Merge branch 'main' of gh:greg-hellings/nixos-config

flake.lock

@@ -4,14 +4,17 @@
       "inputs": {
         "darwin": "darwin",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixunstable"
+        ],
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1701216516,
-        "narHash": "sha256-jKSeJn+7hZ1dZdiH1L+NWUGT2i/BGomKAJ54B9kT06Q=",
+        "lastModified": 1707830867,
+        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "13ac9ac6d68b9a0896e3d43a082947233189e247",
+        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
         "type": "github"
       },
       "original": {
@@ -28,11 +31,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1673295039,
-        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
         "type": "github"
       },
       "original": {
@@ -66,11 +69,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -81,7 +84,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1694529238,
@@ -99,7 +102,7 @@
     },
     "flake-utils_2": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1705309234,
@@ -117,14 +120,14 @@
     },
     "flake-utils_3": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1689068808,
-        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
         "type": "github"
       },
       "original": {
@@ -135,7 +138,7 @@
     },
     "haumea": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
         "lastModified": 1685133229,
@@ -202,11 +205,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1682203081,
-        "narHash": "sha256-kRL4ejWDhi0zph/FpebFYhzqlOBrk0Pl3dzGEKSAlEw=",
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "32d3e39c491e2f91152c84f8ad8b003420eab0a1",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
         "type": "github"
       },
       "original": {
@@ -297,7 +300,7 @@
         "home-manager": "home-manager_2",
         "nix-flake-tests": "nix-flake-tests",
         "nixneovimplugins": "nixneovimplugins",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
         "nmd": "nmd",
         "nmt": "nmt"
       },
@@ -342,22 +345,6 @@
       }
     },
     "nixpkgs": {
-      "locked": {
-        "lastModified": 1677676435,
-        "narHash": "sha256-6FxdcmQr5JeZqsQvfinIMr0XcTyTuR7EXX0H3ANShpQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a08d6979dd7c82c4cef0dcc6ac45ab16051c1169",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
       "locked": {
         "lastModified": 1681001314,
         "narHash": "sha256-5sDnCLdrKZqxLPK4KA8+f4A3YKO/u6ElpMILvX0g72c=",
@@ -372,7 +359,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1705496572,
         "narHash": "sha256-rPIe9G5EBLXdBdn9ilGc0nq082lzQd0xGGe092R/5QE=",
@@ -390,11 +377,11 @@
     },
     "nixstable": {
       "locked": {
-        "lastModified": 1705641746,
-        "narHash": "sha256-D6c2aH8HQbWc7ZWSV0BUpFpd94ImFyCP8jFIsKQ4Slg=",
+        "lastModified": 1708831307,
+        "narHash": "sha256-0iL/DuGjiUeck1zEaL+aIe2WvA3/cVhp/SlmTcOZXH4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d2003f2223cbb8cd95134e4a0541beea215c1073",
+        "rev": "5bf1cadb72ab4e77cb0b700dab76bcdaf88f706b",
         "type": "github"
       },
       "original": {
@@ -406,11 +393,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1707092692,
-        "narHash": "sha256-ZbHsm+mGk/izkWtT4xwwqz38fdlwu7nUUKXTOmm4SyE=",
+        "lastModified": 1709961763,
+        "narHash": "sha256-6H95HGJHhEZtyYA3rIQpvamMKAGoa8Yh2rFV29QnuGw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "faf912b086576fd1a15fca610166c98d47bc667e",
+        "rev": "3030f185ba6a4bf4f18b87f345f104e6a6961f34",
         "type": "github"
       },
       "original": {
@@ -556,6 +543,21 @@
         "type": "github"
       }
     },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "wsl": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -565,11 +567,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1689163449,
-        "narHash": "sha256-C/cm0fRoNGx00lDOieW5439jpBH9VRWRJcAOXUFy+zs=",
+        "lastModified": 1709211223,
+        "narHash": "sha256-1cjd+yXbTlnCwNwEDjn289rJ2f0er5M8pOig4PxniEM=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "20a1f182aed3d2bbc72f62f5814fc3dd34a1cf0c",
+        "rev": "3257ad7f173b0314c8a42fec450fa6556495b97c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -5,7 +5,10 @@
 	description = "Greg's machines!";
 
 	inputs = {
-		agenix.url = "github:ryantm/agenix";
+		agenix = {
+			url = "github:ryantm/agenix";
+			inputs.nixpkgs.follows = "nixunstable";
+		};
 		darwin = {
 			url = "github:lnl7/nix-darwin/master";
 			inputs.nixpkgs.follows = "nixunstable";
@@ -65,6 +68,9 @@
 				unstable = self.nixosConfigurations.jude.config.system.build.toplevel;
 				stable   = self.nixosConfigurations.linode.config.system.build.toplevel;
 			};
+			aarch64-linux = {
+				unstable = self.nixosConfigurations.nixos.config.system.build.toplevel;
+			};
 		};
 
 		nixosConfigurations = (import ./hosts { inherit inputs overlays; });
@@ -94,7 +100,6 @@
 
 		overlays = {
 			default = local_overlay;
-			all = overlays;
 		};
 
 		modules = import ./modules;

home/gui/chat.nix

@@ -1,19 +0,0 @@
-{ pkgs, lib, ... }:
-
-let
-	darwinPkgs = [];
-	x86Pkgs = with pkgs; [
-		discord
-		element-desktop
-		slack
-	];
-	armPkgs = with pkgs; [
-		element-desktop
-	];
-in {
-	home.packages = ( if ( pkgs.stdenv.hostPlatform.isDarwin ) then darwinPkgs else
-		( if ( lib.hasPrefix "aarch64" pkgs.system ) then armPkgs else
-			( if ( lib.hasPrefix "x86_64" pkgs.system ) then x86Pkgs else [] )
-		)
-	);
-}

home/gui/default.nix

@@ -1,42 +0,0 @@
-{ pkgs, ... }:
-
-let
-	excludes = systems: opts: (
-		if ( builtins.all (x: pkgs.system != x) systems ) then opts else []
-	);
-
-in
-{
-	imports = [
-		./chat.nix
-		./firefox.nix
-	];
-
-	# These packages are Linux only
-	home.packages = with pkgs; ( excludes ["x86_64-darwin" "aarch64-darwin"]
-	[
-		cdrtools
-		vlc
-		x265
-	]) ++
-
-	# x86_64-linux only
-	( excludes ["x86_64-darwin" "aarch64-darwin" "aarch64-linux"]
-	[
-		bitwarden
-		endeavour
-		gnucash
-		jellyfin-media-player
-		libreoffice
-		#logseq
-		nextcloud-client
-	]) ++
-
-	# Items that are not supported on ARM/Linux
-	( excludes ["aarch64-linux"]
-	[
-		onlyoffice-bin
-		synology-drive-client
-		zoom-us
-	]);
-}

home/gui/firefox.nix

@@ -1,49 +0,0 @@
-{ lib, pkgs, ... }:
-
-let
-	# For now, we ignore this and don't install it
-	ffPkgs = if ( pkgs.stdenv.hostPlatform.isDarwin )
-		then pkgs.firefox-bin
-		else pkgs.firefox-wayland.override { cfg.enableGnomeExtensions = true; };
-
-	vars = {
-		MOZ_ENABLE_WAYLAND = "1";
-		XDG_CURRENT_DESKTOP = "sway";
-	};
-in with lib;
-{
-	programs.firefox = {
-		enable = (! pkgs.stdenv.hostPlatform.isDarwin);
-		package = ffPkgs;
-		profiles = {
-			default = {
-				settings = {
-					"app.update.auto" = false;
-					"browser.ctrlTab.sortByRecentlyUsed" = true;
-					"browser.startup.page" = 3;
-					"browser.startup.homepage" = "https://thehellings.com";
-					"doh-rollout.doorhanger-decision" = "UIDisabled";
-					"doh-rollout.doneFirstRun" = true;
-					"signon.rememberSignons" = false;
-				};
-				extensions = with pkgs.nur.repos.rycee.firefox-addons; [
-					bitwarden
-					bypass-paywalls-clean
-					gsconnect
-					foxyproxy-standard
-					multi-account-containers
-					plasma-integration
-					octotree
-					refined-github
-					tree-style-tab
-					ublock-origin
-					unpaywall
-				];
-			};
-		};
-	};
-
-	programs.bash.sessionVariables = vars;
-
-	programs.xonsh.sessionVariables = vars;
-}

home/home.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, gui, gnome,
+{ pkgs, lib,
   inputs,
   host ? "most",
   ...}:
@@ -15,11 +15,9 @@
 		./vim.nix
 		./xonsh.nix
 		./hosts/${host}
-	] ++ ( if gui then [ ./gui ] else []);
+	];
 
 
-	greg.gnome = gnome;
-
 	programs.tmux = {
 		enable = true;
 		keyMode = "vi";
@@ -54,5 +52,6 @@
 		tree
 		unzip
 		wget
+		zip
 	];
 }

home/hosts/jude/default.nix

@@ -6,7 +6,9 @@
 	];
 	home.packages = with pkgs; [
 		(mumble.override { pulseSupport = true; })
-		fluffychat
 		logseq
 	];
+	greg.gui = true;
+	greg.sway = false;
+	greg.gnome = false;
 }

home/modules/default.nix

@@ -3,7 +3,9 @@
 {
 	imports = [
 		./gnome.nix
+		./gui.nix
 		./python.nix
+		./sway.nix
 		./xonsh.nix
 	];
 }

home/modules/gui.nix

@@ -0,0 +1,91 @@
+{ config, pkgs, lib, ... }:
+
+let
+	cfg = config.greg.gui;
+
+	excludes = systems: opts: (
+		if ( builtins.all (x: pkgs.system != x) systems ) then opts else []
+	);
+
+	# For now, we ignore this and don't install it
+	ffPkgs = if ( pkgs.stdenv.hostPlatform.isDarwin )
+		then pkgs.firefox-bin
+		else pkgs.firefox-wayland.override { cfg.enableGnomeExtensions = true; };
+
+	vars = {
+		MOZ_ENABLE_WAYLAND = "1";
+		XDG_CURRENT_DESKTOP = "sway";
+	};
+in {
+	options.greg.gui = lib.mkEnableOption "Enable GUI programs";
+
+	config = (lib.mkIf cfg {
+		# These packages are Linux only
+		home.packages = with pkgs; ( excludes ["x86_64-darwin" "aarch64-darwin"]
+		[
+			cdrtools
+			fluffychat
+			cinny-desktop
+			qpwgraph
+			vlc
+			x265
+		]) ++
+
+		# x86_64-linux only
+		( excludes ["x86_64-darwin" "aarch64-darwin" "aarch64-linux"]
+		[
+			bitwarden
+			discord
+			endeavour
+			gnucash
+			jellyfin-media-player
+			libreoffice
+			#logseq
+			nextcloud-client
+			slack
+		]) ++
+
+		# Items that are not supported on ARM/Linux
+		( excludes ["aarch64-linux"]
+		[
+			onlyoffice-bin
+			synology-drive-client
+			zoom-us
+		]);
+
+		programs.firefox = {
+			enable = (! pkgs.stdenv.hostPlatform.isDarwin);
+			package = ffPkgs;
+			profiles = {
+				default = {
+					settings = {
+						"app.update.auto" = false;
+						"browser.ctrlTab.sortByRecentlyUsed" = true;
+						"browser.startup.page" = 3;
+						"browser.startup.homepage" = "https://thehellings.com";
+						"doh-rollout.doorhanger-decision" = "UIDisabled";
+						"doh-rollout.doneFirstRun" = true;
+						"signon.rememberSignons" = false;
+					};
+					extensions = with pkgs.nur.repos.rycee.firefox-addons; [
+						bitwarden
+						bypass-paywalls-clean
+						gsconnect
+						foxyproxy-standard
+						multi-account-containers
+						plasma-integration
+						octotree
+						refined-github
+						tree-style-tab
+						ublock-origin
+						unpaywall
+					];
+				};
+			};
+		};
+
+		# This is supposed to be in support of Firefox, but I dunno...
+		programs.bash.sessionVariables = vars;
+		programs.xonsh.sessionVariables = vars;
+	});
+}

home/modules/sway.nix

@@ -0,0 +1,103 @@
+{ config, pkgs, lib, ... }:
+
+let
+	cfg = config.greg.sway;
+	file_browser = {
+		pkg = pkgs.krusader;
+		path = "${pkgs.krusader}/bin/krusader";
+	};
+	term = "${pkgs.alacritty}/bin/alacritty";
+	msg = "${pkgs.sway}/bin/swaymsg";
+	sleep = "${pkgs.coreutils}/bin/sleep";
+	workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [
+		"${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
+		"${sleep} 1"
+		"${msg} '[app_id=\"firefox\"]' move left"
+		"${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \""
+		"${msg} '[app_id=\"firefox\"]' move left"
+		"${sleep} 0.3"
+		"${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
+		"${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
+	]);
+	workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [
+		"${sleep} 5"
+		"${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
+	]);
+in {
+	options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
+
+	config = (lib.mkIf cfg {
+		programs.swaylock.enable = true;
+
+		wayland.windowManager.sway = let
+			mod = config.wayland.windowManager.sway.config.modifier;
+		in {
+			enable = true;
+			config = rec {
+				#fonts.size = 10.0;
+				keybindings = lib.mkOptionDefault {
+					"Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000";
+					"Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m";
+					"Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m";
+					"Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m";
+
+					"${mod}+Shift+Return" = file_browser.path;
+				};
+				modifier = "Mod1";
+				output = {
+					"Samsung Electric Company S24E650 H4ZN600985" = {
+						mode = "1920x1200";
+						transform = "90";
+						pos = "0 0";
+					};
+					"ViewSonic Corporation VA2252 Series VMT201800925" = {
+						mode = "1920x1080";
+						pos = "200 1920";
+					};
+				};
+				terminal = term;
+				startup = [
+					{ command = "${workstation1}/bin/workstation1"; }
+					{ command = "${workstation2}/bin/workstation2"; }
+				];
+			};
+			extraOptions = [
+				"--unsupported-gpu"
+			];
+			extraSessionCommands = ''
+				export WLR_NO_HARDWARE_CURSORS=1
+			'';
+			systemd.enable = true;
+			wrapperFeatures = {
+				base = true;
+				gtk = true;
+			};
+		};
+		
+		home.pointerCursor = {
+			name = "Adwaita";
+			package = pkgs.gnome.adwaita-icon-theme;
+			size = 12;
+			x11 = {
+				enable = true;
+				defaultCursor = "Adwaita";
+			};
+		};
+
+		home.packages = with pkgs; [
+			arj
+			dpkg
+			kate
+			kget
+			krename
+			file_browser.pkg
+			p7zip
+			plocate
+			rpm
+			qpwgraph
+			xorg.xev
+			xorg.xmodmap
+			xxdiff
+		];
+	});
+}

home/ssh.nix

@@ -1,6 +1,12 @@
 { lib, ... }:
 
 {
+	# Workaround to set the config value to user read-only
+	# This allows things like SSH in distrobox to read the config file just fine
+	home.file.".ssh/config" = {
+  	  target = ".ssh/config_source";
+  	  onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 400 ~/.ssh/config'';
+	};
 	programs.ssh = {
 		enable = true;
 		serverAliveInterval = 60;

hosts/default.nix

@@ -8,8 +8,6 @@ let
 	machine = {
 		channel ? inputs.nixstable,
 		extraMods ? [],
-		gnome ? false,
-		gui ? false,
 		name,
 		system ? "x86_64-linux",
 		hm ? inputs.hm
@@ -20,7 +18,7 @@ let
 		};
 	in channel.lib.nixosSystem {
 		inherit system;
-		specialArgs = { inherit nixpkgs inputs; };
+		specialArgs = { inherit nixpkgs inputs overlays; };
 		modules = [
 			{
 				nixpkgs.overlays = overlays;
@@ -28,7 +26,7 @@ let
 				home-manager.useUserPackages = true;
 				home-manager.users.greg = import ../home/home.nix;
 				home-manager.extraSpecialArgs = {
-					inherit gnome gui inputs overlays;
+					inherit inputs overlays;
 					home = "/home/greg";
 					host = name;
 				};
@@ -41,11 +39,7 @@ let
 	};
 in {
 	genesis = machine { name = "genesis"; };
-	jude = unstable {
-		name = "jude";
-		gnome = true;
-		gui = true;
-	};
+	jude = unstable { name = "jude"; };
 	icdm-root = unstable { name = "icdm-root"; };
 	linode = machine { name = "linode"; };
 	mm = unstable { name = "mm"; };

hosts/icdm-root/location.nix

@@ -8,8 +8,8 @@
   i18n.defaultLocale = "en_US.UTF-8";
 
   # Configure keymap in X11
-  services.xserver = {
+  services.xserver.xkb = {
     layout = "us";
-    xkbVariant = "";
+    variant = "";
   };
 }

hosts/jude/boot.nix

@@ -3,6 +3,8 @@
 {
 	# Use the systemd-boot EFI boot loader.
 	boot = {
+		binfmt.emulatedSystems = [ "aarch64-linux" ];
+		kernelPackages = pkgs.linuxPackages_latest;
 		supportedFilesystems = [ "ntfs" ];
 		loader = {
 			timeout = 15;

hosts/jude/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 
 {
 	imports = [
@@ -23,46 +23,64 @@
 		hostName = "jude";
 		enableIPv6 = false;
 		interfaces.enp12s0.useDHCP = true;
-		firewall.enable = true;
+		firewall = {
+			enable = false;
+			allowedTCPPorts = [ 21000 ];
+			allowedUDPPorts = [ 21000 21010 ];
+		};
 	};
 	greg = {
 		tailscale.enable = true;
-		gnome.enable = true;
-		kde.enable = false;
+		sway.enable = false;
+		gnome.enable = false;
+		kde.enable = true;
 	};
 
-	environment.systemPackages = with pkgs; [
-		bind  # For things like nslookup
-		create_ssl
-		darktable
-		expect
-		gimp
-		gnucash
-		graphviz
-		flock
-		ffmpeg
-		handbrake
-		imagemagick
-		libtheora
-		libxml2
-		linode-cli
-		makemkv
-		nix-du
-		nix-tree
-		oathToolkit
-		synology-drive-client
-		terraform
-		vagrant
-		ventoy
+	boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
 
-		# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
-		gst_all_1.gstreamer
-		gst_all_1.gst-plugins-base
-		gst_all_1.gst-plugins-good
-		gst_all_1.gst-plugins-bad
-		gst_all_1.gst-plugins-ugly
-		gst_all_1.gst-libav
-		gst_all_1.gst-vaapi
+	environment.systemPackages = with pkgs; lib.mkMerge [
+		[  # for Immersed
+			cudatoolkit
+			immersed-vr
+			libva
+		]
+		[
+			bind  # For things like nslookup
+			create_ssl
+			darktable
+			distrobox
+			expect
+			gimp
+			gparted
+			gnucash
+			graphviz
+			flock
+			ffmpeg
+			handbrake
+			imagemagick
+			libtheora
+			libxml2
+			linode-cli
+			makemkv
+			nix-du
+			nix-tree
+			oathToolkit
+			synology-drive-client
+			terraform
+			vagrant
+			ventoy
+		]
+
+		[
+			# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
+			gst_all_1.gstreamer
+			gst_all_1.gst-plugins-base
+			gst_all_1.gst-plugins-good
+			gst_all_1.gst-plugins-bad
+			gst_all_1.gst-plugins-ugly
+			gst_all_1.gst-libav
+			gst_all_1.gst-vaapi
+		]
 	];
 	fileSystems =  {
 		"/boot" = {
@@ -89,6 +107,7 @@
 			pulse.enable = true;
 			wireplumber.enable = true;
 		};
+		locate.enable = true;
 		xserver.videoDrivers = [ "nvidia" ];
 	};
 	hardware = {

hosts/linode/default.nix

@@ -5,10 +5,10 @@
 		./git.nix
 		./hardware-configuration.nix
 		./podman.nix
+		./matrix.nix
 		./nextcloud.nix
 		./nginx.nix
 		./postgres.nix
-		./synapse.nix
 	];
 
 	greg = {

hosts/linode/matrix.nix

@@ -0,0 +1,62 @@
+# Registration of new users is disabled for the public, but I can create
+# them by the following commands:
+# nix run nixpkgs.matrix-synapse
+# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
+{ config, pkgs, ... }:
+let
+	domain = "${config.networking.domain}";
+	fqdn = "matrix.${domain}";
+	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
+in
+{
+	services.nginx = {
+		virtualHosts = {
+			# Server the '.well-known' files to find the Matrix API server
+			"${domain}" = {
+				enableACME = true;
+				forceSSL = true;
+
+				# This is needed so that servers contacting hellings.com can find
+				# the actual application server at matrix.thehellings.com
+				locations."= /.well-known/matrix/server".extraConfig =
+					let
+						server = { "m.server" = "${fqdn}:443"; };
+					in ''
+add_header Content-Type application/json;
+return 200 '${builtins.toJSON server}';
+'';
+
+				locations."= /.well-known/matrix/client".extraConfig =
+					let
+						client = {
+							"m.homeserver" = { "base_url" = "https://${fqdn}"; };
+							"m.identity_server" = { "base_url" = "https://vector.im"; };
+						};
+					in ''
+add_header Content-Type application/json;
+add_header Access-Control-Allow-Origin *;
+return 200 '${builtins.toJSON client}';
+'';
+			};
+
+			# Reverse proxy in front of the actual Matrix server
+			"${fqdn}" = {
+				enableACME = true;
+				forceSSL = true;
+
+				# Not the appropriate place for the chat client
+				locations."/".extraConfig = "return 404;";
+
+				locations."/_matrix" = {
+					proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
+				};
+			};
+		};
+	};
+
+	# Open networking ports for the server
+	networking.firewall = {
+		enable = true;
+		allowedTCPPorts = [ 80 443 ];
+	};
+}

hosts/linode/postgres.nix

@@ -5,7 +5,6 @@
 		enable = true;
 		checkConfig = true;
 		ensureDatabases = [
-			"dendrite"
 			"nextcloud"
 		];
 		#initialScript = pkgs.writeText "create-matrix-db.sql" ''
@@ -16,10 +15,7 @@
 		ensureUsers = [ {
 			name = "nextcloud";
 			ensureDBOwnership = true;
-		} {
-			name = "dendrite";
-			ensureDBOwnership = true;
-		} ];
+		}  ];
 		settings = {
 			log_connections = true;
 			log_statement = "all";
@@ -34,7 +30,6 @@ root root postgres
 	services.postgresqlBackup = {
 		enable = true;
 		databases = [
-			"dendrite"
 			"nextcloud"
 		];
 	};

hosts/linode/synapse.nix

@@ -1,137 +0,0 @@
-# Registration of new users is disabled for the public, but I can create
-# them by the following commands:
-# nix run nixpkgs.matrix-synapse
-# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
-{ config, pkgs, ... }:
-let
-	domain = "${config.networking.domain}";
-	fqdn = "matrix.${domain}";
-	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
-in
-{
-	services.nginx = {
-		virtualHosts = {
-			# Server the '.well-known' files to find the Matrix API server
-			"${domain}" = {
-				enableACME = true;
-				forceSSL = true;
-
-				# This is needed so that servers contacting hellings.com can find
-				# the actual application server at matrix.thehellings.com
-				locations."= /.well-known/matrix/server".extraConfig =
-					let
-						server = { "m.server" = "${fqdn}:443"; };
-					in ''
-add_header Content-Type application/json;
-return 200 '${builtins.toJSON server}';
-'';
-
-				locations."= /.well-known/matrix/client".extraConfig =
-					let
-						client = {
-							"m.homeserver" = { "base_url" = "https://${fqdn}"; };
-							"m.identity_server" = { "base_url" = "https://vector.im"; };
-						};
-					in ''
-add_header Content-Type application/json;
-add_header Access-Control-Allow-Origin *;
-return 200 '${builtins.toJSON client}';
-'';
-			};
-
-			# Reverse proxy in front of the actual Matrix server
-			"${fqdn}" = {
-				enableACME = true;
-				forceSSL = true;
-
-				# Not the appropriate place for the chat client
-				locations."/".extraConfig = "return 404;";
-
-				locations."/_matrix" = {
-					proxyPass = "http://127.0.0.1:8448"; # Lacking the trailing / is correct
-				};
-			};
-
-			# Run Element web
-			"chat.${fqdn}" = {
-				enableACME = true;
-				forceSSL = true;
-				serverAliases = [
-					"chat.${domain}"
-				];
-				root = pkgs.element-web.override {
-					conf.default_server_config."m.homeserver" = {
-						"base_url" = "https://${fqdn}";
-						"server_name" = "${fqdn}";
-					};
-				};
-			};
-		};
-	};
-
-	# Environment secrets
-	age.secrets.dendrite = {
-		file = ../../secrets/dendrite.age;
-		owner = "dendrite";
-	};
-
-	users.users.dendrite = {
-		isSystemUser = true;
-		group = "dendrite";
-	};
-	users.groups.dendrite = {};
-
-	systemd.services.dendrite.serviceConfig = {
-		User = "dendrite";
-	};
-
-	services.dendrite = {
-		enable = true;
-		environmentFile = "/run/agenix/dendrite";
-		httpPort = 8448;
-		# Identify ourselves as the root of our own domain
-		settings = (
-		(builtins.listToAttrs (
-			(map (x: { name = x; value = { database.connection_string = conn; }; }) [
-				"app_service_api"
-				"federation_api"
-				"key_server"
-				"media_api"
-				"mscs"
-				"relay_api"
-				"room_server"
-				"sync_api"
-			])
-		) ) //
-		{
-			user_api.account_database.connection_string = conn;
-			user_api.device_database.connection_string = conn;
-			global = {
-				database = {
-					connection_string = conn;
-					max_open_conns = 90;
-					max_idle_conns = 5;
-					conn_max_lifetime = -1;
-				};
-				server_name = "thehellings.com";
-				trusted_third_party_id_servers = [
-					"matrix.org"
-					"vector.im"
-					"jupiterbroadcasting.com"
-				];
-				# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
-				private_key = "/etc/dendrite.pem";
-			};
-			client_api = {
-				registration_enabled = false;
-				registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
-			};
-		});
-	};
-
-	# Open networking ports for the server
-	networking.firewall = {
-		enable = true;
-		allowedTCPPorts = [ 80 443 ];
-	};
-}

hosts/mm/default.nix

@@ -183,9 +183,9 @@ in
 			};
 		};
 		# Configure keymap in X11
-		xserver = {
+		xserver.xkb = {
 			layout = "us";
-			xkbVariant = "";
+			variant = "";
 		};
 	};
 

hosts/myself/container-git.nix

@@ -1,20 +1,11 @@
-{ inputs, ...}:
 { config, pkgs, lib, ... }: let
 	registryPort = 5000;
 	vpnIp = "100.78.226.76";
 	containerIp = "192.168.200.2";
 in {
-	imports = [
-		inputs.agenix.nixosModules.default
-		inputs.self.modules.nixosModule
-	];
-
-	nixpkgs.overlays = inputs.self.overlays.all;
-
-	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 	age.secretsMountPoint = "/run/derp";
 	age.secrets = let
-		cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
+		cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
 	in {
 		gitlab-secret = cfg "secret";
 		gitlab-otp = cfg "otp";
@@ -24,13 +15,7 @@ in {
 		gitlab-cert = cfg "cert";
 	};
 
-	networking = {
-		firewall = {
-			enable = true;
-			allowedTCPPorts = [ 80 registryPort ];
-		};
-		useHostResolvConf = lib.mkForce false;
-	};
+	networking.firewall.allowedTCPPorts = [ 80 registryPort ];
 
 	greg.proxies = let
 		t = {
@@ -45,7 +30,6 @@ in {
 		"${vpnIp}" = t;
 		"git.thehellings.lan" = t;
 	};
-	greg.tailscale.enable = true;
 
 	virtualisation.docker.enable = true;
 

hosts/myself/container-runner.nix

@@ -1,4 +1,4 @@
-{ inputs, name, extra ? {}, packages ? [] }:
+{ inputs, name, extra ? {}, packages ? [], overlays }:
 
 ({ config, pkgs, lib, ... }:
 let
@@ -15,7 +15,7 @@ lib.attrsets.recursiveUpdate {
 		inputs.self.modules.nixosModule
 	];
 
-	nixpkgs.overlays = inputs.self.overlays.all;
+	nixpkgs.overlays = overlays;
 
 	age = {
 		identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

hosts/myself/default.nix

@@ -1,8 +1,9 @@
 { config, pkgs, lib, ... }:
 {
-	imports = [	
+	imports = [
 		./hardware-configuration.nix
 		./git.nix
+		./matrix.nix
 	];
 
 	environment.systemPackages = with pkgs; [
@@ -65,6 +66,9 @@
 				configurationLimit = 10;
 			};
 		};
+		binfmt.emulatedSystems = [
+			"aarch64-linux"
+		];
 	};
 	nixpkgs.config = {
 		allowUnfree = true;

hosts/myself/git.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, inputs, ... }:
+{ config, pkgs, lib, inputs, overlays, ... }:
 
 let
 
@@ -31,25 +31,10 @@ in  {
 	
 	system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
 
-	containers.gitlab = container {
-		autoStart = true;
-		bindMounts = {
-			"/var/gitlab/state" = {
-				hostPath = gitlabStateDir;
-				isReadOnly = false;
-			};
-			"/dev/net/tun" = {
-				hostPath = "/dev/net/tun";
-				isReadOnly = false;
-			};
-		};
-		forwardPorts = [{
-			hostPort = 2222;
-			containerPort = 22;
-		}];
-		hostAddress = "192.168.200.1";
-		localAddress = "192.168.200.2";
-		config = ((import ./container-git.nix) { inherit inputs; });
+	greg.containers.gitlab = {
+		tailscale = true;
+		subnet = "200";
+		builder = (import ./container-git.nix);
 	};
 
 	systemd.services = {
@@ -80,11 +65,6 @@ in  {
 				];
 			};
 		};
-		"container@gitlab".serviceConfig = {
-			DeviceAllow = [ "/dev/net/tun" ];
-			ProtectKernelModules = false;
-			PrivateDevices = false;
-		};
 		gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
 	};
 
@@ -108,7 +88,7 @@ in  {
 		hostAddress = "192.168.201.1";
 		localAddress = "192.168.201.2";
 		config = ((import ./container-runner.nix) {
-			inherit inputs;
+			inherit inputs overlays;
 			name = "qemu";
 			packages = with pkgs; [ qemu_full qemu_kvm ];
 			extra = {
@@ -142,7 +122,7 @@ in  {
 		hostAddress = "192.168.202.1";
 		localAddress = "192.168.202.2";
 		config = ((import ./container-runner.nix) {
-			inherit inputs;
+			inherit inputs overlays;
 			name = "vbox";
 			extra = {
 				systemd.services.gitlab-runner.serviceConfig = {
@@ -168,7 +148,7 @@ in  {
 		hostAddress = "192.168.203.1";
 		localAddress = "192.168.203.2";
 		config = ((import ./container-runner.nix) {
-			inherit inputs;
+			inherit inputs overlays;
 			name = "shell";
 		});
 	};

hosts/myself/matrix.nix

@@ -0,0 +1,88 @@
+{ config, pkgs, inputs, lib, ... }:
+let
+	domain = "thehellings.com";
+	fqdn = "matrix.${domain}";
+	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
+in
+{
+	greg.containers.matrix = {
+		tailscale = true;
+		subnet = "204";
+		builder = { pkgs, config, ... }: {
+			networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
+
+			# Environment secrets
+			age = {
+				secrets.dendrite = {
+					file = ../../secrets/dendrite.age;
+					owner = "dendrite";
+				};
+				secrets.dendrite_key = {
+					file = ../../secrets/dendrite_key.age;
+					owner = "dendrite";
+				};
+			};
+
+			users.users.dendrite = {
+				isSystemUser = true;
+				group = "dendrite";
+			};
+			users.groups.dendrite = {};
+
+			systemd.services.dendrite.serviceConfig = {
+				User = "dendrite";
+			};
+
+			greg.databases.dendrite = {};
+
+			services.dendrite = {
+				enable = true;
+				environmentFile = config.age.secrets.dendrite.path;
+				httpPort = 8448;
+				# Identify ourselves as the root of our own domain
+				settings = (
+				(builtins.listToAttrs (
+					(map (x: { name = x; value = { database.connection_string = conn; }; }) [
+						"app_service_api"
+						"federation_api"
+						"key_server"
+						"media_api"
+						"mscs"
+						"relay_api"
+						"room_server"
+						"sync_api"
+					])
+				) ) //
+				{
+					user_api.account_database.connection_string = conn;
+					user_api.device_database.connection_string = conn;
+					global = {
+						database = {
+							connection_string = conn;
+							max_open_conns = 25;
+							max_idle_conns = 5;
+							conn_max_lifetime = -1;
+						};
+						server_name = "thehellings.com";
+						trusted_third_party_id_servers = [
+							"matrix.org"
+							"vector.im"
+							"jupiterbroadcasting.com"
+						];
+						# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
+						private_key = config.age.secrets.dendrite_key.path;
+					};
+					client_api = {
+						registration_enabled = false;
+						registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
+					};
+				});
+			};
+
+			systemd.services.dendrite = {
+				after = [ "postgresql.service" ];
+				requires = [ "postgresql.service" ];
+			};
+		};
+	};
+}

modules/baseline.nix

@@ -43,6 +43,7 @@
         gnupatch
         gregpy
         findutils
+        file
         hms # My own home manager switcher
         htop
         killall

modules/nixos/backup.nix

@@ -11,9 +11,9 @@ let
 	makeService = name: job: {
 		serviceConfig = {
 			User = job.user;
-			ExecPre = lib.optionalString (job.pre != "") job.pre;
+			ExecStartPre = lib.optionalString (job.pre != "") job.pre;
 			ExecStart = "${pkgs.rsync}/bin/rsync -avz --delete -e '${pkgs.openssh}/bin/ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null' ${job.src}/ backup@chronicles.shire-zebra.ts.net:/volume1/NetBackup/${job.dest}";
-			ExecPost = lib.optionalString (job.post != "") job.post;
+			ExecStartPost = lib.optionalString (job.post != "") job.post;
 		};
 	};
 

modules/nixos/container.nix

@@ -0,0 +1,76 @@
+{ config, lib, inputs, overlays, ... }:
+
+let
+	cfg = config.greg.containers;
+
+	# Create a container with all our default settings
+
+	makeContainer = name: container: let
+		agekey = "/etc/ssh/agenix_key";
+	in {
+		autoStart = true;
+		hostAddress = "192.168.${container.subnet}.1";
+		localAddress = "192.168.${container.subnet}.2";
+		privateNetwork = true;
+		bindMounts = {
+			"${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key";  # This is needed for agenix to 
+		};
+		enableTun = container.tailscale;
+		config = { config, pkgs, ... }: {
+			imports = [
+				inputs.agenix.nixosModules.default
+				inputs.self.modules.nixosModule
+				container.builder
+			];
+
+			nixpkgs.overlays = overlays;
+
+			networking = {
+				firewall.enable = true;
+				useHostResolvConf = lib.mkForce false;
+			};
+
+			age.identityPaths = [ agekey ];
+
+			greg.tailscale.enable = container.tailscale;
+		};
+	};
+in {
+	options.greg.containers = lib.mkOption {
+		default = {};
+
+		type = with lib.types; attrsOf ( submodule (
+			{
+				options = {
+					tailscale = lib.mkOption {
+						type = bool;
+						default = false;
+						description = "Enable tailscale in the container";
+					};
+					subnet = lib.mkOption {
+						type = str;
+						default = "200";
+					};
+					builder = lib.mkOption {
+						default = { ... }: {};
+						description = ''
+							This needs to be a function, like the one for
+							a container's config. It will setup the core system above the
+							defaults set in this module.
+						'';
+						example = ''
+							{ pkgs, config, lib, ... } :
+							{
+								services.openssh.enable = true;
+							}
+						'';
+					};
+				};
+			}
+		));
+	};
+
+	config = {
+		containers = builtins.mapAttrs makeContainer cfg;
+	};
+}

modules/nixos/db.nix

@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+
+let
+	cfg = config.greg.databases;
+	dbs = (lib.attrNames cfg);
+in {
+	options.greg.databases = lib.mkOption {
+		default = {};
+		type = with lib.types; attrsOf ( submodule (
+			{ name, config, options, ... }: {
+				# Options reserved for future expansion
+				options = {};
+			}
+		));
+	};
+
+	config = lib.mkIf ( dbs != [] ) {
+		services = {
+			postgresql = {
+				enable = true;
+				checkConfig = true;
+				ensureDatabases = dbs;
+				ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
+				settings = {
+					log_connections = true;
+					log_statement = "all";
+					logging_collector = true;
+					log_filename = "postgresql.log";
+				};
+				identMap = "root root postgres";
+			};
+
+			postgresqlBackup =  {
+				enable = true;
+				databases = dbs;
+			};
+
+			logrotate = {
+				enable = true;
+				settings = {
+					postgresqlBackup = {
+						enable = true;
+						files = "${config.services.postgresqlBackup.location}/*.gz";
+					};
+					postgresLog = {
+						enable = true;
+						files = "/var/lib/postgresql/*/log/*.log";
+						compress = true;
+						compresscmd = "${pkgs.xz}/bin/xz";
+					};
+				};
+			};
+
+		};
+
+		greg.backup.jobs.greg-postgresql-backup = {
+			src = config.services.postgresqlBackup.location;
+			dest = "database-${config.networking.hostName}";
+			user = "postgres";
+		};
+	};
+}

modules/nixos/default.nix

@@ -4,6 +4,8 @@
 	imports = [
 		../baseline.nix
 		./backup.nix
+		./container.nix
+		./db.nix
 		./gnome.nix
 		./home.nix
 		./kde.nix
@@ -12,6 +14,7 @@
 		./proxy.nix
 		./router.nix
 		./rpi4.nix
+		./sway.nix
 		./tailscale.nix
 	];
 
@@ -22,7 +25,7 @@
 		lshw
 	];
 
-	system.stateVersion = "22.05";
+	system.stateVersion = "24.05";
 
 	nix = {
 		gc.dates = "weekly";

modules/nixos/gnome.nix

@@ -17,7 +17,7 @@ in with lib; {
 				enable = true;
 				displayManager.gdm.enable = true;
 				desktopManager.gnome.enable = true;
-				layout = "us";
+				xkb.layout = "us";
 				# Trackpad support
 				libinput.enable = true;
 			};
@@ -38,7 +38,6 @@ in with lib; {
 		};
 
 		programs.dconf.enable = true;
-		programs.sway.enable = true;  # Gives us Wayland
 		xdg.portal = {
 			enable = true;
 			wlr.enable = true;  # Enables screen sharing in Wayland

modules/nixos/kde.nix

@@ -13,9 +13,12 @@ in with lib; {
 		services = {
 			xserver = {
 				enable = true;
-				displayManager.sddm.enable = true;
-				desktopManager.plasma5.enable = true;
-				layout = "us";
+				desktopManager.plasma6.enable = true;
+				displayManager = {
+					defaultSession = "plasma";
+					sddm.enable = true;
+				};
+				xkb.layout = "us";
 				# Trackpad support
 				libinput.enable = true;
 			};

modules/nixos/sway.nix

@@ -0,0 +1,42 @@
+{ config, pkgs, lib, ... }:
+
+let
+	cfg = config.greg.sway;
+
+in with lib; {
+	options = {
+		greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
+	};
+
+	config = mkIf cfg.enable {
+		services = {
+			accounts-daemon.enable = true;
+
+			pipewire = {
+				enable = true;
+				alsa.enable = true;
+				audio.enable = true;
+				jack.enable = true;
+				pulse.enable = true;
+				wireplumber.enable = true;
+			};
+
+			xserver = {
+				enable = true;
+				displayManager.gdm = {
+					enable = true;
+					autoSuspend = false;
+					banner = "Welcome to Greg's JUDE machine. Do I know you?";
+					wayland = true;
+				};
+				xkb.layout = "us";
+			};
+		};
+
+		programs.sway = {
+			enable = true;  # Will be enabled through home-manager
+			wrapperFeatures.gtk = true;
+		};
+		security.pam.services.swaylock = {};
+	};
+}

secrets/3proxy.age

@@ -1,24 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 oyEmTw pgy+JU0OlmCRGL1YxpPdvo7yOYM/ds3PcQQraRfuklM
-V6i7wXHal63cLthtmpr2yY2Ayf/3Dd7yEGeJzEsuGfI
--> ssh-ed25519 mOmPfg 1ukIe3ZVLgsr2z6GvZOevYeIh2EyukgpSevAN4fj708
-+SnY9KsZe5yrEfJsXPMZDll6At7y7Z62Alz2hyfs8YQ
--> ssh-ed25519 YJiRbw I+gmOoz+dF4ZDjAu/EJv3VfM0DBYyFGL4+yqhDfqv3c
-vHvuTwex+n5W9dmzx8sluCcSefeInvECLZBMrv9EqOc
--> ssh-ed25519 aY2AXA JViGiOEhvqHVu9SgW5AT2OAO73WnA3J1HKO9rfCrdWY
-Rt6n/EWGFrxpigG66uzmNSbxmu3DCFTIQ24XMo3dPdw
--> ssh-ed25519 Nl/5yA OnTtkQIJBeQGEwTZmBgeYtWlArmqcTaItWTiuPVbPwk
-rmCmPzC4pCaMOfLCQcnGtkwrF4D+BfuUG4zswAJ+EUA
--> ssh-ed25519 GdLgCQ qlJysE+dXsJN108Lgz+jzVUMV9BYDcp4knFMOWtEoVk
-wJTyxTtVu0p1PEEkd/tF80ttPXKO6XB+AaVYEwZ+5oo
--> ssh-ed25519 tOH/HQ s6IMoMfgLNDsfisM+MZ2BFdqmQ/YqSMCquw9AgruQVc
-8t7+P6YiBsPtP33eUmDTrfO67LtsfziORgn0twGKT78
--> ssh-ed25519 FpzvfQ 6gwHsJcGdK0EttaAmg6cTOSGWBVjApo8xsC1y2/piB8
-Vv6mfKYOQS3o8qgFC5bjfAbJpb7yTsxyvu3yQS6pQQI
--> ssh-ed25519 kdPvzQ rzSykoG6mHkxnlwWyd0Y7mWmKviRvO0/5iqzRHTgwHY
-6claIsJUVTKts3lZU+jpB00QV3Lv6CHpnC5EbexJW6Y
--> A2g(UHN--grease =T5M"
-5VTJOL65wKYIQQzuK0hXGTzAmJL3wryRY/USjZbIHuHDMhZMbgLsYIpxIvq248JQ
-Cd4GXw6aH5TUC4kBLHlKlRi+FTA9C543U06SgQA
---- O7vNniD/JmbDJFUR+rut9ZL+OhkvIqlBQt7Zc2nqQUo
-ŸZùU“æcY2EOÙéÑ 5×nܯ–h_#W�"‰èz�öÑžâøÕ�ØÙšË::à€õí…ƒUøÄe®Üj)ÄR!ðâI·´
+-> ssh-ed25519 mOmPfg gumFVDhQh1AGitpxIits9R6Vjm91ZizKG+FhDZjYRFM
+wRzhgUUJp5RAA2teqQeowvZcTkycHPk22X006MPTfxE
+-> ssh-ed25519 YJiRbw SQevbHb7VyGn6MMJs3IBhz0Rymy8b7OuP4Fj/rEYjSA
+PeB0i8IId0RNILuW1g2RC08CVaACm+zCjQJkDR56qGs
+-> ssh-ed25519 aY2AXA g997hboApB18f+r6j8FBCAgCg3nEa9vBdrFWQ83J6jc
+ECAbekA5M5oM8J58X+ouEmLcKnfOqYF1a0/UX0YCNNM
+-> ssh-ed25519 Nl/5yA unK0RFaggliR++d/9pyKsL6f2amxHdo2Gn65pKHgKCs
+w/UX6dqejaqgrdVOTaRVMOyS4rwaNuc/5TbHed4TrhQ
+-> ssh-ed25519 GdLgCQ Fe27fkX2BeHTGct/Pm2nLG10hl5c4tE4PA9Cwggj/g0
++XK+8POGfNZQEQmRYC5lLIWRO5thPxTicM0onkpgGPQ
+-> ssh-ed25519 tOH/HQ oIFm+9sttK0BInsCS+xS34DAdbDYbIBpsNmSVT+PUkk
+u/4noQOR9wnR5dO1tqpRk7+wCVpwcRnwclg26TOzF4M
+-> ssh-ed25519 FpzvfQ rPbTDyT5eg+n5qlmHvy2Zu9A/JLKTrBIIk0jwdeUdUI
+F8D5VJIplhXcqfTzlUhk2GlwRkBmPIiOee980H0VJLM
+-> ssh-ed25519 kdPvzQ ky3n+PXUHZOXiXNa4+MBaLmSMW6H2z/NBX+H9QHVKhE
+wR2DfcF5CgOXBsbQxHKVcZLU+uo1Vt3berKpWoMo/FA
+--- Zrbuy61RBb9S64+YAaGcXNn+i+v/qEkJjXRrDBBKEKY
+• æeÖÁùU|ñ:í¶rCv*~ÿÞ8¾[)ˆ²V†„ÛGÎÚ@Kæ‡Õ<Cå±òÿ `asC˜	ƒ’:lÉÔ·«º£RÑTe

secrets/gitlab/db.age

@@ -1,23 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 oyEmTw 6DS+bTAy4b62Nxw0uXHHEMn3OVY9wUzX+wUCZP5Hjig
-Nt+zLf6IsLY7h5/alXiUffBxgyEL9vV7EEIrlHO3W04
--> ssh-ed25519 mOmPfg 0Gi5xr72h9ya1J5BZGy5ahxCkLx35ImPpZoIlP3sZwo
-iE40yQ2/J8UksZgkl/l3+8bwwg27CZOz/H9sWdKOHok
--> ssh-ed25519 YJiRbw AzMXidZGMtBUb7TRrC6lTEa4egnNqbi5J2WRUzqYBiY
-pAIRAFH+8KbJGPjj2fApMMACjnYdxA58yrB4YZEJnYM
--> ssh-ed25519 aY2AXA VchzlGCRVKD3R30THPckqVQnAb9qAGrQkdPUlbAhn10
-siGMMSA14PDHtJwv1EeEpaztkFMwiyAmnlJsewy6qQg
--> ssh-ed25519 Nl/5yA adKC4ZbwvXWO+zI+cOS2KF/VpuzgucfqkVerpGZ5vCA
-JNZadXOyBUu2pBLq5enLGEts5+uSNfPfuzHh37rFSc4
--> ssh-ed25519 GdLgCQ WSOxf9kUvalmcWf24l2XYApV+91BPCdRHNxYznnQtgE
-Yh8GHx0PvcomYPEmY950kloxo5AuURIr8xcRn2roLVk
--> ssh-ed25519 tOH/HQ pVWHOg02OAzlsPKYAq68kx4cFhh1Mlq6YgvKe+2kcjg
-QxkzNE2Q9TL45dBAIHwtDrSsj7qohmQ7Bn85TXjUu4o
--> ssh-ed25519 FpzvfQ OtdjKF5JtWZabX8nRET3LxUb/KtwoP/0sP3Cc7K4ljw
-E+yGcgPEWWSh6wuxVRr2Bv1+je6v63x9b85v/j4H8gA
--> ssh-ed25519 kdPvzQ NZ6HUl7kvr+f2inPHRwWjQGByXyIp/FzIhIK8bKxfwg
-P+MImWM0wzsSCk4kJe5Mdg9NhOCmoJIAwzsvifrPdqo
--> l8`-grease bcA %TIY [d]~
-R+MH2T2z+etA
---- kjTynEqr/Xufkw0158ZP3mxuBzWzxVQ39QJ6rV965c0
-²Üß}5>—hJøϺR›ËNœ‘žº.t\:+»’IN^²‚Žõíôm@Ie^I¨œK¡³X–s8Zœº¢”’.!ÚGʸ¨(¼x„ÔõÖµ9£[p“:
+-> ssh-ed25519 mOmPfg caaT+VREuqBSbCt7Nv+gAyZgcr6kITpslJjqUn4AoFQ
+iOFZnm7shGu9q362G0KSUeJqfT3uunJ3VE1NQxihx5w
+-> ssh-ed25519 YJiRbw Jnr26oIvPnKlU6qoWgG7o79CKzYeQ92vRkBeUFiD7j8
+JVG00d1wPYTB0SEhv/DR25pkJcK5KHbhtt0JtJ2fDh4
+-> ssh-ed25519 aY2AXA UzWTN6JGfaw96atZLsSnJAxyKq4cYyxeTKnBbeNTgD8
+WLR1F9yTZxZF67DXzWLqqulnWyVpSq5FGWv1kX4IC3I
+-> ssh-ed25519 Nl/5yA l/JQbZH6JY0UNPk5YtLl6zwoIe627u68tSjxwt/N6Cg
+BzpKvweac6lKB/YgGF0tUxEFzmJZSWqiD4XQ8ApPb2s
+-> ssh-ed25519 GdLgCQ hlYrhTQUwaTx5YAFIf++QuqJL8dJjJJ4q2FN1glVBD4
+yFG60mKri3M7s1tUvVOv08XPeDIpKChiOmOCWCXxflo
+-> ssh-ed25519 tOH/HQ QIGaHNqrVi81W549YNnYN5mfrM1Ci6hieVDYqU6cjzo
+BdKS4IaE5lGHQv3I+m6K+HDM157YF2COE5ZC6d7XBm4
+-> ssh-ed25519 FpzvfQ X9ZUHxbN1JN2WTm9nip791WnP2yoLyFBKedvEeI1ihE
+IdWZjOBQNFnv2FRlE/OIu15+wk8Pc/ac6d8NWEzFTkU
+-> ssh-ed25519 kdPvzQ 9h1fd/Z4WWs3LUfZToK2VD97a04iXPWEX38mN7SQJTs
+eioXC6/f9NVuUyJAUlbU18ARfQ9fSCetyl7sd8+2gH8
+--- mQK+grHzDNowE61Xip34q+sg7Y9dkX9b1vFP0N+nKtw
+S¯–xg´å¥)b8"<›p;v°ý¼Ú[${ÜŸ–ÓüÏ„öÂelRvÀÅ)Â¥a�ô±Á½w‘\ÔŽ�Y”3e¸/�fÖ˜PaE“ácúr/Ù°6ùï²I

secrets/gitlab/docker-auth.age

@@ -1,23 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 oyEmTw 3op+GhV8OpN2fD3YxNIxBlL4vNvBX+ij93zH0r5ZIy4
-i2UDs/g/2w+tCgCnWtMK7fPSSGEtcCimQlY31fYWHYE
--> ssh-ed25519 mOmPfg wjMwi+bB1CC83f5eCcbmNE/w+aF72BTTxEJkZu3oVy8
-5qcAf6zWzKgN9fD4qjsb5GnjfZsjCbMdcEDD3TI4gtA
--> ssh-ed25519 YJiRbw 3OYExR/7TTlzvDK/xXh5fQ+f946hVxVRviSDv2DJjj4
-1SbIht8SnDdGw404tFdmEAHydGg18Phb0a3WpeAxqK0
--> ssh-ed25519 aY2AXA IxtJr8/Bp4gaITNzxiXuDPkFUF0/skE1T6Da80zZdXo
-D63zeOhtKPgtPLbNBnVzK4P0ZhytJ6whq7lTxTN+zwA
--> ssh-ed25519 Nl/5yA isCCfCSBrU8yGQ/oNHGRB/V5T/BnPV+6FZnhPq0D82w
-+6M0cX0MbCOKA3QZocEiYZfEFgcgDrVpYscPx6KTndw
--> ssh-ed25519 GdLgCQ a6zGDEVPndccmXoYOK/hGQEwgq8tvbkIThopz/4cQwM
-6qyK4b/6xbBXaqxQkKWufVVgptDF7TZcrRcAjowHkSk
--> ssh-ed25519 tOH/HQ maiNdWPZ+ZeIFC9ZJPgMNb0vb0sgLMsfiDyj8pThoG4
-OGUR9ZCFVgKxiqsDf4EZk59QwkMYFeJp2mPqd3PEOTk
--> ssh-ed25519 FpzvfQ C0UnpWeSAtrm3DJAJuEFSayJr/3m+7SiJvejUrFYklo
-gBxzb/JmRvyutYLYOsAf1Hs4Py+jsv4OvEE/CWL3kDU
--> ssh-ed25519 kdPvzQ /4iNfORP7vr6STdayTzULEutq6A34as9D/SQyrOmimQ
-XKB0sv1RvSlFU8j3IHHiFaPMnUTNBeLSxWPgfne822s
--> n+-grease 6H
-hA
---- ZmPFZncGjg6Ze5VdAq7ZxhMwCoL5XJRNhN8iZBse5pc
-ÿBt;¹,Ö¤2¥"+"+5ßé´0Ðf␍#qÈ#³t“‰ó¡0u¤c/¼¦XS¤ÙÒêšypC]ØëË€õÍÖ"øä‹:ÇŸlaž'ÕaZv¬½]Ù©A’µ+—ÇÕ.õ²¿¨I;J5ðÝ“^ö,î’2´c�œf«ï:-–ÁÍ°wü�µÓÞ<œVz
th~}×q�Ì%¢?¨F
+-> ssh-ed25519 mOmPfg o+i2oELghwEnsYN0//DougkC/3VAP6lVl0VYH7cELyQ
+yL2FJ/MkSuJrB0J4iK1EVdG21RWc3M4NmVU8TncI7dw
+-> ssh-ed25519 YJiRbw XojJl236Ed5WUnda48abwixlYyuaoQx9QzYiQNl8o30
+3PA6fnnWVHqTAmQtrYEE4KBcvGGjaPl6MwKIqoeNHTk
+-> ssh-ed25519 aY2AXA lwiy/CDfOwsutQrEvE9+tbMiYMSmivICPE+P3CcDsic
+wqZ+kQ659tMEKZXuNUuISjeWuFV4lTX9QNgUTtg28Hg
+-> ssh-ed25519 Nl/5yA uzDbFGonniZv3yYPo8wVHhPM8xhCB72osiFF7qlkwQY
+lsbg26Hru9WKvjN9DedhBdXzHczTv3FgBH9GqfvzfUo
+-> ssh-ed25519 GdLgCQ IMBKcmHmJQSjemBjpRd8codzvji7CWWVymf94RnMAEo
+YfwvLEz+hESvvevoYp9YW5GL2mg6ss1Sn83/nLHRhCE
+-> ssh-ed25519 tOH/HQ K5bPrUnHPIjkCyZUnK36zrtSSBBRYaHKWIYDyW07v0M
+AHSM8WuLySrHAhy7h2Vr1XU6r7O6xRdYPS8djxBys2s
+-> ssh-ed25519 FpzvfQ WLZ2OiarCBQolnpS7dTkQhiZY9/P8CpZ1fHYm2nwAR4
+ettuJbEGuxXUqT9Kb7J89aw6TdtUckeLXItfANrg+T0
+-> ssh-ed25519 kdPvzQ G/pyPAn05PtGcAi8WCf/mbBAX1eOlABC3Wy4Md/X9yw
+n8pWfPKC4DSPZiEJZ9ysZupIFyF5RMM+Dx5savwPcO8
+--- H/MbLtj0T3VfZhz+7LTPkp3SRuCDCR94KSW+8RThjtg
+yÝ^Y ¼@«o1ÏçùãªXN7B„Ô�×d³␍ô©Š™]àüµÉvóÃ{R	b¯|&Ù«@*_¤·æNäì¤åC›Ì‰Èì<Ò‹^~¹‰)LÆžœ~n¡ôâ n=ð` åDQ|å2œc}6™Ú6èíûC„˜¿<kmOÝ‹�<iÚ8ïFRCBÔ2V1«„␍°™ª´ÔÐs*Aô

secrets/gitlab/secret.age

@@ -1,24 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 oyEmTw 1gVcNXHntuYOZt7uS7bha7oUfCfIhRzzOJIxhsDneUg
-2E+w6F+4Ivj6sVgbwDuHVrtp8xd/Vb6taHflp2ua/LQ
--> ssh-ed25519 mOmPfg RqI0kJeCEI/bbnfkFbH+49b2iNl7XIk6Xmbeoc27f1w
-amQ1gg3tbuKE4RRgJ4W1nTnt2cZJvG270ILFnxH0n10
--> ssh-ed25519 YJiRbw VdyG0wKNQ40NhrPHGKxjioT8G7x6os3txWNyl4fUGlc
-KViYzzpahou/pz7CchKgD6T9v/jHrECgyGwXaMpJ83g
--> ssh-ed25519 aY2AXA IKzNs61QdKaTUDfCaerk//hj7aJuspjPHdjLUIZnkjQ
-xRRWvEZNYiFU227kqNMH9PzuK1Q1czzTb72ZQ6WeUUE
--> ssh-ed25519 Nl/5yA CK4Ny0Lqv8uw3wKvBZX7OFAq9UG83IAFO8SV54kpdWA
-PJClgWC2EhB/zr0u42QWtXlskQv4DeeDkmUku/Mqkco
--> ssh-ed25519 GdLgCQ Ldy01TmkbvmuG8QDo39zaZK1JMBy8H2gZ9gd+xvv4xY
-5ewsObFjmZCh7VIoPBLsrRz9pXQyvCBKOsyEW1TJDIM
--> ssh-ed25519 tOH/HQ Iz9rOSoY2+SjOmCgYJkvkqfwgg+trZGcrCl5TemzZz8
-L+yoX/1/odfI4zcjcL9ccW9QG0TxoQF1peenqMvS5ng
--> ssh-ed25519 FpzvfQ 1hz0IwEtpIgxbVKK2q1Gb2HMNykWxOrAcjAGK6Xwamw
-tIQt2yKSXABnJAKuXXVkJe4C/XYa7afGE/WsD2nZ7kE
--> ssh-ed25519 kdPvzQ goTQzffzeBmlCSiVmehfE1QNcWau3Mp+6A2ulbhRt0o
-Q675UHTn6RiDOMd0Zaioo25qBAuHFgkfwFQAICLCBYs
--> z-grease '%#V0Cvt
-jEaoqrlfOBAv7IV/lHaHKhgegTyoSeThGpMyCDyG7V5rdyuthXFqOyAPJr1gTWit
-6RIFDoTBamp9+s1H7Ie0BVRN9PM+qyxy0ezzSXiib9ddW2A0TsKHR4M
---- kfIy6IcNlk5+RUWpSUbzhNEqP6RmPuuVsr78T5n/36o
-Lÿ\o8Ck=c[âǧ ‡§�Sd&¿h°Â6/ðûÁëfÔzÐ@Bžœª5®3� Ý¡RTÛ#”¥~	ík�Oq—s‡·}#°ÛÀx¶1T?fEŽ³ìžö
+-> ssh-ed25519 mOmPfg 1S+O/4h+KtXv/KT7jumzZjbVRjI5fWWP9s2qpYWNNiM
+rI4PYkwXE2nLWAxxjREBswKb9N/ZmU26D91XtmcL1gQ
+-> ssh-ed25519 YJiRbw aXG0M0Nfa0zt01LpXqynqrxbbTT8AlyZYrNKVOPHhXA
+mWE7ed0KNPcE7ZR1r1KdBAxHM29F46GxwFw7w0R9awA
+-> ssh-ed25519 aY2AXA iC9GKmK60/1kHYZyN3DoILqsvPZUDWY5F31kTefOc34
+gdkASIQcUvogORDIhHdT/wo+0jP53VIqeYCRzPmAU8o
+-> ssh-ed25519 Nl/5yA gG0I+WlVA1jfcQ+WlrgzlfpsvxzOOLr280Fx9s+sNRw
+9Vlh1tJ2ucjXEzFKjamj7/tDGsBrg5+VYdYHhX8GPio
+-> ssh-ed25519 GdLgCQ Pf9rjnx2w6QZJ+sA1pOD090ODdVBLjDbWD573CZTj3U
+WFPlHf7MVKLAC4zyggvr2yqbMYq5LBsO1nW2/eT/2fA
+-> ssh-ed25519 tOH/HQ j61wyz9nJqfXtw9q+XhqJI7XLGjwO1ecWDXYvpzxlzM
+5y/197ptsDvrSFlaRtb9KbEDp9FKN3y1ggNTo0LZGss
+-> ssh-ed25519 FpzvfQ QA3+JlcexQQCzy60UqJ12n5WrgXj6/raiYvezsftDUQ
+4hzapxkfBUgtSy8jv8xaH8qO6c5/U8hSfgsOWTCXtqY
+-> ssh-ed25519 kdPvzQ lTiMAWCoQ7wSNSWTzJ7wgt/SPXcq7rTHli3cZKEH3zI
+IqnTB97pG06TE/H7EelI7lRejDDmeeNAmlcA3iXcmsw
+--- dMfqSq2yC7lsn66dsfNVyhcIlYeKMvsc+asI5Olvz7k
+>諧
5陟ｻ(IO贖ｴｭ�Sv�ttﾘ妣辷ﾁ�｡ﾔ�]tｸ5	mgﾝM({]ｽﾕ柱翼華ﾊK瀲d蘂"ｻｱ､ｱ湧,ｩﾊﾐBa'ｬｽ4S5�

secrets/linode-forgejo-runner.age

@@ -1,24 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 oyEmTw Ee6sHuaax6dl1ymOessJyXNOn6Yqdx+TmvXtWVCDHUU
-/6mfY5/olSO0tlPzUBCzkcmBFNnUucCakSAvEppc7Kg
--> ssh-ed25519 mOmPfg bEIwmTQPh+ckpBvU+zuQJFLguXLOV6H8XAcA6sla5Uk
-a00/OUNo3O239ZL0Xh6Do7iw2wP4f00Ct5bHX2E1t2M
--> ssh-ed25519 YJiRbw /UBwRGBmkTJ7lGGngi9Yq9dscC/1ZA1y1XAIf0zYSmU
-u+Q4aX+oO0BQ90iStA7mCww+4MSUPePuxuidtwFNusg
--> ssh-ed25519 aY2AXA MdCq40DKOrF5qhwDy3aOjiFczim6V5mc6vetpy+LSAY
-yoahpHv1FsynU8QUTkt6DJefcyuCz94/4AZLM2IZRsE
--> ssh-ed25519 Nl/5yA qvk0cLBlAk/h+PRndzX2EQUrgb7NV9/x/+m5a/ZWtQQ
-72emoDa8zBCCSJgT2eEDxhydMSuEdbywCarcmjlGz7U
--> ssh-ed25519 GdLgCQ IBx6NonXSJIO2gGKfzfJbxW0KaqFstwwC3D6fVpg6jY
-rvr21zirUS+R9zCyPV5O/cqzVe9NVevlfrBRRAJNAos
--> ssh-ed25519 tOH/HQ eyUGDyQGogdQ7Wyj10HFS/GBZsur86ssYeX1yEV4NS0
-iYkMk9w5cpaKgvXomTYXPSXKJXvsIYNbqIaIM1aRQZc
--> ssh-ed25519 FpzvfQ 18RQYBBhudWXP6KTjTkuyclfNAIoVMwlAsJzMa/lFTU
-Cs+yqVQ/dnhRj7XWnBo+sq0Jzy8EAHxrxQ/xlThY/58
--> ssh-ed25519 kdPvzQ fRInO3CmYQlEoaXKMekM8uGr+PTR3fTRSVQH16WDhQs
-y7oVEp7MowBn3SeGzvtWS9dWKRXqwgzs7SFKKYzYs1c
--> VqCj-grease cM
-l13Rk35e1jII+LYs8kLlxPFqxG+6RpGfyD6y7ECvawQ3LFeVGS5tK8mw0lmA1837
-gDmHFduATwN+Vh+1ma1xmTzZW/8q01ChxRtw61b+s2WvdskJRnqURiUj
---- ydn3UpzhLestaGGFt4qPWfzAAsG48Dvv4XiNnscOlX8
-O™l—ÓEšÇ+Áê'¢çîG‚çyð¾UsE·7j+V|6ÓÍ©Ëž¨üëëeó¯èŒÚíb{Ôç�Þ)y©²üuEùœKÌÓâ�ŠúnT™mz
+-> ssh-ed25519 mOmPfg 2G5NU0YqTsV1tEd6OEPQq5Mz47zxOhyl+N40AQFWGUg
+9HICW3CX8Zu72b70AJ0DLU0UZdARGzjgiuGtO7tuMyE
+-> ssh-ed25519 YJiRbw Nhj7z919U4Zua3KqD69z43Gl8D/UlcbO/Ka/prqC3nE
+BYGMIuheJ/M/jAuENAkhpT17QeFMNwvh62atAMVTzmQ
+-> ssh-ed25519 aY2AXA 1K8CdLdKOkqtbLzbQ59K4Ian4oI0aBLWA2gt2b65ZQ8
+LaZfOk9friVrPyFgDnuKPwVV07Q39mhseK2MIY3Q21Q
+-> ssh-ed25519 Nl/5yA ZmaGiys35vAP0S9RXwnP2Rs6LDsGrxXkVkER4lA7jgI
+WbV3Yem3gcnH/6kP4TE/uJKj4046xzbKYNGXGB7Lw+E
+-> ssh-ed25519 GdLgCQ lT07BOROuNbkmgyFGStm4mWQqPVYZHww+kAXQJEAwwg
+enfauL3YtQIZ8nQEUi1jkqr+kzk4mA1tWdW+PfTl5OQ
+-> ssh-ed25519 tOH/HQ 9qKXwlbH67xrNWhr5WuxgJ3i+M9jyT50sWc2fdSEmy8
+xOVZUX/Z3PZK9uVKyaK++g2oc2MMaN0uVReAPh0naEs
+-> ssh-ed25519 FpzvfQ /Kx8WrMw4jG+ufzDBKgQgDQZick+WxGOTBlaK2jOdAw
+Fsa+SzNcgnxQR9hZXR7l+gAQxY/c1wZH9Ftz8aF392k
+-> ssh-ed25519 kdPvzQ PWfMYf9DSnxhYXnEf4kEQ9Z4zZJmzwC0hmsz2c4fWFc
+FMq/kfEv8AXxvFUKQ2WktsW8Kc4ehHMr407+xjwr/rU
+--- hMLIVir6WZ+pyg6DfbwOrFAu6go5X/r5ba5T8GNJcI8
+dfã->ÖšþyG_ô�~NÃ˽�K—€Û··<Æ‚
¥hIJ¦öÞDk˜°ÅMµ²sRÍöJ
AëýÜ¢NËýÃ+†ÀSL.ኸã�

secrets/matrix.age

@@ -1,23 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 oyEmTw hbxTniFYHleC74gD9ipfbIAh5d4pPj2DkDkW7oFjxyU
-lYz2RHrr2xBPmNaLYbu8w/mjLuuvf/Rca+znPNhykmA
--> ssh-ed25519 mOmPfg Q4hNJGkGiO5F6FE5vMLBjHXgH3MMYeROL3OrVI8iHEY
-kZFI/ywUTVb6mczZTvuTroA+UKESSxfAE5nN39nd+Mc
--> ssh-ed25519 YJiRbw U7F4H/y2fki5BjRcoj6WSM4/moVc4LK6IL32/svL0TA
-7Z2wp62ngdPkKQc7XY9zmKLoNfc4Oi7MJTAuAnEIjus
--> ssh-ed25519 aY2AXA z+KbzHrWkOz0EEXSb8P1YXkySBRAS9WKhX4Mk/IyLxg
-8gxsvjm2ekYtPiFer20dyxkuUjOpvlvg5EgwEZzkv1c
--> ssh-ed25519 Nl/5yA /Gm9CD19quwWVBx9gCQsvy6tFb48xaZKFS3lYyAh6SQ
-HtiW2rOYkBTVIuI+Y2/z1FEQJwxSJf4K7Q7eK4LNhUM
--> ssh-ed25519 GdLgCQ jK2LK+MAIDxKU94XnHOg9v8seO9VKE42jr51zRY4PHQ
-IaqFbzdMu80cKeByc0Y4dVRPci5CVOtZ4F0f9P9G3SA
--> ssh-ed25519 tOH/HQ SG5pz5P2jlg0A86syvjNv6MK89aMPro8P8Su+lwaThI
-5SSF5u51C2TUJym8GdK56dgvNsVLmcSUrDCLOr88aTM
--> ssh-ed25519 FpzvfQ jqFIr4c8IRgA1wPkzdutJZJ2UTeKJUy/qUKCp5C9E1g
-qrcnB4L3Jd/euaQK6RLjsvxqB5rEupTqeQjxzd38JyY
--> ssh-ed25519 kdPvzQ B/VS2CZLrj1UMSwm0p2k4JQra7jdpuqA2k8aHKFqQmo
-sB+UWXYGCPRcirH9nIEw88D/7KvCVPZUgBevxX3pv1c
--> -A-grease
-G0JeaURRjTw+XEwEzv3M0HB6xNzO5+inlBR2eWGltrN0uKP4P8GbbfrI
---- C3BZePDnl+fl+JQUqk/XC3gIbkcfdAYjfm9oF6EJ1as
-NGÒ>Ð ?€JÃ�e�òTÝÍu:ŒÆ7<q9ÊÏTG"H°Výh½ö6jò¤ä0¥`0ñдt©€óhAÜ1äEœuª4#”{: ¦®	ßq³äÌÉpD q©�þ›€
+-> ssh-ed25519 mOmPfg yOULBTP94sJiyma4Yzp5SCIbEKdFkJEPi962XZA7CFA
+QsdyfwKgX95rxlZhYmKe8UxgHPpLtX3C1nBF+649Wfo
+-> ssh-ed25519 YJiRbw XZ2AJPQz+v1D4DBzUMOIXr07lrn6hQsWYQW+8AzwBko
+VLTi/f9VnRPI48DBny3GLhD9XQsbAYCbaf2ZB2s19EM
+-> ssh-ed25519 aY2AXA JBoYNE5DIAxi2NED/jo3raVTy7WBvRS4nqAOBF8UJgM
+88VW3KGO6WoZEwqen6pDX8gBlOe2z8Jxo6Je1mKpB8w
+-> ssh-ed25519 Nl/5yA fsU86ATOCufWpDqEQJ70rEe9ztsRCyfQDC9vg4/hFmI
+eYy38nXMFe0oBkBUjsiHqJxujkXIB2VH1FQRviTfLuM
+-> ssh-ed25519 GdLgCQ BLCsfZiE9uoOyTXYCLrrTxM5uyPpC/oPxjn4ciiauWE
+3VzsAVb8M47sUq8m/CeCx3CYPyDzo7mfD3GuwMRU9BY
+-> ssh-ed25519 tOH/HQ lTW1co7HylJEEY6eNl+iniuAe1N4/kCYlPkGuniNnCA
+WW5Nz1F+mRTNWoaSMqTNlGbZOzLLfh3PrXX6tahuS08
+-> ssh-ed25519 FpzvfQ tYSQ6Ipm0Lk5c4/A9H3LJ+ZaHvKMTuL84RbfKaGI/BU
+fJGJRDlceoPy+FDeGlCIvQj/t4HScGTEYAQ31zPIvy8
+-> ssh-ed25519 kdPvzQ ZfEHG6OphdhbAtDPZ7bY0mfsTheaCkCrGdFsXdw5izM
+KucJj2PM4AQSAN8z5dtMQ3lNxQrzoX/ru7cfjZxS+mg
+--- UZ6cw1upnDZDSEI2N0Afj09MhFajhKqUhn9DeZxXspg
+Îù„œ
Sg0@…ý
+ÛŸm«¸ãÌéUŽŽØhŒÔtµ‚/f³(]¥7™#§ü÷KäýHÞ-g¶âxà{¿SqÌû<ËËY’�	¡®:0õ©·7ù2µ
Crʿ
ö]¤I;müoÑTs

secrets/nextcloudadmin.age

@@ -1,23 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 oyEmTw LZKtu9SMMJu2sampgNCt8ED2O3ahJXJO7L1R8jF7ERc
-sLUcvIGBnPvznsvY+2M6UYj9QXAYguwNYTXBs9DpHMw
--> ssh-ed25519 mOmPfg RG9XN6Oewa0IlDojj7l95PJLZ+2ZTJr27aqxPHWNQxM
-/YkGe1LEfWBNqN3oHfr2+wlimSeIYTz4ZyNqKGr7WZ0
--> ssh-ed25519 YJiRbw mNibzxIqGjh4VdUj81uY/aNAOLha3zK7WcuLJJJlfiI
-f/tYgb2n3NF382ZaMCDEnF2fZDS4Cj7EeHlSWX5AZOI
--> ssh-ed25519 aY2AXA Jve/PI5ujBMbzFoPtbLzYNRkSO2ko5x4cA4eHlBZQXw
-qp2a8FH7iFkvXdiZIkzkaH0o4F8pMIkamikozkAgQ+M
--> ssh-ed25519 Nl/5yA d8bVRU9KOeGpJcg2PwWvnm8qnT8CEsBru4JHbiyed24
-Z6I5Xhvhq1EWMuV/H7xiRYsx4F9QSxM/Xnd8VaHls8g
--> ssh-ed25519 GdLgCQ I1XoGkAandUnNszJypbu4uMN0ejo0fokWsU+CgXP2Wo
-rLnZqCqsZgjElmVOfefVZtKiu00mJqjt66YysgdT3GA
--> ssh-ed25519 tOH/HQ 1ekPwz1O/m/FsdwXtks/B5oTuZLwhvqXn5aiP3WqRy8
-PQ2dsYBhm8i4oUWeU430iCdwEf+NoMqfR3uHstdFVHc
--> ssh-ed25519 FpzvfQ CuqgZOBrQFCCwQslHBXJmiZx5XrFKP/w3JGT0yTkFGQ
-RAHWAXNWnm3gTIjTcfH+5bQ+AeikiSQ7ejCv9xQyF5A
--> ssh-ed25519 kdPvzQ EUwAYcsrZb/kvvBvTAqbcDIt2uRVdsItSyC0rDP/uUQ
-/jet2+ewq/rkZMt3Air3CDio1qkJXmN+jzTvqkMmQpk
--> Z-grease /D aI fQ9
-UPslB3eMDsmzbw
---- M/PtjTsIhWWbmnlXu+8v18AFhvcph2SWiG98GLeDoOU
-Ö»ˆ^?r,­€|è¿i3ß␍Ä@ÒËE?.ôÎ2~…ûýl>9îÖ	�ö~
+-> ssh-ed25519 mOmPfg Fti3/hZ2LNZTtHDt44QQKVG8KtI1ew6UcRnGdCGpZTg
+wMOhWTHd2BfzIetxNrU0KdrSn6b8JKBtxGxoykJIolA
+-> ssh-ed25519 YJiRbw PZ6i/cik5zD2Q304YDTjQJ1v37tTng8TgPbU40Gw5j4
+NAU+9KnxeTn4UXiZtXQYCZfW104crGpCS0Nd08aUu48
+-> ssh-ed25519 aY2AXA X9YU1qT6v3jh3CUiHXCA/TWCNRN/mx+BWbpK4z7pGAk
+N0pRGVfX37pzi+3GX4okj1b5QA8Y+Y3bErUJekTBYYc
+-> ssh-ed25519 Nl/5yA fSQ1Ip11xRvPjvjFr6O9SGFi/8Hd5hYZ84Eao0v9YmM
+NpWf40Pyjl6NaEhG7wtalnF8eSKzd+XFMwB8IYpBfwo
+-> ssh-ed25519 GdLgCQ X39sru2i8g7oTAiVXhg9urlMMAPC4WZcZ4ipjzFGxR4
+gfQBzREuupeNwyD7XtCEUCSoRbAvd8bwyRLomKAk6rg
+-> ssh-ed25519 tOH/HQ jGh7wljbo4AnxEAs+vufic3j6Y+57Z0qLq5ZOS0YfEA
+OeuNT4JxkoBX0XmewlxaPeuUgKGgf/BJlppl4CuFGwk
+-> ssh-ed25519 FpzvfQ yB453fvNrlmZQydBS42OTtGapAZwCyjgsLmze5Rrhk4
+vI2jeR6Pl17k+EUo67sVIhXpqu1C0fNo8vtReMu3/A0
+-> ssh-ed25519 kdPvzQ njpxHD3aNvKyDIM0sRKD5A3/Iplg5U5FTlk9yYtFdjE
+HukoZ4nrNohTKfua4kCLGZOUwXSUmSqQvMUJUpTaz6Q
+--- z1qWoUGQYj6xHAOpXiQpEC9ImwqLXkjYRRYFx/WnxJU
+3ô¼w4랤C¢’Sò~‹>7ÒT÷0a&l/lmòp]çï}õ«

secrets/secrets.nix

@@ -34,14 +34,14 @@ in
 	# Then you can reference the file at /run/agenix/matrix
 	"nextcloudadmin.age".publicKeys = everyone;
 
-	"drone.age".publicKeys = everyone;
-
 	"3proxy.age".publicKeys = everyone;
 
 	"linode-forgejo-runner.age".publicKeys = everyone;
 	"jude-forgejo-runner.age".publicKeys = everyone;
 
 
+	"dendrite.age".publicKeys = everyone;
+	"dendrite_key.age".publicKeys = everyone;
 	"gitlab/secret.age".publicKeys = everyone;
 	"gitlab/otp.age".publicKeys = everyone;
 	"gitlab/db.age".publicKeys = everyone;