mob next [ci-skip] [ci skip] [skip ci]

lastFile:machines/b4l/configuration.nix
Update vars via generator acme for machine b4l
2025-11-27 17:50:07 +07:00 · 2025-11-27 17:50:02 +07:00 · 2025-11-27 17:47:34 +07:00 · 2025-11-27 16:12:51 +07:00 · 2025-11-27 14:38:00 +07:00 · 2025-11-27 12:03:18 +07:00
130 changed files with 5414 additions and 3773 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754535625,
-        "narHash": "sha256-RdT3/DskBjwx74cvHJHb/mLSO2XeSHitSYViNmYGU/k=",
+        "lastModified": 1761768376,
+        "narHash": "sha256-AZL8SPJ520NRnLft9Xz4trTECBB510YPRXJnE1OUeXw=",
        "ref": "refs/heads/main",
-        "rev": "f69e28a1333527cdbadb233966a7e19d4b35a1a3",
-        "revCount": 8886,
+        "rev": "bbc9486f0e6306f68e11f8aefa243da9f1c8c56f",
+        "revCount": 10924,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -49,11 +49,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1753067306,
-        "narHash": "sha256-jyoEbaXa8/MwVQ+PajUdT63y3gYhgD9o7snO/SLaikw=",
-        "rev": "18dfd42bdb2cfff510b8c74206005f733e38d8b9",
+        "lastModified": 1760612273,
+        "narHash": "sha256-pP/bSqUHubxAOTI7IHD5ZBQ2Qm11Nb4pXXTPv334UEM=",
+        "rev": "0099739c78be750b215cbdefafc9ba1533609393",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/18dfd42bdb2cfff510b8c74206005f733e38d8b9.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/0099739c78be750b215cbdefafc9ba1533609393.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -88,11 +88,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1753140376,
-        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
+        "lastModified": 1760701190,
+        "narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
+        "rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
        "type": "github"
      },
      "original": {
@@ -139,14 +139,19 @@
    "liminix": {
      "flake": false,
      "locked": {
-        "lastModified": 1760087246,
-        "narHash": "sha256-HRUkAS5XDuM7yDnz+TIMAre7kFOuqyHL/y26wTbH6Sg=",
-        "path": "/home/kurogeek/Desktop/gitea/dan/liminix",
-        "type": "path"
+        "lastModified": 1760426231,
+        "narHash": "sha256-r8c5PKtsxAvtQ/k17GH+WNvP47Lr+AbExLMPdLtvAKE=",
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "revCount": 1574,
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
      },
      "original": {
-        "path": "/home/kurogeek/Desktop/gitea/dan/liminix",
-        "type": "path"
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
      }
    },
    "nix-darwin": {
@@ -157,11 +162,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1751313918,
-        "narHash": "sha256-HsJM3XLa43WpG+665aGEh8iS8AfEwOIQWk3Mke3e7nk=",
+        "lastModified": 1761339987,
+        "narHash": "sha256-IUaawVwItZKi64IA6kF6wQCLCzpXbk2R46dHn8sHkig=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "e04a388232d9a6ba56967ce5b53a8a6f713cdfcf",
+        "rev": "7cd9aac79ee2924a85c211d21fafd394b06a38de",
        "type": "github"
      },
      "original": {
@@ -172,11 +177,11 @@
    },
    "nix-select": {
      "locked": {
-        "lastModified": 1745005516,
-        "narHash": "sha256-IVaoOGDIvAa/8I0sdiiZuKptDldrkDWUNf/+ezIRhyc=",
-        "rev": "69d8bf596194c5c35a4e90dd02c52aa530caddf8",
+        "lastModified": 1755887746,
+        "narHash": "sha256-lzWbpHKX0WAn/jJDoCijIDss3rqYIPawe46GDaE6U3g=",
+        "rev": "92c2574c5e113281591be01e89bb9ddb31d19156",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/69d8bf596194c5c35a4e90dd02c52aa530caddf8.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/92c2574c5e113281591be01e89bb9ddb31d19156.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -185,11 +190,11 @@
    },
    "nixos-facter-modules": {
      "locked": {
-        "lastModified": 1750412875,
-        "narHash": "sha256-uP9Xxw5XcFwjX9lNoYRpybOnIIe1BHfZu5vJnnPg3Jc=",
+        "lastModified": 1761137276,
+        "narHash": "sha256-4lDjGnWRBLwqKQ4UWSUq6Mvxu9r8DSqCCydodW/Jsi8=",
        "owner": "nix-community",
        "repo": "nixos-facter-modules",
-        "rev": "14df13c84552a7d1f33c1cd18336128fbc43f920",
+        "rev": "70bcd64225d167c7af9b475c4df7b5abba5c7de8",
        "type": "github"
      },
      "original": {
@@ -200,11 +205,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1754278406,
-        "narHash": "sha256-jvIQTMN5EzoOP5RaGztpVese8a3wqy0M/h6tNzycW28=",
+        "lastModified": 1761656231,
+        "narHash": "sha256-krgZxGAIIIKFJS+UB0l8do3sYUDWJc75M72tepmVMzE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "6a489c9482ca676ce23c0bcd7f2e1795383325fa",
+        "rev": "d7f52a7a640bc54c7bb414cca603835bf8dd4b10",
        "type": "github"
      },
      "original": {
@@ -233,11 +238,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754328224,
-        "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=",
+        "lastModified": 1760998189,
+        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4",
+        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -22,8 +22,7 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    liminix = {
-      # url = "git+https://gti.telent.net/dan/liminix?ref=refs/heads/main&rev=29fbb5461d034c4c59b88cbe04937b04ecad18e0";
-      url = "path:/home/kurogeek/Desktop/gitea/dan/liminix";
+      url = "git+https://git.b4l.co.th/newedge/liminix?ref=refs/heads/fix-gl-ar750&rev=3f1f7c08d440130cce9262a93ce78ed7969d93cd";
      flake = false;
    };
  };
@@ -38,24 +37,6 @@
        systems = [
          "x86_64-linux"
        ];
-
-        flake.legacyPackages.qemu-router = import "${inputs.liminix}/default.nix" {
-          liminix-config = import "${inputs.liminix}/examples/hello-from-qemu.nix";
-          device = (import "${inputs.liminix}/devices/qemu-aarch64/default.nix");
-        };
-        flake.legacyPackages.yada-router = import "${inputs.liminix}/default.nix" {
-          liminix-config = import ./routers/yada-house/configuration.nix { inherit inputs; };
-          device = (import ./routers/yada-house/device.nix { inherit inputs; });
-        };
-        flake.legacyPackages.qemu-flake = import "${inputs.liminix}/default.nix" {
-          liminix-config = import ./routers/qemu/configuration.nix { inherit inputs; };
-          device = (import ./routers/qemu/device.nix { inherit inputs; });
-        };
-        flake.legacyPackages.vanilla = import "${inputs.liminix}/default.nix" {
-          liminix-config = import ./routers/vanilla/configuration.nix { inherit inputs; };
-          device = (import "${inputs.liminix}/devices/gl-mt300a/default.nix");
-        };
-
        imports = [
          ./fmt.nix
          ./shell.nix
@@ -63,8 +44,24 @@
          ./machines
          ./routers
          ./inventories
+          ./overlays
+          ./tests
          ./modules/clan/flake-module.nix
+          ./modules/nixos/flake-module.nix
        ];
+        perSystem =
+          { pkgs, system, ... }:
+          {
+            _module.args.pkgs = import inputs.nixpkgs {
+              inherit system;
+              overlays = [
+                inputs.self.overlays.packagesOverlay
+              ];
+              config = { };
+            };
+            packages.think = pkgs.think-gtcm;
+            packages.think-be = pkgs.think-backend-gtcm;
+          };
      }
    );
 }
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -3,8 +3,13 @@
    inventory = {

      tags = {
-        glom = [ "vega" ];
+        glom = [
+          "vega"
+          "ramus"
+        ];
        b4l = [ "rigel" ];
+        w = [ "sirius" ];
+        fax-bridge = [ ];
      };

      instances = {
@@ -30,6 +35,20 @@
          };
        };

+        w-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."sirius" = {
+            settings.allowedIps = [
+              #kurogeek
+              "fdfe:7bf:a795:4524:4c99:932b:d36d:b8cc"
+            ];
+          };
+          roles.peer.tags.w = { };
+        };
+
        glom-network = {
          module = {
            name = "zerotier";
@@ -48,6 +67,21 @@
          roles.peer.tags.b4l = { };
        };

+        yggdrasil = {
+          module = {
+            name = "yggdrasil";
+            input = "self";
+          };
+          roles.default.tags."fax-bridge" = { };
+        };
+
+        asterisk = {
+          module = {
+            name = "asterisk";
+            input = "self";
+          };
+        };
+
        pocket-id = {
          module = {
            name = "pocket-id";
--- a/inventory.json
+++ b/inventory.json
@@ -1 +1,7 @@
-{}
+{
+  "machines": {
+    "ramus": {
+      "installedAt": 1764139649
+    }
+  }
+}
--- a/machines/b4l/configuration.nix
+++ b/machines/b4l/configuration.nix
@@ -19,4 +19,18 @@
  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    enableACME = true;
  };
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
 }
--- a/machines/ramus/configuration.nix
+++ b/machines/ramus/configuration.nix
@@ -0,0 +1,33 @@
+{ self, config, ... }:
+{
+  system.stateVersion = "25.11";
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.meta.name = "ramus";
+  clan.meta.description = ''
+    A Hetzner VPS machine own by Alex.
+  '';
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  clan.core.vars.generators.acme = {
+    share = true;
+    files.email.secret = false;
+
+    prompts.email = {
+      type = "line";
+      description = "Email for ACME registeration";
+    };
+
+    script = ''
+      cat $prompts/email > $out/email
+    '';
+  };
+
+  security.acme.certs.defaults.email = config.clan.core.vars.generators.acme.files.email.value;
+
+  imports = [ ./think-greater-chiangmai.nix ];
+}
--- a/machines/ramus/disko.nix
+++ b/machines/ramus/disko.nix
@@ -0,0 +1,84 @@
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_107266387";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/ramus/facter.json
+++ b/machines/ramus/facter.json
--- a/machines/ramus/think-greater-chiangmai.nix
+++ b/machines/ramus/think-greater-chiangmai.nix
@@ -0,0 +1,121 @@
+{ self, config, ... }:
+let
+  commonSettings = {
+    APP_NAME = "Laravel";
+    APP_ENV = "local";
+    APP_KEY._secret = config.clan.core.vars.generators.greaterchiangmai.files.app_key.path;
+    APP_DEBUG = "false";
+    APP_URL = "http://localhost";
+
+    DB_CONNECTION = "mysql";
+    DB_HOST = "localhost";
+    DB_PORT = 3306;
+    DB_DATABASE = "thinkgtcm";
+    DB_USERNAME = "gtcm";
+
+    R2_ACCESS_KEY_ID = config.clan.core.vars.generators.greaterchiangmai-s3.files.access_key_id.value;
+    R2_SECRET_ACCESS_KEY._secret =
+      config.clan.core.vars.generators.greaterchiangmai-s3.files.secret_access_key.path;
+    R2_REGION = config.clan.core.vars.generators.greaterchiangmai-s3.files.region.value;
+    R2_BUCKET = config.clan.core.vars.generators.greaterchiangmai-s3.files.bucket.value;
+    R2_ENDPOINT = config.clan.core.vars.generators.greaterchiangmai-s3.files.endpoint.value;
+
+    LOG_CHANNEL = "stack";
+    LOG_LEVEL = "debug";
+
+    FILESYSTEM_DISK = "local";
+
+    BROADCAST_DRIVER = "log";
+    CACHE_DRIVER = "file";
+    QUEUE_CONNECTION = "sync";
+    SESSION_DRIVER = "file";
+    SESSION_LIFETIME = 120;
+
+    MEMCACHED_HOST = "127.0.0.1";
+
+    REDIS_HOST = "127.0.0.1";
+    REDIS_PORT = 6379;
+
+    UPLOAD_MAX_FILESIZE = "5000M";
+    POST_MAX_SIZE = "5000M";
+
+    TEST_LOCAL = true;
+  };
+in
+{
+  imports = [
+    self.nixosModules.think-gtcm
+    self.nixosModules.think-backend-gtcm
+  ];
+  nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+
+  clan.core.vars.generators.greaterchiangmai = {
+    files = {
+      app_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+    };
+
+    prompts = {
+      app_key.persist = true;
+    };
+
+    script = ''
+      cat $prompts/app_key > $out/app_key
+    '';
+  };
+
+  clan.core.vars.generators.greaterchiangmai-s3 = {
+    files = {
+      access_key_id.secret = false;
+      secret_access_key = {
+        secret = true;
+        owner = config.services.think-greaterchiangmai.user;
+        group = config.services.think-greaterchiangmai.group;
+      };
+      endpoint.secret = false;
+      region.secret = false;
+      bucket.secret = false;
+    };
+
+    prompts = {
+      access_key_id.persist = true;
+      secret_access_key.persist = true;
+      endpoint.persist = true;
+      region.persist = true;
+      bucket.persist = true;
+    };
+
+    script = ''
+      cat $prompts/access_key_id > $out/access_key_id
+      cat $prompts/secret_access_key > $out/secret_access_key
+      cat $prompts/endpoint > $out/endpoint
+      cat $prompts/region > $out/region
+      cat $prompts/bucket > $out/bucket
+    '';
+  };
+
+  services.think-greaterchiangmai = {
+    enable = true;
+    domain = "think.wegetthingsmade.com";
+    settings = commonSettings;
+  };
+  services.think-backend-greaterchiangmai = {
+    enable = true;
+    domain = "think-backend.wegetthingsmade.com";
+    settings = commonSettings;
+  };
+
+  services.nginx.virtualHosts.${config.services.think-greaterchiangmai.domain} = {
+    addSSL = true;
+    forceSSL = true;
+    enableACME = true;
+  };
+  services.nginx.virtualHosts.${config.services.think-backend-greaterchiangmai.domain} = {
+    addSSL = true;
+    forceSSL = true;
+    enableACME = true;
+  };
+}
--- a/machines/sirius/configuration.nix
+++ b/machines/sirius/configuration.nix
@@ -0,0 +1,25 @@
+{
+  inputs,
+  config,
+  self,
+  ...
+}:
+{
+  imports = [
+    self.nixosModules.common
+
+    (inputs.import-tree ./services)
+
+  ];
+
+  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  networking.fqdn = config.clan.core.vars.generators.vega-internal-domain.files.name.value;
+  system.stateVersion = "25.11";
+
+}
--- a/machines/sirius/disko.nix
+++ b/machines/sirius/disko.nix
@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/mmc-FIXME";
+  vdev = [
+    "/dev/disk/by-id/ata-FIXME"
+    "/dev/disk/by-id/ata-FIXME"
+  ];
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+              };
+            };
+          };
+        };
+      };
+    }
+    // (lib.listToAttrs (
+      map (disk: {
+        name = "data-${hashDisk disk}";
+        value = {
+          type = "disk";
+          device = disk;
+          content = {
+            type = "zfs";
+            pool = "zdata";
+          };
+        };
+      }) vdev
+    ));
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+      zdata = {
+        type = "zpool";
+        options.ashift = "12";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        mode = {
+          topology = {
+            type = "topology";
+            vdev = [
+              {
+                mode = "mirror";
+                members = vdev;
+              }
+            ];
+          };
+        };
+        datasets = {
+          "nas" = {
+            type = "zfs_fs";
+            mountpoint = "/mnt/hdd";
+            mountOptions = [ "nofail" ];
+          };
+          "service-data" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib";
+            mountOptions = [ "nofail" ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/machines/sirius/services/samba.nix
+++ b/machines/sirius/services/samba.nix
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  sambaUser = lib.filterAttrs (
+    name: user: user.isNormalUser && builtins.elem "samba" user.extraGroups
+  ) config.users.users;
+
+  sharedFolders = {
+    WhiteHouse.users = [
+      "w"
+      "kurogeek"
+      "berwn"
+    ];
+  };
+in
+{
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        security = "user";
+        workgroup = "WORKGROUP";
+        "server string" = "WhiteHouse NAS";
+        interfaces = "eth* en*";
+        "max log size" = "50";
+        "dns proxy" = false;
+        "syslog only" = true;
+        "map to guest" = "Bad User";
+        "guest account" = "nobody";
+      };
+    }
+    // lib.mapAttrs (share: opts: {
+      path = "/mnt/hdd/samba/${share}";
+      comment = share;
+      "force user" = share;
+      "force group" = share;
+      public = "yes";
+      "guest ok" = "yes";
+      "create mask" = "0640";
+      "directory mask" = "0750";
+      writable = "no";
+      browseable = "yes";
+      printable = "no";
+      # TODO
+      # "valid users" = toString opts.users;
+    }) sharedFolders;
+  };
+
+  users.users = lib.mapAttrs (share: opts: {
+    isSystemUser = true;
+    group = share;
+  }) sharedFolders;
+
+  users.groups = lib.mapAttrs (share: opts: { }) sharedFolders;
+
+  systemd.services.samba-smbd.postStart =
+    lib.concatMapStrings (
+      user:
+      let
+        password = config.clan.core.vars.generators."${user}-smb-password".files.password.path;
+      in
+      ''
+        mkdir -p /mnt/hdd/samba/${user}
+        chown ${user}:users /mnt/hdd/samba/${user}
+        # if a password is unchanged, this will error
+        (echo $(<${password}); echo $(<${password})) | ${config.services.samba.package}/bin/smbpasswd -s -a ${user}
+      ''
+    ) (lib.attrNames sambaUser)
+    + lib.concatMapStrings (share: ''
+      mkdir -p /mnt/hdd/samba/${share}
+      chown ${share}:${share} /mnt/hdd/samba/${share}
+    '') (lib.attrNames sharedFolders);
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+}
--- a/machines/vega/configuration.nix
+++ b/machines/vega/configuration.nix
@@ -1,10 +1,13 @@
 {
  inputs,
  config,
+  self,
  ...
 }:
 {
  imports = [
+    self.nixosModules.common
+
    (inputs.import-tree ./services)

    (import ../../lib/auto-accept-zerotier-members.nix {
--- a/modules/clan/actual-budget/flake-module.nix
+++ b/modules/clan/actual-budget/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.actual-budget = {
+      clan.nixosTests.service-actual-budget = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/actual-budget" = module;
--- a/modules/clan/asterisk/default.nix
+++ b/modules/clan/asterisk/default.nix
@@ -0,0 +1,69 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "asterisk";
+  manifest.description = "Asterisk PBX server";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        ...
+      }:
+      {
+        services.asterisk = {
+          enable = lib.mkDefault true;
+          confFiles = {
+            # Dial plan config
+            "extensions.conf" = ''
+              exten => 1001,1,Dial(PJSIP/user1,20)
+              exten => 1002,1,Dial(PJSIP/user2,20)
+
+              exten => 100,1,Answer()
+              same  =>     n,Wait(1)
+              same  =>     n,Playback(hello-world)
+              same  =>     n,Hangup()
+            '';
+
+            "pjsip.conf" = ''
+              [transport-udp]
+              type=transport
+              protocol=udp
+              bind=0.0.0.0,[::]
+
+              [endpoint_internal](!)
+              type=endpoint
+              context=from-internal
+              disallow=all
+              allow=ulaw
+
+              [auth_userpass](!)
+              type=auth
+              auth_type=userpass
+
+              [aor_dynamic](!)
+              type=aor
+              max_contacts=1
+
+              [user1](endpoint_internal)
+              auth=user1
+              aors=user1
+              [user1](auth_userpass)
+              password=user1
+              username=user1
+              [user1](aor_dynamic)
+
+              [user2](endpoint_internal)
+              auth=user2
+              aors=user2
+              [user2](auth_userpass)
+              password=user2
+              username=user2
+              [user2](aor_dynamic)
+            '';
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/asterisk/flake-module.nix
+++ b/modules/clan/asterisk/flake-module.nix
@@ -0,0 +1,18 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    asterisk = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      clan.nixosTests.asterisk = {
+        imports = [ ./tests/vm/default.nix ];
+
+        clan.modules."@clan/asterisk" = module;
+      };
+    };
+}
--- a/modules/clan/asterisk/tests/vm/default.nix
+++ b/modules/clan/asterisk/tests/vm/default.nix
@@ -0,0 +1,39 @@
+{
+  pkgs,
+  ...
+}:
+{
+  name = "service-asterisk";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        asterisk-test = {
+          module.name = "@clan/asterisk";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.asterisk = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("asterisk")
+
+    # Check that garage is running
+    server.succeed("systemctl status asterisk")
+
+  '';
+}
--- a/modules/clan/flake-module.nix
+++ b/modules/clan/flake-module.nix
@@ -1,4 +1,7 @@
-{ inputs, lib, ... }:
+{
+  inputs,
+  ...
+}:
 {
  imports =
    let
@@ -16,12 +19,7 @@

      # Create import paths for each valid directory
      imports = (map (name: ./. + "/${name}/flake-module.nix") validModuleDirs) ++ [
-        (import (inputs.clan-core + "/lib/flake-parts/clan-nixos-test.nix") {
-          inherit lib;
-          flake-parts-lib = inputs.flake-parts.lib;
-          self = inputs.clan-core;
-          inputs = inputs.clan-core.clan.self.inputs;
-        })
+        inputs.clan-core.flakeModules.testModule
      ];
    in
    imports;
--- a/modules/clan/grafana/flake-module.nix
+++ b/modules/clan/grafana/flake-module.nix
@@ -9,7 +9,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.grafana = {
+      clan.nixosTests.service-grafana = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/grafana" = module;
--- a/modules/clan/nextcloud/flake-module.nix
+++ b/modules/clan/nextcloud/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.nextcloud = {
+      clan.nixosTests.service-nextcloud = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/nextcloud" = module;
--- a/modules/clan/paperless/flake-module.nix
+++ b/modules/clan/paperless/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.paperless = {
+      clan.nixosTests.service-paperless = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/paperless" = module;
--- a/modules/clan/pingvin/flake-module.nix
+++ b/modules/clan/pingvin/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.pingvin = {
+      clan.nixosTests.service-pingvin = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/pingvin" = module;
--- a/modules/clan/pocket-id/flake-module.nix
+++ b/modules/clan/pocket-id/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.pocket-id = {
+      clan.nixosTests.service-pocket-id = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/pocket-id" = module;
--- a/modules/clan/stirling-pdf/flake-module.nix
+++ b/modules/clan/stirling-pdf/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.stirling-pdf = {
+      clan.nixosTests.service-stirling-pdf = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/stirling-pdf" = module;
--- a/modules/clan/victoriametrics/flake-module.nix
+++ b/modules/clan/victoriametrics/flake-module.nix
@@ -10,7 +10,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.victoriametrics = {
+      clan.nixosTests.service-victoriametrics = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/victoriametrics" = module;
--- a/modules/clan/vikunja/flake-module.nix
+++ b/modules/clan/vikunja/flake-module.nix
@@ -9,7 +9,7 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.vikunja = {
+      clan.nixosTests.service-vikunja = {
        imports = [ ./tests/vm/default.nix ];

        clan.modules."@clan/vikunja" = module;
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -0,0 +1,53 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "yggdrasil";
+  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        pkgs,
+        ...
+      }:
+      {
+        clan.core.vars.generators.yggdrasil = {
+          files = {
+            yggdrasil-secret = {
+              secret = true;
+            };
+            yggdrasil-ip = {
+              secret = false;
+            };
+            yggdrasil-subnet.secret = false;
+          };
+          runtimeInputs = with pkgs; [
+            yggdrasil
+            jq
+          ];
+          script = ''
+            yggdrasil -genconf -json | jq {PrivateKey} > $out/yggdrasil-secret
+            cat $out/yggdrasil-secret | yggdrasil -useconf -address | tr -d "\n" > $out/yggdrasil-ip
+            yggdrasil -useconffile $out/yggdrasil-secret -subnet | tr -d "\n" > $out/yggdrasil-subnet
+          '';
+        };
+
+        services.yggdrasil = {
+          enable = lib.mkDefault true;
+          configFile = config.clan.core.vars.generators.yggdrasil.files.yggdrasil-secret.path;
+          settings = {
+            Peers = [
+              # US Peers
+              "tls://ygg.jjolly.dev:3443"
+              "tls://[2602:fc24:18:7a42::1]:993"
+              "tcp://leo.node.3dt.net:9002"
+              "tcp://ygg-kcmo.incognet.io:8883"
+            ];
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/yggdrasil/flake-module.nix
+++ b/modules/clan/yggdrasil/flake-module.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  inputs,
+  self,
+  ...
+}:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    yggdrasil = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      # clan.nixosTests.service-yggdrasil = {
+      #   imports = [ ./tests/vm/default.nix ];
+      #
+      #   clan.modules."@clan/yggdrasil" = module;
+      # };
+    };
+}
--- a/modules/clan/yggdrasil/tests/vm/default.nix
+++ b/modules/clan/yggdrasil/tests/vm/default.nix
@@ -0,0 +1,37 @@
+{
+  ...
+}:
+{
+  name = "service-yggdrasil";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        yggdrasil-test = {
+          module.name = "@clan/yggdrasil";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.yggdrasil = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("yggdrasil")
+
+    # Check that garage is running
+    server.succeed("systemctl status yggdrasil")
+  '';
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+    "type": "age"
+  }
+]
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:pGMobS67sLp2GN2Xw7A/trcLYnQdVZCUbjtlwS/AShXxyXgHXzkqRee6R765GZyCpDwM8A1IuMZYctrqWxVXrpIAiJpwvwy7vDM=,iv:ysRf5xAXN+dFSx+sFHNDt1GcVQx7RLej4c12v60iSI0=,tag:yXYpWhWLdsz9BOOoKpZU4g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UmhPdzcrSnFhVUxRNDBL\ncXlGRzdMdWxCWmFlUkE4RnJRQ3psMlBqV0Q0CkRjTXFoQitQbjRhMlVjaDc3UDN1\nR1hBeXlCeWxvdnZoVWI1ZkcweHF5VncKLS0tIHE4YVFhYTZTNko1MnJINjFPYXh4\ndlJJZThGZ0JIaDJWRTNXbXk3alNZTnMKgd+0535zoTu6xW2778uNReu4Z7LStN6d\n1O9SXAB+s1iOZ3xGEICiQTVF/6p8RE6lheV2oXgoMiXXrFNH6INLsw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:34Z",
+		"mac": "ENC[AES256_GCM,data:YIpKJlOI6ASgOYqv9ipu+T3c+PlM5HwvdFVH8gh8hVeSbmxD1baPPmVSWlLv+u61Q1/C9PK4mczaASopaGiLoswep+Hc1Gn7sSeP9wO6Djx6fEIEyE1VUhUbTqi/nHYiB21yB/wegfpqzNYIn1nO0oFCmDmSS5qIowcT1fhYIjM=,iv:lzxll5oC7poLvC/hZPexUGAcAdf67xZGRXUpj6O3p6Y=,tag:9xu17Y5MtW5XNzGBsWwA3g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+204:5ce7:aa27:579b:ec90:6907:4ddc:177
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:I6yalWQ2u5hI84lJTUmh07JxUBp4EZukJrSGSN7wsGiUGlFa1v/RT1XkTiXuRjDtUVYCLmQmfSCAp/OqFscxF8KL+s24iTDrG4e3S6AeKLa3oZrNJIt1EJ06gWrPNoh1ttmwXSd4Y4Bsk4Lg8vIjH4qw3Bx+KrufxYTqe+anfMdoXKnW8wOWud5O7HMvCh+sf4dNcf6PIQ==,iv:SF5qExXNPyif+LIcNhHP0PKELUBXaFsPj9B3wvUkEp0=,tag:QEkZXDrIdcpNiZ6l2ljOPw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENDhrWVRuYjRnZktROU4v\nSHNtODFGMWl0NDRHazIwcWl0WGtNY2dYMXhnCmZQQ0doS3BTaU5hRHVsVTB5THl1\nWUNDQUNiMVJFeFZnQ1ptYmFQdTJQc28KLS0tIEtJdUQ5Y1VqSThkSVVNcVNVNEFr\nMzBCRjM1L1V5TngrZG5rR0VHY3Z6TDAKPQ6P96upDeh8xwQDrX4Zcf71Dah5zkOJ\n/F5eODEBadzQSRmJuyp3+uRMFf47eR6Q5bVah3NsVxFquXOL3CtNlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHb0EwT2tuMVE5SE5XaWdQ\ncGR0bFFhOUQvM2dGUzdlUEFFbzRnTHBWWUVnCjFGTXcrWW1vR0x5dXBUamtkS0dF\neG9weUVwQzhhNHhPRUdqV1VnWXJyNFEKLS0tIC80b1ZqRGFOenpENDN1Vk5vRUhY\nVnJzZ1Q5VzZ6ZEZtZE13YjQ0VVhrTTAK5y0BjKBRg2AXuO416JWLMLyM/pCQChKn\nVKZMXcT6cc5hHDuqbp9qUofknF68XnzlH6nOyLB1ZtnELyeZuf29fw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:35Z",
+		"mac": "ENC[AES256_GCM,data:Y3k83RaeX64LA3rsIkQxyKw+LLUgXVsqr3F2UHkv9h73gkyChc6k1oE/FLR4CsZZWsfLNjCkPMuenqToA2mKqQK0aADwPDYo0aVm0hr1PGX5j3Py6EmP56NFvxlAQsExRWo32eqdkeCkY23hfcmUYlaB+bo/fsrRVj67zag9GYA=,iv:p18i8cV6jKXpuZ1Xd7KYCl8BMe1/8CW9YnCuVrTAqy0=,tag:IJnLzdZOn8Clu+lCKT6zvA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/modules/nixos/common.nix
+++ b/modules/nixos/common.nix
@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    screen
+    ncdu
+    vim
+    lshw
+    pciutils
+  ];
+}
--- a/modules/nixos/flake-module.nix
+++ b/modules/nixos/flake-module.nix
@@ -0,0 +1,13 @@
+{
+  flake.nixosModules = {
+    common = {
+      imports = [ ./common.nix ];
+    };
+    think-gtcm = {
+      imports = [ ./think-gtcm.nix ];
+    };
+    think-backend-gtcm = {
+      imports = [ ./think-backend-gtcm.nix ];
+    };
+  };
+}
--- a/modules/nixos/think-backend-gtcm.nix
+++ b/modules/nixos/think-backend-gtcm.nix
@@ -0,0 +1,294 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.think-backend-greaterchiangmai;
+  think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
+  defaultUser = "gtcm";
+  defaultGroup = "gtcm";
+
+  php = pkgs.php83;
+
+  artisan-be = pkgs.writeScriptBin "gtcm-be" ''
+    #! ${pkgs.runtimeShell}
+    cd ${think-backend-gtcm}
+    sudo() {
+      if [[ "$USER" != ${cfg.user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe php} artisan "$@"
+  '';
+
+in
+{
+  options.services.think-backend-greaterchiangmai = {
+    enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/think-backend.greaterchiangmai.com";
+      description = ''A place where to store states'';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which this runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      defaultText = "${defaultGroup}";
+      description = ''
+        Group under which the website runs. 
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "think-backend-gtcm" { };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "think-backend.greaterchiangmai.com";
+      example = "forum.example.com";
+      description = "Domain to serve on.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = lib.mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      description = ''
+        Options for settings environment variables
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_NAME = "Laravel";
+          APP_ENV = "local";
+          APP_KEY = "key";
+          APP_DEBUG = true;
+          APP_URL = "http://localhost";
+
+          LOG_CHANNEL = "stack";
+          LOG_DEPRECATIONS_CHANNEL = "null";
+          LOG_LEVEL = "debug";
+
+          DB_CONNECTION = "mysql";
+          DB_HOST = "127.0.0.1";
+          DB_PORT = "3306";
+          DB_DATABASE = "laravel";
+          DB_USERNAME = "root";
+          DB_PASSWORD = "";
+        }
+      '';
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = lib.mkForce {
+      isSystemUser = true;
+      home = cfg.dataDir;
+      createHome = true;
+      homeMode = "755";
+      group = cfg.group;
+    };
+    users.groups.${cfg.group} = { };
+
+    services.phpfpm.pools.think-backend-gtcm = {
+      inherit (cfg) user group;
+      phpPackage = php;
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "listen.mode" = "0600";
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 10;
+        "pm.max_requests" = lib.mkDefault 500;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 1;
+        "pm.max_spare_servers" = lib.mkDefault 3;
+      };
+      phpOptions = ''
+        error_log = syslog
+        log_errors = on
+      '';
+    };
+
+    environment.systemPackages = [
+      artisan-be
+    ];
+
+    services.think-backend-greaterchiangmai.settings = {
+      APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
+      APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
+      APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
+      APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
+      APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
+    };
+
+    systemd.services.think-backend-gtcm-setup = {
+      description = "think-backend.greaterchiangmai installation";
+      requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
+      before = [ "phpfpm-think-backend-gtcm.service" ];
+      requires = [ "mysql.service" ];
+      after = [ "mysql.service" ];
+      serviceConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        UMask = 77;
+        WorkingDirectory = "${think-backend-gtcm}";
+        RuntimeDirectory = "think-backend-gtcm/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          gtcmEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              lib.escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !lib.elem v [
+              { }
+              null
+            ]
+          )) cfg.settings;
+          gtcmEnv = pkgs.writeText "gtcm-be.env" (gtcmEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${lib.getExe php} artisan key:generate --force
+          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."${cfg.domain}" = {
+        root = "${think-backend-gtcm}/public";
+        locations = {
+          "/" = {
+            index = "index.php";
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+          };
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
+          '';
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    services.mysql = {
+      enable = true;
+      package = lib.mkForce pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.DB_DATABASE ];
+      ensureUsers = [
+        {
+          name = cfg.settings.DB_USERNAME;
+          ensurePermissions = {
+            "${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+  };
+}
--- a/modules/nixos/think-gtcm.nix
+++ b/modules/nixos/think-gtcm.nix
@@ -0,0 +1,297 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.think-greaterchiangmai;
+  think-gtcm = pkgs.think-gtcm.override { dataDir = cfg.dataDir; };
+  defaultUser = "gtcm";
+  defaultGroup = "gtcm";
+
+  php = pkgs.php83;
+
+  artisan = pkgs.writeScriptBin "gtcm" ''
+    #! ${pkgs.runtimeShell}
+    cd ${think-gtcm}
+    sudo() {
+      if [[ "$USER" != ${cfg.user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe php} artisan "$@"
+  '';
+
+in
+{
+  options.services.think-greaterchiangmai = {
+    enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/think.greaterchiangmai.com";
+      description = ''A place where to store states'';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which this runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      defaultText = "${defaultGroup}";
+      description = ''
+        Group under which the website runs. 
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "think-gtcm" { };
+
+    packageBackend = lib.mkPackageOption pkgs "think-backend-gtcm" { };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "think.greaterchiangmai.com";
+      example = "forum.example.com";
+      description = "Domain to serve on.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = lib.mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      description = ''
+        Options for settings environment variables
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_NAME = "Laravel";
+          APP_ENV = "local";
+          APP_KEY = "key";
+          APP_DEBUG = true;
+          APP_URL = "http://localhost";
+
+          LOG_CHANNEL = "stack";
+          LOG_DEPRECATIONS_CHANNEL = "null";
+          LOG_LEVEL = "debug";
+
+          DB_CONNECTION = "mysql";
+          DB_HOST = "127.0.0.1";
+          DB_PORT = "3306";
+          DB_DATABASE = "laravel";
+          DB_USERNAME = "root";
+          DB_PASSWORD = "";
+        }
+      '';
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      home = cfg.dataDir;
+      createHome = true;
+      homeMode = "755";
+      group = cfg.group;
+    };
+    users.groups.${cfg.group} = { };
+
+    services.phpfpm.pools.think-gtcm = {
+      inherit (cfg) user group;
+      phpPackage = php;
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "listen.mode" = "0600";
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 10;
+        "pm.max_requests" = lib.mkDefault 500;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 1;
+        "pm.max_spare_servers" = lib.mkDefault 3;
+      };
+      phpOptions = ''
+        error_log = syslog
+        log_errors = on
+      '';
+    };
+
+    environment.systemPackages = [
+      artisan
+    ];
+
+    services.think-greaterchiangmai.settings = {
+      APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
+      APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
+      APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
+      APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
+      APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
+    };
+
+    systemd.services.think-gtcm-setup = {
+      description = "think.greaterchiangmai installation";
+      requiredBy = [ "phpfpm-think-gtcm.service" ];
+      before = [ "phpfpm-think-gtcm.service" ];
+      requires = [ "mysql.service" ];
+      after = [ "mysql.service" ];
+      serviceConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        UMask = 77;
+        WorkingDirectory = "${think-gtcm}";
+        RuntimeDirectory = "think-gtcm/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          gtcmEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              lib.escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !lib.elem v [
+              { }
+              null
+            ]
+          )) cfg.settings;
+          gtcmEnv = pkgs.writeText "gtcm.env" (gtcmEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${lib.getExe php} artisan key:generate --force
+          ${lib.getExe php} artisan migrate --force
+          ${lib.getExe php} artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/cache                      0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."${cfg.domain}" = {
+        root = "${think-gtcm}/public";
+        locations = {
+          "/" = {
+            index = "index.php";
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+          };
+
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
+          '';
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    services.mysql = {
+      enable = true;
+      package = pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.DB_DATABASE ];
+      ensureUsers = [
+        {
+          name = cfg.settings.DB_USERNAME;
+          ensurePermissions = {
+            "${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+  };
+}
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  flake.overlays = {
+    packagesOverlay = import ../pkgs/overlay.nix;
+  };
+}
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -0,0 +1,4 @@
+final: prev: {
+  think-gtcm = final.callPackage ./think-gtcm.nix { };
+  think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
+}
--- a/pkgs/think-backend-gtcm.nix
+++ b/pkgs/think-backend-gtcm.nix
@@ -0,0 +1,32 @@
+{
+  fetchgit,
+  php,
+  dataDir ? "/var/lib/think-backend-gtcm",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
+    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+  };
+  src = "${repoSrc}/think-backend.greaterchiangmai.com";
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "think-backend-gtcm";
+  version = "1.0.0";
+
+  inherit src;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+    rm -rf $out/storage
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    runHook postInstall
+  '';
+
+  composerStrictValidation = false;
+  vendorHash = "sha256-eXm1x3E9KHWojaT2RU4inMdZqQVcWdLCKlvzhOlIZrc=";
+})
--- a/pkgs/think-gtcm.nix
+++ b/pkgs/think-gtcm.nix
@@ -0,0 +1,32 @@
+{
+  fetchgit,
+  php,
+  dataDir ? "/var/lib/think-gtcm",
+}:
+let
+  repoSrc = fetchgit {
+    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
+    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
+    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+  };
+  src = "${repoSrc}/think.greaterchiangmai.com";
+in
+php.buildComposerProject2 (finalAttrs: {
+  pname = "think-gtcm";
+  version = "1.0.0";
+
+  inherit src;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+    rm -rf $out/storage
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    runHook postInstall
+  '';
+
+  composerStrictValidation = false;
+  vendorHash = "sha256-QV3hR3U3GwCqrCRxfkazmJwDpO1vFyMfA6YqUb4bjMI=";
+})
--- a/routers/default.nix
+++ b/routers/default.nix
@@ -1,25 +1,9 @@
-{ inputs, ... }:
+{ inputs, pkgs, ... }:
 {
  flake.legacyPackages = {
-    qemu-router = import "${inputs.liminix}/default.nix" {
-      liminix-config = import "${inputs.liminix}/examples/hello-from-qemu.nix";
-      device = (import "${inputs.liminix}/devices/qemu-aarch64/default.nix");
-    };
-    yada-router = import "${inputs.liminix}/default.nix" {
-      liminix-config = import ./routers/yada-house/configuration.nix { inherit inputs; };
-      device = (import ./routers/yada-house/device.nix { inherit inputs; });
-    };
-    qemu-flake = import "${inputs.liminix}/default.nix" {
-      liminix-config = import ./routers/qemu/configuration.nix { inherit inputs; };
-      device = (import ./routers/qemu/device.nix { inherit inputs; });
-    };
-    vanilla = import "${inputs.liminix}/default.nix" {
-      liminix-config = import ./routers/vanilla/configuration.nix { inherit inputs; };
-      device = (import "${inputs.liminix}/devices/gl-mt300a/default.nix");
-    };
-    fax-router = import "${inputs.liminix}/default.nix" {
+    whitehouse-router = import "${inputs.liminix}/default.nix" {
      device = (import "${inputs.liminix}/devices/gl-ar750");
-      liminix-config = import ./fax-router/configuration.nix { inherit inputs; };
+      liminix-config = import ./white-house/configuration.nix { inherit inputs; };
    };
  };
 }
--- a/routers/fax-router/configuration.nix
+++ b/routers/fax-router/configuration.nix
@@ -1,46 +0,0 @@
-# This is an example that uses the "gateway" profile to create a
-# "typical home wireless router" configuration suitable for a Gl.inet
-# gl-ar750 router. It should be fairly simple to edit it for other
-# devices: mostly you will need to attend to the number of wlan and lan
-# interfaces
-{ inputs }:
-{ config, pkgs, ... }:
-let
-  inherit (pkgs.liminix.services) target;
-  svc = config.system.service;
-in
-rec {
-  imports = [
-    "${inputs.liminix}/modules/wlan.nix"
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/ntp"
-    "${inputs.liminix}/modules/vlan"
-  ];
-
-  services.dhcpv4 =
-    let
-      iface = svc.network.link.build { ifname = "eth1"; };
-    in
-    svc.network.dhcp.client.build { interface = iface; };
-
-  services.defaultroute4 = svc.network.route.build {
-    via = "$(output ${services.dhcpv4} ip)";
-    target = "default";
-    dependencies = [ services.dhcpv4 ];
-  };
-
-  services.packet_forwarding = svc.network.forward.build { };
-
-  services.ntp = config.system.service.ntp.build {
-    pools = {
-      "pool.ntp.org" = [ "iburst" ];
-    };
-  };
-
-  boot.tftp = {
-    serverip = "192.168.8.148";
-    ipaddr = "192.168.8.251";
-  };
-
-  defaultProfile.packages = [ pkgs.hello ];
-}
--- a/routers/fax-router/router-secrets.nix
+++ b/routers/fax-router/router-secrets.nix
@@ -1,17 +0,0 @@
-{
-  wpa_passphrase = "you bring light in";
-  ssid = "liminix";
-  l2tp = {
-    name = "abcde@a.1";
-    password = "NotMyIspPassword";
-  };
-  root = {
-    #  mkpasswd -m sha512crypt
-    passwd = "$6$6pt0mpbgcB7kC2RJ$kSBoCYGyi1.qxt7dqmexLj1l8E6oTZJZmfGyJSsMYMW.jlsETxdgQSdv6ptOYDM7DHAwf6vLG0pz3UD31XBfC1";
-    openssh.authorizedKeys.keys = [ ];
-  };
-
-  lan = {
-    prefix = "10.8.0";
-  };
-}
--- a/routers/qemu/configuration.nix
+++ b/routers/qemu/configuration.nix
@@ -1,49 +0,0 @@
-{ inputs }:
-{ config, pkgs, ... }:
-let
-  svc = config.system.service;
-
-in
-rec {
-  imports = [
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/dnsmasq"
-    "${inputs.liminix}/modules/ssh"
-  ];
-
-  hostname = "hello";
-
-  # configure the internal network (LAN) with an address
-  services.int = svc.network.address.build {
-    interface = config.hardware.networkInterfaces.lan;
-    family = "inet";
-    address = "10.3.0.1";
-    prefixLength = 16;
-  };
-
-  services.sshd = svc.ssh.build { };
-
-  users.root = {
-    # the password is "secret". Use mkpasswd -m sha512crypt to
-    # create this hashed password string
-    passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
-  };
-
-  services.dns =
-    let
-      interface = services.int;
-    in
-    svc.dnsmasq.build {
-      inherit interface;
-      ranges = [
-        "10.3.0.10,10.3.0.240"
-        "::,constructor:$(output ${interface} ifname),ra-stateless"
-      ];
-
-      domain = "example.org";
-    };
-
-  defaultProfile.packages = with pkgs; [
-    figlet
-  ];
-}
--- a/routers/qemu/device.nix
+++ b/routers/qemu/device.nix
@@ -1,58 +0,0 @@
-# This "device" generates images that can be used with the QEMU
-# emulator. The default output is a directory containing separate
-# kernel ("Image" format) and root filesystem (squashfs or jffs2)
-# images
-{ inputs }:
-{
-  system = {
-    crossSystem = {
-      config = "aarch64-unknown-linux-musl";
-    };
-  };
-
-  description = ''
-    QEMU Aarch64
-    ************
-
-    This target produces an image for
-    the `QEMU "virt" platform <https://www.qemu.org/docs/master/system/arm/virt.html>`_ using a 64 bit CPU type.
-
-    ARM targets differ from MIPS in that the kernel format expected
-    by QEMU is an "Image" (raw binary file) rather than an ELF
-    file, but this is taken care of by :command:`run.sh`. Check the
-    documentation for the :ref:`qemu` target for more information.
-
-  '';
-
-  # this device is described by the "qemu" device
-  installer = "vmroot";
-
-  module =
-    { config, lim, ... }:
-    {
-      imports = [
-        "${inputs.liminix}/modules/arch/aarch64.nix"
-        "${inputs.liminix}/devices/families/qemu.nix"
-      ];
-      kernel = {
-        config = {
-          VIRTUALIZATION = "y";
-          PCI_HOST_GENERIC = "y";
-
-          SERIAL_AMBA_PL011 = "y";
-          SERIAL_AMBA_PL011_CONSOLE = "y";
-        };
-      };
-      boot.commandLine = [
-        "console=ttyAMA0,38400"
-      ];
-      hardware =
-        let
-          addr = lim.parseInt "0x40010000";
-        in
-        {
-          loadAddress = addr;
-          entryPoint = addr;
-        };
-    };
-}
--- a/routers/vanilla/configuration.nix
+++ b/routers/vanilla/configuration.nix
@@ -1,41 +0,0 @@
-{ inputs }:
-{ config, pkgs, ... }:
-let
-  inherit (pkgs.liminix.services) target;
-  svc = config.system.service;
-in
-rec {
-  imports = [
-    "${inputs.liminix}/modules/wlan.nix"
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/ntp"
-    "${inputs.liminix}/modules/vlan"
-  ];
-
-  services.dhcpv4 =
-    let
-      iface = svc.network.link.build { ifname = "eth1"; };
-    in
-    svc.network.dhcp.client.build { interface = iface; };
-
-  services.defaultroute4 = svc.network.route.build {
-    via = "$(output ${services.dhcpv4} ip)";
-    target = "default";
-    dependencies = [ services.dhcpv4 ];
-  };
-
-  services.packet_forwarding = svc.network.forward.build { };
-
-  services.ntp = config.system.service.ntp.build {
-    pools = {
-      "pool.ntp.org" = [ "iburst" ];
-    };
-  };
-
-  boot.tftp = {
-    serverip = "192.168.8.148";
-    ipaddr = "192.168.8.251";
-  };
-
-  defaultProfile.packages = [ pkgs.hello ];
-}
--- a/routers/vanilla/device.nix
+++ b/routers/vanilla/device.nix
@@ -1,86 +0,0 @@
-# This "device" generates images that can be used with the QEMU
-# emulator. The default output is a directory containing separate
-# kernel (uncompressed vmlinux) and initrd (squashfs) images
-{ inputs }:
-{
-  system = {
-    crossSystem = {
-      config = "mips-unknown-linux-musl";
-      gcc = {
-        abi = "32";
-        arch = "mips32"; # maybe mips_24kc-
-      };
-    };
-  };
-
-  description = ''
-    QEMU MIPS
-    *********
-
-    This target produces an image for
-    QEMU, the "generic and open source machine emulator and
-    virtualizer".
-
-    MIPS QEMU emulates a "Malta" board, which was an ATX form factor
-    evaluation board made by MIPS Technologies, but mostly in Liminix
-    we use paravirtualized devices (Virtio) instead of emulating
-    hardware.
-
-    Building an image for QEMU results in a :file:`result/` directory
-    containing ``run.sh`` ``vmlinux``, and ``rootfs`` files. To invoke
-    the emulator, run ``run.sh``.
-
-    The configuration includes two emulated "hardware" ethernet
-    devices and the kernel :code:`mac80211_hwsim` module to
-    provide an emulated wlan device. To read more about how
-    to connect to this network, refer to :ref:`qemu-networking`
-    in the Development manual.
-
-  '';
-  module =
-    {
-      config,
-      lib,
-      lim,
-      ...
-    }:
-    {
-      imports = [
-        "${inputs.liminix}/modules/arch/mipseb.nix"
-        "${inputs.liminix}/devices/families/qemu.nix"
-      ];
-      kernel = {
-        config = {
-          MIPS_MALTA = "y";
-          CPU_MIPS32_R2 = "y";
-
-          POWER_RESET = "y";
-          POWER_RESET_SYSCON = "y";
-
-          SERIAL_8250 = "y";
-          SERIAL_8250_CONSOLE = "y";
-        };
-      };
-      hardware =
-        # from arch/mips/mti-malta/Platform:load-$(CONFIG_MIPS_MALTA)  += 0xffffffff80100000
-        let
-          addr = lim.parseInt "0x80100000";
-        in
-        {
-          loadAddress = addr;
-          entryPoint = addr;
-
-          # Unlike the arm qemu targets, we need a static dts when
-          # running u-boot-using tests, qemu dumpdtb command doesn't
-          # work for this board. I am not at all sure this dts is
-          # *correct* but it does at least boot
-          dts = lib.mkForce {
-            src = "${config.system.outputs.kernel.modulesupport}/arch/mips/boot/dts/mti/malta.dts";
-            includePaths = [
-              "${config.system.outputs.kernel.modulesupport}/arch/mips/boot/dts/"
-            ];
-          };
-
-        };
-    };
-}
--- a/routers/white-house/configuration.nix
+++ b/routers/white-house/configuration.nix
@@ -0,0 +1,162 @@
+{ inputs }:
+{
+  config,
+  pkgs,
+  modulesPath,
+  lib,
+  ...
+}:
+let
+  secrets = {
+    firewallRules = { };
+  }
+  // (import ./secrets.nix);
+  wirelessConfig = {
+    country_code = "TH";
+    inherit (secrets) wpa_passphrase;
+    wmm_enabled = 1;
+  };
+  svc = config.system.service;
+in
+{
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/vlan"
+    "${inputs.liminix}/modules/ssh"
+    "${inputs.liminix}/modules/bridge"
+    "${inputs.liminix}/modules/health-check"
+    "${modulesPath}/profiles/gateway.nix"
+  ];
+
+  hostname = "whitehouse";
+  boot = {
+    tftp = {
+      freeSpaceBytes = 3 * 1024 * 1024;
+      serverip = "${secrets.lan.prefix}.148";
+      ipaddr = "${secrets.lan.prefix}.251";
+    };
+  };
+
+  services.sshd = svc.ssh.build {
+    authorizedKeys.root = secrets.root.openssh.authorizedKeys.keys;
+  };
+
+  users.root = secrets.root;
+
+  services.resolvconf = lib.mkForce (
+    pkgs.liminix.services.oneshot rec {
+      name = "resolvconf";
+      up = ''
+        ( in_outputs ${name}
+         echo "nameserver 208.67.222.222" >> resolv.conf
+         echo "nameserver 208.67.220.220" >> resolv.conf
+         echo "nameserver 1.1.1.1" >> resolv.conf
+         echo "nameserver 1.0.0.1" >> resolv.conf
+         echo "nameserver 8.8.8.8" >> resolv.conf
+         chmod 0444 resolv.conf
+        )
+      '';
+    }
+  );
+
+  services.reAddDefaultroute =
+    let
+      threshold = 3;
+      healthCheck = pkgs.writeAshScript "ping-check" { } "ping 1.1.1.1";
+    in
+    pkgs.liminix.services.longrun rec {
+      # dependencies = [ config.services.wan ];
+      name = "hack-default-route";
+      run = ''
+        fails=0
+        while sleep 10 ; do
+          ${healthCheck}
+          if test $? -gt 0; then
+            fails=$(expr $fails + 1)
+          else
+            fails=0
+          fi
+          echo fails $fails/${toString threshold} for ${name}
+          if test "$fails" -gt "${toString threshold}" ; then
+            echo [+] adding default route
+            ${config.services.defaultroute4}/${config.services.defaultroute4.name}/up
+            ${config.services.defaultroute6}/${config.services.defaultroute6.name}/up
+            echo bounced
+            fails=0
+          fi
+        done
+      '';
+    };
+
+  profile.gateway = {
+    lan = {
+      interfaces = with config.hardware.networkInterfaces; [
+        wlan
+        wlan5
+        lan
+      ];
+      inherit (secrets.lan) prefix;
+      address = {
+        family = "inet";
+        address = "${secrets.lan.prefix}.1";
+        prefixLength = 24;
+      };
+      dhcp = {
+        start = 10;
+        end = 240;
+        hosts = { };
+        localDomain = "lan";
+      };
+    };
+    wan =
+      let
+        inherit (config.system.service) vlan;
+        wan-vlan = vlan.build {
+          ifname = "wan-vlan";
+          primary = config.hardware.networkInterfaces.wan;
+          vid = "10";
+        };
+      in
+      {
+        interface = svc.pppoe.build {
+          interface = wan-vlan;
+          username = secrets.l2tp.name;
+          password = secrets.l2tp.password;
+        };
+
+        dhcp6.enable = true;
+      };
+    firewall = {
+      enable = true;
+      rules = secrets.firewallRules;
+    };
+    wireless.networks = {
+
+      "${secrets.ssid}" = {
+        interface = config.hardware.networkInterfaces.wlan;
+        hw_mode = "g";
+        channel = "2";
+        ieee80211n = 1;
+      }
+      // wirelessConfig;
+      "${secrets.ssid}-5" = rec {
+        interface = config.hardware.networkInterfaces.wlan5;
+        hw_mode = "a";
+        channel = 36;
+        ht_capab = "[HT40+]";
+        vht_oper_chwidth = 1;
+        vht_oper_centr_freq_seg0_idx = channel + 6;
+        ieee80211n = 1;
+        ieee80211ac = 1;
+      }
+      // wirelessConfig;
+    };
+  };
+  defaultProfile.packages = with pkgs; [
+    busybox
+    iw
+    nftables
+  ];
+
+}
--- a/routers/white-house/secrets.nix
+++ b/routers/white-house/secrets.nix
@@ -0,0 +1,20 @@
+{
+  wpa_passphrase = "";
+  ssid = "WhiteHouse";
+  l2tp = {
+    name = "";
+    password = "";
+  };
+  root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387"
+    ];
+  };
+
+  lan = {
+    prefix = "192.168.1";
+  };
+}
--- a/routers/yada-house/configuration.nix
+++ b/routers/yada-house/configuration.nix
@@ -1,54 +0,0 @@
-{ inputs }:
-
-{
-  config,
-  pkgs,
-  ...
-}:
-let
-  svc = config.system.service;
-
-in
-rec {
-  imports = [
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/dnsmasq"
-    "${inputs.liminix}/modules/ssh"
-  ];
-
-  hostname = "hello";
-
-  # configure the internal network (LAN) with an address
-  services.int = svc.network.address.build {
-    interface = config.hardware.networkInterfaces.lan2;
-    family = "inet";
-    address = "192.168.8.1";
-    prefixLength = 24;
-  };
-
-  services.sshd = svc.ssh.build { };
-
-  users.root = {
-    # the password is "secret". Use mkpasswd -m sha512crypt to
-    # create this hashed password string
-    passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
-  };
-
-  services.dns =
-    let
-      interface = services.int;
-    in
-    svc.dnsmasq.build {
-      inherit interface;
-      ranges = [
-        "192.168.8.1,192.168.8.240"
-        "::,constructor:$(output ${interface} ifname),ra-stateless"
-      ];
-
-      domain = "example.org";
-    };
-
-  # defaultProfile.packages = with pkgs; [
-  #   figlet
-  # ];
-}
--- a/routers/yada-house/device.nix
+++ b/routers/yada-house/device.nix
@@ -1,127 +0,0 @@
-# GL.iNet GL-MT6000
-{ inputs }:
-{
-  system = {
-    crossSystem = {
-      config = "aarch64-unknown-linux-musl";
-      gcc = {
-        arch = "armv8-a";
-      };
-    };
-  };
-
-  description = ''
-    Device configuration for Yada/White house router.
-  '';
-
-  module =
-    {
-      pkgs,
-      config,
-      lib,
-      lim,
-      ...
-    }:
-    let
-      inherit (pkgs) openwrt_24_10;
-      # mac80211 = pkgs.kmodloader.override {
-      #   targets = [ "rt2800soc" ];
-      #   inherit (config.system.outputs) kernel;
-      # };
-    in
-    {
-      imports = [
-        "${inputs.liminix}/modules/outputs/mtdimage.nix"
-        "${inputs.liminix}/modules/outputs/squashfs.nix"
-        "${inputs.liminix}/modules/outputs/tftpboot.nix"
-        "${inputs.liminix}/modules/outputs/vmroot.nix"
-        "${inputs.liminix}/modules/arch/aarch64.nix"
-        # "${inputs.liminix}/modules/base.nix"
-        "${inputs.liminix}/modules/vlan"
-      ];
-      boot.tftp = {
-        serverip = "192.168.1.254";
-        ipaddr = "192.168.1.1";
-        loadAddress = lim.parseInt "0x46000000";
-      };
-      boot.imageFormat = "fit";
-      boot.loader.fit.enable = true;
-      rootfsType = "squashfs";
-      hardware = {
-        loadAddress = lim.parseInt "0x48080000";
-        entryPoint = lim.parseInt "0x48080000";
-
-        flash = {
-          address = lim.parseInt "0x41e00000";
-          size = lim.parseInt "0x4000";
-          eraseBlockSize = 65536;
-        };
-        rootDevice = "/dev/root";
-
-        dts = {
-          src = "${openwrt_24_10.src}/target/linux/mediatek/dts/mt7986a-glinet-gl-mt6000.dts";
-          includePaths = [
-            "${openwrt_24_10.src}/target/linux/mediatek/dts"
-            "${config.system.outputs.kernel.modulesupport}/arch/arm64/boot/dts/mediatek/"
-          ];
-        };
-        networkInterfaces =
-          let
-            inherit (config.system.service.network) link;
-            inherit (config.system.service) vlan;
-          in
-          rec {
-            eth0 = link.build { ifname = "eth0"; };
-            wan = link.build { ifname = "eth1"; };
-
-            lan1 = vlan.build {
-              ifname = "lan1@eth0";
-              primary = eth0;
-              vid = "1";
-            };
-            lan2 = vlan.build {
-              ifname = "lan2@eth0";
-              primary = eth0;
-              vid = "2";
-            };
-            lan3 = vlan.build {
-              ifname = "lan3@eth0";
-              primary = eth0;
-              vid = "3";
-            };
-            lan4 = vlan.build {
-              ifname = "lan4@eth0";
-              primary = eth0;
-              vid = "4";
-            };
-            lan5 = vlan.build {
-              ifname = "lan5@eth0";
-              primary = eth0;
-              vid = "5";
-            };
-
-            # wlan = link.build {
-            #   ifname = "wlan0";
-            #   dependencies = [ mac80211 ];
-            # };
-          };
-      };
-
-      kernel = {
-        src = openwrt_24_10.kernelSrc;
-        version = openwrt_24_10.kernelVersion;
-        extraPatchPhase = ''
-          echo ==================================================
-          ls ${openwrt_24_10.src}/config
-          echo ==================================================
-          patch ${openwrt_24_10.src}/package/boot/uboot-mediatek/patches/436-add-glinet-mt6000.patch
-          echo --------------------------------------------------
-          ls ${openwrt_24_10.src}/config
-          echo --------------------------------------------------
-          ${openwrt_24_10.applyPatches.mediatek}
-        '';
-        config = {
-        };
-      };
-    };
-}
--- a/routers/yada-house/dts/mt7986a.dtsi
+++ b/routers/yada-house/dts/mt7986a.dtsi
@@ -1,645 +0,0 @@
-// SPDX-License-Identifier: (GPL-2.0 OR MIT)
-/*
- * Copyright (C) 2021 MediaTek Inc.
- * Author: Sam.Shih <sam.shih@mediatek.com>
- */
-
-#include <dt-bindings/interrupt-controller/irq.h>
-#include <dt-bindings/interrupt-controller/arm-gic.h>
-#include <dt-bindings/clock/mt7986-clk.h>
-#include <dt-bindings/reset/mt7986-resets.h>
-#include <dt-bindings/phy/phy.h>
-
-/ {
-	compatible = "mediatek,mt7986a";
-	interrupt-parent = <&gic>;
-	#address-cells = <2>;
-	#size-cells = <2>;
-
-	cpus {
-		#address-cells = <1>;
-		#size-cells = <0>;
-		cpu0: cpu@0 {
-			compatible = "arm,cortex-a53";
-			reg = <0x0>;
-			device_type = "cpu";
-			enable-method = "psci";
-			#cooling-cells = <2>;
-		};
-
-		cpu1: cpu@1 {
-			compatible = "arm,cortex-a53";
-			reg = <0x1>;
-			device_type = "cpu";
-			enable-method = "psci";
-			#cooling-cells = <2>;
-		};
-
-		cpu2: cpu@2 {
-			compatible = "arm,cortex-a53";
-			reg = <0x2>;
-			device_type = "cpu";
-			enable-method = "psci";
-			#cooling-cells = <2>;
-		};
-
-		cpu3: cpu@3 {
-			compatible = "arm,cortex-a53";
-			reg = <0x3>;
-			device_type = "cpu";
-			enable-method = "psci";
-			#cooling-cells = <2>;
-		};
-	};
-
-	clk40m: oscillator-40m {
-		compatible = "fixed-clock";
-		clock-frequency = <40000000>;
-		#clock-cells = <0>;
-		clock-output-names = "clkxtal";
-	};
-
-	psci {
-		compatible = "arm,psci-0.2";
-		method = "smc";
-	};
-
-	reserved-memory {
-		#address-cells = <2>;
-		#size-cells = <2>;
-		ranges;
-		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
-		secmon_reserved: secmon@43000000 {
-			reg = <0 0x43000000 0 0x30000>;
-			no-map;
-		};
-
-		wmcpu_emi: wmcpu-reserved@4fc00000 {
-			no-map;
-			reg = <0 0x4fc00000 0 0x00100000>;
-		};
-
-		wo_emi0: wo-emi@4fd00000 {
-			reg = <0 0x4fd00000 0 0x40000>;
-			no-map;
-		};
-
-		wo_emi1: wo-emi@4fd40000 {
-			reg = <0 0x4fd40000 0 0x40000>;
-			no-map;
-		};
-
-		wo_ilm0: wo-ilm@151e0000 {
-			reg = <0 0x151e0000 0 0x8000>;
-			no-map;
-		};
-
-		wo_ilm1: wo-ilm@151f0000 {
-			reg = <0 0x151f0000 0 0x8000>;
-			no-map;
-		};
-
-		wo_data: wo-data@4fd80000 {
-			reg = <0 0x4fd80000 0 0x240000>;
-			no-map;
-		};
-
-		wo_dlm0: wo-dlm@151e8000 {
-			reg = <0 0x151e8000 0 0x2000>;
-			no-map;
-		};
-
-		wo_dlm1: wo-dlm@151f8000 {
-			reg = <0 0x151f8000 0 0x2000>;
-			no-map;
-		};
-
-		wo_boot: wo-boot@15194000 {
-			reg = <0 0x15194000 0 0x1000>;
-			no-map;
-		};
-
-	};
-
-	soc {
-		compatible = "simple-bus";
-		ranges;
-		#address-cells = <2>;
-		#size-cells = <2>;
-
-		gic: interrupt-controller@c000000 {
-			compatible = "arm,gic-v3";
-			reg = <0 0x0c000000 0 0x10000>,  /* GICD */
-			      <0 0x0c080000 0 0x80000>,  /* GICR */
-			      <0 0x0c400000 0 0x2000>,   /* GICC */
-			      <0 0x0c410000 0 0x1000>,   /* GICH */
-			      <0 0x0c420000 0 0x2000>;   /* GICV */
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-controller;
-			#interrupt-cells = <3>;
-		};
-
-		infracfg: infracfg@10001000 {
-			compatible = "mediatek,mt7986-infracfg", "syscon";
-			reg = <0 0x10001000 0 0x1000>;
-			#clock-cells = <1>;
-			#reset-cells = <1>;
-		};
-
-		wed_pcie: wed-pcie@10003000 {
-			compatible = "mediatek,mt7986-wed-pcie",
-				     "syscon";
-			reg = <0 0x10003000 0 0x10>;
-		};
-
-		topckgen: topckgen@1001b000 {
-			compatible = "mediatek,mt7986-topckgen", "syscon";
-			reg = <0 0x1001B000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
-		watchdog: watchdog@1001c000 {
-			compatible = "mediatek,mt7986-wdt";
-			reg = <0 0x1001c000 0 0x1000>;
-			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
-			#reset-cells = <1>;
-			status = "disabled";
-		};
-
-		apmixedsys: apmixedsys@1001e000 {
-			compatible = "mediatek,mt7986-apmixedsys";
-			reg = <0 0x1001E000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
-		pio: pinctrl@1001f000 {
-			compatible = "mediatek,mt7986a-pinctrl";
-			reg = <0 0x1001f000 0 0x1000>,
-			      <0 0x11c30000 0 0x1000>,
-			      <0 0x11c40000 0 0x1000>,
-			      <0 0x11e20000 0 0x1000>,
-			      <0 0x11e30000 0 0x1000>,
-			      <0 0x11f00000 0 0x1000>,
-			      <0 0x11f10000 0 0x1000>,
-			      <0 0x1000b000 0 0x1000>;
-			reg-names = "gpio", "iocfg_rt", "iocfg_rb", "iocfg_lt",
-				    "iocfg_lb", "iocfg_tr", "iocfg_tl", "eint";
-			gpio-controller;
-			#gpio-cells = <2>;
-			gpio-ranges = <&pio 0 0 100>;
-			interrupt-controller;
-			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-parent = <&gic>;
-			#interrupt-cells = <2>;
-		};
-
-		pwm: pwm@10048000 {
-			compatible = "mediatek,mt7986-pwm";
-			reg = <0 0x10048000 0 0x1000>;
-			#pwm-cells = <2>;
-			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&topckgen CLK_TOP_PWM_SEL>,
-				 <&infracfg CLK_INFRA_PWM_STA>,
-				 <&infracfg CLK_INFRA_PWM1_CK>,
-				 <&infracfg CLK_INFRA_PWM2_CK>;
-			clock-names = "top", "main", "pwm1", "pwm2";
-			status = "disabled";
-		};
-
-		sgmiisys0: syscon@10060000 {
-			compatible = "mediatek,mt7986-sgmiisys_0",
-				     "syscon";
-			reg = <0 0x10060000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
-		sgmiisys1: syscon@10070000 {
-			compatible = "mediatek,mt7986-sgmiisys_1",
-				     "syscon";
-			reg = <0 0x10070000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
-		trng: rng@1020f000 {
-			compatible = "mediatek,mt7986-rng",
-				     "mediatek,mt7623-rng";
-			reg = <0 0x1020f000 0 0x100>;
-			clocks = <&infracfg CLK_INFRA_TRNG_CK>;
-			clock-names = "rng";
-			status = "disabled";
-		};
-
-		crypto: crypto@10320000 {
-			compatible = "inside-secure,safexcel-eip97";
-			reg = <0 0x10320000 0 0x40000>;
-			interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "ring0", "ring1", "ring2", "ring3";
-			clocks = <&infracfg CLK_INFRA_EIP97_CK>;
-			assigned-clocks = <&topckgen CLK_TOP_EIP_B_SEL>;
-			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>;
-			status = "disabled";
-		};
-
-		uart0: serial@11002000 {
-			compatible = "mediatek,mt7986-uart",
-				     "mediatek,mt6577-uart";
-			reg = <0 0x11002000 0 0x400>;
-			interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_UART0_SEL>,
-				 <&infracfg CLK_INFRA_UART0_CK>;
-			clock-names = "baud", "bus";
-			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
-					  <&infracfg CLK_INFRA_UART0_SEL>;
-			assigned-clock-parents = <&topckgen CLK_TOP_XTAL>,
-						 <&topckgen CLK_TOP_UART_SEL>;
-			status = "disabled";
-		};
-
-		uart1: serial@11003000 {
-			compatible = "mediatek,mt7986-uart",
-				     "mediatek,mt6577-uart";
-			reg = <0 0x11003000 0 0x400>;
-			interrupts = <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_UART1_SEL>,
-				 <&infracfg CLK_INFRA_UART1_CK>;
-			clock-names = "baud", "bus";
-			assigned-clocks = <&infracfg CLK_INFRA_UART1_SEL>;
-			assigned-clock-parents = <&topckgen CLK_TOP_F26M_SEL>;
-			status = "disabled";
-		};
-
-		uart2: serial@11004000 {
-			compatible = "mediatek,mt7986-uart",
-				     "mediatek,mt6577-uart";
-			reg = <0 0x11004000 0 0x400>;
-			interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_UART2_SEL>,
-				 <&infracfg CLK_INFRA_UART2_CK>;
-			clock-names = "baud", "bus";
-			assigned-clocks = <&infracfg CLK_INFRA_UART2_SEL>;
-			assigned-clock-parents = <&topckgen CLK_TOP_F26M_SEL>;
-			status = "disabled";
-		};
-
-		i2c0: i2c@11008000 {
-			compatible = "mediatek,mt7986-i2c";
-			reg = <0 0x11008000 0 0x90>,
-			      <0 0x10217080 0 0x80>;
-			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
-			clock-div = <5>;
-			clocks = <&infracfg CLK_INFRA_I2C0_CK>,
-				 <&infracfg CLK_INFRA_AP_DMA_CK>;
-			clock-names = "main", "dma";
-			#address-cells = <1>;
-			#size-cells = <0>;
-			status = "disabled";
-		};
-
-		spi0: spi@1100a000 {
-			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
-			reg = <0 0x1100a000 0 0x100>;
-			#address-cells = <1>;
-			#size-cells = <0>;
-			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&topckgen CLK_TOP_MPLL_D2>,
-				 <&topckgen CLK_TOP_SPI_SEL>,
-				 <&infracfg CLK_INFRA_SPI0_CK>,
-				 <&infracfg CLK_INFRA_SPI0_HCK_CK>;
-			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
-			status = "disabled";
-		};
-
-		spi1: spi@1100b000 {
-			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
-			reg = <0 0x1100b000 0 0x100>;
-			#address-cells = <1>;
-			#size-cells = <0>;
-			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&topckgen CLK_TOP_MPLL_D2>,
-				 <&topckgen CLK_TOP_SPIM_MST_SEL>,
-				 <&infracfg CLK_INFRA_SPI1_CK>,
-				 <&infracfg CLK_INFRA_SPI1_HCK_CK>;
-			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
-			status = "disabled";
-		};
-
-		thermal: thermal@1100c800 {
-			compatible = "mediatek,mt7986-thermal";
-			reg = <0 0x1100c800 0 0x800>;
-			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_THERM_CK>,
-				 <&infracfg CLK_INFRA_ADC_26M_CK>;
-			clock-names = "therm", "auxadc";
-			nvmem-cells = <&thermal_calibration>;
-			nvmem-cell-names = "calibration-data";
-			#thermal-sensor-cells = <1>;
-			mediatek,auxadc = <&auxadc>;
-			mediatek,apmixedsys = <&apmixedsys>;
-		};
-
-		auxadc: adc@1100d000 {
-			compatible = "mediatek,mt7986-auxadc";
-			reg = <0 0x1100d000 0 0x1000>;
-			clocks = <&infracfg CLK_INFRA_ADC_26M_CK>;
-			clock-names = "main";
-			#io-channel-cells = <1>;
-			status = "disabled";
-		};
-
-		ssusb: usb@11200000 {
-			compatible = "mediatek,mt7986-xhci",
-				     "mediatek,mtk-xhci";
-			reg = <0 0x11200000 0 0x2e00>,
-			      <0 0x11203e00 0 0x0100>;
-			reg-names = "mac", "ippc";
-			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_IUSB_SYS_CK>,
-				 <&infracfg CLK_INFRA_IUSB_CK>,
-				 <&infracfg CLK_INFRA_IUSB_133_CK>,
-				 <&infracfg CLK_INFRA_IUSB_66M_CK>,
-				 <&topckgen CLK_TOP_U2U3_XHCI_SEL>;
-			clock-names = "sys_ck",
-				      "ref_ck",
-				      "mcu_ck",
-				      "dma_ck",
-				      "xhci_ck";
-			phys = <&u2port0 PHY_TYPE_USB2>,
-			       <&u3port0 PHY_TYPE_USB3>,
-			       <&u2port1 PHY_TYPE_USB2>;
-			status = "disabled";
-		};
-
-		mmc0: mmc@11230000 {
-			compatible = "mediatek,mt7986-mmc";
-			reg = <0 0x11230000 0 0x1000>,
-			      <0 0x11c20000 0 0x1000>;
-			interrupts = <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
-			assigned-clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
-					  <&topckgen CLK_TOP_EMMC_250M_SEL>;
-			assigned-clock-parents = <&apmixedsys CLK_APMIXED_MPLL>,
-						 <&topckgen CLK_TOP_NET1PLL_D5_D2>;
-			clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
-				 <&infracfg CLK_INFRA_MSDC_HCK_CK>,
-				 <&infracfg CLK_INFRA_MSDC_CK>,
-				 <&infracfg CLK_INFRA_MSDC_133M_CK>,
-				 <&infracfg CLK_INFRA_MSDC_66M_CK>;
-			clock-names = "source", "hclk", "source_cg", "bus_clk",
-				      "sys_cg";
-			status = "disabled";
-		};
-
-		pcie: pcie@11280000 {
-			compatible = "mediatek,mt7986-pcie",
-				     "mediatek,mt8192-pcie";
-			reg = <0x00 0x11280000 0x00 0x4000>;
-			reg-names = "pcie-mac";
-			ranges = <0x82000000 0x00 0x20000000 0x00
-				  0x20000000 0x00 0x10000000>;
-			device_type = "pci";
-			#address-cells = <3>;
-			#size-cells = <2>;
-			interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
-			bus-range = <0x00 0xff>;
-			clocks = <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
-				 <&infracfg CLK_INFRA_IPCIE_CK>,
-				 <&infracfg CLK_INFRA_IPCIER_CK>,
-				 <&infracfg CLK_INFRA_IPCIEB_CK>;
-			clock-names = "pl_250m", "tl_26m", "peri_26m", "top_133m";
-
-			phys = <&pcie_port PHY_TYPE_PCIE>;
-			phy-names = "pcie-phy";
-
-			#interrupt-cells = <1>;
-			interrupt-map-mask = <0 0 0 0x7>;
-			interrupt-map = <0 0 0 1 &pcie_intc 0>,
-					<0 0 0 2 &pcie_intc 1>,
-					<0 0 0 3 &pcie_intc 2>,
-					<0 0 0 4 &pcie_intc 3>;
-			status = "disabled";
-
-			pcie_intc: interrupt-controller {
-				#address-cells = <0>;
-				#interrupt-cells = <1>;
-				interrupt-controller;
-			};
-		};
-
-		pcie_phy: t-phy {
-			compatible = "mediatek,mt7986-tphy",
-				     "mediatek,generic-tphy-v2";
-			ranges;
-			#address-cells = <2>;
-			#size-cells = <2>;
-			status = "disabled";
-
-			pcie_port: pcie-phy@11c00000 {
-				reg = <0 0x11c00000 0 0x20000>;
-				clocks = <&clk40m>;
-				clock-names = "ref";
-				#phy-cells = <1>;
-			};
-		};
-
-		efuse: efuse@11d00000 {
-			compatible = "mediatek,mt7986-efuse", "mediatek,efuse";
-			reg = <0 0x11d00000 0 0x1000>;
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			thermal_calibration: calib@274 {
-				reg = <0x274 0xc>;
-			};
-		};
-
-		usb_phy: t-phy@11e10000 {
-			compatible = "mediatek,mt7986-tphy",
-				     "mediatek,generic-tphy-v2";
-			ranges = <0 0 0x11e10000 0x1700>;
-			#address-cells = <1>;
-			#size-cells = <1>;
-			status = "disabled";
-
-			u2port0: usb-phy@0 {
-				reg = <0x0 0x700>;
-				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
-					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
-				clock-names = "ref", "da_ref";
-				#phy-cells = <1>;
-			};
-
-			u3port0: usb-phy@700 {
-				reg = <0x700 0x900>;
-				clocks = <&topckgen CLK_TOP_USB3_PHY_SEL>;
-				clock-names = "ref";
-				#phy-cells = <1>;
-			};
-
-			u2port1: usb-phy@1000 {
-				reg = <0x1000 0x700>;
-				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
-					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
-				clock-names = "ref", "da_ref";
-				#phy-cells = <1>;
-			};
-		};
-
-		ethsys: syscon@15000000 {
-			 compatible = "mediatek,mt7986-ethsys",
-				      "syscon";
-			 reg = <0 0x15000000 0 0x1000>;
-			 #clock-cells = <1>;
-			 #reset-cells = <1>;
-		};
-
-		wed0: wed@15010000 {
-			compatible = "mediatek,mt7986-wed",
-				     "syscon";
-			reg = <0 0x15010000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
-			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
-					<&wo_data>, <&wo_boot>;
-			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
-					      "wo-data", "wo-boot";
-			mediatek,wo-ccif = <&wo_ccif0>;
-		};
-
-		wed1: wed@15011000 {
-			compatible = "mediatek,mt7986-wed",
-				     "syscon";
-			reg = <0 0x15011000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
-			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
-					<&wo_data>, <&wo_boot>;
-			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
-					      "wo-data", "wo-boot";
-			mediatek,wo-ccif = <&wo_ccif1>;
-		};
-
-		eth: ethernet@15100000 {
-			compatible = "mediatek,mt7986-eth";
-			reg = <0 0x15100000 0 0x80000>;
-			interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 199 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&ethsys CLK_ETH_FE_EN>,
-				 <&ethsys CLK_ETH_GP2_EN>,
-				 <&ethsys CLK_ETH_GP1_EN>,
-				 <&ethsys CLK_ETH_WOCPU1_EN>,
-				 <&ethsys CLK_ETH_WOCPU0_EN>,
-				 <&sgmiisys0 CLK_SGMII0_TX250M_EN>,
-				 <&sgmiisys0 CLK_SGMII0_RX250M_EN>,
-				 <&sgmiisys0 CLK_SGMII0_CDR_REF>,
-				 <&sgmiisys0 CLK_SGMII0_CDR_FB>,
-				 <&sgmiisys1 CLK_SGMII1_TX250M_EN>,
-				 <&sgmiisys1 CLK_SGMII1_RX250M_EN>,
-				 <&sgmiisys1 CLK_SGMII1_CDR_REF>,
-				 <&sgmiisys1 CLK_SGMII1_CDR_FB>,
-				 <&topckgen CLK_TOP_NETSYS_SEL>,
-				 <&topckgen CLK_TOP_NETSYS_500M_SEL>;
-			clock-names = "fe", "gp2", "gp1", "wocpu1", "wocpu0",
-				      "sgmii_tx250m", "sgmii_rx250m",
-				      "sgmii_cdr_ref", "sgmii_cdr_fb",
-				      "sgmii2_tx250m", "sgmii2_rx250m",
-				      "sgmii2_cdr_ref", "sgmii2_cdr_fb",
-				      "netsys0", "netsys1";
-			assigned-clocks = <&topckgen CLK_TOP_NETSYS_2X_SEL>,
-					  <&topckgen CLK_TOP_SGM_325M_SEL>;
-			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>,
-						 <&apmixedsys CLK_APMIXED_SGMPLL>;
-			#address-cells = <1>;
-			#size-cells = <0>;
-			mediatek,ethsys = <&ethsys>;
-			mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
-			mediatek,wed-pcie = <&wed_pcie>;
-			mediatek,wed = <&wed0>, <&wed1>;
-			status = "disabled";
-		};
-
-		wo_ccif0: syscon@151a5000 {
-			compatible = "mediatek,mt7986-wo-ccif", "syscon";
-			reg = <0 0x151a5000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
-		};
-
-		wo_ccif1: syscon@151ad000 {
-			compatible = "mediatek,mt7986-wo-ccif", "syscon";
-			reg = <0 0x151ad000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
-		};
-
-		wifi: wifi@18000000 {
-			compatible = "mediatek,mt7986-wmac";
-			reg = <0 0x18000000 0 0x1000000>,
-			      <0 0x10003000 0 0x1000>,
-			      <0 0x11d10000 0 0x1000>;
-			resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>;
-			reset-names = "consys";
-			clocks = <&topckgen CLK_TOP_CONN_MCUSYS_SEL>,
-				 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
-			clock-names = "mcu", "ap2conn";
-			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>;
-			memory-region = <&wmcpu_emi>;
-		};
-	};
-
-	thermal-zones {
-		cpu_thermal: cpu-thermal {
-			polling-delay-passive = <1000>;
-			polling-delay = <1000>;
-			thermal-sensors = <&thermal 0>;
-
-			trips {
-				cpu_trip_crit: crit {
-					temperature = <125000>;
-					hysteresis = <2000>;
-					type = "critical";
-				};
-
-				cpu_trip_hot: hot {
-					temperature = <120000>;
-					hysteresis = <2000>;
-					type = "hot";
-				};
-
-				cpu_trip_active_high: active-high {
-					temperature = <115000>;
-					hysteresis = <2000>;
-					type = "active";
-				};
-
-				cpu_trip_active_med: active-med {
-					temperature = <85000>;
-					hysteresis = <2000>;
-					type = "active";
-				};
-
-				cpu_trip_active_low: active-low {
-					temperature = <60000>;
-					hysteresis = <2000>;
-					type = "active";
-				};
-			};
-		};
-	};
-
-	timer {
-		compatible = "arm,armv8-timer";
-		interrupt-parent = <&gic>;
-		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
-	};
-};
--- a/routers/yada-house/kconf-from-device.txt
+++ b/routers/yada-house/kconf-from-device.txt
--- a/routers/yada-house/kconf-from-openwrt.txt
+++ b/routers/yada-house/kconf-from-openwrt.txt
@@ -1,103 +0,0 @@
-ARM="y";
-SYS_HAS_NONCACHED_MEMORY="y";
-POSITION_INDEPENDENT="y";
-ARCH_MEDIATEK="y";
-TEXT_BASE="0x41e00000";
-SYS_MALLOC_F_LEN="0x4000";
-NR_DRAM_BANKS="1";
-ENV_SIZE="0x80000";
-ENV_OFFSET="0x400000";
-DEFAULT_DEVICE_TREE="mt7986a-glinet-gl-mt6000";
-OF_LIBFDT_OVERLAY="y";
-TARGET_MT7986="y";
-SYS_LOAD_ADDR="0x46000000";
-PRE_CON_BUF_ADDR="0x4007EF00";
-DEBUG_UART_BASE="0x11002000";
-DEBUG_UART_CLOCK="40000000";
-DEBUG_UART="y";
-AHCI="y";
-FIT="y";
-AUTOBOOT_KEYED="y";
-AUTOBOOT_MENU_SHOW="y";
-DEFAULT_FDT_FILE="mediatek/mt7986a-glinet-gl-mt6000.dtb";
-LOGLEVEL="7";
-PRE_CONSOLE_BUFFER="y";
-LOG="y";
-BOARD_LATE_INIT="y";
-HUSH_PARSER="y";
-SYS_PROMPT="MT7986> ";
-CMD_CPU="y";
-CMD_LICENSE="y";
-CMD_BOOTMENU="y";
-CMD_ASKENV="y";
-CMD_ERASEENV="y";
-CMD_ENV_FLAGS="y";
-CMD_STRINGS="y";
-CMD_DM="y";
-CMD_GPIO="y";
-CMD_PWM="y";
-CMD_GPT="y";
-CMD_MMC="y";
-CMD_PART="y";
-CMD_USB="y";
-CMD_TFTPSRV="y";
-CMD_RARP="y";
-CMD_CDP="y";
-CMD_SNTP="y";
-CMD_LINK_LOCAL="y";
-CMD_DHCP="y";
-CMD_DNS="y";
-CMD_PING="y";
-CMD_CACHE="y";
-CMD_PSTORE="y";
-CMD_PSTORE_MEM_ADDR="0x42ff0000";
-CMD_UUID="y";
-CMD_HASH="y";
-CMD_SMC="y";
-OF_EMBED="y";
-ENV_OVERWRITE="y";
-ENV_IS_IN_MMC="y";
-SYS_RELOC_GD_ENV_ADDR="y";
-USE_DEFAULT_ENV_FILE="y";
-DEFAULT_ENV_FILE="defenvs/glinet_gl-mt6000_env";
-ENV_VARS_UBOOT_RUNTIME_CONFIG="y";
-VERSION_VARIABLE="y";
-NETCONSOLE="y";
-USE_IPADDR="y";
-IPADDR="192.168.1.1";
-USE_SERVERIP="y";
-SERVERIP="192.168.1.254";
-NET_RANDOM_ETHADDR="y";
-BUTTON="y";
-BUTTON_GPIO="y";
-CLK="y";
-GPIO_HOG="y";
-LED="y";
-LED_BLINK="y";
-LED_GPIO="y";
-SUPPORT_EMMC_BOOT="y";
-MMC_HS200_SUPPORT="y";
-MMC_MTK="y";
-PHY_FIXED="y";
-MEDIATEK_ETH="y";
-PHY="y";
-PHY_MTK_TPHY="y";
-PINCTRL="y";
-PINCONF="y";
-PINCTRL_MT7986="y";
-POWER_DOMAIN="y";
-MTK_POWER_DOMAIN="y";
-DM_REGULATOR="y";
-DM_REGULATOR_FIXED="y";
-DM_REGULATOR_GPIO="y";
-DM_PWM="y";
-PWM_MTK="y";
-RAM="y";
-DM_SERIAL="y";
-SERIAL_RX_BUFFER="y";
-MTK_SERIAL="y";
-USB="y";
-USB_XHCI_HCD="y";
-USB_XHCI_MTK="y";
-USB_STORAGE="y";
-HEXDUMP="y";
--- a/routers/yada-house/mt7986a-glinet-gl-mt6000.dts
+++ b/routers/yada-house/mt7986a-glinet-gl-mt6000.dts
@@ -1,356 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
-
-/dts-v1/;
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/pinctrl/mt65xx.h>
-
-#include "mt7986a.dtsi"
-
-/ {
-	model = "GL.iNet GL-MT6000";
-	compatible = "glinet,gl-mt6000", "mediatek,mt7986a";
-
-	aliases {
-		serial0 = &uart0;
-		label-mac-device = &gmac1;
-		led-boot = &led_blue;
-		led-failsafe = &led_blue;
-		led-running = &led_white;
-		led-upgrade = &led_white;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-		bootargs-append = " root=PARTLABEL=rootfs rootwait";
-	};
-
-	reg_1p8v: regulator-1p8v {
-		compatible = "regulator-fixed";
-		regulator-name = "1.8vd";
-		regulator-min-microvolt = <1800000>;
-		regulator-max-microvolt = <1800000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	reg_3p3v: regulator-3p3v {
-		compatible = "regulator-fixed";
-		regulator-name = "fixed-3.3V";
-		regulator-min-microvolt = <3300000>;
-		regulator-max-microvolt = <3300000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_blue: led-0 {
-			label = "blue:run";
-			gpios = <&pio 38 GPIO_ACTIVE_LOW>;
-		};
-
-		led_white: led-1 {
-			label = "white:system";
-			gpios = <&pio 37 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-	usb_vbus: regulator-usb-vbus {
-		compatible = "regulator-fixed";
-		regulator-name = "usb_vbus";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-		gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
-		enable-active-high;
-		regulator-boot-on;
-	};
-};
-
-&eth {
-	status = "okay";
-
-	gmac0: mac@0 {
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-mode = "2500base-x";
-		nvmem-cells = <&macaddr_factory_a 2>;
-		nvmem-cell-names = "mac-address";
-
-		fixed-link {
-			speed = <2500>;
-			full-duplex;
-			pause;
-		};
-	};
-
-	gmac1: mac@1 {
-		compatible = "mediatek,eth-mac";
-		reg = <1>;
-		nvmem-cells = <&macaddr_factory_a 0>;
-		nvmem-cell-names = "mac-address";
-		phy-mode = "2500base-x";
-		phy-handle = <&phy1>;
-	};
-
-	mdio: mdio-bus {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		phy1: phy@1 {
-			compatible = "ethernet-phy-ieee802.3-c45";
-			reg = <1>;
-			reset-assert-us = <100000>;
-			reset-deassert-us = <100000>;
-			reset-gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-			interrupt-parent = <&pio>;
-			interrupts = <46 IRQ_TYPE_LEVEL_LOW>;
-			realtek,aldps-enable;
-		};
-
-		phy7: ethernet-phy@7 {
-			compatible = "ethernet-phy-ieee802.3-c45";
-			reg = <7>;
-			reset-assert-us = <100000>;
-			reset-deassert-us = <100000>;
-			reset-gpios = <&pio 19 GPIO_ACTIVE_LOW>;
-			interrupt-parent = <&pio>;
-			interrupts = <47 IRQ_TYPE_LEVEL_LOW>;
-			realtek,aldps-enable;
-		};
-
-		switch: switch@1f {
-			compatible = "mediatek,mt7531";
-			reg = <31>;
-			reset-gpios = <&pio 18 GPIO_ACTIVE_HIGH>;
-			interrupt-controller;
-			#interrupt-cells = <1>;
-			interrupt-parent = <&pio>;
-			interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
-
-			ports {
-				#address-cells = <1>;
-				#size-cells = <0>;
-
-				port@0 {
-					reg = <0>;
-					label = "lan2";
-				};
-
-				port@1 {
-					reg = <1>;
-					label = "lan3";
-				};
-
-				port@2 {
-					reg = <2>;
-					label = "lan4";
-				};
-
-				port@3 {
-					reg = <3>;
-					label = "lan5";
-				};
-
-				port@5 {
-					reg = <5>;
-					label = "lan1";
-					phy-handle = <&phy7>;
-					phy-mode = "2500base-x";
-				};
-
-				port@6 {
-					reg = <6>;
-					ethernet = <&gmac0>;
-					phy-mode = "2500base-x";
-
-					fixed-link {
-						speed = <2500>;
-						full-duplex;
-						pause;
-					};
-				};
-			};
-		};
-	};
-};
-
-&pio {
-	wf_2g_5g_pins: wf_2g_5g-pins {
-		mux {
-			function = "wifi";
-			groups = "wf_2g", "wf_5g";
-		};
-		conf {
-			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
-			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
-			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
-			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
-			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
-			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
-			       "WF1_TOP_CLK", "WF1_TOP_DATA";
-			drive-strength = <MTK_DRIVE_4mA>;
-		};
-	};
-
-	mmc0_pins_default: mmc0-pins {
-		mux {
-			function = "emmc";
-			groups = "emmc_51";
-		};
-		conf-cmd-dat {
-			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
-			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
-			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
-			input-enable;
-			drive-strength = <MTK_DRIVE_4mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
-		};
-		conf-clk {
-			pins = "EMMC_CK";
-			drive-strength = <MTK_DRIVE_6mA>;
-			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
-		};
-		conf-ds {
-			pins = "EMMC_DSL";
-			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
-		};
-		conf-rst {
-			pins = "EMMC_RSTB";
-			drive-strength = <MTK_DRIVE_4mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
-		};
-	};
-
-	mmc0_pins_uhs: mmc0-uhs-pins {
-		mux {
-			function = "emmc";
-			groups = "emmc_51";
-		};
-		conf-cmd-dat {
-			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
-			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
-			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
-			input-enable;
-			drive-strength = <MTK_DRIVE_4mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
-		};
-		conf-clk {
-			pins = "EMMC_CK";
-			drive-strength = <MTK_DRIVE_6mA>;
-			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
-		};
-		conf-ds {
-			pins = "EMMC_DSL";
-			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
-		};
-		conf-rst {
-			pins = "EMMC_RSTB";
-			drive-strength = <MTK_DRIVE_4mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
-		};
-	};
-};
-
-&crypto {
-	status = "okay";
-};
-
-&ssusb {
-	vusb33-supply = <&reg_3p3v>;
-	vbus-supply = <&usb_vbus>;
-	status = "okay";
-};
-
-&trng {
-	status = "okay";
-};
-
-&uart0 {
-	status = "okay";
-};
-
-&usb_phy {
-	status = "okay";
-};
-
-&watchdog {
-	status = "okay";
-};
-
-&wifi {
-	nvmem-cells = <&eeprom_factory_0>;
-	nvmem-cell-names = "eeprom";
-	pinctrl-names = "default";
-	pinctrl-0 = <&wf_2g_5g_pins>;
-	status = "okay";
-};
-
-&mmc0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
-	pinctrl-names = "default", "state_uhs";
-	pinctrl-0 = <&mmc0_pins_default>;
-	pinctrl-1 = <&mmc0_pins_uhs>;
-	bus-width = <8>;
-	max-frequency = <200000000>;
-	cap-mmc-highspeed;
-	mmc-hs200-1_8v;
-	mmc-hs400-1_8v;
-	hs400-ds-delay = <0x14014>;
-	vmmc-supply = <&reg_3p3v>;
-	vqmmc-supply = <&reg_1p8v>;
-	non-removable;
-	no-sd;
-	no-sdio;
-	status = "okay";
-
-	card@0 {
-		compatible = "mmc-card";
-		reg = <0>;
-
-		block {
-			compatible = "block-device";
-			partitions {
-				block-partition-env {
-					partname = "u-boot-env";
-
-					nvmem-layout {
-						compatible = "u-boot,env";
-					};
-				};
-
-				block-partition-factory {
-					partname = "factory";
-
-					nvmem-layout {
-						compatible = "fixed-layout";
-						#address-cells = <1>;
-						#size-cells = <1>;
-
-						eeprom_factory_0: eeprom@0 {
-							reg = <0x0 0x1000>;
-						};
-
-						macaddr_factory_a: macaddr@a {
-							compatible = "mac-base";
-							reg = <0xa 0x6>;
-							#nvmem-cell-cells = <1>;
-						};
-					};
-				};
-			};
-		};
-	};
-};
--- a/shell.nix
+++ b/shell.nix
@@ -10,7 +10,6 @@
        devshell = {
          packages = [
            inputs.clan-core.packages.${system}.clan-cli
-            inputs.clan-core.packages.${system}.generate-test-vars
          ];
        };
      };
--- a/sops/machines/ramus/key.json
+++ b/sops/machines/ramus/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+    "type": "age"
+  }
+]
--- a/sops/machines/sirius/key.json
+++ b/sops/machines/sirius/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age16aerzyy7adcymezr4ewql3y7chq8wuvjpzsxm5um0u9jvvtdncnqmtsw05",
+    "type": "age"
+  }
+]
--- a/sops/secrets/ramus-age.key/groups/admins
+++ b/sops/secrets/ramus-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/ramus-age.key/secret
+++ b/sops/secrets/ramus-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:lc5PP4xpLq/JXq2LkG/5zkEY5luxKC7EZHx0s6exiwd+UtuGb5rjIOq0kUBFuJWYFWduqcvNS62kR76oQpRfmjIkq2t02NxZ1lA=,iv:eZsHK9u5Rvt886Elz7Vm+PMD8urm1UyoNbNNwnlJtj8=,tag:inCrDdsNmLb+L+LpF9k4Ag==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0STRlY1h1NTVUdDJRM1NO\nc1hacUg4TUtlK3Y0dVZqaE5LdUlqMkFKNmtVCllTYXFHdXM0NVdUejhHZWM1TnVx\nUURvd1JrQmR2K0N3RlZIS2d0RFhTRUEKLS0tIFp1ZlJSNmd2V3dpN05LYWh1VHNC\nbFNkdkY1aUhTZmM1R1FKUWlGWThSdE0KYxgpuknCD07awfN85PkaJjPohYyqT1wL\nbjUcGo6TmFQKIgEzTzNj+in1dm9wz0AnYl1teiHa9WjK/Udd2BANBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCd2Z1aTFYenowSnczWk05\nVEZ3d0FUNFNkV3RlWlpFWk5jd3QwazVES0ZVClVjY0Y2eW1hSGEraVVpSjdoaHMr\naS9lWFUvbFl6Nzd4U2l6dUhXRHBlT0kKLS0tIFNCYTlSL1VnNURBQUxoYVozODZw\nVVRkVGVINTV6SXExN3dCT1JmRmNFdlkK+jNS9cUz4TzBBzrtxuYcoiEmxKcRNTlt\nqksdFqnPWzKI+edJSWq3rkBYeuI7c4wmxTtsgVtHbv2jwbD1kJar1g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGNxVDh0SWNL\nOUt4TG93eGVjaUxzczhnVjNYRlB1Vy9haWxjYnN6aGI3ejQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpxSEtwcUxGcVY3RzNjR2REYmdrRWV6\nYWJyTjhXMVNtVFVpczRDc2dDaHRBCi0tLSA3NUVyR3YvMnVsd0l0TXIxQS9odUZO\nZnJWV0MvRlpwU3luNm9FOGtDNkhzCm/yGJJvQf5qvBRyGLrmCeiI31qHr+JoZ2Av\nbqMUeg3Vv82ffTLT6GX+JjiG0wQFcYAX3/k0noVN9JMR/boiWIc=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGpMZ3JmMVFy\nU3AzeEFFa3B2TGxSL1NlQjhSa28waGtLQUlFTkp4N0hVeEEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpYVDJSdCtnVHIzVXhSQ0lXRzE5dlJo\nS1NHa2F1WEpJK2xJQUQwa0RNNCs4Ci0tLSBBdmpiZGVSOWJwanRiUjUxT3JMT0VT\nM2k5bE0zOW5SVWg2ZGw0QUVvcWVrCrc2TjHS6Pp38MTPU9H59q2seVYlESH80V4+\ny1/qjB6fK8lnnyi5TLrSo+M9MAcG5T4EGvCcAPuzjTvF/DO7hxk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9jZllPWWhO\nV3pDa1MxSzF2ejRJMXJBWDlNMzZqcG1JdVB2Y0xjMlJKeGsgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpwSUdWWlFFbW55aXVkZ0pSeUVPRkF2\nTm5tTnkrTGNmcEdoWE1UckwvcXFBCi0tLSBnN1J1VlQvVnRXbkEvOWtLbHhzVzNN\nU01XVkpRNnd4bCtYb3poNjR4bno4CirmDl+6Kebk0jMjgRp00d8kpkzGtQFsZNht\nm5MPBM+FXVzpDcEWQGUlLr50yDKYVzHdIeeuGsWZ3KaI1GM8pdg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOEQrR1Z1K3RETGgzVi9H\nNXIzUW04UHFCMk5vQVZEN0taRWJwV040Q3h3CmpaVWV0WDZNemFSTHF1TTF4YXI3\nL1loMnA5OUNCbE55aGUyR2EwbklaczQKLS0tIEpnTkkzNStsNmdNS01HWDhXY2s1\nZ3hMNXA1dXUxVmxucTdtbWN4akQ2MTgKAolaT+61/BN/yzljENx7YZTrFRGA8zwN\nsquQs9vnFS8yduVMoaemXrCLTpiQ1KGCAWVX8pPtY8+GV9YKLZsV7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtTlNuQXN3VU9TVTlQd01N\nYVBpN1BxcjRLYWN5SUg3TlhUbHl0UzkrOWcwClZ5OHpOcGp6V2craFBkWCtwcktp\nWDZYYWR4ZjVhaVNPdEN4WmZ0UlJqR3cKLS0tIEx2WXdQL0x1Zm5rRnJGMmJQWFVW\nNW1nMFlac2lyY1ZuOW9OZmNWSjJxbTAK72xqJBlpV3UWAFhGlUjudEILQSnGDhQm\nS4U51sUc8rrUZLlmAivWg1nxCUAdrhLo/r9OuITR6QX9DeFsaeR9uA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6WmVUUDJ0V2sxS0Q1UFZv\nWldFK0tRSlViUkc5aXFTV0JDdDFVbVVXR1QwClUwLzg0eTAvbUtaTVRFV3ptZkJQ\naDR1REl6MXZ2cDlsZzk1SVI1N3pocGcKLS0tIFlUbGFPUXAxWVBvNXhjZ2QzWGNh\nWTkrMklIQnl2T3ZYL0Q1c3JOTU85bkUKL4h+PDQSnVbls8iuioUHTBVpVh5Yhhx5\nrK9ELFCYGPAVzbx5cFoOapnIJcTQUAPZdBpmlm7kgRmMLXptMdGkGg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZ3lPeVJyZUF3cVEvWnhH\nbVBwRmxaQUhaaExQSVRyeVJNZVFSRkFrU25NCkZDcklIcU5TQWplQkE1ZkFTUXB5\nLzZ0VFlEdks3OWpGM0JMSi9ZOVNndnMKLS0tIG11UFZkdWRYdHZJNk9TSDYvaHcw\nQUk1dGxIOFhwaXJZaEZNdVppWWlpdUUKQJ/UjgWIaeKa4o2El4cFkwv+O0bi9SOp\n13XExCNLB+BtwOGPREWbrmW/Z15c8koBEyrW7iuIhu0Pgz95oAF2Sw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:15Z",
+		"mac": "ENC[AES256_GCM,data:ovjPl0pJ6DSJGjGz+Zt5GLbwu3ZTMwOKNSsYxIx1NcjWAiGYpPNFcFrD5OBciVQ2K7VxlRoWW5WqbJt7mrvQXDO69LxvQqiK1+qHeFJOHRd6Sp29fRA1aqEz+kOif0SSzaEkHOXAp1kzk31CnEfIG2j5yQ3oMyrSqNnhnVrx6F4=,iv:NdeCrqNo5SV1Npu8aqPJcZDhPMGfUviyBQi2CUjYZOM=,tag:yM6P7P2vLUMs9GdT284Gvg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/ramus-age.key/users/kurogeek
+++ b/sops/secrets/ramus-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/sops/secrets/sirius-age.key/groups/admins
+++ b/sops/secrets/sirius-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/sirius-age.key/secret
+++ b/sops/secrets/sirius-age.key/secret
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:nb/jvXhD1eQqAWDgmfLlLvuzNbftonrkwrpGNBvbxTKIy0nhB84o03LIgBZbtCDR2q0MkyKe4w4FzY9WvCJCteCoGsuOSkBa86o=,iv:+mBkcXbZxglL2NfzSWUROZacNuvIZfMFmJec82zhf7U=,tag:gtjTQ4CztEqDUbCxEpo7fw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIMW9qRGl4N1NVTlRubmR1\nUXRlQ2NqR1NZaEhGanF2Vk9uZWQvcG5qMTJFCm14ZDFxRWJpakNHTmxsTXBiN1JI\na1FiOU9rR1Vrb3NzbURQcTJVb1h4YU0KLS0tIEV0OS9vQlhsMVMwUmJHcXZITDYw\nUzZWbG1iTzk3LzB6V1Z4YzFYOWpkT0EKiQINdNMEuGIIzY50seuRcwb2s3TdgELP\nYkIJ5GBseK3Q3nVvIyNhuU0bCaVSFnxuTazeygMAKjhW22y2/ui4Wg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONU9hUkRIT3Q0TnNGcC9v\nTVM5YWtyMjYvL29ZTDFqRzlYU2FUTXkvUjBvClNXdk93K2t0L0wvdDgvT2lTTTVX\nRDUwYkc3aGwvT2xFcmZlNXRtdFdZOUEKLS0tIGIwc3FpRXdNQlpQTnhVM1M4YS91\nZXYyL08wa3EvWlB1MDdWVWVORUIyTFEKP2w2cG4d/AE7XrbcscaEIVJ6XQG9FXHY\nNKgBjpGZONp8dEYeuJ23nel5AO3+sm0EN/DsuqoWo2dJCHp4ZXkl7Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFV0S2pYYTFi\nc0IyVXZwMUliQWVwdjZnQmNwSjJTd0dRMisxVmsyM0ZpV2cgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpaeW1RNzhmbjNkNFFZN2FqRnRZc2tS\nZWRlQ0hPZlBsLy9ocFFFY2tiYmtBCi0tLSBFQVNQRzhQblJXSmQyUUYxOEw3UjNV\ncG41b3h0MjhaYXU4SlpQZE5YLy9zCmKxo/IAczzcmAnYhYh29gS88lQEVgoNWMGt\noqldqIgarW2yKSqlbnJYRg60yohiYNn34aHKlNVNPhm7NhfZ6y8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRVZmluZ0JN\ndnRvSFZZeWR1aytjT3oveUdZTTRDZnhOaG51Ym1QditvVTAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpGNi9YaDJWR25rYm1YSnF1bXp1enRU\nQWMvaGlwSEY1L0FLeGN5MjdzS2RJCi0tLSBEOStqZzVZTmQyR3dOZWpoazcwaXFo\nU1RCU29LRHNUaVl6dWd0YTlFaVNJCn7iNwdtKkrQC3e8JzWP1vrt1uMtaYI1FmZC\n/Tug0VKBcShMjmi0MaM2jA6Bo2rHmxQPZTVa4x4myjB1ZwehmQk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGwxK0E2K1Zu\nZHo4ZlQwejVoaXRWUEZ0MGxteURmcGIzdjZjNVFsZVFQMDAgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo5MG02bWxaSmttREozSTNKODk4ZDhS\nZGxtcXhmQnV3YlgybG1MUVRUSUUwCi0tLSBQdUloWE8yMFpQN0NTYWg5cWQ1UzRZ\nYi9VYklCNGlTb2JIUUxPaXJZWGxRCi64TvD9BnC41+HbBI1lIqG8uAr8UnDMvuUy\nEHPAIcvPWbO2WahxEUcL4hBcK81pa3XaQOWo/qRbAHv5fKIA26w=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2b09RdU5jcGRBRHBJREhy\nOU04MTVwZm5TNVUrVmNTUkVtUUJFWGd2aGpRCnBYQ1Y2SnJBbHhaNHJxOFVHM0dC\nZzMyUndHM1M4bTFsOStna3JXM1lVaVEKLS0tIFdnNG9WdzB6cUoxdmV2aTBhVDIr\naDRFQ3JsWlUvNTRRdHNpWVkyb0xWYWMKXSnCes/5K8Qw1WHbxPhL63G+yKtwxnhn\n9fXqnemlQJoscBy1mrpxXYXM6mFl4tnEAh1hB00z+n1AFZS91EwRxg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSGRHbHhyVGE0NEFLbFpn\nM2E3WndLT1oxSVZnOHRiNzVMaFlpL3VhY1ZRCkhyTFdqQk1LM05HZFQrOFd4Y08y\neVgvUk1lZ3dqRzh5OTFLajNlUk9hNXcKLS0tIGdMSlRHcEw1Y2ZFQ1JyTHZ1NFcz\nMzJXNEtaWEswSWdCZ3BLYVVja01DbUUKr/n9DLCjKBYac2+dAk96Snx78qeQAxwN\nnGJf9z3i5NRtN3Kapbrt2vPN7c590YiSTgYdiEEb3oq89g5Ya3hNnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBURi9aRE9jSWI5OFhYRGkv\ndDBIWng5Z2hFWllXdzdkY3NlbWtLMkppc1hZCndTSW9nTFlITzY2aHcwY3dLcTNT\naTlwb1E0c2p3dFcyUzhOcFlLdTdPNDQKLS0tIGx4ZWREalkzNXpIMTFmR3l0cXkx\nRXFnT2JEYWs4VHd6VUtPbXlGSURUTUEKgEkcgDhB/OdJrAfJ5hZohZ0OU4VNXraZ\nvIz5inx8I+/6r46qMoJat3BIcN5IRllHc/iMBPRq+n7EPtaceEZBhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPRERSVWlnT1lQMDZGcTQv\nV2MyZ1F5MGN2WE01ZVhoNTdHMnZROWRpMmhvCm9UQ1pzRjNpdS8wRklTUnV2MlR5\ndzNFVy9SM2hCR0J5d3JkbEVTOFp6OE0KLS0tIGNqNVZtV0dZQ3ZpU0lmK2JsMzNY\nZkMwVWZYN2MrZUtVN0dacjBXSDhZYjQKbtg1xpYwEfH6hArFQ5w7UBja00sYnDte\nQLE6FksPXv6RPxICQ2+bdhEh/QwmGYDAX+8HnYx5GNs54iUnnj3nDg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-10T05:07:06Z",
+		"mac": "ENC[AES256_GCM,data:WLgG9s2UEZ5pySqjGWHVGCeeKI4dZbSoUuBNzqw/D1c4XtK5RS4Dy0iKSDziI+GcIXyfmG4DhxXuUdNLffAKSb8pSu6nvhlAlX+q7fM18GmAXkD/TwrIr7AUvjWXZicIcLvlZ5mEkkj6lrWe+IyA8xJBcFjLji6lwNewBz3PoeM=,iv:PkKt8d732tY289IjCEprlgnUvC3Vt9/1GYSYjlSlLi8=,tag:RZecNrF9NHuwxZbCGUSllA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/sirius-age.key/users/kurogeek
+++ b/sops/secrets/sirius-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/tests/default.nix
+++ b/tests/default.nix
@@ -0,0 +1,16 @@
+{ self, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      checks =
+        let
+          checkArgs = {
+            inherit pkgs self;
+          };
+        in
+        {
+          think-gtcm = import ./tests/think-gtcm.nix checkArgs;
+        };
+    };
+}
--- a/tests/lib.nix
+++ b/tests/lib.nix
@@ -0,0 +1,18 @@
+test:
+# These arguments are provided by `flake.nix` on import, see checkArgs
+{ pkgs, self }:
+let
+  inherit (pkgs) lib;
+  # this imports the nixos library that contains our testing framework
+  nixos-lib = import (pkgs.path + "/nixos/lib") { };
+in
+(nixos-lib.runTest {
+  hostPkgs = pkgs;
+  # This speeds up the evaluation by skipping evaluating documentation (optional)
+  defaults.documentation.enable = lib.mkDefault false;
+  # This makes `self` available in the NixOS configuration of our virtual machines.
+  # This is useful for referencing modules or packages from your own flake
+  # as well as importing from other flakes.
+  node.specialArgs = { inherit self; };
+  imports = [ test ];
+}).config.result
--- a/tests/tests/think-gtcm.nix
+++ b/tests/tests/think-gtcm.nix
@@ -0,0 +1,102 @@
+(import ../lib.nix) {
+  name = "think-gtcm";
+  nodes =
+    let
+      settings = {
+
+        DB_CONNECTION = "mysql";
+        DB_HOST = "localhost";
+        DB_PORT = 3306;
+        DB_DATABASE = "thinkgtcm";
+        DB_USERNAME = "gtcm";
+        DB_PASSWORD = "";
+
+        APP_NAME = "Laravel";
+        APP_ENV = "local";
+        APP_DEBUG = "false";
+        APP_URL = "http://localhost";
+
+        LOG_CHANNEL = "stack";
+        LOG_LEVEL = "debug";
+
+        BROADCAST_DRIVER = "log";
+        CACHE_DRIVER = "file";
+        FILESYSTEM_DISK = "local";
+        QUEUE_CONNECTION = "sync";
+        SESSION_DRIVER = "file";
+        SESSION_LIFETIME = "120";
+
+        MEMCACHED_HOST = "127.0.0.1";
+
+        REDIS_HOST = "127.0.0.1";
+        REDIS_PASSWORD = "null";
+        REDIS_PORT = "6379";
+
+        MAIL_MAILER = "smtp";
+        MAIL_HOST = "mailpit";
+        MAIL_PORT = "1025";
+        MAIL_USERNAME = "null";
+        MAIL_PASSWORD = "null";
+        MAIL_ENCRYPTION = "null";
+        MAIL_FROM_ADDRESS = "hello@example.com";
+
+        AWS_DEFAULT_REGION = "us-east-1";
+        AWS_USE_PATH_STYLE_ENDPOINT = "false";
+
+        PUSHER_PORT = 443;
+        PUSHER_SCHEME = "https";
+        PUSHER_APP_CLUSTER = "mt1";
+
+        UPLOAD_MAX_FILESIZE = "5000M";
+        POST_MAX_SIZE = "5000M";
+
+        TEST_LOCAL = "false";
+      };
+    in
+    {
+      gtcm1 =
+        { self, ... }:
+        {
+          nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+          imports = [ self.nixosModules.think-gtcm ];
+          services.think-greaterchiangmai = {
+            enable = true;
+            settings = settings // {
+              APP_SERVICES_CACHE = "/run/think-gtcm/cache/services.php";
+              APP_PACKAGES_CACHE = "/run/think-gtcm/cache/packages.php";
+              APP_CONFIG_CACHE = "/run/think-gtcm/cache/config.php";
+              APP_ROUTES_CACHE = "/run/think-gtcm/cache/routes-v7.php";
+              APP_EVENTS_CACHE = "/run/think-gtcm/cache/events.php";
+            };
+          };
+        };
+      backend1 =
+        { self, ... }:
+        {
+          nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+          imports = [ self.nixosModules.think-backend-gtcm ];
+          services.think-backend-greaterchiangmai = {
+            enable = true;
+            settings = settings // {
+              APP_SERVICES_CACHE = "/run/think-backend-gtcm/cache/services.php";
+              APP_PACKAGES_CACHE = "/run/think-backend-gtcm/cache/packages.php";
+              APP_CONFIG_CACHE = "/run/think-backend-gtcm/cache/config.php";
+              APP_ROUTES_CACHE = "/run/think-backend-gtcm/cache/routes-v7.php";
+              APP_EVENTS_CACHE = "/run/think-backend-gtcm/cache/events.php";
+            };
+          };
+        };
+    };
+  # This is the test code that will check if our service is running correctly:
+  testScript = ''
+    start_all()
+
+    gtcm1.wait_for_unit("phpfpm-think-gtcm")
+    gtcm1.wait_for_open_port(80)
+    output = gtcm1.succeed("curl localhost")
+
+    backend1.wait_for_unit("phpfpm-think-backend-gtcm")
+    backend1.wait_for_open_port(80)
+    output = backend1.succeed("curl localhost")
+  '';
+}
--- a/vars/per-machine/b4l/state-version/version/value
+++ b/vars/per-machine/b4l/state-version/version/value
@@ -0,0 +1 @@
+25.11
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:ada9:8363:202b:faf:be:92ab:e46d
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:NSyWVWXMxoTR07uaLUYX6rHB17wsIB53FZHSsPxgDKJQ2wHBPFNaHSYh+BiSo+IrX+YcdUUqJFhEkjWDyG+vXaNZHrMbg/pzZ/cwTK/lPbYISkwtOhgr3zCA0H6DmQcHVmvR6fsdRDkFwl7pHtn1RMjEORQdbBINtscZfzZFcAF2L1t+WPFxgRKQDNT/9l3f4SoBcuakyg==,iv:/5JbEZ/vj/4I+eEElOY0cnhiYzqqPw2ZKLv2M/xkstw=,tag:23exDL72g56bP7ZbMsK4mA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTYUFSZGpmd2tmdzB6bkp5\naytPd1RhVWFqeXF3SDZia3QzUmRNNGpzcjBFCnl3VElLdXFvV0tFSEFlV3hRMzFH\nbnBnWVZ2QkRHZ1BoTEZxdFg4QWE4ckkKLS0tIHhSMlBKakxmM0xyeUphKytLTmpk\nVW90V05hTUEyTVNMQzZHN2xhYTBZRGcK/nJOIM4m56TE7KKmn/QH89g053mmuKKG\nQYs/86SWdLPqwL35FstQg2xDIHSxkDcoMSGc+C+/xdOjWV3qLil/DQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaU9idi9RZzhNeXhTb0pp\nUkZ3UVpsZlBka2kvZDBqcVhiRVdMNVFZbEJNCkhvdmFaVTBGcVAvalJPSlFuZHhi\nTE9qeTBMMjk2djhFUEdJbWZmTnN3WnMKLS0tIDludThMRDFDUHhCZVV3bUtVdVBZ\neGg4TzdqVjJPeUxYbnBWNURRSWRrMkEKBCACDZgHG5eVKcSdjHDITJZqgR7cHdHq\n9y8qS3YjaFZ37Ui6Lmb9vJEzDCEy3wEupBy4sbAX4okVapGPJ4fmwg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHJtSTZrY29X\nVTZNQm9XS3JsbEZCNDFUR1gxZXpObDdKRmQzUnRZMytOaFEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpYN2xlOFVDZFlEOHhTMGZTVDNjdjdU\ndWlqd2ROamdmelp4UjAyVitnYVQwCi0tLSBZWmVWc2J4YVhLN3VyMTQwamtYRW5K\nWVovUEp3YlN5WjA1VE10MElWMllvCiLrLLekRkmSL5ekLIcFMoqgeEPXSrn15JDd\neKT9sbYtwhB7vt2L57fDRfaF/+7wNb9y6cv2oi+EdDoDXp/EyB4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxiRWYyUmwv\nVjlEdS9LOVV2K1NwdDFhYWM5RS9LcTZFNkNaMWViMkl5bmMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpUQkk4NGZPVWRTbG5MNk9CTStSUXFi\nbXlGemlJR2o2dTB6QUE2Q2JKSnE4Ci0tLSBzZjRva2NtNHlRamNvQWpoZW1UWFMr\nQVdNYXBpOFVhaEVxWm1KNFM4UHJvCnebMj6d/+e0vp00Gb02qJtUp2+mEpF/jUpD\n25cxeoSAWPAhfnBgE+oLzQqnQSq5dCxsWteE/1eOXC68koeT9FY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9udm9sRDBJ\nNFM4dFA2ZDdJMlBXeXYvakM5RHVzNlcrRitzUHF6dnBvMVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpKZnBka3YzK0tUQ1hXTHVheE45Mzkw\ncE04aVVPQWM1eURmb1JaNlBwVlFFCi0tLSBHTlY4UW5FQXExK2cvMUJDZE9NaURy\nOFUxN0dvczJtWlVRc29QWlZ1bGg0CvUoAmTgDVSF7SPpqnkFhkCUn3N/Yr4Tzodw\nyCiD7U/KYFavEIxGIeg+ClhLF9o4fYq9kk8ld0vU8qUADXBdRDE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTUEyUndkSk1iQTB3eUpp\nb0ljaXpwdi9QYmdNV1J3L0NhWElRVzlnNTFVCnZ6Q01ESWRNMHRxdWZKM0lYTXBX\ncko5VitPdWk0UHpwWDhGNzFVZk4yYzgKLS0tIGVRdG5rWkYwOFlCQWNIWFBRalVE\nMmFtOHBvbUw5YXAvMG93MjBrRjdmMGMKlopySr6HS6vfFHiRcwlJz/qy7jzyS1Nf\nw4lw7QnOrvOkoutiK3HiIia5N6V0jd0TV7nJqIu7tz/zYksbzps7QQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVTZNTUM5UXowWTlPRDFW\nVUJTbStFcldHbTVDUVRJYjNiaklWRmowTHdnCkJNbUtmdk1jS3kyaVNWVFlOTytX\nKzBwTmxoZi9NdmJuRFNMNTUyRThNUDQKLS0tIENSMHZ5TGwxQ0xuZkZFQ3RJdGEv\nSXIvYW9WY243cTdzZEtra292K0JFVlEKMWhG/7R00uqLb5l5lU3p9Vt4pre6J85r\nIFWtg1G/54KaFt8aiWcD5RUSSARGZ3r4qVtO+9eWP+gA4DUpSNkWNw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WVlWMHJNbERKUGx0elgx\nUEF1Sms4VCtNRVRraWdvUkFEaTRzYTJ0TTFZCnl0aTIxR1QyQ1VsU0RFNnN1NzBr\neTVQbHJHQjAvYklFVkZkUDRXRGxvSkEKLS0tIHdINHFyQVE2V1V1R1ZxWEFuMm5x\nUVRjSVp6NStGSkQyQ05JVHlXejBEbWsKBlMvtw9MCReN1eSHKMwwsWaEF8kq1Pns\nLNSYEeWABZ5bbPB1xBvmIIlVFThJqgy5mBVJLzQMUwqb0IvixAgFxQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaSmNiVWlRSy91Mm5qSWJ5\nd2Z4WnEydE9ncWwzUVVCMDVoek1wRTFyOFJjCkZjOVZrVHY5d3FKRmMvaXJQWUtU\neGpSZkZITkJaOERkdWZpelA5dTJQOEkKLS0tIEtZOUNJSytYTFpSTWNuY3JjcnJv\nbFZpTXQxc29Pd1FIN0xrcEJYc3ZlV0kKyO/PLn2WNdVtTqM8cG1XFqV/5YdSqPAY\nvroStGVsLliV7W4T2MAmACeyjoMde9/gVosKfGc6awE+Bi2BUxrqpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T07:22:09Z",
+		"mac": "ENC[AES256_GCM,data:OxeLto6aeiTOX8OffRsQzxyluSdva7y3j4j67c+MI1ost+QCZyGAW/5pr2mMaoU2XrwYqUjZTKBhJ9p1FY6C29/EhyzrNhGUTjC5iTcXO1lbLUTgoSDN8KPmVea97sTa+easVHoSgnPLxisG2yCALv95k9/eQ7vF9FRjBBNTaIU=,iv:FQeojhtnKOlqWuQNJo1TmI/PhjYbgwtvK24gZMjbbpM=,tag:Vwum5bSSZRNNDQ3Yudw4hQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/greaterchiangmai-s3/access_key_id/value
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/access_key_id/value
@@ -0,0 +1 @@
+OR2B5S75FZ59MD19SRR0
--- a/vars/per-machine/ramus/greaterchiangmai-s3/bucket/value
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/bucket/value
@@ -0,0 +1 @@
+greaterchiangmai
--- a/vars/per-machine/ramus/greaterchiangmai-s3/endpoint/value
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/endpoint/value
@@ -0,0 +1 @@
+fsn1.your-objectstorage.com
--- a/vars/per-machine/ramus/greaterchiangmai-s3/region/value
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/region/value
@@ -0,0 +1 @@
+fsn1
--- a/vars/per-machine/ramus/greaterchiangmai-s3/secret_access_key/groups/admins
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/secret_access_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/greaterchiangmai-s3/secret_access_key/machines/ramus
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/secret_access_key/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/greaterchiangmai-s3/secret_access_key/secret
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/secret_access_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:S1TJMu2gZ7hYElZJls8de+apoI+uRPgYjCvN2VDZFX6iCp7WovmJcA==,iv:h4MzIeuoxnn8HTGyr30YoApGLW7UBYCO7sCvMKq7DiY=,tag:J0feK8Mf57vQgaIaJN4ccQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dFVYa1lBNXAzTURmb2pU\nRmhQZ2JjcllyZkQvR3EzVXFUNllsZDRSQlI0CnhDbFVmU2Z3Nm1vOW1MSFRpNFNR\nOHFUYmVyT3k4eExKZktjMDQxZXMwWUEKLS0tIHVud3hOeFdhRzJPQnNRYVNER0M2\neW1Oa1ZCMzg5dTJOY042VTlrS1cwUzQKri7DRDV8MDkmpQ6ji6q6d+3XvcLlzqGW\nYWuQTXctNtgkAbNvJXaR5MIl6Y7yR6L2T38IPQfqups+miT9jxmDBw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEV1lpeFAzZjVmNGYxWEps\nWDBScUZCRVVyWlRwZzFvRWhvaU9XRGs3aGd3Cmc3V3NrbjZrL3Vzclpubkp4cUZi\nT0k3ODk0VXpoN3dJRHRsYUFPQU1IQ28KLS0tICtqT3E2WFpUQUpYVFJ3UFBscjVj\nM1UzQTNNcDJ5akloNWduZEROaEo0MUkKkXa5n45LJnwcC4+ww9XdYvHZHNDw1R9W\npYzwhAz+lNt5BAagxgPXyqjk1Z3tUrCDsAq+heeoYiX3UddPTmAY3g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhNmhNaHRlWEErbW8zQjJu\nTE1SVFAxMGhvU1ZlU2hHck9RaFVCTnIvdkNrClFEMk5wU1JjNW1oZjZCU0dXeXc4\nNHJkOHJGWFIyWGhYN1NzeDRIMHp4ZWsKLS0tIGNwOGp4ZTJiWHVjdG9ma2tXSGwx\nTUdCZFhhdzRibWdtSXg0RVZ0SkMzYXcK48wgvcKMHljIqYQp7RpkJDg9Rl4csJS9\n/fW3j3Ie6EipdlJqtvS1+LdtYZSBuJm7zORiuol/iGlXMCEvfw1Jog==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNqYkVDaXNC\ndXlGNGlIT0h4STVYeldhSzVuVmpZMjMvOUNqYnZrc3lJRDAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpadUxyK1A1d3dQUXRPS2x4U3l4SlpB\nT2s0TklUd2ZVZnB4U2ZQWWtVTS9NCi0tLSBQSGU4Q3docmRsU2RFaXh4NkFDRGta\najNud3hBd2ttNm5ZWVl2WlE4eUhVCttjnItGsd5GHFDDPL2ItUNoKbOkjdnE7OKA\nUArOm9TjFvUScNml5eoXnQ2mAZjJYnGxdxg+gWQX29ZnWQtMf4g=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGJMdmZPSkMy\nV2d1K3NsOEhMZG5DbnRQVzhuNlFqL0RwVldMVXo5ZVlEQ2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpVbzhtWWYyVkVKMU8yU2l4Qmd2S0Fo\neHNTQ0RBSGZCY0x0TnVsQTliMlJzCi0tLSBrM2h3K00zRDBoVXZmcWdacEpKRVlG\ncU85UVUzT3V2a2JySmMvZ2hsMVQ0Cuftyp9Ufwnu/ukn+FtpneEDkGL+t/p8nyk7\nbQeAgazV1ugIQkTabP29CLiIbxz9DWdqwbBh+/kO0EvX6Z1kyZ0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDJiMk53aVND\nTVc1eWJTQ0g0VlVvQ2RSM01NTlp5eGJMcWR5Ym1Zdzc5Z3cgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpDQlJ3UnRnZG9ueDRXTlY1RTZ6VWRV\ndXg0YnBQT0VMQlJDbW4zeUVFcFhRCi0tLSBvMUw0WXRwRzJMT3lIVEkzMVl3RzBO\nd0pqdmdTVWpqTnd1a0JnT2RFaHZnClM3hxods/5D8p/URVeUBaQWzfJk83LNbfC0\nw0J1xYwjS/eLpcM8mLl/iis0xvrpNyGhh4iHS9U0xraio+37KJA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBseUlWZjdnWGFsNUdRR0xx\ncm5XSi9zRDk4ck8zNWxwT3R0MjRxY0dNUFFNCm5NSXV4LzVEaGU0VTBBek9WaXBR\nangxU0xoY1RIaXhiM3ZEZ0lVMUR0UzgKLS0tIE1RMGtlamhkbFYzbGl0Rjc5VXQv\nTkRmVDR4aUl4SVpSMWxjaGNKK1NXaEkKtbiv7giW8dhpjluM3JBWFYZJn2TqEQNY\nCgHXR7o4qaG67UmGpUTqxxNIpWBtI5JFiqoy2wIdOolQZ70qxfQ7Yg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwekdoekt3akovTVZVVzV5\nQ3lNU05ET2dmUmRsb0dhSXlXemhPVCtGbVRRCndUWnRyVytPdzRMOVhjZzZiSlNw\nU1pLZmZhMDZGVVFhL3NJMTZjVTc1V2sKLS0tIEdtaHIra0ttdEJzUS9oTkQ4alNK\nUjRwZUdneDBSd2I5eTdSaE9TaGxla0kKk8PiulG3FCWt3YDRBB4Z5ORQF2qWnpuL\nsq5wtcFl8UpJj2/2ODLdH3mzYxc4jAg47LS4R3ThgJlhrsmr2vgAeQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMa2UrOEkrbWNseEJKNEVt\nZ0dFREhTbC9ta1V3bEZDT2tJZ2x4TlVpbFhJClBJUmJJVmZxSkdsakJsMG8zNUVW\nMEdCR1YyMWtqL25zRjd4VDlIdi9DaXcKLS0tIGpBc1FxMWlDMklIeGNUSDhDYkd5\nZXduYXVkaUg5SjhCb21QaUhEK1JyMTgK40uiFSmA/D1e5XomI+H8/RjrcDS+ovK+\nYf8q1xOzNy1Mpmwke4p4Q4M30CNeutw6Ga1w2saC1oi7et+q59R+RQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VTVwejViQmowSW5YdlMv\nc2NHUEdLbmhoNlkzckVublJUR2ZuNHZRRGtZCmwrQTBuN1p6NjIzM25idWY2bTdM\nQlRsWFNiUkoyWFdWQ21VdGlqbTBudEEKLS0tIGQ4TFJsSnFlblcvM3dXalM5dG95\nWjRzeHd2LzJtUWkzSzNMTlV0SGZxZjgK+5TtNMzFyLJvKpFm1H6PeRlZ2dUSZMZf\nNWEliC0jv2AnHFow9cttBKQKl/dWFjFY+UukUjyIPr9l8rHQQrJPBw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-27T05:03:18Z",
+		"mac": "ENC[AES256_GCM,data:vqadLc/VzXgsKF2dGZYY/OvKiZ7FsaUFVcAPMEHU3El33ojbWvJHNpAKXD9RgP4yLto5lkUCNkyOoTM0OEz++iDVQg3FfRu+sRa3wiKBh5jMJTrjhdziyQGbFGtF97AUvrhLUEGPTL15gUEuFZbeDiPBBhwhyuu5covBLzY23Go=,iv:r/VJsUMA/jOM7pBFoTJzQAJ6ZXZaVGTi/RduN5kXbKs=,tag:IzgzqaVYpPaPWGkPKsOdQA==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/greaterchiangmai-s3/secret_access_key/users/kurogeek
+++ b/vars/per-machine/ramus/greaterchiangmai-s3/secret_access_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/greaterchiangmai/app_key/groups/admins
+++ b/vars/per-machine/ramus/greaterchiangmai/app_key/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/greaterchiangmai/app_key/machines/ramus
+++ b/vars/per-machine/ramus/greaterchiangmai/app_key/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/greaterchiangmai/app_key/secret
+++ b/vars/per-machine/ramus/greaterchiangmai/app_key/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:FrklrOhsZqUqWEJ5BA7daE4ZEXQ3DJkTcH3bcP8sdPKGPF2fWcoe906xs+XYhR6sNhmS,iv:j+TrVt+SvKzsUChUoaDdcCyeIhtgCRQdAkUXLwoqzZo=,tag:GU6yx9aqElKYqQWeg+iHRg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhaHdaWUZiZ1NmZno4VUhq\nOU0rdkl5R3VWL2NJR1VOV0xYbXV1ZWdrNFU4CmxvdWdkcHV4ZmNNWVdBd0E2MU1S\nUWdCeGRqamZnN0Exa1Z1R1dEMS9xUmcKLS0tIHV0QTZ2VzBjemZaWFFOOHFEY1gz\nbEo5ckZUc3NGUXJYNzRGaytXMGRkTUkKP/hLrBUxP2BAXaS0JmcGKOWb/jUDg9BK\nj2RP5jl9wyL90Dz+ndMsAtGfGuuq352FG4J9wnn8fdTQdiHrh9pjtg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbytVemhiaVBkL0o2TXNp\nUmRuR2RVYjNTVFZ4VXM1YzZOMFVEN0ZKcHhjCkVycTdsSGwvN2tZTE5lSnVnLzd1\nd252UUV6Mzk0Q3lQd1hFeXN5TmpyRFEKLS0tIDVId0hCVEQ4aVJsR3FMaENmajFm\nbW5SSGhNd0ZEYjVnQzIwMStuUU9IT2MKIFCX5CRNi5bbHytTfmXUXls8IG2x9nBn\nOw6atFk/O7kZNq5Quwk74wFykT3h/1S/Tlz2eZA7rUgF7Pqai0XpLg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5bTVxQ1ZkWlhBZkxiWE9m\nQm9xekc0cUF2OW9MaFZVSlJRUEpTOU1lZEQwClA3WUdzengyNWQrUml6ZlNrelBX\nK25Pc2dpNUVvNGo1eGhOVTZhSnlocmsKLS0tIEpYU0dweHdJVHk3YU1aZnVtZTFl\nNTdDbEhzL1pyUDR2OUhxUDV0T01kQ1EKihsOo/CvahfHQJnA4q3VOYsQI2OnhdBZ\nDW1Lwm/n50Ju8OPH8FLbJs+YhXUGicnolWvCjP4MYX9/eY+lXMek4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHp6bzZ0QWVz\nY2hGV0lqR1p1OHJWbHVjb3M1V1phSEhNanhHM2s3V3FIaEUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo5aFo1VTBGdXhXSHJlMnlzUjRWd0xa\nY0VQWGdqdFR5TExURHdhOHVFamdVCi0tLSBJa0RMMWNLQmJ6Y1BZTlllN1l3YVBE\nbmlCNC9mVVk1aE5td0NHQ2tER0Q4CnqBm+ck8LH3L0xQZ8N7SiZNv8DVk/nodLKS\ncGY2yJ3Mp1YkP0zSPEnDSN72aEJLKk5lUb++vPJM/mPlNW9LnU8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFBaV0prTU1C\nMDdhZkJ1bDBwT3pyM085cHY5OGpRbXRwenFiTnA4d2JEWEUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpjS0ZnbndqQ1lUOXV5RVJDU002K3RX\ndnlNNHFMZXZkMS9WZ1ZsM3VGY0JRCi0tLSBodVRjUURKSThxN1B5RVhiWFFjeUh4\nYTZ4Z1Byb3VzWDR3b1kzajYrcTFNCqG/9SHNfZUi1Qq+dAzUIHfyXnnwzsZ552yF\noHndHC0dXLOkRWMfDagvMSnKlMSZi8Y8dV52YQrcRPjFeLi/1Wo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHhQcDUvK1NY\nQkdHMGxZZUpTTUZTOU1sTmk0RzcydTljbjJwVDdUalRwWEUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp3T1o4a291ZlFBS0JKeHpxUHdhaFlr\nSytONTNNVEJ2SlJuS1FYRUh5T0NJCi0tLSBybzZXWmdDSjZaamxXU0VWK01MRmpr\ncU5wMWdkbjdON0dNd2Vkcis1VWw0CmjgMsd3l/GgRk68+2LeziHjZwEx9SsMZb+O\nn6ZhyW5lRGxdl18/OKeVIkkwColYLSX9juElDh9SsXkeKjC8Z+g=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTazVRNG4xdzN3YmRrZzFG\nangyWWxlWmFpODBPN1BnL2J0d0x1N015Z0NrClR1NVkza21OczdkMGkwSFBTWVJG\nR3Z5N2FZcDlxVDVPR1JjcTV2Rklob0UKLS0tIEErNjg2eE96UVZBek5QL1p4VmN2\nSWxWbTZNN0JkUW1XOVYyZSs0R3JFRTAKYpp5LGQIkDS3GWz7AZ3gLLd6YMhfUsll\n9iT4zKQ2ib40bQtRfYvCo5eFXHj1BJrPFtishfspdzByX03eYwg5PA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVNzFEODdNWDRMUi90MHZX\nd2ErbFplVkdMNDV5ZHVJQlZSNHg1Y3FqL1F3CnVMVktDWllVeGJZNnJHM3VIRlMy\nTjNPZjNGdk5TY3hYdmNrVVZob2srSlkKLS0tIFlMVU5ZSDhIZ1VqN1REbTB6dG1n\naUZ1U0UyRi9yY2dNTWl4WVZnZXk5STQKyimXHdozwSCJnYvdciMqiYHhVappCaAn\nCGzPUGikDK+WZj+wBrecl8wkLrCy/RwN/LZQTkj3owj3WUAGkLqg2Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFRkNuNmc1S0ZIWUpkdmJP\nSkhaTFdoSHpVOGR4TmZET2w0cjJRbkl3TW5RCk9Uc0RPQ3pZcmFiM3lwQWd5YS9K\naFZHOG9ZZU03WEdYNmIxU2lZUTRjZjQKLS0tIFpZQjRvVTBsRVpJQVZHaWY0cTZF\nTG1PdjlkbWRsQ0txT05XSFJDMmVTV2MKaXkWVtyJowmWVYqsSg/Y9MD1FXBI3tfI\nWAwqsreW6FeDbNbYwGZ/+848CDAtKnCepO+0VNhx6QfF6YKP9Fji7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxU29QdkJZTG9HeUlUOG5x\nZFZ6ZFZiWHlnZlRVZlV5TnVTU2pMMlg1T2lzCnh4dHJmbkl5Y0lkMU1qVUdINzEx\nc1pFK09yMHlPZDVWc29ZQjNDclZBU1kKLS0tIFc5c1lIRWhwYy9VK3kvS2F4ZENK\nWVY1dWs3ZmdJcTJFQmFqQ1NvQ3pHczQKGg8HfFSUbGamKeDgA69ACvxCyPgIcywV\nbQvu04Bkxxf4chOna+cxYDbMAa49IDHQwFHF9XKyIZKshJcyp6WmVg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-27T05:03:17Z",
+		"mac": "ENC[AES256_GCM,data:J8XJzKU9uID+klDDCsDMPrV8aDEdC5ENXlZEAy8pSKcnNYM5bQk8QylnEIydlmbwOMISScGfBA2EqnKtDSX3dOn2Yray2iUj82z23+/ewyOYXfMH5NY2ne4Cf9J3TJG/UwTSz+i09v0p9dTsQBCzRWU3SyQS1I5TPkXJFjJbnto=,iv:FqowVcZ1GEqEnyzKcKB+1LgBZhAffJH4V+KjyMHsxyo=,tag:BVfAoPoaufX37fhYmoATRQ==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/greaterchiangmai/app_key/users/kurogeek
+++ b/vars/per-machine/ramus/greaterchiangmai/app_key/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvItw14tB6fc6gdZalSkZPOUSWGsTNyLnXk4yLAnkrb 
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519/machines/ramus
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:AzcnY511v0LvR5Z3MIjTY2QWnCgvd5cJ3ezs+E6LdXvzp/nf8XM2zyVpl+2tVlSdAgZs4TvxwtHihOanWQ8yLdNnXT8jP0hUgtYUs9RGLagsbxjLZQ4fKc/Qj3lXDrJdHtV1Ycx7uPXJ10acn4TDiO4GgoghbaRQJWkXaWSxNB2aTVV+76fswLcIimm8D8sLo7NGi3X767/u1xOoz7/jnAke9VCF502EtwK59DhAJvcuuwHGTuHwi1H7BQCs6WTNS4cvfSV9sB4EWmj+J3x65IvAp3uo9KfSlRdAIScJulHm9pOhBU/edTb1goSKAXHfahWrQArcKFOjGW54sWN0MakmHN0UFQVlZF1sqEpmHEXNOyjCPLJYpRxaRmjWBeUuJ/2xHvQWVQVBLC2RvhbGdE06lClrX100EX31txzuIJVUirAHR2owbY7+jOOTZuZtLcXZkHGRVgREej6KmDZWr7yNw9NJ178oD7x5/zivajnlAxYEIUoin7UofkDx3T+sMU9N,iv:Q1YlntA6bScOu9hCOshG6MAbhYIBWw6EbM/5z4nJVvQ=,tag:TFZpP9CeOAmOb3GpCVqRWg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1RDc4WTlWVnBvVWJMZFZR\nL1M2ZWxib1NZM0M1aDM4SlhVaXEwTzF6Um1BCmJiRDdCNXVPaDRDdW1CdTNUMjQz\ncVVIMWZRd2YrV1o0M3NjVkRlZW9XZEUKLS0tIGNYazU2a0pqTzhXczlsbUxBUlBP\nUHJlUHgzdVVZdHdyTjlLQTRpdlJWS3cKHghMTLA/S6F60y56nL/at+iECyoEzZmO\nECJhGSDyQ0vbGgEAnskfseoA2xtzNvkj1sO2kbnPg3pCvlIDGaAX7Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBESGo3M3J5S0FLK21HUHZv\nd21uUTZiMWRVaEhZeGR5MFVLcHEvMnd3UmxzCis3K1poM29LY3BBU2pYRXc5azV1\nYnNpT3lZeFRndmhHb0xHZFZzZTBEOUEKLS0tIGZHZXpESlBjNWpWTkFlMDZERW1K\nRDM2aUF6bzNMZ3hLbStOTS9aUlI2bkUKIzTIQ69JjjIlJl3xUUa8c67+WOLXIcxh\nLN/p58/sGa1PH5X9uI9yBxH+7dmn2u7xwZKGcHt/1D1BwH+1f42eyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsaFgrWllHdXZxQUFGSWV4\nZHMweFpkRHZRV0FEOVBDVFh6MU83SEhpZmlvCkJCUmNIMm5kemZFbzUwYU1POFVx\nVk8rTC9HRi9pQUo0Y0JBdFphWGRuT1EKLS0tIC9PUmZvVC9URks4VitMWG5zSmh1\nNEJldTNEd0dsQjQ2V2JUbVU5UHFNSGsKKV03KeObcSAM5tMBNJp+F6hdDpziyABY\neEAJxMr9BuGoPwvAHLAAvIsIuOw6Zw+wfbxeZK+szhwiFmMdZMCffQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE1xbW85Wi9V\nOTdhdk9jWVBlZm9HbXV1SUh6WmFmdnN4TzdRcm92N2JDa28gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpjVVhQU2lLSlp1Z04zcjJjeWNEamEx\nWGltR2FtdlBDTFRpNGNYRTg0Mm1RCi0tLSBVbWV2WVRUbnFySGp2ZEFnNG9Xc3kw\nTzMrV3dEOEMvL1RGTXJ6L3l6b2t3CjxtxJah0sEljMT01ch9x30OeFzvE/HNzXSb\npnG8Dh0rYjv1lJ2unja8zZdfrl41avHP7BeHqSb5QAMVxZj3h8s=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE5CM1NOOUdl\nZHkwN3I0YkNhaDNYWnMwRFM0bnBPRXlUSy9BZUZYVGRtQjAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwprYkxXMUpZZjhjcjdYYno0NWE3b0ND\nSG1nT1d3dGZEUXE1enMrQnlsU3pVCi0tLSBNMitqcnhkeXdueFFIb2ZSNEtmZmhE\nemdYbGtpV2dadTRscnlidzJNK29jClycgQIySOi0Pb7H9G2fbff+VRhbQY4wqliB\ntGyGUMijiTPpKC5CMqoVz3RsMdZkX2NuwfL3p0oZXpHx2gWCPLA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1yS21OR2JC\nY2xKWW5tdWhGWUxZNEVadTdkQW5NeGhtb0xtaml2N0hnR0kgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpXa2ZmN1ljazgxQmRKUitGQlJhMHlk\nYzNrdVJCaU1QeDlMdGZHTWhjajE0Ci0tLSBmcWhNUmlzd0tWNHVHcW5Dd29rRFpF\nUUl0VkNKb0ZUcWpKaWZvT09VVWpFCuvNqV9L0/XREyuFeNA41+G53wx56k1qzfhz\nk407lcOzWtlo9e4GHzSeV4ZEAP4Pxt56AtoIlSM4LNrlEpBpP9M=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0UzNQcU9Zcmt3Y25BeC9X\neU9NRllWYmNQSkdlakZTbDc0RVhQMElnbDJJCkpMVDRRUm00eG1GN2QxdHppRDVn\nK3kwNERzeWx4YnYrWEFZQUd6YWdlVEUKLS0tIFRyNC8yOUtqdC9IN0lCenlFY1R3\nNlRnWXo4ZTQ2endweHZvRnRldnVHVEUKjNVzo097eHcaQdt3l36ptfzkfAaXNsDJ\n5b6gyjs/arzYj8ygdv6UyDdTNjlZfvATSMgfYIjrCKKt/9EDHfXhRg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSWUl3WlNQQTF1dVdmQjVS\nRnNRK0pNUStjV3VuN0QrK051ZHNPNVZZdlJFCndMRmJRSnFMcjJlYjJOa3hjYzAw\nSHRpaDFFUnd3UU1EdjZFNktzczZucXMKLS0tIHNhUXEzOEFIRDdBdHBrOGhKY0ww\nNEFUMlJLakd4bUUrK1BDNDQydzFPRzgKNJUKAxK/8vTbnHM6/gM4J+FibHkvx6dt\n4hbLPRcXAp/5mVJCMAIGHxsuyG4ypSaOkF25e43PiI7f6HacJkw6AQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbVlpY2RxOGQ1NjFaMzUy\nSU1Vd2crYmNrcjhWRFpkdUl4ak03b0c4SEQ0CkhieCtFc0hPQUtsQmNwRnBhdkY5\nMTBOaGVTKzNtUWl3QUIrU2VRYWhWMEEKLS0tIE9VNmFWaGF3KzdKcmJCbHNTZllx\nSnBtNVZUdnJHYVRuZ1NQUWNoRkp0Y3MK0x4epBjs6Czgzpp525Z8FMpJkuQn5LQ2\nbaL3VJJxdjpKKk3AeS3rnIUJ5XV10qtsG4eaQ3wgAQGdXl45jcvDaA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3L1pLSkI5YkdWV3d3TDV2\ncW9lWUNodXhBN2xGcE1KaElaTmxRR2V0eUc4CkF6M0ZCd3NTMVhUZEpqTERnVEt1\ncXE5STdJckRwaWdJdE5SNStsajh1dTAKLS0tIFhrVzEzL1ZGOFVOL2oxbmFDQ1ZS\nTEc1UmM0V3F3YU94WVBDYk54SWZtZUUKl7eW0214fmkJ88J93O9uudjxxZfQ1kFl\ndeZfjYg1N2UEGImL4sZgz05+m8ehxLh+FntlGgJ7MHFrqAE/g6UF1A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:15Z",
+		"mac": "ENC[AES256_GCM,data:Ve2ded5v+sZaMocncuTS+y9g5nGP6wWvu2bWsBn4AbYigZnfp9eROIf7ewCT2pxcu7VFGdYv1DjWrizwvYu1PkRvVMxJZy2BgZeYwtmSVWW+x7m82QFb8kapO5j+8hK6V2tyiaGUw8xwNDtN/QyUhlpS1kjfmNLwy1sBM0rinLo=,iv:G5oif6tMGzS3TAPRk/6LZeHLDvyognPPCjuwxoX05YQ=,tag:M8+mU2/C3MNwc4TABkR9Xg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/ramus/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/root-password/password-hash/groups/admins
+++ b/vars/per-machine/ramus/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/ramus/root-password/password-hash/machines/ramus
+++ b/vars/per-machine/ramus/root-password/password-hash/machines/ramus
@@ -0,0 +1 @@
+../../../../../../sops/machines/ramus
--- a/vars/per-machine/ramus/root-password/password-hash/secret
+++ b/vars/per-machine/ramus/root-password/password-hash/secret
@@ -0,0 +1,50 @@
+{
+	"data": "ENC[AES256_GCM,data:6/cp0K3a8htco1rlIfExnL+ppIgNg0+/XlPPAx0Ylp/KtDfkQg3OI+Y9zWRX2UN1dHjVVBJ0vDrqKv5OaijQbl14E6U46HH4EjevBmGeUCLmDrsFTNIPqGw+D12LoYuOGwkfonsRO5LbtQ==,iv:Beb8wBVdZvkKA69aCtxGMxuQ9fProDLN4WWKtvKPbvc=,tag:+rpJT78McFuf1wJq6DWyoQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpMUllOTM1RUtHSWJ3bDN0\nVnRTWDErQTV3b2lHcEYzanp2VVhoQllyNmhzCk5zN0xwUVlDQjB2RDRLUzlvVW9u\nYjh5eDdnWGRXRWxoYmp0ZTNEam94NDgKLS0tIHBTdHREQ2dRR3ZFNHFhZXV6cDgx\nRk9OOVUrSWlVZGZHTksvN0RocHFyWWsKfhDdr6qFmtt7dAegVIIb3JH01rGxzvyN\naQv6F6BWbhvMUU3/eJNVerJti1Y/RinGxBLSP58SxksJiDTFBv/jWQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMZHQ2U2tsd29qTFQ1aVBP\ndW94RXJqbE9LUkdXeXVsQ0F4TFUxdGo5ZFg4Ck1PWHJGWHVEeTR2QTRTM1NGWVkx\ndG1HMmZUS24yNHNQbjFPMjVNeE83aVUKLS0tIGtiZXEzY1g5QS9FcHlOOWpxbE8y\nbUtrMngrQ0lLdlQ5N2Uwd1ZVWkRYaGsKD+xmS2gjw7o2Wohxh7+4dk2+9Uf7jK75\nFz2RmP6oLNIcWanAENygOR8etcuBMcCPAc08VSEGtjDg9JUC4lV2mw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1egztkqupggjcpy4g9tfwq6kqeh3ljw7enzhx4l53hjge73wmdscqy5qwfp",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYVJmUDNNMWVHSSt0RWk0\nNHlyOU9uYjg2aytjaXVnV21NNDFGUVMyUDNJClBYTUFzNWRxOTNKVmxIdm9pQlRq\nRGQ4am5mSytDOFFjUklGNkJZQ29tQk0KLS0tIE1jQkkvRGltYUExazhKUDlhZlF6\nSDUwNFR0NFdJSC8yNy9yOWxHYUJxSEkKf7bxUdVDAvHnU8kscXInOcIy6vuxj5pL\nBaW5dYJ5yQiroXuv2U9rDygTQYAAiE0g8xZRjp98qzTHT25lG0pgzw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDc3Zjc3blhq\nOVpLSWF3dHRLVitOd1BtWTNISVBPVHREMkpJdkxJUTZHbHcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo4cUZZRXVrMzFiV01QenVJd2oyMXJv\nVENRYmdtazROVnU5d1RkRGp6NVVZCi0tLSBabmQvcjdQQkU3SGZNU3BwVUltN1Er\nZ3hxS01ZeFRFSkZVYjc0UXFqTTZjClLbO5vhBcv+lIMvSEPeuztAL7/L2OttICB5\nEJghMMExc7/kgM7d88q75qEsPsVNgE/4BWzyesrvKXb2gWLosQg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHh5M3BYQ0di\ndkhjL0hDWVZqbU0rTjlkV1NZZTZ6eERTc2JLc1l1b1N6d3cgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpXdEY5MFhNeXJRdlJuREw5emJSakhT\nL3pqNFBpOFozcXRaT3NreXJERVNvCi0tLSA4Mms1NzZRdG4wbnUzSVFVVStueXJ5\naUh0NWd3aVJUeDFQSGRtMjdaNEtrCtQQU4t80k6OnmsBcH6Z0hyBPTLFsb9n+/2h\nxWFf2MsBTboevVnOhvEGaA8XhBB2/MrUCGTbkFStfdf+8jyVj+k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHU0dHI2L2FH\nZ3loaEZxRUY3NW51Ty9pc3FYd25OVGtwNG84OUJUdWFCMVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpYU3FIZ0crV3NWTkNLR29BNFlvbFJZ\nRFNzZk1iWGRvRFdRc1NGMVlpZGNnCi0tLSBmK0FXeW5SbzJLV1c5Q2wxMDkzL0Ew\nMTZoRklJL3JIaXcvcFJ4bzFySm1jCvY44UAa+HixIuoFn5n8BBqWigjNYS0bhFTr\nTLOcMxGb26VeoWMULZs/SaONRAVbbtCYAbv+ZXFu3GH7rn9xx48=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0dmJacm4vYjN2WlJNTFEw\ncHpPamdqa21FZmJKRnRtRUNodE1NNFNZWWp3Ci96R01JWDY3NFNINHg5MVRTbWNU\nVytLV0hyUmI1YkV4dGJ5MXpuQzU5eDgKLS0tIHhlS3NjVWZId1lIa2ZYY1VFUmE1\nc0UwaTR6NEFZcUg1OVh5MG9RSHFKUncKGnRavc/A4Y24WK9g07ofpdw4jf/Dzs14\n2MesaajLi2pHwSeb48V3c/iYgS3cK4j0iosY+viWrfvV3vRG9FE0Tw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMGNtaHl1MEFFSWwrOW10\na1JQNnZIcjNnMGREMTlXb0lwWS9OMC9uNlZJCkxBSXVJSGdzMC9mU3dldkk5K0Vo\nOG5uMDM3S05jZjdBY0ZyNGZSR3ZQQVkKLS0tIEN1WGRDaGNva3dJWGczWHBVVUtw\nTzZad1FCeTB4UDNsZWJ3Tml6M25FVGMKzXCnA2ehQ/bfV32Xc8mflXfWAim/v/+u\nEqU0fp3Bhn1FIWFCBvh18o20kw+MsE3+zpiY6FxxI2EtrVTMyobXuQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCMmtNaDJLL1hhb2tCSm16\nck4zcEVabjh3OXpuMHFsbnd3MTIvbnVmRTMwCjFhRWNWSUlZbmtuUDBVakRaL1Uv\nSVlYeXJtOWd2UWVuVyszQjNkdldrbkkKLS0tIGJnSThzQ2Z2TFkrNExQVWI0V0pD\nMXNBUDZNWXpSb1doYW9teEZLMW9PdXcKa3zgLXVDJ07cEMlHVGNCKOcUtajRBy7x\nssbScq1+iCZeBk/4k1Ex3kyZ5yfmMe3nE8fS8Mx1HtXxvrHcxLmbgA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtakZaeWUvVFROK3ZpQ1ZB\nYTVKTWtNVkdQVE5SeE9veFdtcUJDQXF2MmhnCldYdmZZT3VyZmV3eTNPbHIxWEc1\nYTNSNEhZbExrblRKdWMzUUplQmFGNHcKLS0tIExjQUhKanpmV2xuUzI1ZnBMdHJU\nU05OL2ZaYTEvWWxRTHIzUWUwbU4vODQK13v0k5tac1CYvsESefWacZe+xXUOXWPy\nn/soHGUVG9L2RdiSh4RcZc7n7Foq6GwJqi9wDc8Ms1FpzvuaVdOF/A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-26T06:08:16Z",
+		"mac": "ENC[AES256_GCM,data:QwBGFbzWLFEdzT1bVjV77rtWCZwKXXf9P3byS0+SLRbfyxzRY0+BkzTa+vxj153udYwFkimJX9ywWISUDfqm6FJs6a4jqG8Xmwk1AmSyg585dc2Z26PC30nn4rBcezWBMF2IVFw+pJ65dZq8NSG6EmyHgmzedTOHMis9NZmm/b0=,iv:i/5MNOcH3TcKYRojVKCy0Pw5tHzSzvS8YLLYn0pwQ6s=,tag:96JAFD/kjUKPv1ZnGnEzMw==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/vars/per-machine/ramus/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/ramus/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/ramus/root-password/password/groups/admins
+++ b/vars/per-machine/ramus/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	6e72d44b2d	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/b4l/configuration.nix	2025-11-27 17:50:07 +07:00
kurogeek	f9dde7f1ac	Update vars via generator acme for machine b4l	2025-11-27 17:50:02 +07:00
kurogeek	d63b70866f	mob next [ci-skip] [ci skip] [skip ci] lastFile:inventories/default.nix	2025-11-27 17:47:34 +07:00
kurogeek	6ec0435531	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/nixos/think-backend-gtcm.nix	2025-11-27 16:12:51 +07:00
kurogeek	4c7c63b49a	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/ramus/think-greater-chiangmai.nix	2025-11-27 14:38:00 +07:00
kurogeek	6af36b19f3	Update vars via generator greaterchiangmai-s3 for machine ramus	2025-11-27 12:03:18 +07:00
kurogeek	4c35cff1a7	Update vars via generator greaterchiangmai for machine ramus	2025-11-27 12:03:17 +07:00
kurogeek	bbf5a931c1	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/ramus/think-greater-chiangmai.nix	2025-11-27 10:48:44 +07:00
kurogeek	b6d60ac0a8	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/ramus/think-greater-chiangmai.nix	2025-11-27 10:46:42 +07:00
kurogeek	2dd271c7ba	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/ramus/think-greater-chiangmai.nix	2025-11-27 10:42:09 +07:00
kurogeek	63d11c013a	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/ramus/think-greater-chiangmai.nix	2025-11-26 16:17:42 +07:00
kurogeek	c3eb7fc814	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/ramus/configuration.nix	2025-11-26 14:55:45 +07:00
kurogeek	beb24e867e	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/nixos/think-backend-gtcm.nix	2025-11-26 14:51:14 +07:00
kurogeek	8bc157f4c0	mob next [ci-skip] [ci skip] [skip ci] lastFile:modules/nixos/think-gtcm.nix	2025-11-26 14:50:23 +07:00
kurogeek	10c7ab0667	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/ramus/configuration.nix	2025-11-26 14:49:13 +07:00
kurogeek	cf30c9e92d	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/ramus/configuration.nix	2025-11-26 14:44:28 +07:00
kurogeek	5246b83a8f	mob next [ci-skip] [ci skip] [skip ci] lastFile:tests/default.nix	2025-11-26 14:21:11 +07:00
kurogeek	e6760d320d	ramus machine	2025-11-26 14:01:11 +07:00
kurogeek	bfeea4156b	disappearing default route is fixed by a hacky way	2025-11-21 16:53:55 +07:00
kurogeek	3aa93c1333	nameservers whitehouse	2025-11-18 13:58:59 +07:00
kurogeek	b541e9ff4c	Update vars via generator state-version for machine rigel	2025-11-10 14:48:37 +07:00
kurogeek	bdf1e3e5bc	Update vars via generator state-version for machine b4l	2025-11-10 14:48:37 +07:00
kurogeek	ab88d74226	sirius WhiteHouse NAS	2025-11-10 14:47:09 +07:00
kurogeek	162707546c	whitehouse router: add vlan on wan interface	2025-11-07 15:04:26 +07:00
kurogeek	2c9592c542	more packages on common	2025-11-06 15:57:01 +07:00
kurogeek	0bb6314a03	Update vars via generator state-version for machine vega	2025-11-05 16:22:09 +07:00
kurogeek	13df0a8421	common nixos module	2025-11-05 16:21:50 +07:00
kurogeek	4259d8014e	use upstream clan testModule	2025-10-31 13:53:16 +07:00
kurogeek	71a3ca375f	nixpkgs go back to rev d7f52a7a640bc54c7bb414cca603835bf8dd4b10 since the new one has issue with clan tests	2025-10-31 13:52:52 +07:00
kurogeek	891504f173	rename checks services	2025-10-30 12:03:24 +07:00
kurogeek	5ffbe0ed9b	bump clan-core, nixpkgs	2025-10-30 11:59:22 +07:00
kurogeek	7115a93a0b	clanService asterisk	2025-10-22 16:40:59 +07:00
kurogeek	b5f3adacd8	clanService yggdrasil add vars yggdrasil/yggdrasil-subnet	2025-10-21 15:55:18 +07:00
kurogeek	2eb52251cc	clanService yggdrasil	2025-10-17 16:58:43 +07:00
kurogeek	be25560858	WhiteHouse router configuration	2025-10-16 14:53:41 +07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvItw14tB6fc6gdZalSkZPOUSWGsTNyLnXk4yLAnkrb`