inventory/borgbackup: fix ssh key path for cursa, hadar, procyon, bosona, canopus, deneb

The sops vars backend deploys generator files at
/run/secrets/vars/per-machine/<machine>/<generator>/<file>; the hard-coded
rsh still pointed at /run/secrets/vars/borgbackup/borgbackup.ssh, so
borgbackup-job-alex could not find its key. Align with alasia's entry.

flake.lock

@@ -151,11 +151,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788346295,
-        "narHash": "sha256-k9Ol++FFhQuPya6ZNQwVhqZZkMvE1ytLtbdrbH5zkrI=",
+        "lastModified": 1792819087,
+        "narHash": "sha256-1bxllGymY+u3NvEX4FHMZyE4l9y0nRpvk/qLaPkwAjg=",
         "ref": "refs/heads/main",
-        "rev": "b15797faeca7494a7fe5fde2691d93affa3d3e37",
-        "revCount": 15239,
+        "rev": "94862153f6e63016151d7c527f9e7bb3e96b0598",
+        "revCount": 15417,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
       },
@@ -210,11 +210,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788308203,
-        "narHash": "sha256-dCOb9YIJv9I2udjqukvjlGiTyOvGnO7zVbot0PxjBGk=",
-        "rev": "644c49bbf121b3e256bc83ce10b5d97813d9181d",
+        "lastModified": 1791886485,
+        "narHash": "sha256-/+7ayxD7PeW6wMQiHw20UJHmSTGN8Y5HXbn0zG/EgoA=",
+        "rev": "8d4d36437f9fff6ecaa34872bd53c3ed09ef5464",
         "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/644c49bbf121b3e256bc83ce10b5d97813d9181d.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/8d4d36437f9fff6ecaa34872bd53c3ed09ef5464.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -249,11 +249,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "lastModified": 1792526520,
+        "narHash": "sha256-3hSJlv8mUVnZPMWK2+CM7a9O+nR6Z4mCh27NfLCmTPc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "cedd626e11b635470fa6f9fdb8ad79b0075dd7f9",
         "type": "github"
       },
       "original": {
@@ -419,11 +419,11 @@
         "std": "std"
       },
       "locked": {
-        "lastModified": 1787631179,
-        "narHash": "sha256-l+Zt5XNTD0f0ChkzDJURfQlFAgANIMrGYrk51SZEJKU=",
+        "lastModified": 1789106589,
+        "narHash": "sha256-RMQdAvDaa4eUcdePDqUGAhnyTtzKxc6a8abauy8bzb0=",
         "owner": "kurogeek",
         "repo": "frappix",
-        "rev": "fcb797886ae753b26a6e4415a7f2c19ba6adcf3b",
+        "rev": "dbfa76d84df6354bd7528c9d0c407387f66c3e33",
         "type": "github"
       },
       "original": {
@@ -689,11 +689,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786845137,
-        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
+        "lastModified": 1792737899,
+        "narHash": "sha256-P0/GhewcEQmAbzq3QunNWY2jLJaYH9F6c/5dEM/jQ4M=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
+        "rev": "bb0b90dbd54e207100de72b5dcbe3188c98a4b69",
         "type": "github"
       },
       "original": {
@@ -890,16 +890,16 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1788775869,
-        "narHash": "sha256-JRf1lSypbvKj6AzUZHpUA6YC1DirVuitZWOnRwcm+Ww=",
+        "lastModified": 1792773339,
+        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "58973d74f1893afe13f5902919803a0e99da0ca4",
+        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -1014,11 +1014,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788337237,
-        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
+        "lastModified": 1792809984,
+        "narHash": "sha256-KV+CaZX7QS0hcdKxwGKehDb1jmUgx6lbkTPpaoIW5Nw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
+        "rev": "442449fa7b1fe6c692d0103ac9fc8f9e82931cf3",
         "type": "github"
       },
       "original": {
@@ -1105,11 +1105,11 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1774449309,
-        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "lastModified": 1791244623,
+        "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
         "type": "github"
       },
       "original": {

flake.nix

@@ -31,7 +31,7 @@
       inputs.home-manager.follows = "home-manager";
     };
     import-tree.url = "github:vic/import-tree";
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";

inventories/default.nix

@@ -68,43 +68,43 @@
           roles.client.machines."cursa".settings.destinations = {
             alex = {
               repo = "ssh://borg@10.0.10.225:2222/backup/cursa/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/cursa/borgbackup/borgbackup.ssh";
             };
           };
           roles.client.machines."hadar".settings.destinations = {
             alex = {
               repo = "ssh://borg@10.0.10.225:2222/backup/hadar/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/hadar/borgbackup/borgbackup.ssh";
             };
           };
           roles.client.machines."procyon".settings.destinations = {
             alex = {
               repo = "ssh://borg@10.0.10.225:2222/backup/procyon/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/procyon/borgbackup/borgbackup.ssh";
             };
           };
           roles.client.machines."bosona".settings.destinations = {
             alex = {
               repo = "ssh://borg@10.0.10.225:2222/backup/bosona/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/bosona/borgbackup/borgbackup.ssh";
             };
           };
           roles.client.machines."canopus".settings.destinations = {
             alex = {
               repo = "ssh://borg@10.0.10.225:2222/backup/canopus/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/canopus/borgbackup/borgbackup.ssh";
             };
           };
           roles.client.machines."deneb".settings.destinations = {
             alex = {
               repo = "ssh://borg@10.0.10.225:2222/backup/deneb/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/deneb/borgbackup/borgbackup.ssh";
             };
           };
           roles.client.machines."alasia".settings.destinations = {
             alex = {
               repo = "ssh://borg@10.0.10.225:2222/backup/alasia/backup";
-              rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
+              rsh = "ssh -i /run/secrets/vars/per-machine/alasia/borgbackup/borgbackup.ssh";
             };
           };
         };
@@ -310,10 +310,17 @@
             "200:c8db:ea9b:5bdc:44ed:ad87:462a:6bd0"
           ];
           roles.default.settings.extraPeers = [
-            "tls://ygg.jjolly.dev:3443"
-            "tls://[2602:fc24:18:7a42::1]:993"
+            "tls://133.18.201.69:54232"
+            "tls://153.120.42.137:54232"
+            "tcp://yg-sin.magicum.net:23901"
+            "tls://asia.deinfra.org:15015"
+            "tls://ygg5.mk16.de:1338?key=0000009611ae5391dc0aceea9f3fa6a0dc1279f4306059339e84bfb8b74d2f9b"
             "tcp://leo.node.3dt.net:9002"
             "tcp://ygg-kcmo.incognet.io:8883"
+            "tls://23.184.48.86:1443"
+            "tls://192.3.13.16:8118"
+            "tls://ygg-pa.incognet.io:8884"
+            "tls://mo.us.ygg.triplebit.org:993"
           ];
         };
 

inventory.json

@@ -43,7 +43,7 @@
       "installedAt": 1775458442
     },
     "alasia": {
-      "installedAt": 1778661666
+      "installedAt": 1793077313
     },
     "bosona": {
       "installedAt": 1779098893

machines/alasia/facter.json

@@ -25,7 +25,10 @@
       {
         "index": 8,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -73,7 +76,10 @@
       {
         "index": 9,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -125,7 +131,10 @@
       {
         "index": 10,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -173,7 +182,10 @@
       {
         "index": 11,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -229,7 +241,10 @@
       {
         "index": 12,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -282,14 +297,21 @@
         },
         "driver": "piix4_smbus",
         "driver_module": "i2c_piix4",
-        "drivers": ["piix4_smbus"],
-        "driver_modules": ["i2c_piix4"],
+        "drivers": [
+          "piix4_smbus"
+        ],
+        "driver_modules": [
+          "i2c_piix4"
+        ],
         "module_alias": "pci:v00008086d00007113sv00001AF4sd00001100bc06sc80i00"
       },
       {
         "index": 17,
         "attached_to": 0,
-        "class_list": ["pci", "bridge"],
+        "class_list": [
+          "pci",
+          "bridge"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -337,9 +359,13 @@
     ],
     "cdrom": [
       {
-        "index": 22,
+        "index": 23,
         "attached_to": 15,
-        "class_list": ["cdrom", "scsi", "block_device"],
+        "class_list": [
+          "cdrom",
+          "scsi",
+          "block_device"
+        ],
         "bus_type": {
           "hex": "0084",
           "name": "SCSI",
@@ -396,8 +422,14 @@
         "unix_device_name2": "/dev/sg1",
         "driver": "ata_piix",
         "driver_module": "ata_piix",
-        "drivers": ["ata_piix", "sr"],
-        "driver_modules": ["ata_piix", "sr_mod"]
+        "drivers": [
+          "ata_piix",
+          "sr"
+        ],
+        "driver_modules": [
+          "ata_piix",
+          "sr_mod"
+        ]
       }
     ],
     "cpu": [
@@ -464,7 +496,9 @@
           "spectre_v2_user",
           "its"
         ],
-        "power_management": [""],
+        "power_management": [
+          ""
+        ],
         "bogo": 4224,
         "cache": 16384,
         "page_size": 4096,
@@ -475,7 +509,7 @@
         "fpu_exception": false,
         "cpuid_level": 13,
         "write_protect": false,
-        "tlb_size": 32764,
+        "tlb_size": 32766,
         "clflush_size": 64,
         "cache_alignment": 128,
         "address_sizes": {
@@ -546,7 +580,9 @@
           "spectre_v2_user",
           "its"
         ],
-        "power_management": [""],
+        "power_management": [
+          ""
+        ],
         "bogo": 4224,
         "cache": 16384,
         "page_size": 4096,
@@ -557,7 +593,7 @@
         "fpu_exception": false,
         "cpuid_level": 13,
         "write_protect": false,
-        "tlb_size": 32764,
+        "tlb_size": 32766,
         "clflush_size": 64,
         "cache_alignment": 128,
         "address_sizes": {
@@ -568,16 +604,20 @@
     ],
     "disk": [
       {
-        "index": 23,
-        "attached_to": 19,
-        "class_list": ["disk", "scsi", "block_device"],
+        "index": 22,
+        "attached_to": 20,
+        "class_list": [
+          "disk",
+          "scsi",
+          "block_device"
+        ],
         "bus_type": {
           "hex": "0084",
           "name": "SCSI",
           "value": 132
         },
         "slot": {
-          "bus": 1,
+          "bus": 3,
           "number": 0
         },
         "base_class": {
@@ -606,20 +646,20 @@
           "value": 0
         },
         "model": "QEMU HARDDISK",
-        "sysfs_id": "/class/block/sda",
-        "sysfs_bus_id": "1:0:0:0",
-        "sysfs_device_link": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio2/host1/target1:0:0/1:0:0:0",
+        "sysfs_id": "/class/block/sdb",
+        "sysfs_bus_id": "3:0:0:0",
+        "sysfs_device_link": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio3/host3/target3:0:0/3:0:0:0",
         "unix_device_names": [
           "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0",
           "/dev/disk/by-path/pci-0000:01:01.0-scsi-0:0:0:0",
-          "/dev/sda"
+          "/dev/sdb"
         ],
-        "unix_device_name2": "/dev/sg0",
+        "unix_device_name2": "/dev/sg2",
         "rom_id": "0x80",
         "resources": [
           {
             "type": "disk_geo",
-            "cylinders": 8354,
+            "cylinders": 9399,
             "heads": 255,
             "sectors": 63,
             "size": "0x0",
@@ -628,21 +668,30 @@
           {
             "type": "size",
             "unit": "sectors",
-            "value_1": 134217728,
+            "value_1": 150994944,
             "value_2": 512
           }
         ],
         "driver": "virtio_scsi",
         "driver_module": "virtio_scsi",
-        "drivers": ["sd", "virtio_scsi"],
-        "driver_modules": ["sd_mod", "virtio_scsi"]
+        "drivers": [
+          "sd",
+          "virtio_scsi"
+        ],
+        "driver_modules": [
+          "sd_mod",
+          "virtio_scsi"
+        ]
       }
     ],
     "graphics_card": [
       {
         "index": 16,
         "attached_to": 0,
-        "class_list": ["graphics_card", "pci"],
+        "class_list": [
+          "graphics_card",
+          "pci"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -699,8 +748,12 @@
         },
         "driver": "bochs-drm",
         "driver_module": "bochs",
-        "drivers": ["bochs-drm"],
-        "driver_modules": ["bochs"],
+        "drivers": [
+          "bochs-drm"
+        ],
+        "driver_modules": [
+          "bochs"
+        ],
         "module_alias": "pci:v00001234d00001111sv00001AF4sd00001100bc03sc00i00"
       }
     ],
@@ -708,7 +761,10 @@
       {
         "index": 24,
         "attached_to": 7,
-        "class_list": ["usb", "hub"],
+        "class_list": [
+          "usb",
+          "hub"
+        ],
         "bus_type": {
           "hex": "0086",
           "name": "USB",
@@ -781,8 +837,12 @@
         "hotplug": "usb",
         "driver": "hub",
         "driver_module": "usbcore",
-        "drivers": ["hub"],
-        "driver_modules": ["usbcore"],
+        "drivers": [
+          "hub"
+        ],
+        "driver_modules": [
+          "usbcore"
+        ],
         "module_alias": "usb:v1D6Bp0001d0618dc09dsc00dp00ic09isc00ip00in00"
       }
     ],
@@ -790,7 +850,9 @@
       {
         "index": 5,
         "attached_to": 0,
-        "class_list": ["memory"],
+        "class_list": [
+          "memory"
+        ],
         "base_class": {
           "hex": "0101",
           "name": "Internally Used Class",
@@ -814,7 +876,9 @@
       {
         "index": 21,
         "attached_to": 16,
-        "class_list": ["monitor"],
+        "class_list": [
+          "monitor"
+        ],
         "base_class": {
           "hex": "0100",
           "name": "Monitor",
@@ -960,7 +1024,10 @@
       {
         "index": 25,
         "attached_to": 24,
-        "class_list": ["mouse", "usb"],
+        "class_list": [
+          "mouse",
+          "usb"
+        ],
         "bus_type": {
           "hex": "0086",
           "name": "USB",
@@ -996,7 +1063,9 @@
         "model": "QEMU USB Tablet",
         "sysfs_id": "/devices/pci0000:00/0000:00:01.2/usb1/1-1/1-1:1.0",
         "sysfs_bus_id": "1-1:1.0",
-        "unix_device_names": ["/dev/input/mice"],
+        "unix_device_names": [
+          "/dev/input/mice"
+        ],
         "unix_device_name2": "/dev/input/mouse0",
         "resources": [
           {
@@ -1037,11 +1106,18 @@
         "hotplug": "usb",
         "driver": "usbhid",
         "driver_module": "usbhid",
-        "drivers": ["usbhid"],
-        "driver_modules": ["usbhid"],
+        "drivers": [
+          "usbhid"
+        ],
+        "driver_modules": [
+          "usbhid"
+        ],
         "driver_info": {
           "type": "mouse",
-          "db_entry_0": ["explorerps/2", "exps2"],
+          "db_entry_0": [
+            "explorerps/2",
+            "exps2"
+          ],
           "xf86": "explorerps/2",
           "gpm": "exps2",
           "buttons": -1,
@@ -1054,7 +1130,9 @@
       {
         "index": 18,
         "attached_to": 13,
-        "class_list": ["network_controller"],
+        "class_list": [
+          "network_controller"
+        ],
         "bus_type": {
           "hex": "008f",
           "name": "Virtio",
@@ -1079,7 +1157,9 @@
         "model": "Virtio Ethernet Card 0",
         "sysfs_id": "/devices/pci0000:00/0000:00:12.0/virtio1",
         "sysfs_bus_id": "virtio1",
-        "unix_device_names": ["ens18"],
+        "unix_device_names": [
+          "ens18"
+        ],
         "resources": [
           {
             "type": "hwaddr",
@@ -1092,8 +1172,12 @@
         ],
         "driver": "virtio_net",
         "driver_module": "virtio_net",
-        "drivers": ["virtio_net"],
-        "driver_modules": ["virtio_net"],
+        "drivers": [
+          "virtio_net"
+        ],
+        "driver_modules": [
+          "virtio_net"
+        ],
         "module_alias": "virtio:d00000001v00001AF4"
       }
     ],
@@ -1101,7 +1185,9 @@
       {
         "index": 26,
         "attached_to": 18,
-        "class_list": ["network_interface"],
+        "class_list": [
+          "network_interface"
+        ],
         "base_class": {
           "hex": "0107",
           "name": "Network Interface",
@@ -1115,7 +1201,9 @@
         "model": "Ethernet network interface",
         "sysfs_id": "/class/net/ens18",
         "sysfs_device_link": "/devices/pci0000:00/0000:00:12.0/virtio1",
-        "unix_device_names": ["ens18"],
+        "unix_device_names": [
+          "ens18"
+        ],
         "resources": [
           {
             "type": "hwaddr",
@@ -1128,13 +1216,19 @@
         ],
         "driver": "virtio_net",
         "driver_module": "virtio_net",
-        "drivers": ["virtio_net"],
-        "driver_modules": ["virtio_net"]
+        "drivers": [
+          "virtio_net"
+        ],
+        "driver_modules": [
+          "virtio_net"
+        ]
       },
       {
         "index": 27,
         "attached_to": 0,
-        "class_list": ["network_interface"],
+        "class_list": [
+          "network_interface"
+        ],
         "base_class": {
           "hex": "0107",
           "name": "Network Interface",
@@ -1147,14 +1241,19 @@
         },
         "model": "Loopback network interface",
         "sysfs_id": "/class/net/lo",
-        "unix_device_names": ["lo"]
+        "unix_device_names": [
+          "lo"
+        ]
       }
     ],
     "pci": [
       {
         "index": 13,
         "attached_to": 0,
-        "class_list": ["pci", "unknown"],
+        "class_list": [
+          "pci",
+          "unknown"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1211,14 +1310,21 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
         "module_alias": "pci:v00001AF4d00001000sv00001AF4sd00000001bc02sc00i00"
       },
       {
         "index": 14,
         "attached_to": 0,
-        "class_list": ["pci", "unknown"],
+        "class_list": [
+          "pci",
+          "unknown"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1274,8 +1380,12 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
         "module_alias": "pci:v00001AF4d00001002sv00001AF4sd00000005bc00scFFi00"
       }
     ],
@@ -1283,7 +1393,10 @@
       {
         "index": 6,
         "attached_to": 17,
-        "class_list": ["storage_controller", "pci"],
+        "class_list": [
+          "storage_controller",
+          "pci"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1325,7 +1438,7 @@
         "resources": [
           {
             "type": "io",
-            "base": 49152,
+            "base": 49216,
             "range": 64,
             "enabled": true,
             "access": "read_write"
@@ -1340,14 +1453,21 @@
         },
         "driver": "virtio-pci",
         "driver_module": "virtio_pci",
-        "drivers": ["virtio-pci"],
-        "driver_modules": ["virtio_pci"],
+        "drivers": [
+          "virtio-pci"
+        ],
+        "driver_modules": [
+          "virtio_pci"
+        ],
         "module_alias": "pci:v00001AF4d00001004sv00001AF4sd00000008bc01sc00i00"
       },
       {
         "index": 15,
         "attached_to": 0,
-        "class_list": ["storage_controller", "pci"],
+        "class_list": [
+          "storage_controller",
+          "pci"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1437,8 +1557,12 @@
         },
         "driver": "ata_piix",
         "driver_module": "ata_piix",
-        "drivers": ["ata_piix"],
-        "driver_modules": ["ata_piix"],
+        "drivers": [
+          "ata_piix"
+        ],
+        "driver_modules": [
+          "ata_piix"
+        ],
         "module_alias": "pci:v00008086d00007010sv00001AF4sd00001100bc01sc01i80"
       }
     ],
@@ -1448,33 +1572,10 @@
     "unknown": [
       {
         "index": 19,
-        "attached_to": 6,
-        "class_list": ["unknown"],
-        "base_class": {
-          "hex": "0000",
-          "name": "Unclassified device",
-          "value": 0
-        },
-        "sub_class": {
-          "hex": "0000",
-          "name": "Unclassified device",
-          "value": 0
-        },
-        "vendor": "Virtio",
-        "device": "",
-        "model": "Virtio Unclassified device",
-        "sysfs_id": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio2",
-        "sysfs_bus_id": "virtio2",
-        "driver": "virtio_scsi",
-        "driver_module": "virtio_scsi",
-        "drivers": ["virtio_scsi"],
-        "driver_modules": ["virtio_scsi"],
-        "module_alias": "virtio:d00000008v00001AF4"
-      },
-      {
-        "index": 20,
         "attached_to": 14,
-        "class_list": ["unknown"],
+        "class_list": [
+          "unknown"
+        ],
         "base_class": {
           "hex": "0000",
           "name": "Unclassified device",
@@ -1492,16 +1593,54 @@
         "sysfs_bus_id": "virtio0",
         "driver": "virtio_balloon",
         "driver_module": "virtio_balloon",
-        "drivers": ["virtio_balloon"],
-        "driver_modules": ["virtio_balloon"],
+        "drivers": [
+          "virtio_balloon"
+        ],
+        "driver_modules": [
+          "virtio_balloon"
+        ],
         "module_alias": "virtio:d00000005v00001AF4"
+      },
+      {
+        "index": 20,
+        "attached_to": 6,
+        "class_list": [
+          "unknown"
+        ],
+        "base_class": {
+          "hex": "0000",
+          "name": "Unclassified device",
+          "value": 0
+        },
+        "sub_class": {
+          "hex": "0000",
+          "name": "Unclassified device",
+          "value": 0
+        },
+        "vendor": "Virtio",
+        "device": "",
+        "model": "Virtio Unclassified device",
+        "sysfs_id": "/devices/pci0000:00/0000:00:05.0/0000:01:01.0/virtio3",
+        "sysfs_bus_id": "virtio3",
+        "driver": "virtio_scsi",
+        "driver_module": "virtio_scsi",
+        "drivers": [
+          "virtio_scsi"
+        ],
+        "driver_modules": [
+          "virtio_scsi"
+        ],
+        "module_alias": "virtio:d00000008v00001AF4"
       }
     ],
     "usb_controller": [
       {
         "index": 7,
         "attached_to": 0,
-        "class_list": ["usb_controller", "pci"],
+        "class_list": [
+          "usb_controller",
+          "pci"
+        ],
         "bus_type": {
           "hex": "0004",
           "name": "PCI",
@@ -1568,15 +1707,25 @@
         },
         "driver": "uhci_hcd",
         "driver_module": "uhci_hcd",
-        "drivers": ["uhci_hcd"],
-        "driver_modules": ["uhci_hcd"],
+        "drivers": [
+          "uhci_hcd"
+        ],
+        "driver_modules": [
+          "uhci_hcd"
+        ],
         "driver_info": {
           "type": "module",
-          "db_entry_0": ["uhci-hcd"],
+          "db_entry_0": [
+            "uhci-hcd"
+          ],
           "active": true,
           "modprobe": true,
-          "names": ["uhci-hcd"],
-          "module_args": [""],
+          "names": [
+            "uhci-hcd"
+          ],
+          "module_args": [
+            ""
+          ],
           "conf": ""
         },
         "module_alias": "pci:v00008086d00007020sv00001AF4sd00001100bc0Csc03i00"
@@ -1682,7 +1831,9 @@
           "name": "RAM",
           "value": 7
         },
-        "memory_type_details": ["Other"],
+        "memory_type_details": [
+          "Other"
+        ],
         "speed": 0
       }
     ],

machines/bosona/configuration.nix

@@ -17,6 +17,8 @@ in
     inputs.self.overlays.frappixLibsOverlay
     inputs.self.overlays.frappixPythonOverlay
     inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
   ];
 
   clan.core.vars.generators.frappix = {

machines/canopus/configuration.nix

@@ -17,6 +17,8 @@ in
     inputs.self.overlays.frappixLibsOverlay
     inputs.self.overlays.frappixPythonOverlay
     inputs.self.overlays.frappixToolsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
   ];
 
   clan.core.vars.generators.frappix = {

machines/deneb/configuration.nix

@@ -26,6 +26,8 @@ in
     inputs.self.overlays.frappixPythonOverlay
     inputs.self.overlays.frappixToolsOverlay
     inputs.self.overlays.frappixAppsOverlay
+    inputs.self.overlays.posthogPr578265Overlay # TEMPORARY, see overlays/nixpkgs-pr-578265-posthog.nix
+    inputs.self.overlays.frappixFixupsOverlay
   ];
 
   fonts.packages = [ pkgs.tlwg ];

machines/hadar/configuration.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  domain = "poy-inventory.newedge.house";
+  domain = "w-inventory.newedge.house";
 in
 {
   clan.core.settings.machine.description = "VM machine that host Inventree system for Poy";
@@ -79,6 +79,7 @@ in
     secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
     adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
     settings.INVENTREE_SITE_URL = "https://${domain}";
+    settings.INVENTREE_FRONTEND_SETTINGS = ''{"mobile_mode": "allow-ignore"}'';
   };
 
   system.stateVersion = "25.11";

machines/ramus/think-greater-chiangmai.nix

@@ -54,7 +54,9 @@ in
     self.nixosModules.think-gtcm
     self.nixosModules.think-backend-gtcm
   ];
-  nixpkgs.overlays = [ self.overlays.packagesOverlay ];
+  nixpkgs.overlays = [
+    self.overlays.packagesOverlay
+  ];
 
   clan.core.vars.generators.greaterchiangmai = {
     files = {

machines/stellio/configuration.nix

@@ -10,16 +10,6 @@
     inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
   ];
 
-  # matthew-hardware's common/generic-uefi-image.nix still sets
-  # `image.repart.enable = true`; nixpkgs removed that option (importing
-  # image/repart.nix now always defines system.build.image). Declare it so the
-  # definition has somewhere to land. Drop once upstream stops setting it.
-  options.image.repart.enable = lib.mkOption {
-    type = lib.types.bool;
-    default = true;
-    internal = true;
-  };
-
   config = {
     hardware.mt7986a-glinet-gl-mt6000.enable = true;
     hardware.mt7986a-glinet-gl-mt6000.zealous = true;
@@ -83,6 +73,108 @@
       '')
     ];
 
+    # The router service opens SSH only to the mgmt VLAN, the staging port
+    # and the ZeroTier mesh (inventories/router.nix). Also admit it over
+    # Yggdrasil (fleet-wide instance in inventories/default.nix) so the box
+    # stays reachable when ZeroTier's controller/relays are down. Scoped to
+    # the tunnel interface (clan-core's yggdrasil service names it `ygg`):
+    # only decrypted 200::/7 traffic arrives there, so a spoofed source on
+    # the WAN never matches.
+    networking.firewall.interfaces.${config.services.yggdrasil.settings.IfName}.allowedTCPPorts = [
+      22
+    ];
+
+    # AIS delegates a single /64 over PPPoE (seen 2026-10-02: "ppp0: DHCP:
+    # received delegated prefix 2405:9800:b910:1f5d::/64"). The router
+    # service hands out sub-prefixes with SubnetId=auto, so whichever VLAN
+    # interface comes up first takes the whole /64 -- on this box vlan-mgmt
+    # did, and vlan-lan logged "Couldn't find a suitable prefix. Ran out of
+    # address space": no RA prefix on lan, so clients had no global IPv6.
+    # Pin the ids: lan (where the clients are) always gets subnet 0, i.e.
+    # the entire prefix when it is a /64; mgmt asks for subnet 1, which
+    # fails harmlessly on a /64 (mgmt is reached over v4 and the meshes) and
+    # starts working unchanged if AIS ever delegates wider. Drop once
+    # cnx-network's router service exposes a per-VLAN subnet id.
+    systemd.network.networks."40-vlan-lan".dhcpPrefixDelegationConfig.SubnetId = lib.mkForce "0x0";
+    systemd.network.networks."40-vlan-mgmt".dhcpPrefixDelegationConfig.SubnetId = lib.mkForce "0x1";
+
+    # Interim copy of cnx-network-clan 45643d6 (router/ipv6: deprecate
+    # withdrawn DHCPv6-PD prefixes); drop when the input is bumped past it.
+    # networkd never deprecates a prefix it stops announcing (systemd#29651):
+    # on every reboot the first PPPoE session lands on another AIS BNG, is
+    # torn down minutes later, and the reconnect brings a different /64.
+    # networkd announces the new prefix at once but clients keep the old
+    # one preferred for the rest of its 1800 s lifetime, so RFC 6724 source
+    # selection picks the dead prefix and every v6 connection fails for up
+    # to 30 minutes (2026-10-08 07:57). Watch vlan-* for networkd removing a
+    # dynamic (PD) address and send up to three RAs with that /64 at
+    # preferred lifetime 0, one short-lived radvd per RA (SIGKILLed: no
+    # shutdown RA with router lifetime 0), stopping as soon as the prefix is
+    # back on the interface -- a plain flap re-delegates the same /64 within
+    # seconds and a deprecating RA sent after networkd re-announced it would
+    # leave clients deprecated until the next periodic RA (08:19 today).
+    systemd.services.router-radv-deprecate = {
+      description = "Deprecate withdrawn DHCPv6-PD prefixes on the VLANs";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "systemd-networkd.service" ];
+      path = [
+        pkgs.iproute2
+        pkgs.ipcalc
+        pkgs.radvd
+      ];
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = 2;
+        RuntimeDirectory = "router-radv-deprecate";
+      };
+      script = ''
+        conf=$RUNTIME_DIRECTORY/radvd.conf
+        pid=$RUNTIME_DIRECTORY/radvd.pid
+
+        # /64s of the global addresses currently on an interface.
+        prefixes_on() {
+          ip -o -6 addr show dev "$1" scope global | while read -r _ _ _ a _; do
+            echo "$(ipcalc --no-decorate -n "$a")/''${a##*/}"
+          done
+        }
+
+        # "Deleted 4: vlan-lan    inet6 2001:db8::1/64 scope global dynamic mngtmpaddr \ valid_lft ..."
+        ip -o -6 monitor address | while read -r event _ dev _ addr _ scope rest; do
+          [[ $event == Deleted && $dev == vlan-* && $scope == global && $rest == *dynamic* ]] || continue
+          prefix="$(ipcalc --no-decorate -n "$addr")/''${addr##*/}"
+          cat > "$conf" <<EOF
+        interface $dev {
+          AdvSendAdvert on;
+          MinRtrAdvInterval 3;
+          MaxRtrAdvInterval 4;
+          AdvDefaultLifetime 1800;
+          AdvCurHopLimit 0;
+          prefix $prefix {
+            AdvOnLink on;
+            AdvAutonomous on;
+            AdvPreferredLifetime 0;
+            AdvValidLifetime 7200;
+          };
+        };
+        EOF
+          for _ in 1 2 3; do
+            if prefixes_on "$dev" | grep -qxF "$prefix"; then
+              echo "$dev: $prefix is back, leaving it announced"
+              break
+            fi
+            echo "$dev: deprecating withdrawn prefix $prefix"
+            rm -f "$pid"
+            # radvd sends its first RA on start; the next would follow 3-4 s later.
+            radvd -C "$conf" -p "$pid" -n -m stderr &
+            sleep 1
+            kill -KILL $! 2>/dev/null || true
+            wait $! || true
+            sleep 2
+          done
+        done
+      '';
+    };
+
     systemd.services.heartbeat-push = {
       description = "Heartbeat push to uptime monitor";
       serviceConfig = {

machines/tangra/configuration.nix

@@ -1,3 +1,4 @@
+{ ... }:
 {
   system.stateVersion = "25.11";
   nixpkgs.hostPlatform = {

machines/vega/services/samba.nix

@@ -82,8 +82,11 @@ in
   };
 
   services.avahi = {
-    publish.enable = true;
-    publish.userServices = true;
+    settings.publish = {
+      disable-publishing = false;
+      disable-user-service-publishing = false;
+      publish-addresses = true;
+    };
     # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
     nssmdns4 = true;
     # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it

modules/clan/home-profiles/home-user/emmie.nix

@@ -80,15 +80,12 @@
                 ...
               }:
               let
-                dictionaries =
-                  with pkgs;
-                  (hunspellWithDicts (
-                    with hunspellDicts;
-                    [
+                dictionaries = pkgs.hunspell.withDicts (
+                  d: with d; [
                     en-us-large
                     th-th
                   ]
-                  ));
+                );
               in
               {
                 imports = [ inputs.plasma-manager.homeModules.plasma-manager ];
@@ -111,7 +108,6 @@
                     keepassxc
                     vlc
                     thunderbird
-                    wasabiwallet
                     protonmail-desktop
                   ];
                 };
@@ -119,6 +115,8 @@
 
                 programs.firefox = {
                   enable = true;
+                  # Keep the pre-26.05 profile location; moving it would orphan the existing profile.
+                  configPath = ".mozilla/firefox";
                 };
 
                 programs.home-manager.enable = true;

modules/clan/nextcloud/default.nix

@@ -42,10 +42,27 @@
             dbhost = lib.mkDefault "/run/postgresql";
             dbuser = lib.mkDefault "nextcloud";
             dbname = lib.mkDefault "nextcloud";
-            adminuser = lib.mkDefault "admin";
-            adminpassFile = lib.mkDefault config.clan.core.vars.generators.nextcloud.files.adminpassFile.path;
+          };
         };
 
+        # nixpkgs installs Nextcloud with --disable-admin-user; create the
+        # admin account ourselves once the instance is installed.
+        systemd.services.nextcloud-admin-user = {
+          wantedBy = [ "multi-user.target" ];
+          after = [ "nextcloud-setup.service" ];
+          requires = [ "nextcloud-setup.service" ];
+          before = [ "phpfpm-nextcloud.service" ];
+          path = [ config.services.nextcloud.occ ];
+          serviceConfig = {
+            Type = "oneshot";
+            User = "nextcloud";
+          };
+          script = ''
+            if ! nextcloud-occ user:info admin >/dev/null 2>&1; then
+              NC_PASS="$(<${config.clan.core.vars.generators.nextcloud.files.adminpassFile.path})" \
+                nextcloud-occ user:add admin --password-from-env --group admin
+            fi
+          '';
         };
 
         clan.core.state.nextcloud.folders = [

modules/clan/nextcloud/tests/vm/default.nix

@@ -31,7 +31,7 @@
 
     server.wait_for_unit("phpfpm-nextcloud.service")
 
-    # Check that garage is running
-    server.succeed("systemctl status phpfpm-nextcloud.service")
+    # Admin account exists and is in the admin group
+    server.succeed("nextcloud-occ user:info admin --output=json | grep -q '\"groups\":\\[\"admin\"\\]'")
   '';
 }

modules/clan/phonebox/default.nix

@@ -224,7 +224,7 @@
                 throw "clanService/yggdrasil is required";
           in
           {
-            clan.core.vars.generators.phonebox = builtins.break {
+            clan.core.vars.generators.phonebox = {
               files = {
                 server-prefix-number.secret = false;
                 ata-local-number.secret = false;
@@ -330,6 +330,7 @@
               in
               {
                 "${matchAll}".allowedTCPPorts = [ 80 ];
+                "ygg".allowedTCPPorts = [ 80 ];
               };
 
             services.asterisk = {
@@ -403,7 +404,7 @@
                     in
                     ''
                       [from-internal]
-                      exten => 999,1,Answer()
+                      exten => 99,1,Answer()
                       same  =>     n,Playback(hello-world)
                       same  =>     n,Hangup()
 

modules/clan/prometheus/README.md

@@ -0,0 +1,8 @@
+# Prometheus
+
+Monitoring over the Yggdrasil network. Requires the `yggdrasil` clan service on every machine in the instance.
+
+Roles:
+
+- `server`: runs Prometheus and Alertmanager, scraping every `nodes` machine by its Yggdrasil address. Optional `matrix-alertmanager` forwards alerts to Matrix rooms; the bot token and webhook secret are generated as clan vars.
+- `nodes`: enables the `services.prometheus.exporters` listed in `exporters` (with `openFirewall`) so the server can harvest them.

modules/clan/prometheus/default.nix

@@ -256,6 +256,21 @@
                 ];
               };
 
+              # nixpkgs runs alertmanager with DynamicUser; that user only exists
+              # while the service runs, so sops-install-secrets cannot resolve the
+              # owner of matrix-alertmanager-urlfile at boot and rejects the whole
+              # manifest (no secrets installed). Use a static user instead.
+              users.users.alertmanager = {
+                isSystemUser = true;
+                group = "alertmanager";
+              };
+              users.groups.alertmanager = { };
+              systemd.services.alertmanager.serviceConfig = {
+                DynamicUser = lib.mkForce false;
+                User = "alertmanager";
+                Group = "alertmanager";
+              };
+
               services.matrix-alertmanager = lib.mkIf settings.matrix-alertmanager.enable {
                 enable = true;
                 tokenFile = config.clan.core.vars.generators.prometheus.files.matrix-alertmanager-token.path;

modules/clan/samba/default.nix

@@ -239,8 +239,11 @@
             };
 
             services.avahi = {
-              publish.enable = true;
-              publish.userServices = true;
+              settings.publish = {
+                disable-publishing = false;
+                disable-user-service-publishing = false;
+                publish-addresses = true;
+              };
               # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
               nssmdns4 = true;
               # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it

overlays/default.nix

@@ -2,11 +2,15 @@
 {
   flake.overlays = {
     packagesOverlay = import ../pkgs/overlay.nix;
+    # TEMPORARY: drop with the file once NixOS/nixpkgs#578265 reaches nixos-unstable.
+    posthogPr578265Overlay = import ./nixpkgs-pr-578265-posthog.nix;
 
     frappixFrappeOverlay = inputs.frappix.frappeOverlay.x86_64-linux;
     frappixLibsOverlay = inputs.frappix.libsOverlay.x86_64-linux;
     frappixPythonOverlay = inputs.frappix.pythonOverlay.x86_64-linux;
     frappixToolsOverlay = inputs.frappix.toolsOverlay.x86_64-linux;
     frappixAppsOverlay = import ../pkgs/frappix/overlay.nix;
+    # Must be applied after frappixPythonOverlay (overrides packages from it).
+    frappixFixupsOverlay = import ./frappix-fixups.nix;
   };
 }

overlays/frappix-fixups.nix

@@ -0,0 +1,34 @@
+# Fixups for frappix's python overlay on current nixos-unstable. Everything
+# here belongs upstream in kurogeek/frappix; drop entries as they land.
+# Must be applied after frappixPythonOverlay.
+_final: prev:
+let
+  inherit (prev) lib;
+in
+{
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyFinal: pyPrev: {
+      # frappe >= v15.120 needs sqlparse 0.6 (db_query.py touches
+      # sqlparse.engine.grouping.MAX_GROUPING_TOKENS), but every sql_metadata
+      # 2.x release pins sqlparse<0.6; the sqlglot-based 3.x needs sqlglot >= 30,
+      # which nixpkgs does not ship yet. Relaxing the pin is safe for frappe: its
+      # two call sites (desk/reportview.py, core/doctype/recorder/db_optimizer.py)
+      # only parse SELECT statements, and the only sql_metadata test regressions
+      # on sqlparse 0.6 are `CREATE TABLE IF NOT EXISTS` name extraction (2/150).
+      sql_metadata =
+        if lib.versionAtLeast pyPrev.sql_metadata.version "3" then
+          lib.warn "frappix ships sql_metadata ${pyPrev.sql_metadata.version} (no sqlparse dependency): drop the sql_metadata entry from overlays/frappix-fixups.nix" pyPrev.sql_metadata
+        else
+          pyPrev.sql_metadata.overridePythonAttrs (old: {
+            pythonRelaxDeps = (old.pythonRelaxDeps or [ ]) ++ [ "sqlparse" ];
+          });
+
+      # rq 1.16.2 (frappix's rq_1 pin): test_parse_connection compares redis
+      # connection kwargs against a literal; redis-py 8.1 (current nixpkgs) adds
+      # `himport_registry`, so the assertion fails. Test-only.
+      rq_1 = pyPrev.rq_1.overridePythonAttrs (old: {
+        disabledTests = old.disabledTests ++ [ "test_parse_connection" ];
+      });
+    })
+  ];
+}

overlays/nixpkgs-pr-578265-posthog.nix

@@ -0,0 +1,33 @@
+# TEMPORARY workaround for NixOS/nixpkgs#578265 (python3Packages.posthog: unbreak).
+# nixpkgs#575004 bumped mcp 1.29 -> 2.2 and marked posthog broken; the only
+# failure is one test in posthog's optional MCP integration (field rename in
+# mcp 2). posthog is a runtime dependency of frappe, so frappix machines fail
+# to evaluate without this.
+#
+# Remove once `nix flake update` pulls the PR in: delete this file and every
+# reference to it (grep 578265). The overlay becomes a no-op and warns at eval
+# time as soon as the locked nixpkgs no longer marks posthog broken.
+_final: prev:
+let
+  inherit (prev) lib;
+in
+{
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyFinal: pyPrev: {
+      posthog =
+        if !pyPrev.posthog.meta.broken then
+          lib.warn "nixpkgs no longer marks posthog broken: NixOS/nixpkgs#578265 has landed, remove overlays/nixpkgs-pr-578265-posthog.nix" pyPrev.posthog
+        else
+          pyPrev.posthog.overridePythonAttrs (old: {
+            disabledTests = old.disabledTests ++ [
+              # AttributeError: 'CallToolResult' object has no attribute 'structuredContent'
+              # (mcp>=2 renamed the field to `structured_content`)
+              "test_prepare_tool_result_delivers_into_call_tool_result_models"
+            ];
+            meta = old.meta // {
+              broken = false;
+            };
+          });
+    })
+  ];
+}

pkgs/frappix/default-thai-company.nix

@@ -11,8 +11,8 @@ let
     domain = "git.b4l.co.th";
     owner = "newedge";
     repo = "default_thai_company";
-    rev = "68f08171252099920d52f5c47800d65ddf4689b3";
-    sha256 = "sha256-9UomP8G5K+nkAMCfn+gXbBNivLlDo0c/36FYZgHm2Cw=";
+    rev = "c8fb98374989a22d0c907aa44877f247391a49ac";
+    sha256 = "sha256-c+pqds4l3Laldgf3+Rj2Ug693kFJYDB1j4a15j4U5SY=";
   };
 in
 buildPythonPackage (finalAttrs: {

pkgs/gtcm-file-uploader.nix

@@ -7,18 +7,17 @@
 let
   repoSrc = fetchgit {
     url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "6f8c8d7dfaf5a0c1eb2077de1d6fb35ceaf3d4ec";
-    hash = "sha256-2mCdn8xGjWZrANclctGTmxQhkNc43VzlzMTVwVIFJcM=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
   };
   src = "${repoSrc}/upload-large-file";
 in
 buildNpmPackage {
   pname = "gtcm-file-uploader";
-  version = "1.0.0";
+  version = "1.1.6";
 
   nativeBuildInputs = with pkgs; [
     nodejs
-    breakpointHook
   ];
 
   inherit src;

pkgs/overlay.nix

@@ -1,5 +1,5 @@
 final: prev: {
-  think-gtcm = final.callPackage ./think-gtcm.nix { };
+  think-gtcm = final.callPackage ./think-gtcm.nix { php = final.php83; };
   think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
   gtcm-file-uploader = final.callPackage ./gtcm-file-uploader.nix { };
 }

pkgs/think-backend-gtcm.nix

@@ -6,14 +6,14 @@
 let
   repoSrc = fetchgit {
     url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
-    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
   };
   src = "${repoSrc}/think-backend.greaterchiangmai.com";
 in
 php.buildComposerProject2 (finalAttrs: {
   pname = "think-backend-gtcm";
-  version = "1.0.0";
+  version = "1.1.6";
 
   inherit src;
 
@@ -32,5 +32,5 @@ php.buildComposerProject2 (finalAttrs: {
   '';
 
   composerStrictValidation = false;
-  vendorHash = "sha256-wGfbprSDULBje1s5y3+ZiU/nCwYGDEULobZzyzGZ9bQ=";
+  vendorHash = "sha256-FaAwFzLXfMAiUv9eZLtFI0QurkNLh4fsTYrvGv1rAlo=";
 })

pkgs/think-gtcm.nix

@@ -6,14 +6,14 @@
 let
   repoSrc = fetchgit {
     url = "https://git.b4l.co.th/newedge/think-greaterchiangmai";
-    rev = "7c17aa78436538241c09fc7d633904d3c063011e";
-    hash = "sha256-GDx0+PmuCXC+UPtsvsocCZQiTPcnOZEzJI17sxrVv7Q=";
+    rev = "deadb17b255b0733a2c552ae3638ecde0b9ee7d6";
+    hash = "sha256-xXq3yZjlp0ULzlSkBnc5SIRxwXZQQoIXgy0rztgFGHg=";
   };
   src = "${repoSrc}/think.greaterchiangmai.com";
 in
 php.buildComposerProject2 (finalAttrs: {
   pname = "think-gtcm";
-  version = "1.0.0";
+  version = "1.1.6";
 
   inherit src;
 
@@ -32,5 +32,5 @@ php.buildComposerProject2 (finalAttrs: {
   '';
 
   composerStrictValidation = false;
-  vendorHash = "sha256-b8+AKUmjQiOdV8UC9GYfJzAHFs9+FRSH91YsxKt0rDA=";
+  vendorHash = "sha256-7M0nn3u8ERVFF6WiNjYByNdkFwHZz1vfoClybdOtIJ8=";
 })

shell.nix

@@ -4,12 +4,14 @@
     inputs.devshell.flakeModule
   ];
   perSystem =
-    { system, ... }:
+    { pkgs, system, ... }:
     {
       devshells.default = {
         devshell = {
           packages = [
-            inputs.clan-core.packages.${system}.clan-cli
+            # clan-core pins `nixVersions.nix_2_31` for a CI perf A/B test;
+            # nixos-unstable has dropped that attribute. Use nixpkgs' default nix.
+            (inputs.clan-core.packages.${system}.clan-cli.override { nix = pkgs.nix; })
           ];
         };
       };

vars/shared/zerotier-identity-adhil/identity-secret/groups/admins

@@ -0,0 +1 @@
+../../../../../sops/groups/admins

vars/shared/zerotier-identity-adhil/identity-secret/machines/adhil

@@ -0,0 +1 @@
+../../../../../sops/machines/adhil

vars/shared/zerotier-identity-adhil/identity-secret/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:HT4hSTyFNaZlSVG5wjxFE6xULu+Cf+hmMi+GJ+YWXJrvNw5bYHaEguJ3Sbq7u+BAYLG/uPVpu/H83VXG9IY6jRKWsClXNmzqimZMSIo6KiIcNW6+czCkk1UTUsTGVi8bQRBiIOGMtMp+RYn3sJ0AxlZx3GrtRq4a/XAlvCrHsw7yxYT0Cs6qJxtXbM2iMUbcfr/lfolDrqjNmhkS5TulY4LzKIeDD6VHkCYOlkIW/m+x6wSquEX6RnPGEuvcvBXte6EvUi692qxjNPRrSMu4tRmVUSr55CY63QsNsEzo1cRsU8+jIGIarN9uxFMQaVBGXQAQNnZgFN3IUrs/sgWYIgCdFIk7Xa8WPra14OxO,iv:PxJrjt1dpL6iHALcvYaqkBybcSvCK9qMEZE3MWjixBQ=,tag:mL//WdhB8SVXp/M3Jxb0HQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTWViMC9uVHl4QitxZXV4\nWFFtV253NTBBSnJjazJ0UXd1Z3kzaTYvN3hZCnNyRjZaOU02TU5hbUxSVGdlQmlD\ndVZnUDVFSFMzTGg4Q2FIMG5XZHAvNFEKLS0tIHRUMURnYlhFS3RBaXVXaEVyQ21S\nMElwbTBUOVR1dTV2a2ZHVWV4czQwUWMKgQmIfaVSTRr9yytEgEiTQVp4jCREXLQ7\nlOfBUK02hqN26rkVEVu4YcCttx9/nH7Dwc+wc/nxXXDWYLIcwpdMLA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWYmt1ZElyUjJsclJlZXBY\nWXlXNWVpMUZPZmczaWs2SWFLdzkyT09neEc0CnplRlZ5VS9ZZk5ZODNoNy8yVUtm\ncnQ3RHVtRGVNYk1xSFg1dFRta2pBZTQKLS0tIFBqZ3hwWTJnYkhpZVZUTElIcmto\nc1A1NHdnSFRzRkdGQ3JLYVg2UzF5SzQK4bCCxZRiMSXTkUNOJeuCUcGwz0xoYr7s\nkNVMHSm74UOZG9BowimHiTb9n280ViCaGhZfvKIWkQLRdsYGiUxH5g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1dytdeqtct0jy3vvmqvapgqjf3v9p486jjcpx60gfxwgrptgyyqrs0lj9vc"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHZBRlhQWGwv\nQkVLendPcXExRzBXaG9ieDJycWRXMXhOWDN0K2RWSFoyVFkgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpXUVE4eGJxUTFNYTZSejNoS2tJK1Nw\nUUkzUm44T2l2RjFXTEpaM2w0MkdFCi0tLSA3UElXSlVmZ21nZHUwYUlPU09yZkpi\nc2VSaXo4eVBKOFZ2L3lpVDNxMytZCi5Uz/e8luflh7aUmsDRIo6SIUnvRslFwLzw\nbb1zehkiEHPOdlsccqLNy3jWHT5j26O1/wJgnyUNF+EHlH0SdrU=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHNMTm44d1Rh\naGZPM29DOSs2THkxeEoxUUZ1WkxyMUFiMmFWUEZXZm1KU3MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpObkliM0s3aUI4UnI1Y1J0TEtRQjh4\nWDlBd3pjNlZGSklVTHNUYnRFV1RZCi0tLSAwT2N4ejBLUjlOSU03QmlMRmF2aG5v\nYy81VzB6b0UzTCtBbmNSUFM4UWZZCggMWJpWYEWTe4Am4el4VtIwagRb3uu0qWky\nsdh9OJ9uVoRtUKWdLFKfT4o5eWTj9zP0C/mMuSjpelwo2iRcQ1s=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIHVJMmhGZC85\nT1NQdXBHNXQydFRoclNQUURRVnJjYmlSR3pXTXhWNTVFUmsgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpNS2FlMEdxNjAyZE1hQVZVVUtPL1Jl\nTE5CTXh6TTNKNlI5Q3BtZ01OdnJrCi0tLSBwVERvMnhEYWdwcjE1WFQ2dldqTW5r\ndTVOdzI4TWsrYUdOQ2laOUk4cUVFCi3++2i2ULNWHy6EbUAIVfQo3be4srgMuzMR\nlUWlzlsHmZksrvdpfdWM72i5Hj7hvgIZAyVroPijEc8PXyORm2s=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCUHpuc2JjcjFucVpjc0lq\nN1BHclRzV1IzanZrcmdoMFp5UEJ0WGo4MUdZClBOczBCNTZzRitCdmJwZ0RnOE5w\nS2t6aGNhaGJUbXdjYUJNUS83c1FsRGsKLS0tIEEybm9Sc21HOFZLWHNhRml1ZFZF\ndjdiZVo5OElHdVg1L2FnK3NrQzROMXMKHfKVsiisagg77l81ycyfHarJhRaaypOO\nsKbgOWXr33j7D+O9pPXUNlPgofsZTJC10MHUlnTebv74NZUnOIK89g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5VVp2eXlSd0l3Y2ZJejBq\nMDhEZGRMOUZxTTBLbG1CUDVZTkR0SzEvdVVzCk5BYk5kVENVNE5yMXNmSXQvaFlu\nbFlHZ0s3cExPOVhUUTFWdm56U21JcmcKLS0tIHlySmJjMzJwN3lFamZkSS9SbnZ6\nWkhRM1ZBNmsxcjI3UDEyYS8wZ3p4TzQKTqU63FMjj3HywYeENZpVdzthhlOAhf7M\naQ33Cb+EQasD9Osb5gF/ZKjDvhLTe0LemV8CVG2eb6DwyLpDgOYcIA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCckJ4bjFkUzY4RFRxMHln\nU0NLUWg5YlJ1cXJEbnN1TW93bmNJMjB4emhrCnZCR242ak43V0wwZE5zeHE5dmpv\nSW8zc2lQZWV0QUpxZnJvVFhXK0xFNE0KLS0tIFVxS0pFNFJDRFVIT01lS3ZCQm02\ndllQV3FtYjJHcmJuWVZSR3MzQmVTQzQKfA/QgdtihvvYWU0WBefz+w5PhPjR31BF\nzTcv4Ynd1tQRy4mDWcPVgcyJP4nN8GabfkBAA0+pjI2jcXIl0sWaRA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1ak1objdQYVdUeWl6RWNW\nSTVsZlFnblIvRnJNVmRMdTJDeVd2NGlKZWpRCjZ6ZjJQQi81OHY4bTNqUCtiaWV2\nSUwwOEpRNEQ4MWY2cDdwS0Q1OFBUaEEKLS0tIFF4WVlUbDdFNncyNXR6V28xbmpj\nVEkveXIweEcwWi9BdW9rSEZuakN3djgKmiHdiJypk0r+EWWHgSmw7+Yd1f59m3Ul\n6rIcw9j7Cjy/9HUGkfqzZJIVf+TSBpCh4BOY6Wwnyi2h2CvKvaNQRw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-10-09T07:44:42Z",
+		"mac": "ENC[AES256_GCM,data:h/fejv7NsOKoVkb1Jz0LejcSof5j6NlIfpTjfirhnmaw3rO2aa1G5/ZRUsNNcEfxqcahzm7Y/ucs+nSoA8uyJa73pE98sctrUPLis2VfBHy8EY4UQq/3MS62VLDY9tCH8VSvA0+/IKtjCsFyeEMS5nzYwME6A2clvh6XQq2cpE4=,iv:oKI4v1SuH/9pUghbGiVP0+bG8adNmFB/groeuXfGe2E=,tag:YhTfSeZ/vSFFRI7h4+5S/g==,type:str]",
+		"version": "3.13.3"
+	}
+}

vars/shared/zerotier-identity-adhil/identity-secret/users/kurogeek

@@ -0,0 +1 @@
+../../../../../sops/users/kurogeek

vars/shared/zerotier-identity-almach/identity-secret/groups/admins

@@ -0,0 +1 @@
+../../../../../sops/groups/admins

vars/shared/zerotier-identity-almach/identity-secret/machines/almach

@@ -0,0 +1 @@
+../../../../../sops/machines/almach

vars/shared/zerotier-identity-almach/identity-secret/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:C0rXbTr/YQ3db7PHAUNQC3lvn8MFlsMnkEMd342f4v9R6e5h0BomePsqhgd2UNjO7P1DWxTwDVhjWsCiVct0JgjwbAEbVTDcJHKEIPLs4+oDj5ZACZSUr4vp17ZkaaZOdIN3Ywy8bnV/pCr9F8xZ6caLCBvNSR+g40xjlpNyJdcUaGdQYo4tmUlnMT84cmpubF2lNUTHSLhYzunKvO49NCWlS1CNalcZjW39whhfTqPiTMp7J7r37yXgjLX2cHdL6mFatrs/Xxwj82hahb5a3QJvgXJ6+UZrurirrGX7Q8rfiGKNUd6IWyyVL+0To/kTPGzkQ4Kz+gW4WMugKO4vwqA+mwL3BbHdLhIakgFI,iv:pS3syLhM0N33YJPJ3MoQHspjV+717qSRgZYllq1Z0is=,tag:6CAaJ4aF5Dv5vQOSr2qpQQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1VDdJMXR4RTk4MVVSOTdt\nL1ozb09JRzdvckM3dTdCRFRMamZHNHpBT1FvCm5ucG10bi9rODdOaXBIMlhvV1NK\nVWpUdWgyTzNpRWx1UUZ2bHdjVTRGNDAKLS0tIHFrTVdOQVRDUTM2bk9RSndISlJy\nVWNoaFh0UmErOHFlemtjZ25ETXdyVm8KN6AdmVGo/HPUYmSdJkTrtuMPNluU9X2h\nEfXvT8rjxZTd4SwD3r4AktVIRhXq/0bwsPNTbW2ZpbdJ/CJ/pT5S/g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEM2SHFKSUNx\nKzBMK0dmZ21iWlFwMWNxcFNzVitJRW50Z3E3OTUrUHJYUzAgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQp0OXRybUdwVHBxWHFWUWtodnZpQkJ5\nK25sNDAybTM2Sk5JOVJTY0NGb1hZCi0tLSBhY1lkTkR1aWVkUGM4bnhZRFIzRy9Q\naSs2SlBvYmVUK3ZZbURKdUtjTk1vCqIroKG03zORXYfC8ySosSUKJFLtOW3YvZxq\njvGOi7gdJ18bBcbq5DxWZMremfYoWeplWegYIt4agXmaGIq8nXE=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFNjaDhaZFBo\nTUQwb2NIbFo1eVZIcTFqWXN5L0VwZEcrVU02UXVjSHlYVncgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpsTGh6NmljQzNtOXhjZm9Nb2VMTnhW\ncU5KOWNKNE10TmcwMVk4bjlwQzlvCi0tLSBsdVhIREtyZk5qdkg5a2Z3N0RURVR3\nbU9ualB3ems0RUNRMGM0c3dGcmN3Cnqneq/mJFWsJMLrZD2yUGd0gBqliC8OK8iV\nC1JKHR9iZ4vIrdPDhC3S0AoIQ/iIYNUs9F36NoXnWzFYHJnDtQE=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGk3WlY0cFA2\nVy9nZzBpemVOSjAvV0FRVGhEaVJWK0NIdWt1UjYyY0dCaVUgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6alF6dVZzVHJRQ2VsNkoyYUY1RTUr\nMm9yZ1R4VWZCUUVMTEZpZXZTNXVvCi0tLSA4NW5mN1RFSXkxOXpMb0xzWUVxUlRF\nTkFJVElNM0lySWpOc2dOT2NNelpRCuQeukSZN4c9n90QpSyzZv1pA4yr9svAcdA3\nGAyBu4LV9Fd2cO9j3rN9iLF2qUR2toAhIGlJBnIyGHtVTiH+++o=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBemdVa0hwTUxHSVFpN21r\ncFBJSzdtcHFOa3YwdC9PQzFkT1FvdnY2UHpvCkZybUZCWHgvMU5SUVlBOTA2ZnBw\nR1VVSU1aL05PR093TlY2TitWelF3em8KLS0tIDVTOFBoYitSallBVGlucTh1TXBC\nV3JnWUVXQkNzWEV2WCsreWhjeFRvOW8KKL+d+uJyGTmUaxvL6QlSbCPPLfcMgqEr\nufojmvBYhLsm7m6a1QUTxtdMuZKN5Wd4VdhIFE3JI5YaUzdTZY2EHA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVcUE5VFp1WTR5TTV3SEFr\nUnE1YVpVRjFMQzJsR0phNzF6MWFGeTh3aUZFCmZwOVNYSTN1aVRLQm9PWlhEWnFG\nSSs1TVVicnNWRURHZUU3Zjl6WG11MjAKLS0tIEpVWXRHaXVDYzlIOW1MSk9qajdr\nZlR5Y2pvaXNJTGdQeG5sZDFrU01odDAKEx1zKdU6x6uNbpyxLAGSNYxaaj+Pgj+7\nBYU4PSeN1PPqp7el13lfHscUHUG4i5OWRY4VBWF39DGgp4kSXawyJg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1m2e4c3gv7mxyg839gf0lfsh8wvygx3rn8u5cwnn99vw2w43ssers40tlq8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0RTZyOENUUmI1UUJEdVlQ\nS0xEMnd4a1dHZ00zcUp1U3VzK0xvdGJsVEJ3CnFTMXF3Wkd2cWdPVDYxNGdZUVph\nVVRJaitjUzY3VUo0ekw5dG5kL2hRaDAKLS0tIHpWOVRhZy92ZXpTWFlnTGNiSUti\nL3d6dE9TeW9reVBJMnNwMnNrelZxSXcKOPfEEv1c2k6bHZJ+i5v7XKZJxhfkJgg3\nsfgiG0jKKuzERCZTBXNUFzEWH3zw96LAcrLT6iAdZSfrDOYQw5O8yw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySlRBdTRobjBKVTBiTmhD\nZXM5ais0ZUE4QjlQTlA1RU5ObUtna1owS1hjCksrNW9LMzJKUkptUDAxZ1h6ZGFi\naysrelFHZ3pCbUd2d0xhZlZOV3V3V0EKLS0tIE1LVXdMTHlpcWxaTm9WeW9EcEFu\nbi93TVVzdll1aThzbDFPd3dqNnlOZEkKmnmiOvMvdxrxrxORf5Xqu9zZ0zLQIiSI\nLPI2oLaka0XHHe9ntHoINAT7MgZMSO6whELRYlIOjSY4BOTPYUN4eg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBINkxtem5NTTV2QUoyYUxZ\nTTNYK0JQS3pQbzcySkFGRmtyMXlnVFRwaDJvCk5PK1VRQ05WTDBUakxYNUtia3Bv\nUUgvSW1PZVhyZWhXVEcvWnZqMkZUOE0KLS0tIFRpNkpzQXJOTit4enB6d2FIc051\nL216WWNESU45U1Ziam1TZVUrUGJ2N2MKpuZHpZHGQZzQlsdFiuw5siIReOGe2zdw\n2uMl25AvnWsWtoydEYzDPSbz9AIifUZy3TpzNZ6MzlL670pfANlEiQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-10-09T07:44:42Z",
+		"mac": "ENC[AES256_GCM,data:EdR/UIwCVTxWBUAAzTBWVPqjA4wZG2YYV5WtsGzvfC+X3noypuKKkqGRhOwYeTvurc9riNByQbXwob5TqLcx8FmnGaaEY3/1SuOom5eJo4kIDdd41ETyqsGyHNwCpY8EpafmnTQjed35t8B9xyQUtasF8m6O7vj7shK/HBKAfwU=,iv:N5/YgfoMLDJyYzxFse842I5mITThzu884yOIZdDFPOc=,tag:IVjldPzHM1nLoMk1wxYiIg==,type:str]",
+		"version": "3.13.3"
+	}
+}

vars/shared/zerotier-identity-almach/identity-secret/users/kurogeek

@@ -0,0 +1 @@
+../../../../../sops/users/kurogeek

vars/shared/zerotier-identity-alpheratz/identity-secret/groups/admins

@@ -0,0 +1 @@
+../../../../../sops/groups/admins

vars/shared/zerotier-identity-alpheratz/identity-secret/machines/alpheratz

@@ -0,0 +1 @@
+../../../../../sops/machines/alpheratz

vars/shared/zerotier-identity-alpheratz/identity-secret/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:1/BI/yaoHAnKCvXeUMtuFi074H8iKqbhRF0nW4Bxw7mqruHGghvBOWdh8oS4EeC5voruKmJHXUpjunuQIPC4yZn8FVZ6y0SA+No1R2zAGSfIcmEeB9MbN0Bq1xIbK3Meii8ocYfEKtZVTcp5MiRTbGxXWZJkQHQkCDEoZ2FQrJkqRmLpHogZpuB7De/8auj/HniRPSwvNO+qPxUqjdmuVyTc8h41Wsjqbfj3nQKZaMKLHVfOYVStYyTFhxcvAAY4+k2I9rCJM1gpvwJ3ASwYguOWNYGoMO0QAY7HlvAqt/34mw9HoAuj/9dKX+wRvjEcHFPGMhWilUreXc/nFkNhamuQj3jBzFwlOZ5gUrc+,iv:hSPk3gZMEzhO/TTwnh+JJsDLrCuo0ezF1Ou92nByuX0=,tag:6GmCP2Rj6g8Q+1/jXatlGw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBldkRFcStkREx0OExjWFYy\ndEIzdnRQNnZjdWRHQlVmOTlsVXdnMjl2VVVFClVTSmtocWk0ZjJZWmZkTzBKb1lI\nVnRYeXV2VTI0OFdFZEgxT1BITkVVbVUKLS0tIENZVzVoejVFckkySzFBdVRHQm1u\nWnJnV0VOTWc4dWNKakNwT1NPdnp2b0kKQELeL2FOqprZ0ioGIEXet/v7/xHL5+LJ\nFZu3TNAfTgq4GfnZ81IJpm+0W6emiYQIojtmZjI1J1sgNQk9rlR10w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17c9908f08w2w0ajprep4p60a7hd27cznrnxmq4mxwznvgzjuhymsxttd3d"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNT21ibHg1alUyZnVseGJK\nMTRaS2o3b2FwUjhQRHgvL0thTUluV0xzM1NFCjhvTTBOcVZDZ2tMbExTZ0ZYSnhj\nMUZRQ2lWbjZJNHhkcjYrZ1dsUjNTbEEKLS0tIHFBMFFqM2h6Mm9zQitTZk50bDh0\nZzFPUS9jMzArWjV0T3Rja1hYeHJ5SUEK9fWE8AfIiLOktOz/T5iXsgOMbIdzDavP\n3ecNfrWt5Pkwq5U1WZJgB4m8OCxOxmlalcpSoyuQnhnaeKwDtrpcNQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEdlc0lRQ1hV\ncjRyQXRZdnhnWlU1SFNQYmdoUWlwaWIxZ0FSdTI3YjZMaG8gQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpVb0gyS0ptS2JmVDlpZ3VPUlNLYkNX\nWkZrR2VydnNYUjVPcnBCTmtVRFZJCi0tLSBQcmsrMHBMZXdvWUg2R1NvbnVCbHFq\ndG5MMTlnTG1wMW1PdE8rWXdKeTVjCnRsPfPMojLJ69iYUls41EMcpyj8/+GF0Jhl\nsooxmxvuwGhOPXuWTewFsEji1yfye6rsgNLA9Cd0RCpvyIJw0P0=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEVUU1lSaytR\nR3EzbUdrSG5LMndoTjFYNnlIVVgvNU5na3JSekxOQllRSHcgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpxT1lnNGZyZFg2QUxWM000VEoxUEVy\nNjBMcFFoeHVaQThKc3IzRVhuV3pnCi0tLSByckIxTUZVQWtnalByTHBuaXN1NDN6\nZG1PcUhNUTYzL1JBbW9KOVVRZEo0CgQg8XcyqPKDCVKwl0Dl2etfAv92GdKDRYM+\nAWO6BLNlf77kNpdOlUPW4UHkbm/RLm44db6nbJnxhORn5ywql1Y=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGZLTnFMUnJC\nZEFsdVp0aTNxSVJ2OEE0U202ajNzTGFSUTN3bkZTMlZHeGcgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpLZDhXb3pJdVRUd3oxSnJ6dWF0WnJH\nRS9aN1pvZllLM1oyM3pRanczcWF3Ci0tLSA2aEhIQTgyS0N6T1pmNFo0M081bGJu\nUEkraTh4YVBnOE1SN3BacUR6RTVBCunmdr+N4+GF4pggFEnR+8Pjo8sid/O0j+EH\nwA/jT3rreM3G/IIZhiXPtlg9IRQAsops1AWpmRtXpg+m3ra5O7I=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYN3hvS2FTS1FKaUVLdjk2\nN2E0RDBoZGx2djVTYkxOU2JQNmoyaE9XeHdBCkJmc1pzSU9iOXFTZW53ZFNSSktS\nUDFaQlJjZVhIOEh3TkxEYk9GVU5peHMKLS0tIDd3N2lia1B5WnZJQUhpTytDcENK\nQlQ5eW1rLzFKZndWVmZaYmJqdnRhQzgKqNW6DT439xoXARintD8N+baALXqH+Fg/\nmBw2wxY8vXsdhVHnl1JQ7c5xKhsXZrPnuOokoSq1drjgoZaTIrvo8A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UFhpWmRSTXkxM0RnL2t4\nMWRkVWhQSFFIRU1IK3BRMmpLYVhic1M0Nm5vClZJb2dicGFnVFFZdGlnQlZkNUtp\nMlRLcEk3eHJNZVZOU0ZPbldpbGNxRG8KLS0tIEVCSXA3dldodEl3Z2hHUTg0OEEr\nSEtsMTVxT0t2VG16S0JZcWNSZGZPYlkKGHVe915N+bgdXGjrLiOeTCGFv/tHPdUZ\n2hRQW0aPFwAq9S2ydJ12h47LfhhBPYpntDG2JRaoNHlcx87na39Fnw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOL2VWNWV6Tm56eTNIZk1M\nTlVMdWtjb2R4cGM0eHo3S1FLeDFqdFNEYlc4CnY1TmUrSENGdGtCUzJ0OW5oOWxq\nQWU5alZKNC9OOVNZeUJ6N2xnK3RXc28KLS0tIEpaRVQ2Wm1hV0dxUFRFVS82akNy\nL2ZIUm9pTWpaaEU1QlMvMEZMY1pVVlkKhT2ETLPMpHqe3tflE4H9jxH4fesR1TgF\ndHk4i0bCkWRJZCTDYKPmGMkHRvanUIf7u0lP6rm/4qdA36g50fTleQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjWkZOdmQ4T29zQVZnZUlZ\nbklXN0dvZ1BRcTA2dXFINEhIbmZJdU5TWjFjCndXWHFyL2J0Tmt1YnJIdTVCWitF\nZFZ2QUgvWUUxV1UwWXJsQURnbkQ3TkEKLS0tIE5YQ2tzOVVjVDZzRnl0dCt2bGtF\nUXdaajNuUnBxS2pQUzJEbWgxOGlNZ3cKCau1pvPuaIDDDnWvwGTFWU8ozLlCHfFN\ngp2lGxlGU8jI4yjfTT83+W15QXwbQsSWssr3ex7zkRKg0hKabQHzvA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-10-09T07:44:43Z",
+		"mac": "ENC[AES256_GCM,data:5gW6xx0tNOh9i6v6+etYYCfWmQ7ISW1BppRUX58Mq+Ulhz0wfYyRTiiHZqiDzUYUl0lCk20VLaGPynAIwIda672bmK5OvGJC/9HuBuJoKRpSpRgJ4uF3pKS4C5DBMKkSXEl3efzCZQ2xrwISNBFQnXPzWBX4Fo5nYZOtMTTwRbw=,iv:/H54jQ7cto6RfAxNYs4CXjcdZ2Oguzn64NhDY+8dRjE=,tag:+p4fQf3cqdoyqDJnpw9vTw==,type:str]",
+		"version": "3.13.3"
+	}
+}

vars/shared/zerotier-identity-alpheratz/identity-secret/users/kurogeek

@@ -0,0 +1 @@
+../../../../../sops/users/kurogeek

vars/shared/zerotier-identity-buna/identity-secret/groups/admins

@@ -0,0 +1 @@
+../../../../../sops/groups/admins

vars/shared/zerotier-identity-buna/identity-secret/machines/buna

@@ -0,0 +1 @@
+../../../../../sops/machines/buna

vars/shared/zerotier-identity-buna/identity-secret/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:QaeDS07zlZznnp51cjGu8RhinPA0QEQcKv6qcfLh5xtivdttkScAp9tX4D8eepXQ97YsB1JJdPpp6gq+iW8HXyem+tYrkuoVvWKUzydAhvepyRi7cgyBV9YqI5OY3LnMSIpaDrcibKvV8qyQCD92HXeDS35ufE+0AOhy0TeO7AEZ2uXEc3BoJRvQW9lrApWMrfPe+6QltizCUX4xZk8DHdmNu+KsOogiUO8KGx5DCjyGYOugAgMGHbd/ZtkwOWgyGMzSMMRlrOdumpGJacIVH+Clb1EOtpK1URzJy1RgeqqP8cKEvRailR5VXyZviEpUGecUfu1T7LicBkVn9b8+EGHM3lH4A+lahRJm8JYt,iv:Lw1B9JrVC0bs/ZqILYjJlSk6zIyI3VyPvTWSDV9SDmo=,tag:dJnaYhLRdQE4UJ9tbItjGw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6M3JhMDMxT0FLcVMyN2l3\neU9PTFM2ZnJISHJ6T1NLM0d4a1NRT3NWNHowCkRhZlBmS2xRWnNxSFlEb1BmR3NV\nN0FmMWtsVWp3NzhvQmZSZWYyb1FXTGMKLS0tIENzaGt1VjJKOTN3TFExYlhrK2hn\nUVhGZW96SDFzK3FkaFdVNTArQXVLK1kK/eijw2CfYeUDP0mN6gK3cVlasrKMDf9Q\npJAE7j7qJBY12+KCaH0U7GeU4qe0rQW5gQvZAp/Rjau3OAyBmJtuPw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEF5UndoV1hm\nUVNNeHFuWjZHRVNzaGlGeXpyalN5KzZURDNvcnRyZHgxU0kgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpZWmwzME1lNUNzelFGU1FUNFZzSldP\nRmtuU1l0a0x1MUFXbzU3MmVkU2pFCi0tLSBRY1BUQ25qa2ZqcXhYREQ0L1A5VUV3\naWhDaGpNMFU2eUdWSmpJT3dNbWQwCsdznbkReqYz+oeevciXSl8aAJd+dMXIGJMj\nyJj8yIwIo7S/EP1eamg46UYwJdEdZzvKXHCNp+NwHGMUSNMiwew=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEwvcEp2Z0pP\nL0VHekxtY2NIcVA3ZnFRc3hxTHhvVGQ3WHBzVDRRd0RLa2sgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpyZHdkSTcvNVd6MVQ4eGFsdEw0cGN6\nenNRNHptZU9xN2k2R0I0MmZLdXpJCi0tLSB2clVhcTAzQU1RQ2lBUHhzWUVLRDJn\nY0N5Q2ROd0dVWHVmcjE0YjZUWG5rCgLBnzsYiVYjAOVy3i+s+rJlBFAWQWAgn0/6\nNm+u4QgqGvDSc3USB81KyMIUDbiQB7ppcEooNc39TvsV5fECrX8=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFRmMG8wSkFa\neFd4VG5lYVFxcW9vditscU5SN1Z1QlU4SVlrU0k1VlB2MkEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp3TVJ0UXFwbnFNQXdFNDd4LzZDcUN0\nRzBmZUE1QllZVmJ2Q0Z3bWNqdGdvCi0tLSB5UG4zUVVuNXkxUkkxWWVmVCtWYTBQ\nazhUQnAwK0lBMWlhRXB5N1dPNEpzCgH+Dmfy9/Yd3DnaRHIA0pFo8wcZgGdQd8N0\n+pz2o1GnVSoC5kq0NxY+sFKEvVbL6wl7V6kIJ3fGclsSOQaXFvw=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxcG94d2NnVjV1eVY4UFFw\nTmhFZk05cDdvdDhOUnNtK01lZFR0c05Kb21vCjhMT09WR1EwZjRDOXdTaWN6VjJo\nelQzbzBuRzJyYVVKTDE4WVcwcGE0UzQKLS0tIHR3SW85aXFhd29RV0dvSUhtMkZM\nMTF5VjFIRVRKQUY5RmhyTklvOW1rZEUK62GxTlYLJOOjlYJl02uygjSt2yewjoMX\ntY4mw9av6gDRbnVDNkP3lLhDQA5tGE0KpTvcGcTOjkdzPIBb5pygqg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnTFU5MFhQMkd0UGhtWEIz\nMEZscktHSTN6aFJVR3grWjRMVk5qMGlaV1JnCm8zRDNLVGdrZExDQXVxODFJQ2pM\neFMwMUZJeWpkTllKL1JXTk9WQjJhSXcKLS0tIDhWUjZEMnhWblM5eTBsTjZVSFMw\nUFh4YmdOZWZmcTAwdEFUVnpqeUlvWDgKpyC3/jxXEiV5A5U1SLkgXuWkRZFFt2fe\nvKhmhBXqyD2PbqAvdmIRBbh3L89oqsgEFr2md9Kvo9piKSCtWVcwMA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1pgxgvwck2vr3va6c4c3utj7w2rfg2st9qvm76nc92vhfmplqmu4qs928lm"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUaWFEdGd1UmJ2R000dzJI\neUNwSVVYM2JYc0ZleUozS05uM2EvWnpqTGlRClBSQ2VQR3QrektXTWo4YjBuZDJj\nUW44UjNEeSthbWlxblUrY3VjYnVRdW8KLS0tIGZNdnVwRFdnbk1WcTcwSVV2VkZV\nMnRIVmd6ZzhQL2JYemgxTjd6RGFSY0EKGOT6w/7Kbn42afcyU9vWkIWW9vCHDzOi\nft+z61VK2z0P/VCq21dcBVW6q78CEg6v3eJEbhAdMQZvK11hLf1zYw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVzBkbEN1Uno4UE9uSXBF\nNHhMc2ZxbHBnSWNsMkRBQ1F6c3hYOVJOblNJCmFrNnkvRnlFdm0ra1NBejVtS21G\naVl0RzFKL1REanZJUWh0VmtTQjFGNWsKLS0tIFNDekloQ0ZqdHBMUEllZkNCTG1r\nY3MybWQzdjNVQXhuUFp3Q2dqWDIrZEkKopZMeSmWY1JAbQMw92F9UsLr+WP4k/Sf\naFFPr6p5MCfvISFXfi75XZK073ylg9jISSBIoMOr+49Q+QZH9qeP6w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwajBZTWI2Q2o0a2lkYTVt\nWHpSZzM0NExRUVlRUVpaR3pMdFhnaUdjM0g4CnFXck1zWmxYSzdOYVFPWUZLc1J0\nMmttU1kreklaQXBZMllWSk5TR2ZVdzgKLS0tIGVMTytxWmJ0WUFOc0xDU3puRTY0\nTlNXakxKenZJa0NUZ0hueXlKOGJIY1EKm0OCBDKnM4gSB6sh5DU98EXv2J+LxXyR\n4V213yMXE0QuTkXCJYeaTKyNT0BhlJ51TF8TUXfpiP7+W/py1ADMdA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-10-09T07:44:44Z",
+		"mac": "ENC[AES256_GCM,data:gykkTbBTzcHSl/p67q38V29VJjmlpWLzpcn2/wAtFf3n8S7m+Ma1xCGUbsVnd4mV2OMClXKjdaz5wN8rNhkfvQy8jnWDgdmTJN4Z3LawvmXhuzEOmViv4uIuTLqTnmfrc4BNGTgajvtwGIz9vDVmBvMFv15b7xFUY3wU5xuAdsQ=,iv:XACWsdOFU6rRPfu2eCsKI9Lbt1cqdgPEQLn1vKztOHo=,tag:eBM4wtrmZRiXx7/qgATA4g==,type:str]",
+		"version": "3.13.3"
+	}
+}

vars/shared/zerotier-identity-buna/identity-secret/users/kurogeek

@@ -0,0 +1 @@
+../../../../../sops/users/kurogeek

vars/shared/zerotier-identity-mirach/identity-secret/groups/admins

@@ -0,0 +1 @@
+../../../../../sops/groups/admins

vars/shared/zerotier-identity-mirach/identity-secret/machines/mirach

@@ -0,0 +1 @@
+../../../../../sops/machines/mirach

vars/shared/zerotier-identity-mirach/identity-secret/secret

@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:ICq7CQHrcO4kuOQ24kjl036JWx6dnS5YVNqU+eJeHi7QZ0WtI4XTSzVsdZ0slCGTwIrDY4knrPFvC6zoqtXVimQCE7qkvrr9GgNS4JdJgMmq+9tuA3f9nvf2Z7JDfGWU3Ht/gQvHlmu/tN9Wtg/buqpdk93lRXkBi95Fe6799ocFmus3vKfkFIddcq7V1wkfX774OaHLE3/ho+dMuQxUcgSuy29rQwHr7l+DXdJQ5gUXk/z/XAU30SVFOnSH92DjSDMLnrg9hkgPHgaFVNAgP3hG+C6S9WFBNuz2Z14jm/0ylTKjANyqLrX9wRi4SHFc8IDyFW4q8xqZy+Fm1LkYTehG4Re10F9wgh3q8vt4,iv:Bs9WJNERCDOQktKhdxZzAW1k/bzdvUTtyM1NU6/tThc=,tag:CD+oBGHCj+lNdEh9elL9sg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMdDBSNTZSQTVPVVlGNXI5\ncFpCVWJhSHIwczJKTUdZQTJQTE5RVE5XUERVCjFpdDdJeEVRM3k2YlNPaEk5dzBK\nNldvUUF3eE9kaEg2c0ZvNjl4Lys1dFkKLS0tIFpBam0xRjFkRnZjWEtWUHJZUmth\naEgxME0rUE5Ya25JZC9TdmEzRG9Tb2MKpLndT2smBLsxeKbCy310XMEM94NDUJI/\nLK9pn0IvPKndGETgUuOoPZNOvKNptEmk6DtmiwJx6M2gpNsQRogCQA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age15k6cz0lj207608gdlgxq6l2n5zsflvg0lw8qqlvkyk0xddc4kqvq9nh6ex"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBadjhaazA2TWJvVFVyUC9D\nSWVRRWFKbU5LRUpqeTBIWk80cFRQU1MvaUMwCmNPR0thUFRiR0R4OCtWRC9vbFdU\ncDZ3SU5iWC9BL2U5bEUvZFRnSWFzUVUKLS0tIEtha3Y5Z1VnRVVpS2EwbGxnNU11\nclhDTkdseWJXenFCaWhFejkvZ1QyaVUK4l+jug4AU3WKCasru29KrqOryUOoxXpL\naoigeE0yTDacBMdh8bMZK08HBzDgBW3q1WLi34xf0rR8FOk08JN3aw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGxsYTZOWVBz\nRnNMUDF1cDNwL0M0MTRuNlFNR01KaXJEN1FVTDNCeEM1MEUgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpQSzZicUQ1ZDJ6a0p4YzY4blBtbHRv\naHVBU3R4S0I2dVRhZnFyR0Q1azZnCi0tLSBnQno3V3lQcEJJVjVpRlBGbjNTRzM4\nQ1B5bVc1d0FVYVNyK2tjbDMrWEI0Cg+VtL8ZC39HU76T8ZyQH5k9AN2ouj31P0Id\nhmEfWMGp6ilC0Fm+fMkUoleSO4Us1bc7C+CjwJN88xucNEkcKqE=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIFpZTjJmWnN2\nVnI3UHArVXhkeWx0UkdLM1h4ZkdSdHdyRU8wZmVYNlE3M2MgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZworcmgrbnM2bXVzdmRETzV2Q2ZxT1l3\ndmF4TkJIdjNMS0FDY3lJZEJ3a1NRCi0tLSBpWXJOQjhGUW5jRzhrdzQ0eEVNcTJX\nVGJzVXNxYUg2ZWdjbjRRWm5ibUNJCvzc5NMCGROVcGH6uLBL1ArMuSku0J/8cy4e\nXrriQktXy2Exw14jBC7w6kirE8zqRm8rQK5HNHDCudSNwSG1lM4=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEZuRWpNaW1X\nRXYxUlVVY255bUtLUmdwclR0SENGZnFGbDAzWEp5anJCRTAgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwpqMXFNT2tRa2cxT1ZOUU1EVXFzb2ta\nM0NOS3lRTVdGY2kvL0VzTE1Oa2lzCi0tLSBXQ1d5L2dZV0RtRDd0b1pGdXYrZklY\ncmFPa3owZ05zZEo2UjZ0YlNZc0ZRCiQKbOn4DMdVy25AjJ7J+bqLmt3cPTeErtYu\nhSUSZ9TW50bFEopZHLIMHmqEnfp4ckInGva9BD3rUmdwdX5OpEg=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBud282MTN6UVpyM3V6OUE0\nV3cxWUU1UThibU83MFpiWGFiVWsxMmYvbkM4CmtoNFBWbWNGaVNkVnJEbUp1elZR\nTk9GL2NWVEw1OUIyaUR4WUh5aUh0YVEKLS0tIFF5b0I3UUkxNDN1c3NETzVPNjhz\nZlFnYm1URmE2U0NKUnJIcmwvWlk1cDgKyFm8sfGceuW3c1LQHJazv15Ghyz+af75\n3XxENPd8xXoRIa7i34xIFgXvU7hxqX517NtIXgJwHHboWfUueXPQUA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySUxYUnY5MDdsMzZwNFVv\nYWhxSU16S2hLcHpPM2dWWTB2ZnM0OXhLMjA0ClFnR1hyNWduM0hRWFhxVld4NWVS\nbnlDMlRPbVNBeUlFbUJka0JkMjQ3NVkKLS0tIE5kZDZGUWFGQXJoc0JRYUgwRjBx\nc2w1RWNGQXc1Smw5TnVGZXlBblcvZXcKDoGAcdVZ8andZq5pNGGfDQfyQ9LW2XOJ\n2mJhLWiYWKei6xEG7eJ+Yl+De4R+EtNN+alp2gJLCjsoiTVd87PVqA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdGRpMVp3N3E5K25VS2Zm\nbTFpQWtMcUN4bytIdDNRT3B0RTNDMzNlRlJNCitvek4vVmlmWFlOc1k4eE91QmJ0\nT3NIMmhyWkh5UGtaTmVqQjBibERqR2cKLS0tIHpwNFlGVzNvQkRxUnAwNlM5NS9B\nb2laYkhrTlBVQ3hOK3RaT0tJaFE4cEUKx3rB2z3XVbXv9PkQtAA7I5QneNi8Jjrp\nBApe2+PFEPKjLq75QYCYZRH6ah08CYx77dD0O561bNL6J6oZCD1YRw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBVGV0M09LU3ZZRkV5cVFz\nbTlxbC9hTlNKemJ0LzBDc1U2bnI4Smp1U2tnCmNORzd2SWQyZFFkS1ZDRlJHa2d4\nWGxIaHBlbEZMZ2R0NWdrbHhWMzZHUmMKLS0tIFJ5dnNOUG96TFZybDF1TGdoQ2dC\nbFo1WTVYNlVVeFo4ZndXSytncy95SkkKSGv8EJsVnDCzFpsnzB2bkMds8bW82OUw\nz6uBFRR7T9JbfSHKLYqQRJVSNlu3jleKK+wak+HfGaUPPU4n2K0Qwg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-10-09T07:44:44Z",
+		"mac": "ENC[AES256_GCM,data:eK0kYfRDJVVKQ1FK2nTfUl7/Pm3dRRwjvhih1LMncBw6xlF8xLy+/CckucqDFgf+5PSl8Mti1G0eKo4/WoISEtDjYmmuSHM++KsVpKtmk6g7ooco8maUYyh8t7siqYzhBvqVt3ftlrA4kJ5f+BQm41QTGDqk33E7JaNglGRgh+U=,iv:BzwqnsQL6vBVzbJel2TOUxTo7QiLq2ujBskrQ1LIO5I=,tag:pWwtZlcht5eSTjz/CrtM3w==,type:str]",
+		"version": "3.13.3"
+	}
+}

vars/shared/zerotier-identity-mirach/identity-secret/users/kurogeek

@@ -0,0 +1 @@
+../../../../../sops/users/kurogeek

vars/shared/zerotier-ip-adhil-b4l-network/ip/value

@@ -0,0 +1 @@
+fd6b:1ec3:3bf0:8d8e:ce99:936f:daf0:109b

vars/shared/zerotier-ip-almach-b4l-network/ip/value

@@ -0,0 +1 @@
+fd6b:1ec3:3bf0:8d8e:ce99:9313:20d:e30e

vars/shared/zerotier-ip-alpheratz-b4l-network/ip/value

@@ -0,0 +1 @@
+fd6b:1ec3:3bf0:8d8e:ce99:936a:93d7:d67e

vars/shared/zerotier-ip-mirach-b4l-network/ip/value

@@ -0,0 +1 @@
+fd6b:1ec3:3bf0:8d8e:ce99:9375:cdf4:e6de