_site_data"
+                  "cached_images_and_files"
+                  "password_signin"
+                  "autofill"
+                  "site_settings"
+                  "hosted_app_data"
+                ];
+                "BraveRewardsDisabled" = true;
+                "BraveWalletDisabled" = true;
+                "BraveAIChatEnabled" = false;
+                "BraveNewsDisabled" = true;
+                "BraveSpeedreaderEnabled" = false;
+                "BraveWaybackMachineEnabled" = false;
+                "BraveStatsPingEnabled" = false;
+                "BraveWebDiscoveryEnabled" = false;
+                "BravePlaylistEnabled" = false;
+                "BraveVPNDisabled" = true;
+                "TorDisabled" = true;
+                "BraveP3AEnabled" = false;
+                "BraveTalkDisabled" = true;
+                "SyncDisabled" = false;
+                "PasswordManagerEnabled" = false;
+                "AutofillAddressEnabled" = false;
+                "AutofillCreditCardEnabled" = false;
+                "TranslateEnabled" = false;
+                "DnsOverHttpsMode" = "secure";
+                "DnsOverHttpsTemplates" = "https://dns.adguard-dns.com/dns-query";
+              };
+            };
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.${username} =
+              {
+                osConfig,
+                pkgs,
+                lib,
+                inputs,
+                ...
+              }:
+              {
+                imports = [ inputs.plasma-manager.homeModules.plasma-manager ];
+
+                home = {
+                  homeDirectory = lib.mkForce "/home/${username}";
+                  stateVersion = osConfig.system.stateVersion;
+                  packages = with pkgs; [
+                    libreoffice-fresh
+                    element-desktop
+                    signal-desktop
+                    brave
+                    keepassxc
+                    vlc
+                    thunderbird
+                    wasabiwallet
+                    protonmail-desktop
+                  ];
+                };
+                programs.chromium.package = pkgs.brave;
+                programs.home-manager.enable = true;
+                services.syncthing.tray.enable = osConfig.services.syncthing.enable;
+                programs.plasma.enable = true;
+                programs.plasma.powerdevil = {
+                  AC = {
+                    autoSuspend.action = "shutDown";
+                    autoSuspend.idleTimeout = 1800;
+                  };
+                  battery = {
+                    autoSuspend.action = "shutDown";
+                    autoSuspend.idleTimeout = 1800;
+                  };
+                  lowBattery = {
+                    autoSuspend.action = "shutDown";
+                    autoSuspend.idleTimeout = 1800;
+                  };
+                };
+              };
+            home-manager.extraSpecialArgs = {
+              inherit inputs;
+            };
+          };
+      };
+  };
+}

modules/clan/home-profiles/home-user/home.nix

@@ -0,0 +1,26 @@
+{
+  osConfig,
+  pkgs,
+  lib,
+  username,
+  ...
+}:
+{
+  home = {
+    inherit username;
+    homeDirectory = lib.mkForce "/home/${username}";
+    stateVersion = osConfig.system.stateVersion;
+    packages = with pkgs; [
+      libreoffice-fresh
+      element-desktop
+      signal-desktop
+      brave
+      firefox
+      keepassxc
+      vlc
+      thunderbird
+    ];
+  };
+  programs.home-manager.enable = true;
+  services.syncthing.tray.enable = osConfig.services.syncthing.enable;
+}

modules/clan/jukebox/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "jukebox";
   manifest.description = "mpd server, library on removable disks";
+  manifest.readme = "mpd server, library on removable disks";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     interface =
       { lib, ... }:
       {
@@ -111,19 +113,22 @@
 
             services.mpd = {
               enable = true;
-              musicDirectory = settings.baseDir;
-              network.listenAddress = "any";
-              extraConfig = ''
-                audio_output {
-                  type "pulse"
-                  name "jukebox"
-                  server "localhost"
-                }
-              '';
+              openFirewall = true;
+              settings = {
+                bind_to_address = "any";
+                music_directory = settings.baseDir;
+                audio_output = [
+                  {
+                    type = "pulse";
+                    name = "jukebox";
+                    server = "localhost";
+                  }
+                ];
+              };
             };
 
             networking.firewall.interfaces = lib.genAttrs settings.binds (_: {
-              allowedTCPPorts = [ config.services.mpd.network.port ];
+              allowedTCPPorts = [ config.services.mpd.settings.port ];
             });
 
             environment.systemPackages = [ pkgs.mpc ];

modules/clan/nextcloud/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "nextcloud";
   manifest.description = "Nextcloud server, a safe home for all your data";
+  manifest.readme = "Nextcloud server, a safe home for all your data";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
 
     perInstance.nixosModule =
       {

modules/clan/paperless/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "paperless";
   manifest.description = "A community-supported supercharged document management system: scan, index and archive all your documents";
+  manifest.readme = "A community-supported supercharged document management system: scan, index and archive all your documents";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
 
     perInstance.nixosModule =
       {
@@ -14,6 +16,18 @@
         ...
       }:
       {
+        nixpkgs.overlays = [
+          (final: prev: {
+            pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+              (pyFinal: pyPrev: {
+                psycopg = pyPrev.psycopg.overrideAttrs (old: {
+                  disabledTests = old.disabledTests ++ [ "test_stats_connect" ];
+                });
+              })
+            ];
+          })
+        ];
+
         services.paperless = {
           enable = lib.mkDefault true;
         };

modules/clan/personal-computer/automatic-timezone.nix

@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  services.automatic-timezoned.enable = true;
+  services.geoclue2 = {
+    enableDemoAgent = lib.mkForce true;
+    geoProviderUrl = "https://beacondb.net/v1/geolocate";
+  };
+}

modules/clan/personal-computer/default.nix

@@ -0,0 +1,21 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "personal-computer";
+  manifest.description = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.readme = "A service for configuring personal computer such as printing, automatic-timezone, etc.";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    description = "an only one default role";
+    perInstance.nixosModule =
+      { inputs, lib, ... }:
+      {
+        imports = [
+          (inputs.import-tree.initFilter (
+            p: !lib.hasSuffix "default.nix" p && !lib.hasSuffix "flake-module.nix" p
+          ) ./.)
+        ];
+      };
+  };
+}

modules/clan/personal-computer/desktop-environment.nix

@@ -0,0 +1,9 @@
+{ config, lib, ... }:
+{
+  security.pam.services."sddm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+  security.pam.services."gdm".kwallet.enable = config.services.desktopManager.plasma6.enable;
+
+  services.displayManager.sddm.enable = lib.mkForce false;
+  services.displayManager.gdm.enable = true;
+  services.displayManager.gdm.wayland = true;
+}

modules/clan/personal-computer/flake-module.nix

@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    personal-computer = lib.modules.importApply ./default.nix { };
+  };
+}

modules/clan/personal-computer/libinput.nix

@@ -0,0 +1,11 @@
+{
+  services = {
+    libinput = {
+      enable = true;
+      touchpad = {
+        disableWhileTyping = true;
+        naturalScrolling = true;
+      };
+    };
+  };
+}

modules/clan/personal-computer/printing.nix

@@ -0,0 +1,62 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  allowManageGroups = [
+    "root"
+    "wheel"
+    "lpadmin"
+  ];
+  polkitAllowGroups = builtins.concatStringsSep "||" (
+    builtins.map (group: ''subject.isInGroup("${group}")'') allowManageGroups
+  );
+
+  printerMember = lib.map (user: user.name) (
+    lib.attrsets.attrsToList (
+      lib.attrsets.filterAttrs (name: value: value.isNormalUser) config.users.users
+    )
+  );
+
+in
+{
+  services.printing = {
+    enable = true;
+    drivers = [
+      pkgs.brlaser
+      pkgs.gutenprint
+    ];
+
+    extraFilesConf = ''
+      SystemGroup ${builtins.concatStringsSep " " allowManageGroups}
+    '';
+  };
+
+  security.polkit = {
+    enable = true;
+
+    extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        var actionMatchs = (
+          action.id.indexOf('org.opensuse.cupspkhelper.mechanism.') === 0
+        );
+        if (actionMatchs) {
+          if (${polkitAllowGroups}) {
+            return polkit.Result.YES
+          }
+        }
+      });
+    '';
+  };
+
+  hardware.sane = {
+    enable = true;
+  };
+
+  users.groups.lpadmin.members = printerMember;
+  users.groups.lp.members = printerMember;
+  users.groups.scanner.members = printerMember;
+
+}

modules/clan/personal-computer/users.nix

@@ -0,0 +1,11 @@
+{ lib, ... }:
+{
+  users.mutableUsers = lib.mkForce true;
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if ((action.id == "org.freedesktop.accounts.change-own-password")) {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+}

modules/clan/personal-computer/wireless.nix

@@ -0,0 +1,4 @@
+{
+  networking.networkmanager.enable = true;
+  hardware.bluetooth.enable = true;
+}

modules/clan/phonebox/default.nix

@@ -1,11 +1,16 @@
-{ clanLib, ... }:
+{
+  clanLib,
+  ...
+}:
 {
   _class = "clan.service";
   manifest.name = "phonebox";
-  manifest.description = "";
+  manifest.description = "A peer to peer phone relay network built on top of yggdrasil.";
+  manifest.readme = "A peer to peer phone relay network built on top of yggdrasil.";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     interface =
       { lib, ... }:
       {
@@ -14,10 +19,10 @@
           description = "An Ethernet interface that connect to ATA box.";
           default = "enp2s0";
         };
-        options.extraClientNumbers = lib.mkOption {
-          type = with lib.types; listOf str;
-          description = "List of client suffix number.";
-          default = [ ];
+        options.ownerName = lib.mkOption {
+          type = lib.types.str;
+          description = "";
+          default = "";
         };
       };
     perInstance =
@@ -27,6 +32,7 @@
         ...
       }:
       {
+
         nixosModule =
           {
             lib,
@@ -39,12 +45,57 @@
               propagatedNativeBuildInputs = [ pkgs.spandsp3 ];
             });
 
+            machines = lib.attrNames roles.default.machines;
+
             user = "asterisk";
             faxDir = "/run/asterisk/fax";
             rtpPortFrom = 10000;
             rtpPortTo = 20000;
             ata-interface = settings.ata-ethernet-iface;
 
+            contactList = builtins.map (machineName: {
+              name = "${clanLib.getPublicValue {
+                flake = config.clan.core.settings.directory;
+                machine = machineName;
+                generator = "phonebox";
+                file = "owner-name";
+                default = null;
+              }}";
+              number = "${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "server-prefix-number";
+                  default = null;
+                }
+              }${
+                clanLib.getPublicValue {
+                  flake = config.clan.core.settings.directory;
+                  machine = machineName;
+                  generator = "phonebox";
+                  file = "ata-local-number";
+                  default = null;
+                }
+              }";
+            }) machines;
+
+            createContactListTiff =
+              let
+                contactTXT = lib.concatStringsSep "\n" (
+                  builtins.map (contact: "${contact.number}\t\t: \t\t${contact.name}") contactList
+                );
+              in
+              pkgs.writeShellApplication {
+                name = "create-contact-tiff";
+                text = ''
+                  magick -background white -fill black -pointsize 20 -font DejaVu-Sans label:"${contactTXT}" "$1"
+                  magick "$1" -border 20x50 -bordercolor white "$1"
+                  magick "$1" -resize 1728x -units PixelsPerInch -compress Group4 -density 204x196 -monochrome -depth 1 "$1"
+                '';
+                runtimeInputs = [ pkgs.imagemagick ];
+              };
+
             genServerSIPEndpoint =
               { hostname, address }:
               ''
@@ -72,22 +123,7 @@
 
                 [${localNumber}](dynamiic_aor)
                 max_contacts=1
-              '';
-
-            genLocalSIPEndpointV6 =
-              { localNumber }:
-              ''
-                [${localNumber}](internal_endpoint)
-                transport=transport-udp6
-                aors=${localNumber}
-                auth=${localNumber}
-
-                [${localNumber}](userpass_auth)
-                username=${localNumber}
-                password=${localNumber}
-
-                [${localNumber}](dynamiic_aor)
-                max_contacts=1
+                remove_existing=yes
               '';
 
             genLocalExtenConf =
@@ -123,26 +159,35 @@
                 throw "clanService/yggdrasil is required";
           in
           {
-            clan.core.vars.generators.phonebox = {
+            clan.core.vars.generators.phonebox = builtins.break {
               files = {
                 server-prefix-number.secret = false;
                 ata-local-number.secret = false;
+                owner-name.secret = false;
               };
 
               prompts = {
                 server-prefix-number = {
                   type = "line";
+                  persist = true;
                   description = "Server prefix number: indicate server to connect to [10XX]";
                 };
                 ata-local-number = {
+                  persist = true;
                   type = "line";
                   description = "Local suffix number: indicate local number on the server [XX00]";
                 };
+                owner-name = {
+                  persist = true;
+                  type = "line";
+                  description = "The owner's name for this unit";
+                };
               };
 
               script = ''
                 cat $prompts/server-prefix-number > $out/server-prefix-number
                 cat $prompts/ata-local-number > $out/ata-local-number
+                cat $prompts/owner-name > $out/owner-name
               '';
             };
 
@@ -220,7 +265,6 @@
               package = lib.mkDefault asterisk;
               confFiles =
                 let
-                  machines = lib.attrNames roles.default.machines;
                   nodes = builtins.foldl' (
                     nodes: name:
                     nodes
@@ -296,18 +340,22 @@
                       same => n,Set(FAXFILE=${faxDir}/echo-''${UNIQUEID}.tiff)
                       same => n,Set(FAXECHO=true)
 
+                      exten => 888,1,Answer()
+                      same => n,Set(FAXFILE=${faxDir}/contact.tiff)
+                      same => n,System(${lib.getExe createContactListTiff} ''${FAXFILE})
+                      same => n,Set(FAXECHO=true)
+                      same => n,Playback(vm-goodbye)
+                      same => n,Wait(3)
+
                       exten => h,1,GotoIf($[''${FAXECHO}]?sendfax)
                       same => n,Hangup()
-                      same => n(sendfax),Originate(PJSIP/00,app,SendFAX,${faxDir}/echo-''${UNIQUEID}.tiff)
+                      same => n(sendfax),Originate(PJSIP/00,app,SendFAX,''${FAXFILE})
                       same => n,Set(FAXECHO=false)
 
                     ''
                     + (genLocalExtenConf {
                       localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
                     })
-                    + lib.concatStringsSep "\n" (
-                      builtins.map (number: genLocalExtenConf { localNumber = number; }) settings.extraClientNumbers
-                    )
                     + serverConf;
 
                   "rtp.conf" = ''
@@ -339,7 +387,6 @@
 
                       [base_endpoint](!)
                       type=endpoint
-                      transport=transport-udp
                       disallow=all
                       allow=ulaw,alaw,g722,gsm
                       direct_media=no
@@ -362,13 +409,14 @@
                     + (genLocalSIPEndpoint {
                       localNumber = config.clan.core.vars.generators.phonebox.files.ata-local-number.value;
                     })
-                    + lib.concatStringsSep "\n" (
-                      builtins.map (number: genLocalSIPEndpointV6 { localNumber = number; }) settings.extraClientNumbers
-                    )
                     + serverConf;
                 };
             };
 
+            environment.systemPackages = [
+              createContactListTiff
+            ];
+
             systemd.tmpfiles.rules = [
               "d ${faxDir}                            0755 ${user} ${user} - -"
             ];

modules/clan/phonebox/tests/vm/vars/per-machine/server/phonebox/owner-name/value

@@ -0,0 +1 @@
+fake_line_value

modules/clan/pingvin/default.nix

@@ -1,23 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "pingvin";
-  manifest.description = "A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient file sharing.";
-  manifest.categories = [ "System" ];
-
-  roles.default = {
-
-    perInstance.nixosModule =
-      {
-        config,
-        ...
-      }:
-      {
-        services.pingvin-share = {
-          enable = true;
-        };
-
-        clan.core.state.pingvin-share.folders = [ config.services.pingvin-share.dataDir ];
-      };
-  };
-}

modules/clan/pingvin/flake-module.nix

@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  module = lib.modules.importApply ./default.nix { };
-in
-{
-  clan.modules = {
-    pingvin = module;
-  };
-
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.service-pingvin = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/pingvin" = module;
-      };
-    };
-}

modules/clan/pingvin/tests/vm/default.nix

@@ -1,42 +0,0 @@
-{
-  ...
-}:
-{
-  name = "service-pingvin";
-
-  clan = {
-    directory = ./.;
-    inventory = {
-      machines.server = { };
-
-      instances = {
-        pingvin-test = {
-          module.name = "@clan/pingvin";
-          module.input = "self";
-          roles.default.machines."server".settings = { };
-        };
-      };
-    };
-  };
-
-  nodes = {
-    server = {
-      services.pingvin-share = {
-        hostname = "share.localhost";
-        frontend.port = 3000;
-        backend.port = 8000;
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    server.wait_for_unit("pingvin-share-frontend")
-
-    server.succeed("systemctl status pingvin-share-frontend")
-    server.wait_for_open_port(3000)
-    server.wait_for_open_port(8000)
-    server.succeed("curl -H \"Host: share.localhost\" http://127.0.0.1:3000 ")
-  '';
-}

modules/clan/pocket-id/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "pocket-id";
   manifest.description = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
+  manifest.readme = "A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
 
     perInstance.nixosModule =
       {

modules/clan/pulse-stream/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "pulse-stream";
   manifest.description = "stream audio to attached speakers";
+  manifest.readme = "stream audio to attached speakers";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default role";
     interface =
       { lib, ... }:
       {

modules/clan/samba/default.nix

@@ -0,0 +1,253 @@
+{ lib, ... }:
+{
+  _class = "clan.service";
+  manifest.name = "samba";
+  manifest.description = "Samba configuration for NAS";
+  manifest.readme = "Samba configuration for NAS";
+  manifest.categories = [ "System" ];
+
+  roles.server = {
+    description = "A server role that host files";
+
+    interface =
+      { lib, ... }:
+      let
+        userOptions = {
+          readPerm = lib.mkOption {
+            type = with lib.types; bool;
+            description = "Permission to read";
+            default = false;
+          };
+          writePerm = lib.mkOption {
+            type = with lib.types; bool;
+            description = "Permission to write";
+            default = false;
+          };
+        };
+      in
+      {
+        options = {
+
+          globalUsers = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (submodule {
+                options = userOptions;
+              });
+            description = "List of global users with permissions, this will be applied to all the folders.";
+            default = {
+              admin = {
+                readPerm = true;
+                writePerm = true;
+              };
+            };
+          };
+
+          sharedFolders = lib.mkOption {
+            type =
+              with lib.types;
+              attrsOf (submodule {
+                options = {
+                  users = lib.mkOption {
+                    type =
+                      with lib.types;
+                      attrsOf (submodule {
+                        options = userOptions;
+                      });
+                    description = "List of users with permissions, this will only applied to this particular folder.";
+                    default = { };
+                  };
+                  allowedGuest = lib.mkOption {
+                    type = with lib.types; bool;
+                    description = "Whether to allow guest access to this folder.";
+                    default = false;
+                  };
+                };
+              });
+            description = "List of folders with users permissions.";
+            default = [
+              {
+                name = "DEFAULT";
+              }
+            ];
+
+          };
+
+          dataDir = lib.mkOption {
+            type =
+              with lib.types;
+              oneOf [
+                str
+                path
+              ];
+            description = "A directory where all samba folders will be.";
+          };
+
+        };
+      };
+    perInstance =
+      { settings, ... }:
+      let
+        allUsernameList = lib.uniqueStrings (
+          lib.flatten (
+            (lib.mapAttrsToList (name: share: builtins.attrNames share.users) settings.sharedFolders)
+            ++ builtins.attrNames settings.globalUsers
+          )
+        );
+      in
+      {
+        nixosModule =
+          {
+            lib,
+            config,
+            pkgs,
+            ...
+          }:
+          {
+
+            users.users = builtins.listToAttrs (
+              map (
+                username:
+                lib.nameValuePair username {
+                  isSystemUser = true;
+                  group = username;
+                }
+              ) (allUsernameList ++ builtins.attrNames settings.sharedFolders)
+            );
+
+            users.groups = builtins.listToAttrs (
+              map (username: lib.nameValuePair username { }) (
+                allUsernameList ++ builtins.attrNames settings.sharedFolders
+              )
+            );
+
+            clan.core.vars.generators = builtins.listToAttrs (
+              map (
+                username:
+                lib.nameValuePair "${username}-smb-password" {
+                  files.password = { };
+                  runtimeInputs = with pkgs; [
+                    coreutils
+                    xkcdpass
+                    mkpasswd
+                  ];
+                  script = ''
+                    xkcdpass --numwords 3 --delimiter - --count 1 > $out/password
+                  '';
+                }
+              ) allUsernameList
+            );
+
+            systemd.services.samba-smbd.postStart =
+              lib.concatMapStrings (
+                user:
+                let
+                  passwordPath = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+                  userDir = "${settings.dataDir}/${user}";
+                in
+                ''
+                  mkdir -p ${userDir}
+                  chown ${user}:users ${userDir}
+                  # if a password is unchanged, this will error
+                  (echo $(<${passwordPath}); echo $(<${passwordPath})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+                ''
+              ) allUsernameList
+              + lib.concatMapStrings (
+                share:
+                let
+                  shareDir = "${settings.dataDir}/${share}";
+                in
+                ''
+                  mkdir -p ${shareDir}
+                  chown ${share}:${share} ${shareDir}
+                ''
+              ) (builtins.attrNames settings.sharedFolders);
+
+            services.samba = {
+              enable = true;
+              openFirewall = true;
+              settings = {
+                global = {
+                  security = "user";
+                  workgroup = "WORKGROUP";
+                  "server string" = "WhiteHouse NAS";
+                  "max log size" = "50";
+                  "dns proxy" = false;
+                  "syslog only" = true;
+                  "map to guest" = "Bad User";
+                  "guest account" = "nobody";
+                };
+              }
+              // lib.mapAttrs (
+                shareName: value:
+                {
+                  path = "${settings.dataDir}/${shareName}";
+                  comment = shareName;
+                  "force user" = shareName;
+                  "force group" = shareName;
+                  "create mask" = "0640";
+                  "directory mask" = "0750";
+                  "read only" = "yes";
+                  browseable = "yes";
+                  printable = "no";
+                  "read list" = lib.concatStringsSep " " (
+                    lib.uniqueStrings (
+                      lib.flatten (
+                        (builtins.attrNames (lib.filterAttrs (n: v: v.readPerm) value.users))
+                        ++ (builtins.attrNames (lib.filterAttrs (n: v: v.readPerm) settings.globalUsers))
+                      )
+                    )
+                  );
+                  "write list" = lib.concatStringsSep " " (
+                    lib.uniqueStrings (
+                      lib.flatten (
+                        (builtins.attrNames (lib.filterAttrs (n: v: v.writePerm) value.users))
+                        ++ (builtins.attrNames (lib.filterAttrs (n: v: v.writePerm) settings.globalUsers))
+                      )
+                    )
+                  );
+                }
+                // lib.optionalAttrs (value.allowedGuest) {
+                  public = "yes";
+                  "guest ok" = "yes";
+                }
+              ) settings.sharedFolders
+              // builtins.listToAttrs (
+                map (
+                  user:
+                  lib.nameValuePair user {
+                    comment = user;
+                    path = "${settings.dataDir}/${user}";
+                    "force user" = user;
+                    "force group" = "users";
+                    public = "yes";
+                    "guest ok" = "no";
+                    "create mask" = "0640";
+                    "directory mask" = "0750";
+                    writable = "yes";
+                    browseable = "yes";
+                    printable = "no";
+                    "valid users" = user;
+                  }
+                ) allUsernameList
+              );
+            };
+
+            services.samba-wsdd = {
+              enable = true;
+              openFirewall = true;
+            };
+
+            services.avahi = {
+              publish.enable = true;
+              publish.userServices = true;
+              # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+              nssmdns4 = true;
+              # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+              enable = true;
+              openFirewall = true;
+            };
+          };
+      };
+  };
+}

modules/clan/samba/flake-module.nix

@@ -0,0 +1,20 @@
+{ inputs, self, ... }:
+let
+  module = ./default.nix;
+in
+{
+  clan.modules = {
+    samba = module;
+  };
+
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.service-samba = {
+        imports = [ ./tests/vm/default.nix ];
+        _module.args = { inherit self inputs; };
+
+        clan.modules."@clan/samba" = module;
+      };
+    };
+}

modules/clan/samba/tests/vm/default.nix

@@ -0,0 +1,86 @@
+{
+  lib,
+  self,
+  config,
+  hostPkgs,
+  ...
+}:
+let
+  testDir = "/mnt/hdd/samba";
+in
+{
+  name = "service-samba";
+  result.update-vars =
+    let
+      relativeDir = lib.removePrefix "${self}/" (toString config.clan.directory);
+    in
+    hostPkgs.writeShellScriptBin "update-vars" ''
+      set -x
+      export PRJ_ROOT=$(git rev-parse --show-toplevel)
+      ${
+        self.inputs.clan-core.packages.${hostPkgs.system}.clan-cli
+      }/bin/clan-generate-test-vars $PRJ_ROOT/${relativeDir} ${config.name}
+    '';
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        samba-test = {
+          module.name = "@clan/samba";
+          module.input = "self";
+          roles.server.machines."server".settings = {
+            dataDir = testDir;
+            globalUsers = {
+              guser1 = {
+                readPerm = true;
+                writePerm = true;
+              };
+            };
+            sharedFolders = {
+              "share1" = {
+                users = {
+                  "u1share1" = { };
+                  "u2share1" = { };
+                };
+              };
+              "share2" = {
+                users = {
+                  "u1share2" = { };
+                  "u2share2" = { };
+                };
+              };
+              "share3" = { };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("samba-smbd")
+
+    server.succeed("systemctl status samba-smbd")
+
+    server.succeed("test -d ${testDir}/guser1")
+    server.succeed("test -d ${testDir}/u1share1")
+    server.succeed("test -d ${testDir}/u2share1")
+    server.succeed("test -d ${testDir}/u1share2")
+    server.succeed("test -d ${testDir}/u2share2")
+    server.succeed("test -d ${testDir}/share1")
+    server.succeed("test -d ${testDir}/share2")
+
+    server.succeed("runuser -u guser1 -- test -r ${testDir}/share1")
+    server.succeed("runuser -u guser1 -- test -r ${testDir}/share1")
+    server.succeed("runuser -u u1share1 -- test -r ${testDir}/share1")
+  '';
+}

modules/clan/samba/tests/vm/sops/machines/server/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
+    "type": "age"
+  }
+]

modules/clan/samba/tests/vm/sops/secrets/server-age.key/secret

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:EH+rEfBdg4O7dEsk0o95T7xBQK/7duVCnLpdFOC1rWVbwdt/qYzEobZCo9awzvmh6YlC9Ld/OKv5wIBJJJI8PpTII2jdlWMG778=,iv:nhswri4dJ+Yj/1zarXzvLUhfJPSlWCGjVYOP6sYOT3w=,tag:WKFP6xhiSAfuDY880tEyAw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBheUV1blJCMFFoQmxVaGdK\nUmpsZHRkWDJXczFRaDdqWVRXeXYzSVZhdFUwCmY1Ym1uVWF2akJlc2JScWZWUUtI\nbXgvTFYvS0d1aXVSVkFUakJNSVdrZUEKLS0tIFA5WllweEhrK2hwYkFMaTRYeGJT\nU3YxY1ZIblhYdlJZaERodWVsSW1yYmsK5ow3QIvOt7nelW+aiBo1Z08SCqXTThTb\nAimCwnhqBhW08ipZ5hmQFqZc4cfoDapmemOBqW9Q6NPyNB0Mr2EIdg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-02-11T02:53:23Z",
+		"mac": "ENC[AES256_GCM,data:TxoCasCZ4fRLU4gFWSDl4oi5YUIFSKirYV1kI5oMJcFqSFUZ0ZXCbuBX4i5UA/VWkY0/Th4scRqgvVCFcr/sO8DGh+oi14Ayu1o70Pjf/f0u6S3ROa84f5nBybq8oVQTzP23+a0OkpJTB2vS+ELB2Q7GOeQ7MIrya58XB+40QCg=,iv:9H+0luICB18332YyuUnF+d8sYDWYWakiIK95dmqOZVA=,tag:ldPbuLykRCp9sqI+vHoO3w==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/samba/tests/vm/sops/secrets/server-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

modules/clan/samba/tests/vm/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}

modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:WU0RGh0P17GqEfENAZO9/orLxtU8wpc=,iv:yFINf8UCfkSKmWSghHB1wsrsgMcgAxjXbuSbtQY7WhI=,tag:sugSGytBTks5EYk5gZUw/Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBER2VuTUVpTnRDNzVKcW5I\nMTZ3NW5JVEJSVnB4UTBJQ2g5S3ZRdnZBaTFRCmZWTUwyckZwL1RhdXJaZUkyL1lH\nODdienVFWENrb0VDWENOK0hseFBKLzgKLS0tIHMrWDd3ZW9UM3lWZU9Vb2JYUC91\nZGhTTVBmSURPVmNITVlIM2swNXAxUW8K2/88jwpUI+gZ8B289I/AvxtXpQHRabcy\nS2tK1rww6umRYmEvN8X3Ek5cz7XeulgY3gMlS+IbtScjXCGySw5tTg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZRlFGV0FveEpkZVNhbjE0\nZ0c2cWtYTEVVTWlkeFMvT2twQVF1ZkRQcVJjCkVLRUpUY0RBQW54dU5McjUzbGQv\nSEorSFpXM3J3ZFgveUg3WDdMOVlwZWsKLS0tIHR2bXRVMnkxNThtNE5McmhzWWRE\ncHAyYW5FZXJ5T2piREhHY1F5WXpsQ0UKFyeMvgOogS9n8puvB0/0lq5+sOSq8yfZ\nSIGlqE0KTmFryNpPUINiJj5SpvdXvUeVqahoCB1QOGbodX1vKiwdgA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-02-11T02:53:23Z",
+		"mac": "ENC[AES256_GCM,data:gRxnr9F8mT7OuooHRVgtNLut1BAEQiWpVr9iw7oN2mKlbZxq0X09K8jYZu0/dEMijbRfDoZ2bUmW7VIcqAZXwAZqLoqx3vzBqOGAQFcxyVFk0yRqPzR6odMYBdOeLFufN9l1IXOKiH4wZZB1kHean7XBlLzNUCTts12l+wInisY=,iv:zz7g/VcsBkY0kCELIIOBByLOj9bfXVOkw7JdTnlKRWc=,tag:FcGO6rsv+fBTHt+ymL6c0A==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/samba/tests/vm/vars/per-machine/server/guser1-smb-password/password/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/samba/tests/vm/vars/per-machine/server/state-version/version/value

@@ -0,0 +1 @@
+26.05

modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:bgmzK6ERM6e6uJMW8Cqfgo1ktvM6l83LxNJV,iv:aYAYbWvBLZZx9zdUUZ/K29heR/yKXRDeR48g8rhKIQY=,tag:ZhXGRovVumEa0lpT8P8KaQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTG4yRFM5T1B1SWdzWWYv\nQTd0M2RjVTVKNy9rNUM1TmtvcEZsTVZ1U0JFCjNTOS95alh6MVZubXhOTGRwakUz\nZDBFck8rUVhYay9iRTRHY0pCZDJsSEEKLS0tIHJPUXpOVnMxMk9aSjYrTEFvSEJo\ndTd1MmNabVI1YkkwbVhkMnJLRzZzYjQKP6ehM8PTOrPVMgViUPGsXTyOdr9k5OAO\npf0faZpfH/GHiVBT7vaLrE/BLOhxLNkltldqyS1IUy19iXG9wEjbOQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVDVZM3U4b0JveXVQL3BS\nR2x0SnlyK3FHMGdPL0hsb3lLOWt6aHBRbWdBClpzYWxEWUJHOGxzM0ZrUWhEa2hv\ncnFmOElUUkw5NEtEMmV3VDdiUGkyWlkKLS0tIHVtUlN0VTR1Y3ZxQ3JyRjA4ZzNk\nZWthMDJ5K1Z4Uzc0dVdWY2xWQUgzYkkKE0WIA/a1ZJXDS+qZyqadNYPRg7ixB8fU\n/mqsnJ6imb4+436LDfAd+ZknhS38IKe+56Tj27/frHFvcM4XIdBOuQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-02-11T02:53:27Z",
+		"mac": "ENC[AES256_GCM,data:rTA80/5n6DcTQns0UfuIJ61700exGeY/9zZaFA29bPFVzjuWz7EF4kQB8c3Qt1NcgGECn39pI/cT8SO1fWvz5mMRpBuoPthG8vzHGtjpqYYQhvOXh4CPmPA2EpWsC5Yz+ixSNF5BsrQqr+nnHLncmqVtdwKNx5WHZ+cHGHscqlk=,iv:ve7d0esVdq74ABai4NnS/W2hcLTmEf4QpxoJ24dLMNw=,tag:u99X2k0L7/iWSIJoTBR3KQ==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/samba/tests/vm/vars/per-machine/server/u1share1-smb-password/password/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:WgDWZkhHWOV+ziaXtaeTWQicasUPRXE=,iv:Mwgc7cohAOLNsN77fEMBuOQaeQYAUL2CpEE1WaXm0lk=,tag:05Xxc/rJg1bt1PF79MLd/g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpWThaNElOVmhxbWFuTkJR\nQlJYMkVNTW5oRUNqRlowK2RLelhqb2hwSldFCjMycUpGelo1M2N1QWsxT3BCYktR\nUlpTYTUxTnVGMVZoelU3ZUlvQ1pMcTQKLS0tIGNmd1NQSlROR3lzQ2JQdkF0elkz\nNkN0Y2Z2T0Q2QUk0d0kzQmwrcVZEOVEKiM3Y/uGy4dB/5rGKAjjZM95y8INx+e+q\nxU9TUfGQBgYVzZtloLz3O7mlwhlamk1BvPvHttU+35paw26IbUlIoA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWczZZWk5OTGtCTUw3b1c3\ncU9UaE1RaHNMS01NeXNmYVVqVHhJOXdmUmxvClh4R0ZtZjVmblZCWjlBb2VEaUlE\nUDBmWTV5Wnhpa2tnTWo3bEhOYXlYRFkKLS0tIE5jV1Ivdzdxc0R6V1ZiZU5NWFNL\ndnNsK0dhTElVWDVMRUZiTG5kMnJVSlkKVXmgoqF2bdwia9VDlOOKA6DTZCqpl9DP\n2ClATf3YXnKQ/uBNpfWrKoqJDL2y+26rEeoisPUrkrgYbpr3hq6Nqg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-02-11T02:53:29Z",
+		"mac": "ENC[AES256_GCM,data:Yf5hFEEQ+yYH6OOjI7GLBahLL8UPuLIhIIdYkRoj6cSHgqm/ZpQGcd8MlHLGq0dpUcGOYJV9CM9pBqX0MjpABiK4XdTpoTn80EOV+mI2k6idE5N0doDecymI5A9ueB+5lO187HP57j5blJIn9aW+xO6MI9kYRYOz3sroAPq/JX0=,iv:yH1mB6DD+h869bsmovywJQm2ccd1PmqA7sZ9DGQ2+W4=,tag:sqLDW7JjT+K0JeWr8cUAQg==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/samba/tests/vm/vars/per-machine/server/u1share2-smb-password/password/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:LgIGB2KkRtTiqyy97uHI87jzaWTn2oCiV+Jx,iv:fUBJ6d9svCfwS+nDcIxezV3Eevlyq6r81D4h10T7Tw8=,tag:jPTOtbwjYEZc2eyMAKBrkA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyekpXT3lVSWErbWZBZW9l\nalBMVTB2M3Y2czZQWFR0Y3NWMlVLT0o0eWg0CmJWZmlHWFUwelI3ei9wTm5SZ2JC\nODRoYVRoVDFTRC8vcWgxaXd0ODB2TEkKLS0tIEhZL25mR1ZMY1Z1anBCTnltYjlr\nL2h4M0lieDFWS2lCMDY3MERORDZBS3MK3onTR08r0s8KA3qRC9xymVRhHQ9I6XjL\n/7bDzOR72fIHtCG8h+KTvN2v5H/YgHTVf6GzDw9FRRByuQ6YrP5lHQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIT1prVStXZnBTajNYeFNh\nL1BMNWxuM2RYRENPQ2JKVWJjZ0w2M1RodkRFCmFWU2hmbDBNZ0tOM0tGRlZaMkpL\nY3JtNnl0NXVsNnJUZThidXRuMlhNRTQKLS0tIHZMaUVZa0RBRHJoaSt4dDNyUGk5\nQ2hIUXJKTkFpR0szb1BWRi9FZ2MvK2cKzSfNN4PPx/AeyavqTMrpIOxQrdOi1Pt5\nrXrMYf1flYJ0xy0qjiBOSQlTlbq98A9sdB6OvfHFIMZU5Gq6jrnieQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-02-11T02:53:32Z",
+		"mac": "ENC[AES256_GCM,data:0jinh78IsYiqCEAjxk2gE9KP1vMmWT7XCgODdwT0tpQwlJ3T3aym2QCuC2fSFSpjqFrLBeclMOMH1Yz6dU873ZeRYX3uVovTYzOBJCYip/8PIUslum8Rafq7P/R0am1gZ6fwGkuY7kjIwaSxNc38mwx4TvIBZKNRdmkdnN9ZmnA=,iv:XpJAlFi/KSDaoZiMS6cc8RSwAw8MhikzAy1VlHFW6ig=,tag:i6ydBPpn/hvY/2AGaVkxZw==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/samba/tests/vm/vars/per-machine/server/u2share1-smb-password/password/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/machines/server

@@ -0,0 +1 @@
+../../../../../../sops/machines/server

modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/secret

@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:n7e3+g4+mB7eB9fs6RShr8Weh/N58vuRTg==,iv:64jgKcVY4kJlL88hZujnN0w4Bd3BAvnx7qcL7jviaIs=,tag:qE0pNorMKPsQnguqSciiGQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1jked5ykp2ch5k4030cewmgqr44jc9e7cxsyrfek4v3j4g3fydcxs4jk8jn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzRXFnb3RMV0srYUUzSkg5\nQUo5cWl3RlRoYnRWV0N0VzU3aE9MUUlHdUgwCjRha0VwY2ljSk43b0UyUWtic2g4\nRFhWbmhBOWRpc2pDRlVMRnhObXJCMjgKLS0tIE1jM0hBeWd4eTNKanV6V2ZOUW0w\nNVFnMzNpR01tSU5HUHY1cW1SOWk3NUUK9PT0IV210rjorKWcdfP324IPojJqdFfn\nGAL2mbI96jat2nyqkg1uRfighvVzGlGJWkLpToAUpqJTWu5tRbMrXg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhUWVub0ZzMW8vWVJmK0pC\nUHMyNjFXZkhPV3BrUElwd1dFUzBRVFBhSUU0Cjh4NUV4L3F3RjYrclk3d0RWS1hv\nTEdlZUY5ZFYyQ2VkOG5xNUc2SFphU3cKLS0tIFc2MG9IVFJWbHBYWnJEMkJTZnZL\nMms2eUk2Nm03aURJYWJGclNJMk8wZUUKFz49E5sp23YLlewDHbjApgRxS2BZjBTk\nk4SVJYvvIoZiPdRTNzZ6HYZGD7p036WhYg43lduqUrq8AtCnEHPdbw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-02-11T02:53:34Z",
+		"mac": "ENC[AES256_GCM,data:0XlREuaKL02o1KlUm5K/xM9cFZP1APpO9152Bl3328Pm/a/j4XoAu70keSUjE26UG5TLcxAkT7m5bOW5Clo/zxzPORAMMv9NTho4gwkfOABwymcR0giNFjpZ10a3PBHgxMm5AaXR0mfehFE+NV32oKfe2htpOSKin5kFe+0kmLQ=,iv:qXE5c8hRLM2lALo5JbDA9YoCDjc4A0OxmWkXocUDHBs=,tag:AXZjnULGKuIMdDkywa3PqA==,type:str]",
+		"version": "3.11.0"
+	}
+}

modules/clan/samba/tests/vm/vars/per-machine/server/u2share2-smb-password/password/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

modules/clan/stirling-pdf/default.nix

@@ -3,15 +3,23 @@
   _class = "clan.service";
   manifest.name = "stirling-pdf";
   manifest.description = "Your locally hosted one-stop-shop for all your PDF needs.";
+  manifest.readme = "Your locally hosted one-stop-shop for all your PDF needs.";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     perInstance.nixosModule =
       {
         lib,
         ...
       }:
       {
+        nixpkgs.overlays = [
+          (final: prev: {
+            libreoffice = prev.libreoffice-fresh;
+          })
+        ];
+
         services.stirling-pdf = {
           enable = lib.mkDefault true;
           environment = {

modules/clan/victoriametrics/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "Victoria Metrics";
   manifest.description = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
+  manifest.readme = "VictoriaMetrics: fast, cost-effective monitoring solution and time series database";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     perInstance.nixosModule =
       {
         config,

modules/clan/vikunja/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "vikunja";
   manifest.description = "The to-do app to organize your life.";
+  manifest.readme = "The to-do app to organize your life.";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default server role";
     perInstance.nixosModule =
       {
         lib,

modules/clan/yggdrasil/default.nix

@@ -3,9 +3,11 @@
   _class = "clan.service";
   manifest.name = "yggdrasil";
   manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.readme = "An in scalable routing as an encrypted IPv6 overlay network";
   manifest.categories = [ "System" ];
 
   roles.default = {
+    description = "a default peer role";
     perInstance.nixosModule =
       {
         lib,

modules/nixos/think-backend-gtcm.nix

@@ -7,6 +7,30 @@
 let
   cfg = config.services.think-backend-greaterchiangmai;
   think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
+  file-uploader = pkgs.gtcm-file-uploader.override { dataDir = cfg.dataDir; };
+
+  nginxNodeProxyConfig = ''
+    proxy_pass http://127.0.0.1:3000;
+
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host $host;
+    proxy_set_header x-webobjects-server-protocol HTTP/1.0;
+    proxy_set_header x-webobjects-remote-host 127.0.0.1;
+    proxy_set_header x-webobjects-server-port $server_port;
+    proxy_set_header x-webobjects-server-name $server_name;
+    proxy_set_header x-webobjects-server-url $scheme://$host;
+    proxy_connect_timeout 90;
+    proxy_send_timeout 90;
+    proxy_read_timeout 90;
+    proxy_buffer_size 64k;
+    proxy_buffers 8 64k;
+    proxy_busy_buffers_size 64k;
+    proxy_temp_file_write_size 64k;
+    client_max_body_size 50m;
+    client_body_buffer_size 128k;
+  '';
+
   defaultUser = "gtcm";
   defaultGroup = "gtcm";
 
@@ -33,7 +57,7 @@ in
     dataDir = lib.mkOption {
       type = lib.types.path;
       default = "/var/lib/think-backend.greaterchiangmai.com";
-      description = ''A place where to store states'';
+      description = "A place where to store states";
     };
 
     user = lib.mkOption {
@@ -142,6 +166,19 @@ in
       '';
     };
 
+    systemd.services.gtcm-file-uploader = {
+      description = "File upload service for think-backend.greaterchiangmai.com";
+      requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
+      before = [ "phpfpm-think-backend-gtcm.service" ];
+      serviceConfig = {
+        User = cfg.user;
+        WorkingDirectory = "${file-uploader}";
+        ExecStart = "${lib.getExe pkgs.nodejs_20} ${file-uploader}/src/be/index.js";
+        Restart = "on-failure";
+      };
+      path = [ pkgs.nodejs_20 ];
+    };
+
     environment.systemPackages = [
       artisan-be
     ];
@@ -226,6 +263,7 @@ in
           # migrate & seed db
           ${lib.getExe php} artisan key:generate --force
           ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan storage:link
           ${lib.getExe php} artisan config:cache
         '';
     };
@@ -233,8 +271,8 @@ in
     systemd.tmpfiles.rules = [
       "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
       "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
-      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
-      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0755 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0755 ${cfg.user} ${cfg.group} - -"
       "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
       "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
       "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
@@ -244,6 +282,8 @@ in
       "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
       "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
       "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+
+      "d ${cfg.dataDir}/gtcm-file-uploader/uploads      0700 ${cfg.user} ${cfg.group} - -"
     ];
 
     networking.firewall.allowedTCPPorts = [
@@ -265,12 +305,28 @@ in
             index = "index.php";
             tryFiles = "$uri $uri/ /index.php?$query_string";
           };
+          "/uploads" = {
+            root = "${cfg.dataDir}/public/uploads";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "/storage" = {
+            root = "${cfg.dataDir}/public/storage";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
           "~ \\.php$".extraConfig = ''
             fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
           '';
           "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
             extraConfig = "expires 365d;";
           };
+          "^~ /initiate-multipart-upload".extraConfig = nginxNodeProxyConfig;
+          "^~ /get-presigned-url".extraConfig = nginxNodeProxyConfig;
+          "^~ /complete-multipart-upload".extraConfig = nginxNodeProxyConfig;
+          "^~ /generate-presigned-url".extraConfig = nginxNodeProxyConfig;
+          "^~ /enable-bucket-cors".extraConfig = nginxNodeProxyConfig;
+          "^~ /upload".extraConfig = nginxNodeProxyConfig;
         };
       };
     };

modules/nixos/think-gtcm.nix

@@ -33,7 +33,7 @@ in
     dataDir = lib.mkOption {
       type = lib.types.path;
       default = "/var/lib/think.greaterchiangmai.com";
-      description = ''A place where to store states'';
+      description = "A place where to store states";
     };
 
     user = lib.mkOption {
@@ -228,6 +228,7 @@ in
           # migrate & seed db
           ${lib.getExe php} artisan key:generate --force
           ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan storage:link
           ${lib.getExe php} artisan config:cache
         '';
     };
@@ -267,7 +268,16 @@ in
             index = "index.php";
             tryFiles = "$uri $uri/ /index.php?$query_string";
           };
-
+          "/uploads" = {
+            root = "${cfg.dataDir}/public/uploads";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
+          "/storage" = {
+            root = "${cfg.dataDir}/public/storage";
+            index = "index.php index.html";
+            tryFiles = "$uri $uri/ /index.php";
+          };
           "~ \\.php$".extraConfig = ''
             fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
           '';

pkgs/gtcm-file-uploader.nix

@@ -0,0 +1,40 @@
+{
+  fetchgit,
+  buildNpmPackage,
+  pkgs,
+  dataDir ? "/var/lib/gtcm-file-uploader",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "6f8c8d7dfaf5a0c1eb2077de1d6fb35ceaf3d4ec";
+    hash = "sha256-2mCdn8xGjWZrANclctGTmxQhkNc43VzlzMTVwVIFJcM=";
+  };
+  src = "${repoSrc}/upload-large-file";
+in
+buildNpmPackage {
+  pname = "gtcm-file-uploader";
+  version = "1.0.0";
+
+  nativeBuildInputs = with pkgs; [
+    nodejs_20
+    breakpointHook
+  ];
+
+  inherit src;
+
+  npmDepsHash = "sha256-JEp2F1CQfuV9fSYZRdRO+BiOE9dy1ReK6doJcqCuxu4=";
+
+  buildPhase = ''
+    npm install
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r * $out
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/gtcm-file-uploader/uploads $out/src/be/uploads
+    runHook postInstall
+  '';
+}

pkgs/overlay.nix

@@ -1,4 +1,5 @@
 final: prev: {
   think-gtcm = final.callPackage ./think-gtcm.nix { };
   think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
+  gtcm-file-uploader = final.callPackage ./gtcm-file-uploader.nix { };
 }

pkgs/think-backend-gtcm.nix

@@ -21,12 +21,16 @@ php.buildComposerProject2 (finalAttrs: {
     runHook preInstall
     mkdir -p $out
     cp -R * $out
+
     rm -rf $out/storage
+
     ln -s ${dataDir}/.env $out/.env
     ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/public/storage $out/public/storage
+    ln -s ${dataDir}/public/uploads $out/public/uploads
     runHook postInstall
   '';
 
   composerStrictValidation = false;
-  vendorHash = "sha256-eXm1x3E9KHWojaT2RU4inMdZqQVcWdLCKlvzhOlIZrc=";
+  vendorHash = "sha256-wGfbprSDULBje1s5y3+ZiU/nCwYGDEULobZzyzGZ9bQ=";
 })

pkgs/think-gtcm.nix

@@ -21,12 +21,16 @@ php.buildComposerProject2 (finalAttrs: {
     runHook preInstall
     mkdir -p $out
     cp -R * $out
+
     rm -rf $out/storage
+
     ln -s ${dataDir}/.env $out/.env
     ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/public/storage $out/public/storage
+    ln -s ${dataDir}/public/uploads $out/public/uploads
     runHook postInstall
   '';
 
   composerStrictValidation = false;
-  vendorHash = "sha256-QV3hR3U3GwCqrCRxfkazmJwDpO1vFyMfA6YqUb4bjMI=";
+  vendorHash = "sha256-b8+AKUmjQiOdV8UC9GYfJzAHFs9+FRSH91YsxKt0rDA=";
 })

sops/machines/petra/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1m2llc94j2ft2q52zj0jt5fghx2r8qtdagwxduuz24hhrmxytgguq90xpgn",
+    "type": "age"
+  }
+]

sops/machines/rana/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14l00770djurg4uycw5988nklpeha2wxy35t5jx7x8yp2d6uv7y6s47nskp",
+    "type": "age"
+  }
+]

sops/secrets/petra-age.key/groups/admins

@@ -0,0 +1 @@
+../../../groups/admins

sops/secrets/petra-age.key/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:soUz5kHdCe4rH0TWKyYoAqbcmIRiN380vsQtt37IWMKpn2fCMIGtBjDXq5g7mLthQ7Cl7JizvhBL0qDJKVX+JZIOa/EQ4QlSn9s=,iv:RXCgYhE7lHZd42D6PSZcn1ERqaIJ7ujUVmt5wo9QJD0=,tag:yqQcr83MAZLSHk/cbwKvDA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVUTk5UkdzRWxkWUNDS3Nk\neHlpYk81QkVkRkFhSzNhOUUzelBmZUUySWd3CldpcEpRR2pTWUR3Vnl2bzhzSHV0\nVmdaNGloeHJCT1lRbWU3eFBhNlF1NUUKLS0tIG8zeUtoRXRrb1Fmc2h0a3JGNlpq\nOGdrd1U4SVJ5Q0VkOVRYZm1OU3d4MGMKdY0LvwYdiNV3v3OqoXgVCYAuGOIpoboe\nis2eLvNwxZ5c/l+miXrkQw0cDg0bvG+2jGGktbzS6F8fIbMX5VLgBA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJUmJ6eEJuMDNyS0lrbVRj\ncWtWcVY4My9STGRVcjFjVkZBU2Y1ZHQyblJzClZ0NlZDY0lMUGsvQVJGeTN3ZjBn\nZEFsMmJ1S2RuSndjWjh1aFRKTFNTaW8KLS0tIDZ5emlueFhIajZGN1BoeFJudE45\ndm5wY3k1Q3pyWndEclhzdHhGRlYrelkKhqPOc63fLmW2Ck3Mpjw8hiwTfD4dMDWF\nKHz6hY9mBQbQbOK1UL5QADA0EJFXFH4fiEYpOlKLMKr28lDgtgOWMw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGRKWThqMmJS\nUDlTYWs5c05rd2puR1R5L1pjQXEzc1g1RkZBM2RaY0NseFUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp4RzVWUXo5M0FYV0MzREE4L0FIWEU2\nanVEcTNBZ0FWdmpKcUVkMktVbWprCi0tLSBnVVlkNmhpS3dQRXhRRVZkYjVHSVJH\nRG1kd01yVDd1NzFlQTNUdkdhdDhBCr8wWDYWFC6ghoPWL6+ARhHTgEdex0RYVaKY\nDRPDHy2s+/LAkKaKYiNWAqLbscWdtKGXkmwnqoxQm9RKqOiqVe0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFVKNElteFpq\nYThYUndzcmEybHdZb3FuZEZLTGJOZG5qSzU3MytQcVZlM28gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp5K1grb2U1S240VFVZaEtWMTRYb3F4\nVTVZUDVZVFppY1NZeGZ1UG0zSzFJCi0tLSBQUGttdFpPV3dzOEZoWGY2akUxcW5L\nQ2tzS2NZTWUyZ1IvdVEzQTFKVEk0CkF2QbY5/opISu1Z5nZgtVtkaXyiEOL/dLP1\nmG18OHT2p5Q690YBAsxc2dgZ6kWxBtXFbXRIdU2D99dr9SzPhcE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9GUFZXNDU2\nY2RscnpRWjhDdElhSG5TV3RBdGxlMm95YVZocktMR1pORlkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpEdHp3MjlybnlSTGFNa1VMRTJnaE1Z\nWVg3Ly9ueGhyNVJIMmhuaEFGbGtJCi0tLSBjQTRMQ0l4KzZYd2gvcnNzTTAraDRT\nVW0rRzY1R2l1c3VrRjY1NWxuTGM0Cnk+L/s3P2zPqkEOnSrsOF3FC5GhdrOUnt22\nOpr8XZkwnOGz6eyTqKWDfpwwhnkGxro6TxE0fi7K3+m/5bvgsqM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkY1hQeFQ2R1A3TDJaNGph\nVG1vSEswUkdhclZCSG8zRGRIY1Fyb2srRkRrClgyR0JQbHZCeThjbHNxcjdKd0d3\nWnZxS1BLT2w2dWN1elA1RnRYNXo3c1EKLS0tIEtJa1dlVG1SZVRSVFVQSUZFR3FX\nU2JMUUMwa0VKTzVCc0dRd0NaaVozTGsKjfF1ukrmfIyKIO0ZuWHTFiidtrvZr4Cq\no2IJXOjxPOAuIEgioQyUAwl9ziWYISg9xuoe3Syi0qgeX/oAO0TXaA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENFF4VTZGSVJQNWMzMDM5\nTWo1eURqSUlmSTYxSFdwWWVJc1VCb3E1Q2ljCnZnSUs1Q3A5clZJREhNSWZNQlc1\nRTRIcHB4TDZGZnFwMGpVdU9Mbkg0VHcKLS0tIHJTZ2RmU2ovdW5wQStNZGM2MXVU\nS0o4NXI1eU51VlFuZDJsekN5R0M5bUEKvCNFQNUrY3o07bbWnEw5IuDvBGjXiDsw\nRRKjCXQpY+9kWDqk+Xah3T1aKpiImTLfK3q90tBK5tUVe7m4kqlB6A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVnBSeEhKTlhFZHA1OXU4\nRzVDQWtVYzVyUkNDbmd5d3NaR0RCdnd4a3pVCitnd3FSWS8zWE5LblNxS1RuZjM1\nRERNcjJ4Y0YwRVFtMEFZcXZTMEVMM0EKLS0tIDNuUnhmNElzN09hVDArNGFQZ3dP\ndkI0OFRBYXlOS0N6cEEvbmZXa0ZVSlEKzhPJSGjDHNsv0kuluhmzuEgdKX8588Cr\n41gDyJEreZRfFpu2zjcyXYuIkKqznNpcSg98wkEpsHVO8Q/mvzwEdw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByMWhZc1padStZa3kwRzFG\nZ2t6ZEV1cUdLRHBybk4wemxseEhsTkF6OXhzCkxlK0FMMmlNbDdwbndvV2hzSE4v\nQ3g0SWRLd2NhbHVIZVJkOU4rbHloN3cKLS0tIE4xZGFFdC9vbitJQzZpbDlxNUZJ\ncHVWRnh3MEFhQjJmaWZ3YzNueDhYUlkKQksX/rsAFdW3rL0AL8qifw6KuIohhxyq\nokPJhj3bKXwW+B6UDs4IrZaSsI7bPtfQM8tYZYScP7ULwE96iV48fQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-22T05:00:48Z",
+		"mac": "ENC[AES256_GCM,data:qLq3939SrebMCIUfG4D3w2Lc0TikxGOK4UKyWvYvQLWwjf6BBI14zoTPaH6RjuqhYIQexG6xcB68VhNfZf6QD3LB6arOsyKZeBOY8kWzLkh75iSwYGruWXEf1REGVxal1h1rhzy9XiHx9ZfR0RI6jJ0dz+O4sJDv64BZWgBvhZA=,iv:NSbramhOR7xg21UV03QRAk486zyruHAQ9R7BN1A9utQ=,tag:q9tlBsI2aEacfK9UbfEUSA==,type:str]",
+		"version": "3.11.0"
+	}
+}