mob next [ci-skip] [ci skip] [skip ci]

lastFile:machines/rigel/networking.nix
2025-10-21 17:04:45 +07:00 · 2025-10-21 16:16:47 +07:00 · 2025-10-21 15:57:45 +07:00 · 2025-10-21 15:57:30 +07:00 · 2025-10-21 15:56:11 +07:00 · 2025-10-21 15:55:18 +07:00
65 changed files with 807 additions and 3726 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -139,14 +139,19 @@
    "liminix": {
      "flake": false,
      "locked": {
-        "lastModified": 1760087246,
-        "narHash": "sha256-HRUkAS5XDuM7yDnz+TIMAre7kFOuqyHL/y26wTbH6Sg=",
-        "path": "/home/kurogeek/Desktop/gitea/dan/liminix",
-        "type": "path"
+        "lastModified": 1760426231,
+        "narHash": "sha256-r8c5PKtsxAvtQ/k17GH+WNvP47Lr+AbExLMPdLtvAKE=",
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "revCount": 1574,
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
      },
      "original": {
-        "path": "/home/kurogeek/Desktop/gitea/dan/liminix",
-        "type": "path"
+        "ref": "refs/heads/fix-gl-ar750",
+        "rev": "3f1f7c08d440130cce9262a93ce78ed7969d93cd",
+        "type": "git",
+        "url": "https://git.b4l.co.th/newedge/liminix"
      }
    },
    "nix-darwin": {
--- a/flake.nix
+++ b/flake.nix
@@ -22,8 +22,7 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    liminix = {
-      # url = "git+https://gti.telent.net/dan/liminix?ref=refs/heads/main&rev=29fbb5461d034c4c59b88cbe04937b04ecad18e0";
-      url = "path:/home/kurogeek/Desktop/gitea/dan/liminix";
+      url = "git+https://git.b4l.co.th/newedge/liminix?ref=refs/heads/fix-gl-ar750&rev=3f1f7c08d440130cce9262a93ce78ed7969d93cd";
      flake = false;
    };
  };
@@ -38,24 +37,6 @@
        systems = [
          "x86_64-linux"
        ];
-
-        flake.legacyPackages.qemu-router = import "${inputs.liminix}/default.nix" {
-          liminix-config = import "${inputs.liminix}/examples/hello-from-qemu.nix";
-          device = (import "${inputs.liminix}/devices/qemu-aarch64/default.nix");
-        };
-        flake.legacyPackages.yada-router = import "${inputs.liminix}/default.nix" {
-          liminix-config = import ./routers/yada-house/configuration.nix { inherit inputs; };
-          device = (import ./routers/yada-house/device.nix { inherit inputs; });
-        };
-        flake.legacyPackages.qemu-flake = import "${inputs.liminix}/default.nix" {
-          liminix-config = import ./routers/qemu/configuration.nix { inherit inputs; };
-          device = (import ./routers/qemu/device.nix { inherit inputs; });
-        };
-        flake.legacyPackages.vanilla = import "${inputs.liminix}/default.nix" {
-          liminix-config = import ./routers/vanilla/configuration.nix { inherit inputs; };
-          device = (import "${inputs.liminix}/devices/gl-mt300a/default.nix");
-        };
-
        imports = [
          ./fmt.nix
          ./shell.nix
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -5,6 +5,10 @@
      tags = {
        glom = [ "vega" ];
        b4l = [ "rigel" ];
+        fax-bridge = [
+          "neptune"
+          "rigel"
+        ];
      };

      instances = {
@@ -48,6 +52,14 @@
          roles.peer.tags.b4l = { };
        };

+        yggdrasil = {
+          module = {
+            name = "yggdrasil";
+            input = "self";
+          };
+          roles.default.tags."fax-bridge" = { };
+        };
+
        pocket-id = {
          module = {
            name = "pocket-id";
--- a/machines/neptune/configuration.nix
+++ b/machines/neptune/configuration.nix
@@ -0,0 +1,22 @@
+{ inputs, config, ... }:
+{
+  imports = [
+    # (inputs.import-tree ./services)
+  ];
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+  boot.loader.grub.devices = [ "/dev/disk/by-id/FIXME" ];
+  fileSystems = {
+    "/".device = "/dev/FIXME";
+  };
+  networking.fqdn = "b4l.co.th";
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+
+  security.acme.defaults.email = "admin@b4l.co.th";
+  security.acme.acceptTerms = true;
+  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+    enableACME = true;
+  };
+}
--- a/machines/rigel/configuration.nix
+++ b/machines/rigel/configuration.nix
@@ -8,6 +8,7 @@
        "2bd36db8cc" # kurogeek-thinkpad
      ];
    })
+    ./networking.nix
  ];

  system.stateVersion = "25.11";
--- a/machines/rigel/networking.nix
+++ b/machines/rigel/networking.nix
@@ -0,0 +1,85 @@
+{ lib, config, ... }:
+let
+  ata-interface = "enp2s0";
+
+  ipv6Subnet = lib.elemAt (lib.splitString "/" config.clan.core.vars.generators.yggdrasil.files.yggdrasil-subnet.value) 0;
+  ipv6Prefix = lib.elemAt (lib.splitString "/" config.clan.core.vars.generators.yggdrasil.files.yggdrasil-subnet.value) 1;
+in
+{
+  # clan.core.vars.generators.networking.files.ata-interface.secret = false;
+
+  networking.interfaces = {
+    ${ata-interface} = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = "192.168.254.1";
+          prefixLength = 24;
+        }
+      ];
+      ipv6.addresses = [
+        {
+          address = ipv6Subnet + "1";
+          prefixLength = lib.toInt ipv6Prefix;
+        }
+      ];
+      ipv6.routes = [
+        {
+          address = "200::";
+          prefixLength = 7;
+          # via = "${ipv6Subnet}1";
+        }
+      ];
+    };
+  };
+
+  services.dnsmasq = {
+    enable = true;
+
+    settings = {
+      bind-interfaces = true;
+      server = [
+        "1.1.1.1"
+        "8.8.8.8"
+      ];
+      # enable-ra = true;
+      domain-needed = true;
+      domain = "localhost";
+      dhcp-range = [
+        "192.168.254.10,192.168.254.240,255.255.255.0,24h"
+        "${ipv6Subnet}10,${ipv6Subnet}240,slaac"
+      ];
+      dhcp-option = [
+        "3,192.168.254.1"
+        "6,8.8.8.8,8.8.4.4"
+        "option6:information-refresh-time,3600"
+      ];
+      interface = [ ata-interface ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "_" = {
+        locations."/" = {
+          proxyPass = "http://192.168.254.96";
+        };
+      };
+    };
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv6.conf.all.forwarding" = true;
+  };
+
+  networking.firewall.allowedUDPPorts = [
+    53
+    67
+  ];
+  networking.firewall.allowedTCPPorts = [
+    53
+    80
+    443
+  ];
+}
--- a/modules/clan/yggdrasil/default.nix
+++ b/modules/clan/yggdrasil/default.nix
@@ -0,0 +1,53 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "yggdrasil";
+  manifest.description = "An in scalable routing as an encrypted IPv6 overlay network";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    perInstance.nixosModule =
+      {
+        lib,
+        config,
+        pkgs,
+        ...
+      }:
+      {
+        clan.core.vars.generators.yggdrasil = {
+          files = {
+            yggdrasil-secret = {
+              secret = true;
+            };
+            yggdrasil-ip = {
+              secret = false;
+            };
+            yggdrasil-subnet.secret = false;
+          };
+          runtimeInputs = with pkgs; [
+            yggdrasil
+            jq
+          ];
+          script = ''
+            yggdrasil -genconf -json | jq {PrivateKey} > $out/yggdrasil-secret
+            cat $out/yggdrasil-secret | yggdrasil -useconf -address | tr -d "\n" > $out/yggdrasil-ip
+            yggdrasil -useconffile $out/yggdrasil-secret -subnet | tr -d "\n" > $out/yggdrasil-subnet
+          '';
+        };
+
+        services.yggdrasil = {
+          enable = lib.mkDefault true;
+          configFile = config.clan.core.vars.generators.yggdrasil.files.yggdrasil-secret.path;
+          settings = {
+            Peers = [
+              # US Peers
+              "tls://ygg.jjolly.dev:3443"
+              "tls://[2602:fc24:18:7a42::1]:993"
+              "tcp://leo.node.3dt.net:9002"
+              "tcp://ygg-kcmo.incognet.io:8883"
+            ];
+          };
+        };
+      };
+  };
+}
--- a/modules/clan/yggdrasil/flake-module.nix
+++ b/modules/clan/yggdrasil/flake-module.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  inputs,
+  self,
+  ...
+}:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    yggdrasil = module;
+  };
+  perSystem =
+    { ... }:
+    {
+      # clan.nixosTests.yggdrasil = {
+      #   imports = [ ./tests/vm/default.nix ];
+      #
+      #   clan.modules."@clan/yggdrasil" = module;
+      # };
+    };
+}
--- a/modules/clan/yggdrasil/tests/vm/default.nix
+++ b/modules/clan/yggdrasil/tests/vm/default.nix
@@ -0,0 +1,37 @@
+{
+  ...
+}:
+{
+  name = "service-yggdrasil";
+
+  clan = {
+    directory = ./.;
+    inventory = {
+      machines.server = { };
+
+      instances = {
+        yggdrasil-test = {
+          module.name = "@clan/yggdrasil";
+          module.input = "self";
+          roles.default.machines."server".settings = { };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    server = {
+      services.yggdrasil = {
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("yggdrasil")
+
+    # Check that garage is running
+    server.succeed("systemctl status yggdrasil")
+  '';
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/machines/server/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+    "type": "age"
+  }
+]
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/secret
@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:pGMobS67sLp2GN2Xw7A/trcLYnQdVZCUbjtlwS/AShXxyXgHXzkqRee6R765GZyCpDwM8A1IuMZYctrqWxVXrpIAiJpwvwy7vDM=,iv:ysRf5xAXN+dFSx+sFHNDt1GcVQx7RLej4c12v60iSI0=,tag:yXYpWhWLdsz9BOOoKpZU4g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UmhPdzcrSnFhVUxRNDBL\ncXlGRzdMdWxCWmFlUkE4RnJRQ3psMlBqV0Q0CkRjTXFoQitQbjRhMlVjaDc3UDN1\nR1hBeXlCeWxvdnZoVWI1ZkcweHF5VncKLS0tIHE4YVFhYTZTNko1MnJINjFPYXh4\ndlJJZThGZ0JIaDJWRTNXbXk3alNZTnMKgd+0535zoTu6xW2778uNReu4Z7LStN6d\n1O9SXAB+s1iOZ3xGEICiQTVF/6p8RE6lheV2oXgoMiXXrFNH6INLsw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:34Z",
+		"mac": "ENC[AES256_GCM,data:YIpKJlOI6ASgOYqv9ipu+T3c+PlM5HwvdFVH8gh8hVeSbmxD1baPPmVSWlLv+u61Q1/C9PK4mczaASopaGiLoswep+Hc1Gn7sSeP9wO6Djx6fEIEyE1VUhUbTqi/nHYiB21yB/wegfpqzNYIn1nO0oFCmDmSS5qIowcT1fhYIjM=,iv:lzxll5oC7poLvC/hZPexUGAcAdf67xZGRXUpj6O3p6Y=,tag:9xu17Y5MtW5XNzGBsWwA3g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/sops/secrets/server-age.key/users/admin
@@ -0,0 +1 @@
+../../../users/admin
--- a/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
+++ b/modules/clan/yggdrasil/tests/vm/sops/users/admin/key.json
@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+204:5ce7:aa27:579b:ec90:6907:4ddc:177
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/machines/server
@@ -0,0 +1 @@
+../../../../../../sops/machines/server
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:I6yalWQ2u5hI84lJTUmh07JxUBp4EZukJrSGSN7wsGiUGlFa1v/RT1XkTiXuRjDtUVYCLmQmfSCAp/OqFscxF8KL+s24iTDrG4e3S6AeKLa3oZrNJIt1EJ06gWrPNoh1ttmwXSd4Y4Bsk4Lg8vIjH4qw3Bx+KrufxYTqe+anfMdoXKnW8wOWud5O7HMvCh+sf4dNcf6PIQ==,iv:SF5qExXNPyif+LIcNhHP0PKELUBXaFsPj9B3wvUkEp0=,tag:QEkZXDrIdcpNiZ6l2ljOPw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12ldrhhffl0jeteh8f0rzhezs0ulggg5jyqph6xzrgjw2dv40pqwq49lej9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENDhrWVRuYjRnZktROU4v\nSHNtODFGMWl0NDRHazIwcWl0WGtNY2dYMXhnCmZQQ0doS3BTaU5hRHVsVTB5THl1\nWUNDQUNiMVJFeFZnQ1ptYmFQdTJQc28KLS0tIEtJdUQ5Y1VqSThkSVVNcVNVNEFr\nMzBCRjM1L1V5TngrZG5rR0VHY3Z6TDAKPQ6P96upDeh8xwQDrX4Zcf71Dah5zkOJ\n/F5eODEBadzQSRmJuyp3+uRMFf47eR6Q5bVah3NsVxFquXOL3CtNlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHb0EwT2tuMVE5SE5XaWdQ\ncGR0bFFhOUQvM2dGUzdlUEFFbzRnTHBWWUVnCjFGTXcrWW1vR0x5dXBUamtkS0dF\neG9weUVwQzhhNHhPRUdqV1VnWXJyNFEKLS0tIC80b1ZqRGFOenpENDN1Vk5vRUhY\nVnJzZ1Q5VzZ6ZEZtZE13YjQ0VVhrTTAK5y0BjKBRg2AXuO416JWLMLyM/pCQChKn\nVKZMXcT6cc5hHDuqbp9qUofknF68XnzlH6nOyLB1ZtnELyeZuf29fw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T05:34:35Z",
+		"mac": "ENC[AES256_GCM,data:Y3k83RaeX64LA3rsIkQxyKw+LLUgXVsqr3F2UHkv9h73gkyChc6k1oE/FLR4CsZZWsfLNjCkPMuenqToA2mKqQK0aADwPDYo0aVm0hr1PGX5j3Py6EmP56NFvxlAQsExRWo32eqdkeCkY23hfcmUYlaB+bo/fsrRVj67zag9GYA=,iv:p18i8cV6jKXpuZ1Xd7KYCl8BMe1/8CW9YnCuVrTAqy0=,tag:IJnLzdZOn8Clu+lCKT6zvA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
+++ b/modules/clan/yggdrasil/tests/vm/vars/per-machine/server/yggdrasil/yggdrasil-secret/users/admin
@@ -0,0 +1 @@
+../../../../../../sops/users/admin
--- a/routers/default.nix
+++ b/routers/default.nix
@@ -1,25 +1,9 @@
 { inputs, ... }:
 {
  flake.legacyPackages = {
-    qemu-router = import "${inputs.liminix}/default.nix" {
-      liminix-config = import "${inputs.liminix}/examples/hello-from-qemu.nix";
-      device = (import "${inputs.liminix}/devices/qemu-aarch64/default.nix");
-    };
-    yada-router = import "${inputs.liminix}/default.nix" {
-      liminix-config = import ./routers/yada-house/configuration.nix { inherit inputs; };
-      device = (import ./routers/yada-house/device.nix { inherit inputs; });
-    };
-    qemu-flake = import "${inputs.liminix}/default.nix" {
-      liminix-config = import ./routers/qemu/configuration.nix { inherit inputs; };
-      device = (import ./routers/qemu/device.nix { inherit inputs; });
-    };
-    vanilla = import "${inputs.liminix}/default.nix" {
-      liminix-config = import ./routers/vanilla/configuration.nix { inherit inputs; };
-      device = (import "${inputs.liminix}/devices/gl-mt300a/default.nix");
-    };
-    fax-router = import "${inputs.liminix}/default.nix" {
+    whitehouse-router = import "${inputs.liminix}/default.nix" {
      device = (import "${inputs.liminix}/devices/gl-ar750");
-      liminix-config = import ./fax-router/configuration.nix { inherit inputs; };
+      liminix-config = import ./white-house/configuration.nix { inherit inputs; };
    };
  };
 }
--- a/routers/fax-router/configuration.nix
+++ b/routers/fax-router/configuration.nix
@@ -1,46 +0,0 @@
-# This is an example that uses the "gateway" profile to create a
-# "typical home wireless router" configuration suitable for a Gl.inet
-# gl-ar750 router. It should be fairly simple to edit it for other
-# devices: mostly you will need to attend to the number of wlan and lan
-# interfaces
-{ inputs }:
-{ config, pkgs, ... }:
-let
-  inherit (pkgs.liminix.services) target;
-  svc = config.system.service;
-in
-rec {
-  imports = [
-    "${inputs.liminix}/modules/wlan.nix"
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/ntp"
-    "${inputs.liminix}/modules/vlan"
-  ];
-
-  services.dhcpv4 =
-    let
-      iface = svc.network.link.build { ifname = "eth1"; };
-    in
-    svc.network.dhcp.client.build { interface = iface; };
-
-  services.defaultroute4 = svc.network.route.build {
-    via = "$(output ${services.dhcpv4} ip)";
-    target = "default";
-    dependencies = [ services.dhcpv4 ];
-  };
-
-  services.packet_forwarding = svc.network.forward.build { };
-
-  services.ntp = config.system.service.ntp.build {
-    pools = {
-      "pool.ntp.org" = [ "iburst" ];
-    };
-  };
-
-  boot.tftp = {
-    serverip = "192.168.8.148";
-    ipaddr = "192.168.8.251";
-  };
-
-  defaultProfile.packages = [ pkgs.hello ];
-}
--- a/routers/fax-router/router-secrets.nix
+++ b/routers/fax-router/router-secrets.nix
@@ -1,17 +0,0 @@
-{
-  wpa_passphrase = "you bring light in";
-  ssid = "liminix";
-  l2tp = {
-    name = "abcde@a.1";
-    password = "NotMyIspPassword";
-  };
-  root = {
-    #  mkpasswd -m sha512crypt
-    passwd = "$6$6pt0mpbgcB7kC2RJ$kSBoCYGyi1.qxt7dqmexLj1l8E6oTZJZmfGyJSsMYMW.jlsETxdgQSdv6ptOYDM7DHAwf6vLG0pz3UD31XBfC1";
-    openssh.authorizedKeys.keys = [ ];
-  };
-
-  lan = {
-    prefix = "10.8.0";
-  };
-}
--- a/routers/qemu/configuration.nix
+++ b/routers/qemu/configuration.nix
@@ -1,49 +0,0 @@
-{ inputs }:
-{ config, pkgs, ... }:
-let
-  svc = config.system.service;
-
-in
-rec {
-  imports = [
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/dnsmasq"
-    "${inputs.liminix}/modules/ssh"
-  ];
-
-  hostname = "hello";
-
-  # configure the internal network (LAN) with an address
-  services.int = svc.network.address.build {
-    interface = config.hardware.networkInterfaces.lan;
-    family = "inet";
-    address = "10.3.0.1";
-    prefixLength = 16;
-  };
-
-  services.sshd = svc.ssh.build { };
-
-  users.root = {
-    # the password is "secret". Use mkpasswd -m sha512crypt to
-    # create this hashed password string
-    passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
-  };
-
-  services.dns =
-    let
-      interface = services.int;
-    in
-    svc.dnsmasq.build {
-      inherit interface;
-      ranges = [
-        "10.3.0.10,10.3.0.240"
-        "::,constructor:$(output ${interface} ifname),ra-stateless"
-      ];
-
-      domain = "example.org";
-    };
-
-  defaultProfile.packages = with pkgs; [
-    figlet
-  ];
-}
--- a/routers/qemu/device.nix
+++ b/routers/qemu/device.nix
@@ -1,58 +0,0 @@
-# This "device" generates images that can be used with the QEMU
-# emulator. The default output is a directory containing separate
-# kernel ("Image" format) and root filesystem (squashfs or jffs2)
-# images
-{ inputs }:
-{
-  system = {
-    crossSystem = {
-      config = "aarch64-unknown-linux-musl";
-    };
-  };
-
-  description = ''
-    QEMU Aarch64
-    ************
-
-    This target produces an image for
-    the `QEMU "virt" platform <https://www.qemu.org/docs/master/system/arm/virt.html>`_ using a 64 bit CPU type.
-
-    ARM targets differ from MIPS in that the kernel format expected
-    by QEMU is an "Image" (raw binary file) rather than an ELF
-    file, but this is taken care of by :command:`run.sh`. Check the
-    documentation for the :ref:`qemu` target for more information.
-
-  '';
-
-  # this device is described by the "qemu" device
-  installer = "vmroot";
-
-  module =
-    { config, lim, ... }:
-    {
-      imports = [
-        "${inputs.liminix}/modules/arch/aarch64.nix"
-        "${inputs.liminix}/devices/families/qemu.nix"
-      ];
-      kernel = {
-        config = {
-          VIRTUALIZATION = "y";
-          PCI_HOST_GENERIC = "y";
-
-          SERIAL_AMBA_PL011 = "y";
-          SERIAL_AMBA_PL011_CONSOLE = "y";
-        };
-      };
-      boot.commandLine = [
-        "console=ttyAMA0,38400"
-      ];
-      hardware =
-        let
-          addr = lim.parseInt "0x40010000";
-        in
-        {
-          loadAddress = addr;
-          entryPoint = addr;
-        };
-    };
-}
--- a/routers/vanilla/configuration.nix
+++ b/routers/vanilla/configuration.nix
@@ -1,41 +0,0 @@
-{ inputs }:
-{ config, pkgs, ... }:
-let
-  inherit (pkgs.liminix.services) target;
-  svc = config.system.service;
-in
-rec {
-  imports = [
-    "${inputs.liminix}/modules/wlan.nix"
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/ntp"
-    "${inputs.liminix}/modules/vlan"
-  ];
-
-  services.dhcpv4 =
-    let
-      iface = svc.network.link.build { ifname = "eth1"; };
-    in
-    svc.network.dhcp.client.build { interface = iface; };
-
-  services.defaultroute4 = svc.network.route.build {
-    via = "$(output ${services.dhcpv4} ip)";
-    target = "default";
-    dependencies = [ services.dhcpv4 ];
-  };
-
-  services.packet_forwarding = svc.network.forward.build { };
-
-  services.ntp = config.system.service.ntp.build {
-    pools = {
-      "pool.ntp.org" = [ "iburst" ];
-    };
-  };
-
-  boot.tftp = {
-    serverip = "192.168.8.148";
-    ipaddr = "192.168.8.251";
-  };
-
-  defaultProfile.packages = [ pkgs.hello ];
-}
--- a/routers/vanilla/device.nix
+++ b/routers/vanilla/device.nix
@@ -1,86 +0,0 @@
-# This "device" generates images that can be used with the QEMU
-# emulator. The default output is a directory containing separate
-# kernel (uncompressed vmlinux) and initrd (squashfs) images
-{ inputs }:
-{
-  system = {
-    crossSystem = {
-      config = "mips-unknown-linux-musl";
-      gcc = {
-        abi = "32";
-        arch = "mips32"; # maybe mips_24kc-
-      };
-    };
-  };
-
-  description = ''
-    QEMU MIPS
-    *********
-
-    This target produces an image for
-    QEMU, the "generic and open source machine emulator and
-    virtualizer".
-
-    MIPS QEMU emulates a "Malta" board, which was an ATX form factor
-    evaluation board made by MIPS Technologies, but mostly in Liminix
-    we use paravirtualized devices (Virtio) instead of emulating
-    hardware.
-
-    Building an image for QEMU results in a :file:`result/` directory
-    containing ``run.sh`` ``vmlinux``, and ``rootfs`` files. To invoke
-    the emulator, run ``run.sh``.
-
-    The configuration includes two emulated "hardware" ethernet
-    devices and the kernel :code:`mac80211_hwsim` module to
-    provide an emulated wlan device. To read more about how
-    to connect to this network, refer to :ref:`qemu-networking`
-    in the Development manual.
-
-  '';
-  module =
-    {
-      config,
-      lib,
-      lim,
-      ...
-    }:
-    {
-      imports = [
-        "${inputs.liminix}/modules/arch/mipseb.nix"
-        "${inputs.liminix}/devices/families/qemu.nix"
-      ];
-      kernel = {
-        config = {
-          MIPS_MALTA = "y";
-          CPU_MIPS32_R2 = "y";
-
-          POWER_RESET = "y";
-          POWER_RESET_SYSCON = "y";
-
-          SERIAL_8250 = "y";
-          SERIAL_8250_CONSOLE = "y";
-        };
-      };
-      hardware =
-        # from arch/mips/mti-malta/Platform:load-$(CONFIG_MIPS_MALTA)  += 0xffffffff80100000
-        let
-          addr = lim.parseInt "0x80100000";
-        in
-        {
-          loadAddress = addr;
-          entryPoint = addr;
-
-          # Unlike the arm qemu targets, we need a static dts when
-          # running u-boot-using tests, qemu dumpdtb command doesn't
-          # work for this board. I am not at all sure this dts is
-          # *correct* but it does at least boot
-          dts = lib.mkForce {
-            src = "${config.system.outputs.kernel.modulesupport}/arch/mips/boot/dts/mti/malta.dts";
-            includePaths = [
-              "${config.system.outputs.kernel.modulesupport}/arch/mips/boot/dts/"
-            ];
-          };
-
-        };
-    };
-}
--- a/routers/white-house/configuration.nix
+++ b/routers/white-house/configuration.nix
@@ -0,0 +1,120 @@
+{ inputs }:
+{
+  config,
+  pkgs,
+  modulesPath,
+  lib,
+  ...
+}:
+let
+  secrets = {
+    firewallRules = { };
+  }
+  // (import ./secrets.nix);
+  wirelessConfig = {
+    country_code = "TH";
+    inherit (secrets) wpa_passphrase;
+    wmm_enabled = 1;
+  };
+  svc = config.system.service;
+in
+{
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/network"
+    "${inputs.liminix}/modules/vlan"
+    "${inputs.liminix}/modules/ssh"
+    "${inputs.liminix}/modules/bridge"
+    "${modulesPath}/profiles/gateway.nix"
+  ];
+
+  hostname = "whitehouse";
+  boot = {
+    tftp = {
+      freeSpaceBytes = 3 * 1024 * 1024;
+      serverip = "${secrets.lan.prefix}.148";
+      ipaddr = "${secrets.lan.prefix}.251";
+    };
+  };
+
+  services.sshd = svc.ssh.build {
+    authorizedKeys.root = secrets.root.openssh.authorizedKeys.keys;
+  };
+
+  users.root = secrets.root;
+
+  services.resolvconf = lib.mkForce (
+    pkgs.liminix.services.oneshot rec {
+      name = "resolvconf";
+      up = ''
+        ( in_outputs ${name}
+         echo "nameserver $(output ${config.services.wan} ns1)" > resolv.conf
+         echo "nameserver $(output ${config.services.wan} ns2)" >> resolv.conf
+         chmod 0444 resolv.conf
+        )
+      '';
+    }
+  );
+
+  profile.gateway = {
+    lan = {
+      interfaces = with config.hardware.networkInterfaces; [
+        wlan
+        wlan5
+        lan
+      ];
+      inherit (secrets.lan) prefix;
+      address = {
+        family = "inet";
+        address = "${secrets.lan.prefix}.1";
+        prefixLength = 24;
+      };
+      dhcp = {
+        start = 10;
+        end = 240;
+        hosts = { };
+        localDomain = "lan";
+      };
+    };
+    wan = {
+      interface = svc.pppoe.build {
+        interface = config.hardware.networkInterfaces.wan;
+        username = secrets.l2tp.name;
+        password = secrets.l2tp.password;
+      };
+
+      dhcp6.enable = true;
+    };
+    firewall = {
+      enable = true;
+      rules = secrets.firewallRules;
+    };
+    wireless.networks = {
+
+      "${secrets.ssid}" = {
+        interface = config.hardware.networkInterfaces.wlan;
+        hw_mode = "g";
+        channel = "2";
+        ieee80211n = 1;
+      }
+      // wirelessConfig;
+      "${secrets.ssid}-5" = rec {
+        interface = config.hardware.networkInterfaces.wlan5;
+        hw_mode = "a";
+        channel = 36;
+        ht_capab = "[HT40+]";
+        vht_oper_chwidth = 1;
+        vht_oper_centr_freq_seg0_idx = channel + 6;
+        ieee80211n = 1;
+        ieee80211ac = 1;
+      }
+      // wirelessConfig;
+    };
+  };
+  defaultProfile.packages = with pkgs; [
+    busybox
+    iw
+    iptables
+  ];
+
+}
--- a/routers/white-house/secrets.nix
+++ b/routers/white-house/secrets.nix
@@ -0,0 +1,20 @@
+{
+  wpa_passphrase = "";
+  ssid = "WhiteHouse";
+  l2tp = {
+    name = "";
+    password = "";
+  };
+  root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387"
+    ];
+  };
+
+  lan = {
+    prefix = "192.168.1";
+  };
+}
--- a/routers/yada-house/configuration.nix
+++ b/routers/yada-house/configuration.nix
@@ -1,54 +0,0 @@
-{ inputs }:
-
-{
-  config,
-  pkgs,
-  ...
-}:
-let
-  svc = config.system.service;
-
-in
-rec {
-  imports = [
-    "${inputs.liminix}/modules/network"
-    "${inputs.liminix}/modules/dnsmasq"
-    "${inputs.liminix}/modules/ssh"
-  ];
-
-  hostname = "hello";
-
-  # configure the internal network (LAN) with an address
-  services.int = svc.network.address.build {
-    interface = config.hardware.networkInterfaces.lan2;
-    family = "inet";
-    address = "192.168.8.1";
-    prefixLength = 24;
-  };
-
-  services.sshd = svc.ssh.build { };
-
-  users.root = {
-    # the password is "secret". Use mkpasswd -m sha512crypt to
-    # create this hashed password string
-    passwd = "$6$y7WZ5hM6l5nriLmo$5AJlmzQZ6WA.7uBC7S8L4o19ESR28Dg25v64/vDvvCN01Ms9QoHeGByj8lGlJ4/b.dbwR9Hq2KXurSnLigt1W1";
-  };
-
-  services.dns =
-    let
-      interface = services.int;
-    in
-    svc.dnsmasq.build {
-      inherit interface;
-      ranges = [
-        "192.168.8.1,192.168.8.240"
-        "::,constructor:$(output ${interface} ifname),ra-stateless"
-      ];
-
-      domain = "example.org";
-    };
-
-  # defaultProfile.packages = with pkgs; [
-  #   figlet
-  # ];
-}
--- a/routers/yada-house/device.nix
+++ b/routers/yada-house/device.nix
@@ -1,127 +0,0 @@
-# GL.iNet GL-MT6000
-{ inputs }:
-{
-  system = {
-    crossSystem = {
-      config = "aarch64-unknown-linux-musl";
-      gcc = {
-        arch = "armv8-a";
-      };
-    };
-  };
-
-  description = ''
-    Device configuration for Yada/White house router.
-  '';
-
-  module =
-    {
-      pkgs,
-      config,
-      lib,
-      lim,
-      ...
-    }:
-    let
-      inherit (pkgs) openwrt_24_10;
-      # mac80211 = pkgs.kmodloader.override {
-      #   targets = [ "rt2800soc" ];
-      #   inherit (config.system.outputs) kernel;
-      # };
-    in
-    {
-      imports = [
-        "${inputs.liminix}/modules/outputs/mtdimage.nix"
-        "${inputs.liminix}/modules/outputs/squashfs.nix"
-        "${inputs.liminix}/modules/outputs/tftpboot.nix"
-        "${inputs.liminix}/modules/outputs/vmroot.nix"
-        "${inputs.liminix}/modules/arch/aarch64.nix"
-        # "${inputs.liminix}/modules/base.nix"
-        "${inputs.liminix}/modules/vlan"
-      ];
-      boot.tftp = {
-        serverip = "192.168.1.254";
-        ipaddr = "192.168.1.1";
-        loadAddress = lim.parseInt "0x46000000";
-      };
-      boot.imageFormat = "fit";
-      boot.loader.fit.enable = true;
-      rootfsType = "squashfs";
-      hardware = {
-        loadAddress = lim.parseInt "0x48080000";
-        entryPoint = lim.parseInt "0x48080000";
-
-        flash = {
-          address = lim.parseInt "0x41e00000";
-          size = lim.parseInt "0x4000";
-          eraseBlockSize = 65536;
-        };
-        rootDevice = "/dev/root";
-
-        dts = {
-          src = "${openwrt_24_10.src}/target/linux/mediatek/dts/mt7986a-glinet-gl-mt6000.dts";
-          includePaths = [
-            "${openwrt_24_10.src}/target/linux/mediatek/dts"
-            "${config.system.outputs.kernel.modulesupport}/arch/arm64/boot/dts/mediatek/"
-          ];
-        };
-        networkInterfaces =
-          let
-            inherit (config.system.service.network) link;
-            inherit (config.system.service) vlan;
-          in
-          rec {
-            eth0 = link.build { ifname = "eth0"; };
-            wan = link.build { ifname = "eth1"; };
-
-            lan1 = vlan.build {
-              ifname = "lan1@eth0";
-              primary = eth0;
-              vid = "1";
-            };
-            lan2 = vlan.build {
-              ifname = "lan2@eth0";
-              primary = eth0;
-              vid = "2";
-            };
-            lan3 = vlan.build {
-              ifname = "lan3@eth0";
-              primary = eth0;
-              vid = "3";
-            };
-            lan4 = vlan.build {
-              ifname = "lan4@eth0";
-              primary = eth0;
-              vid = "4";
-            };
-            lan5 = vlan.build {
-              ifname = "lan5@eth0";
-              primary = eth0;
-              vid = "5";
-            };
-
-            # wlan = link.build {
-            #   ifname = "wlan0";
-            #   dependencies = [ mac80211 ];
-            # };
-          };
-      };
-
-      kernel = {
-        src = openwrt_24_10.kernelSrc;
-        version = openwrt_24_10.kernelVersion;
-        extraPatchPhase = ''
-          echo ==================================================
-          ls ${openwrt_24_10.src}/config
-          echo ==================================================
-          patch ${openwrt_24_10.src}/package/boot/uboot-mediatek/patches/436-add-glinet-mt6000.patch
-          echo --------------------------------------------------
-          ls ${openwrt_24_10.src}/config
-          echo --------------------------------------------------
-          ${openwrt_24_10.applyPatches.mediatek}
-        '';
-        config = {
-        };
-      };
-    };
-}
--- a/routers/yada-house/dts/mt7986a.dtsi
+++ b/routers/yada-house/dts/mt7986a.dtsi
@@ -1,645 +0,0 @@
-// SPDX-License-Identifier: (GPL-2.0 OR MIT)
-/*
- * Copyright (C) 2021 MediaTek Inc.
- * Author: Sam.Shih <sam.shih@mediatek.com>
- */
-
-#include <dt-bindings/interrupt-controller/irq.h>
-#include <dt-bindings/interrupt-controller/arm-gic.h>
-#include <dt-bindings/clock/mt7986-clk.h>
-#include <dt-bindings/reset/mt7986-resets.h>
-#include <dt-bindings/phy/phy.h>
-
-/ {
-	compatible = "mediatek,mt7986a";
-	interrupt-parent = <&gic>;
-	#address-cells = <2>;
-	#size-cells = <2>;
-
-	cpus {
-		#address-cells = <1>;
-		#size-cells = <0>;
-		cpu0: cpu@0 {
-			compatible = "arm,cortex-a53";
-			reg = <0x0>;
-			device_type = "cpu";
-			enable-method = "psci";
-			#cooling-cells = <2>;
-		};
-
-		cpu1: cpu@1 {
-			compatible = "arm,cortex-a53";
-			reg = <0x1>;
-			device_type = "cpu";
-			enable-method = "psci";
-			#cooling-cells = <2>;
-		};
-
-		cpu2: cpu@2 {
-			compatible = "arm,cortex-a53";
-			reg = <0x2>;
-			device_type = "cpu";
-			enable-method = "psci";
-			#cooling-cells = <2>;
-		};
-
-		cpu3: cpu@3 {
-			compatible = "arm,cortex-a53";
-			reg = <0x3>;
-			device_type = "cpu";
-			enable-method = "psci";
-			#cooling-cells = <2>;
-		};
-	};
-
-	clk40m: oscillator-40m {
-		compatible = "fixed-clock";
-		clock-frequency = <40000000>;
-		#clock-cells = <0>;
-		clock-output-names = "clkxtal";
-	};
-
-	psci {
-		compatible = "arm,psci-0.2";
-		method = "smc";
-	};
-
-	reserved-memory {
-		#address-cells = <2>;
-		#size-cells = <2>;
-		ranges;
-		/* 192 KiB reserved for ARM Trusted Firmware (BL31) */
-		secmon_reserved: secmon@43000000 {
-			reg = <0 0x43000000 0 0x30000>;
-			no-map;
-		};
-
-		wmcpu_emi: wmcpu-reserved@4fc00000 {
-			no-map;
-			reg = <0 0x4fc00000 0 0x00100000>;
-		};
-
-		wo_emi0: wo-emi@4fd00000 {
-			reg = <0 0x4fd00000 0 0x40000>;
-			no-map;
-		};
-
-		wo_emi1: wo-emi@4fd40000 {
-			reg = <0 0x4fd40000 0 0x40000>;
-			no-map;
-		};
-
-		wo_ilm0: wo-ilm@151e0000 {
-			reg = <0 0x151e0000 0 0x8000>;
-			no-map;
-		};
-
-		wo_ilm1: wo-ilm@151f0000 {
-			reg = <0 0x151f0000 0 0x8000>;
-			no-map;
-		};
-
-		wo_data: wo-data@4fd80000 {
-			reg = <0 0x4fd80000 0 0x240000>;
-			no-map;
-		};
-
-		wo_dlm0: wo-dlm@151e8000 {
-			reg = <0 0x151e8000 0 0x2000>;
-			no-map;
-		};
-
-		wo_dlm1: wo-dlm@151f8000 {
-			reg = <0 0x151f8000 0 0x2000>;
-			no-map;
-		};
-
-		wo_boot: wo-boot@15194000 {
-			reg = <0 0x15194000 0 0x1000>;
-			no-map;
-		};
-
-	};
-
-	soc {
-		compatible = "simple-bus";
-		ranges;
-		#address-cells = <2>;
-		#size-cells = <2>;
-
-		gic: interrupt-controller@c000000 {
-			compatible = "arm,gic-v3";
-			reg = <0 0x0c000000 0 0x10000>,  /* GICD */
-			      <0 0x0c080000 0 0x80000>,  /* GICR */
-			      <0 0x0c400000 0 0x2000>,   /* GICC */
-			      <0 0x0c410000 0 0x1000>,   /* GICH */
-			      <0 0x0c420000 0 0x2000>;   /* GICV */
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-controller;
-			#interrupt-cells = <3>;
-		};
-
-		infracfg: infracfg@10001000 {
-			compatible = "mediatek,mt7986-infracfg", "syscon";
-			reg = <0 0x10001000 0 0x1000>;
-			#clock-cells = <1>;
-			#reset-cells = <1>;
-		};
-
-		wed_pcie: wed-pcie@10003000 {
-			compatible = "mediatek,mt7986-wed-pcie",
-				     "syscon";
-			reg = <0 0x10003000 0 0x10>;
-		};
-
-		topckgen: topckgen@1001b000 {
-			compatible = "mediatek,mt7986-topckgen", "syscon";
-			reg = <0 0x1001B000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
-		watchdog: watchdog@1001c000 {
-			compatible = "mediatek,mt7986-wdt";
-			reg = <0 0x1001c000 0 0x1000>;
-			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
-			#reset-cells = <1>;
-			status = "disabled";
-		};
-
-		apmixedsys: apmixedsys@1001e000 {
-			compatible = "mediatek,mt7986-apmixedsys";
-			reg = <0 0x1001E000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
-		pio: pinctrl@1001f000 {
-			compatible = "mediatek,mt7986a-pinctrl";
-			reg = <0 0x1001f000 0 0x1000>,
-			      <0 0x11c30000 0 0x1000>,
-			      <0 0x11c40000 0 0x1000>,
-			      <0 0x11e20000 0 0x1000>,
-			      <0 0x11e30000 0 0x1000>,
-			      <0 0x11f00000 0 0x1000>,
-			      <0 0x11f10000 0 0x1000>,
-			      <0 0x1000b000 0 0x1000>;
-			reg-names = "gpio", "iocfg_rt", "iocfg_rb", "iocfg_lt",
-				    "iocfg_lb", "iocfg_tr", "iocfg_tl", "eint";
-			gpio-controller;
-			#gpio-cells = <2>;
-			gpio-ranges = <&pio 0 0 100>;
-			interrupt-controller;
-			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-parent = <&gic>;
-			#interrupt-cells = <2>;
-		};
-
-		pwm: pwm@10048000 {
-			compatible = "mediatek,mt7986-pwm";
-			reg = <0 0x10048000 0 0x1000>;
-			#pwm-cells = <2>;
-			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&topckgen CLK_TOP_PWM_SEL>,
-				 <&infracfg CLK_INFRA_PWM_STA>,
-				 <&infracfg CLK_INFRA_PWM1_CK>,
-				 <&infracfg CLK_INFRA_PWM2_CK>;
-			clock-names = "top", "main", "pwm1", "pwm2";
-			status = "disabled";
-		};
-
-		sgmiisys0: syscon@10060000 {
-			compatible = "mediatek,mt7986-sgmiisys_0",
-				     "syscon";
-			reg = <0 0x10060000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
-		sgmiisys1: syscon@10070000 {
-			compatible = "mediatek,mt7986-sgmiisys_1",
-				     "syscon";
-			reg = <0 0x10070000 0 0x1000>;
-			#clock-cells = <1>;
-		};
-
-		trng: rng@1020f000 {
-			compatible = "mediatek,mt7986-rng",
-				     "mediatek,mt7623-rng";
-			reg = <0 0x1020f000 0 0x100>;
-			clocks = <&infracfg CLK_INFRA_TRNG_CK>;
-			clock-names = "rng";
-			status = "disabled";
-		};
-
-		crypto: crypto@10320000 {
-			compatible = "inside-secure,safexcel-eip97";
-			reg = <0 0x10320000 0 0x40000>;
-			interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
-			interrupt-names = "ring0", "ring1", "ring2", "ring3";
-			clocks = <&infracfg CLK_INFRA_EIP97_CK>;
-			assigned-clocks = <&topckgen CLK_TOP_EIP_B_SEL>;
-			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>;
-			status = "disabled";
-		};
-
-		uart0: serial@11002000 {
-			compatible = "mediatek,mt7986-uart",
-				     "mediatek,mt6577-uart";
-			reg = <0 0x11002000 0 0x400>;
-			interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_UART0_SEL>,
-				 <&infracfg CLK_INFRA_UART0_CK>;
-			clock-names = "baud", "bus";
-			assigned-clocks = <&topckgen CLK_TOP_UART_SEL>,
-					  <&infracfg CLK_INFRA_UART0_SEL>;
-			assigned-clock-parents = <&topckgen CLK_TOP_XTAL>,
-						 <&topckgen CLK_TOP_UART_SEL>;
-			status = "disabled";
-		};
-
-		uart1: serial@11003000 {
-			compatible = "mediatek,mt7986-uart",
-				     "mediatek,mt6577-uart";
-			reg = <0 0x11003000 0 0x400>;
-			interrupts = <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_UART1_SEL>,
-				 <&infracfg CLK_INFRA_UART1_CK>;
-			clock-names = "baud", "bus";
-			assigned-clocks = <&infracfg CLK_INFRA_UART1_SEL>;
-			assigned-clock-parents = <&topckgen CLK_TOP_F26M_SEL>;
-			status = "disabled";
-		};
-
-		uart2: serial@11004000 {
-			compatible = "mediatek,mt7986-uart",
-				     "mediatek,mt6577-uart";
-			reg = <0 0x11004000 0 0x400>;
-			interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_UART2_SEL>,
-				 <&infracfg CLK_INFRA_UART2_CK>;
-			clock-names = "baud", "bus";
-			assigned-clocks = <&infracfg CLK_INFRA_UART2_SEL>;
-			assigned-clock-parents = <&topckgen CLK_TOP_F26M_SEL>;
-			status = "disabled";
-		};
-
-		i2c0: i2c@11008000 {
-			compatible = "mediatek,mt7986-i2c";
-			reg = <0 0x11008000 0 0x90>,
-			      <0 0x10217080 0 0x80>;
-			interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
-			clock-div = <5>;
-			clocks = <&infracfg CLK_INFRA_I2C0_CK>,
-				 <&infracfg CLK_INFRA_AP_DMA_CK>;
-			clock-names = "main", "dma";
-			#address-cells = <1>;
-			#size-cells = <0>;
-			status = "disabled";
-		};
-
-		spi0: spi@1100a000 {
-			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
-			reg = <0 0x1100a000 0 0x100>;
-			#address-cells = <1>;
-			#size-cells = <0>;
-			interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&topckgen CLK_TOP_MPLL_D2>,
-				 <&topckgen CLK_TOP_SPI_SEL>,
-				 <&infracfg CLK_INFRA_SPI0_CK>,
-				 <&infracfg CLK_INFRA_SPI0_HCK_CK>;
-			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
-			status = "disabled";
-		};
-
-		spi1: spi@1100b000 {
-			compatible = "mediatek,mt7986-spi-ipm", "mediatek,spi-ipm";
-			reg = <0 0x1100b000 0 0x100>;
-			#address-cells = <1>;
-			#size-cells = <0>;
-			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&topckgen CLK_TOP_MPLL_D2>,
-				 <&topckgen CLK_TOP_SPIM_MST_SEL>,
-				 <&infracfg CLK_INFRA_SPI1_CK>,
-				 <&infracfg CLK_INFRA_SPI1_HCK_CK>;
-			clock-names = "parent-clk", "sel-clk", "spi-clk", "hclk";
-			status = "disabled";
-		};
-
-		thermal: thermal@1100c800 {
-			compatible = "mediatek,mt7986-thermal";
-			reg = <0 0x1100c800 0 0x800>;
-			interrupts = <GIC_SPI 138 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_THERM_CK>,
-				 <&infracfg CLK_INFRA_ADC_26M_CK>;
-			clock-names = "therm", "auxadc";
-			nvmem-cells = <&thermal_calibration>;
-			nvmem-cell-names = "calibration-data";
-			#thermal-sensor-cells = <1>;
-			mediatek,auxadc = <&auxadc>;
-			mediatek,apmixedsys = <&apmixedsys>;
-		};
-
-		auxadc: adc@1100d000 {
-			compatible = "mediatek,mt7986-auxadc";
-			reg = <0 0x1100d000 0 0x1000>;
-			clocks = <&infracfg CLK_INFRA_ADC_26M_CK>;
-			clock-names = "main";
-			#io-channel-cells = <1>;
-			status = "disabled";
-		};
-
-		ssusb: usb@11200000 {
-			compatible = "mediatek,mt7986-xhci",
-				     "mediatek,mtk-xhci";
-			reg = <0 0x11200000 0 0x2e00>,
-			      <0 0x11203e00 0 0x0100>;
-			reg-names = "mac", "ippc";
-			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&infracfg CLK_INFRA_IUSB_SYS_CK>,
-				 <&infracfg CLK_INFRA_IUSB_CK>,
-				 <&infracfg CLK_INFRA_IUSB_133_CK>,
-				 <&infracfg CLK_INFRA_IUSB_66M_CK>,
-				 <&topckgen CLK_TOP_U2U3_XHCI_SEL>;
-			clock-names = "sys_ck",
-				      "ref_ck",
-				      "mcu_ck",
-				      "dma_ck",
-				      "xhci_ck";
-			phys = <&u2port0 PHY_TYPE_USB2>,
-			       <&u3port0 PHY_TYPE_USB3>,
-			       <&u2port1 PHY_TYPE_USB2>;
-			status = "disabled";
-		};
-
-		mmc0: mmc@11230000 {
-			compatible = "mediatek,mt7986-mmc";
-			reg = <0 0x11230000 0 0x1000>,
-			      <0 0x11c20000 0 0x1000>;
-			interrupts = <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
-			assigned-clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
-					  <&topckgen CLK_TOP_EMMC_250M_SEL>;
-			assigned-clock-parents = <&apmixedsys CLK_APMIXED_MPLL>,
-						 <&topckgen CLK_TOP_NET1PLL_D5_D2>;
-			clocks = <&topckgen CLK_TOP_EMMC_416M_SEL>,
-				 <&infracfg CLK_INFRA_MSDC_HCK_CK>,
-				 <&infracfg CLK_INFRA_MSDC_CK>,
-				 <&infracfg CLK_INFRA_MSDC_133M_CK>,
-				 <&infracfg CLK_INFRA_MSDC_66M_CK>;
-			clock-names = "source", "hclk", "source_cg", "bus_clk",
-				      "sys_cg";
-			status = "disabled";
-		};
-
-		pcie: pcie@11280000 {
-			compatible = "mediatek,mt7986-pcie",
-				     "mediatek,mt8192-pcie";
-			reg = <0x00 0x11280000 0x00 0x4000>;
-			reg-names = "pcie-mac";
-			ranges = <0x82000000 0x00 0x20000000 0x00
-				  0x20000000 0x00 0x10000000>;
-			device_type = "pci";
-			#address-cells = <3>;
-			#size-cells = <2>;
-			interrupts = <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>;
-			bus-range = <0x00 0xff>;
-			clocks = <&infracfg CLK_INFRA_IPCIE_PIPE_CK>,
-				 <&infracfg CLK_INFRA_IPCIE_CK>,
-				 <&infracfg CLK_INFRA_IPCIER_CK>,
-				 <&infracfg CLK_INFRA_IPCIEB_CK>;
-			clock-names = "pl_250m", "tl_26m", "peri_26m", "top_133m";
-
-			phys = <&pcie_port PHY_TYPE_PCIE>;
-			phy-names = "pcie-phy";
-
-			#interrupt-cells = <1>;
-			interrupt-map-mask = <0 0 0 0x7>;
-			interrupt-map = <0 0 0 1 &pcie_intc 0>,
-					<0 0 0 2 &pcie_intc 1>,
-					<0 0 0 3 &pcie_intc 2>,
-					<0 0 0 4 &pcie_intc 3>;
-			status = "disabled";
-
-			pcie_intc: interrupt-controller {
-				#address-cells = <0>;
-				#interrupt-cells = <1>;
-				interrupt-controller;
-			};
-		};
-
-		pcie_phy: t-phy {
-			compatible = "mediatek,mt7986-tphy",
-				     "mediatek,generic-tphy-v2";
-			ranges;
-			#address-cells = <2>;
-			#size-cells = <2>;
-			status = "disabled";
-
-			pcie_port: pcie-phy@11c00000 {
-				reg = <0 0x11c00000 0 0x20000>;
-				clocks = <&clk40m>;
-				clock-names = "ref";
-				#phy-cells = <1>;
-			};
-		};
-
-		efuse: efuse@11d00000 {
-			compatible = "mediatek,mt7986-efuse", "mediatek,efuse";
-			reg = <0 0x11d00000 0 0x1000>;
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			thermal_calibration: calib@274 {
-				reg = <0x274 0xc>;
-			};
-		};
-
-		usb_phy: t-phy@11e10000 {
-			compatible = "mediatek,mt7986-tphy",
-				     "mediatek,generic-tphy-v2";
-			ranges = <0 0 0x11e10000 0x1700>;
-			#address-cells = <1>;
-			#size-cells = <1>;
-			status = "disabled";
-
-			u2port0: usb-phy@0 {
-				reg = <0x0 0x700>;
-				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
-					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
-				clock-names = "ref", "da_ref";
-				#phy-cells = <1>;
-			};
-
-			u3port0: usb-phy@700 {
-				reg = <0x700 0x900>;
-				clocks = <&topckgen CLK_TOP_USB3_PHY_SEL>;
-				clock-names = "ref";
-				#phy-cells = <1>;
-			};
-
-			u2port1: usb-phy@1000 {
-				reg = <0x1000 0x700>;
-				clocks = <&topckgen CLK_TOP_DA_U2_REFSEL>,
-					 <&topckgen CLK_TOP_DA_U2_CK_1P_SEL>;
-				clock-names = "ref", "da_ref";
-				#phy-cells = <1>;
-			};
-		};
-
-		ethsys: syscon@15000000 {
-			 compatible = "mediatek,mt7986-ethsys",
-				      "syscon";
-			 reg = <0 0x15000000 0 0x1000>;
-			 #clock-cells = <1>;
-			 #reset-cells = <1>;
-		};
-
-		wed0: wed@15010000 {
-			compatible = "mediatek,mt7986-wed",
-				     "syscon";
-			reg = <0 0x15010000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
-			memory-region = <&wo_emi0>, <&wo_ilm0>, <&wo_dlm0>,
-					<&wo_data>, <&wo_boot>;
-			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
-					      "wo-data", "wo-boot";
-			mediatek,wo-ccif = <&wo_ccif0>;
-		};
-
-		wed1: wed@15011000 {
-			compatible = "mediatek,mt7986-wed",
-				     "syscon";
-			reg = <0 0x15011000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
-			memory-region = <&wo_emi1>, <&wo_ilm1>, <&wo_dlm1>,
-					<&wo_data>, <&wo_boot>;
-			memory-region-names = "wo-emi", "wo-ilm", "wo-dlm",
-					      "wo-data", "wo-boot";
-			mediatek,wo-ccif = <&wo_ccif1>;
-		};
-
-		eth: ethernet@15100000 {
-			compatible = "mediatek,mt7986-eth";
-			reg = <0 0x15100000 0 0x80000>;
-			interrupts = <GIC_SPI 196 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 198 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 199 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&ethsys CLK_ETH_FE_EN>,
-				 <&ethsys CLK_ETH_GP2_EN>,
-				 <&ethsys CLK_ETH_GP1_EN>,
-				 <&ethsys CLK_ETH_WOCPU1_EN>,
-				 <&ethsys CLK_ETH_WOCPU0_EN>,
-				 <&sgmiisys0 CLK_SGMII0_TX250M_EN>,
-				 <&sgmiisys0 CLK_SGMII0_RX250M_EN>,
-				 <&sgmiisys0 CLK_SGMII0_CDR_REF>,
-				 <&sgmiisys0 CLK_SGMII0_CDR_FB>,
-				 <&sgmiisys1 CLK_SGMII1_TX250M_EN>,
-				 <&sgmiisys1 CLK_SGMII1_RX250M_EN>,
-				 <&sgmiisys1 CLK_SGMII1_CDR_REF>,
-				 <&sgmiisys1 CLK_SGMII1_CDR_FB>,
-				 <&topckgen CLK_TOP_NETSYS_SEL>,
-				 <&topckgen CLK_TOP_NETSYS_500M_SEL>;
-			clock-names = "fe", "gp2", "gp1", "wocpu1", "wocpu0",
-				      "sgmii_tx250m", "sgmii_rx250m",
-				      "sgmii_cdr_ref", "sgmii_cdr_fb",
-				      "sgmii2_tx250m", "sgmii2_rx250m",
-				      "sgmii2_cdr_ref", "sgmii2_cdr_fb",
-				      "netsys0", "netsys1";
-			assigned-clocks = <&topckgen CLK_TOP_NETSYS_2X_SEL>,
-					  <&topckgen CLK_TOP_SGM_325M_SEL>;
-			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>,
-						 <&apmixedsys CLK_APMIXED_SGMPLL>;
-			#address-cells = <1>;
-			#size-cells = <0>;
-			mediatek,ethsys = <&ethsys>;
-			mediatek,sgmiisys = <&sgmiisys0>, <&sgmiisys1>;
-			mediatek,wed-pcie = <&wed_pcie>;
-			mediatek,wed = <&wed0>, <&wed1>;
-			status = "disabled";
-		};
-
-		wo_ccif0: syscon@151a5000 {
-			compatible = "mediatek,mt7986-wo-ccif", "syscon";
-			reg = <0 0x151a5000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
-		};
-
-		wo_ccif1: syscon@151ad000 {
-			compatible = "mediatek,mt7986-wo-ccif", "syscon";
-			reg = <0 0x151ad000 0 0x1000>;
-			interrupt-parent = <&gic>;
-			interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
-		};
-
-		wifi: wifi@18000000 {
-			compatible = "mediatek,mt7986-wmac";
-			reg = <0 0x18000000 0 0x1000000>,
-			      <0 0x10003000 0 0x1000>,
-			      <0 0x11d10000 0 0x1000>;
-			resets = <&watchdog MT7986_TOPRGU_CONSYS_SW_RST>;
-			reset-names = "consys";
-			clocks = <&topckgen CLK_TOP_CONN_MCUSYS_SEL>,
-				 <&topckgen CLK_TOP_AP2CNN_HOST_SEL>;
-			clock-names = "mcu", "ap2conn";
-			interrupts = <GIC_SPI 213 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 214 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 215 IRQ_TYPE_LEVEL_HIGH>,
-				     <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>;
-			memory-region = <&wmcpu_emi>;
-		};
-	};
-
-	thermal-zones {
-		cpu_thermal: cpu-thermal {
-			polling-delay-passive = <1000>;
-			polling-delay = <1000>;
-			thermal-sensors = <&thermal 0>;
-
-			trips {
-				cpu_trip_crit: crit {
-					temperature = <125000>;
-					hysteresis = <2000>;
-					type = "critical";
-				};
-
-				cpu_trip_hot: hot {
-					temperature = <120000>;
-					hysteresis = <2000>;
-					type = "hot";
-				};
-
-				cpu_trip_active_high: active-high {
-					temperature = <115000>;
-					hysteresis = <2000>;
-					type = "active";
-				};
-
-				cpu_trip_active_med: active-med {
-					temperature = <85000>;
-					hysteresis = <2000>;
-					type = "active";
-				};
-
-				cpu_trip_active_low: active-low {
-					temperature = <60000>;
-					hysteresis = <2000>;
-					type = "active";
-				};
-			};
-		};
-	};
-
-	timer {
-		compatible = "arm,armv8-timer";
-		interrupt-parent = <&gic>;
-		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
-			     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
-	};
-};
--- a/routers/yada-house/kconf-from-device.txt
+++ b/routers/yada-house/kconf-from-device.txt
--- a/routers/yada-house/kconf-from-openwrt.txt
+++ b/routers/yada-house/kconf-from-openwrt.txt
@@ -1,103 +0,0 @@
-ARM="y";
-SYS_HAS_NONCACHED_MEMORY="y";
-POSITION_INDEPENDENT="y";
-ARCH_MEDIATEK="y";
-TEXT_BASE="0x41e00000";
-SYS_MALLOC_F_LEN="0x4000";
-NR_DRAM_BANKS="1";
-ENV_SIZE="0x80000";
-ENV_OFFSET="0x400000";
-DEFAULT_DEVICE_TREE="mt7986a-glinet-gl-mt6000";
-OF_LIBFDT_OVERLAY="y";
-TARGET_MT7986="y";
-SYS_LOAD_ADDR="0x46000000";
-PRE_CON_BUF_ADDR="0x4007EF00";
-DEBUG_UART_BASE="0x11002000";
-DEBUG_UART_CLOCK="40000000";
-DEBUG_UART="y";
-AHCI="y";
-FIT="y";
-AUTOBOOT_KEYED="y";
-AUTOBOOT_MENU_SHOW="y";
-DEFAULT_FDT_FILE="mediatek/mt7986a-glinet-gl-mt6000.dtb";
-LOGLEVEL="7";
-PRE_CONSOLE_BUFFER="y";
-LOG="y";
-BOARD_LATE_INIT="y";
-HUSH_PARSER="y";
-SYS_PROMPT="MT7986> ";
-CMD_CPU="y";
-CMD_LICENSE="y";
-CMD_BOOTMENU="y";
-CMD_ASKENV="y";
-CMD_ERASEENV="y";
-CMD_ENV_FLAGS="y";
-CMD_STRINGS="y";
-CMD_DM="y";
-CMD_GPIO="y";
-CMD_PWM="y";
-CMD_GPT="y";
-CMD_MMC="y";
-CMD_PART="y";
-CMD_USB="y";
-CMD_TFTPSRV="y";
-CMD_RARP="y";
-CMD_CDP="y";
-CMD_SNTP="y";
-CMD_LINK_LOCAL="y";
-CMD_DHCP="y";
-CMD_DNS="y";
-CMD_PING="y";
-CMD_CACHE="y";
-CMD_PSTORE="y";
-CMD_PSTORE_MEM_ADDR="0x42ff0000";
-CMD_UUID="y";
-CMD_HASH="y";
-CMD_SMC="y";
-OF_EMBED="y";
-ENV_OVERWRITE="y";
-ENV_IS_IN_MMC="y";
-SYS_RELOC_GD_ENV_ADDR="y";
-USE_DEFAULT_ENV_FILE="y";
-DEFAULT_ENV_FILE="defenvs/glinet_gl-mt6000_env";
-ENV_VARS_UBOOT_RUNTIME_CONFIG="y";
-VERSION_VARIABLE="y";
-NETCONSOLE="y";
-USE_IPADDR="y";
-IPADDR="192.168.1.1";
-USE_SERVERIP="y";
-SERVERIP="192.168.1.254";
-NET_RANDOM_ETHADDR="y";
-BUTTON="y";
-BUTTON_GPIO="y";
-CLK="y";
-GPIO_HOG="y";
-LED="y";
-LED_BLINK="y";
-LED_GPIO="y";
-SUPPORT_EMMC_BOOT="y";
-MMC_HS200_SUPPORT="y";
-MMC_MTK="y";
-PHY_FIXED="y";
-MEDIATEK_ETH="y";
-PHY="y";
-PHY_MTK_TPHY="y";
-PINCTRL="y";
-PINCONF="y";
-PINCTRL_MT7986="y";
-POWER_DOMAIN="y";
-MTK_POWER_DOMAIN="y";
-DM_REGULATOR="y";
-DM_REGULATOR_FIXED="y";
-DM_REGULATOR_GPIO="y";
-DM_PWM="y";
-PWM_MTK="y";
-RAM="y";
-DM_SERIAL="y";
-SERIAL_RX_BUFFER="y";
-MTK_SERIAL="y";
-USB="y";
-USB_XHCI_HCD="y";
-USB_XHCI_MTK="y";
-USB_STORAGE="y";
-HEXDUMP="y";
--- a/routers/yada-house/mt7986a-glinet-gl-mt6000.dts
+++ b/routers/yada-house/mt7986a-glinet-gl-mt6000.dts
@@ -1,356 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
-
-/dts-v1/;
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/pinctrl/mt65xx.h>
-
-#include "mt7986a.dtsi"
-
-/ {
-	model = "GL.iNet GL-MT6000";
-	compatible = "glinet,gl-mt6000", "mediatek,mt7986a";
-
-	aliases {
-		serial0 = &uart0;
-		label-mac-device = &gmac1;
-		led-boot = &led_blue;
-		led-failsafe = &led_blue;
-		led-running = &led_white;
-		led-upgrade = &led_white;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-		bootargs-append = " root=PARTLABEL=rootfs rootwait";
-	};
-
-	reg_1p8v: regulator-1p8v {
-		compatible = "regulator-fixed";
-		regulator-name = "1.8vd";
-		regulator-min-microvolt = <1800000>;
-		regulator-max-microvolt = <1800000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	reg_3p3v: regulator-3p3v {
-		compatible = "regulator-fixed";
-		regulator-name = "fixed-3.3V";
-		regulator-min-microvolt = <3300000>;
-		regulator-max-microvolt = <3300000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_blue: led-0 {
-			label = "blue:run";
-			gpios = <&pio 38 GPIO_ACTIVE_LOW>;
-		};
-
-		led_white: led-1 {
-			label = "white:system";
-			gpios = <&pio 37 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-	usb_vbus: regulator-usb-vbus {
-		compatible = "regulator-fixed";
-		regulator-name = "usb_vbus";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-		gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
-		enable-active-high;
-		regulator-boot-on;
-	};
-};
-
-&eth {
-	status = "okay";
-
-	gmac0: mac@0 {
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-mode = "2500base-x";
-		nvmem-cells = <&macaddr_factory_a 2>;
-		nvmem-cell-names = "mac-address";
-
-		fixed-link {
-			speed = <2500>;
-			full-duplex;
-			pause;
-		};
-	};
-
-	gmac1: mac@1 {
-		compatible = "mediatek,eth-mac";
-		reg = <1>;
-		nvmem-cells = <&macaddr_factory_a 0>;
-		nvmem-cell-names = "mac-address";
-		phy-mode = "2500base-x";
-		phy-handle = <&phy1>;
-	};
-
-	mdio: mdio-bus {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		phy1: phy@1 {
-			compatible = "ethernet-phy-ieee802.3-c45";
-			reg = <1>;
-			reset-assert-us = <100000>;
-			reset-deassert-us = <100000>;
-			reset-gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-			interrupt-parent = <&pio>;
-			interrupts = <46 IRQ_TYPE_LEVEL_LOW>;
-			realtek,aldps-enable;
-		};
-
-		phy7: ethernet-phy@7 {
-			compatible = "ethernet-phy-ieee802.3-c45";
-			reg = <7>;
-			reset-assert-us = <100000>;
-			reset-deassert-us = <100000>;
-			reset-gpios = <&pio 19 GPIO_ACTIVE_LOW>;
-			interrupt-parent = <&pio>;
-			interrupts = <47 IRQ_TYPE_LEVEL_LOW>;
-			realtek,aldps-enable;
-		};
-
-		switch: switch@1f {
-			compatible = "mediatek,mt7531";
-			reg = <31>;
-			reset-gpios = <&pio 18 GPIO_ACTIVE_HIGH>;
-			interrupt-controller;
-			#interrupt-cells = <1>;
-			interrupt-parent = <&pio>;
-			interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
-
-			ports {
-				#address-cells = <1>;
-				#size-cells = <0>;
-
-				port@0 {
-					reg = <0>;
-					label = "lan2";
-				};
-
-				port@1 {
-					reg = <1>;
-					label = "lan3";
-				};
-
-				port@2 {
-					reg = <2>;
-					label = "lan4";
-				};
-
-				port@3 {
-					reg = <3>;
-					label = "lan5";
-				};
-
-				port@5 {
-					reg = <5>;
-					label = "lan1";
-					phy-handle = <&phy7>;
-					phy-mode = "2500base-x";
-				};
-
-				port@6 {
-					reg = <6>;
-					ethernet = <&gmac0>;
-					phy-mode = "2500base-x";
-
-					fixed-link {
-						speed = <2500>;
-						full-duplex;
-						pause;
-					};
-				};
-			};
-		};
-	};
-};
-
-&pio {
-	wf_2g_5g_pins: wf_2g_5g-pins {
-		mux {
-			function = "wifi";
-			groups = "wf_2g", "wf_5g";
-		};
-		conf {
-			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
-			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
-			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
-			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
-			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
-			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
-			       "WF1_TOP_CLK", "WF1_TOP_DATA";
-			drive-strength = <MTK_DRIVE_4mA>;
-		};
-	};
-
-	mmc0_pins_default: mmc0-pins {
-		mux {
-			function = "emmc";
-			groups = "emmc_51";
-		};
-		conf-cmd-dat {
-			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
-			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
-			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
-			input-enable;
-			drive-strength = <MTK_DRIVE_4mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
-		};
-		conf-clk {
-			pins = "EMMC_CK";
-			drive-strength = <MTK_DRIVE_6mA>;
-			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
-		};
-		conf-ds {
-			pins = "EMMC_DSL";
-			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
-		};
-		conf-rst {
-			pins = "EMMC_RSTB";
-			drive-strength = <MTK_DRIVE_4mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
-		};
-	};
-
-	mmc0_pins_uhs: mmc0-uhs-pins {
-		mux {
-			function = "emmc";
-			groups = "emmc_51";
-		};
-		conf-cmd-dat {
-			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
-			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
-			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
-			input-enable;
-			drive-strength = <MTK_DRIVE_4mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
-		};
-		conf-clk {
-			pins = "EMMC_CK";
-			drive-strength = <MTK_DRIVE_6mA>;
-			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
-		};
-		conf-ds {
-			pins = "EMMC_DSL";
-			bias-pull-down = <MTK_PUPD_SET_R1R0_10>;	/* pull-down 50K */
-		};
-		conf-rst {
-			pins = "EMMC_RSTB";
-			drive-strength = <MTK_DRIVE_4mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_01>;	/* pull-up 10K */
-		};
-	};
-};
-
-&crypto {
-	status = "okay";
-};
-
-&ssusb {
-	vusb33-supply = <&reg_3p3v>;
-	vbus-supply = <&usb_vbus>;
-	status = "okay";
-};
-
-&trng {
-	status = "okay";
-};
-
-&uart0 {
-	status = "okay";
-};
-
-&usb_phy {
-	status = "okay";
-};
-
-&watchdog {
-	status = "okay";
-};
-
-&wifi {
-	nvmem-cells = <&eeprom_factory_0>;
-	nvmem-cell-names = "eeprom";
-	pinctrl-names = "default";
-	pinctrl-0 = <&wf_2g_5g_pins>;
-	status = "okay";
-};
-
-&mmc0 {
-	#address-cells = <1>;
-	#size-cells = <0>;
-	pinctrl-names = "default", "state_uhs";
-	pinctrl-0 = <&mmc0_pins_default>;
-	pinctrl-1 = <&mmc0_pins_uhs>;
-	bus-width = <8>;
-	max-frequency = <200000000>;
-	cap-mmc-highspeed;
-	mmc-hs200-1_8v;
-	mmc-hs400-1_8v;
-	hs400-ds-delay = <0x14014>;
-	vmmc-supply = <&reg_3p3v>;
-	vqmmc-supply = <&reg_1p8v>;
-	non-removable;
-	no-sd;
-	no-sdio;
-	status = "okay";
-
-	card@0 {
-		compatible = "mmc-card";
-		reg = <0>;
-
-		block {
-			compatible = "block-device";
-			partitions {
-				block-partition-env {
-					partname = "u-boot-env";
-
-					nvmem-layout {
-						compatible = "u-boot,env";
-					};
-				};
-
-				block-partition-factory {
-					partname = "factory";
-
-					nvmem-layout {
-						compatible = "fixed-layout";
-						#address-cells = <1>;
-						#size-cells = <1>;
-
-						eeprom_factory_0: eeprom@0 {
-							reg = <0x0 0x1000>;
-						};
-
-						macaddr_factory_a: macaddr@a {
-							compatible = "mac-base";
-							reg = <0xa 0x6>;
-							#nvmem-cell-cells = <1>;
-						};
-					};
-				};
-			};
-		};
-	};
-};
--- a/sops/machines/neptune/key.json
+++ b/sops/machines/neptune/key.json
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+    "type": "age"
+  }
+]
--- a/sops/secrets/neptune-age.key/groups/admins
+++ b/sops/secrets/neptune-age.key/groups/admins
@@ -0,0 +1 @@
+../../../groups/admins
--- a/sops/secrets/neptune-age.key/secret
+++ b/sops/secrets/neptune-age.key/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:XXV5r3FnMpt1rX8L4LtxLbNeEZ+tLkFeMQOTvyH93fRAEltE4Uszy5khsvyX9c/h33uxyGFQAymHUqSN8rBlBfbJ0bIf8DfoaJA=,iv:rYt5U/usIK7+glVjRclgCkNpQYwQoZ+UPSzanqbI9bA=,tag:c34l9laQnhQOZlV6bj9KCA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmY0szY2IvRzhId2l3MTFI\nUjFrV0hEWXJIOGcvTmNoaDkvZDlrN0dlRWhnCm1CR2tBWFhJb2NyVndkZTlYWmg1\nUlJHVTkyVGdWZFVVSkZtUzZIQm9DRGMKLS0tIDJxVnB4RFRkWWZ0Y01VeFNIV0hM\nQlphalhKeDQySEVoWWdGNmRaWUhDbm8KnTdaaJsw3YqkjSDQREQuOjeHqKjMbw8q\nfgeetuG7tI/30tKgggTr48rk6mHVHoZE0JHugjYTt0mfoM8Dqct/Sw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvK0R0TC8zZVFkRyt0cEJa\nam9XNk1oenZ6d0lyd0l2cVByZW85TDR6R0NjClFKeXp3ZzFrUU5vQ1dhczRtbGRN\ncVd0dm5uQ1NIeFJneDNXcEwwb3JkWDAKLS0tIGczcEhEWlFBTVJYNWxLMHhCUDY2\nRFhZdEN0NEJHRHpHL24wdjdNUEVmWDAKYVTOGiD/4zZ8ME3F931LDzjoloy6JESj\nGVcgg1ISR/GMeYGxqTGxTQhHVVXv0+djdTnK+RAg2wUJy0VbFTzqTA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFh0UzRLMXhN\nL1Z0QWJxaEVFRDQ5YnQwRGFLdGNzSzQydUJXbVpDTE1sV00gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpmcGdiQkVKSUxQZkJzbEVhay9rVlZS\nV2ZoNmg2WS9aWC9zbGYvdDNkUDlBCi0tLSBqWHM5alJISkNWaE4rcXV0OTZPU1Bh\nY0tFWFl5MnB4L3VrZFREVW50UFkwCqW2sa+4LVWIwcZT9xJ0evJsBva3Lmpcj2SF\nV9YHl7EmGb4pJBslgYUFMQkvTr0/w9VC545YLP3ECn9loC3hzxM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxOOVVrK1ZR\nWjFIcmpacjhUT29LRzlBcENjaWVKWW9BZzdVYUZDWFRIM1UgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwovWlU3RE5aMlczZlJocll1MDZlMG1Q\nSm9CZGZ4TjdYaCtDd04rcjdzQUE0Ci0tLSB3YnMrVGowTUFoNmlzYnRVbTU0dnFM\nb2tuVW1OanYwZm0yTVV0WlZkS21zCmRJ7ij8d36hIM0ZotpU/+ooyWKkHYSgRILa\ncm3F97UZGQ/TkNVaJvMlm7IlX4g/6hONDb41me4/29EmJsJHhKs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIExBUmFLZlNY\nK0tHY2NSRzZtR0Rwci8weWphekM2bWZvTGFEREdzSG5pQTggQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpsRU1ndC9FekMyTDMra2dYeTlDZFVC\nTURLTG1uMHQ1ZlBEL3ZadnF2R2k4Ci0tLSArWFoyRFdzeFh3cEd3L1hKT3B5a2xS\nQjFEd2Y4NzROTDNmWlYxK015TFRjCjbR7wDmMMuCZpzMq4bbKJNj5P0OH+GclyvT\np84RX7o2CzmlJQXmYwLkv6FICe7U904QURuhPywyU0RXGhKUqhM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVVU1M1M3VURheitScDRw\nbGhETlhUOXdPVVptUGgrUkM1QnRrckJCZERnCkhyY3dhSnJ3a3VDWEs1L3RrQVJl\nOHI0OXBJY2dDQm1vOUFpMzJQcGV3cG8KLS0tIEZ1SHdweDJkV1owRE9RanR3cTd3\nMWFlSDJuMHR1bXVHc1dNODlJejQ5N3MKhKq69LY9/9PXKm3TlsWHYW8PbMgWwgWQ\nUAC4WqLvKYk/MAbKbMOVr/TfrRbkrFJtbP1H0X6A7yzIrAXnsPfyRA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzZGJQTkRFcUh5SEM0Ritx\nLzNhNWxSL3g2Zm1kNUtmT1AyZ0VzOGh5eHhFClJmcm41Q1BFUVk3cWZ3d0VxV21X\nVmFKSzRkeTVWMzMzZzJIeXNDcWJFNkkKLS0tIDYrbWF3Z253ZDQxUkF5dzdGSlJW\nRkxReGYyV0tTcHJQR2JwUVdBL1I5TzgK5kZPf+5N0P/NeuqpQ04Lb8Sme+bocqYk\nk9Ld7vFSxXyjTTnhwKGv4+q85IkDq1xGLj+7iM7QfRfpZS6tBpKJjQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4U0VWYlJKM1JYOXRoU09r\nUjhzalA5aHRCVTVZWXBmODJZZnAvSEI2MFI4ClZEeGh6WnZsNUtTSW9lU0xnL1kx\nbDV4UGIvVXRra2VvdzJwNFdINmdlT00KLS0tIDJwMnpCWVVkVmtYVmxSNXJqNkYz\nM2lCbXQ5VEd1RE9TREF0WllGRWFjeFUKouFFBKiW7JQ+c41t5hwnBndUKZKhdwpm\nYCzF7/2YlZtNYdxip1+lZ5YEqyaXygcOZBjjZ/4s1B7ihEscQskLhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBidzFMU3pQRm1HL3IvS2NJ\na1ZjcFhyRTljb1lQeXhjK3BBN1htdjhCUnpRCmM2MnJEeE1UZ3N0RDRvRitLMndX\nZXpWNk53d3FXWjA5Nnd1Vm5idEg0Z0EKLS0tIC9RaXE4ak1tOXMzU3dsZWh1MFR5\nQnlqTnBGY2pMd0dZYVpGdHRaTzFuTmMKqixum2H5jyBFdxdXAVlLZ4Wn5ZfeUJNR\nnNNsDNsjMctBn3gbtGHkx2wEnlKS4a6jbk01wVdSeyOFWlR9KKXF7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:23:57Z",
+		"mac": "ENC[AES256_GCM,data:xVNbw/RamaR6701df6IHPGjGDoYsZH7gwOWeVpb8A8VoaxYNHQVnRkV6jL58AQqI4DR+HisrpkBoN4Ui9o8t5u7PRbGyjUgUr6tvuwh4MMpk+osUmlH8eNdzi0W3SarhFZIWtcSHkLuhOj92yk0qd+W3TmWd3iMCrdVpkDe2kU8=,iv:uuUYoGcDQTZu/vGgVkt0x4QMQNkcNWCcwOlM/XQBx38=,tag:J49wr+on3MJdlNASbr+tMg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/sops/secrets/neptune-age.key/users/kurogeek
+++ b/sops/secrets/neptune-age.key/users/kurogeek
@@ -0,0 +1 @@
+../../../users/kurogeek
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:ada9:8363:202b:faf:be:92ab:e46d
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/machines/b4l
@@ -0,0 +1 @@
+../../../../../../sops/machines/b4l
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:NSyWVWXMxoTR07uaLUYX6rHB17wsIB53FZHSsPxgDKJQ2wHBPFNaHSYh+BiSo+IrX+YcdUUqJFhEkjWDyG+vXaNZHrMbg/pzZ/cwTK/lPbYISkwtOhgr3zCA0H6DmQcHVmvR6fsdRDkFwl7pHtn1RMjEORQdbBINtscZfzZFcAF2L1t+WPFxgRKQDNT/9l3f4SoBcuakyg==,iv:/5JbEZ/vj/4I+eEElOY0cnhiYzqqPw2ZKLv2M/xkstw=,tag:23exDL72g56bP7ZbMsK4mA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTYUFSZGpmd2tmdzB6bkp5\naytPd1RhVWFqeXF3SDZia3QzUmRNNGpzcjBFCnl3VElLdXFvV0tFSEFlV3hRMzFH\nbnBnWVZ2QkRHZ1BoTEZxdFg4QWE4ckkKLS0tIHhSMlBKakxmM0xyeUphKytLTmpk\nVW90V05hTUEyTVNMQzZHN2xhYTBZRGcK/nJOIM4m56TE7KKmn/QH89g053mmuKKG\nQYs/86SWdLPqwL35FstQg2xDIHSxkDcoMSGc+C+/xdOjWV3qLil/DQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaU9idi9RZzhNeXhTb0pp\nUkZ3UVpsZlBka2kvZDBqcVhiRVdMNVFZbEJNCkhvdmFaVTBGcVAvalJPSlFuZHhi\nTE9qeTBMMjk2djhFUEdJbWZmTnN3WnMKLS0tIDludThMRDFDUHhCZVV3bUtVdVBZ\neGg4TzdqVjJPeUxYbnBWNURRSWRrMkEKBCACDZgHG5eVKcSdjHDITJZqgR7cHdHq\n9y8qS3YjaFZ37Ui6Lmb9vJEzDCEy3wEupBy4sbAX4okVapGPJ4fmwg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHJtSTZrY29X\nVTZNQm9XS3JsbEZCNDFUR1gxZXpObDdKRmQzUnRZMytOaFEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpYN2xlOFVDZFlEOHhTMGZTVDNjdjdU\ndWlqd2ROamdmelp4UjAyVitnYVQwCi0tLSBZWmVWc2J4YVhLN3VyMTQwamtYRW5K\nWVovUEp3YlN5WjA1VE10MElWMllvCiLrLLekRkmSL5ekLIcFMoqgeEPXSrn15JDd\neKT9sbYtwhB7vt2L57fDRfaF/+7wNb9y6cv2oi+EdDoDXp/EyB4=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxiRWYyUmwv\nVjlEdS9LOVV2K1NwdDFhYWM5RS9LcTZFNkNaMWViMkl5bmMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpUQkk4NGZPVWRTbG5MNk9CTStSUXFi\nbXlGemlJR2o2dTB6QUE2Q2JKSnE4Ci0tLSBzZjRva2NtNHlRamNvQWpoZW1UWFMr\nQVdNYXBpOFVhaEVxWm1KNFM4UHJvCnebMj6d/+e0vp00Gb02qJtUp2+mEpF/jUpD\n25cxeoSAWPAhfnBgE+oLzQqnQSq5dCxsWteE/1eOXC68koeT9FY=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9udm9sRDBJ\nNFM4dFA2ZDdJMlBXeXYvakM5RHVzNlcrRitzUHF6dnBvMVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpKZnBka3YzK0tUQ1hXTHVheE45Mzkw\ncE04aVVPQWM1eURmb1JaNlBwVlFFCi0tLSBHTlY4UW5FQXExK2cvMUJDZE9NaURy\nOFUxN0dvczJtWlVRc29QWlZ1bGg0CvUoAmTgDVSF7SPpqnkFhkCUn3N/Yr4Tzodw\nyCiD7U/KYFavEIxGIeg+ClhLF9o4fYq9kk8ld0vU8qUADXBdRDE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTUEyUndkSk1iQTB3eUpp\nb0ljaXpwdi9QYmdNV1J3L0NhWElRVzlnNTFVCnZ6Q01ESWRNMHRxdWZKM0lYTXBX\ncko5VitPdWk0UHpwWDhGNzFVZk4yYzgKLS0tIGVRdG5rWkYwOFlCQWNIWFBRalVE\nMmFtOHBvbUw5YXAvMG93MjBrRjdmMGMKlopySr6HS6vfFHiRcwlJz/qy7jzyS1Nf\nw4lw7QnOrvOkoutiK3HiIia5N6V0jd0TV7nJqIu7tz/zYksbzps7QQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVTZNTUM5UXowWTlPRDFW\nVUJTbStFcldHbTVDUVRJYjNiaklWRmowTHdnCkJNbUtmdk1jS3kyaVNWVFlOTytX\nKzBwTmxoZi9NdmJuRFNMNTUyRThNUDQKLS0tIENSMHZ5TGwxQ0xuZkZFQ3RJdGEv\nSXIvYW9WY243cTdzZEtra292K0JFVlEKMWhG/7R00uqLb5l5lU3p9Vt4pre6J85r\nIFWtg1G/54KaFt8aiWcD5RUSSARGZ3r4qVtO+9eWP+gA4DUpSNkWNw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WVlWMHJNbERKUGx0elgx\nUEF1Sms4VCtNRVRraWdvUkFEaTRzYTJ0TTFZCnl0aTIxR1QyQ1VsU0RFNnN1NzBr\neTVQbHJHQjAvYklFVkZkUDRXRGxvSkEKLS0tIHdINHFyQVE2V1V1R1ZxWEFuMm5x\nUVRjSVp6NStGSkQyQ05JVHlXejBEbWsKBlMvtw9MCReN1eSHKMwwsWaEF8kq1Pns\nLNSYEeWABZ5bbPB1xBvmIIlVFThJqgy5mBVJLzQMUwqb0IvixAgFxQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaSmNiVWlRSy91Mm5qSWJ5\nd2Z4WnEydE9ncWwzUVVCMDVoek1wRTFyOFJjCkZjOVZrVHY5d3FKRmMvaXJQWUtU\neGpSZkZITkJaOERkdWZpelA5dTJQOEkKLS0tIEtZOUNJSytYTFpSTWNuY3JjcnJv\nbFZpTXQxc29Pd1FIN0xrcEJYc3ZlV0kKyO/PLn2WNdVtTqM8cG1XFqV/5YdSqPAY\nvroStGVsLliV7W4T2MAmACeyjoMde9/gVosKfGc6awE+Bi2BUxrqpw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T07:22:09Z",
+		"mac": "ENC[AES256_GCM,data:OxeLto6aeiTOX8OffRsQzxyluSdva7y3j4j67c+MI1ost+QCZyGAW/5pr2mMaoU2XrwYqUjZTKBhJ9p1FY6C29/EhyzrNhGUTjC5iTcXO1lbLUTgoSDN8KPmVea97sTa+easVHoSgnPLxisG2yCALv95k9/eQ7vF9FRjBBNTaIU=,iv:FQeojhtnKOlqWuQNJo1TmI/PhjYbgwtvK24gZMjbbpM=,tag:Vwum5bSSZRNNDQ3Yudw4hQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/b4l/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519.pub/value
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE09U7Tuvn3/icqFhjKuhp4hG+V6E6IFKhX1W2hVvyVj 
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/groups/admins
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/machines/neptune
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/machines/neptune
@@ -0,0 +1 @@
+../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:w0u/GcCzPgiQMK5NpXb3kBO4Y+cknIMebBSv8yVISZG3rQn4ndimELcAoxbbmvB4N5x8uHSG6YxVdKRGCr7J4Xw9UOLIr8XPeMst8ZqRZRvJQFqRbjyuBjp27JSPrrkFcohfWmjHIIaqDQ29mPCOhbY8bPfl0MM8p6Iyvft2VtQpo/A5dKbDtn8/e1/5ChTtmBQWdtIfw8LBILChlc03RTZmW0b0esNqLUwn9UFTGKjxF/CFjJKSpxLM1vdYFipHQ7VZWD/HRs0qtAlldXQmWu5d0ypI73NQ9dNAo000zcraf55DsjcwjLhjMdnm2heEovAqVBUpgdr+tHSnu3SKq4L+JFUVudxIHrQXsdUkV32QZddYitQANlwC4jjCK9jr4we39RV/AJzs3krkKcG+3tKWg/NCZeW1KwGfgdOuc+wPb1N3OQVIHcC9YgYlXViAW5NO1vT75UvLLNTxbnQRKKADvYVTuxo+ZIaxFBmd8ZUNXJTFbnZJ6e5MH7QbqOwrTDA9,iv:Hc6d3IxfBdHF5XmgdV2zvAU1XZhrgi53/kAKEk6cFiI=,tag:H9CYzcaHbr/LI518IB8YOw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMUh0ZzFCbWJxenpJYlBP\nelEwWDlTYmNuVE9GcXZRUERPd3lyaGhoRFZVCldEcDZUTmJueCt2dmhXS2x4c2Mv\nMENYTFo1UzRLM1lZWGdYRGVkb3hLN28KLS0tIHZhUWNzcXNiUnNPbFZQa0l1SXNl\nSzd4QU1DandCb1lRUEkxUFFNSE5rUUkK7LHoggdi4wj9K39A6KaH0+MFbJ4wzaIt\nRYZxyUdWtrDMm4tEPbHT3DgBYC7RdGfWbxct9KwihlwSWMhNTyXAbg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOb1lOQjRYOEd5S2lEeDho\nNkFLeWhnM1Zjdm9ENXZtUnQwbUlMckhBd2c4CkFLRkVJL25ka1hnTGNnVmRjZ1pz\ndFFFZ2NKZUU2REF0OXV0amVOL0VTZVEKLS0tIHFtcnJ1b1dWVnlPWnExeHJPYnBm\nNEVkNHJBRW1GM2p1Rlh6ZlZiTmYzZ2sKT21d9OMGWuPxkITTvl6XUWzHyGqqzZty\nitwdfFm3YpzGK/FLN6LH+KSXqfo/ntUMmOIAai+geefuT8mSW9n/Ag==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYOHhKWlAwMDBUZFBRamNT\nOFg2Ky94M0xvZTlsS0pEekxkRlYxN1lDVGpvCjZ3T1AzaEV5Qlo1TlAyazQzRUR1\nWjk3d01USzdNaHF6bGpPVWhEbENUZ0kKLS0tIG9TQWlkQmlFdklETXh4cUphUFdZ\nVVhuM3h6NFpKQm1IeGNDR2RxaEUvR2sKoXaltJrkQ4EzTRkrrO74CrCmT67Fef3Q\njRi8NcuYAFN/CrsBLGQA34JwTdKhmS0skkJsDEsofPuepebNc6IHCg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZyWndNQ3ho\nbTl4YXh4UkdyeUNTZzlyZXNIZGpOWklwSXp1Ykx1amZzQUEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpGMDdjSzIvUGtIaWR6eTlaSG51Z3Na\nSUJHWTVhcTRaRGp4NzExcDZTVVJJCi0tLSAvU1JPeGtLT25sNEIrdmJHUzYrTGky\ncURjektPeE1HTHlKK1M2VWpidlgwCimWuV36gFbk2wB7H1X8HJjfq3RJHjP0r5AF\nFY5UYFLvlftVdPizm0LXo5KQbnbckDPZxrlwvkcJP12PR+FOyh0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRpczlmNVdz\nd1BUUkk1OUZwOWhCY1lkbm9xUnBiYmltVWw3MFg0TWEvVVUgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpCODRxNWYxNzdCdE51bkVGZU4xbENx\nZTlPTXh5VFJMWFl3ZlhSWElMRldRCi0tLSBnMXExUWtrL2Q1ZmdiaEpIdHVsWHJz\nSFJuRGRvWU01ejYvcFJTNVRqRUY0Ct9eLGkzb+9Zf5Au/Zg+EbQxzgoxTKByhtij\n2YSL2jfn+MiQSoEWeXYP2x6QiZ3gh7yp5WY1ghD09Yvf7x7UAPo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHAzLzNCa0RK\nOHBML3RQWDZPVk1SZlh3NkxqSDQ2eXd0amxiZHpzeEd0aEkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp4NEkwbHhqUTZydmJOMm9xbjB3eGVU\nQmRtZW9ETElXdXIvK3NQb2ZjVHJrCi0tLSBzUUxtMnpYUFdyMlg3czg4RTBWcWdW\nUFFvN3N2WEI1Y2RWZWFwR1p6Rm9RCoMt8vokyKfTEPJ5nj/lKIS9OrBEe9QPADTG\nQ7HWrId0rRFkXXb8urU8APRJgUFKeap5mUtQ7LjNPMz0dhbccew=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwZ2ZoZElaeldaVE0xUElK\nelFWN3ZrS1VzYkFZbENjb0ZMQzA3TWFFTngwCkM0NUJseE5LUHZqUUxxbXB1Rndz\neVBMcWsvdGdNSURsR0xFOFJ3N09lOGsKLS0tIDUyaDRDL3QrcnltaDZHL3dPYmxs\naU1Xc1ZjYmhwV1lINk1UMTcxc1Q4SDgKTt5+DspGwjI2ODiemPgLkGzHnyo05u6y\nJpewiruQhL4WsZgI48Us8WFfyHNc+dLaGplBgJrUadh6S3Fo+QpiVA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcWFwdVFaMHEySmlKTUZq\nNWUxT05UMkhFall3Mzh6NTFIcDZoZUxpZkZVCmJQV0ZmYnFJbTQycXNBWGtLZG5s\nZ2ovc0Nydm1YcXBwdytuWHlRTWFCc2MKLS0tIGFnbzdMOWR1UzVpY2RvWnJFeXlO\nYmU0dWxWNjVTYkFLdW14Qk9jOTZOcUUK6BCenu5Mh8fg6Lia4CBcQgNVTQsTY9Z1\nxSlqi4zOvKRDlE9PNRW/dWas68F/bJCRa8KhUPQ5ZF475Q5FUrbNoA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrWUhZSEl2ckJwZWwzc1Fi\nQ3g5R2RpZzZVdUpFK0ZyTlcvQnZSWkFlaGc4CitPeTM3SDhvb1Z1ZFh6WmNpWFBR\nd1RURnJPbnZlTWtBTHNsa083M2VRZDgKLS0tIFl2Ty9JaGNUWE5VSzU4ZDhUOHBx\nVEtlL3Nwa0ZpWjl2K2ptQ054WUlSSjAKhxcMLryYi7O8CKnFDphV1ojcDaSYFXPL\ngzaX32vI1LOo/doAq0dLC+yLtj1G7f/tE6tK2ax7SCUsAEhTn8QJ4A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHalpIQWNJemFzaDRjM1JC\nUTJydzJPcWhoU3dPQkpjQWF3QVpUc2dhSkVnCkVGbkZQT3V6bWVqdS9KenBlcEpj\nUVdLQzdaRUlkdDIyeEV6bDhPU0VsQ0UKLS0tIHZYUHZVT1M0bm9oN3hwL1NkdWZW\nVVN0SWc2cTAwQWNoVUUrSkdwWHlSZUkKgsejUHV0bc70zNYwQk29KPetAbhiUMBg\nB3QxI8i+D8mJ+/EKFZzllakXK0NeHVDHTcALcyaI3SvIa95PMBczuA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:23:57Z",
+		"mac": "ENC[AES256_GCM,data:g054D4imoqjlpf/2HLfKW62cEJvJxGswSnNS+snyS1mx3+86E1kM256AJhETWl5ZC3qdfzgeobxRIIS1m3U8iajQtYn2nOJ23Njnfu2s9RTAQSCsnJevV+HfmaBDxqt/uS/q6DaXylaXmPINlmsA8Jwr4AiJtIKovm173P9/2hg=,iv:37tf+FpGFw1bv2q2Anc4gu6C9zacBjgh+Z5Xise6jKw=,tag:7HrVKWWkGE4CBF3TsisdzQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/openssh/ssh.id_ed25519/users/kurogeek
+++ b/vars/per-machine/neptune/openssh/ssh.id_ed25519/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/root-password/password-hash/groups/admins
+++ b/vars/per-machine/neptune/root-password/password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/root-password/password-hash/machines/neptune
+++ b/vars/per-machine/neptune/root-password/password-hash/machines/neptune
@@ -0,0 +1 @@
+../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/root-password/password-hash/secret
+++ b/vars/per-machine/neptune/root-password/password-hash/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:H2KsH0uMgHC/NjEHH04I5hm7k96ZjOITsZ+kzL3y2CEAaauvmmTh7wNxpvG3E7SswbkYx200KXZTxgfY7z+0pmQxvwMzRukwIjpKZLLxUIIfvlZc9qmwpNH+7wo3pwjLQmYJ0OhMO9tzFA==,iv:EmAv1RrWtasq0ViKkAH+TrPYRXdhH+SdLH9hHfFBpnI=,tag:+0TexZJUMyMd9Kt647iM3A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNb0VqN1h0QVdkendqTDVW\nM01kSGtZQkx3Ukw1UFBocUY4OVVxa2JLdVgwCkJEeGpHdlJCQkxnSW95ZlR0UVQv\nRFpmZzdpNVVYeTYxeWdyQUo4c1diZVkKLS0tIDBpdUdSNUVpamJvVy95QmhJbUhO\ndVpJZE5DdXJuSFJDaU5HT3FqNTA3amcKnmQ9DED2jtzConYx8tEQ0O5wkWLLuO/R\nFlpeMWrolziCbcBgraGffbFM3tk6jHqEdWB4r2SH/4U0HtNKBXSJfg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlMFY2cVpWd04rMTlGSWxq\naFNXSGtVU1p1U0x0NVZYV0hGb0wrdnJQQVJjClVkSnkzaVFjNTlrMjNjVGVDSGVF\nd3BJbmZvb3RjV2JkcThuaUNCZjRjNG8KLS0tIE5TbHNoYy9QdTdHZlZ0bHZEUHd1\nSUJ0Z3FpZmVWRWxqVmJUZVYxck8xWnMKVbTYt8zbGkKMuz7f4yOG/EkdYYqfmj03\nKDCVLPqwsRoibsBRpyRine5oOUwzN+PtQeXwHj1vRTjtGzZIgpQIQA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWUZwN1kwTTZHUjNJWUw1\nY1htbUM3dnJrNUFPTStOOGJ6MW1DeUJWcnowCjRObXdGT0pUbjFYZzExaVpMbjhi\nWmF3QzAxaVlSeUkvNUpzcSt4TG1wU1EKLS0tIExDTnNtR3lVRllwRFh1RW05NGRl\nNTVyRWRDNFl0aVAwKzVYNkFKcXNRaUEKv84/fA4ydX7MjuWJA3oYhYkmWHXl3LyN\nIHpWk+7JuZlWaHJGVO/ywQmnEj+aaETpVvh99cKQhHk68dzzSV36lg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHN5MVAyQmRk\nWVRodG5EY2pRc3ZYL3FiWVJCSURlYmd0VTlkeU1FRFE1ZzQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQprSEFITXhnVGZhcTE3OTlSdzhmOXF1\nZFA1Zm5ZQVRLUDcrL3NBblhUVEZzCi0tLSBzUUFyR3V2UGFLYVQ4dG03RHZzZmZK\nOGtLMHJWbEYxOGQxL2NnRzVUdHN3Cun6V7ieogvJq02jePVUnX+IOHLnu3RRuVGX\n/PVGf0jRVQLP6u9gXsTa+GO/Ah6hYRsmV9lzq1S27gly5U0CbDI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhlcE9GVVVL\nN3JvTDRxUGNGZTE5ZngwYzVmTzM0ZmJ1N0Z4R2NYSlFobWsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo2U3NMTHAxTGlxU2FSYmVLb1JBbXhZ\ncVpDc080VVpRUHhEaEJQSHVFbzV3Ci0tLSB3bmxZQmNHbThMSEtPb3BjS1JhTmRu\nYUNWMWE2eVBFbk53Wi9HSFNZejEwCigdlrPSwK9e3LcE+U5ZMfy424+gjcXCPtJI\nhDQPkKQ0htljBYFDz2izD/s7qwKOqzTia8u6UPLTopMcGyXpSbs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIE9qdHcxd2pS\nRkRXNjlpQWE1UVdudDdGRmdzcEFPditmWTRCbXpobkg1aXcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo2NkRIT3J1VnJzSEhCWjZLM1BtNWkz\nRjFMclJuMVB0U2ZsYkIzaUNEc2lBCi0tLSBQZ3IvK0Vvend0dThqalBwWFE2dExt\nYmk0NVhlY2E3Q2JWbXpMWE1PS1hvCv/w4TeDBqWbyBueaiypFgUu5InTNNuHRKOp\nvr1obhIlz4alQ62mhbLdGB+P3GB0yBkuamUlaOhfNNIk1kuMpt8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzdDdFbnY4OVpDdDcvT2pN\nQXNqdmYxaldmM0R5bGFmWWhlVzVoRWlMMjNjCkdXcUx1NU9KYmt4QUZCLzBYRUNo\ncFNqcjYxcUhFSWE2bjRqU0pzbjRrTmMKLS0tIG91K1RSWWxLaGdHazY2RDQ2VjA2\nV1NpN3p3Tm5sZ01jUUlhazlFNW1VQTgKj6wMVKN354bMWIs1OKAqCFu2+XSQ0KK4\nNxj0kJ3mimOpkZjTCAojuD784feb70gBx+Tgf3Z05jtR/EQBv5TjNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeFBrbUJaWER0dC9ueDM4\nVENqQTkrSHp6elJuLysyaGliOTVPY3ZEb1RFCnJRUWZMQy9tVEZjYlh0ejY2RVBB\nWFlPWXJHcXBTMnRjSjFvblNDQld2L2cKLS0tIHBvSkdST2o5WmRNYnFodkJ4aU5G\nQktFcTdBM2pnT1ZINWkvWit6d1Z3dFEK9abGvVqxqXfSH+vKT85RhlyMUTQjAink\nW/0bH3ToYJpIoqxXk7ZxGWBlA+6To6HUZ5y8fcCFg100LIVtcqT9Ew==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwYTE1cG5kUEN4U1I4b3lP\neXVJRCtzekc2azdWalJTWUJmU2c3N0c5NWk0CjFUelJnMytKbXVCY25YZ0F4RDB0\nRENtcXpwanMwV0xZZ3VYNy9BUjQwck0KLS0tIDZ4TkhXUGJKVnM2bkVHdnZCT0Jp\nR2hYK0dqU3dEVHJna0hsVjVzOVZDR1EKq2/gNYgUozNgWx+A1eWWN/1ci+JGLuC2\n6MSoCDx0ZUg4e5EOmBLRl4CwRUSBJklfhzeCGVh0lOznNBlr0WfMaA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBScGhnbklHZllqMXNrK3NH\naGZtZTNKS3IrU0ZEanFJeG9iaXhmaDNMbkN3CmlybXhLbERkMEVwcDJDS1h6TGEz\ndCs1VHh2MnNQcGVzU2JMVmk3MDZLSTAKLS0tIHVoOU8wN2lSUU16Vjl6ZVJlbUw1\nMjh2U0JoK3pCY0tOWWpxZWcyaGdXeGcKBMyrTPy/8sIl6wLoasD9P0/+D4MI3uMk\n8U9hL+4Hw/8BdRt9rYwbcRX04/oKNXcPiyByHmIjYYF1AJTX07hFiQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:24:05Z",
+		"mac": "ENC[AES256_GCM,data:TQi5XJZPZOhJrYNVqyr9azqo0QAs0Q30qB4BZXQdTN/+mfmDqx+mdJdkMQpSlJaFpbzCZhVGW0reSzCbFOtam73LFsBJZUr0c0RYXq3f8U91FE11czMp9+oau2yY4D/6PzDQbHdJVywj0t2qTrsSHHdF4b/0BdpTpi0goNgbacM=,iv:+xpi5If3k154cekAvrT3/rtII4BsrRg2YFDDRaLjNds=,tag:4GoEX5ZxSkaY8XofCSF8Iw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/root-password/password-hash/users/kurogeek
+++ b/vars/per-machine/neptune/root-password/password-hash/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/root-password/password/groups/admins
+++ b/vars/per-machine/neptune/root-password/password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/root-password/password/secret
+++ b/vars/per-machine/neptune/root-password/password/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:JatEWUAYacgbFT1oRM0i3oHwoWh2URg+ZX6y9qafiPZujagsx6Ks2AQrGg==,iv:Dd8djrt+mnVkrWgGnfLWOByretizJSJ3+PfYW3bbGVw=,tag:fK3lGIgr2bMtKUifKK7tOA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WU1mbG5UMnU1OVhRQ2p4\nVHU4VUkxTXR4V3VlU3ZQdDYvTzZ5K1IvSXc0ClZGeTRUc2ZyaituMkh5ckFmbzFZ\ncVNycHNDSXZ0dzNPVXJMZlJ0QTk2UXMKLS0tIFNEd1BLNVVXdUM5M2JQT3VLaXIv\nTzFKbW1BYkxPZDFueEs0UEVGUDVBNUEKfP73bJLaJn+xsE0t4kz5PE1+LJqMxwGe\n74m0W8YoVweZHnpUeRcOnsxp0egDAwhgqg+sqpxLfY08L+zpeNSpIA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQUZDWnpEZzVuWWJmUC94\nN3NwSEtNL1ROMnkrUy9VdjNUSFdub1A0VWl3CnhPRWpyUzNvajI3SitZZmVLQ1pB\nc085RU1CUHo3M3Q1em52ZmRnSnhqUFkKLS0tIHM0Qi95Q09CbkZDdEp2cTR3cGZw\nSkpjMjE5aHNMVFFGb1VYRWc0bi96RzQKhi6eXNUbhBeqofDl8WOvzLiD7mGiE7bk\nsctMjwCtHxpQTW0oD7hIMsNyJTduZ9/9rxPfRkmSDcCWYAsVFcBevA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEYxK09HUFNB\nZnVaUXp2RllSejJqTitBa2EveEZFdXpIb0VleHlHK2hweEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo1SlkvNVhtRXMraWtLQWxINFRuNy9E\nZUU1RlBqQ2d6eHQrMDJVK3B1Yys4Ci0tLSBwangzV2xtdHUreTRpLzFnMENQb1VE\nTllTc3RVYzVIeGtZMnhjNllSS1hjCleRr8GWtMiXRvk5IXgIKimKlJ6US26iHz3H\ngJhLHc9WzATHQFoiSnRsYLMRfXXfQDJ62GM6FX9MOZ8bbDdUZ78=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGI2UWIrOVdV\nbml5UmM3WU16YUVDMXJPRElFZVV2YlZtekJURnhuSU5zMkkgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo5SDhoYUxHQUJTTUNPa2dYWnA3NlBE\ncFZoTGRjVEpNb055emN3OE96UzBJCi0tLSB6ZEZqc0txNmQ5K0ttN0s5YmpxQU1M\nTEI5MFZaQ0IzL2ZIVi9LZ0pjVkg0CnnCHiCzCg9iyOw+jjei0TmnQDuuhEpxTvLB\n78+JpBnOnVZRMZM/RrguHup2lAMVXSBtu0zddf5wSivr0renXRk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEZiTVJZbzVC\nQ2gxTG1PblRpUmM4QUQ3d2hhZ1YvRjBnT3IrcWljOEp0RE0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpyTm1leGQycmp0bXJqKys2S3VPblFu\nV0pwSS9GQUNFL2N2ekNIUFpVTGM4Ci0tLSBLbUpnVlJuRmpJOVpuRTE0WmlEbEQz\nY2pQbmFCaThtN0ZCTUtGbFVhaDdBCpg+8OIwptyv+WHA/1w0qWXfZH7RIj6Ao1L7\nHQyjOyEi2Y4sRYmgNg9xFKS9bT0Y6jamyXmemCeSmhZg3wg154M=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bEZDOHQ0cGdTa2JTNkhM\nclgwZWducDgvcVp6dlFScTByVHBxdEJWVUM4CnBnYWcxMHdERWNuOW9YRGkyaTBM\nV2M0QnJuWFZ3VXV6V2xIM01LQ21RK28KLS0tIGVyamo5cElVMFYyclZsWEgraW15\nbUxEc0R0SGRoTS9VbTJsZytvbWdCZkEKgwfGoXJgmvmM/QW+7WN6ssGgZuzQLmCz\nCrQWifImc4k9YjUPLyLc+rV5lnUBKiqJZug4RLRCmUvYYlEZBxqWRw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VjBkMnA4ZWloc2NUd3VL\nUHlyL0Q3c3Z4YkJuYTFiMXlwdHpUMW1HSzBBClBUdVQvaW5kRUE1eHpoY0ZMUWNC\na0s3Q3lVTHB2NGpFMk80anZQZzM5SFkKLS0tIFQ0c0QxbFdnTUFLbDdqc052R0tS\nYU8wbWwrWFJTNmdBZzBPdHN4VTMyZ0kKdsJa1r1GA/Ya93rbh/FkVEhK1QcfV+UF\nQMqjRfe9s2UIdRiMk+osPyV2Fr9L9ncIMw/5Eqdh1cJm04m7rAMN7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TUxlNmN1SWxxbVA1bHdO\nL0RFS2hDbzJ5Mk1sNVZVYlVvZ0VFTVp4d0RVCkRjZ0lhOEhnMVM4cDBQMjJVYlll\nc25rdWo5VTdyY0w5Mnhxdm1ubXdnbDgKLS0tIEZSQ3Z6c0lzQTJDOFZSR0dTR3BH\nbkorOWNLZkFSY0hYY1hIODFqMGNpczQKgnl7vH2fRrW2sGCxAlTnf0/9aTGWbXGX\n6OtGMfAIv9vZWXi65CpVwPFfx5f8yoydWTLOc8Pf/e5N+ZOZP3U2JA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3TmZmdk1qV0ZFYVorZXdy\nR0d0bUhkbGdqWTByM21kZForMUpMbTk2UG4wCjN0dURpRytnWW1peGRYL2Uwc29R\nSWF2ZENjWXlpQlpWamJEeE5SUlVrVVEKLS0tIEgvbjR6MFJVM0taMU9zV2orMmVB\nRVdrcG4xOEp5aFdpYlRtL050Q3ViR0kKZ8SzmPVVgDYshXyoFXiGvgvAnAKNI5qm\nQsV6tKCbuY+07yTSEtUo7B0htfS3k7YQqxC6dBEOODtM5C0yXcxzHA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-17T10:24:04Z",
+		"mac": "ENC[AES256_GCM,data:yWNfoYh1Yj6PctGH2sc0XHb32PkK7fH+pC7KdVBjqL6jOEeUmJeJUV1Krxw0lzHG/Z7iDsgVryVxT0CkZ9pmQsNe6HAVM33gd3snqhdSm9x690vAezWde3rqu/JelU01HTgrLnxWVdJcv3R1XM06BvJ64rzZPs0N4kjuketeIKk=,iv:oHOAzASEVZunFHUcXPTXFoXUw10hBeEwxYBRdpQI1cI=,tag:obZUAhewwsLVdrdHxLYg5Q==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/root-password/password/users/kurogeek
+++ b/vars/per-machine/neptune/root-password/password/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:6f1e:6b42:c153:5461:a48:bced:d936
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/machines/neptune
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/machines/neptune
@@ -0,0 +1 @@
+../../../../../../sops/machines/neptune
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,51 @@
+{
+	"data": "ENC[AES256_GCM,data:mE1tSqDTrnvGFZIlA/Hzceg6NB0ZMGpu0XACSYlpLMyobqEa9RSsTUX+hyBrmTo0A9PosHTscmI4NmHWU73UAnTwOFkMwi6jebEKXDdIZU0YX0kus5blToe5Li0HTMhTR56GNPptywGjZsPGa3+zAOIh3TH8YMD4W8opdlisegTgG1d4On/rp+l6jcwRehCbL36pGmYKJg==,iv:cEK7BnP6CFLV4Fbrxs2CU68pvVxs6baR2/xXsAr8Gu4=,tag:iS7BahlN0GEjP+yj7FMo8g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkL0lNSm15QzlTQWZPZHVx\nRHp3UHJSR3hrQkVZYVVjOTBoMjhDcVE5elI4Cm83eGt6RXZLYzdsbk1QcndPWS9j\nanBDMTJwNEJ4enEyMy82cmc1ZHRyN1kKLS0tIHJsRzRSQVRNOWhFYmZWcFlRQlc1\ncGlFOXY4aHhlQU1iOUlJMlpvZktKNkEKRBvYL41kpcRYQhB112CYn3mAAGhzgH9O\ntl3dx12ziBAu3w2NNi9Kx56FTVwP/5MC5fa0z7/FEitW2qkVzXerXA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14x2fatvz802dyvnfukgkxfu30khuqml5ang9smm3pr9lc95eqpjs2ywxxf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByckhBVmRvMEZCQWpHaTRv\nMDVlVzgwZmsxQmVhV3RHOHNVUlVVUlhYaFFRCjZ2ZmYrQkVuaVV1VjdCUkpieUVl\nUXRGektvdzNMTGdSN25IM1ZNSVVQbUkKLS0tIFNlMFRia3VBQ3dEZWdVb0tyU1l0\nZFJ1ZzBIMUM0OVVyUGRuOWxjT09xU0EKtwMOhar5P3NZlBnvugSzjTOUzG+3EzQh\nIKtn4ZtHVGL91VFYJwl6GpYmuaZM+bBQ9DfSf9xTtDelADJlv0NGVQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNQXF4Njc4MTN1Sm41VG5m\nR2UvS0pGajNlQjAyUHZUUDRyOWhqdmZnWFI0Cm1GUXZnY3VrbGpET3BoVTNyMTNC\nVldTcFprQ1dsK3JRbDB6eGh1R1FWbEUKLS0tIE9ib291VWV5dC9JaVVHODA3Rlh0\nalpnaE5sWUtGMzhhZWd2b0d4aHJLQmsK4SbS4M4n92o0Lk1ZnSjuXHvjKhwNBmlj\nMUZBAnXaPYRpvGNWdXmTaSkxXcJUTtJvrLqctBDDbIciEHyHOueQLg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFl3R3A2SENl\nWkFsdXRQOEs0dlFaSmVsYU5acWJxcWVrWGtUN0hDRXNvbVUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3K0pSN21ZUnhRRDR2TUo3b0MyTERy\nVTRkY1BTM1ZDbDZ0d3ZvZlJlM0t3Ci0tLSBITmlWMHpld1YwRmc4WmFLZDZsVzN4\naEk0aGVvTzBzcTRPUDJSekhycXJrCsW1R583IwdojY4bUSQspEdGVDXci1cWrScb\n6dpeYu9uWB0JiesaDJ/arF4FbA7bDMKC3WT6t8dvDdqPzwaMTyM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG1xQ2YybXI1\nTFhEaXg4all6TVJFNW5WTEtKWDBRci9Zd3kvaG5odlB5aVEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpwd0UwcnZXemxkRDQvM2ZlWXRicEIv\nMDNra0txZkRTblRWbDQrMHBETkZNCi0tLSBNckdIT3h4aGF4N2xvNWtVakxIWUx6\nMUM1MlI3R1lqQ00yNkhMaSs1OG5JCrhuqHWE8aSoir4rYWtmZ8P+vL+gyxdvL3+n\n9iFyRiq9k74iyZ5qojiIOYhJIIis5Ygxygi/qDQm0/tqr7Vg7gE=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEJBKzlIK0pY\nbmZpR0ZxYzBXVkREdmx4Z0pudDBHWHA5MVZkQ2R3em5WMncgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp3SStKRzBTQ2loWkpidkJSZWdSYk1k\nNmFvOGpVWUhhNjJvckxKbDFOQVBzCi0tLSBEdE55NUhpSDR6U1FMRHhsVDVuYWZt\ncXBNVHBRVGQ2dm5rYkwvNTB4OEFvCl0/SrhvHrMD5O6bjUeOoXDeZjwsFdq636kz\nQvzC2t1rtthWo7oCKsTDV7wDCRIhqUeKnQlc5vb3ssQTzWByn1k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYQnIxVUNJV0JDY0xEZkFs\nc0F0QmNuY0xyM3l3MHYyOUJ4MVprbXNMVGpBCnpuUXJkTUZGb2RlMWdiYkpTZVRn\ndWpDSUtiT3pSNlVaaWZNVWR1NWFrRmcKLS0tIGFNTGt2N3JUeDNmQmRkZTBoUVJF\ndVhuRnJFa0ZWM1ZKSWUwMTRTUUlsRU0KkrDp96Evmf4vNnBeB0DWI7j6/t/3+T+C\n3OtG4xohL1R1tPzsaWeKRoSAzAMgAYWC2eSnJPT2xyN2ppGqu1Hu2g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqU09xVUJoU1NiQ2FwSG1E\nUElvVzJUTXNGMEtCQ2d5YVdkcWZpY3crVVFFCmc2My9XRzd4bzducHRwblcwOVhL\nelE5SHh4SXczVVF3c1dZaHR1WUpsS00KLS0tIFdCcmwyN1IzUmNRd3preUxxNGpD\nZzE3WVZyOG1RdWNRNXZ2ZUNtdEJnS1UKzmYfhhYiwmeNvpqFWgJdU5ogN5COd4j1\nc6aJ0QrdU7fnKQrAeYTbUCm3Hb0M02pzPLUiYgJVB86Nwlp8u/5TQg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Q3lwY0RZVC96NWNQUkhC\nOEpFYURlOUlpZjZHd3hBTVJhOVQ5azAwZUJ3Ckt5bXRWWmttUXduWTBZeWJxYkh2\nQ01QaXNicEdTcFpENTJ6Ti94YnBnZ3MKLS0tIGxCZUQ5ZVJXdDZxUWxMQ1R0ZU80\nSGUwZkRuM2hnNWNCeXhsRG9MNWViR28Kza+JHzNBnoSXz63q6nPEP+Zg//S9kn0J\nZj2GEgaK5X/VENf16blgwMvXuY1xGj+s91X+H4ZLudIQD4b9i6lk4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5bDdONmpwaC9PNFhYTGtj\nQm9RNUJoTUxPWG5BZkRqeGVRa2Fyd3VUQkFJCkRUZENaQndmcDhqRG9KSVNmN3VS\na1JlaWdWNW1lUllqa1hUZXdRTGVJdXMKLS0tIHNxUG5rdWwvTTQxeUhmbHE5a3Jv\nMy9jd1B0WHZxMHk0QXRIS0R4WlFUN1EKlSYbI89l0FaFSe2m/bTuccqP++0vNcBq\nbdD+Y0weyMuh9NvdbH+4wL2do/MgXNrGKKiBk8lIcwb6cUdbY5du7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-21T08:57:30Z",
+		"mac": "ENC[AES256_GCM,data:YV48MhAcKoE7BfYnAE4UrAl32Nv34KeliHuWhpf4hs5XE7675w/7nibYGOjgwLk5DO4HlalbRKHQzpxZJUHKZcWaNddc5k0rZIUm8is8n1B7MMA87Z1ZPuB5L/fRAhv9mdHCxBKL27X0FagiLxv5hZ1KXmxwu1HnP5s/V9+4ZlE=,iv:xqYactk9mfoMCyxtFUn/4iHdDsmtzxlntBvZjOR+p08=,tag:kF4bDKj7svRYeZvd5SwOMQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/neptune/yggdrasil/yggdrasil-subnet/value
+++ b/vars/per-machine/neptune/yggdrasil/yggdrasil-subnet/value
@@ -0,0 +1 @@
+300:6f1e:6b42:c153::/64
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-ip/value
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-ip/value
@@ -0,0 +1 @@
+200:8572:6695:fdef:15d6:6c5:698f:3ba4
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/groups/admins
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/machines/rigel
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/machines/rigel
@@ -0,0 +1 @@
+../../../../../../sops/machines/rigel
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret
@@ -0,0 +1,47 @@
+{
+	"data": "ENC[AES256_GCM,data:1dMtSGsh6eNkg3U4ReHxGbrGzomkthx8mtui7E58pk6f15tj7hFWpa3IKwGMXgszMWdnfIYIKT/eImz57P3/2Y/goBYZFCY9NuQztuSJx4BVgKn5vHJyGTWPRoEn1wKq1Py8PFubmsGmqxCSdtzRjc3q6ASoE21aknzg1E6suGOgX/Udt+ClQftaTqqardTGH/+QzzWLgA==,iv:0IGBhwFZzgeF3Q3BKsPoPStuvtBo+59N2NHR3wUUgQ8=,tag:9+HPTQK8uu+eeRLkMkUKWg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age134vt63pjqpd0m7702fyn8vhdlzyj2deqc2q78sp9uw9052kxsgwq6d25ez",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSUkRPSDR2ZTRNYmFVRXVa\nWU5LUTh1amdmSDFVQmhzZUp5ZW9Dcm1tYm1NCnJsVHdTWUYzbWV3UkVVeWVDRWlD\ndGJHQ0JkMU9RL2dNZnR3Vjc1blBMNkUKLS0tIHoyVnJmU0lKTG5seWVKTlN2UmFu\ncXNPcXJUOXpzMzl0MkZGejAxZ3VGc0EKS8OAKVR1APSdneX2wG0kOLPAcQqk0pXi\nuyzQvir3fJLsn27tnQ28owTRRZ+bF8W4hXFOhhFKMW9I0QfCEcfWng==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYdm9tYk9WWEUxUnpsYTNa\nMU1oYlcwOHRNdHhHamlBcHFWbW54Z09sMkg4CnFocWFUVXlQd3U2cUxmK0pXL2t2\nWUtOMEpNdmZnSDFoRDRGejRXVnd2RVEKLS0tIHVuV3oxSDJjZGpkS1NZMHMyR3Nn\nUXlkMXJzcVhMbmVvU3ZvYXltUkt5dHcKR8vpS/UKyMJ2hbtkBisJhR40RQFgBOa1\nE6l98MmLTRqzXzWcGUtx0KJIn1N5WYzObLDL+Ozame5tPPyXh1LufQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9zSmFScVJi\nUkFjVGRUbmpYMkNxamd2WHFidHdZT1NMSDJoQitYSVRPd0EgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp2bXJqWmNDRXc2V3l0SVdVNlIwRWJQ\nMGhmdDE2c2VzV2hyTlJDNzQvN1A0Ci0tLSBpZmc1RU9JTExvNGhVeGdYL1llRnFD\nclFjR08xVkhhdURaVDIrUVlxb2FvCsGgkwtlSkVYuv5ryExZ4pPW6nhzSfRRWU3S\nONCdxRzFZvRk2pjQnAVh/kZjahUXnBkIVhcq1Q3eYA2lyXxct1s=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHpaRGZhSlBa\nOE0zK08vZVpjaCt2cGI2aU1TcGZXR1UzSit5U0c4S3VnMHMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpzK250Skh6bkhzc0NyM2lVeWs5T013\nVFJ3R2J6VU1qdGh4N24yQmgxamVrCi0tLSA5bVNrYXhnSVZnNy9ZM3hxczFMWWJs\nRitlWFcwelZ5cEFxWFNWOTBoVlQwCjEqDW9t4SvIF2Ssft+vpnIYQ/FqBGaC6MOk\nhJMa1SxEyCJ4Ey4w/3EzlRybAZpSOfrHKsYi81IjN53zMMuCk9s=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG5ac0Njd0lJ\nQ2kvcVQ5dTBhUmV6eUk1cll2K3lydWR3aXQwUlVHa3ZlQ3cgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6TXdDZEJvREtYblhuZ1pXVmp3Y0RE\nZyswOWhXZ0owSDRFQW40WFU5WVQ0Ci0tLSBDVnd6R2tBS1Y2M2NWd1owSDRmOXdO\nbEtOT3BNd0IzcHo5azVaWnBnQWh3CtPclvQu9at0hYpBkRywzG+Ar399azaEM22K\nHTikQgyAt3hwnxanAa6DFEtK3mggHK9bUQeFcAZd2/jCYprpNsA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTcnVBZ3Zid3NYdEdML2VG\nMDEzOFkrSDRuYkp0YThtKzBHQVRrRWlFa0VFCmIvQXRhRXNzY01hYTJiZkd0LzFS\nVm15K08zV3hzd0YvamhNNW1YQTVCTTQKLS0tIHYzNGptSkRnT2cwMUh4Ym44d0Ex\nd0owbzFUeTZUQmNNUHFEdzgyZ2NCZXMKm6vZhqi0LCyRZXNtF3M2pGfitexaBi9j\n5OuNC19YiNfTzLm0LRMuDjpzuypGJwzo3oSZH322aZNqvhgDfgx9WQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZWE1JcHJvU0pPMFRvU2tX\nejV3REdJUWxtYnk5VVlyR0doMVNiMUdGWFJNCmY2S3FacDRQR1FhOFN1c0dmOSta\nQkdyaTd4RnNYK0ZsOEhnUVEzdmhETE0KLS0tIFVSV2VFUmxQWGIyNWc1Mmx3cVhu\nZ0ZESURhcEc4cUw4T3haVVVTR1VuL1UK1YNbgSTxHAk9/5zuQ+44qSBR05Rx78Ln\n9g28PwfmccyizNNcuRVP71MOosATDS+FAkEIT02N+A8l3MeaSZ19Xg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5UDBQNHM2TzVKU0krOHZy\nRjl6cy9QME5GTUtxWU15K1ZrL2YvUjNzNEQ0CnUxd0tqNGxHVGZ5RWxLc3ExMEFj\nMGhzZm4rdFcwa2FBeGhvRUh5UnYveUEKLS0tIDBYQTdRQmhhVHR4U3d0amhJUnhU\nbXBPTCtoR1YrT2orQ1V2RkNlYkJuMmMKPD65HPvOQgPvuGp//PvDR/Pa87nTGeRG\n682MvdjUmDxLi5liRhoRvnMYN5P5aNP79/L5PSp0BrqDM1Dqxx8ZTA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3Z2lZcmhGSENRcDR6RVBx\nT2xLSEVleXJ3ZXZ6SkFJR0RMYzc0T0gybkhNCkthODZkbWptbnBKU1BpaVdBbGJX\nQTh6dU9CTlhDRjhaUnVxYy9yaDIzdEUKLS0tIGphcjBKREhPc3NHYmZMYVpLbnpR\nMEQzME05VCtxWFVQcVlCUXZEdUh0UlEK3PKmi8lZAFP80wbdjkXjU0a2xjw9xX9b\n5eGV53ULQXMpWaDHwpjYMxxi20bDjEVOgzphrhxyJt3hy+kSNBYN7w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-21T08:57:45Z",
+		"mac": "ENC[AES256_GCM,data:bG7lqye0VqkkK7wtR8zoGqJPuphSOYw7QVNqxq7q0dr35yVjesGkJ7Y74+D/1qaeUXKbWnrDTGIAqYfdHXrWuyIuc+Ry77PA4keKFGbaa78GKuvUXrW2dTDd2G02YDGavpsYKbP1qUumPYjZ5NLkwZnHEo5GHRbdfj2l4AYrTEw=,iv:0qu47k2G/Yt99nGhz3fL6ScjScO11CdDLbU79Xkl08E=,tag:31lBmsiBRY4akCQTPIZ66w==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/users/kurogeek
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-secret/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
--- a/vars/per-machine/rigel/yggdrasil/yggdrasil-subnet/value
+++ b/vars/per-machine/rigel/yggdrasil/yggdrasil-subnet/value
@@ -0,0 +1 @@
+300:8572:6695:fdef::/64
Author	SHA1	Message	Date
kurogeek	8ea257bfbd	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/rigel/networking.nix	2025-10-21 17:04:45 +07:00
kurogeek	238f449a47	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/rigel/networking.nix	2025-10-21 16:16:47 +07:00
kurogeek	219027a0f1	Update vars via generator yggdrasil for machine rigel	2025-10-21 15:57:45 +07:00
kurogeek	d89117cf42	Update vars via generator yggdrasil for machine neptune	2025-10-21 15:57:30 +07:00
kurogeek	c9c733e53a	mob next [ci-skip] [ci skip] [skip ci] lastFile:vars/per-machine/rigel/yggdrasil/yggdrasil-secret/secret	2025-10-21 15:56:11 +07:00
kurogeek	b5f3adacd8	clanService yggdrasil add vars yggdrasil/yggdrasil-subnet	2025-10-21 15:55:18 +07:00
kurogeek	2eb52251cc	clanService yggdrasil	2025-10-17 16:58:43 +07:00
kurogeek	be25560858	WhiteHouse router configuration	2025-10-16 14:53:41 +07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE09U7Tuvn3/icqFhjKuhp4hG+V6E6IFKhX1W2hVvyVj`