inventory/borgbackup: fix ssh key path for cursa, hadar, procyon, bosona, canopus, deneb

The sops vars backend deploys generator files at /run/secrets/vars/per-machine/<machine>/<generator>/<file>; the hard-coded rsh still pointed at /run/secrets/vars/borgbackup/borgbackup.ssh, so borgbackup-job-alex could not find its key. Align with alasia's entry.
inventory.json: update install time of alasia
2026-10-27 06:15:06 +00:00 · 2026-10-27 12:01:54 +07:00 · 2026-10-27 12:01:53 +07:00 · 2026-10-27 02:20:53 +00:00 · 2026-10-27 02:20:53 +00:00 · 2026-10-27 02:04:04 +00:00
155 changed files with 3403 additions and 847 deletions
@@ -38,6 +38,22 @@
        "type": "github"
      }
    },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
    "call-flake": {
      "locked": {
        "lastModified": 1687380775,
@@ -135,11 +151,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781517972,
-        "narHash": "sha256-G8bIXFqifs/y62GNPwg20Ksf71raYwzmyN99gf1tXak=",
+        "lastModified": 1792819087,
+        "narHash": "sha256-1bxllGymY+u3NvEX4FHMZyE4l9y0nRpvk/qLaPkwAjg=",
        "ref": "refs/heads/main",
-        "rev": "7fc62d0c25c7a97d7027a9c248e21c97c9b3acc1",
-        "revCount": 14604,
+        "rev": "94862153f6e63016151d7c527f9e7bb3e96b0598",
+        "revCount": 15417,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -148,6 +164,36 @@
        "url": "https://git.clan.lol/clan/clan-core"
      }
    },
+    "cnx-network": {
+      "inputs": {
+        "clan-core": [
+          "clan-core"
+        ],
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixos-mailserver": "nixos-mailserver",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790583225,
+        "narHash": "sha256-Nhgf1hptHA9pgcGN4U1wQqDg1cc3t6oCT/HCgBcRs/w=",
+        "ref": "refs/heads/main",
+        "rev": "b2749dcc6ebe5d055b691f32dd47039f745a7d0e",
+        "revCount": 203,
+        "type": "git",
+        "url": "https://git.b4l.co.th/B4L/cnx-network-clan"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.b4l.co.th/B4L/cnx-network-clan"
+      }
+    },
    "data-mesher": {
      "inputs": {
        "flake-parts": [
@@ -164,11 +210,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1778718524,
-        "narHash": "sha256-pXLoI6Ax0EnUK6r34UM1vibVC7CfTu6j72R2692ZzPs=",
-        "rev": "12c552ad547d87254f33f33bddd1a2cdbeac754d",
+        "lastModified": 1791886485,
+        "narHash": "sha256-/+7ayxD7PeW6wMQiHw20UJHmSTGN8Y5HXbn0zG/EgoA=",
+        "rev": "8d4d36437f9fff6ecaa34872bd53c3ed09ef5464",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/12c552ad547d87254f33f33bddd1a2cdbeac754d.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/8d4d36437f9fff6ecaa34872bd53c3ed09ef5464.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -203,11 +249,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "lastModified": 1792526520,
+        "narHash": "sha256-3hSJlv8mUVnZPMWK2+CM7a9O+nR6Z4mCh27NfLCmTPc=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "cedd626e11b635470fa6f9fdb8ad79b0075dd7f9",
        "type": "github"
      },
      "original": {
@@ -249,6 +295,22 @@
        "type": "github"
      }
    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
@@ -357,11 +419,11 @@
        "std": "std"
      },
      "locked": {
-        "lastModified": 1782964989,
-        "narHash": "sha256-pU2Gye+1f+nvFleBTgXdeQfrQnKaJEuO2LT7PnsJ1p0=",
+        "lastModified": 1789106589,
+        "narHash": "sha256-RMQdAvDaa4eUcdePDqUGAhnyTtzKxc6a8abauy8bzb0=",
        "owner": "kurogeek",
        "repo": "frappix",
-        "rev": "ac5e2814fc1aca188080bf6b50504cd329790e56",
+        "rev": "dbfa76d84df6354bd7528c9d0c407387f66c3e33",
        "type": "github"
      },
      "original": {
@@ -370,6 +432,57 @@
        "type": "github"
      }
    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "cnx-network",
+          "nixos-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "cnx-network",
+          "nixos-mailserver",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778507602,
+        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "cnx-network",
+          "nixos-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
    "haskell-flake": {
      "locked": {
        "lastModified": 1675296942,
@@ -416,11 +529,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781557312,
-        "narHash": "sha256-QOIRYSUFSq7L5mY3dZymaVhcnne3tPgoR9riB0WocjA=",
+        "lastModified": 1788355065,
+        "narHash": "sha256-gAz5oTI7ur34CfuakQduiQd/2ZhO62Bn2XXg08nZYYQ=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "c03e4752899e55705dfa63979abd885c582a5c48",
+        "rev": "d9d750e4fc11c10cab2da677bdd31e427f3a3a71",
        "type": "github"
      },
      "original": {
@@ -497,6 +610,35 @@
        "url": "https://gti.telent.net/dan/liminix"
      }
    },
+    "matthew-hardware": {
+      "inputs": {
+        "disko": [
+          "clan-core",
+          "disko"
+        ],
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "unf": "unf"
+      },
+      "locked": {
+        "lastModified": 1789393925,
+        "narHash": "sha256-8PHRxSVWxu1ol1AIrqiP8g6t+h9fLekTgDdpgRa+sME=",
+        "ref": "mc/wip",
+        "rev": "ebee3891bc9cbec584f611b4bcdf12618da25148",
+        "revCount": 34,
+        "type": "git",
+        "url": "https://codeberg.org/matthewcroughan/matthew-hardware"
+      },
+      "original": {
+        "ref": "mc/wip",
+        "type": "git",
+        "url": "https://codeberg.org/matthewcroughan/matthew-hardware"
+      }
+    },
    "microvm": {
      "inputs": {
        "flake-utils": "flake-utils",
@@ -547,11 +689,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781242433,
-        "narHash": "sha256-bchLZZ3sRn740zyvD2icZSnNoTaanN0nw7l6fjVXO+E=",
+        "lastModified": 1792737899,
+        "narHash": "sha256-P0/GhewcEQmAbzq3QunNWY2jLJaYH9F6c/5dEM/jQ4M=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "aabb2037edfc0f210723b72cd5f528aab5dd3f0b",
+        "rev": "bb0b90dbd54e207100de72b5dcbe3188c98a4b69",
        "type": "github"
      },
      "original": {
@@ -690,6 +832,31 @@
        "type": "github"
      }
    },
+    "nixos-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nixpkgs": [
+          "cnx-network",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785198005,
+        "narHash": "sha256-falBPi+PJtMx0vwII8L24wjDGXNZMwRiVXsw8WTXLEo=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "d357b9f048c5532ec81b0e0034c0b8463d5ddd46",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "ref": "nixos-26.05",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1712920918,
@@ -707,11 +874,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1781359544,
-        "narHash": "sha256-iUuzKQcyXvopYDDzFpMK5eQKP3WIJExYny2kJtbgUcE=",
+        "lastModified": 1780365719,
+        "narHash": "sha256-QfWfccTN+70ZQ4m2qlU9PiKfz2Yppq94058iJyARNwc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "9f11f828c213641c2369a9f1fa31fe31557e3156",
+        "rev": "ffa10e26ae11d676b2db836259889f1f571cb14f",
        "type": "github"
      },
      "original": {
@@ -721,6 +888,22 @@
        "type": "github"
      }
    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1792773339,
+        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "nosys": {
      "locked": {
        "lastModified": 1668010795,
@@ -752,16 +935,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1708640854,
-        "narHash": "sha256-EpcAmvIS4ErqhXtVEfd2GPpU/E/s8CCRSfYzk6FZ/fY=",
+        "lastModified": 1787579760,
+        "narHash": "sha256-WGhIEINOICx7bhV3WrSz0QTzv8uzaaa9AXvD1clIWpc=",
        "owner": "paisano-nix",
        "repo": "core",
-        "rev": "adcf742bc9463c08764ca9e6955bd5e7dcf3a3fe",
+        "rev": "88739c84d308876714322eb9844ede6597c1a580",
        "type": "github"
      },
      "original": {
        "owner": "paisano-nix",
-        "ref": "0.2.0",
        "repo": "core",
        "type": "github"
      }
@@ -810,14 +992,16 @@
      "inputs": {
        "clan-community": "clan-community",
        "clan-core": "clan-core",
+        "cnx-network": "cnx-network",
        "devshell": "devshell",
        "flake-parts": "flake-parts",
        "frappix": "frappix",
        "home-manager": "home-manager",
        "import-tree": "import-tree",
        "liminix": "liminix",
+        "matthew-hardware": "matthew-hardware",
        "nixos-images": "nixos-images",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
        "plasma-manager": "plasma-manager",
        "treefmt-nix": "treefmt-nix"
      }
@@ -830,11 +1014,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780547341,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "lastModified": 1792809984,
+        "narHash": "sha256-KV+CaZX7QS0hcdKxwGKehDb1jmUgx6lbkTPpaoIW5Nw=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "rev": "442449fa7b1fe6c692d0103ac9fc8f9e82931cf3",
        "type": "github"
      },
      "original": {
@@ -921,11 +1105,11 @@
    },
    "systems": {
      "locked": {
-        "lastModified": 1774449309,
-        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "lastModified": 1791244623,
+        "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
        "owner": "nix-systems",
        "repo": "default",
-        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
        "type": "github"
      },
      "original": {
@@ -985,6 +1169,24 @@
        "type": "github"
      }
    },
+    "unf": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1779596435,
+        "narHash": "sha256-ztzeJVOQDhQtE0z9DwtSWL+OyoWKZrAD4gzRRvUP9ug=",
+        "ref": "refs/heads/main",
+        "rev": "4f5ab30ee524f09126b09f42f249c0aba756459d",
+        "revCount": 6,
+        "type": "git",
+        "url": "https://git.atagen.co/atagen/unf"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.atagen.co/atagen/unf"
+      }
+    },
    "yants": {
      "inputs": {
        "nixpkgs": [
@@ -31,7 +31,7 @@
      inputs.home-manager.follows = "home-manager";
    };
    import-tree.url = "github:vic/import-tree";
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -51,6 +51,23 @@
      inputs.nixos-unstable.follows = "nixpkgs";
      inputs.nixos-stable.follows = "nixpkgs";
    };
+
+    matthew-hardware = {
+      url = "git+https://codeberg.org/matthewcroughan/matthew-hardware?ref=mc/wip";
+      inputs.flake-parts.follows = "flake-parts";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.disko.follows = "clan-core/disko";
+    };
+
+    # `router` clan service (site gateway: PPPoE, VLAN bridge, Kea/Blocky,
+    # nftables). Consumed via `module.input = "cnx-network"` in inventories/router.nix.
+    cnx-network = {
+      url = "git+https://git.b4l.co.th/B4L/cnx-network-clan";
+      inputs.clan-core.follows = "clan-core";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
+      inputs.treefmt-nix.follows = "treefmt-nix";
+    };
  };
  outputs =
    {
@@ -2,6 +2,7 @@
  imports = [
    ./personal-computer.nix
    ./emmie.nix
+    ./router.nix
  ];
  clan = {
    inventory = {
@@ -16,7 +17,10 @@
          "deneb"
          "bosona"
        ];
-        w = [ "sirius" ];
+        w = [
+          "sirius"
+          "stellio"
+        ];
        b4l = [
          "rigel"
          "rana"
@@ -36,6 +40,7 @@
          "cursa"
          "rigel"
          "vega"
+          "buna"
        ];

        dm-bootstrapper = [
@@ -45,6 +50,12 @@
          "bosona"
          "canopus"
        ];
+
+        dm-pull-deploy = [
+          "rana"
+          "rigel"
+          "vega"
+        ];
      };

      instances = {
@@ -57,43 +68,43 @@
          roles.client.machines."cursa".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/cursa/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/cursa/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."hadar".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/hadar/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/hadar/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."procyon".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/procyon/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/procyon/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."bosona".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/bosona/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/bosona/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."canopus".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/canopus/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/canopus/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."deneb".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/deneb/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/deneb/borgbackup/borgbackup.ssh";
            };
          };
          roles.client.machines."alasia".settings.destinations = {
            alex = {
              repo = "ssh://borg@10.0.10.225:2222/backup/alasia/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/alasia/borgbackup/borgbackup.ssh";
            };
          };
        };
@@ -181,7 +192,7 @@
              }
            )
          ];
-          roles.default.tags = [ "all" ];
+          roles.default.tags = [ "dm-pull-deploy" ];
          roles.default.settings.action = "switch";
        };

@@ -299,10 +310,17 @@
            "200:c8db:ea9b:5bdc:44ed:ad87:462a:6bd0"
          ];
          roles.default.settings.extraPeers = [
-            "tls://ygg.jjolly.dev:3443"
-            "tls://[2602:fc24:18:7a42::1]:993"
+            "tls://133.18.201.69:54232"
+            "tls://153.120.42.137:54232"
+            "tcp://yg-sin.magicum.net:23901"
+            "tls://asia.deinfra.org:15015"
+            "tls://ygg5.mk16.de:1338?key=0000009611ae5391dc0aceea9f3fa6a0dc1279f4306059339e84bfb8b74d2f9b"
            "tcp://leo.node.3dt.net:9002"
            "tcp://ygg-kcmo.incognet.io:8883"
+            "tls://23.184.48.86:1443"
+            "tls://192.3.13.16:8118"
+            "tls://ygg-pa.incognet.io:8884"
+            "tls://mo.us.ygg.triplebit.org:993"
          ];
        };

@@ -313,13 +331,28 @@
          };
          roles.server.machines."alasia".settings = {
            public_url = "tailvpn.public.newedge.house";
-            base_domain = "tailnet.newedge.house";
            advertise_routes = [ "10.0.10.0/24" ];
-            nameservers = [
-              "10.0.10.82"
-              "1.1.1.1"
-              "8.8.8.8"
-            ];
+            dns = {
+              magic_dns = true;
+              base_domain = "tailvpn.newedge.house";
+              nameservers = [
+                "10.0.10.82"
+                "1.1.1.1"
+                "8.8.8.8"
+              ];
+              extra_records = [
+                {
+                  name = "poyerp.newedge.house";
+                  type = "A";
+                  value = "10.0.10.1";
+                }
+                {
+                  name = "glomerp.newedge.house";
+                  type = "A";
+                  value = "10.0.10.1";
+                }
+              ];
+            };
          };
        };

@@ -489,9 +522,49 @@
              exporters.smartctl = { };
              exporters.zfs = { };
            };
+            buna.settings = {
+              exporters.smartctl = { };
+            };
+            mirach.settings = {
+              exporters.smartctl = { };
+            };
+            almach.settings = {
+              exporters.smartctl = { };
+            };
+            stellio.settings.exporters.smartctl = { };
          };
        };

+        wifi =
+          let
+            networks = {
+              home = { };
+              glom = { };
+            };
+          in
+          {
+            module.name = "wifi";
+            module.input = "clan-community";
+
+            roles.default = {
+              machines."buna".settings = { inherit networks; };
+
+              extraModules = [
+                (
+                  { lib, ... }:
+                  {
+                    # profile names match the network attr names above;
+                    # 0 = retry forever for both (defaults: 4 autoconnect attempts, 3 auth attempts)
+                    networking.networkmanager.ensureProfiles.profiles = lib.mapAttrs (_: _: {
+                      connection.autoconnect-retries = 0;
+                      connection.auth-retries = 0;
+                    }) networks;
+                  }
+                )
+              ];
+            };
+          };
+
      };
    };
  };
@@ -0,0 +1,91 @@
+# Site gateways: the `router` clan service from cnx-network-clan (see
+# flake.nix input `cnx-network`, and that repo's modules/clan/router/README.md).
+# One instance for the fleet; each site adds its gateway machine with the
+# site's port / VLAN layout. `clan vars generate <gw>` then prompts for the
+# PPPoE username/password.
+{ lib, ... }:
+let
+  # Admin mesh = the site's ZeroTier network. The service only opens SSH,
+  # metrics and iperf3 to this prefix, so the gateway must also be a peer of
+  # the same network (tag membership in default.nix). Prefix derivation as in
+  # cnx-network's modules/mesh-hosts.nix: fd + 8-byte network id + 0x9993,
+  # /88 covers every peer.
+  meshSubnet =
+    instance:
+    let
+      networkId = lib.fileContents ../vars/shared/zerotier-network-${instance}/network-id/value;
+      full = "fd" + networkId + "9993";
+      hextet = i: builtins.substring (i * 4) 4 full;
+    in
+    "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
+in
+{
+  clan.inventory.instances.router = {
+    module = {
+      name = "router";
+      input = "cnx-network";
+    };
+
+    roles.default.settings.mesh.subnet = meshSubnet "w-network";
+
+    # stellio: GL.iNet Flint 2 (GL-MT6000, MT7986a). Ports as named by the
+    # device tree in matthew-hardware: eth1 = the 2.5G "WAN" port, lan1 = the
+    # 2.5G LAN port, lan2-lan5 = the 1G LAN ports (DSA on the MT7531 switch).
+    roles.default.machines.stellio.settings = {
+      site = "white-house";
+      siteId = 8;
+
+      # PPPoE on the ISP's VLAN 10, as on the liminix router it replaces
+      # (routers/white-house); set to null if the ISP runs PPPoE untagged.
+      wan.interface = "end1";
+      wan.vlanId = 10;
+
+      # lan1 (2.5G): untagged mgmt port for on-site recovery. lan2-lan4 (1G):
+      # untagged client ports on lan. lan5 is the pre-cutover staging uplink:
+      # DHCP client into the old LAN (routers/white-house), SSH only, no VLAN
+      # membership; set stagingPort = null at cutover.
+      accessPorts = {
+        lan1 = "mgmt";
+        lan2 = "lan";
+        lan3 = "lan";
+        lan4 = "lan";
+      };
+      stagingPort = "lan5";
+
+      # Both MT7976 radios serve lan as an untagged access port, one SSID per
+      # band named like the GL-AR750 it stands in for ("GL-AR750" on 2.4 GHz,
+      # "GL-AR750-5" on 5 GHz) so clients roam over unchanged. Passphrases
+      # are the `wifi-GL-AR750-passphrase` / `wifi-GL-AR750-5-passphrase`
+      # vars prompts. Channels as on the old router. Check the band mapping
+      # with `iw phy` (mt7986: phy0/wlan0 = 2.4 GHz, phy1/wlan1 = 5 GHz).
+      wifi = {
+        enable = true;
+        countryCode = "TH";
+        networks = {
+          "GL-AR750".vlan = "lan";
+          "GL-AR750-5".vlan = "lan";
+        };
+        radios = {
+          wlan0 = {
+            band = "2g";
+            channel = 2;
+            wifi6 = true;
+            networks = [ "GL-AR750" ];
+          };
+          wlan1 = {
+            band = "5g";
+            channel = 36;
+            wifi6 = true;
+            networks = [ "GL-AR750-5" ];
+          };
+        };
+      };
+
+      # 10.1.<id>.0/24, router .1, DHCP pool .100-.199.
+      vlans = {
+        mgmt.id = 10;
+        lan.id = 20;
+      };
+    };
+  };
+}
@@ -19,7 +19,7 @@
      "installedAt": 1765277591
    },
    "buna": {
-      "installedAt": 1765343708
+      "installedAt": 1787123510
    },
    "rana": {
      "installedAt": 1773134236
@@ -43,7 +43,7 @@
      "installedAt": 1775458442
    },
    "alasia": {
-      "installedAt": 1778661666
+      "installedAt": 1793077313
    },
    "bosona": {
      "installedAt": 1779098893
@@ -25,7 +25,10 @@
      {
        "index": 8,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -73,7 +76,10 @@
      {
        "index": 9,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -125,7 +131,10 @@
      {
        "index": 10,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -173,7 +182,10 @@
      {
        "index": 11,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -229,7 +241,10 @@
      {
        "index": 12,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -282,14 +297,21 @@
        },
        "driver": "piix4_smbus",
        "driver_module": "i2c_piix4",
-        "drivers": ["piix4_smbus"],
-        "driver_modules": ["i2c_piix4"],
+        "drivers": [
+          "piix4_smbus"
+        ],
+        "driver_modules": [
+          "i2c_piix4"
+        ],
        "module_alias": "pci:v00008086d00007113sv00001AF4sd00001100bc06sc80i00"
      },
      {
        "index": 17,
        "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -337,9 +359,13 @@
    ],
    "cdrom": [
      {
-        "index": 22,
+        "index": 23,
        "attached_to": 15,
-        "class_list": ["cdrom", "scsi", "block_device"],
+        "class_list": [
+          "cdrom",
+          "scsi",
+          "block_device"
+        ],
        "bus_type": {
          "hex": "0084",
          "name": "SCSI",
@@ -396,8 +422,14 @@
        "unix_device_name2": "/dev/sg1",
        "driver": "ata_piix",
        "driver_module": "ata_piix",
-        "drivers": ["ata_piix", "sr"],
-        "driver_modules": ["ata_piix", "sr_mod"]
+        "drivers": [
+          "ata_piix",
+          "sr"
+        ],
+        "driver_modules": [
+          "ata_piix",
+          "sr_mod"
+        ]
      }
    ],
    "cpu": [
@@ -464,7 +496,9 @@
          "spectre_v2_user",
          "its"
        ],
-        "power_management": [""],
+        "power_management": [
+          ""
+        ],
        "bogo": 4224,
        "cache": 16384,
        "page_size": 4096,
@@ -475,7 +509,7 @@
        "fpu_exception": false,
        "cpuid_level": 13,
        "write_protect": false,
-        "tlb_size": 32764,
+        "tlb_size": 32766,
        "clflush_size": 64,
        "cache_alignment": 128,
        "address_sizes": {
@@ -546,7 +580,9 @@
          "spectre_v2_user",
          "its"
        ],
-        "power_management": [""],
+        "power_management": [
+          ""
+        ],
        "bogo": 4224,
        "cache": 16384,
        "page_size": 4096,
@@ -557,7 +593,7 @@
        "fpu_exception": false,
        "cpuid_level": 13,
        "write_protect": false,
-        "tlb_size": 32764,
+        "tlb_size": 32766,
        "clflush_size": 64,
        "cache_alignment": 128,
        "address_sizes": {
@@ -568,16 +604,20 @@
    ],
    "disk": [
      {
-        "index": 23,
-        "attached_to": 19,
-        "class_list": ["disk", "scsi", "block_device"],
+        "index": 22,
+        "attached_to": 20,
+        "class_list": [
+          "disk",
+          "scsi",
+          "block_device"
+        ],
        "bus_type": {
          "hex": "0084",
          "name": "SCSI",
          "value": 132
        },
        "slot": {
-          "bus": 1,
+          "bus": 3,
          "number": 0
        },
        "base_class": {
@@ -606,20 +646,20 @@
          "value": 0
        },
        "model": "QEMU HARDDISK",
-        "sysfs_id": "/class/block/sda",
-        "sysfs_bus_id": "1:0:0:0",
-        "sysfs_device_link": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio2/host1/target1:0:0/1:0:0:0",
+        "sysfs_id": "/class/block/sdb",
+        "sysfs_bus_id": "3:0:0:0",
+        "sysfs_device_link": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio3/host3/target3:0:0/3:0:0:0",
        "unix_device_names": [
          "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0",
          "/dev/disk/by-path/pci-0000:01:01.0-scsi-0:0:0:0",
-          "/dev/sda"
+          "/dev/sdb"
        ],
-        "unix_device_name2": "/dev/sg0",
+        "unix_device_name2": "/dev/sg2",
        "rom_id": "0x80",
        "resources": [
          {
            "type": "disk_geo",
-            "cylinders": 8354,
+            "cylinders": 9399,
            "heads": 255,
            "sectors": 63,
            "size": "0x0",
@@ -628,21 +668,30 @@
          {
            "type": "size",
            "unit": "sectors",
-            "value_1": 134217728,
+            "value_1": 150994944,
            "value_2": 512
          }
        ],
        "driver": "virtio_scsi",
        "driver_module": "virtio_scsi",
-        "drivers": ["sd", "virtio_scsi"],
-        "driver_modules": ["sd_mod", "virtio_scsi"]
+        "drivers": [
+          "sd",
+          "virtio_scsi"
+        ],
+        "driver_modules": [
+          "sd_mod",
+          "virtio_scsi"
+        ]
      }
    ],
    "graphics_card": [
      {
        "index": 16,
        "attached_to": 0,
-        "class_list": ["graphics_card", "pci"],
+        "class_list": [
+          "graphics_card",
+          "pci"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -699,8 +748,12 @@
        },
        "driver": "bochs-drm",
        "driver_module": "bochs",
-        "drivers": ["bochs-drm"],
-        "driver_modules": ["bochs"],
+        "drivers": [
+          "bochs-drm"
+        ],
+        "driver_modules": [
+          "bochs"
+        ],
        "module_alias": "pci:v00001234d00001111sv00001AF4sd00001100bc03sc00i00"
      }
    ],
@@ -708,7 +761,10 @@
      {
        "index": 24,
        "attached_to": 7,
-        "class_list": ["usb", "hub"],
+        "class_list": [
+          "usb",
+          "hub"
+        ],
        "bus_type": {
          "hex": "0086",
          "name": "USB",
@@ -781,8 +837,12 @@
        "hotplug": "usb",
        "driver": "hub",
        "driver_module": "usbcore",
-        "drivers": ["hub"],
-        "driver_modules": ["usbcore"],
+        "drivers": [
+          "hub"
+        ],
+        "driver_modules": [
+          "usbcore"
+        ],
        "module_alias": "usb:v1D6Bp0001d0618dc09dsc00dp00ic09isc00ip00in00"
      }
    ],
@@ -790,7 +850,9 @@
      {
        "index": 5,
        "attached_to": 0,
-        "class_list": ["memory"],
+        "class_list": [
+          "memory"
+        ],
        "base_class": {
          "hex": "0101",
          "name": "Internally Used Class",
@@ -814,7 +876,9 @@
      {
        "index": 21,
        "attached_to": 16,
-        "class_list": ["monitor"],
+        "class_list": [
+          "monitor"
+        ],
        "base_class": {
          "hex": "0100",
          "name": "Monitor",
@@ -960,7 +1024,10 @@
      {
        "index": 25,
        "attached_to": 24,
-        "class_list": ["mouse", "usb"],
+        "class_list": [
+          "mouse",
+          "usb"
+        ],
        "bus_type": {
          "hex": "0086",
          "name": "USB",
@@ -996,7 +1063,9 @@
        "model": "QEMU USB Tablet",
        "sysfs_id": "/devices/pci0000:00/0000:00:01.2/usb1/1-1/1-1:1.0",
        "sysfs_bus_id": "1-1:1.0",
-        "unix_device_names": ["/dev/input/mice"],
+        "unix_device_names": [
+          "/dev/input/mice"
+        ],
        "unix_device_name2": "/dev/input/mouse0",
        "resources": [
          {
@@ -1037,11 +1106,18 @@
        "hotplug": "usb",
        "driver": "usbhid",
        "driver_module": "usbhid",
-        "drivers": ["usbhid"],
-        "driver_modules": ["usbhid"],
+        "drivers": [
+          "usbhid"
+        ],
+        "driver_modules": [
+          "usbhid"
+        ],
        "driver_info": {
          "type": "mouse",
-          "db_entry_0": ["explorerps/2", "exps2"],
+          "db_entry_0": [
+            "explorerps/2",
+            "exps2"
+          ],
          "xf86": "explorerps/2",
          "gpm": "exps2",
          "buttons": -1,
@@ -1054,7 +1130,9 @@
      {
        "index": 18,
        "attached_to": 13,
-        "class_list": ["network_controller"],
+        "class_list": [
+          "network_controller"
+        ],
        "bus_type": {
          "hex": "008f",
          "name": "Virtio",
@@ -1079,7 +1157,9 @@
        "model": "Virtio Ethernet Card 0",
        "sysfs_id": "/devices/pci0000:00/0000:00:12.0/virtio1",
        "sysfs_bus_id": "virtio1",
-        "unix_device_names": ["ens18"],
+        "unix_device_names": [
+          "ens18"
+        ],
        "resources": [
          {
            "type": "hwaddr",
@@ -1092,8 +1172,12 @@
        ],
        "driver": "virtio_net",
        "driver_module": "virtio_net",
-        "drivers": ["virtio_net"],
-        "driver_modules": ["virtio_net"],
+        "drivers": [
+          "virtio_net"
+        ],
+        "driver_modules": [
+          "virtio_net"
+        ],
        "module_alias": "virtio:d00000001v00001AF4"
      }
    ],
@@ -1101,7 +1185,9 @@
      {
        "index": 26,
        "attached_to": 18,
-        "class_list": ["network_interface"],
+        "class_list": [
+          "network_interface"
+        ],
        "base_class": {
          "hex": "0107",
          "name": "Network Interface",
@@ -1115,7 +1201,9 @@
        "model": "Ethernet network interface",
        "sysfs_id": "/class/net/ens18",
        "sysfs_device_link": "/devices/pci0000:00/0000:00:12.0/virtio1",
-        "unix_device_names": ["ens18"],
+        "unix_device_names": [
+          "ens18"
+        ],
        "resources": [
          {
            "type": "hwaddr",
@@ -1128,13 +1216,19 @@
        ],
        "driver": "virtio_net",
        "driver_module": "virtio_net",
-        "drivers": ["virtio_net"],
-        "driver_modules": ["virtio_net"]
+        "drivers": [
+          "virtio_net"
+        ],
+        "driver_modules": [
+          "virtio_net"
+        ]
      },
      {
        "index": 27,
        "attached_to": 0,
-        "class_list": ["network_interface"],
+        "class_list": [
+          "network_interface"
+        ],
        "base_class": {
          "hex": "0107",
          "name": "Network Interface",
@@ -1147,14 +1241,19 @@
        },
        "model": "Loopback network interface",
        "sysfs_id": "/class/net/lo",
-        "unix_device_names": ["lo"]
+        "unix_device_names": [
+          "lo"
+        ]
      }
    ],
    "pci": [
      {
        "index": 13,
        "attached_to": 0,
-        "class_list": ["pci", "unknown"],
+        "class_list": [
+          "pci",
+          "unknown"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1211,14 +1310,21 @@
        },
        "driver": "virtio-pci",
        "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
        "module_alias": "pci:v00001AF4d00001000sv00001AF4sd00000001bc02sc00i00"
      },
      {
        "index": 14,
        "attached_to": 0,
-        "class_list": ["pci", "unknown"],
+        "class_list": [
+          "pci",
+          "unknown"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1274,8 +1380,12 @@
        },
        "driver": "virtio-pci",
        "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
        "module_alias": "pci:v00001AF4d00001002sv00001AF4sd00000005bc00scFFi00"
      }
    ],
@@ -1283,7 +1393,10 @@
      {
        "index": 6,
        "attached_to": 17,
-        "class_list": ["storage_controller", "pci"],
+        "class_list": [
+          "storage_controller",
+          "pci"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1325,7 +1438,7 @@
        "resources": [
          {
            "type": "io",
-            "base": 49152,
+            "base": 49216,
            "range": 64,
            "enabled": true,
            "access": "read_write"
@@ -1340,14 +1453,21 @@
        },
        "driver": "virtio-pci",
        "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
        "module_alias": "pci:v00001AF4d00001004sv00001AF4sd00000008bc01sc00i00"
      },
      {
        "index": 15,
        "attached_to": 0,
-        "class_list": ["storage_controller", "pci"],
+        "class_list": [
+          "storage_controller",
+          "pci"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1437,8 +1557,12 @@
        },
        "driver": "ata_piix",
        "driver_module": "ata_piix",
-        "drivers": ["ata_piix"],
-        "driver_modules": ["ata_piix"],
+        "drivers": [
+          "ata_piix"
+        ],
+        "driver_modules": [
+          "ata_piix"
+        ],
        "module_alias": "pci:v00008086d00007010sv00001AF4sd00001100bc01sc01i80"
      }
    ],
@@ -1448,33 +1572,10 @@
    "unknown": [
      {
        "index": 19,
-        "attached_to": 6,
-        "class_list": ["unknown"],
-        "base_class": {
-          "hex": "0000",
-          "name": "Unclassified device",
-          "value": 0
-        },
-        "sub_class": {
-          "hex": "0000",
-          "name": "Unclassified device",
-          "value": 0
-        },
-        "vendor": "Virtio",
-        "device": "",
-        "model": "Virtio Unclassified device",
-        "sysfs_id": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio2",
-        "sysfs_bus_id": "virtio2",
-        "driver": "virtio_scsi",
-        "driver_module": "virtio_scsi",
-        "drivers": ["virtio_scsi"],
-        "driver_modules": ["virtio_scsi"],
-        "module_alias": "virtio:d00000008v00001AF4"
-      },
-      {
-        "index": 20,
        "attached_to": 14,
-        "class_list": ["unknown"],
+        "class_list": [
+          "unknown"
+        ],
        "base_class": {
          "hex": "0000",
          "name": "Unclassified device",
@@ -1492,16 +1593,54 @@
        "sysfs_bus_id": "virtio0",
        "driver": "virtio_balloon",
        "driver_module": "virtio_balloon",
-        "drivers": ["virtio_balloon"],
-        "driver_modules": ["virtio_balloon"],
+        "drivers": [
+          "virtio_balloon"
+        ],
+        "driver_modules": [
+          "virtio_balloon"
+        ],
        "module_alias": "virtio:d00000005v00001AF4"
+      },
+      {
+        "index": 20,
+        "attached_to": 6,
+        "class_list": [
+          "unknown"
+        ],
+        "base_class": {
+          "hex": "0000",
+          "name": "Unclassified device",
+          "value": 0
+        },
+        "sub_class": {
+          "hex": "0000",
+          "name": "Unclassified device",
+          "value": 0
+        },
+        "vendor": "Virtio",
+        "device": "",
+        "model": "Virtio Unclassified device",
+        "sysfs_id": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio3",
+        "sysfs_bus_id": "virtio3",
+        "driver": "virtio_scsi",
+        "driver_module": "virtio_scsi",
+        "drivers": [
+          "virtio_scsi"
+        ],
+        "driver_modules": [
+          "virtio_scsi"
+        ],
+        "module_alias": "virtio:d00000008v00001AF4"
      }
    ],
    "usb_controller": [
      {
        "index": 7,
        "attached_to": 0,
-        "class_list": ["usb_controller", "pci"],
+        "class_list": [
+          "usb_controller",
+          "pci"
+        ],
        "bus_type": {
          "hex": "0004",
          "name": "PCI",
@@ -1568,15 +1707,25 @@
        },
        "driver": "uhci_hcd",
        "driver_module": "uhci_hcd",
-        "drivers": ["uhci_hcd"],
-        "driver_modules": ["uhci_hcd"],
+        "drivers": [
+          "uhci_hcd"
+        ],
+        "driver_modules": [
+          "uhci_hcd"
+        ],
        "driver_info": {
          "type": "module",
-          "db_entry_0": ["uhci-hcd"],
+          "db_entry_0": [
+            "uhci-hcd"
+          ],
          "active": true,
          "modprobe": true,
-          "names": ["uhci-hcd"],
-          "module_args": [""],
+          "names": [
+            "uhci-hcd"
+          ],
+          "module_args": [
+            ""
+          ],
          "conf": ""
        },
        "module_alias": "pci:v00008086d00007020sv00001AF4sd00001100bc0Csc03i00"
@@ -1682,7 +1831,9 @@
          "name": "RAM",
          "value": 7
        },
-        "memory_type_details": ["Other"],
+        "memory_type_details": [
+          "Other"
+        ],
        "speed": 0
      }
    ],
@@ -17,6 +17,8 @@ in
    inputs.self.overlays.frappixLibsOverlay
    inputs.self.overlays.frappixPythonOverlay
    inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
  ];

  clan.core.vars.generators.frappix = {
@@ -17,6 +17,8 @@ in
    inputs.self.overlays.frappixLibsOverlay
    inputs.self.overlays.frappixPythonOverlay
    inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
  ];

  clan.core.vars.generators.frappix = {
@@ -25,8 +25,13 @@ in
    inputs.self.overlays.frappixLibsOverlay
    inputs.self.overlays.frappixPythonOverlay
    inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.frappixAppsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
  ];

+  fonts.packages = [ pkgs.tlwg ];
+
  clan.core.vars.generators.frappix = {
    files = {
      sslCertificate.secret = false;
@@ -57,6 +62,7 @@ in
      pkgs.frappix.hrms
      pkgs.frappix.crm
      pkgs.frappix.posprinter
+      pkgs.frappix.default_thai_company
    ];
    sites = {
      "${sitename}" = {
@@ -67,6 +73,7 @@ in
          "hrms"
          "crm"
          "posprinter"
+          "default_thai_company"
        ];
      };
    };
@@ -5,7 +5,7 @@
  ...
 }:
 let
-  domain = "poy-inventory.newedge.house";
+  domain = "w-inventory.newedge.house";
 in
 {
  clan.core.settings.machine.description = "VM machine that host Inventree system for Poy";
@@ -79,6 +79,7 @@ in
    secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
    adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
    settings.INVENTREE_SITE_URL = "https://${domain}";
+    settings.INVENTREE_FRONTEND_SETTINGS = ''{"mobile_mode": "allow-ignore"}'';
  };

  system.stateVersion = "25.11";
@@ -54,7 +54,9 @@ in
    self.nixosModules.think-gtcm
    self.nixosModules.think-backend-gtcm
  ];
-  nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+  nixpkgs.overlays = [
+    self.overlays.packagesOverlay
+  ];

  clan.core.vars.generators.greaterchiangmai = {
    files = {
@@ -5,8 +5,6 @@
 }:
 {
  imports = [
-    self.nixosModules.common
-
    ./hardware-configuration.nix
  ];

@@ -23,15 +21,12 @@
  nixpkgs.hostPlatform = {
    system = "aarch64-linux";
  };
+  nixpkgs.buildPlatform = {
+    system = "x86_64-linux";
+  };

  system.stateVersion = "25.11";

-  services.journald.extraConfig = ''
-    Storage=volatile
-    RuntimeMaxUse=30M
-    RuntimeMaxFileSize=10M
-  '';
-
  services.udisks2.enable = false;

  nix.settings.log-lines = 25;
@@ -54,6 +49,23 @@
    "sd_mod"
  ];

+  boot = {
+    consoleLogLevel = 0;
+    kernel.sysctl = {
+      "fs.suid_dumpable" = 0;
+      "kernel.core_pattern" = "/dev/null";
+    };
+    tmp = {
+      useTmpfs = true;
+    };
+  };
+
+  services.journald.settings.Journal.Storage = "none";
+
+  systemd = {
+    coredump.enable = false;
+  };
+
  fileSystems."/mnt/hdd" = {
    device = "zdata/nas";
    fsType = "zfs";
@@ -0,0 +1,197 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
+  ];
+
+  config = {
+    hardware.mt7986a-glinet-gl-mt6000.enable = true;
+    hardware.mt7986a-glinet-gl-mt6000.zealous = true;
+    hardware.mt7986a-glinet-gl-mt6000.image.repart.enable = true;
+
+    nixpkgs.hostPlatform.system = "aarch64-linux";
+    nixpkgs.buildPlatform.system = "x86_64-linux";
+
+    system.stateVersion = "26.11";
+    clan.core.sops.defaultGroups = [ "admins" ];
+
+    clan.core.settings.name = "stellio";
+    clan.core.settings.machine.description = "Flint-2 router";
+
+    # Root is ext4 on the Flint 2's eMMC: keep steady-state writes off it.
+    # The journal is persistent but bounded (256M) and synced once a minute
+    # (the router needs logs for pppd/kea debugging and, after the Sep 2026
+    # unlogged reboots, for post-mortem; volatile storage left nothing).
+    # /tmp is tmpfs, no core dumps, and ext4 skips atime updates and
+    # flushes its journal every 60 s instead of 5 s so the small periodic
+    # writes (Kea leases, timesyncd clock, speedtest textfile, journal)
+    # coalesce. A power cut loses at most a minute of that state.
+    fileSystems."/".options = [
+      "noatime"
+      "commit=60"
+    ];
+    boot.tmp.useTmpfs = true;
+    services.journald.settings.Journal = {
+      Storage = "persistent";
+      SystemMaxUse = "256M";
+      SyncIntervalSec = "1m";
+    };
+    systemd.coredump.enable = false;
+
+    # Upstream 07d9958739 (mainline 2026-05, not in linux-6.18.y). The MT7531
+    # switch on the Flint 2 hangs off MDIO, and mt7530_get_stats64 took the
+    # MDIO mutex under the RCU read lock that /proc/net/dev holds, so any
+    # stats reader (zerotier-one, node exporter, `ip -s link`) that raced a
+    # PHY access oopsed the box: "BUG: scheduling while atomic" ->
+    # "Unable to handle kernel paging request" on 2026-09-20 09:02 UTC.
+    # Drop once boot.kernelPackages moves to a kernel that carries it.
+    boot.kernelPatches = [
+      {
+        name = "mt7530-get-stats64-atomic";
+        patch = ./mt7530-get-stats64-atomic.patch;
+      }
+    ];
+
+    # nixpkgs' services.blocky check runs the aarch64 blocky in a
+    # system.checks derivation, which an x86_64 builder without binfmt cannot
+    # execute (`--max-jobs 0` -> Exec format error). Validate the same YAML
+    # with the build host's blocky instead. Drop once cnx-network's router
+    # service carries this itself (router/dns: validate the Blocky config
+    # with the build host's binary).
+    services.blocky.enableConfigCheck = false;
+    system.checks = [
+      (pkgs.runCommand "check-blocky-config" { } ''
+        ${lib.getExe pkgs.buildPackages.blocky} --config ${
+          (pkgs.formats.yaml { }).generate "blocky-config.yaml" config.services.blocky.settings
+        } validate && touch $out
+      '')
+    ];
+
+    # The router service opens SSH only to the mgmt VLAN, the staging port
+    # and the ZeroTier mesh (inventories/router.nix). Also admit it over
+    # Yggdrasil (fleet-wide instance in inventories/default.nix) so the box
+    # stays reachable when ZeroTier's controller/relays are down. Scoped to
+    # the tunnel interface (clan-core's yggdrasil service names it `ygg`):
+    # only decrypted 200::/7 traffic arrives there, so a spoofed source on
+    # the WAN never matches.
+    networking.firewall.interfaces.${config.services.yggdrasil.settings.IfName}.allowedTCPPorts = [
+      22
+    ];
+
+    # AIS delegates a single /64 over PPPoE (seen 2026-10-02: "ppp0: DHCP:
+    # received delegated prefix 2405:9800:b910:1f5d::/64"). The router
+    # service hands out sub-prefixes with SubnetId=auto, so whichever VLAN
+    # interface comes up first takes the whole /64 -- on this box vlan-mgmt
+    # did, and vlan-lan logged "Couldn't find a suitable prefix. Ran out of
+    # address space": no RA prefix on lan, so clients had no global IPv6.
+    # Pin the ids: lan (where the clients are) always gets subnet 0, i.e.
+    # the entire prefix when it is a /64; mgmt asks for subnet 1, which
+    # fails harmlessly on a /64 (mgmt is reached over v4 and the meshes) and
+    # starts working unchanged if AIS ever delegates wider. Drop once
+    # cnx-network's router service exposes a per-VLAN subnet id.
+    systemd.network.networks."40-vlan-lan".dhcpPrefixDelegationConfig.SubnetId = lib.mkForce "0x0";
+    systemd.network.networks."40-vlan-mgmt".dhcpPrefixDelegationConfig.SubnetId = lib.mkForce "0x1";
+
+    # Interim copy of cnx-network-clan 45643d6 (router/ipv6: deprecate
+    # withdrawn DHCPv6-PD prefixes); drop when the input is bumped past it.
+    # networkd never deprecates a prefix it stops announcing (systemd#29651):
+    # on every reboot the first PPPoE session lands on another AIS BNG, is
+    # torn down minutes later, and the reconnect brings a different /64.
+    # networkd announces the new prefix at once but clients keep the old
+    # one preferred for the rest of its 1800 s lifetime, so RFC 6724 source
+    # selection picks the dead prefix and every v6 connection fails for up
+    # to 30 minutes (2026-10-08 07:57). Watch vlan-* for networkd removing a
+    # dynamic (PD) address and send up to three RAs with that /64 at
+    # preferred lifetime 0, one short-lived radvd per RA (SIGKILLed: no
+    # shutdown RA with router lifetime 0), stopping as soon as the prefix is
+    # back on the interface -- a plain flap re-delegates the same /64 within
+    # seconds and a deprecating RA sent after networkd re-announced it would
+    # leave clients deprecated until the next periodic RA (08:19 today).
+    systemd.services.router-radv-deprecate = {
+      description = "Deprecate withdrawn DHCPv6-PD prefixes on the VLANs";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "systemd-networkd.service" ];
+      path = [
+        pkgs.iproute2
+        pkgs.ipcalc
+        pkgs.radvd
+      ];
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = 2;
+        RuntimeDirectory = "router-radv-deprecate";
+      };
+      script = ''
+        conf=$RUNTIME_DIRECTORY/radvd.conf
+        pid=$RUNTIME_DIRECTORY/radvd.pid
+
+        # /64s of the global addresses currently on an interface.
+        prefixes_on() {
+          ip -o -6 addr show dev "$1" scope global | while read -r _ _ _ a _; do
+            echo "$(ipcalc --no-decorate -n "$a")/''${a##*/}"
+          done
+        }
+
+        # "Deleted 4: vlan-lan    inet6 2001:db8::1/64 scope global dynamic mngtmpaddr \ valid_lft ..."
+        ip -o -6 monitor address | while read -r event _ dev _ addr _ scope rest; do
+          [[ $event == Deleted && $dev == vlan-* && $scope == global && $rest == *dynamic* ]] || continue
+          prefix="$(ipcalc --no-decorate -n "$addr")/''${addr##*/}"
+          cat > "$conf" <<EOF
+        interface $dev {
+          AdvSendAdvert on;
+          MinRtrAdvInterval 3;
+          MaxRtrAdvInterval 4;
+          AdvDefaultLifetime 1800;
+          AdvCurHopLimit 0;
+          prefix $prefix {
+            AdvOnLink on;
+            AdvAutonomous on;
+            AdvPreferredLifetime 0;
+            AdvValidLifetime 7200;
+          };
+        };
+        EOF
+          for _ in 1 2 3; do
+            if prefixes_on "$dev" | grep -qxF "$prefix"; then
+              echo "$dev: $prefix is back, leaving it announced"
+              break
+            fi
+            echo "$dev: deprecating withdrawn prefix $prefix"
+            rm -f "$pid"
+            # radvd sends its first RA on start; the next would follow 3-4 s later.
+            radvd -C "$conf" -p "$pid" -n -m stderr &
+            sleep 1
+            kill -KILL $! 2>/dev/null || true
+            wait $! || true
+            sleep 2
+          done
+        done
+      '';
+    };
+
+    systemd.services.heartbeat-push = {
+      description = "Heartbeat push to uptime monitor";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.curl}/bin/curl -s -o /dev/null https://uptime.b4l.co.th/api/push/X0WCHAcY5gPf1U8If7BT1FLjpacZqGZu?status=up&msg=OK&ping=";
+      };
+    };
+
+    systemd.timers.heartbeat-push = {
+      description = "Heartbeat push timer";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "60s";
+        OnUnitActiveSec = "60s";
+        Unit = "heartbeat-push.service";
+      };
+    };
+
+  };
+}
@@ -0,0 +1,13 @@
+{ inputs, ... }:
+{
+  disko = {
+    imageBuilder = {
+      # Avoid double emulation to significantly speed up image building process.
+      # Update the system according to your host system.
+      # See https://github.com/nix-community/disko/issues/856
+      qemu =
+        inputs.nixpkgs.legacyPackages.x86_64-linux.qemu
+        + "/bin/qemu-system-aarch64 -M virt -cpu cortex-a57";
+    };
+  };
+}
@@ -0,0 +1,230 @@
+From 07d99587396024932e02474c3a5bede71d108454 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 2 May 2026 11:55:02 +0100
+Subject: net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
+
+The .get_stats64 callback runs in atomic context, but on
+MDIO-connected switches every register read acquires the MDIO bus
+mutex, which can sleep:
+[   12.645973] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:609
+[   12.654442] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 759, name: grep
+[   12.663377] preempt_count: 0, expected: 0
+[   12.667410] RCU nest depth: 1, expected: 0
+[   12.671511] INFO: lockdep is turned off.
+[   12.675441] CPU: 0 UID: 0 PID: 759 Comm: grep Tainted: G S      W           7.0.0+ #0 PREEMPT
+[   12.675453] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
+[   12.675456] Hardware name: Bananapi BPI-R64 (DT)
+[   12.675459] Call trace:
+[   12.675462]  show_stack+0x14/0x1c (C)
+[   12.675477]  dump_stack_lvl+0x68/0x8c
+[   12.675487]  dump_stack+0x14/0x1c
+[   12.675495]  __might_resched+0x14c/0x220
+[   12.675504]  __might_sleep+0x44/0x80
+[   12.675511]  __mutex_lock+0x50/0xb10
+[   12.675523]  mutex_lock_nested+0x20/0x30
+[   12.675532]  mt7530_get_stats64+0x40/0x2ac
+[   12.675542]  dsa_user_get_stats64+0x2c/0x40
+[   12.675553]  dev_get_stats+0x44/0x1e0
+[   12.675564]  dev_seq_printf_stats+0x24/0xe0
+[   12.675575]  dev_seq_show+0x14/0x3c
+[   12.675583]  seq_read_iter+0x37c/0x480
+[   12.675595]  seq_read+0xd0/0xec
+[   12.675605]  proc_reg_read+0x94/0xe4
+[   12.675615]  vfs_read+0x98/0x29c
+[   12.675625]  ksys_read+0x54/0xdc
+[   12.675633]  __arm64_sys_read+0x18/0x20
+[   12.675642]  invoke_syscall.constprop.0+0x54/0xec
+[   12.675653]  do_el0_svc+0x3c/0xb4
+[   12.675662]  el0_svc+0x38/0x200
+[   12.675670]  el0t_64_sync_handler+0x98/0xdc
+[   12.675679]  el0t_64_sync+0x158/0x15c
+
+For MDIO-connected switches, poll MIB counters asynchronously using a
+delayed workqueue every second and let .get_stats64 return the cached
+values under a spinlock. A mod_delayed_work() call on each read
+triggers an immediate refresh so counters stay responsive when queried
+more frequently.
+
+MMIO-connected switches (MT7988, EN7581, AN7583) are not affected
+because their regmap does not sleep, so they continue to read MIB
+counters directly in .get_stats64.
+
+Fixes: 88c810f35ed5 ("net: dsa: mt7530: implement .get_stats64")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Chester A. Unal <chester.a.unal@arinc9.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/6940b913da2c29156f0feff74b678d3c526ee84c.1777719253.git.daniel@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++--
+ drivers/net/dsa/mt7530.h |  8 ++++++
+ 2 files changed, 80 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index b9423389c2ef0..44d670904ad89 100644
+--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
+@@ -25,6 +25,9 @@
+ 
+ #include "mt7530.h"
+ 
+#define MT7530_STATS_POLL_INTERVAL	(1 * HZ)
+#define MT7530_STATS_RATE_LIMIT		(HZ / 10)
+
+ static struct mt753x_pcs *pcs_to_mt753x_pcs(struct phylink_pcs *pcs)
+ {
+ 	return container_of(pcs, struct mt753x_pcs, pcs);
+@@ -906,10 +909,9 @@ static void mt7530_get_rmon_stats(struct dsa_switch *ds, int port,
+ 	*ranges = mt7530_rmon_ranges;
+ }
+ 
+-static void mt7530_get_stats64(struct dsa_switch *ds, int port,
+-			       struct rtnl_link_stats64 *storage)
+static void mt7530_read_port_stats64(struct mt7530_priv *priv, int port,
+				     struct rtnl_link_stats64 *storage)
+ {
+-	struct mt7530_priv *priv = ds->priv;
+ 	uint64_t data;
+ 
+ 	/* MIB counter doesn't provide a FramesTransmittedOK but instead
+@@ -951,6 +953,54 @@ static void mt7530_get_stats64(struct dsa_switch *ds, int port,
+ 			       &storage->rx_crc_errors);
+ }
+ 
+static void mt7530_stats_refresh(struct mt7530_priv *priv)
+{
+	struct rtnl_link_stats64 stats = {};
+	struct dsa_port *dp;
+	int port;
+
+	dsa_switch_for_each_user_port(dp, priv->ds) {
+		port = dp->index;
+
+		mt7530_read_port_stats64(priv, port, &stats);
+
+		spin_lock_bh(&priv->stats_lock);
+		priv->ports[port].stats = stats;
+		priv->stats_last = jiffies;
+		spin_unlock_bh(&priv->stats_lock);
+	}
+}
+
+static void mt7530_stats_poll(struct work_struct *work)
+{
+	struct mt7530_priv *priv = container_of(work, struct mt7530_priv,
+						stats_work.work);
+
+	mt7530_stats_refresh(priv);
+	schedule_delayed_work(&priv->stats_work,
+			      MT7530_STATS_POLL_INTERVAL);
+}
+
+static void mt7530_get_stats64(struct dsa_switch *ds, int port,
+			       struct rtnl_link_stats64 *storage)
+{
+	struct mt7530_priv *priv = ds->priv;
+	bool refresh;
+
+	if (priv->bus) {
+		spin_lock_bh(&priv->stats_lock);
+		*storage = priv->ports[port].stats;
+		refresh = time_after(jiffies, priv->stats_last +
+					      MT7530_STATS_RATE_LIMIT);
+		spin_unlock_bh(&priv->stats_lock);
+		if (refresh)
+			mod_delayed_work(system_percpu_wq,
+					 &priv->stats_work, 0);
+	} else {
+		mt7530_read_port_stats64(priv, port, storage);
+	}
+}
+
+ static void mt7530_get_eth_ctrl_stats(struct dsa_switch *ds, int port,
+ 				      struct ethtool_eth_ctrl_stats *ctrl_stats)
+ {
+@@ -3137,9 +3187,24 @@ mt753x_setup(struct dsa_switch *ds)
+ 	if (ret && priv->irq_domain)
+ 		mt7530_free_mdio_irq(priv);
+ 
+	if (!ret && priv->bus) {
+		mt7530_stats_refresh(priv);
+		schedule_delayed_work(&priv->stats_work,
+				      MT7530_STATS_POLL_INTERVAL);
+	}
+
+ 	return ret;
+ }
+ 
+static void
+mt753x_teardown(struct dsa_switch *ds)
+{
+	struct mt7530_priv *priv = ds->priv;
+
+	if (priv->bus)
+		cancel_delayed_work_sync(&priv->stats_work);
+}
+
+ static int mt753x_set_mac_eee(struct dsa_switch *ds, int port,
+ 			      struct ethtool_keee *e)
+ {
+@@ -3257,6 +3322,7 @@ static int mt7988_setup(struct dsa_switch *ds)
+ static const struct dsa_switch_ops mt7530_switch_ops = {
+ 	.get_tag_protocol	= mtk_get_tag_protocol,
+ 	.setup			= mt753x_setup,
+	.teardown		= mt753x_teardown,
+ 	.preferred_default_local_cpu_port = mt753x_preferred_default_local_cpu_port,
+ 	.get_strings		= mt7530_get_strings,
+ 	.get_ethtool_stats	= mt7530_get_ethtool_stats,
+@@ -3395,6 +3461,9 @@ mt7530_probe_common(struct mt7530_priv *priv)
+ 	priv->ds->ops = &mt7530_switch_ops;
+ 	priv->ds->phylink_mac_ops = &mt753x_phylink_mac_ops;
+ 	mutex_init(&priv->reg_mutex);
+	spin_lock_init(&priv->stats_lock);
+	INIT_DELAYED_WORK(&priv->stats_work, mt7530_stats_poll);
+
+ 	dev_set_drvdata(dev, priv);
+ 
+ 	return 0;
+diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h
+index 3e0090bed298d..dd33b0df3419e 100644
+--- a/drivers/net/dsa/mt7530.h
+++ b/drivers/net/dsa/mt7530.h
+@@ -796,6 +796,7 @@ struct mt7530_fdb {
+  * @pvid:	The VLAN specified is to be considered a PVID at ingress.  Any
+  *		untagged frames will be assigned to the related VLAN.
+  * @sgmii_pcs:	Pointer to PCS instance for SerDes ports
+ * @stats:	Cached port statistics for MDIO-connected switches
+  */
+ struct mt7530_port {
+ 	bool enable;
+@@ -803,6 +804,7 @@ struct mt7530_port {
+ 	u32 pm;
+ 	u16 pvid;
+ 	struct phylink_pcs *sgmii_pcs;
+	struct rtnl_link_stats64 stats;
+ };
+ 
+ /* Port 5 mode definitions of the MT7530 switch */
+@@ -875,6 +877,9 @@ struct mt753x_info {
+  * @create_sgmii:	Pointer to function creating SGMII PCS instance(s)
+  * @active_cpu_ports:	Holding the active CPU ports
+  * @mdiodev:		The pointer to the MDIO device structure
+ * @stats_lock:		Protects cached per-port stats from concurrent access
+ * @stats_work:		Delayed work for polling MIB counters on MDIO switches
+ * @stats_last:		Jiffies timestamp of last MIB counter poll
+  */
+ struct mt7530_priv {
+ 	struct device		*dev;
+@@ -900,6 +905,9 @@ struct mt7530_priv {
+ 	int (*create_sgmii)(struct mt7530_priv *priv);
+ 	u8 active_cpu_ports;
+ 	struct mdio_device *mdiodev;
+	spinlock_t stats_lock; /* protects cached stats counters */
+	struct delayed_work stats_work;
+	unsigned long stats_last;
+ };
+ 
+ struct mt7530_hw_vlan_entry {
+-- 
+cgit 1.3.1-korg
+
@@ -1,3 +1,4 @@
+{ ... }:
 {
  system.stateVersion = "25.11";
  nixpkgs.hostPlatform = {
@@ -82,8 +82,11 @@ in
  };

  services.avahi = {
-    publish.enable = true;
-    publish.userServices = true;
+    settings.publish = {
+      disable-publishing = false;
+      disable-user-service-publishing = false;
+      publish-addresses = true;
+    };
    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
    nssmdns4 = true;
    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
@@ -1,4 +1,3 @@
 # Apple Network

 This service allows atalkd instances to connect to each other over vxlan over Yggdrasil. We need to use vxlan due to the support of broadcasting it provides. The service will form a network of star-topology vxlan using the underlying Yggdrasil network. With this vxlan network, we can have a private Apple Talk network over the internet.
-
@@ -19,12 +19,6 @@
            description = "Public URL for accessing the instance";
          };

-          base_domain = lib.mkOption {
-            type = with lib.types; str;
-            default = "";
-            description = "Defines the base domain to create the hostnames for MagicDNS in Headscale. `base_domain` must be a FQDN, without the trailing dot. The FQDN of the hosts will be `hostname.base_domain (e.g. myhost.tailnet.example.com)";
-          };
-
          advertise_routes = lib.mkOption {
            type = with lib.types; listOf str;
            default = [ ];
@@ -32,14 +26,57 @@
            example = [ "192.168.1.0/24" ];
          };

-          nameservers = lib.mkOption {
-            type = with lib.types; listOf str;
-            default = [
-              "1.1.1.1"
-              "8.8.8.8"
-            ];
-            description = "List of nameservers to pass to Tailscale clients";
-            example = [ "10.0.10.1" ];
+          dns = {
+            base_domain = lib.mkOption {
+              type = with lib.types; str;
+              default = "";
+              description = "Defines the base domain to create the hostnames for MagicDNS in Headscale. `base_domain` must be a FQDN, without the trailing dot. The FQDN of the hosts will be `hostname.base_domain (e.g. myhost.tailnet.example.com)";
+            };
+
+            nameservers = lib.mkOption {
+              type = with lib.types; listOf str;
+              default = [
+                "1.1.1.1"
+                "8.8.8.8"
+              ];
+              description = "List of nameservers to pass to Tailscale clients";
+              example = [ "10.0.10.1" ];
+            };
+
+            magic_dns = lib.mkOption {
+              type = with lib.types; bool;
+              default = true;
+              description = "Whether to enable MagicDNS";
+            };
+
+            extra_records = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (
+                  listOf (submodule {
+                    options = {
+                      name = lib.mkOption {
+                        type = lib.types.str;
+                        description = "DNS record name.";
+                        example = "grafana.tailnet.example.com";
+                      };
+                      type = lib.mkOption {
+                        type = lib.types.enum [
+                          "A"
+                          "AAAA"
+                        ];
+                        description = "DNS record type.";
+                        example = "A";
+                      };
+                      value = lib.mkOption {
+                        type = lib.types.str;
+                        description = "DNS record value (IP address).";
+                        example = "100.64.0.3";
+                      };
+                    };
+                  })
+                );
+            };
          };
        };
      };
@@ -170,10 +207,11 @@
              settings.server_url = "https://${settings.public_url}";

              settings.dns = {
-                base_domain = settings.base_domain;
+                base_domain = settings.dns.base_domain;
                override_local_dns = true;
-                nameservers.global = settings.nameservers;
-                magic_dns = false;
+                nameservers.global = settings.dns.nameservers;
+                magic_dns = settings.dns.magic_dns;
+                extra_records = settings.dns.extra_records;
              };
            };

@@ -80,15 +80,12 @@
                ...
              }:
              let
-                dictionaries =
-                  with pkgs;
-                  (hunspellWithDicts (
-                    with hunspellDicts;
-                    [
-                      en-us-large
-                      th-th
-                    ]
-                  ));
+                dictionaries = pkgs.hunspell.withDicts (
+                  d: with d; [
+                    en-us-large
+                    th-th
+                  ]
+                );
              in
              {
                imports = [ inputs.plasma-manager.homeModules.plasma-manager ];
@@ -111,7 +108,6 @@
                    keepassxc
                    vlc
                    thunderbird
-                    wasabiwallet
                    protonmail-desktop
                  ];
                };
@@ -119,6 +115,8 @@

                programs.firefox = {
                  enable = true;
+                  # Keep the pre-26.05 profile location; moving it would orphan the existing profile.
+                  configPath = ".mozilla/firefox";
                };

                programs.home-manager.enable = true;
@@ -11,7 +11,7 @@
    homeDirectory = lib.mkForce "/home/${username}";
    stateVersion = osConfig.system.stateVersion;
    packages = with pkgs; [
-      libreoffice-fresh
+      libreoffice-stable
      element-desktop
      signal-desktop
      brave
@@ -42,10 +42,27 @@
            dbhost = lib.mkDefault "/run/postgresql";
            dbuser = lib.mkDefault "nextcloud";
            dbname = lib.mkDefault "nextcloud";
-            adminuser = lib.mkDefault "admin";
-            adminpassFile = lib.mkDefault config.clan.core.vars.generators.nextcloud.files.adminpassFile.path;
          };
+        };

+        # nixpkgs installs Nextcloud with --disable-admin-user; create the
+        # admin account ourselves once the instance is installed.
+        systemd.services.nextcloud-admin-user = {
+          wantedBy = [ "multi-user.target" ];
+          after = [ "nextcloud-setup.service" ];
+          requires = [ "nextcloud-setup.service" ];
+          before = [ "phpfpm-nextcloud.service" ];
+          path = [ config.services.nextcloud.occ ];
+          serviceConfig = {
+            Type = "oneshot";
+            User = "nextcloud";
+          };
+          script = ''
+            if ! nextcloud-occ user:info admin >/dev/null 2>&1; then
+              NC_PASS="$(<${config.clan.core.vars.generators.nextcloud.files.adminpassFile.path})" \
+                nextcloud-occ user:add admin --password-from-env --group admin
+            fi
+          '';
        };

        clan.core.state.nextcloud.folders = [
@@ -31,7 +31,7 @@

    server.wait_for_unit("phpfpm-nextcloud.service")

-    # Check that garage is running
-    server.succeed("systemctl status phpfpm-nextcloud.service")
+    # Admin account exists and is in the admin group
+    server.succeed("nextcloud-occ user:info admin --output=json | grep -q '\"groups\":\\[\"admin\"\\]'")
  '';
 }
@@ -16,18 +16,6 @@
        ...
      }:
      {
-        nixpkgs.overlays = [
-          (final: prev: {
-            pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-              (pyFinal: pyPrev: {
-                psycopg = pyPrev.psycopg.overrideAttrs (old: {
-                  disabledTests = old.disabledTests ++ [ "test_stats_connect" ];
-                });
-              })
-            ];
-          })
-        ];
-
        services.paperless = {
          enable = lib.mkDefault true;
        };
@@ -0,0 +1,5 @@
+{
+  boot.supportedFilesystems = {
+    ntfs = true;
+  };
+}
@@ -224,7 +224,7 @@
                throw "clanService/yggdrasil is required";
          in
          {
-            clan.core.vars.generators.phonebox = builtins.break {
+            clan.core.vars.generators.phonebox = {
              files = {
                server-prefix-number.secret = false;
                ata-local-number.secret = false;
@@ -256,6 +256,13 @@
              '';
            };

+            # Phonebox nodes are headless and unattended. Observed on mirach/almach
+            # (2026-07..09): hard hangs leave no journal/pstore trace and stay down
+            # until someone power-cycles the board. Arm the hardware watchdog so a
+            # hung kernel/PID1 resets itself, and reboot instead of halting on panic.
+            systemd.settings.Manager.RuntimeWatchdogSec = "30s";
+            boot.kernel.sysctl."kernel.panic" = 10;
+
            networking.interfaces = {
              ${ata-interface} = {
                useDHCP = false;
@@ -280,7 +287,7 @@
                dhcp-range = [
                  "192.168.254.100,192.168.254.100,255.255.255.0,3m"
                ];
-                dhcp-leasefile = "/dev/null";
+                leasefile-ro = true;
                dhcp-option = [
                  "3,192.168.254.1"
                ];
@@ -323,6 +330,7 @@
              in
              {
                "${matchAll}".allowedTCPPorts = [ 80 ];
+                "ygg".allowedTCPPorts = [ 80 ];
              };

            services.asterisk = {
@@ -396,7 +404,7 @@
                    in
                    ''
                      [from-internal]
-                      exten => 999,1,Answer()
+                      exten => 99,1,Answer()
                      same  =>     n,Playback(hello-world)
                      same  =>     n,Hangup()

@@ -0,0 +1,8 @@
+# Prometheus
+
+Monitoring over the Yggdrasil network. Requires the `yggdrasil` clan service on every machine in the instance.
+
+Roles:
+
+- `server`: runs Prometheus and Alertmanager, scraping every `nodes` machine by its Yggdrasil address. Optional `matrix-alertmanager` forwards alerts to Matrix rooms; the bot token and webhook secret are generated as clan vars.
+- `nodes`: enables the `services.prometheus.exporters` listed in `exporters` (with `openFirewall`) so the server can harvest them.
@@ -256,6 +256,21 @@
                ];
              };

+              # nixpkgs runs alertmanager with DynamicUser; that user only exists
+              # while the service runs, so sops-install-secrets cannot resolve the
+              # owner of matrix-alertmanager-urlfile at boot and rejects the whole
+              # manifest (no secrets installed). Use a static user instead.
+              users.users.alertmanager = {
+                isSystemUser = true;
+                group = "alertmanager";
+              };
+              users.groups.alertmanager = { };
+              systemd.services.alertmanager.serviceConfig = {
+                DynamicUser = lib.mkForce false;
+                User = "alertmanager";
+                Group = "alertmanager";
+              };
+
              services.matrix-alertmanager = lib.mkIf settings.matrix-alertmanager.enable {
                enable = true;
                tokenFile = config.clan.core.vars.generators.prometheus.files.matrix-alertmanager-token.path;
@@ -239,8 +239,11 @@
            };

            services.avahi = {
-              publish.enable = true;
-              publish.userServices = true;
+              settings.publish = {
+                disable-publishing = false;
+                disable-user-service-publishing = false;
+                publish-addresses = true;
+              };
              # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
              nssmdns4 = true;
              # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
@@ -14,11 +14,6 @@
        ...
      }:
      {
-        nixpkgs.overlays = [
-          (final: prev: {
-            libreoffice = prev.libreoffice-fresh;
-          })
-        ];

        services.stirling-pdf = {
          enable = lib.mkDefault true;
@@ -10,10 +10,10 @@ in
  perSystem =
    { ... }:
    {
-      clan.nixosTests.service-stirling-pdf = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules."@clan/stirling-pdf" = module;
-      };
+      # clan.nixosTests.service-stirling-pdf = {
+      #   imports = [ ./tests/vm/default.nix ];
+      #
+      #   clan.modules."@clan/stirling-pdf" = module;
+      # };
    };
 }
@@ -2,10 +2,15 @@
 {
  flake.overlays = {
    packagesOverlay = import ../pkgs/overlay.nix;
+    # TEMPORARY: drop with the file once NixOS/nixpkgs#578265 reaches nixos-unstable.
+    posthogPr578265Overlay = import ./nixpkgs-pr-578265-posthog.nix;

    frappixFrappeOverlay = inputs.frappix.frappeOverlay.x86_64-linux;
    frappixLibsOverlay = inputs.frappix.libsOverlay.x86_64-linux;
    frappixPythonOverlay = inputs.frappix.pythonOverlay.x86_64-linux;
    frappixToolsOverlay = inputs.frappix.toolsOverlay.x86_64-linux;
+    frappixAppsOverlay = import ../pkgs/frappix/overlay.nix;
+    # Must be applied after frappixPythonOverlay (overrides packages from it).
+    frappixFixupsOverlay = import ./frappix-fixups.nix;
  };
 }
@@ -0,0 +1,34 @@
+# Fixups for frappix's python overlay on current nixos-unstable. Everything
+# here belongs upstream in kurogeek/frappix; drop entries as they land.
+# Must be applied after frappixPythonOverlay.
+_final: prev:
+let
+  inherit (prev) lib;
+in
+{
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyFinal: pyPrev: {
+      # frappe >= v15.120 needs sqlparse 0.6 (db_query.py touches
+      # sqlparse.engine.grouping.MAX_GROUPING_TOKENS), but every sql_metadata
+      # 2.x release pins sqlparse<0.6; the sqlglot-based 3.x needs sqlglot >= 30,
+      # which nixpkgs does not ship yet. Relaxing the pin is safe for frappe: its
+      # two call sites (desk/reportview.py, core/doctype/recorder/db_optimizer.py)
+      # only parse SELECT statements, and the only sql_metadata test regressions
+      # on sqlparse 0.6 are `CREATE TABLE IF NOT EXISTS` name extraction (2/150).
+      sql_metadata =
+        if lib.versionAtLeast pyPrev.sql_metadata.version "3" then
+          lib.warn "frappix ships sql_metadata ${pyPrev.sql_metadata.version} (no sqlparse dependency): drop the sql_metadata entry from overlays/frappix-fixups.nix" pyPrev.sql_metadata
+        else
+          pyPrev.sql_metadata.overridePythonAttrs (old: {
+            pythonRelaxDeps = (old.pythonRelaxDeps or [ ]) ++ [ "sqlparse" ];
+          });
+
+      # rq 1.16.2 (frappix's rq_1 pin): test_parse_connection compares redis
+      # connection kwargs against a literal; redis-py 8.1 (current nixpkgs) adds
+      # `himport_registry`, so the assertion fails. Test-only.
+      rq_1 = pyPrev.rq_1.overridePythonAttrs (old: {
+        disabledTests = old.disabledTests ++ [ "test_parse_connection" ];
+      });
+    })
+  ];
+}
@@ -0,0 +1,33 @@
+# TEMPORARY workaround for NixOS/nixpkgs#578265 (python3Packages.posthog: unbreak).
+# nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked posthog broken; the only
+# failure is one test in posthog's optional MCP integration (field rename in
+# mcp 2). posthog is a runtime dependency of frappe, so frappix machines fail
+# to evaluate without this.
+#
+# Remove once `nix flake update` pulls the PR in: delete this file and every
+# reference to it (grep 578265). The overlay becomes a no-op and warns at eval
+# time as soon as the locked nixpkgs no longer marks posthog broken.
+_final: prev:
+let
+  inherit (prev) lib;
+in
+{
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyFinal: pyPrev: {
+      posthog =
+        if !pyPrev.posthog.meta.broken then
+          lib.warn "nixpkgs no longer marks posthog broken: NixOS/nixpkgs#578265 has landed, remove overlays/nixpkgs-pr-578265-posthog.nix" pyPrev.posthog
+        else
+          pyPrev.posthog.overridePythonAttrs (old: {
+            disabledTests = old.disabledTests ++ [
+              # AttributeError: 'CallToolResult' object has no attribute 'structuredContent'
+              # (mcp>=2 renamed the field to `structured_content`)
+              "test_prepare_tool_result_delivers_into_call_tool_result_models"
+            ];
+            meta = old.meta // {
+              broken = false;
+            };
+          });
+    })
+  ];
+}
@@ -0,0 +1,35 @@
+{
+  buildPythonPackage,
+  pythonRelaxDepsHook,
+  flit-core,
+  mkAssets,
+  fetchFromGitea,
+}:
+let
+  version = "0.0.1";
+  src = fetchFromGitea {
+    domain = "git.b4l.co.th";
+    owner = "newedge";
+    repo = "default_thai_company";
+    rev = "c8fb98374989a22d0c907aa44877f247391a49ac";
+    sha256 = "sha256-c+pqds4l3Laldgf3+Rj2Ug693kFJYDB1j4a15j4U5SY=";
+  };
+in
+buildPythonPackage (finalAttrs: {
+  # pname doubles as the frappe app name (services.frappe reads app.pname)
+  pname = "default_thai_company";
+  inherit version;
+
+  pyproject = true;
+
+  src = mkAssets {
+    inherit (finalAttrs) pname version;
+    inherit src;
+    yarnHash = "sha256-oZgyP0hTU9bxszOVg3Bmiu6yos2d2Inc1Do8To4z8GQ=";
+  };
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    flit-core
+  ];
+})
@@ -0,0 +1,9 @@
+# Extends the frappix app scope with in-house frappe apps.
+# Must be applied after frappixFrappeOverlay (needs prev.frappix).
+final: prev: {
+  frappix = prev.frappix.overrideScope (
+    ffinal: _fprev: {
+      default_thai_company = ffinal.callPackage ./default-thai-company.nix { };
+    }
+  );
+}
@@ -7,18 +7,17 @@
 let
  repoSrc = fetchgit {
    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "6f8c8d7dfaf5a0c1eb2077de1d6fb35ceaf3d4ec";
-    hash = "sha256-2mCdn8xGjWZrANclctGTmxQhkNc43VzlzMTVwVIFJcM=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
  };
  src = "${repoSrc}/upload-large-file";
 in
 buildNpmPackage {
  pname = "gtcm-file-uploader";
-  version = "1.0.0";
+  version = "1.1.6";

  nativeBuildInputs = with pkgs; [
    nodejs
-    breakpointHook
  ];

  inherit src;
@@ -1,5 +1,5 @@
 final: prev: {
-  think-gtcm = final.callPackage ./think-gtcm.nix { };
+  think-gtcm = final.callPackage ./think-gtcm.nix { php = final.php83; };
  think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
  gtcm-file-uploader = final.callPackage ./gtcm-file-uploader.nix { };
 }
@@ -6,14 +6,14 @@
 let
  repoSrc = fetchgit {
    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
-    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
  };
  src = "${repoSrc}/think-backend.greaterchiangmai.com";
 in
 php.buildComposerProject2 (finalAttrs: {
  pname = "think-backend-gtcm";
-  version = "1.0.0";
+  version = "1.1.6";

  inherit src;

@@ -32,5 +32,5 @@ php.buildComposerProject2 (finalAttrs: {
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-wGfbprSDULBje1s5y3+ZiU/nCwYGDEULobZzyzGZ9bQ=";
+  vendorHash = "sha256-FaAwFzLXfMAiUv9eZLtFI0QurkNLh4fsTYrvGv1rAlo=";
 })
@@ -6,14 +6,14 @@
 let
  repoSrc = fetchgit {
    url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
-    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
  };
  src = "${repoSrc}/think.greaterchiangmai.com";
 in
 php.buildComposerProject2 (finalAttrs: {
  pname = "think-gtcm";
-  version = "1.0.0";
+  version = "1.1.6";

  inherit src;

@@ -32,5 +32,5 @@ php.buildComposerProject2 (finalAttrs: {
  '';

  composerStrictValidation = false;
-  vendorHash = "sha256-b8+AKUmjQiOdV8UC9GYfJzAHFs9+FRSH91YsxKt0rDA=";
+  vendorHash = "sha256-7M0nn3u8ERVFF6WiNjYByNdkFwHZz1vfoClybdOtIJ8=";
 })
@@ -4,12 +4,14 @@
    inputs.devshell.flakeModule
  ];
  perSystem =
-    { system, ... }:
+    { pkgs, system, ... }:
    {
      devshells.default = {
        devshell = {
          packages = [
-            inputs.clan-core.packages.${system}.clan-cli
+            # clan-core pins `nixVersions.nix_2_31` for a CI perf A/B test;
+            # nixos-unstable has dropped that attribute. Use nixpkgs' default nix.
+            (inputs.clan-core.packages.${system}.clan-cli.override { nix = pkgs.nix; })
          ];
        };
      };
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7",
+    "type": "age"
+  }
+]
@@ -0,0 +1 @@
+../../../groups/admins
@@ -0,0 +1,42 @@
+{
+	"data": "ENC[AES256_GCM,data:PdrPoAQnV9OBdwssaYfqN7tga1yUGKo2o2BzHaE2LJRDYo+Y5QFJi1vSxnT0jny4yN7fkoU9ilxYGi+sBkvtR77PescyUESta3U=,iv:KfpSaeZE8B1qBXPamhgLh4FvemjWHWMS4frJh9RWw6Y=,tag:uZ7fXNgHFXxQ4OlUurXdyw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TkI0blpCUEYyQXlQcS9z\nRSt6andVS0poNHI1S2pWSC9tdjBOcWlCS0d3CnQ1Wmxvc2IzRlBKbFV5R0hMMmxt\najRDNlRGUnUvL1k1VUxVWlVPdFlwTTAKLS0tIFplQ3d1WWhBcUhEVG1EZ2dQdlZW\nZjVLbFJHODA1VitpZk54Q0tTekpQZ3cKwd6lFt1KJs8H04d1WeztJntDVx4+SOj0\n1Eb31GAUNHxkJMGKpOyojpwewAWRXaLybq734CsrDn2SYrcCxxwkAA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFU4dXV4dkQ4\nSThRSGdRU3lIdUhEOVB6Yi9hbWg0UXJ3YTM0MHB3SkpWR28gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo0VDIvQWpJNEdnK2NjV3dkbmZIWjF6\nZTZRMEVxQm5BRGlXdC9BTU1PNVpVCi0tLSBocHN0eVl4a1E3aVZhRmpGVEdZajRE\nRjlKU2VDK0pwak5LdDhoa0tsUkswCrhbCwwLHBxkvkKqXThgc45LyABYOQRhemWM\nw4k8cnCgtricI4FChhG8wNpFx1vKBJ1z7spimX+fG0AxXUIkiqQ=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFljSUI5cExD\nQnVSVlFTL3ZjNW1maFRwZVVhSERlS09MaEZ2VWpLeXh1V0EgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwoyVlZzVlg3U1lpOTcxYzUxSXVycXNF\nalZlcTdyK3MvVFRyeVRQOGkxQXB3Ci0tLSBMMXhETlVrN0hMT2NaamRDTGxlQVpH\nNW1VZWs1QVVrVk1UcnBiWXdQVEs0Cn7aMYe+48HDHhQRDAUVVWel1mv0KZKYguzX\nOlQCqCirlzMhSRmXTYNQe4S80ecymgLBmcjvQVSitREv8mK8eeY=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEhVdXUyNXZX\nT2NacThiblFjYzNFRzVKQzFaRm96aHRUR2xrTzJqV3RuSFkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo1N25PL2RjYUcrblF1V2t5eERmNlR6\nNlFoYXpoOTVlK2gxbFBWa3FNY21vCi0tLSBEc1lsSlA4WklTSjE1ekJNbm40bTVa\neHRRc1Y2S2diY1FIUU1wdjhwVTJVCr8/pFIR0gZNp4zAmmcKFwXHg+FlDSlLqHBr\nuWqURlbZNaAA7azU4pjt2EJC6ppcgcW85yYxVghy3v1Hb1PBW+k=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNGR5bVkwbDVUVUl2cWNY\ndStDL0I2SmtNeEd3UEs2TExKM1pFNEgwTHdBCmU5WnF0dlRGSkJ2SVpLejlsSFQr\nRTE0YVUwMGxWRGVtV3MvMHMrdW9YRlkKLS0tIGcwMnRYb2wxcE1RMDcraVljS2Nz\nTS8zZ2ErMTREWklXNVF1UnlPZ1BRb1EKe03KNmpDxrTndF6hQeuBtaW2FIb9LaCg\nXoBKHmSxeESIPunpAhWJw2YUdPJ+8Td+fAdOZCPgktaeGcYSejaZMA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Nno3Ung3dHNtK3V4dFdm\nbW1mWm5ZN1ZtMjBENTlmaUtHYjZvbUluZERFCkNobHV4SWY3eWVIN1h1Ry9WWWxz\nU1hIUndONjFBWEJiTUc1cU9COExHWjgKLS0tIHQ0eWpzdGYveXNRZmZHeWdSbytt\na013d3FlL29HRy82L1YrR2NBTkR4YTgKCOuq/HrqenpgwhK73vQsvG2axxdPlWrf\ngK42riDP7VLxdqbri/mPIGKiGoMLumW3OQejUc6p+e3K6y42cESuyw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaZ1NjdTVOemZvZXJvRWIx\neEVIRWc2NndINzNETVVTOHNqSlBGM2lDbkIwCmRtR3FiQ0JkQ0hQSTIwQWs1SHE5\neHA1OWJTVU1CSVE0NTdlQTJTOGFVWXcKLS0tIHI5M09aR0ZrTzhmUmxRS0xHNzVO\nUUIxbWt4SVE1K1R1Unk3YlBPZnpHRWMKHqE7HUK3YM+bYQWUmO3UXSokoABSbsRi\navYoaIVbMgbTcSwkK+f8aZML9cyX4juA3NbKVAnmLPPU9aEUzImncA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVMm5XaGEySTVtbUY1QlRk\nNGlhb2FsK3QvU0xPV2FmQ0RjcVRpZzZhbkdzClhjbE81TVA1YXJaTk5jbUR6UGF5\nMzREcit5dHVHbVcrU3IrSnZFaDlVd1UKLS0tIFNyMzd6NmpKNy9nK2FHU1BlUmdO\neThBTkZMWWNFb2M0NmhNZkd2RW5vUk0KbDNx1IUaM9akKfH+sNEVFbIxnWbHJAdu\nS7aFj0SQx9O7G26PJEPZOLBYW9qryA/XVYcEcxycEoOBMu8J50GWZQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:41Z",
+		"mac": "ENC[AES256_GCM,data:XCAM+Fsk/1b+YVPWWAfruny5TA+3SrDBEPmvkhzDzJofmvfPiHSSl7X6nxGSdMyEFO6EElCNUiScDmvVsISlb+Vsl9Eeqqst3dPtnbCG+uUoYaRy8B9R4Pew13ceR1Q8oKNux5J84zQKctcWCKRu5ASa7mhJWC+68+azDkd/UTc=,iv:07RbTD3ggIWsQ/0f3Bohuzpqk21LelaCqz8jMftqsHE=,tag:sps3aXc94kUtLlaEYOU1nA==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:HKDiQZ4vDrHTJnbtVQzVdCk3UQjp/W/1aUKRw9HZkPVu+Rjr/bqdUYP2/3zYxXYvYjJVWRDAR4/oybc9WQZkpbGuN9CkoW36YUs0BkIUgy+qfMwvwGAcHROSFIK3OSgUt2F8ozjBBWYNICyJcT0DKKk+dmPTl5AIm8Xlo/G0UiscToqQdN6nDfFjRba9+aUC/8AagtjexbQTrcA/eJC6EesVfZOdfV8BAeL8YBfq1ZmDVnRmn67VCXzvDPIR0G3/L1c+ZJXtlt+TopWJHTvHehyxrKJxoTHk6udApNJWfxxUOqOrfYMTepTFPshX,iv:yrGBRLLiPyc/H3/RACAj4OGDnrYyVSUOKNHuouU+JbY=,tag:VHIXaOl9SXpxZIRAkOdCow==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRNEpyUjkrU055YWdHUlJu\nWklTMUpudHduUERwaGxiRzhtWmxnV0s4TUZZCnpqOXBFYVA3UUFUajhyOHB4R1hW\nc1o5T0k0VDN4QzlQT1k4SFZ6NklLV1EKLS0tIEF1anprN1BmbCtpY2lsUFJLTFRR\nOVptWWc5Y0VuR2RnNnY3WGYvTVhncUEKYlCzPy66COzZl94/TJGPLQLCYRi26H+G\nlzjD/F8ktXgu8w+X4VdoYJ7/XhTTd0Un35yNlKAvWokzAlVlvN9WAw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBabktwUmhQbi9CT2plM0Rv\nYlhKbS9Ub3RZRURDV3RNUXkwNC83aWtaYVZrClRFZWVYZk10S21kWFJrTnh3MnY0\nYmRHd2pqYTdYNS9HendreS9qcjN5ODAKLS0tIFkvZWxoaHhQSU1kWTRaUE1RZTFm\neUJlQmprTjRxZTFxOFpsRHlFUTVVd3cK77wHXeoZW5p6Aj9sh0M9Z5s8f4AwyfSL\nWqO3mR9SLRvgUpS5mI0YgGbbCZqBrpKGHht39GavT98bnUfZ9Um44w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHh4aUh2QVR3\nRTFmMTJFMVJMUFg2SVg3OVVpVUVhK2xmbGxoMis4QUwzQTggQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpkaitCakJMdWhvOWdZK0szZXJxZGpK\nZDQ1SmlSaEprZFFJQkp2UlZtcWhjCi0tLSBjNXpaaVBYRUVuVTVoOHFsSXY0MnYw\nRjcrNHB3aEdvaElQK2ppWHV6cjNrCmMWdEXrDTpV0ITjDStiBvW9calfZ+d8BRJt\ndoJrI5pkVOGxOx8p/5dM4ObVIfDbACvJSRbfcE+z4y3cYeLEVck=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFhCZG01TDUr\nVFgyNnFzR2JRUloyUGkrcGNCTDZEamIyNG5IeVZ4cHFWemcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpsSWk5cExyZ1NYNksxSE16UDFBVGho\nY3dDZkVSZnoxNFVWYXg0cGQzVkRRCi0tLSBrR2VtM3N2aFkySVVTYzljTEUyMnVH\nVnVWbjFVakNrVExhcFh6aU83ck1JCh12zCYcy2+cyvu9KprpbQywkLHfj8JutBPT\nHIOmAilzW4QdJoqsDepXqUsYBhprF6FUjePF3NVlWwbChUxqCYM=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGhiRjh0S0pn\nbkZvZEI4THY0QlJCbHkvU1pxMlBNcXVkR0VacGJmbVFhbnMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwoyWjc3aUJVU2VIcHpFUFFJSXdUOFBW\nWTFvNnVHbng5Ry84SjkyVFU3R01JCi0tLSB0SmNkOW9lY1VmMHkrUjJ3bmUxdmdF\nQXFuS3ZPQis1RUhpcUFVbmIvL0VvComcxR2y8IOy72kZbjJgBfl6djI9o7AWCP67\n2gSjzIsM//7D/fkDddIHNwjFhhTf8XI6RhGZ3TLg9Y1XpbF/WIc=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwb0RvNGsrM0VSSzk5eGNk\na2ErRVBRbmtmS3l2TFRNNHdzT2MrQVZCZEIwCkcxNFcxZEJBRm5PWnlUNVNVSkh2\nL2E0Q1ovcGp5MVUvTEdlSTR4N0JOMmMKLS0tIDd5VXhDTWphb083L2syd3IrdzFX\nVkNvVDZHWXRoSXlqS1ZVVUppSFpwMlUK6KgvrzqmJ6+i7N/clDKEqlJsBbHU6Umm\nuDBOeEQjqS8/srxnsSUUGX4LWSou6HdcLIBkb6kE61QltVreFHkrzw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMcVNxWHQreWhxcktZaUE3\nWG5GVzJMcE1GdnNRai9YZXdCb3crb1A3a1hvCmdDSlFGbEVDT2xLM2ZheGoxL29y\nOVZhVysrdXdOSjhiMm1UbGJISitBK3cKLS0tIHNTVC8xdWpkQTlwQXM0ZHEvQ2Fi\ndURBOFdPQkh4RVdhV1IzWVJ0b2VWVkEKKkgMTrBtALRK4CSs4/bnu2aztC9hIoqV\nBVVykHQNbiPbxfowgZOFLT411/gF3GfKh7Pnqso5jmKvYda4nfRdqQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6WG1ZTVRCbjJKeXhreUpa\nVU5Ja0N1Y0JyWWwzQk5lajVSKzI0ZURoS1dZCmFoeXVWNDZ5ZEtvY0lhYnR2MXc2\nNEFXcm8wbFVrMlZhYkdIdFZqV3hjNk0KLS0tIHFmZW5wUjM3SE9Dc3Y2aHBPNDBL\nY3g5YllWVWJkbS9lMHU0dTArYjIvNUkKgQC87XDj/uGLQpyoFeQcOeQP/wjZryL7\nsJsvvYTKrxoIltd9bqWoRAjUv+AHpP1G7lP9CaOdwyIXueDME4oozQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKL0gvZ0NaUG1uYis1VGpw\nVjNOaXVYcFdIOGNnZlZFQlhpUDdaelJNVGxVCk1pTzlZVnVIMGhPMlVMeHo2LzRL\nUmRMOUJ1YmZSSURIaFBzOHV6blhjcjQKLS0tIDYzTlpNTlFybWhiUWxVQ0pWcUNn\nOE5pbGswMmtQWEVsajZXV0plbDBUV00KYiQUbgMGj0toDBSPDqB37rZhXULc3Ose\nmZxBYH0r+wLACK5Pk2PRYUbOVROgqzCnYq7CFDh9VRvobP4itLkfKg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:41Z",
+		"mac": "ENC[AES256_GCM,data:elvsvTF0eEXNvNNMPm9g1/8aMAv96IMbLuJECoTndZsMwX78bqCFUSkBTSuKq7kAGSPcAO/JyXST+y1SK0fFaxEzSr6aq+yrR0AdHqfiyoplnAyMTHieVISvfSZj57xowz1/U+lS4lGj2xKxw+ZvmFAIdYVFNNkU/u8PlrkYTEQ=,iv:o+AxaZ3QWmif9Rr77a8kdR94RMqBuPmw9ThO8uO/kOQ=,tag:L3zqKyzIZZKC57axmybmsw==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:h31xS880MdG3e/4QOq3+8l25itPFucZr31V7PaibVWM0XpyONxKVE0Jxfhleb6utq7pN7y5GSbPxf0wvuKJOSjLsPIgr8C0/ZEA1t6sSctu9+Neq+VaudSSUdoanMk79vLvNSbl95H3NNNOu9Sm+RPpwc5CAGD0=,iv:GyZS3dbruCMY1Ngqkb6ikXQ1Sx8v3CnLMbdoPJuh5S4=,tag:vYTlyPu4Hm9fPqe/lea0Sw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGelFJek9LRm5MWG5vVEpX\nS3dicHViRGZxQnJZSmtIU3Zqc3FuaE41cTFFCjMzclhqOHQ2RHdBNStCelcwTDd0\nZk11SzJ2cWpQMGwxUlgrZmNhL094cUUKLS0tIHRWcVZRdjBUVTRsZENzaGNiNHp0\naW5JN29uL0xha1RBQlk4YmVrbG1OWmsKoOU0N/q2Tc+sT63LtndrFm7E98Bi7a25\ncSjHnlniG4QD/9BMVnUzL2dxhxGCL4hsIp4tSODD1e/EqnZtSSc7lw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxQWQzbTF2M0d1RkN5RVJl\nUEUwamo1SlQ2TVBGQk96Z2pvL0xvbFNiZ2lnCkRPL0p1WWcwM2ZXRC80WTNaemxJ\nekVzNDFWS0s3ZTNMaENOcXZHbGRSSU0KLS0tIDZlK2IvNlViejZtOWNWZ3dPWVN1\nYmJtRzQ2a2lrUzlBYlJoaXBiWCtIQzAKxS2wOgNfnC6U+fp0A/VPA7M8BAl05sfV\nVkFgudMYgBBB71WEeahg2thZF6QvcStE+BeANoV2JPNQBfhkfogOwQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFVzQlFTeHUv\nT3R6U1FsWHE3cnh2cURkMWpwb0VHU28zbWRpc3hUTmhTMEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp3Rm9hZWtlMUpZcEZoVTlMaVNVZFBS\ncU1ZQWVVenJJZ00zUzY2Yzc3bE0wCi0tLSBnMUZ0aUplWUx6RWE0UXVIbk1ERHZC\nSlVZRjhESjQwWXNDZTlETmJsTFVzCjlRR0c+6bjSxQCQPwIsEctfJdcZiuoh4LIw\njeoMdzE1mjgJW4joOzVTUiV0fi5Y8h0XS02f9axyI8vFUNlFH+c=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpUL1JFQXRh\ndmJTTVU3RTJNMVBoanVCVnQ2QWlQV1ZSZ1hwTGxSM0tXbVEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpQUEt0d0k3ZXc1ZThHdHZOdVhvaFlB\ncklJV0FuSnAwL25QemJwMlMrY21RCi0tLSBESDJHcHdvTzlJSjlkY0xWVEp5RG5C\nQzFOS1RDWGxpQWZyMHVBdk1uTURzChACYZ6/G0L5SaILYJs2JsuPsBaMtHEY48xL\nAoqnBQA38vOdSJqCAiPVpGsxm8PV3Bdu0e81C2fn2WYJK0u5Org=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHQrRVFoaC90\nczRRaldrRnFQNTd2WU1RaWZxQjR2VUltNk1BOTdwQ2ZSMEUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpmQTQrOHBWcmFMaXQyZTgvSTdFdkNP\naFdXV3orM2x0VXF2eWVwdTl0UkZJCi0tLSA2K01HZzFwUmU3cnZndUhtYUVCaUpt\nZXFtT0djRlVEZlpxSGpteE9aQWtVCuOVoIsIxOGUa+Lwc4yjbPuaP6PkhBAaoq7B\n7odYF/BOpEDCgr6bDG4U5epHTd9zm94N52bwEqgAo7SwmpetVTc=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4SzlyaEpGSFFwNm0yelUy\nNURDeU16cTlCNE9scjhmQ3JGTytlTmttRXlRCk5DdjJRRHI5YTZ4dVluSDg1N1JS\nRENqUW9XT0lYMmFoODcrNi9kOVQ0eUEKLS0tIGVFOGFNV2hqUEhFSlZYZlJudzJW\nVDFvMXZZVWw2ZGYvRzcrS1lLU0k4eU0KUlBai3+q+q2zvkF4jHyizG147Iyko+1p\nZZaggv1r3EOIvRultU0X/gJ9ORMh6M7/oAa4UuaUs/Z+RvraNqG9IQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTWx5cGtOK2dhR0VOVlBD\neTh3RnJudm12aGhKYUttc3hOcUhGd1kxSFI4CndxdDgvMDdZckdyM0ZpenNSc0JO\nbCs2Rkk5M2RiYStvYkxTaWxxbzVHdlEKLS0tIGRLcElDUDFZZ1BQMk1YTGtJZTVj\nVGJCWnVkVnppcjdqL0p6ZXFUMVFLRzAK+h/2DMvFnrvpv2cpOTfoop8eBj4oktjp\nXtF5nNBAw2B1y8FlBwE+dSZ/uUBwMyLDZm+qOKikuSY1zoap/t13mQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBocWhmUHRsUVdQTXJxUjI4\nVHIydVowZDVMS1Eva2JRSGN0UHBzS3JvQ0hrCml6LzAyRWgvMEJxTW42cS9QdklU\naU02VTJLZzRBeXVXaTMwMVdNT2IwSGsKLS0tICs2TkhvVUx1VS9BUDBDMGdZbWhq\nbG56dUVYYTNmQzBRUTROaUN6VkVXdFUKnvmWDVEXHqsvBF7G68XSA8HzXhqkYi7z\nPVaZNnnx9G3zp4HhjPWjU4jhqNxyTMFyzgFAdrXWvqzhwwhX0MdZJw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxTGFTQWFWY2lzT1plSkVx\nNzlVQ091RnpXc28ySUxodWxISDIwOGM3YmtNCjMvN2tzOTFqUnNMOFkwUU9jR25I\ndkRqY2pML2phZStoZEtzL1d1THJIQlUKLS0tIGEyRDZsSnpaY2pWSWJ3VVhPcnFs\ncFZNd01sU2pMdVd6UDkxMkNQVWhHUG8Kk7KxzaoNWWEeeqxKF7g1echsZdpT9S1C\n2lMZFcZxP2xOQtOvZf5ZsEaAGknngknmp0UysalfLxE8qL9eyUCyiw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:41Z",
+		"mac": "ENC[AES256_GCM,data:iUa9/R3WNipDdLR2lP91D641ebihrDn3hnWHPr5ntqNEXwQ+lLcojshRr2KeLoCa9q3zgUcREAG0GTNN5nKq7ZItzK/UuZDdRqaX3QBUBBIE6pkratVTSeS+r9VBrnN2jk+wwBs0bTb2A1SFyKJ6p0te2Lf996e4Pw5Z5Q0yZxk=,iv:/+Wbb0iUYfzuKEPA1c2rG+86fXFWhBwHCaTQDe8qOPc=,tag:d2bt72/a07LJ/lMmLB/GJQ==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAqT9H1Dl8/zvoKetgdD0fLpeLQ3oFIWvtO/dl+VI1RCU=
+-----END PUBLIC KEY-----
@@ -0,0 +1 @@
+12D3KooWMD331LXvtCEkjsa78PNK2EDWZtNnFPJfnoaB8hFXsWzx
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:rHeeAVA26cOaJbxBPJccMbLssLi2sJWqvYIghBnW5mhoqF76rvxnos1w25j7oPfcPAVB8mIBRvH0qPQs5EkT/8u1OYxmd+0inx16Fl0hP9ad6VyPnbcbN7YoFaAXI5bFdy58E03FlTTXmbP2S/f5PprYV7sm1kw=,iv:GlEt6zfThCZQwZYigtAGIkqINE8w0gGDcsPOujDdOD8=,tag:kP+ADas1Yuacy+GnC+rvrg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSVVCVjRlM01lL0daRHZ2\nWWRpcGp6Wmx6OWRFVS9VR1RCTmFJZHNxb3pJCkpOOXlYY1o2Z21YR2RRTUloU0t3\naE10UHFJUjZOaXB1dC9aUVV6K1dOWGcKLS0tIG5xQXYxY2FVdFYyWEdLSnBFcklX\nTmdQRHFaQlFnNk9uMFNjTTRRY3FsMFEKlmuyR55zbvelxb0aWfyzQwTuO/5Lrpum\nZ8DyW0wTkAdWdDFhd4xrizuO6Y3gzYKrYBgbu0V/YvV1BWGgEbKN0g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKd2p6bmt5WjkzTXpNaFE0\nN0dCUXNpS05WajA0UnZiWXA2WmpIdDFDS1VBCjBBM3FRd1hYbzFGSVl2ajFBOTVz\nVWpUSWI1NE1TWkp6Y2Urc0R2dXczZlkKLS0tIGk5MzY3S0dZUmMvd2Y1dkxmSmR6\nOEVFeUxjcks3WXNZbEtSTkJWNVJ0QkEKDY9Xxm1SuQ7M2LDqsjn5ixexYj6KBhjM\nnJRvmZPqGSx4MxZOoIc6hVPQI88h6uO2LNLjGfMBYWfo9FsRZutXrg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGk1RWFvMUpi\nbjJrUitESGEvckVzODdIUUxtbWNMTktXYkNmZzdsWEpuVFUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpFZzF6MjhrWjdwWFE4RzFha3o4Z2tM\nK3RNVXYrRWFIbDNRZytSVDZzdkVJCi0tLSBlOUVkNXRIVGhCeUVSeXZnd3FQalhL\nRlVINFJmdGdxdE1DWXJlY2t4RW5zCj1uRLPEM8E1xPkRhOERFSEOdqMrd9Bq/GLf\nF5fe38Yx9yIxVrzS5lMsn1IhJnNuf8jppxRbNWP8OjNpFKWwYzk=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGh3YWRtOGVM\nc0M5QnYxU0c2amcvRFc1cGNlNk9SWEFXeHd2TUhwWG1reEEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpxejg2MFIzNjVINkFuTUNLRVJXWWJz\nNkU5bDkvY3ZLZGh3V1dXSUNaOXVVCi0tLSBKd1RBQTZPcGhneElYdVRqclRmU25s\nY24zSVVBSmRiTjlCWTFmeTVuSGNvCsmWSEw+bSE2Z7H5o5zTPBrEAUJoUQNf+2ie\nYvyhM+bDAmzAOYlyUCPdj7OGK76a14xcVdq09RBKXwFWtRe4WpI=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFV0VkNOTzBo\nWVVVemRGdEVISldKYitVaEN6Ty8vZ1lUWEN5U1NJVmtIUjAgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpuS29nbU1lUE1iUmt0TzVLQXJCWDJI\ndWIrVlhPUlJnRnlQYm52ZFgwT3dFCi0tLSAycVdUR0NTOHh2WnpiYlhzdEREYS9p\nUWhSVHA3QmcybTNOZjB3ME9BWHFBCtC4y2cQI55yx/ndEcdFOSgKaw+CwVVSfYgm\nhliwYgs8R/OttucAa93snT1dWicACmbFfYed/swLsMsKkw2uG/c=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2dWEyV01UdzJ1bWRpUnlx\nSkZMWE5wWEE1VXJXaC9yUitWcWNJclQ3OVZJCjIreW9IOVU1bm5nSlhta01yRGJF\nVk5WN3Vxb25jZmhLSTBYM21lTk5EYWcKLS0tIEJsMlptUWtlWFdJVEpzbEJNNHZh\nTVJMQU1PK0xsOHFQdGN3bjRKVjl4ckUKF7GzljGn4J2jFYxsfLyg8o45IqZwb1ll\n4y3FwuWJ62YfHdY8iPFfLBVArhKD9iSIh3yf4Vxj/3+p5luNWnvsUw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkTUxPcVhCVDBDcGxQeDVZ\nMDhmajZmK3l0bXpUdFNEUEhILzl3MXYrV2hzClpnNFJkZkUvUjl3SXppNFBFVGY4\nUmh1RitnbHpEUTRWZHJrUWNrNU83eDQKLS0tIGYweVVpdXJsa3Q5dGYvRG1GRVZK\nOTNjNVpBNFpZallVSzNQSTAzS3AvYncKwlEivlYTcrKNg1NyBG5QKAKY6GvBkI1x\nkOX0Akcyxns7eKNLBg5mDxDpHP20tfvkvtBtAF0OjRYbcXgVN+jrRQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6dVltY1V3THo3WitiUHNB\nVGl2QUNLWWpPS05ZS0RFOGVkS2NXSVFHMGs0CmlxMEFWbFNxTlJlSXVMQWsxZFN6\nbHN3QzF2Wm83b2dKU3dMQVVxMmZzVXMKLS0tIDFtSyt6aXozQUdFYm14VncxRmhm\nT2VmWTlMb0RhS0ZqOTh5QVFZN2ZTYlEKoADFPdRQUdezS6VCu/9wqM1J0PFHAhNZ\nPqKNJsEk8zuK0Z4Jsfdfj8mCh4IaHux0mhUcL4ihLyQIdb6Jp9gllw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0U1FtZkRxNzhXMVUvVE5T\nQ0hDbjBpaDV2anhjeWgxZmpzbUxSSDFUSEhZClQ0SVFqYU5kdUJ3VXEvb3kwWlMr\nVnNZa1VCRXFLa1Q3NnJRWjJRSGJhWWsKLS0tIFNhMTFTZzVjWk1vbE5acUdEUmtO\nTGFSQkNBdGNKTWM1bmI2a3F3dFJmZ2sKi3Z9rXr7Bmn0Nb05zviKRajvMrMuSF2e\nTNrKOw647KsBdrvLCxBdplDrUWWiwpeBQE/UdOyNKVffm3pGBJNr4w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:42Z",
+		"mac": "ENC[AES256_GCM,data:M8PYIuKI373DZucoGPkm9qrkRz5TST3jyxKB3q6nd4EQXepZtuCDO3w7kvkjl+OxdC3Py54vk3LE25ppIUudYv9il4HHqQo0MWO8b5mDaYRri2uJ3qxO4LcwcPLZt7HUo7cwtr7iNZofXTs8Kk4FwqGkFCYTvwubPPVSKYe82uk=,iv:/hm72ocqMV++jIku6WJ+w1s/Q1tiWzdxouDWYAXeNLQ=,tag:oGgCYqk3wfkBC/2bZBuSEA==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAnmjyS5P+bJ5oCjTFJ79yD7avpya+k0PMrTBIVL3ynYk=
+-----END PUBLIC KEY-----
@@ -0,0 +1 @@
+ae6b2f69e7a75d39b2f0e174d08b3adfe90573acedbc9cad3212bac8dce08c6c
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIO3MkWOaP+Jatf0y1hTm1W+flCy/GB7iBlK2HA6tubO0AAAAIOi7KB+Sk1bx2jiPi09Pq25HFg20HebNO1ucOwyGDuZrAAAAAAAAAAAAAAACAAAAB3N0ZWxsaW8AAAAQAAAADHN0ZWxsaW8uY2xhbgAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAICXbUTypho9ecNCGzhQHzETuVroy8XnwBwZXsLN03kvrAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEBhA1sVKDGKqKCD1MCpJahl7kOa2TYueGDLYRbHS7+Mc/82019I7/IQ9wAZ6k27jgM50vmL4hcYtvQsJMQUHJsG /tmp/vars-79gjjs4h/in/openssh/ssh.id_ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOi7KB+Sk1bx2jiPi09Pq25HFg20HebNO1ucOwyGDuZr 
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:qo7AOPLV6kxhPuSZE6llB6V534Ee91yxgc39IK1PLlT92P1GPCTYbraEigjxEoj+OY0+Y6w9VblXh+vnF3mVTOZVf4inl6V+dO9eWCxGhE971cONUIamzzFaGmS2Y+Gs9t2QZBSF9PML5jvSSQPiIM0i0dEBZ/NAkhAZQpP9ivxKFaqaEwRe5Y4HzjQMoIGUT3LsP8nj0VhLxJZTSG0WYGHqYMds/2IgQuygjd67DrrgNnZh4wFgMzNDCo5Lf8i6k1fGls4ab0SXHcnRatNXFohnNx6TqSLfEqgEjZPU0mHiKeGWzDX4o7Jbm4X2mu8OLR9tCQqQQQxCdomLlIjSMu2pZoenJby8T7pCzMAHzgOqVsB8ZL2F9dl7s6C7T7plO8XNtByb54v4XBSUHwfOKeCLbXLmzNnrk0aRqynqN4jmyJdA8ijpjuMHQRbaXkkEtvDTCpuzqQRgCO0wI+ItRwgIomikHpTjeaa/ocnkg7eQ2bG+i2WPQtv44D/LGoRCpBKn,iv:e4ysOL7YmX+IN/6WfqEV13fsu8M2CPeXxKkmPHKqzM4=,tag:Y7aU5QvCEshNmHRpwcGUsw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnb3N4aWRRN04wUmJJM21Q\nRDF1Rm0xajdRV3Zma1B0U242M1JKekpFQnd3CmduNlZRWmk2ZGdsdFI3Mi9ma1pV\nZ1pYZ1dtNTRVRVZMUVlkRjJYZUxCaTgKLS0tIDU5ejVwUGlBeE91dWZXaG1Bd0JR\ncS8rNHJLZXdQeTNzaldRalFqMDJSL0kKCpleYoeiAJ3njQ7DHPE/cnTaVmN9jnse\nvegx9dKxrLbjrohm90nf1z0naabxo5dIL7c5nCLdma4t+cydvKTVBQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRY1VYK29HZ2tIT01OT2NE\nbEVkWWYxYjZMd3pXb05oTU4yM0tsM1g1MDIwClR0TVlUdGZZbWJQMzJsSks1eTc0\ncUhrang5M0JwWU5OQkZ5ZDRRd1dMTlkKLS0tIFJwQVNoS3NlQlkvZlZaOFVNWDJE\nSktPTXA0Wm80MzVBZXM0MWVZMmtlL1kKBXmJKL6tMH1EL2TaAOvTAml8NODtn7UM\nRCtTTde8uyu0MBTDzq6stUBg1uYMNkDh2UN0tR+VUg+216U/CacOIQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDZmak56SGdJ\nNk5yOHQ1VVJjRFAyZUFGRTRIYXV5N1J6bFlzSFd5TWJkbk0gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQo3UXhEczJIdjBCZUFpUkhNeTc5Z0FT\ndis2NWlpNU0zYzUydEJEa24rUmNJCi0tLSBKUUR1eWpHcHhHTGtlSXEveWlZRkRT\nVXhlOHBuMWVaRmI1MlRMbVRKUkI0Cjb42OJ94DMOF0PjQVTakbokmN+/4qZaiFpy\np2ciVzWrM5qEdKBi+G9FqCGy9IV1WQvfrQRueH5IWNdRgD2v6Yc=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG0veGdzRkNM\nYnlXaWdwYnZCWW9tZXFhM1E5UVFKRFZKcmZvSG1vMy92MkEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpaYXBjQkhBeVdONThrd1h1RHAwcFBP\nRzlHZW5pMGkvZitHbUdMeE5SZ0dFCi0tLSBFL0FXd25Sd041OTlQOGJwVmdlWEZH\nRHhVMzJGUXR2eFVVNVRBYmk4MlV3CsdqH0eKP9AgHaaD1VVdRU7HROBa6aoktuOj\nKjYDV5cljzCs3rkC3dCr/XpekiRol8MAQfqHSDZu/2sPJzN9sOE=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFJLdEgwV2dk\nNTU1Nm01VkJVRnRqazlrYUoxSElqaU1XWWhuNUlzTTBWaVkgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwo0TlNhRlBZR2ZNUXJhdGUxWEF0NWlC\nNGxNTnJ2bGdZWEZaR1kzVkYrcWFvCi0tLSBGaFlzcTA0VEZDNDZwd0prOVVhWWh3\nUlpEVzU3THdaYlpISnRXRTFxL1FJCixq2BXu9gBY/YofT5fMh5OHaTq9vCwS5d8u\nvJ8HlSFMZPlc4KHK5n31hKJe/V5vwxErv1H7ATpjfeDOJH7hUgk=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQb0x5L2djbzQ0ZlZsS0g5\nTG5vYWd2Z1R2bnV1OExhTWVLb3lzV0ovTFFNCjg1Z001dmlwWmdZODJLcmFKQ3Qz\neVZxaWlIQUY3aXQ4NXVoSDU2czQ5SE0KLS0tIEZoZVR4MVdLWVlWbmhvcEZYL1VX\nOG0wdEtvYmlhMTMraElIQklZM2FielUK1F+qIbrCHPFvHd5KuCFx/ifwrvQFvTM7\nW05l6Sjy0MbOC+QGUdrlw0kZNu5uQ0U1Q/z0gb9ZF/Ae6h70byyB3A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCM3FNUHh0Q3k4WkRFMHVK\nZERmZHZiTDljOWxuc1JSSEsvR1VQakxVUWxFCkR0VXdCci81ZU01S04wUnQyNnlY\nbTkzRW13aEtRNWJnelJnSmxRLzVCMmcKLS0tIGVub0hHRHJJK3lPR1IzZG5OSHdD\nR2hnYjBVNG5TU2ZtMTdKRjBCTnpETmsKsWuZ58MXAtosQdLnekKBLalD9yD0OAWg\nCTr+4So+tHVENokl/LjjUPXryRl3a+RExLHEgyRPORkV8y6nXXJyvg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvYU5WRDRNbEJHWXhnRWdC\nVVlXMVBZL2FpUlg1czF0cStrYTMzZlNaTkNnClM1NXdiUVFZOWY0Znl3STlTdkUr\naXNDQ2RFdXE3NGZWRDdMR1FrVGR6dFkKLS0tIDVRbFp0Um5zTW9qODVabWtndTRx\nRnhLc3RRU0dEVDhzdFo0a0gvamdab3cKPqibNlN64u43Vm9V5wwfBdXksXSJkH8s\nSV2Tq9ZALQvOpH3F5CcMdiztBczGzqz19wwB0bGFbiPCeANvTE8wRQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQdVBoZ05OVC9vWVlnQ0lO\nKzRKdmsyZzNJQ1RFSTNjdFhaR1l1bnZGdGs4CkhqMGZzbVdHQTBCRnVnVUlzc1Fq\ncUQvTHRSSFE4SURkajA2d25xeW5uc1UKLS0tIGQvVm85dHhaTzlCZ2o0V0F0RzdO\nenBYOUVRMExzdk9Pb3hwM3ZxVTFPalEKJkx9U+nRtqh7vF0k2ioxyRuKnJkTWeAR\nKGiCIi4x6mD1RT83GYBSzYLlksbOTlWWQ01NYQm9c9mcRJLPMOIt6w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:42Z",
+		"mac": "ENC[AES256_GCM,data:B92SvCXMf/dD9OaavR+n98KZ9/bRnxhkTiYTD5EDLgr5V96fzOI/D/d58T9UHl4/KZUhx2Sb8RNWKPqaGzsm7M9hcTQN1kSQvDRACwHHOTb3tV43KoUSClLPrhJW+Vy1y0KWFZbTcME1lAYFZuxRotZ54U6ogMLsEpd3vwFCKT0=,iv:8UzrJlUxwGllsKXghhCYN66/03Q/0vZx3qC83LCs4Qg=,tag:sPXwpwb9Xz6U1lGLoheJ0g==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:pOhLtV+nHWGtTsE57vNvpONm6rD1V9WA7taoRA==,iv:WTxZyb3HjnSoGUYbvZGEq18RWWUdxEI56W62NUUhY+w=,tag:H5LMZgpiJUYO1SSjBK0nKg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOYlowaWJPOG5sWTF3VXVn\nSThnQnJxTmRFUk9wV29FV1gyYWpLZTlUSXlFCkJhbk9ZdmowdmZlNzFGYnZrWHdF\nbmZqUE15RUtpTXFadTFYQi9EY25PM2MKLS0tIC93RUdpMnAvZHlrVXlZNy9RK0RZ\nZ01Jc2piQXRyRjZyaXBvY09ZOVNrencKOR1/X7Hl6VWosEclsuQhg7zAtsfZfycM\nmIJjTCtZOd+Br5IirV+Bicf78FMlUNKxSAfAmvSZzix8VpAbCF6Pwg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmekdHdGF2RlJ3UzF6cFNp\nVkR3QUFINnBBb0pNY1B2MVBOcFgxdUZYWTJjCkRxRUQrQWMxdFM1Yk1vRk1rUW9E\nWEhncC83WlEyMFJCZkZyeXRuQ0RZK0UKLS0tIHVteDIzWUdQM1lJeHQ1RjNPdDdI\nTGZJYVpBcUhrbVFHbGxKcGxIRmx3ZXMKjIe5pANboDieeV7FnVg6MyRTKtugEmXe\n/OF41893CjNKVa9Rpaelzd2B9ZTv94pBl6bkpzcRVb7lDQc+aCYJ+Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC94T0Q3QlFo\nYUJXbEE3UDZLMmhyTXl6RGZuR3ZGclpCNnhtNld6RHJpMjQgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpNN21vdVdnWkhJS1VJTXdmMDJCbURY\nVCtxU2JGNUx4SitxVHVETEFNTGVRCi0tLSBJVWtoL1FaYkFXNUozdy9UZDRYVzBS\nZ1V5ODdKbXkxM1hWcldJSElKNjFNCsSwMEFvXDlg2LIfhD9np91xvV6k/iKMk4eX\nnrEc4mu6BoMmeGQcrPgMSOGc+7R5d4duBJ7cux8sgaeN+K1YBAE=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIENhWjlablV3\neVRFakNBaHk4SkFrRnE1RUVnVE93MHJXbm1uM0VjVVpsVzAgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp2TE03VWg5Ry9wZ2FZNERXczl6Vzcr\nditzSTlMS1FzUXQ4d0JuOURQZW00Ci0tLSBCZHVpeVM2eHB2ZDRpL1NWVExMSW1X\nK3JIR3FIbmtEUElScC83NGNiK2M4CoOWG+151bJVdZsN0rBdsLcjkQHsoRPe0UZO\ncExyM7xZ1WZTKEIPRtuOf2Sf7BhCldnUfvDWTh/5TvyEmlVSGCw=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIElFNjJxb01I\ncllmV21EeU5UU2tnNHA5ZENlcHdwcHpXSldyNDFwbmtSV3MgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpaamRjVkVJZWZuS0lhbVBzZHRPdnRL\nUTVIR2dnR1o5bHpzbmRoeUo0VXpzCi0tLSBFN3E3alQ1enJzOXFrU1ZMSVQ2aUwx\nb05BL3laUjNNT2JPUkljKzVZR1hJCo8U6RJleetpnrclOKiLOD/FbmMamsHJDMZ3\n5k0nWnQIqOs1S/caPZTVDhKMdTpKXkPHuvSTv70X6s1ed6QKjQ8=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcTdJN1lOaGU3VlZxTm9a\nY3Q3TU5FOXRaNVk4WjNJRkVzbVIyVkxDb1VVCmVnQVp6VVFVSDduaGFoamlUL0pL\nOWRmamJsbXM1UDN2NnpwRXN2eWtaVjgKLS0tIHZGRHVXSmdZWWlpUHA1ZmdtclpL\nWWxvbmcvNWppUkhObjQ0cjhTYmpDUWcKJVpk/Tr2TSbJzLgO52eWNSErB693+vXG\nWUpckVg0kBSmk134F9vwawMl6c72e9drVoC6tBq7vju7jGeuckZdVQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWeFFYMTNGV3o3Zms2d2xI\nQUZ6MmltMDZ0a3cvb2JyaG1BMXFLTlVTb2tBCjUyWTNEM2p6dE16bFJ1NDhpNjly\nSFZ0WXdxUSs3QWJFRUdyMGVwYmVDRVkKLS0tIFpKUkcrbjZYQzk0WmRZZkFZTEVG\nRGNiTWJaQXhBLy9PZGM1NVdHeUhxU2MKF147TBA9IpVpfjwmwrk2a9NoTy/lCMb0\nKqGcrKy7X7kAhe0/vJkeXgBO9cUyPv4wpImPDOG+toe7hBovjN75fw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4cDRjR2ljNGJUQVJQdG9T\nZmxDR0N6Yk41UGpwWmdHMEpqeXQ1V2QzcWt3CkJ2UjAyNkoySUhzMmdRNTlxZS9R\nUEJOczdRNWJJanJBSi81Mit3Rm1lSlEKLS0tIDU1VU1zbTB0K3d2K0pseGw5cmZY\nQ3pLNG1rUmhNSlFLQ09lS1RKSzIwdHcKAFkKk2vDX1Osb2jh55JNh/IRv39c1we/\ntfJh7WJ4V/fGDuN5aBBFjl855N5iD5UDAQ4k3tqd5IAi1bu3T3kbSw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUnpsN3YvWk5zZDhOb0Nm\neWhnV2tKN1pDWkxrYUdsaG5KYTQ1U1VIWEhvCkIvbDZmeU53T1dMa2Rqblg5aEV3\nQWFvTWVjR3pNZzkrcm9nMCtzNEtUcDAKLS0tIHFmM1kxY05qMlZ4NmUrb2lwNGxK\nZWdQcDc2WDRCUG9uNjYrYWNlL0kxenMKMLg7RhA+Hj7MPwW4fCNu82rLy6gGq+32\nooZ0HBX+HrYUVG0LktKkUvbX7lqzIyAvaGwKTp+II1WIByU7LXSN7Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-09-18T06:18:20Z",
+		"mac": "ENC[AES256_GCM,data:rQa+5v1ftpo/WWGzo56ehu57Y9qzKhqkM5QJ2IhHclSrSoMu05la6C52M7xUvxAyMEMJ0+M8sFYWy+jKyZtspsLaRoj/eLDUgWBGJeKvAiMVaDxoeo4ziXGLPofNhUag7YwNaR9DmoSX6Cadk3P+HtaqE1qy2SVSyUIQ9oHnQmE=,iv:pqyiXOghgzx6O5iapunLfR4d3ng45a9Hj1UqUhjrkuI=,tag:Qj1i7cVpL6gaIuG3s9IxCw==,type:str]",
+		"version": "3.13.3"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:6WiDKqyb2FXVNBg2UhR3DwZa,iv:bNOZ8gKG/3yXjoYX0JBtCqr3jJvpb0VyMYguY4yonHk=,tag:1fEZPSWGMUX0/UbLdkCwcg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1QVcrdlZvV3crZzhqb3c3\nUkZrYlh5NVh0Tkl1M0NjaTJTdmk1NGNRd0g4CjNxY1RJdmlSNnBMVlpxQTJwcXpt\nSjlKVTFHME1RbllmV1BoblAybHNyVzQKLS0tIE8xeW83WTdRYi9aT1gzK0VzZ3BO\ndzFaVDZFWlFDK1lvTWM1N2FQNE1OdUEK1lZPHByUePgLsfFNwD41jcJTD8ppauak\nx4C2ZI3rW9OtubdHufq6na+nEnw39QPiw/vLL2Uz6LkNFxUeKGOrDw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiQzZUemRiUU9GWEhVMVJi\nenV6QlhkSms1K1VNTmQ1TzlOK2dXQUhkWkNrCmVlaThVVGZTM3UxU1RONzFnVWRn\nRktJcTNESTlmWTFsYXRxRGxDVko0OUEKLS0tIGdQdjBmcW40VDFnY2xIMFFGMHd6\nU1pGZ0JhRkN5c0VIK21oY3Z3bkFjZ1UKswAs2F50Re1j6sPxKi7zaTQpCWsVeyPH\nPTEcYvuYbhPReL7kRTDqJY/WWLtWC9N6DEIZKpdMH+/f2utbLzQeqg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDhqckRvaWdX\nRW05VHU3TlpBRXdLWGNEbWdQQVRzY082amV4Zm03ODNJaEEgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpZMC82RVBYL1piemdEQ2N3bkVBR3Zp\nczNYSTcvVC9pRFhndjJGUldXaUFvCi0tLSBFVjJ5V0JjZGhqeUxML2VqOUtodzJ4\nWjJIdmJ0N1lhTjFaZGlqUzFzVHJvCqPfTCeulRj9dUMp2F0xzEM0ogT7dmNTJsuD\njWZGSLVLtJpubpudRX0PBIV3fyhC9s0Q3XCAe2g24AKH/VCEBAM=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIC9XZzJpQUJU\nclliamRlcmRaVVpraUxqK0ZCZGQyT29SM29jOFh1dURtd2sgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpla3Yyby9ZREZJaTFOeFkvTUZSR29R\nVmRoWGhsZXEyR1hIbmhKWHlxeG5nCi0tLSA3SjkzblZ4VWNmcElrVVBRMm4rdXBP\neGsxV2t0SUVlcWpGbnBlQ3FSYms0CjZhn7RKsZ0Zz8zDRvr5lDI0/hqq9ANFGSt9\nlSmDbBIkuh4PTYzCuvudMNiASScGmeWxKQqaxA+BJVdlTa1QJzI=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHdVRXdsZk1J\nSXREQWEybW1Gck9lTnVMVkRnYy9La3ZDQXJXVFVwSmY2eHMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpLRFU3T1RWQWxodmgyWDZnMm9LN09l\nY1p1LzMrWlRUWlYvbVE2UVZiMWR3Ci0tLSBRd3NTdmxZa255SVVrc2FkZnRUYWhX\nd2EvMFJtbHRZY1pkejdTb3QrNlowCn7uh8POlPuO31KqXY4W+CYLCtxWEDWMVdOh\n/VBNb9XEGV0IzTErNPtgaVQupzbnb8TVS/KuM6G0Z+ABg8y5RVw=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvQVdhYUV3VHJzYXM4OURW\nbGNOS21vazVhVm5zalVKUFVSblNTRngzVUZRCngwYitMRkZTYktNNjdSSEY5YlF4\nTUx6QUpJMTR5NVBHQkdpbG1TVmRMTWsKLS0tIFNOWXN6MEdZdDVjWHc5TjN1K09V\nWXB1WGVRVUswSHBGTkp5RnJ0R20vRzAK6/KEhxV93oLhlI1VAf4hRdoTGBqFfv4Q\nIWgQFGPxbEXNjvlauB5ZGxwpCgQTWgT+pKIDc9vUrPpt7symJS0CMQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqQlNrL3VUMUY0SHZ0YUZF\nL3d5SmViY3NURllya1Q4MmFoM1JqMFRuYWxBCkVvcTFhdDJWRiszUSszRXl6L2g1\nb2xtUG1sYTlGdGtIS2M4VlNua2ZqZEkKLS0tIDEyR1RkbmdYMUFvQVJIeWsxNnRG\nUmdRanp1OUpsU2oxV1FuZStSSjlucVkKkISehCi59bnA7SUdNw3wVV83aZ1RGpy9\nl9CrlCT3R7EoX0BU49SNhIMM5iwJt5YhUCLZl13TUb2bF0z5Nwcdxg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVZmVMTzFoSDFpeTJGMlpr\nVnhHMzBPdDI2aEFsdS8wSXlqMGM4RVRjSENrCmFOL1FZaFB0elFxR0FIdy9FRjU5\neDROV0lYMnFhNjdUUDFhclVia0V6UkUKLS0tIDZYbkVpY3JkR2dsa2FVWUh5Wjgz\nY1dQdTJVYURJZzdKelZuS0c2NHRsSUkKs+YXFMXOPmKC2QPrxdeTY1f05Q2UlO/O\n7/fw8Y9ioF5TcMIrNIjRP85f3G6KN4AMu/PKojcXDltSBLGTTNQzZg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqN3JGenp4Z1FqcnM5ZHJa\nbUY3VW9FK2w4NDJvYzJtTTloTnpVZXlqUEFJCmtpMkliVE9ZQ3g0SEd4N3ZsN0NF\nbTVtUGFZeURvZ3VLdGJNMEl6QytVQW8KLS0tIE9FVGJ4SVFBbUM4MlUxa0NZTk05\nUHZ1YUtZT2VYakQrMWsyYzRhVktmSlUKU8lBRfWqtOdcjwLgT75jFv60Bm/ZS84T\nPj/9CLzb+NQ/06m3w4cyefhq9k4wjHM7zQ4Y1uzv/JpIkbIUrUuiBw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-09-18T06:18:20Z",
+		"mac": "ENC[AES256_GCM,data:k9zsU1OW6s9tdqSdQMWsrdVN4Sl/nWY6oY3IbfPeFstaljDEUFjhKW+B2gayFIFuBryqzh8zFCBw76H0nKrtDswRty2VThc5IAVQt1XfKeRl4pUHoM5Qt5Qwdti/jLpSqgJ/1CzLQAvwYL8qc14gFbVFGH8R6aBUvxQfJ+OZ23E=,iv:3ITsTUC7iM0KPultW/0nxeTsUfxGhlf+qklNUPhuvg8=,tag:rfTvb3iuk/sR7lC/uEgUNA==,type:str]",
+		"version": "3.13.3"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+26.11
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:iP7uCx/8n8XuZfavJjnuaQ79EE+EVwFR1OicGJVg89AE7TZ0bbTBlHPYzhw/rUHDWWpHr2msGGQMyRwHybR3,iv:amlaPU2vjGhl8mZ/ISqeCgbv56Z0+5PCn4Fkydh8+/g=,tag:J6N3as45ANbiZYoKZZm6dQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZVEFMKythVGJ6dE9yQXdV\nY2pIU2U1TUtHZzZDd3RCVTJnK0t0bVZyMmhrCmZlRGJ0NkJ0Sm9neGZFN0pIN1pk\nT2tFYXdxbkpsdUticG1CVzBjNFNJUjAKLS0tIDRsWFdhRUE3alFJUUhrT3Nabjhk\nL1BJNjVGK0pXRER1YTR2VkRFWFQxeUEKuHb44CERXxtdCg2Ijq6wm+et/02MuRV8\nI/gjmedFyhEh6npWdfd6jWAy/DnQf63B73MAyvRdQ56sHeGboeR1dA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlenh2QjVpMnRac1pZZ1o5\nWi9TRzJEUkNBU0J2VVROQWRyTm1ydzVHY3dJCmJkUTUxOFZRc3dQay9FdnBNUFU3\ncVV2UDMwVU94WkdJVnlWWFRvL09qSzgKLS0tIERaMXNDT2IyTXFZTG9WSmcrRS9D\nU045ZnRpQ20wdWlyNDhjbnFkNEZneXcKfhWIu9EkAZjbT9FHEsUB+mU/x7QeCKLu\n+PB6Hml/bBxCeJbweE9kJ4mTnuWdp1l7hsTWbE32VyWZsOak4HPKhg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGtUcEhUZkxj\nRHd3N01jR0FXamIvK3NtMmdhVzNwUjhDN2IyS0pWWnBPUlUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp6VzdQck9pTldnZk9PSFUybWNPVlFn\nUHRTTlhtd2RsdlpiVnZGem5rK1FrCi0tLSBMMzVxdzNIMDRMY0JrRU9nM3FodFBo\nK3l4UXprVjNZWWhrRHRGdmZvcjBBCl1WMva0T3coYshnotC8epT3i80DiKkycodn\nCpEWZCjaYXBzWH3gM4uo2s17u80c6LhOwNolQCUWZZ/kAXNDpsw=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpZWE9VSHg3\nVkJXc3pRcml3Wm1XNmFHUi9VeDd5YUlxWFBuWklyUFVQa00gQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwozQkNrNWYwaVZCQU9sQlRzNVkxeUx6\nTzlkMGZKVDd3Z1RNWXhhWWRRN0lRCi0tLSBRVXhlVjRKb1U2ZEdSbUhYTy9ZcEZ0\nRWM2Nk1tdUoyYjV5OHZ5Y3c4SXpRCqhkbaMYb9Op4RJRc8ux7ZAgg6jV37RYcdnN\n6qgwjojwZTlgdeed7VYrwAFTgcuwyaa6UzZUOKaBXXZMwyhIL4E=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDB6dC91OWVE\nU3lDUGtMQmxmejhoNUg1c1VCUzU4SXNhVHU5ZVZuV1NsblEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpSQVN1ZnBqUnVjd0M4ZjhPYW5Pa1h0\nK251alVETjRvMFUvWEFGVHVhTHA4Ci0tLSB3V1pDenB3SzZKUmI3ZExaU3hhdjdj\nNTBnc2lsZFdPMUhVbkRaWlVFRkVjChYRZ7Upre1IslIhjkE5i9n5AtZOTkYGjU/W\nJu4mHd23pG9wZjo+93OvQjx4MAQGkB6r3wrmBH+rkjATzEKvR5A=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbEVONUxLQThOM2VVRGxZ\nVFp3UzBBRGcyRmFQNG8yU1g4Mkp3U2cvY1drCmE2T3JDZGd2VG5zcWFZeGJpZnZU\ncDZSaUZmMDJjVXZpbU9yZXRsekVicXcKLS0tIDdqTXV3WmFydzdEWEt5aUpHcy92\nWkg4dXBwR2lvSWEwT1RveTg4UXZXTU0KkzIRQhcUhnwVZRvY4Kn2L/FAxcu1iHyH\nf04x+nrGZ/MFtAxXaN31ggl2b0AuVz7HB/916lZwT4cnw2Zr1GzoKw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZy9pZHlUZmMzeEVBcW1w\ndzdQb2JkSG1pL1ZDaUlMNys2ekw3Y3hqeG1vCjBVTHZsVDA2VmNpZ1VPVkJEZHBm\neUtGUUJ6QXl0cEYxWXpDaGVRSlNvdEkKLS0tIGc5NzZqQVZKWXk2dTRLNjVMZmJ1\nbnpwWENZbWswanUxQ1dIYUl6ZzRlUlEKv4q4Ue3MnOKBu6FqZwZG5yV47kePFoku\nMUZutPuE/QeMBt+9lPXU7qC4yAA4Yno9Xe358daaKT+YrXYldpszaA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3c1Nqd2Y3WWVKUnhGaW1w\ndUJwSHZyTWkrL24rQ202Wm0yR3N1RHI1RURBCkRjT3lFSzBKU3BxdHliWkUzWC9i\nRkFvU2oxNXpMeUZzWHpUOTNJczZRa1UKLS0tIGlidmxjS1M5ZVZYUG5DUHVRVGUv\nZ2JiWjU4ODl5K2dHNWZpdWwrWW1lVG8K2Dc5gElpgou3NNFJE+pq76sOaIOhS8/h\ndlS4rVbzfetDP2pvLbvvfmcmXIQsjwXZW/HvQMS6fg026saqeTudzw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0L0NlU3NsZHhHbUZ2YkhG\nNXNZbFZjaVdwdTBoOFRzYi90Y0srT0YyN3o0ClhIT3QzT0FIM2gzT3d1Tml0R1k0\ndzJhbmkweU5aTFVxaXhBUmNIdlRLVmsKLS0tIC9yaG8rczI0U0FBeHkvRW50ZjRG\nbDQ2a2FwY3FMOExwRTdVTHRTRm00emsK2NYzZfCgKqPsuzEAwNKgB+eth9re3EEq\nBdp0xSV1SRAOcVxudMSBHIxnPpt6vAhfk0ffvO2Ed3+lxRWfBMK8qw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:45Z",
+		"mac": "ENC[AES256_GCM,data:Hrzq7ZB16pMOVO1QsUour34Gs47OF0LBu0w4CTu2c4bfWzabhI2WFsqs9g/bvIl5fcRZaIBQS3/fM8lDsqrGHbQmFXpg+YzOHI9Mbxi2IcY8rZihwcRW7Ob5T0gCQ1j08SggnHl6NhWi/y+br3h0iOdNjYvboUaaBVqUd2AGx9w=,iv:TqvtOV4wJJW94/JMuWk0Ew12YcALnmuWTdEyB1eIF7w=,tag:SVNFwd8/uKrJaKBciUhLJw==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:lRUOkjvYcibH7aK8h2jCS1jrUU6I+gMTp9eDZo7Kxz5XQTQgdjjOByh3fKSGLsvGsHJJC0K2tx2NvpzKaEUBeRWrAhjIoekfvG8A3NCg48bCHsDbUqTDQt0Rn1MgcOza,iv:vWy/VuQV2wGqm8/NF+WapmM6Q3aEAvHOFY8bFibgrpw=,tag:p4nlnbsUHo5+9HAYGG2cOA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0enRiRi9sbTZIaTltMm5v\nT0xFWDRKNjFjN1NMVWFwNEpzcWdzaGFwb2dFCmtyZldmTHJ4QzQ2emlQckNzdU50\nN253UVpUWEh3R0tYSmNWZE80S3dPNDgKLS0tIFlSV1AwOHpUODFVb1VNZVJ1TjFP\ndHQydVIxQU5aQUcxTk5OQS9WK3ZyN3cKDfIzALhtS86sPTFdJNmvjWFsIvh84aKN\nYNI5piyIyYNs+w61H5FdPcQ06NUBFlXGqNqFvNo1e0Wmt3Zf3d7V0A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3eHU3V0dmR2pSdHorWlFj\naVhCV014Qnova1dKOXl4eU1Qbit3dEVOVVg0CjJzcVZBcG5wdmVPdEVENEl0dklY\nZnB5dUpHdHdndTZzVVdEMTNCQTIyancKLS0tIDM0bDcxRUFqNTFBTmJTcFFjeXJT\nUWxReDgvRThmV1MxTGZoUUhyblNqWVUKGxET0B455eaCgl6FGc3a8hzAufDPj72T\n4GzuMBbGawCcrtVDjuccjmIxkvzmkrLbIrKJ14CXX5zBbymLfcXboQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGJwdEFYdzhS\nRzl0WnFCWENLTGEvSTVCaFpYRkl5SGozOXVkRDdLYjJwancgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQozcW4wRnErZTZqbHpGM28wcmU3QTNN\nVk1GZGpoRXlrSFY3UVNYd0E4RFVJCi0tLSB1bFhjd2pDQllxSVZMdEJNRWttYytE\nU0dBdXY3V0Q0YWpNQlNPbzBHUUJjCucpoaZDC32yJDMU07jESuKypNOPVBL2oZ+i\ntS0wREGAdYmU2ElkR5taHUP5itFsD4Ta7O+GycVvdrUYKQB2WJk=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFM5TXNldnQ3\ncHE5NVR4Ulp5NytXdnlMdmVjTHNwcVdEUTFrWmRCZ3lLeHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpZK0FJQm0rV3dCYTBTWGluNGZHcXR4\nNWpPelBRQUZQTncrT2hTSUwrT1I4Ci0tLSAxUVhqYU0ydWgrZXhLTVhONmFmVkJj\nQ013U3lENmZpYklvZ0Vtbm02dWtJCgIm2DOzEzwa5Q4JRea9Dh9aIg7aYOYQPwLk\nWjL/clFL4JMJIfVS/6G6WPlPYDT3Qg50KjxeftczFOkVybacKgg=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIG9EUlJwUnlx\nSVI2U2J0UERoRi9kQ3hIZ2FmZEhjdy9BWUFLN09LMTNteU0gQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwphKzNaN3FBUVNkWGR5eDB5WFJIb3h2\nVVo0ZVc5S3N1dzRoZTg4bU56Ry8wCi0tLSBwVHVDam5KWkNJVzBzSnlGcDg5SGp1\naDNUMFIzR0taRlYvdkpVdzVGM3ZZCor6Yn7gAMlCCUy3L095K51W6KFAS4FiBm1b\nIPle3ok6No6nopLqXa23b3O9rZbTxJqlWoDx6M9He1uucpifCF0=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aXpmK3JMZmRRWDFYSVRO\nV0hicU9EcGExaXQvVUhNUXR0T0dwR1J3NGw0CnNTNmpaNWZGM0JaM3FGVlpYMGRy\nQ2VoWkZxSU5FQTUrRGdqd3drcTBqOUEKLS0tIG9hNEp2bVprN2RtVlRaNVpQbUZI\nNmZoVE9zK2ZIbGJxVE5vVHFXK1RoeDAKiFuxwE5Z1vwar/wGWkkTRLlDYFojrOU1\n2e2XuGKB5sgnNEuIJbczKLKKYWI1pjf7qhEUch7xP1eHf5PtyU6VXA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZMFg0emNQM3lWbXZhTFE2\nRC96V282aU83Q3kwczN0K2l1UlRGUGVkTFRjCkZjRlhoOFI5MFFSVmdYUUZBY1F1\nWjZMR3pOakdTbWpuUnp0RXpBV254Mm8KLS0tIFkzTUVGSG1JWkdSQm03M0QrMERn\namd6d0lZSmJYNmdXdUVLUjNWNHNVVGMK+Qn2Pni+awfsylxXxn/s+iE1/G/w2GBE\n2EV2y9E2n3UG9RtKACSwSi1BoUXm+PYFewEwu5SI6h3LEH7DxTjI+Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRakdtaXNyNm4rZkxHdll4\nZVZ5d3JBeldGWHZOMUsxbmhRYktUL1c2MmgwCkM3Q0NsTnEvVFpIMzh5L0hPWVd0\nNG9ka3VvekJIMUdPWlZ1QWFtYlJOQWMKLS0tIE9PMDRyR3pPaFRkM2VOTXczYkRy\neXZFNjd4NW9yWUw0Z3ZBeUJxOVNBbzAKLrgbg0y3Q5DnbfAJEFSaGPJL2LQvVSpA\nKHYfA5LHFj3vgPwJjFwm0lYram+2qVvAO2p7hF5nmrVBTbcWRmN6Fw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnB6em56T2ZDOHFaWS9Z\nZHVUbmxoL1V3WkF2NFRBVC96UUVjNWdmZ1dZCnQ2dGwrOFRyWnlJalJwZXB6cXlU\nZlVpWXdncndVemM1eHMrZFp3VlFqaUUKLS0tIFlWSzg4NjA0UCtYMTR6amt3dkc0\nWjdhdm9UUnIzRFhDQWgyMUNKMklOT2MK2U7E6IznrOD/+2xT2saKr1d0dJujiNkt\nbXsIspGQ8BhaqtClailNR3blgSFM+phikbh3AYqkSXB8wbZDXCuzaw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:45Z",
+		"mac": "ENC[AES256_GCM,data:MlYlbBDwvR4ykN2Q+V24mIYMxVHep/QNRl4jgPSJeYPGVw4+NGtXtflqZJWW7W1A6S3Gzcm8IcEOidewQDHzkfeREvrMeszQA5rC654bxLKHVLYGeCnOSiZoStyD28kf38ziK1oZwuYjFQkl5oIsJv+w4W1g5tIxM019yB7aYM4=,iv:3xrhgAATofjpnr/2goOxtau4Ue9p4V5v1NxnNnuaG9k=,tag:Olcd7P7U73TBeWg+NQUt0w==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:8KgUpV7BQEBpNTZumIPWJZyEG113BeL6CYnJtnVMuUVVrQpTtDK+VtpGUANEbrptyanrVifNnOk/x4DLp2NYYWZk1sBUV3TjoA==,iv:Ik7nI2sIthPHggs72FDAPCGfSXrhw4mxgSW9XDJK+xg=,tag:ElH2LXa6J5WDmSqVquPeyw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNOHhuTlE2YmgrcW1lZk1T\nQlErMklPVi91eGZXWGVlMGExeFlSU2d6cWwwCjdDTVZJWmxkMTZSdWgrK0ZPcGpz\nWStjaDhrM2dSblM3eDRNS21BSUVSV3cKLS0tIHhXbHdaUE5IS3lNaEt5M1YxOWpx\nQTdoOFJ3UUZuYkg4MzF3bGl4SDRXQmMK5+EEiCbOdYxHBVb8DDh4Iq694PeLYpCj\nTOp+vViACV6et41ZOyZOSrqaoQNaoKxAVQ5Rfawo92V/fw7EdlDuJA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENHh6YWczd0ttemtCWW14\nME4wRXp2SjJKSkZqL2ZmbUFqVFN1cFNZcVJrCjVRSjVSUlpTWGlHcE00cDRWb2VR\nWUxlSGcraEpESFBhcmtSVVZXdzY2L0EKLS0tIGtOOXhRUkVMcjdZNzlqR3RaNHVS\nMjF1bWNkc3JVdUJvcFo0SWxsUzdBaVUKMnzUsxBPnGtwp0jRyBrYn8WPrvnoOvey\n/Yljezupgt6jsfJkkhbtOJ5KDj0bTAXJzj7tkbYrDgrSibpjUNdCmQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEJFQStGbmsy\nMlpab2txanhyV3RNalFWTm5NWC91RllSYUVRZk5NRmNuQ2cgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpEZDJhU002QUxwcUpmRXRYeHhpQXh6\nZkxacitqcUMybVcvSkVBN0dyWUtjCi0tLSBkaXhFYkRySVNBZDhCZEZsajNoZ29l\nNUZJNjVOSGhKRDU5Wlk4VHJZL09jCmFkSRbscx0ZAb/mytYwUm2g9g89j8VOgrkr\nMROuMtvq0uI8QFhQbdPUYZeB6r0HsXbAjzB7grI55FajUS0kTGQ=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGI0Zm5VN0tx\nV0JBWWV3cWkwSnJRa2FhTVljZGI5U3VvMVJQSWNyMVhvVkEgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwp3RTB0cmpUc0wwbXh5cDVCS0FLcEVp\nL1ZOWmFoSklPenBHL0ZNdW1NZWJzCi0tLSBjS1NpMms3MHFIODhweDd6UjNZNjln\neklUY0U4cURYMEpHS2ZRQ1dOblpJCj/yi05kF4fhWzhwn0PVP9rRwfwxi3FJTRA9\nQJT/c1ONKwLGv2N5zSCz3r5j+ljr/iDUfh+xQJrqbhUf63JWEnA=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHRCdmIwc00v\nNmx4SUl0NW1wMXZObDlXc3pDd1VrcGE5TkZ5clJvYnZWRGMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpLZ05WRWhwZzh5eG9CWndnMTljaFIr\nVUduckpQNDdUSytGRjc3QUFzdkxjCi0tLSBPdHc2cUpGL1dxSzh6U1ZadXJ5S3hy\nbzBURGNXOUFJcXVxeVUvMFBwdk00CkfaclY7nlbDjeT8i9pNOMO3PtRhY5sQ2/Vs\nTl5uf+7ebbGQfwxMG+GNBAqM70USf9vh84NvcFvaA/tq5gq43+g=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bTJMRlF2Tm1kZGxSYS9T\nVU1wVDhWS1VOT2kvRUhIS2N6Q0V2MDRGTkZFCjlFUkcvU1QvNzMwS0VOZzNCaC91\nRm1FL0hqbFlDR1E2ZUt3SkFibzRaV1kKLS0tIG5LUFVzdEFoakZHYVRML2FUNmJZ\nVzI4SnZZeS9rNWZIYjdJSHc5bllLSmsK3PVYYrRh8xcATKllKvzNdYQGFJZ0/lo4\nxwXbvemxvloDIFWHJAqv3Rjj++LB09wwJTjqt1Rh4rASCYAa2wlCQw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZnozaEZuVmxwSmUzOWc3\nOFVWcDJnUEhYUGNrY1MwbE56c2J3aFFWZlJJCkdSS2JBanY0MTVNVkZOVzJoNldk\nRHV2KzM5eFZGUDZ5eGdmbGwvN2xwUTgKLS0tIFZ0R0lLMXNlQ1ZWVHJQWWQ5ZzZ3\nbjdEMEp5ekVQQ2JvUzlpTFVHRTNuR28KkqAz46hagytustj1Lunbn6lErjbkaQ81\nyj5jOnWJhfQW0pKsyS/EMmuEH2KYS/94f8Ado7p4Fr2G4S3wTAWzTQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNDZVZ0V6eHoybkRBMWla\ndXh4RDJCVjVlWWcxSzNsbEJ0eG9RUnA4a0JzClZvcGdDc1QvWkpyTXY0Yytsd3NU\nQXlNRkFmc2taZGREMGNKR3llQTRHZm8KLS0tICsxMXRTaHV4MmpVYTRZVTJiMCt2\naHpHTkFHcXc5bTRQSytwQnVIU0duc0UKGa8R+Z2q8bkbzd3cLZf6GbyWyy/OjMcn\n6goEDfeBafGwNkYvhz9pd2HNN+0AGPTd9xOFUj4hafnC8czxmmxIGw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlTTF1ejhWZVF4UVlXc3NE\nZytZdjg2NEZSQmV1cU9IREpGYTZRQUVjaEhRCjVmNWRxVi9SMW1TdEk2cEpUdFJ5\nVmV5R1JVYmNmNEFWY2NCV0FVRVVyakEKLS0tIEc0WjVmYVpKazRnd1lvcXZhdFdH\nQ1M0eGhGdTF5bjhYYXFHTnh5WXZvZXcK6xhetbmDSa8wTkO6NITExetkBROR55C2\ntMNNat9kNOb6s75fQULlRaMJUTJigSpy/SUDBP6S8XpAHne1Hwmxpw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:46Z",
+		"mac": "ENC[AES256_GCM,data:x+zzKrCeSQ8qCb4VhgK8d7JIPjb/7Nv6J3gfP0JJov+amTSdUyw3miVNDAJD2rU2EfPTOVeTBotwFRp+kycZ7Q8G2y+bnY5cqheIJ5RWeKua1AUGZ/hihpcUXky2vEyojOzYPtXV1CR7M+QK2TQ0IqDo+Xn42EXEwm1Pik591sc=,iv:2Z2P0b4iwxfEF1CHFzrqiz9HTsx2jpbAaO4vuJ3w33M=,tag:TBfN8BKD65OmQYTJ20El6Q==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1,42 @@
+{
+	"data": "ENC[AES256_GCM,data:hyln1WrV3NrfBKAw7TW+PuZ0aYc+fXxc14A1RgE8eop4jadmzdjJb1Tgvjbea51w,iv:afAXbKqS6bs46cX/gi61cFi5CWj7A2AegDlxAYJEt+w=,tag:wz65fi5tjNuGEQUaDLg0Fg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNSmJLUmpoOXJ5cEdVR3VK\nWmRKOWV1U1lRWEVpR1hQbTVwSW1aMEtnQlgwCldSWmZ1NXNzeWNyREVRWStDK2t0\nT2phbVRubmlUay9SOU1URlNodDFQa2sKLS0tIHg5aFp2SlZKalgxY1NlRVFHaXRn\nUGFxdGlJTjh4VEdQR2NEV2JrdlNpK0kKgJFwcHpaXKZto2UiUyXj9ZtLm/IR1kjv\nzwo4HLcNo8VI4eSn3hlUQyphcGAnYMEvhVe25tyFYkH1xRm9RVOHxg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZ6V1Q4Z0k2\nSFRjZEJQa1E2akd2OWUwMmFmWXFXZkxDM1NmWHBES21heWMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp2QVQwWkZtTWlMSDhJWmVkTlVKQzN2\nZlE2ampXK0Y5ZHZSY05kSWRDZ2hjCi0tLSBkSmsyREgrUlBRWUJWSzRnRGZGY29w\nWFZteDZKWTJLZFZnamRrL2JTNHhFCo9twvFS11tDUBHJnKSLdCBIiWrnjczuHuYM\nsFr0tjMfP5kFHAEQ2pafjJf23DiKDrJemRg1CwgNQz2FsyA/epo=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDM2YUVyMnBk\naDVVcHlmY2d4UDN2WTVSL3hSQzZlMkVlMUFaSFJRcEErVmMgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpCSVBGVmozU0wyZC81RURYNTFqY3h2\nczU0aFREWDhxSnU2VHNkdzNVdTJrCi0tLSB5TjNCa0ZBTUpZY3diVTIyb1hOaWc2\nR3laTURvWGkyQXhXd1drOU1KeE9nCkV7wsTNpFYDRij0yqBrhUkktG9D9nD0wyNC\nifJpQOoY7bjdFHwHM48EF6iT0copWDkKHgvKH0mWTMeBonU5a6E=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFZVeXBaaUNV\neWtxOHBkMHhaZjQ5UnlDekp1Z3FYSEdGUXFuK0tydkplVmMgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpkU3FlYkRCeUdRQ0FYK2F5aDlBb0FR\nQjJjYmo0VWpnQzZ3M2h4V3liSjFFCi0tLSB6NlhjalNjZkRTVUJnbmpzKytTdnRr\nRk14aWhZSHpQazdyTHIva0gzUktVCnT7IjfwTQhjGRZ0QsySoat3WvYOAuuBNp+L\nTuNBcVybcPRJjPXymTNCPc5wLWhLEtyWI2C54VoSg6h3usZo7pI=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3S1plNEtqTFV3dFNTY0xn\na1FvektoaGpua0ViaUlsMWRJZ2ZSTFRJYWtvCjY3Z1c5aHZMRVNURG9xOTlUNC9F\nUjl2TlYyaXREQVdOKzFaOGVoMGtOWGMKLS0tIDRLUmRsQ1JsVXA2WFdHZ2ZEeCs5\nb2RpZm1kdkFhSnFGaE5kTk82TEVaNlUK7LpdpuwrIK5LkKcbtpJl86iDrwb5QY28\n2TZ1672ezpryEv0vmEDwfyZlWVqzVTzyuy7cPRT3tsw5yc9WJS7uGw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwRkdZL1M3YXNrTDU2VEdN\nRVhVbnRnbkYrVW80R3lmYnFCMll0VjN5dXlJCmJERlNIRE5NbEZ1L3A1RElPLzhQ\nZE9ZOW1qeE5MWXZwVzRmVlpMZHlLbWMKLS0tIGkxT1BDUisrZ1NqSGhlTWUvaDB4\nazg5aFgxTFdrdnZsOGlQR3ZnQXVoNnMKHSMZveAvujuGfluBz1H3a5yuSFsG7VTQ\npvIlAnquThzx7WZeU4OsU6IORHSSo0ItdpBxlhEJx3sOauAFg+5qUg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIOFZrR3l1bmZCMjZWcm1i\nL2E3Y2thRXFoSzZ2cnlKTkxrdHNoTXArdDJNCndKN2s5ZGhRNnp4YTN4YzNqWk9i\nbkhINUIwQ2RxbW90ZkEwTUpUKy9BUmsKLS0tIDRVRm53eWlSb1dYYStOaFdOdkdW\nRTNzSjNMR3NSWC9JWVFnekp2dlpIVE0KbzQ7pkiV407uHJ1odKaELJ4lbWl0AZFB\nSkspjdvkEywD/cEEKmUo+jxwzTUX/BPGH/Rl+NbZvZA7lXFxNTWGlA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZzIvS3YrVWM4M0pMMUdS\nYnVIVVM1dTgyK3ZZc1Vua0dyaUhIMzA0Q25ZCjJtL0ZUaXVFZVFudjJ2MG1kWnlT\nOVIzTHJhdmRVK3RRbXhaN1dFclF2WDQKLS0tIHRpVXVBVVV4dnpRYmNNb1JQOFJQ\nRk1scVZMaTIxaURxQkNZcnFJT2hXQ2cKpQQBnnBefqst7Pz16zJ2XgJRECf6762u\nPlSeXetPmChJzNzlHULYj9CVF1tpwW3rsjAh2o46Bq84jHVMQlXfNA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-08-12T08:44:45Z",
+		"mac": "ENC[AES256_GCM,data:LSiDDclyBe+k2DsFV3VQ+up797RarsrswYkASRbhhriZJUDm8Gn00k8/3CocXRIy//25fh5dHHC9Au104E1PmTyjyzNRrOoGoIfr6WOAuXeczWATGR/glQ/gi9iHlecfj5L03d15Pnsfw6Q3Cq/LSF1qco4Zpo+8dpGGyq0RjHA=,iv:ZjE9YzdwY1OGRzgvqM2vzsBO431e79ALmTgrmWbpbJ4=,tag:yn/KUjII5kx1NxW2T5t9Dg==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:a2FQFSLd0eUq3FdoGKY1RBfy38CfCxtWqf4AiTAqsYeFQJeOFzNC28c6YImv,iv:EDlMtdxJFlo1G8chTuERaMNhGFO0C4Nex7DN3pn7i10=,tag:8HE58+YnKhdJpax15jyCqA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Nk1QQnU1WFlFK0RDdlFr\nWkhSUTN0SDgzSXNtK3c3ZFRieEkvV1hqdmhVCjJDZWxLYXpWUGJoMHFYeWE4U1lD\nWVFFQ01IblBXUCtNODZ3OHF2UmhhM1kKLS0tIHZndC9rL0h4ZzhPbEY1MkkzT1M1\namRib0FOZEdhR3hUQWpCWDJaMnJMb0kKiqanyOifjJO+2Pw/m7Sx3+Z7TFVULDlE\ngz3qH+tlIo//GpufHPIfQ+c2gtFaNFG1AKbOewIK3inuEzvSEQyF0w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpenVKdDBEMlY4V2QxdmN0\nZUpBSEdzbk9SWTc4dGZldzk4NDZLa1UzTFRjCkt1MXZWbzZtUHpVdGozc0JSMnhP\nOGxnRkRSeXgyMTVvUXQ5WG9IcXRaTGMKLS0tIDJNVlVZWll5bjN1Z1BXdzR6M1li\nTzM0cVdFaEFxTjdmZ3RUK3JHQ1V5a3MK0KgXsT3efS4BQi2nBZB6TjAULYUGE72S\nTYKl+lQ+p8IREG8DGU0MzFPnPAjat0YAMav4RNSQGWHvjqU2J3fNiQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDk2UmlZTzJB\nV2tZS296eTdabmg4amNKbnc1QUluTDVkcGh6aUdsbW56RHMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpQamZwcFZGOHpISVF5Z0FGUjhhQXZS\nNnBmMnIwYVMwOUFoOEJwN2FpNkRZCi0tLSBraUg2NE1tM1FjQTk0M3c5ZEwyODV5\neFNIc3M4OFpzOCtCbFdoaGZXR3NvCsVpoP8RKmd/wLwjmMpK8fEDlKUF00W5+YRG\nj2qi6sHPNsScgFL5am2P3lKF0kjbhx02C5bZxxocEJ99sRJL3N4=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNNdTlqNWFq\nOWR4ZS9ZOEdsaGpUWXdrZHJiM3FQTUFDQ1ZCbkJibEhjaWsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpjaE5oZ1ZmaWRMRURCbE5TL1krWW1j\ncFh0NjRWWWNFMm5TSitrZ3BnU200Ci0tLSBVYjA1clNLdE85aTdnZGJIbTJQVHhn\nYWFuc1k0Yk04aVdqdFA1SERWRmtjCtBq6UTDH5qMdVLv4zuyvi0JT60a3bmIaD1u\nExb5g0HxtmLZCyXVCj8/+Amj9xdsJ4ppmbp/7gxNkTmas9+K1H0=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEZUQWtKODg4\nZS9CbmgxODdiTzN0VlAvbTFYL2RaZFd2aXJQcW5JQ2s4Z1UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6TlNickJibkdWM2dESzZOdmQwQUZP\nQXJ5ZGd6LzhpcEJ6RnhvdkI5SmxBCi0tLSBVNUoxK0pmZDUxbEpKVnAvOXc1S1Bj\nZzBkemtONXF3aG1kQUlEKzcxME93Cqr0myzB5rHWchu5ppaKVD+Ypg/eWExmvwTJ\nVKptgfdfzfowzIHftRyVNvWzgt+D83QhwmZzELfpv6RGkST4BQs=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMCtGNlRIUUJnYTlvL1ZG\nVXI0UG1uRytsM1J0dHZtbXFyRVFFeTRaK1RRCnoyYWwrU3RWWENyck9lK0xmempI\nQjViN0V4Zzl0WVlFTGhvT3I5ZkpvQlkKLS0tIGVpaWg2aXNiOEtiV0szcWJhMCtj\nNDhJaGk4WnhmZDF3d3NDSUdXTjY2UlEKYyjpIe7bpSgBJ4fMb5j58kjNBqePezmC\nKvqPDSkT9OzAf2Hkgq7cG1CWM95GYjHpeDevoRvSs8l7fCrOUWTV5A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmTWFuQUErcDVYRDZhVVVm\nZzEvZVRGUlVyaEM5OXUzb0plcjNzT1hjcWxNCmF0a3dXZGJXQWgwRWhvcCtha3d1\nMVBNeGI1SloyTzRldm1WbXNqaHA2QUEKLS0tIHUwNUt4MEx0K0xpR09DZWxEa04y\nS1NLZVoydUhGSVBZMHRVd2VZc25xdlUKJRkVkKqDyxtviNppT3Wywj1RJh44hO+H\n2YU1wvfPtkar+Tu6ua0KEtKGEnbQK9woVR1n44aB2pBHrJKOTX3qTw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBNUlyUEZ1aktHSE5SUWE3\nRFdreXBabzNKWmhCbjA2V2pnbzkzekkxa1c0ClZQNGJoUmtVSFl5eXpwQXdmM2Rr\nckVTZng3RTM2aWNzYUQvVERJdEJtWXcKLS0tIERWbWhaZlpRK0p2WEhXREZ6aUVZ\nMU9NaVBBNCtaZFVWRlVxaS80aWY3RUUKqlXufjNFkWGT1RylteAtw6ijsYBRvQyL\nHheXQBkZ5DgOXGJ6qlJCEwBh4XC4YB48OzCmf230OsP9QIG9LpX3ow==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTQ2xRVUQxb2YwazhUVlhS\nZTQ5Zjh0eGxjUElyWUFGVmRiSUF5SjhpQUVnCllhSzBoam1nbzZ3eGpJRnRtYlYz\nQVpZak1DQnVOVk9zSWFvQm9adEJKUGcKLS0tIG5xNmlYOUxVZVN5RTN2R2NrZG52\nRll0MDQxNHJVY0U3K2gvTER3NEN4MTgKf3XZWt0f3ml33yI/z/zIWS6FRQf3wAF4\nmIX9dePU8HKnkp3Oy9Cot5hhI9asq1moi1OGNkS2htzP3YUS12a3Bw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-09-21T09:50:13Z",
+		"mac": "ENC[AES256_GCM,data:9oM++V+iIv6KSy6Yhd16Ocx9moyXRgs04sKTAqIJMja+V+dpN/gznHJmgRW7TbFQKlov7Zi0HNlByWWCipxXF7bAfYTF3/79ZetkF6y2oFWm0ieab3yJbcx/zrQm0k+jEYansME5JHJ4OjF7ZBMPQ6ibtjWQU60LfutVmhjhqR4=,iv:7UeqRTU5puNv95iyKLQBlw9MJTIi9URvImQK7sHmqcw=,tag:1cmR5SMkBA8WpCWxU9JhvQ==,type:str]",
+		"version": "3.13.3"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:Cz0lmpOGYW/Yik8plBEWURzH0eNEwpNSuRH+Vs6bWnNFgBl7MbaR3h9J1ELv,iv:PR/76pDzXAa+zqv28EzUyn3tE0KLXmwXFKjszGmGQhU=,tag:k6IhDQKXwJOc1qO82A+ZQg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRldqV3dFV20yV3hYdkVn\nOE85WDcxSE4wd3I3QjBiVFVqL2c2TmRYaUYwCk5IUlNwUm5tZU8xLzd1K28ydFZF\nQjkrYUtCbVd5YS8rUTBwQmhEV2kyc2cKLS0tIHljTlRBRHFIZWY0UWV2cUl2MmRD\neFgvV2NZV3RuZ1p5bEVxSkRuWEtnZlEKGiMnCtln1vSkJqOwZUtNxCO6cATk8xHh\nYTGX7BrX2FeBuGNTezcp29qnGJng2Z62jh6Eb5O4rUovJg5cVAabZA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbVc2M0J0dlZxVUx0VndY\nOEsxbFVaM3dRSGZYNDJjVnRSZk9CVmFKalRRCjZOSlhwd0p3UjlKc2dOdEtDM1Ft\nTHBWK3lsb1JOYjhVOEcxSXZJaUxuanMKLS0tIEV3QWtuYTJaYmt6MHRWa2lLRzBI\nZjNteElMUTFENDY0S2xsSU9KUnVlZWMK5HXz/YBmGvERAfVjwl7IsMOEABkv9sV+\nrlI5I/GFkOHxzeR5TeF5YOqnSd5oLQDHtYlovYV1drdeN4yfd9lLNw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDdVU1lIZTE5\nNEw2Y2lJaHI5TzlKV1c4REVvVnhzNGtkbjZwT1RpVUFwVmcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpMdUM4Yjhwa2RvTnBaeW9Ic1dMVmVo\na3BWWC9ZYmRzZEJNZ0U0d1BsQTVjCi0tLSBuRi95TG1NNDltRy9pY0FCbGNqU0FM\nZnloNmZmbEdDTnFLSlhOaTZzeHNRCsJEYSr/Zyj45cp1CYZwTAZZuS9C+65EZJ8Y\nga6faEEo1Fa11CNhaN3wvqqiGwZhN3CPboVAo7giQkXbpmrvbHE=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdYMkJpTHBK\namxlT3RUUlRCTnJtSG1GVmtlK21NL2NpaUNJZGNOTGVjM0UgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo3QlBIbTNncVpnaytEN0NqY01lTXdG\nZ0FURDgvQ2I1Z3BHNTVTNWxEeUs0Ci0tLSBmbnlvSTNQSXRVejgrMXlubGVMM1Za\ncE8wdkoxQW8rUk5YSTdWOW52dytvCm9c8ogdR3gHsTVTqcbObhfQXsNXO0nudh3M\njiTX9BPxZDuIf8OaL0Kh0M/p4U0UNmSBj+SsEctCkBf0a1lHhHc=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGN2U0t4eTJL\nN0ZiSldQZUpCOHFxU1V4L3RPMkwwVUExY3Fxc3A0cVM4MUEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp1VnJudlBKVUp2YTl6U200Y3A1ZFh3\neWtXTXBhamJsWEZJQ0VxeXhSRWQwCi0tLSBqWnNJdkJzSGdqNkRGcDRnY2lQbFU3\nRFNOZm1YUUdPR1pGalczN1h5VmUwCuRg39/4XjF4JDNKbYBD9uFK/YE/xjEkcBPY\n+niwkk0bVMim7/+w5ROiJERPYffn1dyBm8YOauwE9DfSvd/yhdI=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENEdHTmRBUmhGUWx4b0Zx\nTnBKbHFpc1FBSkoyKzZPZzdlcXRpTUtKZzJvCkRBN1hZV1FXbTZDbHpaSXhHZVZH\na1BMV0xyUWF3cCt5N010ZGxuRk42WkEKLS0tIHRBbko0dmQrN3hobVpXdHprQjBk\nWEhhc0krRnlmZmpySVVhK1ZCS1Q3UDAK390KtJjWaiASVW63zzvFFBBup5Wo/DsH\nwzp4AEM0x4i+QgSAFEwFEtgpfitIxE/F+EV2CPkTmyccygGShbIcHg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQUxzWGJoa3QxRnQyelNq\ncitoVGFOZEE4a29sTTc5Snc4a0JnejAyVERZClE3S2pVb25Gd2FkK21IZ284VVVi\naVJnOVkzSzAveUFsVFZTQ1JTb3VnencKLS0tIEMzSHMrSTRpbk1TeWFOdjFZRFRC\nSnQvZS8yUjdyQmZtd0RBTkpBR0lLZmMKOug+UtHoNLVJMhBMmlsdA2xGY28IA5q2\n1+L6+KK3A/8sqtLzBBh+ev5SKaLgnCKs2WKz/BcNkiBBxGRu/4DPfA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUHhqR0NqVzJZRWp2UzB1\nZmFzMldjZXVRaFZGbGN3Mk9scitBY3JpRFRvCnpHS3NhTkZkYVYwWHRkZHBNMzl4\nR05wSUhmdGFhc2d2WEtVcVV2aWlSY0UKLS0tIEFWY09lQWd3R1psWFFkZGZCUHcv\nRVJYNW0vUTJXblJoS3E0dU94LzNiTjAK98FCTYD6x8KbN6Ugkpo3mUwl8rZETQkh\nby9ZWMcBuk7kZCWQ/HcCNZq3JutDl29k8Zjj/xJmqemw+lqVY9AAmg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArTHgxTFI3cFZQeWhQaXh1\nUmdiSjR3LzUrWUg5M3pzdFJWdnB4b3NxWXpZCmxBbCtqVkp1VmlPdXZMSXpvcDJx\nUUREMDduc0RQVmtIc1JuN3JFZFNycnMKLS0tIGQvY211aUI4dFQxS0FGTllXV2N6\nWEd1VHBNNGpmeGpUa00zL05WNDZueVkKUWA+iHXydSwQByEXmGHVWhFM0jp8dJGG\ncy2Dy8SOeQQt+h4wx3MNrfQn2IW0RWUOzszutp+03rRJmcX+ZNNp1g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-09-21T09:50:14Z",
+		"mac": "ENC[AES256_GCM,data:ims4gXwRuyDeRFCi/uhU0BYkVrlkG4Tdldz1PQMTgz+vcQwQUN7fmzXOBEKyyOuQi0IcxyLCCs9+C6FqfCoaOcuO6k7J1IjZ9t+/OrL/DG/Jh6kRk/jIh8I8hq0bsBjiqHjv4nvg5mf04EF3YbzGIi9GL6r6ktgaZVyKMEwAHsA=,iv:ouyE4KNY2V2IfhWSB88dGYE5O530joJIOeoV/vkZphc=,tag:2zt6NhJO73adFDkvYBRW/g==,type:str]",
+		"version": "3.13.3"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
Author	SHA1	Message	Date
kurogeek	7abdbfec85	inventory/borgbackup: fix ssh key path for cursa, hadar, procyon, bosona, canopus, deneb The sops vars backend deploys generator files at /run/secrets/vars/per-machine/<machine>/<generator>/<file>; the hard-coded rsh still pointed at /run/secrets/vars/borgbackup/borgbackup.ssh, so borgbackup-job-alex could not find its key. Align with alasia's entry.	2026-10-27 06:15:06 +00:00
kurogeek	63614d824a	inventory.json: update install time of alasia	2026-10-27 12:01:54 +07:00
kurogeek	cc7cb5aae9	machines/alasia/facter.json: update hardware configuration	2026-10-27 12:01:53 +07:00
kurogeek	2f36a34a95	gtcm-file-uploader: bump to deadb17 (1.1.6) upload-large-file untouched upstream; rev pinned in lockstep.	2026-10-27 02:20:53 +00:00
kurogeek	85d1591f05	think-gtcm, think-backend-gtcm: bump to deadb17 (1.1.6) composer.lock unchanged; vendorHash moves with the version (embedded in vendor/composer/installed.*).	2026-10-27 02:20:53 +00:00
kurogeek	9f76f7ddc2	gtcm-file-uploader: bump to c274e6d (1.1.5) upload-large-file untouched upstream; rev pinned in lockstep.	2026-10-27 02:04:04 +00:00
kurogeek	ee3059a8d7	think-gtcm, think-backend-gtcm: bump to c274e6d (1.1.5) composer.lock unchanged; vendorHash moves anyway because the vendor FOD embeds the root package version (vendor/composer/installed.*).	2026-10-27 02:04:04 +00:00
kurogeek	37496b974e	modules/prometheus: run alertmanager as a static user nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only exists while the service is running. The matrix-alertmanager-urlfile secret is owned by that user; at boot sops-install-secrets cannot resolve it and rejects the whole manifest, leaving /run/secrets empty (no ssh host key, yggdrasil key, tor key, ...). Deploys masked it because the dynamic user was resolvable via nss-systemd at switch time. Create a static alertmanager user/group and disable DynamicUser.	2026-10-26 09:27:42 +00:00
kurogeek	452bd5f686	flake.lock: bump frappix to dbfa76d frappe v15.113.3 -> v15.120.1, erpnext v15.115.0 -> v15.121.2, insights v3.0.24 -> v3.12.6.	2026-10-26 07:54:10 +00:00
kurogeek	d8193f0652	bosona, canopus, deneb: apply frappix fixups overlay	2026-10-26 07:54:10 +00:00
kurogeek	ac2b1873b9	overlays: add frappix fixups for nixos-unstable (sql_metadata, rq_1) Building the frappix hosts on nixos-unstable 3ec6363 fails in frappix's python overlay: - sql_metadata 2.12.0 pins sqlparse<0.6, nixpkgs ships 0.6.0. frappe itself needs 0.6 (MAX_GROUPING_TOKENS), and sql_metadata 3.x needs sqlglot >= 30 which nixpkgs lacks, so relax the pin. frappe only feeds it SELECT statements; the only regressions on 0.6 are CREATE TABLE IF NOT EXISTS name extraction. - rq 1.16.2 test_parse_connection fails against redis-py 8.1 (extra himport_registry kwarg). Test-only; disable it. nix flake check does not catch these: it only evaluates hosts.	2026-10-26 07:54:10 +00:00
kurogeek	466dcba07c	gtcm-file-uploader: bump to fdb71d6 (1.1.4)	2026-10-26 07:09:32 +00:00
kurogeek	136daea65d	think-gtcm, think-backend-gtcm: bump to fdb71d6 (1.1.4) composer.lock unchanged; vendorHash moved with the php/composer bump in nixos-unstable 3ec6363.	2026-10-26 07:09:32 +00:00
kurogeek	835373fa06	flake.lock: bump clan-core to 9486215 Also moves clan-core/{disko,nix-darwin,sops-nix}.	2026-10-26 06:53:54 +00:00
kurogeek	d63c87d0bf	ramus, tangra, flake, overlays: drop php backport (nixpkgs#576853 landed) nixos-unstable 3ec6363 ships php83 8.3.36 / php85 8.5.12; the overlay was warning that it had become a no-op.	2026-10-26 06:53:54 +00:00
kurogeek	477af55f8c	flake: switch nixpkgs to nixos-unstable, bump to 3ec6363 nixos-unstable dropped nixVersions.nix_2_31, which clan-core still pins for clan-cli (pkgs/clan-cli/flake-module.nix); override it to pkgs.nix in the devshell.	2026-10-26 06:53:45 +00:00
kurogeek	c909e483b8	bosona, canopus, deneb: apply posthog workaround overlay	2026-10-26 06:53:24 +00:00
kurogeek	70be800f77	overlays: work around nixpkgs#578265 (posthog broken with mcp 2) nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked python3Packages.posthog broken; only one optional MCP test fails. frappe needs posthog at runtime. Skip that test and clear meta.broken until the upstream unbreak lands; the overlay warns at eval time once it does.	2026-10-26 06:53:24 +00:00
kurogeek	e04805f889	gtcm-file-uploader: bump to 225578a (1.1.3)	2026-10-23 09:31:23 +00:00
kurogeek	2b69d0d7c4	think-gtcm, think-backend-gtcm: bump to 225578a (1.1.3)	2026-10-23 09:31:23 +00:00
kurogeek	3612bb2d22	ramus, tangra, flake: apply php backport overlay Covers every PHP consumer: think/think-backend (php83) on ramus, wordpress pools (pkgs.php) on tangra, and the perSystem think packages.	2026-10-23 02:30:28 +00:00
kurogeek	d13c64f314	overlays: backport nixpkgs#576853 (php 8.3.36/8.4.27/8.5.12) Temporary overlay until the PR reaches nixpkgs-unstable. Fixes CVE-2026-109618 and CVE-2026-109619. Becomes a no-op and warns at eval time once the locked nixpkgs ships these versions; delete it then.	2026-10-23 02:30:27 +00:00
kurogeek	32b1d76dbf	flake.lock: bump clan-core to a566329 Fixes devShell build on nixpkgs 5adc508: makeWrapper no longer word-splits makeWrapperArgs, so clan-cli's "--unset LD_LIBRARY_PATH" single-string args failed with "makeWrapper doesn't understand the arg". Upstream clan-core main splits the tokens.	2026-10-22 11:12:07 +00:00
kurogeek	51d7b7eef0	Revert "personal-computer: vendor ipp-usb module with fixed avahi options" This reverts commit `d41fa2210a`.	2026-10-22 17:32:15 +07:00
kurogeek	a48f1c75c5	personal-computer: vendor ipp-usb module with fixed avahi options nixpkgs' services/printing/ipp-usb.nix still sets the obsolete services.avahi.publish.{enable,userServices}, warning on every machine that enables ipp-usb. Disable the upstream module and carry a copy that uses services.avahi.settings.publish; only that block differs.	2026-10-22 17:32:15 +07:00
kurogeek	8769b83d42	prometheus: write README manifest.readme read an empty file, triggering a missing-readme warning.	2026-10-22 17:32:15 +07:00
kurogeek	d19cd6c51e	emmie: fix hunspell and firefox deprecation warnings hunspellWithDicts -> hunspell.withDicts; pin programs.firefox.configPath to the legacy .mozilla/firefox so the profile stays put when stateVersion crosses 26.05.	2026-10-22 17:32:15 +07:00
kurogeek	862d46b157	samba: migrate obsolete services.avahi.publish options Use services.avahi.settings.publish as nixpkgs now expects.	2026-10-22 17:32:15 +07:00
kurogeek	7d3dc6c1ee	think-gtcm: pin to php83 Default php is now 8.5; composer.lock pins nette/* to php <= 8.4. Matches think-backend-gtcm and the runtime module.	2026-10-22 17:32:15 +07:00
kurogeek	57e03a0557	emmie: remove wasabiwallet Removed from nixpkgs (vendored ancient openssl, unmaintained).	2026-10-22 17:32:15 +07:00
kurogeek	47ce38ab4b	stellio: drop image.repart.enable shim nixpkgs declares the option again.	2026-10-22 17:32:15 +07:00
kurogeek	e1e4687168	nextcloud: create admin user via occ nixpkgs removed services.nextcloud.config.{adminuser,adminpassFile} and now installs with --disable-admin-user. Add a nextcloud-admin-user oneshot that creates the admin account from the vars secret after nextcloud-setup.	2026-10-22 17:32:15 +07:00
kurogeek	78d4960301	flake.lock: bump nixpkgs to 5adc508, clan-core to 86d72f3 clan-core bumped alongside: the previous rev used lib.licenses.apsl20, which nixpkgs renamed to apple-psl20.	2026-10-22 17:32:15 +07:00
kurogeek	ea9529aef6	gtcm-file-uploader: bump to 895092d (1.1.2)	2026-10-22 09:45:30 +00:00
kurogeek	9a2f3e1ada	think-gtcm, think-backend-gtcm: bump to 895092d (1.1.2)	2026-10-22 09:45:30 +00:00
kurogeek	a460f345d8	gtcm-file-uploader: bump to 421ed1f (1.1.1)	2026-10-21 09:45:39 +00:00
kurogeek	e4133ad242	think-gtcm, think-backend-gtcm: bump to 421ed1f (1.1.1)	2026-10-21 09:45:39 +00:00
kurogeek	759e3ec61b	default_thai_company: bump to c8fb983	2026-10-21 03:42:43 +00:00
kurogeek	b99cb381c4	gtcm-file-uploader: bump to b67934a (1.1.0)	2026-10-20 08:38:30 +00:00
kurogeek	5540557413	think-gtcm, think-backend-gtcm: bump to b67934a (1.1.0)	2026-10-20 08:33:59 +00:00
kurogeek	50d923442a	gtcm-file-uploader: bump to 0658ed2	2026-10-20 03:48:00 +00:00
kurogeek	243c66e0ab	think-gtcm, think-backend-gtcm: bump to 0658ed2	2026-10-19 10:57:43 +00:00
kurogeek	72a17fea6e	yggdrasil: replace dead public peers, add Asia/US peers ygg.jjolly.dev:3443 has been offline 21 weeks and [2602:fc24:18:7a42::1]:993 is unreachable (dropped from the public peer list); every node was retrying both. Add measured-reachable peers near the Asian (SG/JP/HK) and US nodes so tree parents are no longer forced through two US-Midwest relays.	2026-10-09 09:35:15 +00:00
kurogeek	81f4e393e3	vars: update via generator zerotier-ip-mirach-b4l-network (shared)	2026-10-09 14:45:19 +07:00
kurogeek	ff88a93280	vars: update via generator zerotier-ip-alpheratz-b4l-network (shared)	2026-10-09 14:44:45 +07:00
kurogeek	9abafc50aa	vars: update via generator zerotier-ip-almach-b4l-network (shared)	2026-10-09 14:44:45 +07:00
kurogeek	08f87d630a	vars: update via generator zerotier-identity-mirach (shared)	2026-10-09 14:44:44 +07:00
kurogeek	b848f709fa	vars: update via generator zerotier-ip-adhil-b4l-network (shared)	2026-10-09 14:44:44 +07:00
kurogeek	5174234e95	vars: update via generator zerotier-identity-mirach (shared)	2026-10-09 14:44:44 +07:00
kurogeek	3dcc71de4b	vars: update via generator zerotier-identity-buna (shared)	2026-10-09 14:44:44 +07:00
kurogeek	04e1fc2f8e	vars: update via generator zerotier-identity-alpheratz (shared)	2026-10-09 14:44:43 +07:00
kurogeek	6350dff658	vars: update via generator zerotier-identity-buna (shared)	2026-10-09 14:44:43 +07:00
kurogeek	5bad8fba97	vars: update via generator zerotier-identity-almach (shared)	2026-10-09 14:44:42 +07:00
kurogeek	9a861fa294	vars: update via generator zerotier-identity-alpheratz (shared)	2026-10-09 14:44:42 +07:00
kurogeek	4536b97366	vars: update via generator zerotier-identity-adhil (shared)	2026-10-09 14:44:42 +07:00
kurogeek	2d13588f77	vars: update via generator zerotier-identity-almach (shared)	2026-10-09 14:44:41 +07:00
kurogeek	46ad94c4b9	vars: update via generator zerotier-identity-adhil (shared)	2026-10-09 14:44:40 +07:00
kurogeek	c915103634	phonebox: open port 80 on the yggdrasil interface so the ATA web UI proxy is reachable over ygg too	2026-10-09 07:02:35 +00:00
kurogeek	597f0df6b3	phonebox: move hello-world test extension from 999 to 99 so it is reachable cross-node (e.g. 2099 → rigel)	2026-10-09 03:27:17 +00:00
kurogeek	7f3457859e	machines/stellio: stop deprecating a PD prefix the ISP re-delegates (sync with cnx-network 45643d6) The ISP modem restart at 08:19 re-delegated the same /64 five seconds after the PPPoE drop. networkd re-announced it at once, but the fixed 7 s radvd run kept sending preferred-lifetime-0 RAs for it, so clients sat on a deprecated prefix until networkd's next periodic RA and IPv6 stayed broken for minutes. Send one RA per radvd start, up to three 3 s apart, and skip each one if the /64 is already back on the interface. Verified on stellio with the rendered script: a prefix gone for good -> three RAs; the PD address removed and re-added 4 s later -> two RAs, then "is back, leaving it announced", client preferred again and pinging over v6.	2026-10-08 08:36:59 +00:00
kurogeek	31ebf2d081	machines/stellio: deprecate withdrawn DHCPv6-PD prefixes (interim copy of cnx-network fa11327) After the reboot vlan-lan got its /64 at boot, but IPv6 still failed for clients: the first PPPoE session lands on another AIS BNG, is torn down minutes later, and the reconnect brings a different /64 (07:53 2405:9800:b911:91e3 -> 07:57 b910:1f5d). networkd announces the new prefix at once but never deprecates the old one (systemd#29651), so clients keep it preferred for up to 30 minutes and source selection sends every connection from a dead address. router-radv-deprecate.service watches vlan-* for networkd removing a dynamic address and sends RAs with that /64 at preferred lifetime 0 via a short-lived radvd (SIGKILLed: no shutdown RA). Identical script to the upstream commit; drop once the cnx-network input is bumped past it. Verified on stellio: the stale prefix flipped to deprecated on the client at the first RA and pings resumed; a synthetic dynamic address removed from vlan-lan produced the same RA end to end.	2026-10-08 08:13:23 +00:00
kurogeek	b5077983ea	machines/stellio: give the AIS /64 to vlan-lan, not whichever VLAN came up first Clients on stellio's lan had no global IPv6. AIS delegates a single /64 over PPPoE; cnx-network's router service carves the VLAN prefixes with SubnetId=auto, so vlan-mgmt took the whole prefix and vlan-lan logged "Couldn't find a suitable prefix. Ran out of address space" -- no RA prefix on lan. Pin SubnetId: 0x0 on vlan-lan (the whole /64), 0x1 on vlan-mgmt (out of range on a /64, harmless; works unchanged if AIS ever delegates wider). Verified live via runtime drop-ins: vlan-lan got 2405:9800:b910:1f5d::/64 and a LAN client pinged 2606:4700:4700::1111 over v6. Drop once cnx-network carries the per-VLAN `ipv6SubnetId` option (cnx-network-clan commit 27c697a) and the input is bumped.	2026-10-08 07:54:39 +00:00
kurogeek	0a87664afd	default_thai_company: bump version	2026-10-05 15:49:34 +07:00
kurogeek	7469976750	stellio: allow ssh over yggdrasil The router service only opens SSH to the mgmt VLAN, the staging port and the ZeroTier mesh. Also admit it on the yggdrasil interface (`ygg`, as named by clan-core's service) so the box stays reachable when ZeroTier is down. Interface-scoped, so a spoofed 200::/7 source on the WAN never matches.	2026-10-02 07:53:47 +00:00
kurogeek	c95f74be25	default_thai_company: e7d0a54 -> c6e6c12 Default Standard Sales Order as Sales Order default print format; position line under signatures on print formats.	2026-10-01 04:51:37 +00:00
kurogeek	2e56bfc54c	default_thai_company: 68f0817 -> e7d0a54 Picks up print formats for Purchase Invoice/Order and Sales Order, Withholding Tax Certificate print format and button, DRAFT watermark on unsubmitted certificates, Type of Income Paid on Tax Withholding Category.	2026-10-01 04:19:20 +00:00
kurogeek	b4c197e64c	w-inventory: allow phone to access	2026-09-30 13:56:52 +07:00
kurogeek	0dc7595f43	poy-inventory -> w-inventory	2026-09-29 18:25:07 +07:00
kurogeek	92a3676b83	remove break	2026-09-29 15:42:11 +07:00
kurogeek	6039edfac6	phonebox: stop dnsmasq trying to write leases to /dev/null dhcp-leasefile=/dev/null logs 'failed to write /dev/null: Invalid argument' every lease; leasefile-ro is the supported way to run without a lease file.	2026-09-29 07:46:41 +00:00
kurogeek	5066d4ee46	phonebox: arm hardware watchdog and auto-reboot on panic mirach and almach have each hung at least twice since July with nothing in the journal or pstore, and stayed down until someone power-cycled the board. RuntimeWatchdogSec was 0 and kernel.panic was 0, so a hung kernel/PID1 or a panic could never self-recover. Arm the systemd hardware watchdog (30s) and reboot 10s after a panic on all phonebox nodes. Watchdog resets will show up as extra entries in journalctl --list-boots.	2026-09-29 07:46:41 +00:00
kurogeek	a80202e419	flake.lock: cnx-network (ppp0 KeepConfiguration=yes)	2026-09-28 15:17:32 +07:00
kurogeek	9b0368edc6	machines/stellio: backport mt7530 .get_stats64 atomic-context fix The MT7531 on the Flint 2 is MDIO-attached and shares the SoC MDIO bus with the 2.5G WAN PHY. On 6.18.49 mt7530_get_stats64 takes the MDIO mutex under the RCU read lock that /proc/net/dev readers hold; when the WAN PHY is renegotiating (PPPoE flap) the mutex is contended, the read sleeps in atomic context and the box oopses: BUG: scheduling while atomic: zerotier-one/1748/0x00000002 mt7530_get_stats64 -> dsa_user_get_stats64 -> dev_seq_show Unable to handle kernel paging request at 0000afa547cef5f0 Vendor upstream 07d99587396024932e02474c3a5bede71d108454 (mainline 2026-05-04, absent from linux-6.18.y). Applies to v6.18.49 with one fuzz-1 hunk (6.18 still exports mt7530_switch_ops).	2026-09-24 09:21:59 +00:00
kurogeek	d525e63050	machines/stellio: persist the journal Storage=volatile left nothing behind for the 2026-09-23/24 reboots: the last persisted entry is journald stopping during the 2026-09-22 switch, and /sys/fs/pstore is empty too. Keep the eMMC-wear intent with a 256M cap and a 1 min sync interval matching the ext4 commit=60.	2026-09-24 09:21:46 +00:00
kurogeek	9b8d15d583	machines/stellio: a new whitehouse router that uses clanService/router from cnx-network	2026-09-23 15:31:57 +07:00
kurogeek	fa95098b7e	frappix: bump default_thai_company to 68f0817 (main)	2026-09-17 10:55:54 +00:00
kurogeek	0906700ad6	deneb: add default_thai_company frappe app to poyerp Package git.b4l.co.th/newedge/default_thai_company as a frappix app (pkgs/frappix/default-thai-company.nix) and expose it through a new frappixAppsOverlay that extends the pkgs.frappix scope. Install it on the poyerp.newedge.house site on deneb.	2026-09-15 16:18:30 +07:00
kurogeek	b9302e6192	clanService/prometheus: add mirach and almach	2026-09-11 10:53:00 +07:00
kurogeek	5cb262857e	inventory/wifi: retry autoconnect and auth indefinitely Set connection.autoconnect-retries=0 and connection.auth-retries=0 on the NetworkManager profiles generated by the clan wifi module for buna, so a flaky AP or slow auth never leaves the connection permanently blocked.	2026-09-09 04:15:18 +00:00
kurogeek	47e536540f	flake: bump nixpkgs to fix broken prettier build prettier 3.9.6 in nixpkgs e8be781 failed to build (stale pnpm lockfile in binding-wasm32-wasi), breaking nix fmt. Fixed upstream in 58973d7.	2026-09-08 08:35:21 +00:00
kurogeek	282a8f8287	clanService/personal-computer: supportedFilesystems ntfs	2026-09-04 14:06:30 +07:00
kurogeek	a9254c424d	machines/sirius: buildPlatform.system = x86_64-linux	2026-09-04 13:43:04 +07:00
kurogeek	5961254878	machines/sirius: rm common module	2026-09-04 13:42:10 +07:00
kurogeek	9403ddbf08	clanService/headscale: adjust magic dns settings	2026-09-03 17:17:36 +07:00
kurogeek	37ff958560	inventory/auto-pull-update: limited to selected machines until a build machine is present	2026-09-03 13:58:29 +07:00
kurogeek	efa4b39782	libreoffice-fresh -> libreoffice-stable	2026-09-03 12:22:15 +07:00
kurogeek	e2341b7c79	inputs/nixpkgs,home-manager,clan-core,frappix, bump version	2026-09-03 12:21:00 +07:00
kurogeek	dc1c94796a	machines/sirius: reduce write on disk	2026-09-02 11:34:40 +07:00
kurogeek	5b07b98f40	inventory/prometheus: add buna to monitored machines	2026-08-21 12:03:34 +07:00
kurogeek	88ac5cbd83	machines/buna: use wifi	2026-08-19 14:34:34 +07:00
kurogeek	969c006f97	machines/deneb: support Thai characters	2026-08-16 14:02:41 +07:00
				`@@ -0,0 +1 @@`
				`12D3KooWMD331LXvtCEkjsa78PNK2EDWZtNnFPJfnoaB8hFXsWzx`
				`@@ -0,0 +1 @@`
				`ae6b2f69e7a75d39b2f0e174d08b3adfe90573acedbc9cad3212bac8dce08c6c`
				`@@ -0,0 +1 @@`
				ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIO3MkWOaP+Jatf0y1hTm1W+flCy/GB7iBlK2HA6tubO0AAAAIOi7KB+Sk1bx2jiPi09Pq25HFg20HebNO1ucOwyGDuZrAAAAAAAAAAAAAAACAAAAB3N0ZWxsaW8AAAAQAAAADHN0ZWxsaW8uY2xhbgAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAICXbUTypho9ecNCGzhQHzETuVroy8XnwBwZXsLN03kvrAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEBhA1sVKDGKqKCD1MCpJahl7kOa2TYueGDLYRbHS7+Mc/82019I7/IQ9wAZ6k27jgM50vmL4hcYtvQsJMQUHJsG /tmp/vars-79gjjs4h/in/openssh/ssh.id_ed25519.pub
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOi7KB+Sk1bx2jiPi09Pq25HFg20HebNO1ucOwyGDuZr`