chore(gitea/anubis): remove anubis-secret from kustomization

Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work
challenge that protects web services from AI crawlers and scrapers.

Changes:
- Add Anubis as an extraContainers sidecar in the Gitea HelmRelease
  - Listens on :8080, proxies to Gitea at http://localhost:3000
  - DIFFICULTY=4 (default; tune up to increase challenge strength)
  - SERVE_ROBOTS_TXT=true (Anubis manages robots.txt)
  - OG_PASSTHROUGH=true (OpenGraph bots pass through for link previews)
  - Signs challenges with ED25519 key from 'anubis-key' secret
- Add anubis port (8080) to Gitea service via additionalPorts
- Update Ingress to route to the 'anubis' port instead of 'http'
- Add anubis-secret.yaml placeholder with creation instructions

One-time setup required before applying:
  kubectl create secret generic anubis-key \
    --namespace gitea \
    --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)

.gitea/workflows/update-flake-lock.yaml

@@ -1,13 +1,13 @@
 name: Update flake.lock
 
-on:
+"on":
   schedule:
     - cron: "0 0 * * 0"  # Every Sunday at midnight UTC
   workflow_dispatch:
 
 jobs:
   update-flake-lock:
-    runs-on: [bare-metal, nix-latest]
+    runs-on: nix-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.gitlab-ci.yml

@@ -1,23 +0,0 @@
-stages:
-  - eval
-  - build
-  - push
-
-"Evaluate for builds":
-  stage: eval
-  tags:
-    - kubernetes
-  image: "$CI_REGISTRY/greg/ci-images/builder:latest"
-  artifacts:
-    paths:
-      - gitlab-ci-continue.yml
-  script: nix run ".#gen-build" > gitlab-ci-continue.yml
-
-"Trigger builds":
-  stage: build
-  trigger:
-    include:
-      - artifact: gitlab-ci-continue.yml
-        job: "Evaluate for builds"
-  variables:
-    PARENT_PIPELINE_ID: $CI_PIPELINE_ID

.pre-commit-config.yaml

@@ -17,7 +17,7 @@ repos:
       - id: mixed-line-ending
       - id: trailing-whitespace
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.37.1
+    rev: v1.38.0
     hooks:
       - id: yamllint
         args:
@@ -30,8 +30,9 @@ repos:
               comments: false
               comments-indentation: false
               document-start: false
+              line-length: false
   - repo: https://github.com/NixOS/nixfmt
-    rev: v1.1.0
+    rev: v1.2.0
     hooks:
       - id: nixfmt-nix
   - repo: https://github.com/astro/deadnix

darwin/baseline.nix

@@ -1,30 +1,40 @@
 {
-  lib,
   pkgs,
+  pkgs',
   top,
   ...
 }:
 let
-  builder-config = {
+  system = builtins.replaceStrings [ "darwin" ] [ "linux" ] pkgs.stdenv.hostPlatform.system;
-    darwin-aarch-builder = top.self.nixosConfigurations.builder-aarch;
+  builderConfig = top.nixunstable.lib.nixosSystem {
-    darwin-x86-builder = top.self.nixosConfigurations.builder-x86;
+    inherit system;
+    modules = [
+      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
+      {
+        virtualisation = {
+          host.pkgs = pkgs;
+          darwin-builder = {
+            workingDirectory = "/var/lib/darwin-builder";
+            hostPort = 22;
+          };
+        };
+      }
+    ];
   };
-  builder = arch: let
+  builder = {
-    b = builder-config."darwin-${arch}-builder";
+    command = "${builderConfig.config.system.build.macos-builder-installer}/bin/create-builder";
-  in {
-    command = "${b.config.system.build.macos-builder-installer}/bin/create-builder";
     serviceConfig = {
       KeepAlive = true;
       RunAtLoad = true;
-      StandardOutPath = "/var/log/builder-vm-${arch}.log";
+      StandardOutPath = "/var/log/builder-vm-${system}.log";
-      StandardErrorPath = "/var/log/builder-vm-${arch}.stderr.log";
+      StandardErrorPath = "/var/log/builder-vm-${system}.stderr.log";
     };
   };
 in
 {
   environment.systemPackages = with pkgs; [
     agenix
-    hms
+    pkgs'.hms
   ];
 
   fonts.packages = with pkgs; [
@@ -32,23 +42,13 @@ in
     nerd-fonts.hack
   ];
 
-  #launchd.daemons = lib.genAttrs' [ "x86" "aarch" ] (arch: lib.nameValuePair "builder-${arch}-machine" (builder arch));
+  #launchd.daemons.darwin-builder = builder;
 
   nix = {
+    #buildMachines = [ { systems = ["aarch64-linux"]; sshUser = "builder"; sshKey = "/etc/nix/builder_ed25519"; hostName = "localhost:31022"; protocol = "ssh-ng"; }];
     enable = true;
-    buildMachines = [
-      {
-        hostName = "ssh-ng://builder@localhost";
-        system = "aarch64-linux";
-        maxJobs = 4;
-        supportedFeatures = [
-          "kvm"
-          "benchmarch"
-          "big-parallel"
-        ];
-      }
-    ];
     gc.interval.Hour = 3;
+    #linux-builder.enable = true;
     settings.auto-optimise-store = false; # Darwin bugs?
   };
 

darwin/default.nix

@@ -19,6 +19,7 @@ let
       specialArgs = {
         inherit metadata top;
         inherit (top) self;
+        pkgs' = top.self.packages.${system};
       };
       modules = [
         {
@@ -37,11 +38,4 @@ let
       ++ lib.optionals (builtins.pathExists ./hosts/${name}) [ ./hosts/${name} ];
     };
 in
-(
+(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) (name: mac { inherit name; }))
-  lib.genAttrs
-    (builtins.attrNames (builtins.readDir ./hosts))
-    (
-      name:
-      mac { inherit name; }
-    )
-)

darwin/hosts/gregory/default.nix

@@ -31,6 +31,7 @@ in
       "bitwarden"
       "bruno"
       "chromium"
+      "claude"
       "dbeaver-community"
       "ghostty"
       "firefox"

darwin/hosts/lithic/default.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ ... }:
 let
   username = "greg";
 in

flake.lock

@@ -25,19 +25,17 @@
     },
     "buildbot": {
       "inputs": {
-        "flake-parts": "flake-parts",
-        "hercules-ci-effects": "hercules-ci-effects",
         "nixpkgs": [
           "nixunstable"
         ],
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1776626072,
+        "lastModified": 1779096866,
-        "narHash": "sha256-NF6x9h74mrA0Acl1JHWwuSSrwzyTm3KyV8a85QUqTW0=",
+        "narHash": "sha256-8HtF1G7OPMXzo+f+0W+7zwzhuBUSk2EMrOS4ZvFw7+I=",
         "owner": "nix-community",
         "repo": "buildbot-nix",
-        "rev": "f298855ee69709374a25ae9543ad11bd549d7b8b",
+        "rev": "891f2baba218f4365f0c6ef96ea33f9b277f5ed0",
         "type": "github"
       },
       "original": {
@@ -97,11 +95,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775037210,
+        "lastModified": 1779036909,
-        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
         "type": "github"
       },
       "original": {
@@ -128,6 +126,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -145,17 +159,14 @@
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib"
-          "buildbot",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1775087534,
+        "lastModified": 1778716662,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -166,14 +177,17 @@
     },
     "flake-parts_2": {
       "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
+        "nixpkgs-lib": [
+          "nixvimunstable",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1775087534,
+        "lastModified": 1778716662,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -183,27 +197,6 @@
       }
     },
     "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixvimunstable",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nurpkgs",
@@ -239,31 +232,6 @@
         "type": "github"
       }
     },
-    "hercules-ci-effects": {
-      "inputs": {
-        "flake-parts": [
-          "buildbot",
-          "flake-parts"
-        ],
-        "nixpkgs": [
-          "buildbot",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1776380511,
-        "narHash": "sha256-3A2B8k6YCuzt5pT/CQEltUghtE6heSlk2tMYkg/fUWI=",
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "rev": "4a80b7e95a298b7bb4418c0a2b55fe95a662c377",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "type": "github"
-      }
-    },
     "hmunstable": {
       "inputs": {
         "nixpkgs": [
@@ -271,11 +239,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776904464,
+        "lastModified": 1779125151,
-        "narHash": "sha256-sBUCj7/4d3Hoevpu3oQp8ccJNA1EDeVmFi1F8O6VJro=",
+        "narHash": "sha256-bPHT0oJAHe5a43lkkSGAiCEg/RBqpwv5xsFrcj+Bog8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "667b3c47325441e6a444faaf405bba76ec70338a",
+        "rev": "fab3fd7327a0ac7a1fae5095bf140377704fac7f",
         "type": "github"
       },
       "original": {
@@ -306,6 +274,45 @@
         "type": "github"
       }
     },
+    "minecraft": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_2",
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1778039471,
+        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "type": "github"
+      }
+    },
+    "niks3": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1778839878,
+        "narHash": "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=",
+        "owner": "Mic92",
+        "repo": "niks3",
+        "rev": "c29f3641de064545d75f00318cd45bea2b4ea1d0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "niks3",
+        "type": "github"
+      }
+    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -329,11 +336,11 @@
     },
     "nix-hardware": {
       "locked": {
-        "lastModified": 1776830795,
+        "lastModified": 1779099457,
-        "narHash": "sha256-PAfvLwuHc1VOvsLcpk6+HDKgMEibvZjCNvbM1BJOA7o=",
+        "narHash": "sha256-u73aVD/lUmmT3JV+kPDztl7zPwQKd0eobD1AbJltaGs=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "72674a6b5599e844c045ae7449ba91f803d44ebc",
+        "rev": "8792fab9d4a6454a9201675f01326f827ce35ead",
         "type": "github"
       },
       "original": {
@@ -360,11 +367,26 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1774748309,
+        "lastModified": 1777168982,
-        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1778984393,
+        "narHash": "sha256-r755Kh5Q0XBTPNuv9rL2rsUJTq8BDhb+lIwRWhl6yYA=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "0d14a58ab7aa3f513c58ccc9e47e77ffd92be204",
         "type": "github"
       },
       "original": {
@@ -375,11 +397,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1776548001,
+        "lastModified": 1769461804,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
         "type": "github"
       },
       "original": {
@@ -391,27 +413,59 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1766025857,
+        "lastModified": 1778491576,
-        "narHash": "sha256-Lav5jJazCW4mdg1iHcROpuXqmM94BWJvabLFWaJVJp0=",
+        "narHash": "sha256-9YOHDS9ANGbRmf3DSQ9UCvas3CyYNIBwBkKGQZTLXGY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "1174f92bf37f1a5914be77e1b44482d6fbc75ecc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1777207419,
+        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
         "type": "github"
       }
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1776548001,
+        "lastModified": 1778869304,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
         "type": "github"
       },
       "original": {
@@ -423,18 +477,18 @@
     },
     "nixvimunstable": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": [
           "nixunstable"
         ],
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1776830812,
+        "lastModified": 1779116047,
-        "narHash": "sha256-L2q0bpa6evlzE4IfIQ7JWqhTAuINggUSIxMmOAxUsCg=",
+        "narHash": "sha256-2BnXm4/BvR5B0CH8nxC4CL+y+Z7woqPbPxKO7IMH85U=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "53aad7a9aaadaec21d740117ba0f0531b9a9b3cd",
+        "rev": "1367315826ebda2bebbf896029f44ac05df523f5",
         "type": "github"
       },
       "original": {
@@ -446,15 +500,15 @@
     },
     "nurpkgs": {
       "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1776910402,
+        "lastModified": 1779124721,
-        "narHash": "sha256-SvRshrmzz9SmiiflE+Ph2RQ2YJkmQRpluebVt94mHPQ=",
+        "narHash": "sha256-Z1q8QkuHAdkmXh4SItOzViVVFVLb+tzaEaYCTHI2UKk=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b3ab759ea8da0d514dbbcb89e269fd59676a92ae",
+        "rev": "ad57d8faf36bb02c65c90012cd0289daa0b2d9c4",
         "type": "github"
       },
       "original": {
@@ -469,9 +523,12 @@
         "buildbot": "buildbot",
         "colmena": "colmena",
         "darwin": "darwin_2",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
         "hmunstable": "hmunstable",
+        "minecraft": "minecraft",
+        "niks3": "niks3",
         "nix-hardware": "nix-hardware",
+        "nixpkgs-lib": "nixpkgs-lib_2",
         "nixunstable": "nixunstable",
         "nixvimunstable": "nixvimunstable",
         "nurpkgs": "nurpkgs",
@@ -525,6 +582,21 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -546,16 +618,37 @@
         "type": "github"
       }
     },
-    "vsext": {
+    "treefmt-nix_2": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": [
+          "niks3",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1776828494,
+        "lastModified": 1775636079,
-        "narHash": "sha256-gQ5+syn8ndyF/+c5g5ZpeAScNKhkTF4/63JsO2hqGHo=",
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "vsext": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1779077424,
+        "narHash": "sha256-2nuxPFMR1R3IlV/OlF65qjs2gGjHhASa7U0+8QX0bJg=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "ea6764d22ff5478f5db39ede57eeafc70d14e8e6",
+        "rev": "b7bde1772cdb20e77381516fbbb5306a621d0965",
         "type": "github"
       },
       "original": {
@@ -566,17 +659,17 @@
     },
     "wsl": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "nixpkgs": [
           "nixunstable"
         ]
       },
       "locked": {
-        "lastModified": 1776910211,
+        "lastModified": 1777732699,
-        "narHash": "sha256-0ku3gW8bZ9TTpEU2fQw86oU6ZLT2vF6pacF+cLaf7VY=",
+        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "4e6cad241baa0115a7aae8c55b04c166da4997c9",
+        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
         "type": "github"
       },
       "original": {

flake.nix

@@ -23,7 +23,10 @@
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixunstable";
     };
+    minecraft.url = "github:Infinidoge/nix-minecraft";
+    niks3.url = "github:Mic92/niks3";
     nix-hardware.url = "github:nixos/nixos-hardware";
+    nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
     nixvimunstable = {
       url = "github:nix-community/nixvim/main";
       inputs.nixpkgs.follows = "nixunstable";
@@ -47,6 +50,7 @@
         top.nixvimunstable.overlays.default
         top.nurpkgs.overlays.default
         top.vsext.overlays.default
+        top.minecraft.overlay
       ];
       metadata = builtins.fromJSON (builtins.readFile ./network.json);
       systems = [
@@ -82,6 +86,7 @@
                   self
                   top
                   ;
+                pkgs' = top.self.packages.x86_64-linux;
               };
             };
           }
@@ -143,16 +148,17 @@
             pkgs = imported_packages.${system};
           };
 
-          packages = (import ./pkgs { inherit pkgs; });
+          packages = (import ./pkgs { inherit pkgs top; });
 
           checks = import ./checks.nix {
             inherit system top self';
-            inherit (pkgs) lib;
+            inherit (top.nixpkgs-lib) lib;
           };
 
           devShells = import ./shells.nix {
             inherit pkgs;
             inherit (top) colmena;
+            inherit (self') packages;
           };
         };
     };

garnix.yaml

@@ -4,14 +4,6 @@ builds:
       - "homeConfigurations.*"
       - "nixosConfigurations.*"
       - "packages.*"
-      # bitwarden-cli package is broken on aarch64-darwin
-      - "packages.aarch64-darwin.img-bitwarden"
-      # kmod-31 is not a thing on Darwin
-      - "packages.aarch64-darwin.qemu-hook"
-      - "packages.aarch64-darwin.vfio_shutdown"
-      - "packages.aarch64-darwin.vfio_startup"
-      # This one is a bit of a beast and shouldn't take up Garnix time
-      - "packages.aarch64-darwin.zim"
       # These are just images which I will build when
       # I feel like it
       - "devShells.*"
@@ -20,14 +12,12 @@ builds:
       - darwinConfigurations.MacBook-Pro
       - darwinConfigurations.MacBook-Prolocal
       - darwinConfigurations.li
-  # Some specific includes which are not specific enough to override the rules above,
+  # Some specific includes which are not specific enough to override the rules
-  # due to the intrepretation of the glob excludes, but which I still need included
+  # above, due to the intrepretation of the glob excludes, but which I still
+  # need included
   - include:
-      # These are Mac homeConfigurations, which I do not have the infra to build at home
+      # These are Mac homeConfigurations, which I do not have the infra
+      # to build at home
       - homeConfigurations."gregory.hellings-mbp"
       - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
-      # These are builder images used on my Macs, but they can't always access the cache
+      - homeConfigurations.ivr
-      # on my local infrastructure, so I build them in Garnix so they are accessible
-      # outside of my network, too
-      - nixosConfigurations.builder-x86
-      - nixosConfigurations.builder-aarch

home/baseline/nushell/functions.nu

@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis vm-gitlab]
+let servers = [isaiah jeremiah zeke genesis]
 
 def par-map [ items: list, c: closure ] {
   let results = $items | par-each -k $c
@@ -72,7 +72,7 @@ def dc [ $cmd: string = "sh" ] {
 def claude [ ] {
     unlock
     $env.GITLAB_TOKEN = ^bw get item 7d3da4e9-5f9a-49d0-8e14-b39c010a4001 | from json | get fields | find claudeapi | get value
-    $env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
+    #$env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
     ^claude
 }
 

home/baseline/shell.nix

@@ -26,6 +26,7 @@
       nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
       r = "run0";
       updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
+      p = "${lib.getExe pkgs.podman-tui}";
 
       # General
       k = "kubectl";

home/baseline/ssh.nix

@@ -5,7 +5,7 @@
   # This allows things like SSH in distrobox to read the config file just fine
   home.file.".ssh/config" = {
     target = ".ssh/config_source";
-    onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
+    onChange = "cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config";
   };
   programs.ssh = {
     enable = true;

home/baseline/xonsh_footer.xsh

@@ -38,11 +38,6 @@ def _ivr2(args):
     vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology")
 aliases['ivr2'] = _ivr2
 
-def _glrestart(args):
-    sudo nixos-container run gitlab -- systemctl restart gitlab
-    sudo nixos-container run gitlab -- systemctl restart nginx
-aliases['glrestart'] = _glrestart
-
 def _aws_creds(args):
     $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key")
     $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key")

home/default.nix

@@ -10,7 +10,9 @@ let
     let
       inherit (metadata.hosts.${host}) system;
       pkgs = nixpkgs.${system};
-      username = if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
+      pkgs' = top.self.packages.${system};
+      username =
+        if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
     in
     top.hmunstable.lib.homeManagerConfiguration {
       inherit pkgs;
@@ -24,6 +26,7 @@ let
           host
           username
           metadata
+          pkgs'
           ;
         nixvim = top.nixvimunstable;
         gui = false;
@@ -31,8 +34,4 @@ let
       };
     };
 in
-(
+(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) user)
-  lib.genAttrs
-    (builtins.attrNames (builtins.readDir ./hosts))
-    user
-)

home/home.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  pkgs',
   lib,
   host ? "most",
   top,
@@ -38,7 +39,7 @@ in
       gh
       git
       gnupatch
-      hms
+      pkgs'.hms
       btop
       inetutils
       jq
@@ -46,7 +47,7 @@ in
       nix-prefetch
       nmap
       openssl
-      setup-ssh
+      pkgs'.setup-ssh
       tmux
       tree
       unzip

home/hosts/exodus/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   greg = {
@@ -24,6 +24,7 @@
     minio-client
     mumble
     pre-commit
+    prismlauncher
     restic
     restic-browser
     tea
@@ -35,4 +36,13 @@
       settings.SKIP_HOST_UPDATE = true;
     };
   };
+  xdg.desktopEntries = {
+    prismlauncher = {
+      name = "Prism Launcher - Minecraft";
+      actions.minecraft = {
+        name = "Minecraft";
+        exec = lib.getExe pkgs.prismlauncher;
+      };
+    };
+  };
 }

home/hosts/lithic/default.nix

@@ -4,9 +4,11 @@
   ...
 }:
 let
-  python = pkgs.python312.withPackages (p: with p; [
+  python = pkgs.python312.withPackages (
-    ipython
+    p: with p; [
-  ]);
+      ipython
+    ]
+  );
 in
 {
   # Disables hitting local cache
@@ -27,17 +29,23 @@ in
       direnv
       home-manager
       just
+      mcp-grafana
       nixVersions.stable
+      podman
+      poetry
       pre-commit
-      (pulumi.withPackages (p: with p; [
+      (pulumi.withPackages (
-        pulumi-aws-native
+        p: with p; [
-        pulumi-command
+          pulumi-aws-native
-        pulumi-go
+          pulumi-command
-        pulumi-nodejs
+          pulumi-go
-        pulumi-python
+          pulumi-nodejs
-      ]))
+          pulumi-python
+        ]
+      ))
       python
       rustc
+      terraform
     ];
   };
 

hosts/baseline.nix

@@ -3,19 +3,24 @@
   lib,
   metadata,
   pkgs,
+  top,
   ...
 }:
 {
   imports = [
     ../modules/nix-conf.nix
+    top.niks3.nixosModules.niks3-auto-upload
   ];
 
+  age.secrets.niks3-api-token.file = ../secrets/niks3/api_token.age;
+
   console = {
     font = "Lat2-Terminus16";
     keyMap = "us";
   };
 
   environment.systemPackages = with pkgs; [
+    top.niks3.packages.${pkgs.stdenv.hostPlatform.system}.niks3
     agenix
     bitwarden-cli
     bmon
@@ -26,10 +31,9 @@
     efibootmgr
     findutils
     file
-    gcc-tune
     git
     gnupatch
-    hms # My own home manager switcher
+    top.self.packages.${pkgs.stdenv.hostPlatform.system}.hms # My own home manager switcher
     iperf
     killall
     nano
@@ -97,6 +101,12 @@
   # Enable the OpenSSH daemon for remote control
   services = {
     locate.enable = true;
+    niks3-auto-upload = {
+      enable = config.greg.nix.cache;
+      authTokenFile = config.age.secrets.niks3-api-token.path;
+      serverUrl = "http://hosea.nebula.thehellings.com:5751";
+      verifyS3Integrity = true;
+    };
     openssh = {
       enable = true;
       settings.X11Forwarding = true;

hosts/default.nix

@@ -15,11 +15,17 @@ let
     }:
     let
       inherit (metadata.hosts.${name}) system;
+      pkgs' = top.self.packages.${system};
     in
     channel.lib.nixosSystem {
       pkgs = nixpkgs.${system};
       specialArgs = {
-        inherit metadata top lib';
+        inherit
+          metadata
+          top
+          lib'
+          pkgs'
+          ;
       };
       modules = [
         {
@@ -45,16 +51,6 @@ in
     })
   )
 )
-// (lib.genAttrs
-  (builtins.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./vm)))
-  (
-    name:
-    (unstable {
-      inherit name;
-      extraMods = [ ./vm/${name} ];
-    })
-  )
-)
 // {
   # nix build '.#nixosConfigurations.wsl.config.system.build.installer'
   #nixos = wsl { name = "wsl"; };
@@ -63,26 +59,4 @@ in
   #  name = "wsl";
   #  system = "aarch64-linux";
   #};
-
-  builder-aarch = lib.nixosSystem {
-    system = "aarch64-linux";
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
-        boot.loader.grub.devices = [ "/dev/vda" ];
-      }
-    ];
-  };
-
-  builder-x86 = lib.nixosSystem {
-    system = "x86_64-linux";
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
-        boot.loader.grub.devices = [ "/dev/vda" ];
-      }
-    ];
-  };
 }

hosts/unstable/exodus/default.nix

@@ -43,10 +43,6 @@
       enable = true;
       tags = [ "mobile" ];
     };
-    runner = {
-      enable = true;
-      qemu = true;
-    };
   };
 
   hardware = {

hosts/unstable/genesis/default.nix

@@ -2,12 +2,18 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ pkgs, ... }:
+{
+  top,
+  pkgs,
+  pkgs',
+  ...
+}:
 {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
     ./networking.nix
+    top.minecraft.nixosModules.minecraft-servers
   ];
 
   greg = {
@@ -30,9 +36,122 @@
   };
 
   environment.systemPackages = with pkgs; [
-    create_ssl
+    pkgs'.create_ssl
     step-ca
   ];
 
   networking.hostName = "genesis"; # Define your hostname.
+
+  services = {
+    minecraft-servers = {
+      enable = true;
+      eula = true;
+      openFirewall = true;
+
+      servers = {
+        maya = {
+          enable = true;
+          operators = {
+            Almec = {
+              bypassesPlayerLimit = true;
+              uuid = "7884dc5a-ae21-43d5-9506-a934d59be19a";
+            };
+          };
+          package = pkgs.fabricServers.fabric.override { jre_headless = pkgs.openjdk25_headless; };
+
+          serverProperties = {
+            allow-flight = true;
+            motd = "Maya's Minecraft World";
+            online-mode = true;
+          };
+          whitelist = { };
+
+          jvmOpts = "-Xms4092M -Xmx4092M";
+
+          symlinks = {
+            mods = pkgs.linkFarmFromDrvs "mods" (
+              builtins.attrValues {
+                # Health info
+                appleskin = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/EsAfCjCV/versions/HwaLJe3v/appleskin-fabric-mc26.1-3.0.9.jar";
+                  hash = "sha256-iNCycR/oxqFpbPGfIcfgfWOm7PzPiIu5AmBWb8asTb4=";
+                };
+                # Needed by survivalfly
+                balm = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7959/843/balm-fabric-26.1.2-26.1.2.4.jar";
+                  hash = "sha256-zDtDxkxOftpW0wUIap7l6abGCjXNczwrF2wLZDztyA0=";
+                };
+                # Adds more diverse biomes
+                # https://www.curseforge.com/minecraft/mc-mods/biomes-o-plenty
+                biomes = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7977/180/BiomesOPlenty-fabric-26.1.2-26.1.2.0.3.jar";
+                  hash = "sha256-0aPtsRep0ftbkKqbp69PgUnNJyOBLY9vcPsB1mhOy/M=";
+                };
+                # Automation engines
+                # https://www.curseforge.com/minecraft/mc-mods/create
+                #create = pkgs.fetchurl {
+                #  url = "https://mediafilez.forgecdn.net/files/7963/363/create-1.21.1-6.0.10.jar";
+                #  hash = "sha256-74f+Vwnxuh9bi7IKKSW1r7RmnheP1ti/EMFndZ7v43o=";
+                #};
+                fabric_api = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/tnmuHGZA/fabric-api-0.146.1%2B26.1.2.jar";
+                  hash = "sha256-8Jy/xmxRtw4z4GJ+38wwbXHVn4NGYp4w/mFvW9cmvKg=";
+                };
+                # Required by biomes-o-plenty
+                # https://www.curseforge.com/minecraft/mc-mods/glitchcore
+                glitchcore = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7975/608/GlitchCore-fabric-26.1.2-26.1.2.0.0.jar";
+                  hash = "sha256-IDz+TblWvgt4UxFg3L3DhFMEESoX7y5cTOvXhyccQm8=";
+                };
+                # Tooltips
+                # https://www.curseforge.com/minecraft/mc-mods/jade/
+                jade = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7886/518/Jade-mc26.1-Fabric-26.0.8.jar";
+                  hash = "sha256-Pc3R5eO4Jf+94mNMPtY/vvpbomp+S+qnAUAVbQk1r2Y=";
+                };
+                # Gives info on crafting recipes
+                # https://www.curseforge.com/minecraft/mc-mods/jei
+                jei = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7920/925/jei-26.1.2-fabric-29.5.0.26.jar";
+                  hash = "sha256-7nF7fXYPIg9the/mxi6pUYEmKtosZO6yL2b0Dgf8+fI=";
+                };
+                # Machines
+                # https://www.curseforge.com/minecraft/mc-mods/mekanism
+                #mekanism = pkgs.fetchurl {
+                #  url = "https://mediafilez.forgecdn.net/files/7904/58/Mekanism-1.21.1-10.7.19.85.jar";
+                #  hash = "sha256-AE28nzEG9NGSrqoe4RkN0W7JyoBZ7T0JO4ADT0xXT0M=";
+                #};
+                # Shows installed mods
+                modmenu = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/mOgUt4GM/versions/jvjwXH6l/modmenu-18.0.0-alpha.8.jar";
+                  hash = "sha256-u0gtCOVAnNxyHcslo+y9l/jCGsFb+U/Y8soiUilhZDA=";
+                };
+                # Better storage engines
+                # https://www.curseforge.com/minecraft/mc-mods/refined-storage
+                refined-storage = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/8086/588/refinedstorage-fabric-3.0.0.jar";
+                  hash = "sha256-LuOF0aYQon78AQeD5fQ8OXHCnekfa+PNKpH7cqimFNs=";
+                };
+                # https://www.curseforge.com/minecraft/mc-mods/storage-drawers
+                #storagedrawers = pkgs.fetchurl {
+                #url = "https://mediafilez.forgecdn.net/files/7352/799/StorageDrawers-fabric-1.21.11-20.0.0.jar";
+                #hash = "sha256-eBKCmAtjAhdAjOyLMRneu/NZnNt+orIezxPy6V8g/S8=";
+                #};
+                survivalfly = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7870/312/survivalfly-1.3_fabric-mc26.1.1.jar";
+                  hash = "sha256-Kai4wSxckpXbs1yLp8wJ4BmmjNkdDbeqerqWGIz3+Zk=";
+                };
+                # Also needed by biomes
+                # https://www.curseforge.com/minecraft/mc-mods/terrablender-fabric
+                terrablender = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7933/873/TerraBlender-fabric-26.1.2-26.1.2.0.1.jar";
+                  hash = "sha256-lUrkmMIod54Qj78H0rzT4EYoEeiBG7w6sVOJlRvsnQ4=";
+                };
+              }
+            );
+          };
+        };
+      };
+    };
+  };
 }

hosts/unstable/genesis/net/hosts

@@ -22,8 +22,6 @@
 
 # VMs
 10.42.4.1 matrix matrix.thehellings.lan
-#10.42.4.2 vm-jellyfin vm-jellyfin.thehellings.lan
-10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan
 
 # VIP
 10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
@@ -37,7 +35,6 @@
 100.88.91.27 dns.home
 100.70.99.91 exodus.home exodus.shire-zebra.ts.net
 100.96.198.104 genesis.home genesis.shire-zebra.ts.net smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
-100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net grafana.home
 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes buildbot.home

hosts/unstable/genesis/networking.nix

@@ -102,6 +102,7 @@ in
         metadata.infra.lan
         metadata.infra.tailscale
         metadata.infra.nebula
+        "127.0.0.0/8"
       ];
       zones =
         let
@@ -114,10 +115,15 @@ in
                 "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
                 "\tIN\tNS\t${config.networking.hostName}"
               ];
-              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
+              makeHost =
+                host:
+                [ "${host.name}\tIN\tA\t${host.address}" ]
+                ++ lib.map (a: "${a}\tIN\tA\t${host.address}") (
+                  if builtins.hasAttr "aliases" host then host.aliases else [ ]
+                );
             in
             pkgs.writeText "${domain}" (
-              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
+              builtins.concatStringsSep "\n" (preamble ++ (lib.flatten (lib.map makeHost hosts)) ++ [ "" ])
             );
         in
         lib.mapAttrs

hosts/unstable/hosea/default.nix

@@ -6,6 +6,7 @@
   config,
   metadata,
   pkgs,
+  top,
   ...
 }:
 let
@@ -19,11 +20,30 @@ in
     # Include the results of the hardware scan.
     ./arr.nix
     ./hardware-configuration.nix
+    top.niks3.nixosModules.niks3
   ];
 
-  age.secrets.grafana-secret-key = {
+  age.secrets = {
-    file = ../../../secrets/grafana-secret-key.age;
+    cache-private-key = {
-    owner = "grafana";
+      file = ../../../secrets/cache-private-key.age;
+      owner = "niks3";
+    };
+    grafana-secret-key = {
+      file = ../../../secrets/grafana-secret-key.age;
+      owner = "grafana";
+    };
+    niks3-access-key-id = {
+      file = ../../../secrets/niks3/access_key_id.age;
+      owner = "niks3";
+    };
+    niks3-api-token = {
+      file = ../../../secrets/niks3/api_token.age;
+      owner = "niks3";
+    };
+    niks3-secret-access-key = {
+      file = ../../../secrets/niks3/secret_access_key.age;
+      owner = "niks3";
+    };
   };
 
   # Bootloader
@@ -98,6 +118,7 @@ in
         ];
       };
     };
+    firewall.interfaces.nebula0.allowedTCPPorts = [ 5751 ];
     nameservers = [ metadata.infra.dns ];
   };
 
@@ -150,6 +171,27 @@ in
         analytics.reporting_enabled = false;
       };
     };
+    niks3 = {
+      enable = true;
+
+      apiTokenFile = config.age.secrets.niks3-api-token.path;
+      gc.enable = false;
+      httpAddr = "${metadata.hosts.hosea.nebulaIp}:5751";
+      nginx = {
+        enable = true;
+        domain = "hosea.nebula";
+        enableACME = false;
+        forceSSL = false;
+      };
+      s3 = {
+        accessKeyFile = config.age.secrets.niks3-access-key-id.path;
+        bucket = "niks3";
+        endpoint = "nas1.shire-zebra.ts.net:9000";
+        secretKeyFile = config.age.secrets.niks3-secret-access-key.path;
+        useSSL = false;
+      };
+      signKeyFiles = [ config.age.secrets.cache-private-key.path ];
+    };
     prometheus.exporters.graphite.enable = true;
     # Configure keymap
     xserver.xkb = {

hosts/unstable/isaiah/default.nix

@@ -43,10 +43,6 @@
       tags = [ "home" ];
     };
     remote-builder.enable = true;
-    runner = {
-      enable = true;
-      qemu = true;
-    };
     gitea-runner = {
       enable = true;
       extraLabels = [ "bare-metal:host" ];

hosts/unstable/jeremiah/default.nix

@@ -22,8 +22,6 @@ in
   ];
 
   age.secrets = {
-    runner-reg.file = ../../../secrets/gitlab/nixos-qemu-shell.age;
-
     gitea-buildbotWorkersFile = mk ../../../secrets/gitea/buildbotWorkersFile.age;
     gitea-oauthToken = mk ../../../secrets/gitea/oauthToken.age;
     gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
@@ -95,11 +93,6 @@ in
       tags = [ "home" ];
     };
     remote-builder.enable = true;
-    runner = {
-      enable = true;
-      threads = 3;
-      qemu = true;
-    };
   };
 
   hardware = {

hosts/unstable/linode/default.nix

@@ -66,20 +66,4 @@
       immichUrl = "https://immich.shire-zebra.ts.net";
     };
   };
-
-  security.sudo.extraRules = [
-    {
-      users = [ "gitlab-runner" ];
-      commands = [
-        {
-          command = "/run/current-system/sw/bin/systemctl";
-          options = [ "NOPASSWD" ];
-        }
-        {
-          command = "/run/current-system/sw/bin/podman";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
 }

hosts/unstable/linode/matrix.nix

@@ -2,12 +2,24 @@
 # them by the following commands:
 # nix run nixpkgs.matrix-synapse
 # register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
-{ config, lib, ... }:
+{ config, ... }:
 let
   domain = "${config.networking.domain}";
   fqdn = "matrix.${domain}";
 in
 {
+  greg.proxies."${fqdn}" = {
+    extraConfig = ''
+      error_log /var/log/nginx/debug.log debug;
+      proxy_ssl_verify off;
+      proxy_ssl_server_name on;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-Ssl on;
+    '';
+    genAliases = false;
+    ssl = true;
+    target = "https://matrix.shire-zebra.ts.net";
+  };
   services.nginx = {
     virtualHosts = {
       # Server the '.well-known' files to find the Matrix API server
@@ -44,36 +56,6 @@ in
             return 200 '${builtins.toJSON client}';
           '';
       };
-
-      # Reverse proxy in front of the actual Matrix server
-      "${fqdn}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        extraConfig = ''
-          error_log /var/log/nginx/debug.log debug;
-        '';
-
-        # Not the appropriate place for the chat client
-        locations =
-          (builtins.listToAttrs (
-            builtins.map
-              (
-                val:
-                lib.nameValuePair "/_${val}" {
-                  proxyPass = "http://matrix.kubernetes";
-                }
-              )
-              [
-                "matrix"
-                "synapse"
-                "dendrite"
-              ]
-          ))
-          // {
-            "/".extraConfig = "return 404;";
-          };
-      };
     };
   };
 

hosts/unstable/linode/nginx.nix

@@ -24,7 +24,6 @@ in
   virtualisation.oci-containers = {
     backend = "podman";
     containers."homepage" = {
-      # needs explicit port to match what gitlab-runner sees when pulling
       image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
       ports = [ "${homepage}:80" ];
     };
@@ -35,10 +34,5 @@ in
       ssl = true;
       genAliases = false;
     };
-    "doubles.thehellings.com" = {
-      target = "http://localhost:8081";
-      ssl = true;
-      genAliases = false;
-    };
   };
 }

hosts/unstable/linode/postgres.nix

@@ -1,7 +1,12 @@
-{ config, pkgs, ... }:
+{
+  config,
+  pkgs,
+  pkgs',
+  ...
+}:
 
 {
-  environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
+  environment.systemPackages = [ pkgs'.upgrade-pg-cluster ];
 
   services.postgresql = {
     enable = true;

hosts/unstable/zeke/default.nix

@@ -28,10 +28,6 @@
     };
     nebula.enable = true;
     remote-builder.enable = true;
-    runner = {
-      enable = true;
-      vbox = false;
-    };
     tailscale = {
       enable = true;
       tags = [ "home" ];

hosts/vm/gitlab/default.nix

@@ -1,273 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  registryPort = 5000;
-  vpnIp = "100.117.28.111";
-in
-{
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
-  age.secrets =
-    let
-      cfg = n: {
-        file = ../../../secrets/gitlab/${n}.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    in
-    {
-      gitlab-secret = cfg "secret";
-      gitlab-otp = cfg "otp";
-      gitlab-db = cfg "db";
-      gitlab-db-password = cfg "db-password";
-      gitlab-jws = cfg "jws";
-      gitlab-key = cfg "key";
-      gitlab-cert = cfg "cert";
-      gitlab-salt = cfg "salt";
-      gitlab-primary-key = cfg "primary-key";
-      gitlab-deterministic-key = cfg "deterministic-key";
-
-      minio_access_key_id = {
-        file = ../../../secrets/minio_access_key_id.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-      minio_secret_access_key = {
-        file = ../../../secrets/minio_secret_access_key.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    };
-
-  greg = {
-    backup.jobs.nas-backup = {
-      src = "/var/gitlab/state/backup/";
-      dest = "gitlab";
-    };
-    home = true;
-    tailscale = {
-      enable = true;
-      tags = [ "home" ];
-    };
-  };
-
-  networking = {
-    hostName = "gitlab"; # Define your hostname.
-    firewall.allowedTCPPorts = [
-      80
-      registryPort
-    ];
-  };
-
-  services = {
-    gitlab = {
-      enable = true;
-      backup = {
-        keepTime = 288;
-        startAt = [ "03:00" ];
-      };
-      databaseHost = "postgres.kubernetes";
-      databaseName = "gitlab";
-      databaseUsername = "gitlab";
-      databasePasswordFile = config.age.secrets.gitlab-db-password.path;
-      databaseCreateLocally = false;
-      extraConfig = {
-        registry.port = null;
-        gitlab = {
-          trustedProxies = [
-            "${vpnIp}/32" # The system itself
-            "100.109.86.8/32" # Public server's IP
-          ];
-        };
-        object_store = {
-          enabled = true;
-          proxy_download = true; # Tell them to reach out to object storage themselves!
-          connection = {
-            provider = "AWS";
-            endpoint = "http://s3.thehellings.lan:9000";
-            region = "us-east-1";
-            aws_access_key_id = {
-              _secret = config.age.secrets.minio_access_key_id.path;
-            };
-            aws_secret_access_key = {
-              _secret = config.age.secrets.minio_secret_access_key.path;
-            };
-            path_style = true; # True for MinIO
-            aws_signature_version = 2;
-          };
-          #storage_options = ...;
-          objects = builtins.listToAttrs (
-            builtins.map
-              (
-                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
-              )
-              [
-                "artifacts"
-                "ci_secure_files"
-                "dependency_proxy"
-                "external_diffs"
-                "lfs"
-                "packages"
-                "pages"
-                "terraform_state"
-                "uploads"
-              ]
-          );
-        };
-      };
-      host = "src.thehellings.com";
-      https = true;
-      initialRootEmail = "greg@thehellings.com";
-      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-      pages = {
-        enable = true;
-        settings.pages-domain = "pages.thehellings.com";
-      };
-      port = 443;
-      puma = {
-        threadsMax = 6;
-        threadsMin = 2;
-        workers = 6;
-      };
-      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-      registry = {
-        enable = true;
-        certFile = config.age.secrets.gitlab-cert.path;
-        keyFile = config.age.secrets.gitlab-key.path;
-        externalAddress = "registry.thehellings.com";
-        externalPort = 443;
-      };
-      secrets = {
-        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
-        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
-        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
-        dbFile = config.age.secrets.gitlab-db.path;
-        jwsFile = config.age.secrets.gitlab-jws.path;
-        otpFile = config.age.secrets.gitlab-otp.path;
-        secretFile = config.age.secrets.gitlab-secret.path;
-      };
-    };
-
-    nginx = {
-      enable = true;
-      clientMaxBodySize = "25000m";
-      virtualHosts = {
-        "vm-gitlab.shire-zebra.ts.net" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = 443;
-              ssl = true;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-            recommendedProxySettings = true;
-          };
-          extraConfig = ''
-            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-            client_max_body_size 10000m ;
-          '';
-        };
-        "registry" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = registryPort;
-              ssl = true;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:4567/";
-            recommendedProxySettings = true;
-          };
-          extraConfig = ''
-            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-            client_max_body_size 25000m ;
-          '';
-          serverAliases = [
-            "vm-gitlab.shire-zebra.ts.net"
-          ];
-        };
-      };
-    };
-
-    openssh.enable = true;
-
-    postgresql.enable = true;
-
-    qemuGuest.enable = true;
-
-    redis.servers.gitlab = {
-      enable = true;
-    };
-
-    #resolved.enable = true;
-  };
-
-  # Do not start nginx until we have tailscaled up and running, so it can bind
-  # to the 100.* addresses
-  systemd = {
-    services = {
-      certRefresh =
-        let
-          script = pkgs.writeShellApplication {
-            name = "cert-refresh";
-            runtimeInputs = [ pkgs.tailscale ];
-
-            text = ''
-              cd /etc/certs
-              tailscale cert vm-gitlab.shire-zebra.ts.net
-              chown nginx ./*
-              systemctl reload nginx
-            '';
-          };
-        in
-        {
-          script = lib.getExe script;
-          serviceConfig = {
-            Type = "oneshot";
-            User = "root";
-          };
-        };
-
-      nginx = rec {
-        after = [ "network-online.target" ];
-        requires = [ "network-online.target" ];
-        wants = after;
-        serviceConfig = {
-          RestartMaxDelaySec = "30s";
-          RestartSteps = "5";
-        };
-      };
-      tailscaled.partOf = [ "network-online.target" ];
-    };
-
-    timers = {
-      "cert-refresh" = {
-        wantedBy = [ "cert-refresh.service" ];
-        timerConfig = {
-          OnCalendar = "monthly";
-          Persistent = true;
-        };
-      };
-    };
-  };
-  system.stateVersion = lib.mkForce "24.11";
-}

hosts/vm/gitlab/hardware-configuration.nix

@@ -1,58 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  # Bootloader.
-  boot = {
-    extraModulePackages = [ ];
-    initrd = {
-      availableKernelModules = [
-        "uhci_hcd"
-        "ehci_pci"
-        "ahci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    loader = {
-      efi.canTouchEfiVariables = true;
-      systemd-boot.enable = true;
-    };
-  };
-
-  fileSystems."/" = {
-    device = lib.mkDefault "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/1E6A-C3BB";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
-}

lib/default.nix

@@ -15,6 +15,7 @@
       (name: value: {
         inherit name;
         address = builtins.getAttr netAttr value;
+        aliases = lib.optionals (builtins.hasAttr "aliases" value) (builtins.getAttr "aliases" value);
       })
       (
         lib.filterAttrs (

manifests/bitwarden/deployment.yaml

@@ -21,9 +21,6 @@ spec:
     spec:
       containers:
         - name: bitwarden-cli
-          # Since my gitlab instance depends on the database hosted in k3s, and
-          # the database depends on this image, I need a way to bootstrap the
-          # system if # I am doing disaster recovery. And this is it.
           image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest"
           #image: >-
           #  registry.thehellings.com/greg/nixos-config/img-bitwarden:latest

manifests/databases/ingress.yaml

@@ -14,14 +14,12 @@ spec:
       - 100.88.91.27 # dns?
       - 100.80.99.48 # exodus
       - 100.88.91.27 # genesis
-      - 100.117.28.111 # gitlab
       - 100.68.203.1 # hosea
       - 100.84.183.79 # isaiah
       - 100.102.186.39 # jeremiah
       - 100.90.74.19 # zeke
       - 100.115.57.8 # linode
       - 100.65.5.38 # matrix
-      #- 100.127.55.22 # jellyfin
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP

manifests/databases/kustomization.yaml

@@ -4,7 +4,6 @@ resources:
   - namespace.yaml
   - secrets.yaml
   - postgres-cluster.yaml
-  - postgres-gitlab.yaml
   - postgres-pgadmin.yaml
   - postgres-matrix.yaml
   - ingress.yaml

manifests/databases/postgres-cluster.yaml

@@ -11,13 +11,6 @@ spec:
 
   managed:
     roles:
-      - name: gitlab
-        ensure: present
-        comment: Gitlab user
-        login: true
-        superuser: false
-        passwordSecret:
-          name: postgres-user-gitlab
       - name: pgadmin
         ensure: present
         comment: PG Admin user

manifests/databases/postgres-gitlab.yaml

@@ -1,9 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: database-gitlab
-spec:
-  name: gitlab
-  owner: gitlab
-  cluster:
-    name: postgres

manifests/databases/secrets.yaml

@@ -1,39 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: postgres-user-gitlab
-  namespace: db
-spec:
-  target:
-    name: postgres-user-gitlab
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: postgres-user-matrix
   namespace: db

manifests/gitea/chart.yaml

@@ -47,6 +47,12 @@ spec:
         type: LoadBalancer
         port: 32222
         nodePort: 32222
+      # Anubis sidecar port — ingress routes here; Anubis proxies to :3000
+      additionalPorts:
+        - name: anubis
+          port: 8080
+          targetPort: 8080
+          protocol: TCP
 
     gitea:
       admin:
@@ -119,6 +125,46 @@ spec:
         cpu: "100m"
         memory: "2Gi"
 
+    # Anubis anti-crawler sidecar
+    # Anubis listens on :8080 and proxies to Gitea at http://localhost:3000
+    # Ingress is updated to route to the anubis port instead of http
+    extraContainers:
+      - name: anubis
+        image: ghcr.io/techarohq/anubis:latest
+        imagePullPolicy: Always
+        env:
+          - name: BIND
+            value: ":8080"
+          - name: DIFFICULTY
+            value: "4"
+          - name: METRICS_BIND
+            value: ":9090"
+          - name: SERVE_ROBOTS_TXT
+            value: "true"
+          - name: TARGET
+            value: "http://localhost:3000"
+          - name: OG_PASSTHROUGH
+            value: "true"
+          - name: OG_EXPIRY_TIME
+            value: "24h"
+        resources:
+          limits:
+            cpu: "750m"
+            memory: "256Mi"
+          requests:
+            cpu: "250m"
+            memory: "256Mi"
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          seccompProfile:
+            type: RuntimeDefault
+
     strategy:
       type: RollingUpdate
       rollingUpdate:

manifests/gitea/dump-cronjob.yaml

@@ -76,4 +76,3 @@ spec:
                     secretKeyRef:
                       name: gitea-config
                       key: minio_secret
-

manifests/gitea/ingress.yaml

@@ -8,7 +8,8 @@ spec:
     service:
       name: gitea-release-http
       port:
-        name: http
+        # Route through Anubis anti-crawler sidecar instead of directly to Gitea
+        name: anubis
   tls:
     - hosts:
         - gitea

manifests/gitea/secrets.yaml

@@ -15,8 +15,8 @@ spec:
         storage: |-
           MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
           MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
-        #minio_key: "{{ .minio_nas1_key }}"
+        minio_key: "{{ .minio_nas1_key }}"
-        #minio_secret: "{{ .minio_nas1_secret }}"
+        minio_secret: "{{ .minio_nas1_secret }}"
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore

manifests/gitlab-runner/chart.yaml

@@ -1,64 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gitlab-runner
-spec:
-  interval: "24h"
-  url: https://charts.gitlab.io
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitlab-runner
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: gitlab-runner
-      version: "0.83.1"
-      sourceRef:
-        kind: HelmRepository
-        name: gitlab-runner
-      interval: "1h"
-  dependsOn:
-    - name: external-secrets
-      namespace: external-secrets
-    - name: tailscae
-      namespace: tailscale
-  values:
-    crds:
-      create: true
-    includeCRDs: true
-    gitlabUrl: https://src.thehellings.com
-    runners:
-      secret: gitlab-runner
-    imagePullSecrets:
-      - name: image-pull-secrets
-    rbac:
-      create: true
-    serviceAccount:
-      create: true
-    metrics:
-      enabled: true
-    extraEnv:
-      CACHE_TYPE: s3
-      CACHE_SHARED: "true"
-      CACHE_S3_BUCKET_NAME: gitlab-runner-cache
-      CACHE_S3_INSECURE: "true"
-    extraEnvFrom:
-      PACKER_GITHUB_API_TOKEN:
-        secretKeyRef:
-          name: gitlab-runner
-          key: PACKER_GITHUB_API_TOKEN
-      CACHE_S3_SERVER_ADDRESS:
-        secretKeyRef:
-          name: gitlab-runner
-          key: CACHE_S3_SERVER_ADDRESS
-      CACHE_S3_ACCESS_KEY:
-        secretKeyRef:
-          name: s3-access
-          key: username
-      CACHE_S3_SECRET_KEY:
-        secretKeyRef:
-          name: s3-access
-          key: password

manifests/gitlab-runner/kustomization.yaml

@@ -1,6 +0,0 @@
-namespace: gitlab-runner
-
-resources:
-  - namespace.yaml
-  - secrets.yaml
-  - chart.yaml

manifests/gitlab-runner/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitlab-runner

manifests/gitlab-runner/secrets.yaml

@@ -1,101 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitlab-runner
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-fields
-    kind: ClusterSecretStore
-  target:
-    name: gitlab-runner
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        runner-registration-token: ""
-        runner-token: "{{ .runnerToken }}"
-        PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}"
-        CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}"
-  data:
-    - secretKey: runnerToken
-      remoteRef:
-        key: &key 53719920-b100-4355-8c80-b2f9002fad22
-        property: CI_SERVER_TOKEN
-    - secretKey: PACKER_GITHUB_API_TOKEN
-      remoteRef:
-        key: *key
-        property: PACKER_GITHUB_API_TOKEN
-    - secretKey: CACHE_S3_SERVER_ADDRESS
-      remoteRef:
-        key: *key
-        property: CACHE_S3_SERVER_ADDRESS
-        # Includes
-        # CI_SERVER_TOKEN
-        # PACKER_GITHUB_API_TOKEN
-        # CACHE_S3_SERVER_ADDRESS
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: s3-access
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    name: s3-access
-    deletionPolicy: Delete
-  data:
-    - secretKey: username
-      remoteRef:
-        key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: *key
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: image-pull-secrets
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    deletionPolicy: Delete
-    template:
-      type: kubernetes.io/dockerconfigjson
-      data:
-        .dockerconfigjson: >-
-          {
-            "auths": {
-              "https://index.docker.io/v1/": {
-                "username": "{{ .user }}",
-                "password": "{{ .password }}",
-                "email": "greg.hellings@gmail.com",
-                "auth": "{{ .auth }}"
-              }
-            }
-          }
-  data:
-    - secretKey: user
-      remoteRef:
-        key: &key f560ae38-368c-4e58-898c-aeb90012d597
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: *key
-        property: password
-    - secretKey: auth
-      sourceRef:
-        storeRef:
-          name: bitwarden-fields
-          kind: ClusterSecretStore
-      remoteRef:
-        key: *key
-        property: auth

manifests/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - mariadb-operator
   - databases
   - matrix
-  #- gitlab-runner
   - immich
   - monitoring
   - pinchflat

manifests/mariadb-operator/chart.yaml

@@ -19,6 +19,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -33,6 +34,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
   dependsOn:
     - name: mariadb-operator-crds
     - name: longhorn

manifests/mariadb-operator/databases.yaml

@@ -11,6 +11,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
   dependsOn:
     - name: mariadb-operator-crds
     - name: mariadb-operator

modules/nix-conf.nix

@@ -9,6 +9,7 @@
 let
   builderHosts = lib.filterAttrs (_n: v: (builtins.hasAttr "builder" v) && v.builder) metadata.hosts;
   cfg = config.greg.nix;
+  hostname = x: if cfg.cache then "${x}.shire-zebra.ts.net" else "${x}.thehellings.lan";
 in
 {
   options.greg.nix = {
@@ -22,7 +23,7 @@ in
     programs.ssh.extraConfig = builtins.concatStringsSep "\n" (
       lib.map (x: ''
         Host ${x}-builder
-          Hostname ${x}.shire-zebra.ts.net
+          Hostname ${hostname x}
           User remote-builder-user
       '') (lib.attrNames builderHosts)
     );
@@ -57,12 +58,18 @@ in
           "gregory.hellings"
         ]; # For home and for work machines
         substituters =
-          (if cfg.cache then [
+          (
-            #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
+            if cfg.cache then
-            "http://nas1.shire-zebra.ts.net:8080/default"
+              [
-          ] else [
+                #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
-            "http://nas1.thehellings.lan:8080/default"
+                "http://nas1.shire-zebra.ts.net:9000/niks3"
-          ])
+                #"http://nas1.shire-zebra.ts.net:8080/default"
+              ]
+            else
+              [
+                "http://nas1.thehellings.lan:8080/default"
+              ]
+          )
           ++ [
             "https://ai.cachix.org"
             "https://nixpkgs-python.cachix.org"
@@ -72,6 +79,7 @@ in
             "https://nixhelm.cachix.org"
           ];
         trusted-public-keys = [
+          "niks3:8iztr/NACwYEK5O7JJtGFGuv+ho/cmwql8NeoCiXNto="
           #"chronicles.shire-zebra.ts.net:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
           "default:DTGxNijw2D8FrZJPT1pFTWcLqbt60tovL+9Z+VW0HRY="
           "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="

modules/nixos/default.nix

@@ -10,7 +10,6 @@
     ./ceph.nix
     ./db.nix
     ./gitea-runner.nix
-    ./gitlab-runner.nix
     ./gnome.nix
     ./home.nix
     ./kde.nix

modules/nixos/gitea-runner.nix

@@ -45,22 +45,27 @@ in
         "debian-latest:docker://node:25-trixie"
 
         "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-26.04:docker://docker.gitea.com/runner-images:ubuntu-26.04"
         "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
         "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
 
         "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
+        "ubuntu-full-26.04:docker://ghcr.io/catthehacker/ubuntu:full-26.04"
         "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
         "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
 
         "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        "ubuntu-act-26.04:docker://ghcr.io/catthehacker/ubuntu:act-26.04"
         "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
         "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
 
         "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
+        "ubuntu-runner-26.04:docker://ghcr.io/catthehacker/ubuntu:runner-26.04"
         "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
         "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
 
         "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
+        "ubuntu-rust-26.04:docker://ghcr.io/catthehacker/ubuntu:rust-26.04"
         "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
         "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
 

modules/nixos/gitlab-runner.nix

@@ -1,82 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.greg.runner;
-  environmentVariables = {
-    EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-    STORAGE_URL = "s3.thehellings.lan:9000";
-  };
-  runnerCfg = file: {
-    inherit environmentVariables;
-    authenticationTokenConfigFile = file;
-    executor = "shell";
-    limit = cfg.threads;
-  };
-in
-# We want exactly one of these to be true, but not both. Neither can both be false
-{
-  options.greg.runner = {
-    enable = lib.mkEnableOption "Enable as a gitlab-runner with both libvirt and virtualbox";
-
-    threads = lib.mkOption {
-      default = 5;
-      type = lib.types.int;
-      description = "The maximum number of concurrent jobs";
-    };
-
-    qemu = lib.mkEnableOption "Enable the qemu host (mutually exclusive with vbox)";
-    vbox = lib.mkEnableOption "Enable the vbox host (mutually exclusive with qemu)";
-  };
-
-  config = lib.mkIf cfg.enable ({
-    # assertions = [
-    #   {
-    #     assertion = cfg.qemu || cfg.vbox && (cfg.qemu != cfg.vbox);
-    #     message = "You must enable exactly one of qemu or vbox";
-    #   }
-    # ];
-    # Shared configurations
-    age.secrets = {
-      qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
-      vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
-    };
-
-    services.gitlab-runner = {
-      enable = false;
-      settings.concurrent = cfg.threads;
-      services = {
-        qemu = lib.mkIf cfg.qemu (runnerCfg config.age.secrets.qemu.path);
-        vbox = lib.mkIf cfg.vbox (runnerCfg config.age.secrets.vbox.path);
-      };
-    };
-
-    systemd.services.gitlab-runner = {
-      serviceConfig = {
-        DevicePolicy = lib.mkForce "auto";
-        User = "root";
-        DynamicUser = lib.mkForce false;
-      };
-    };
-
-    users.extraGroups.vboxusers.members = lib.optional cfg.vbox "greg";
-
-    virtualisation = {
-      libvirtd = lib.mkIf cfg.qemu {
-        enable = true;
-        allowedBridges = [
-          "br0"
-          "virbr0"
-        ];
-        onBoot = "ignore"; # only restart VMs labeled 'autostart'
-      };
-      virtualbox.host = lib.mkIf cfg.vbox {
-        enable = true;
-        enableExtensionPack = true;
-      };
-    };
-  });
-}

modules/nixos/nebula.nix

@@ -27,7 +27,7 @@ let
   nebulaDomain = "nebula.thehellings.com";
   # Linode's public address — used by all non-lighthouse hosts to reach it.
   # Override with greg.nebula.lighthouseAddr if the public IP ever changes.
-  defaultLighthouseAddr = "linode.${nebulaDomain}";
+  defaultLighthouseAddr = "thehellings.com";
 in
 {
   options.greg.nebula = {

modules/nixos/proxy.nix

@@ -54,7 +54,7 @@ with lib;
 
                 target = mkOption {
                   type = types.str;
-                  description = ''The destination that is being proxied.'';
+                  description = "The destination that is being proxied.";
                   example = "http://localhost:8080";
                 };
 

modules/nixos/remote-builder.nix

@@ -57,6 +57,7 @@ with lib;
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLOqwbp4hFYkiJpokh9i2RToa/6tQcwthDNQH69tyBF root@vm-matrix.thehellings.lan"
         # Mac
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBT5BFHQz1I5k/zkLQNLjL77EaqfdpRiF2Ci4eS9LMDK gregory.hellings@jude.thehellings.lan"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPVlMoN2pkKRRwKNuMbMczki5ybR34wvjdgDNlgR74Wh greg@gregs-MacBook-Pro-16-inch-Nov-2024"
       ];
       homeMode = "500";
       isNormalUser = true;

modules/nixos/syncthing.nix

@@ -18,7 +18,6 @@ with lib;
         devices = {
           chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
           genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
-          gitlab.id = "GKNOZWI-CNC2Q2F-R5GGGDX-RYFGHK4-CCC37LC-GVOEMJI-46QPC6G-AWFEOQE";
           linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
         };
         options = {

network.json

@@ -13,7 +13,8 @@
       "ip": "10.42.1.4",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
       "external": true,
-      "ts": "100.119.228.115"
+      "ts": "100.119.228.115",
+      "aliases": [ "s3" ]
     },
     "exodus": {
       "ip": null,
@@ -121,9 +122,6 @@
       "external": true,
       "system": "x86_64-linux"
     },
-    "gitlab": {
-      "system": "x86_64-linux"
-    },
     "wsl": {
       "external": true,
       "system": "aarch64-linux"

overlays/default.nix

@@ -30,4 +30,3 @@ final: prev:
     tpmSupport = true;
   };
 }
-// (import ../pkgs { pkgs = prev; })

pkgs/default.nix

@@ -1,36 +1,37 @@
 {
   pkgs,
   system ? pkgs.stdenv.hostPlatform.system,
+  top,
   ...
 }:
 
 let
-  c = pkgs.callPackage;
+  c = pkgs.newScope packages;
+  packages = if system == "x86_64-linux" then (allSys // x86Linux) else allSys;
+  allSys = {
+    #default = iso;
+    #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage;
+    #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
+    aacs = c ./aacs.nix { };
+    adblock_update = c ./adblock_update.nix { };
+    brew = c ./homebrew.nix { };
+    create_ssl = c ./create_ssl.nix { };
+    gcc-tune = c ./gcc-tune.nix { };
+    #gen-build = c ./gen-build { };
+    hms = c ./hms { };
+    inject-darwin = c ./inject-darwin.nix { };
+    inject = c ./inject.nix { };
+    setup-ssh = c ./setup-ssh { };
+    upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
+  };
+  x86Linux = {
+    qemu-hook = c ./qemu-hook.nix { };
+    vfio_startup = c ./vfio_startup.nix { };
+    vfio_shutdown = c ./vfio_shutdown.nix { };
+  }
+  // (import ./zim {
+    inherit (top.nixpkgs-lib) lib;
+    inherit pkgs;
+  });
 in
-{
+packages
-  #default = iso;
-  #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage;
-  #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
-  aacs = c ./aacs.nix { };
-  adblock_update = c ./adblock_update.nix { };
-  brew = c ./homebrew.nix { };
-  create_ssl = c ./create_ssl.nix { };
-  gcc-tune = c ./gcc-tune.nix { };
-  #gen-build = c ./gen-build { };
-  hms = c ./hms { };
-  inject-darwin = c ./inject-darwin.nix { };
-  inject = c ./inject.nix { };
-  setup-ssh = c ./setup-ssh { };
-  upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
-}
-// (
-  if system == "x86_64-linux" then
-    {
-      qemu-hook = c ./qemu-hook.nix { };
-      vfio_startup = c ./vfio_startup.nix { };
-      vfio_shutdown = c ./vfio_shutdown.nix { };
-      zim = c ./zim.nix { };
-    }
-  else
-    { }
-)

pkgs/zim/blobs.json

@@ -1,72 +1,88 @@
 {
   "en": {
     "gutenberg": {
-      "name": "gutenberg_en_all_2023-08.zim",
+      "name": "gutenberg_en_all",
-      "hash": "sha256-wWi0vTyMD/Es0w/jk9uyg4DN94080thPfT5uphEqbUc="
+      "version": "2023-08",
+      "hash": "sha256-OXmdHdsLZcW4nCUQsy7sMpUssS8NV7ztkCgS/nsISuw="
     },
     "phet": {
-      "name": "phet_en_all_2025-03.zim",
+      "name": "phet_en_all",
-      "hash": "sha256-HT/gVNydkOitny6oUl2A+JvbFDGAIeb0h+xbMeQ2Rqs="
+      "version": "2025-03",
+      "hash": "sha256-ARuUzU2o17J2/ZedHc2acXl33dtHCbQJEb72UQUEm1Y="
     },
     "wikibooks": {
-      "name": "wikibooks_en_all_maxi_2025-10.zim",
+      "name": "wikibooks_en_all_maxi",
-      "hash": "sha256-zmcvrvGO+LEHt7x8/SoguBDODUyRXy9x5LUGAkS+fF8="
+      "version": "2025-10",
+      "hash": "sha256-ONBh/ze1Fv2Ffm5b9vDzYS/i2cWSa4pM4MLZnozr2n8="
     },
     "wikipedia": {
-      "name": "wikipedia_en_all_maxi_2025-08.zim",
+      "name": "wikipedia_en_all_maxi",
-      "hash": "sha256-r7Cd0vjEb84Ftw+EwZSlqb8qhqm8WA3LAPdHAav7wrg="
+      "version": "2026-02",
+      "hash": "sha256-vwhTv5TtjFNSTl7mcoi8SJiBm8nUlq8rP4UrZYir3Sc="
     },
     "wikisource": {
-      "name": "wikisource_en_all_maxi_2025-11.zim",
+      "name": "wikisource_en_all_maxi",
-      "hash": "sha256-jPHh/C20PARN6K7aPNw3k9fFHhpwzsREi/1o1DIISS4="
+      "version": "2025-11",
+      "hash": "sha256-p1Jio+PMTZVSLIDIOBeMG3acXJg83CwQM7zIWDUyozM="
     },
     "wikiversity": {
-      "name": "wikiversity_en_all_maxi_2025-11.zim",
+      "name": "wikiversity_en_all_maxi",
-      "hash": "sha256-0DaE2EUdHvaX3XqD3f0lwurSAaDZ4hEKtrMEutL5xt0="
+      "version": "2025-11",
+      "hash": "sha256-IG/gAUdc/vHRrIWGHhw8vMJdLWwqrNbfh+SiclQRIAI="
     },
     "wiktionary": {
-      "name": "wiktionary_en_all_nopic_2025-09.zim",
+      "name": "wiktionary_en_all_nopic",
-      "hash": "sha256-EzrrruJQWY/3pP93WCTeCCfaPvpshqdkR0TFxVz7bEI="
+      "version": "2025-09",
+      "hash": "sha256-Ghcb60qeGaSJtTKQkJoMx/XucX7Lt1XY145lD3gHlMg="
     }
   },
   "fr": {
     "gutenberg": {
-      "name": "gutenberg_fr_all_2025-10.zim",
+      "name": "gutenberg_fr_all",
-      "hash": "sha256-1gU7v//LYX/2LyIRjO02A1fWPQz9Y7Qt5ftgeazd3G8="
+      "version": "2025-10",
+      "hash": "sha256-gLHxLXJNwwcxM/mZHtoJ8ojbGQ1fugxgni/+RXccwhU="
     },
     "phet": {
-      "name": "phet_fr_all_2025-03.zim",
+      "name": "phet_fr_all",
-      "hash": "sha256-K56i55WPu5EMQHIrnnqhgJ32WozZ6oYD9X3IBytGA0A="
+      "version": "2025-03",
+      "hash": "sha256-CSboZNTIowLLhp1u9wkxH8xmu3LvQNx5q493AOYJRIc="
     },
     "wikibooks": {
-      "name": "wikibooks_fr_all_maxi_2025-09.zim",
+      "name": "wikibooks_fr_all_maxi",
-      "hash": "sha256-PQSdPbBHwK3IfFPH5GsKaxkNGTlZVJNJEI8gNioBl1U="
+      "version": "2025-09",
+      "hash": "sha256-KHCc/73L5Bd9iZ47SRV6vpI8fVM1v9hk1TpEvTro2uo="
     },
     "wikipedia": {
-      "name": "wikipedia_fr_all_maxi_2025-06.zim",
+      "name": "wikipedia_fr_all_maxi",
-      "hash": "sha256-zzDhITMd1nRMYTUlvn56l4VBnpFuhiNrhhYMcrrBuOQ="
+      "version": "2025-06",
+      "hash": "sha256-ve7Mbh96/ObNbV/KVNYZpfLN+HdWlJ7C5LItEdVkRH0="
     },
     "wikisource": {
-      "name": "wikisource_fr_all_maxi_2025-09.zim",
+      "name": "wikisource_fr_all_maxi",
-      "hash": "sha256-2gEY5nTBecrmg61VJerxO4/oV7dZJmRgzLkqrcocW/0="
+      "version": "2025-09",
+      "hash": "sha256-FdLYCjoT6Yk34AZKFND/NaBHNe+GzW9Ibpd6mVPWlxI="
     },
     "wikiversity": {
-      "name": "wikiversity_fr_all_maxi_2025-09.zim",
+      "name": "wikiversity_fr_all_maxi",
-      "hash": "sha256-4vOxYiX3TYht7ARY+PeCJ0ArVZZn9TeGtwCieqn3xUw="
+      "version": "2025-09",
+      "hash": "sha256-55fdtw/cRezq6nkRp6wuwkukBiqsQKdwh9QWVAgFcBI="
     },
     "wiktionary": {
-      "name": "wiktionary_fr_all_nopic_2025-11.zim",
+      "name": "wiktionary_fr_all_nopic",
-      "hash": "sha256-oQS8DzKioceCER1p1oAvaS1gRooMLJLYnCqy1aLARi4="
+      "version": "2025-11",
+      "hash": "sha256-P0CJptee5rDzccxyRDBzyRLuuFOcaLsJYi6DkBFUfIc="
     }
   },
   "ht": {
     "phet": {
-      "name": "phet_ht_all_2025-03.zim",
+      "name": "phet_ht_all",
-      "hash": "sha256-UjC0REJ5d5wIKccutZADX74IxvZuF+CD/caVzZfHg9s="
+      "version": "2025-03",
+      "hash": "sha256-bHrPzE8H7ptrP6r5wPlXSsXNlTiKxJ9KatABC4kwx+s="
     },
     "wikipedia": {
-      "name": "wikipedia_ht_all_maxi_2025-09.zim",
+      "name": "wikipedia_ht_all_maxi",
-      "hash": "sha256-spT7EFXLnI0FWT9Vlvp7QEP0urntmQ2C+fQB5bVLoLE="
+      "version": "2026-04",
+      "hash": "sha256-qUX0pKxIyNsWX4V6kNIsP4Z9nc6TDhwdDR0MmpDOQFs="
     }
   }
 }

pkgs/zim/default.nix

@@ -0,0 +1,24 @@
+{ pkgs, lib, ... }:
+let
+  zimMetadata = builtins.fromJSON (builtins.readFile ./blobs.json);
+  oneZim =
+    sourceType: info:
+    pkgs.callPackage ./one_zim.nix {
+      inherit sourceType;
+      sourceName = info.name;
+      sourceHash = info.hash;
+      sourceVersion = info.version;
+    };
+  # Preserves structure in the blobs.json file, turning leaves into drvs
+  zimFileDrvs = builtins.mapAttrs (
+    _language: types: (builtins.mapAttrs (sourceType: info: oneZim sourceType info) types)
+  ) zimMetadata;
+  # Flattens leaf drvs into the structure that flake packages expects
+  zimFilePkgs = builtins.listToAttrs (
+    lib.mapAttrsToListRecursiveCond (_path: x: !(x ? "name")) (_path: drv: {
+      inherit (drv) name;
+      value = drv;
+    }) zimFileDrvs
+  );
+in
+zimFilePkgs

pkgs/zim/one_zim.nix

@@ -0,0 +1,33 @@
+{
+  sourceType,
+  sourceName,
+  sourceVersion,
+  sourceHash,
+
+  fetchurl,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  name = "zim-${sourceType}-${sourceName}.zim";
+  version = sourceVersion;
+
+  src = (
+    fetchurl {
+      url = "https://download.kiwix.org/zim/${sourceType}/${sourceName}_${sourceVersion}.zim";
+      hash = sourceHash;
+    }
+    # fetchtorrent {
+    #   inherit (val) hash;
+    #   url = "https://download.kiwix.org/zim/${type}/${val.name}.torrent";
+    #   backend = "transmission";
+    #   postUnpack = "mkdir -p $downloadedDirectory/tmp; mv $downloadedDirectory/*.zim $downloadedDirectory/tmp";
+    # }
+  );
+  phases = [ "installPhase" ];
+  preferLocalBuild = true;
+  installPhase = ''
+    set -x
+    ln -s ${finalAttrs.src} $out
+  '';
+})

pkgs/zim/updater.go

@@ -83,7 +83,7 @@ func getHash(ch chan result, file, category, language string) {
 	// TODO: Only call this if the file doesn't already have a hash
 	// in the existing file
 	fmt.Printf("Fetching hash for %s\n", file)
-	cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s.torrent", BASE, category, file))
+	cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
 	out, err := cmd.Output()
 	if err != nil {
 		fmt.Printf("Error fetching hash for %s (category: %s, language: %s): %v\n", file, category, language, err)
@@ -115,6 +115,7 @@ type result struct {
 
 type Zim struct {
 	Name string `json:"name"`
+	Version string `json:"version"`
 	Hash string `json:"hash"`
 }
 

secrets/acme_password.age

@@ -1,38 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg HqGj+5hXjRLJcrRMC3biBE8K9B/OAJj68gqTqg9ja1k
+-> ssh-ed25519 87huqg LKhlbZI1BygDI8E4kkzhw0/Y1BfWnzekf/URa/Bma30
-K25Z2YGlWnUK02EUQmdNo0QM13apME/mc5w0gydrEDc
+uT7QzE8DPX8j3us7oNRKwu6hPUFpQosbcMRmMNgS/Gw
--> ssh-ed25519 8UnW5Q Pj4iDE8Q9FhzudZ341W+V2aaWuotfzOZzN18fRnPqh8
+-> ssh-ed25519 8UnW5Q dDAJI5EnPMIhs5H21wLT84GWhkROEJRXE1QVp1aOH38
-kujFDr1mL/0YrsyoVpWQhkEwwjXr3l3AbbD2787z8zo
+qZJt4Kip5qVZl9QoIFEXgrhtrlQEpbkfLarCgaHugj8
--> ssh-ed25519 UFfTmg Ga4FQrnrejoa6uSNDh0VMgB7ntPrp4Z2Ic8n5XCosHM
+-> ssh-ed25519 UFfTmg kbrSoge204JvRPBszhAfMewPM4oHg0HkF52BNeb9kx8
-cquCWegeBg6Mtv3/t5RAEmh66p6oHBlQvbuJMaZTB6g
+E4ASRdn0pjF//GiFCjmRlgXRS2wiJxIXDFSjldMtTdQ
--> ssh-ed25519 xNtnoA Mf9EJ6mB79mWBN383e8t/BZQVjB7mXuFKvhyJdT9GA0
+-> ssh-ed25519 xNtnoA 7b9/Z/qUEmRnFCiCYzVGJVvxvV8onjZemSg6sllaDyA
-QnnrGVbZIHMDBS4ZZrj8BDwx6deSP10t2kLLzu2ewXs
+bQosZIGbaSsUqFO2JuRpIhm3FJd79JyYS43A9+zr+1w
--> ssh-ed25519 aY2AXA 0Lop9E46qiaGNrFTVbgg0O1yKbqwCFmG9pjssoclMUM
+-> ssh-ed25519 aY2AXA m4gIzzAX8pkBHHzsSykIy24E6Kru/I4uNnjihKH3JHg
-I5lOVEogB8XV9pkyqmYcFojvZlAX31ADlMyHgDluxjY
+S18CWIY5wNcR5PVkCqbjp1FJRrGxco6fdoykQeHhyX0
--> ssh-ed25519 AQhf1g Ktn1BuWcwx0eJS0ZJugnRiTmvAht6ABOVzTDcw58HlM
+-> ssh-ed25519 AQhf1g LBmvyUbKRLKtPGIEqt+NwOSrtGwlFt2zqgdmRDHu9n8
-7Vm9rx9P+rXDvrxTQnxxpUBZbvNRgd6UafmzuG0ePwM
+zb8OnKRsJBEkH6eJ76mlKvJmtZ8NvVwVS9/0tsZlMUk
--> ssh-ed25519 mOmPfg VhUpDomkduEthbPGMr4bFpLqVcXgn3OrQojPjA+s8k4
+-> ssh-ed25519 mOmPfg TuPbRMlX9eRATxSbv6v88TtzGhOKWn5FOkIg4xR6FH0
-1nrS2JxDSSe6PvPRK9VNBh7RTMiFChSiM3xbCQAQw/4
+NLNzJM/9r2jZ70Y2r5Hsc36gcRTSPw40Aabn/H7OE+4
--> ssh-ed25519 YJiRbw XVylSfHTRne3B5zWru6x+yhAPJEp9Jj27P0Y63Wp2SE
+-> ssh-ed25519 YJiRbw bVMyOOgBcFFRNulym46YwKAIPlOkbQhmQAo9kl4dRx8
-APDEG5J9tBR1boxpsUBarSC8vN6q34KElRUK98fsQ+0
+5W2fIxGXCXbzULOismGg4NxE+VQ8LDEbODlJ0OpFMiI
--> ssh-ed25519 0/WsKg FVXUmVyse3msAkDSkznhcUw5VYd4vwsKd9PCDBJwLiM
+-> ssh-ed25519 Nl/5yA ydFS0bVjjDzymhQFaBJ3YqDREQDpVO6VzgS2MBtuOUo
-hRIDpMGWWFu127Q/jvxr+ieSM7KQfNagqhUZUnTwJMM
+tNzj/85BiYe6th2N6A9ZkMSPKduwAIe/qnf2NVJiHOg
--> ssh-ed25519 Nl/5yA qO4YJ4/gnfbLOdJFyGq1J4AJH5pMTPhR2IvEKMt4IlM
+-> ssh-ed25519 GdLgCQ wmfT7bCzwnkwEtn2mRnElIM75MmdRw+33MhSegSHJWk
-Dyhj/RQQ3LxgJVc5drDdgw0cAJi1t3zCFnO1zWKaWIw
+YHrCYB1wF1njNjzpIy3hKZ9l1cj7m5yicLuj71TvKr8
--> ssh-ed25519 GdLgCQ GyVGc/nK0Zu3/Gm76KRvXHwjdnRvoM+WuY/psFaIv2Y
+-> ssh-ed25519 tOH/HQ z5/GMQOtkpMWwWdMXqxmf12MM84xkgXL/OLliq3RHh0
-1O56ZsNvSBzhcFRPoIOyUCMQCGQYn3w5ES2AfGP75uw
+mVhBt+uc7z/YkoIAyXTqBgv00cJOrZ0bsBP0lD9S24c
--> ssh-ed25519 tOH/HQ wR3dxHjLSzkHIG/6UX45qiGFqX0cHA18/oEFatBthUc
+-> ssh-ed25519 FpzvfQ D8N5JQ+3rGdSZIPmzlZqO5VpS90v6r99WMXtyUqCGiw
-J/gpGWp8kOdmtFs9A65B68lsnD68gxfheiOZfp0AeI4
+A2SSvI4H5TRY13R/iOa60bCdc0zR6lUAHJVHfAUR5mQ
--> ssh-ed25519 FpzvfQ 0sdlOKrumgCJedenPUNY/QSIDmhrP3J077qZxTwvdQE
+-> ssh-ed25519 2UotMw eaM1Kkzw53Oq8lW0BFn3rqWFcTQaTz9jcDsULDg/fwU
-DdWxilImsFB/XXgbZNYXEjSCoqmVd0vaTH7rhR73fsw
+3QVYFrhKnvwWDpIdsyTp0amontUXePko8z8PeUub9EE
--> ssh-ed25519 kdPvzQ 9PxMQp7Y4Gh0V2uMa8K6SmldUhcqcBfYgVtMkzzzdAc
+-> ssh-ed25519 kdPvzQ 08LE8a24S5cvuK9DVWD2ta0GjJMNzUidmgYT4RfhQDA
-sS8Fqm1p72IPOKNZfJKIJTxTLoNt3MQaOI6w8qYCTRo
+cRFH8vOr2y1/C9F2wZWV2deUxUpoL34IFRyOBHPYifI
--> ssh-ed25519 onmXpg Ig9ABzLLazyW4wxkUmq87XR7hmUt6l5/X0R9Zf2qBlE
+-> ssh-ed25519 onmXpg J5MKGIovNwv4FyTN4ofExlHV8qYzU/J9O3MI4tZYcTo
-n3DO7o4NdWRefqEkexyIJLeOQ8w1q9QN+wIslQNXIF4
+iagT0Ypo8gTwvGpV66XNuNPedefx2S72q9hyeB2Rz/w
--> ssh-ed25519 CnhD0g wtGoi7CzfIAs8ezcIF7ecjTXshD96xG8ZLlhYYaM6HQ
+-> ssh-ed25519 CnhD0g se/N4hrYxOiukByYzsIhxToceXNuBO7J7VmM4muJ3Dk
-4hwG3V1Cf/iYDsNXT0RmzWJnW5kxnBWNvX3ECrP1/oE
+cW+WW8iWjj3eXDqDO8aEON1ZH/+6AXQGAEXkLRbL3AI
--> ssh-ed25519 4ep2UA AKSh5d04251XgyZKKscIJjU7RSpKclMqO5qPTEMQygo
+-> ssh-ed25519 4ep2UA uyjvubY39oSGeCNsX3/VIdM5CzNBlrnRpkF+YN5MBCo
-wSyIxArdlbLafOKmUyrlUqOZQbF1PXZND/PAFYCjClU
+xiNuksI7olV5Db392Vjz/7uDNDIssGmI9bez6vSOXTk
---- DnRePhJDkX5QDmrkH5jiZkuljvOFaVm1BrqYMTDP3tg
+--- VsGbd8K7JzHe/eoYUeTMwcg/GrY9SXVzNxL4HZ23tKQ
-\bºîç:ý]3\ô<™rÔhމ׋|ÈFz.R{FEÝá<RòôœÊ'=ðY”­v xˆ˜o½ßÌF
+£_÷t/¢ªØËVÎÞ}7J'%?™Á‰Å0“¤¼^õ¿-„ÏÛ„äu4¥ù‹íäóü0!®ÝîËðMÜÅ·
-q
¤lî0¥ä»

secrets/dendrite.age

@@ -1,37 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg gv0jzWC7KtVxSEeepOckxiDwxN6VdPzYaXjZryNlUjE
+-> ssh-ed25519 87huqg CsPCBXcVp7krsPi1k0WbjKFZxUzuZNJkkpOImMDWNns
-04mMQsL99xW+VbpELVdnWehgq/3u50l5f98ZFTscSwU
+h6evECCNa5VGBe1dtbVwOBFBPkzwUKPFyVdQsTNMUXo
--> ssh-ed25519 8UnW5Q GzZDPqTzZNU5Dun3u7rSane+MXkDcbIM3TlEEJr7cUI
+-> ssh-ed25519 8UnW5Q 1pioLo4kA+RJ6r35H9FNCQ5LZqmYUmxZTVyTdD0o92Q
-Dh/3ObCIG56797AvmSh5yrUk+MWqjxJ42/b4i2smnos
+4r/sOb3IcQElEJnKAgmYeHtubm1Hk/cdiY6gUI1GkHg
--> ssh-ed25519 UFfTmg 7EWxx0WGxxAP2sErB6Rfteg2o1su5n1ELN7oCUsodEQ
+-> ssh-ed25519 UFfTmg ruMzDG9lKKSHo2I1L/2wigVZs1Jhi6aTNmrr4zAyEiI
-S5x8TAYvjxjtCJgmY4ttCxvoZDdHMxY2RbsAJ7DxfJY
+3gsAmzM6fE8RL/fLL63pPIH75P9TW954nw11/JpU77M
--> ssh-ed25519 xNtnoA 9mPAgc7YI355QYNlTlJWmMhaScCNbCH9EofQcJJDeWk
+-> ssh-ed25519 xNtnoA eTZoJFu1SqUoUGPcdVDw/2wW82xvRiSCnAmQSZPQT2w
-QSlYi9COKd5ZjkC7Qxp8IcmmVJifJ1qy70VnExASqBM
+Y9Cf+/h80vn2w6G9n+V4uNV7bj3tpOT1KWRKajM7d5k
--> ssh-ed25519 aY2AXA JUIOcOAjshTPueqEo/GDXWzEubBt1JuMM4NLv89zfTA
+-> ssh-ed25519 aY2AXA c4MkdSio2FFkulOBKDSAG3Iq71ghRdw8/SQF0B98chY
-njcVfVgCmT374IdMqke8AWGyGcpCgpu5rGs2zrn/A2Y
+lvT+m2ey5+HqipuC7MrPQIKu8KrSsLHM0XRK8c0iS8w
--> ssh-ed25519 AQhf1g faN3428QM/K0P7o6nlPxT3lHlx88PBIWxw1mSN07zy8
+-> ssh-ed25519 AQhf1g vLig+8a5jPo3cQhdmQw/C/P1hgzKHiVkVwUTkMBNmTk
-6G8FARubsbz7TtQWeQ5biww7XoXZrs0xDFdxKwyov/U
+N5ROr2EtHpTwti7NByDiR8R3pOQ/STwlIuNeY1pDA20
--> ssh-ed25519 mOmPfg b7LviVrLo50sU195qKNxtD6lEqq/QJBnHFkQ3WdKT2g
+-> ssh-ed25519 mOmPfg WcbxDQfraXfxkN1+IGaArpIHOmlUlhGjBijQt5ZYSxE
-USSSrAIA3v3Luzt2Kft6fpMx4fXHAPBtWQVAAliiV2o
+6KHLewxXWwo8fVIuaTuY/T/igsI6CKqEl2tyM/gkn6g
--> ssh-ed25519 YJiRbw QjrEHQL9zx6pIR/HzrKyM94JF7efjkMo+ArkVOjkQlU
+-> ssh-ed25519 YJiRbw IblKWpY9DeDSWDfvlEmNeWSV1lGdz9aHcv2oQVmKQFI
-MfUl5yYO/LtxrENlcw2KgzyJiLpd/Xk0CbEJicxgG0E
+qPcdGcA6Z7YaLL5umR8ZOKzOyNIUJVHRBpV5HyAJeqw
--> ssh-ed25519 0/WsKg ER1PXYwpONwb3U77qUoH2ZDFmfvRQ7SV8lkgHqRJQig
+-> ssh-ed25519 Nl/5yA wr0Q96yztc+Rf88q6ooiDHlKqpVdWPkRWApfJsc7uQc
-MCRbKzFD72DdZwoVrV5DesMbNG6ikMlL5C6mTSVGtj8
+hQZTwZ36mkajMcSbxDsL+TtAezJIY+H+J7VaU1QOqEo
--> ssh-ed25519 Nl/5yA XKaH3S150ZwHo4uyLwaBrn2od5v6MRvc0bOR83Sz5Ag
+-> ssh-ed25519 GdLgCQ LiwfxrAh9dLjMeo6FglQzvUQ3hfWRAZr2naADkB5/WM
-RqQn4/jo122fZA1oujOkwe4gbnGfn5BK8CJXi42NsDM
+Bn4fnoqTvKPd73qi28NAgAN8AZl4EWcr9e/uhuUwVgI
--> ssh-ed25519 GdLgCQ XVrC/NooMQFg4bSPQ09avkJ2mwROHp8mYbBA7dWjSCs
+-> ssh-ed25519 tOH/HQ x35ypXVDI9C1wpquWxDUFYXYHxEsD2NJ0VIDosRONyE
-Q72VZnjs6Y574eRwheabzTW2GH8A2oEOEyk1Mkh+NzU
+Aa5eZt98GQQZmKlBDzRC9KRyMCy2z1htSAsjKNGCuFw
--> ssh-ed25519 tOH/HQ b55WhSZiczkXRQQTxAFBeN4HKyi2orpR+ikGiSyaonU
+-> ssh-ed25519 FpzvfQ jlAbIzsWi8eX+PTKn100NaiSoezN1kXzZ3gWUOKfQVg
-woTljkdrDmI6iCwUnJ7i1kLdfH3QaZgkxxQ+Upik6/E
+NQARp2qsxIdSG3OLJyP33A97r6cBRaMSaneT8NBnhDI
--> ssh-ed25519 FpzvfQ +kFO6lyChWKyGs1vN8XmRnp5wNUrOvKGAMtQB5gYJyQ
+-> ssh-ed25519 2UotMw 53sXK937St2F3MzVIhmsjH6WeCSRdkpv4oFa2ZBaelI
-xQbRbUfvk9Eoi/JLfzugHeUVbPGfFItkul33A7MVx3Y
+lNsjlQzS8Szj0FcAvrQno9rDO17iKDjMN7VwMLvIleE
--> ssh-ed25519 kdPvzQ dv1xr07TrUQRGwl6jbxMQlocvvYlTmyzyZpbRAU5rg0
+-> ssh-ed25519 kdPvzQ YdeMlv40jR9bFnXVjPJDpvCnqn091dCKAB60m4Obwgo
-IYO9Af8yAxY5499AArmWCy1aV/ZB3w3deBS4OAHq+LY
+vgPAO0evfCXQUX7Tu/G9ERUhLO3KiWXqpxIqATDl5vw
--> ssh-ed25519 onmXpg 8cNof6Uwd2MpA3ydHLQHAQvFvl7Kk5moWMRD5qVFxGs
+-> ssh-ed25519 onmXpg mrDB6F061SjeYOZuUJVvZP8SzOVrFdpAAEfgPOzp608
-hTMO0oPxHajokrzMIWB5ksbrVFcpQGo6Jje9FWoiPxE
+AzAEEHK6Q71YxPfiljl7ZCy0b3YBdSBMKORJd7Opkck
--> ssh-ed25519 CnhD0g kqhzl+91aQ7CDRrXzrLPo+P5GuEOSF0MGQlfZESPJDA
+-> ssh-ed25519 CnhD0g Ov3v97PyY79WoXUDAdvXEZvTE7ruIgDeXVz3jD5O1HY
-64xA1PirxldhnScyJ0njwaOMZ/EgPRm1hQzojJIa+84
++0rSmiqdxP6PgplxLkim4AJtKPcjn7OlkXpcu0BsI4s
--> ssh-ed25519 4ep2UA Zss5olMIbVxEJT8XdrFSrBOppplv8+x5ej3CktSUNDs
+-> ssh-ed25519 4ep2UA bDGTw6Msbh9sOp66l1VKGrT53AlrPv+QG2T6ZJv1pDk
-ldPkN2iSBrU8M7WCZx+PlgUhEIZEoUmRWRgRHvG7+Dk
+WvHFJ3LIlpiuVhHUxY6egKifWNepzIB7Ls2R4Kx1Kng
---- emzp8uRGi0GDRt9HS6E6NvmwB7LyI8mWED2Mof9KFrA
+--- Ec6/6bQEn4GQOedrSzE+Yw1xRjQA34sj29Tr3zLFgZo
-WK 烾ÄÆý;m7…%‘cl4‹8Wáå‡÷'›D} ýœ.x÷l»fGºj�«yàÈI2ˆ~h•YKè‚Ͼ†Ù‡Ńɺ…"VÕ"(HQ>å­EAG€æx1
+NïP¢uGc!Wcݼ¯£ \¼ìæ—K-©;]Ðu¹!,ó$#nŒ¶dZ‹«­¦yž“-kX’BÕÙƒ°·ªc'‡Lò¯Fl�ݪš6L‚n˸n’Ý£f$ƒðÀ´ê

secrets/gitea/oauthSecret.age

@@ -1,37 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg iDDZb1/mBldfguf43wN0TSuqOXsEScH+aDZDKrVl9m0
+-> ssh-ed25519 87huqg ua9lzblqM2d0AmRbEj9c6p8LVBxNkYYr/vH5+HFoDEI
-FSHO4h9Csu9lJqlNpsY3bcDt58eSUxi9ENr365lBvEs
+Y08ot6KWTZdHXjYUsc2hcKnQlJBtcmE1oD5+OX86J80
--> ssh-ed25519 8UnW5Q TzreBNEiSrZEVSzdZCzm4J7BP0IJ0U3U+FdINlUvMRw
+-> ssh-ed25519 8UnW5Q QW+RWL8RfOoPfZEb+m2XHNgvlUoLZqPSDjx6riMCXDk
-X1SKp6T7YVTuqRD9ozJWl9wGLQS2XpL2SsP9JLHdoHo
+DyJSnhbUWRCMUWlHYnz/jbqBxazGXEaxe6/T6CNtvsc
--> ssh-ed25519 UFfTmg F2LDdqKDkBIHrvcT4lZs7fnpRVH83/Rxnt65ATqVETk
+-> ssh-ed25519 UFfTmg XcNVYggkFQmj591cbFEpz0ishJgp90W1Eu1OWphmj1g
-did174XGfcJQNubK1B7W9F5+ZL4XDQfa7zb+3WXsd1g
+3/GL+Q2euyXgcapUXDt8Mw5Q2+bbk2C2voQgGuTtiUU
--> ssh-ed25519 xNtnoA H/lAt2D/IK8qCWzTDh8hrm54OrO42ETYJIcOqYgF7Uo
+-> ssh-ed25519 xNtnoA CYfNyaWgYlM4oe/G2sI99gvldiKY9ScDsi7XPLnDTjU
-+yOkmOn65o1X5Mv5PiQhAhFDJ/R//6f96i7PslUsNYw
+h07PCdnOUF4o6YggrJ27Cdc/Gb9cu5CE0cZegyqLiKc
--> ssh-ed25519 aY2AXA N98Z0KfofoC/OOYyEhUnzQNMJIuKQN/n3t34/j7rHDQ
+-> ssh-ed25519 aY2AXA NxBftj7RM1QeZ5Np3Mt/xsxZ12XMtgHh/foWN2uyyT8
-sL2tca3lYlgrz8BE6cSbWyOL8/p3ocgpR75BmP14tpY
+nXUQI/tjhtPSYH6GFDxw5oIQnrLrQHYfNpriXXqH5fg
--> ssh-ed25519 AQhf1g w0czfp/ljjiS6a5SU/stgWSw1yIIxgxaEQAQPFUzrjE
+-> ssh-ed25519 AQhf1g 8BTUwRGn9xPBIO+Ez2viFtp1B0LzWR69Aer0B/OfhS0
-mdVPm1r9VTXvAaGS7Bajg/yiUE4Hv8UMF9dSsTTwEiA
+uKAkoOTpuyLFnqKPXgTPYBriaNCQZz/hwSLkUKypBwo
--> ssh-ed25519 mOmPfg oh9DqeeAL5sFTB6baYe5QGcyZOi+/90kIltmTA/bpmE
+-> ssh-ed25519 mOmPfg FNLltRffV5bNxipVpxAOkfviS/RKJfrZ1TBWIVSspHM
-jA6K/lAEBjhSdgpoZ+qLlCtS0RpbyOMrETXtuvOxv4s
+ML0HeuZwms//wyIBfXspWQPLh/DSbl5YkcyHHJ4vZ/8
--> ssh-ed25519 YJiRbw 1dT8jG+xx1GNSISZdT7WAmaP2ltxkMKmPAGCde+ucRM
+-> ssh-ed25519 YJiRbw rgJDr6qSeN679l+aIfDuhonxcoGw1h5C+nVGS0ce3nE
-gYae0N5DuZRZ4S7KufXlO5K6kC71YTGbEVx4p3oYBT8
+c5xynEMZNtHuPb3wc9d8QADay6Pgf5dhSw9jLw5jkjw
--> ssh-ed25519 0/WsKg 5z5D+ckewk4cXzygfGrcPE4e01rDKo2yFU8MFzxjz34
+-> ssh-ed25519 Nl/5yA /5IxJynZ+oP2iBZikH1dePktiwHrjYMSSeEn0wR4ywc
-Su0ZzamKBmyALZ06iU/4fthHnaimTX+MZ7g+SMNCmYg
+My8esaXF11AgCEOeyNX+JRgLGuMlSPYGHqJIbxG3XWk
--> ssh-ed25519 Nl/5yA SpZyA5mzLrtF0TyAUnAf4pplmAda/ZkNP/2mW1VbhEQ
+-> ssh-ed25519 GdLgCQ zKBABsXQE98vU0BgEj5onnfHs/Ta9qWwMgKKPFI//n4
-HcHUXgrdd8MobLl2KonByGUg3xIF3LtJ8dfAjTMeubc
+h0cMTFqCZ3pON8JwZBfJz1E2HPWVEqH9fRc2ry59HaM
--> ssh-ed25519 GdLgCQ 9ty+jQ1QEmakbYfYRglH3aYRiWDlWVoyoAvr4mhaIhI
+-> ssh-ed25519 tOH/HQ oPtW9p3QZzva2unDORMZURJAl7VVbuGF91HCe+wbTzo
-AWurwo3gS/sqFYA2x43uf6bVQMPgIScTl3bO6rBTH2Q
+9bTm0B3q1tFNVepL20MIU5hWUFK6uUn3781NDqhWkv8
--> ssh-ed25519 tOH/HQ xf9oXzcY8WhHKo0+igVMXftblQEgtsYRiQr2HIBvWDY
+-> ssh-ed25519 FpzvfQ R4ZCZsgf2tlN4h07M6mzgR/lhaZnP7uyUxajO+oC+UE
-ErehHTChNeBt8QL6LGduelH38xmH6g+EJ3HeLcGKfqI
+iJnJWKYrushgkegJPxw7M2aimtQ/dqOB31BHnMaFTm8
--> ssh-ed25519 FpzvfQ WwI5B4bhYqUd+kyv/qfsdZF++vPwv0z/VHs1rLgA+EQ
+-> ssh-ed25519 2UotMw eIow72TygjpYbhJLCqt2vm2X7bu3NjY6MFTOWjl+pgI
-TbZcSqK++NDFivpCvDbVJsrgh99BlkTtrEaX8N7AyO0
+2EgimzYzga4FW5c79N3ppEMVvREAmh5wx3lI8gh0/BU
--> ssh-ed25519 kdPvzQ SzDbjtauFcizhjnZfG4QWtU/OuAP6A3zAC5IU1bVgyI
+-> ssh-ed25519 kdPvzQ 5XbOccIDpMFKcCaBWFRWWCaUh3p1LBJ0ayolQroZeA4
-f6VAcC6ZJ/a/Iqy+nAQcR6QSIOxQ0w9rEV3Dl1AcgSc
+Jb+n0HeR3gDYizA0kta1TBvEiZryKlDwbuoa2u8PyKM
--> ssh-ed25519 onmXpg 6N3pFYE/eAfEHSos6DJCqWj98lzh8eKWTX8cKqtr9BQ
+-> ssh-ed25519 onmXpg PZR1T8ylkM55nGIBYiCroNWNTwBcEA5PZU1YWH3tsWA
-f8q/cHQ3+n49H5VP9/KERqJelasa34FZvBe6Suj0SR4
+LsOHqiryBJkA7b463zyg3IToKy1Teo/miyPfENewGnQ
--> ssh-ed25519 CnhD0g gGrIh8bxCV52xGc83dGIUBvfSwVLW4Vg0iKlc9Gz+nI
+-> ssh-ed25519 CnhD0g j8T3e67+tDXJFRsX/gC9qqQn6YGFxgAMwWsQ9vlDsGg
-TjgGfOIDKMtha50mPumPHqgaITYRnuEXVfrBGmxzlVI
+KAOrCxfTTo4uB0EjrV6VwAx71hbrNiJuP6G8F9lOr2Q
--> ssh-ed25519 4ep2UA TdsseBn5UGPnXtrChro0wf4IHMrudNTNYKzbRiG3AxE
+-> ssh-ed25519 4ep2UA wC0BaXPYM2iRPRBhQlOo2QRM0nX084cDp6brzKWjkzo
-USm6bS3A3m8vUO3JY54dcTtODZAdZsJSbAuRD1y5Rt0
+wNBztDXiPi6K9q+HJRXsr56/nf6k/aQJQIEpVCjQjQE
---- htoy3HVrfZj0Pfl6qkK8DCj+kARn6O8M/BhkXpLcu1E
+--- IsVY/KsFoTGubmdpOdoTI64+O40RJplehy026aS1RJc
-�º~\t¦Ü×a|Ä“ôá	�ׯQʯw(˜ÔÃ.•SeJÜkÔ
‹‹¹Ùâ·ùazµS&Í5Î7*›ÔKèfÌo«KT©5
ų0·Ý�Y˜\Ø£GE2‰Ký
+]̃R…ÊYávŠ½²1ù\½LœÙkœ”­“¡Q:ÙŸý6	š¶¥b»Ø*ÙI­ÝZ3ýAóQÆ%HÑ4Êða0,ìvÇåÙ÷Ä­Äþ7�ð-

secrets/gitea/webhookSecret.age

@@ -1,38 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg iCgUGB5ce7TRS5Cm7+ROuxs4Rc4LXGsIEFFRd3Is+DQ
+-> ssh-ed25519 87huqg iZk0mtBXNJEHptCG6sm5Bre86Ittrbshc7mgBg8lHwA
-95deqc2X7cXJOkBAJOu6mdk/gf4g0mOV41vWupQmRIo
+YgWizpWE1BvU8p4A2nnVM+KEW+pP/VQfeXNyn2C+RkY
--> ssh-ed25519 8UnW5Q QTtK5n/dtnm5JzzeNrxh1JmvnVQMgu2Wz1G6MAq3LCk
+-> ssh-ed25519 8UnW5Q rWJlpARVcYaUwReRg3WP0Lo5EK1WHXnDF281NfRCTh0
-WAIkKpMJLYMATfHCyj0AJVzTPnAlMGqqirn83NLXVeY
+6JMBB4BVRxh4irXU5jR7NEtGgHUKEnATl05kPLkIJVk
--> ssh-ed25519 UFfTmg t+Deer+hgn2+45pkjuzW+hzJRocLdTSwZpbVRSrSeHA
+-> ssh-ed25519 UFfTmg r5QfXMP2yX1sT5/NSZOk81uKuUD2gHKCJ00OUfMstxg
-2Gb9IEKRPmSwE/lWS/lwQszl+y2YsiO7wIv21h2wXnw
+9vQme3i/ip6BdyWXSqKf9KtBciD/xWnlTfU5bF9n6KM
--> ssh-ed25519 xNtnoA 4pov/sXP+HqiW3T6/kmOtOPlsmUGEScRRTq/ajvVGV4
+-> ssh-ed25519 xNtnoA kiD+2ao6nBdkn3Us43lwCK4FMTWUX83AXZTdNS2ct1k
-eVXJAcNQ5JoFC9lZF8vtmLfGUiUqWUouvQSaMFpYGS0
+BQaO2/DuYW42uSRu9XLz8A3N7H1H3LZk8kz1Za12qTk
--> ssh-ed25519 aY2AXA FPATcHTZrjb709XkHJp6iqYQYtr0DECYHQiqM1jH71g
+-> ssh-ed25519 aY2AXA cG0+CVmbBoR3El6TwvwrJhHbuLKpO0FNLMQQuAMU5XA
-cLK2Fm7oDL6L2BBH5Gnoy3pn3bEJIIoAczYefN6+Dk4
+uedc7XXzPp1q877M4Kb2AfGAafp2unNIB8Hz/15hSbg
--> ssh-ed25519 AQhf1g XQfu4fJWgrdr7rm1kWVGq44wWTMa2ihE1XDi3etugxI
+-> ssh-ed25519 AQhf1g ZIT944IUaACBEPFVv0/Q3Era9425gfYPDHTKQDFj0TA
-4utpAuup+QisLRX62TiwjzkDxWRQ1OCX6JAdVXRTC8w
+nJsuyOXfhNqejnljvd07tiGAH/6cVebb8N9op+yUkaQ
--> ssh-ed25519 mOmPfg DkI63znwJU3S1gjsSu++DZwV6ESAJ2gOroj2JgEToUI
+-> ssh-ed25519 mOmPfg O+i/JqV2MSpDtjq2fGYsZk4cGe4mY1IMxfFiVsZX8FE
-9gxNErI/wYffYOno/1s5tTDj8qrFOUOfM2BHR/p8am4
+mqjMKCEPYrP9T5QvrPgrqpuQj90syD5Nly3xcZzlu+s
--> ssh-ed25519 YJiRbw X2PJfMTDs6kQ+pecTkVATjtm5kzGNs0hKuM01GqzBVw
+-> ssh-ed25519 YJiRbw cww2VvvXfFmWdspOqp0fYNizYF5gOJoWo2z0cmc2Q3E
-pp5IZxmsNI8DaYyETCPz72BHdamsmT9e/0HH6M59kOA
+t746Geby8GdPXb4G6PSnYWxAYHhwEygAy2kWOTNlQSE
--> ssh-ed25519 0/WsKg sYiDJlriTlNsDiE/pJx62UVmaiuB4TLuhMJ034PKUgA
+-> ssh-ed25519 Nl/5yA /sbUMK+/aNe604RdYYGhC76NUAUV0zWC/d/BOFUMdDE
-jv7IHgZBEBSslBfN0AbiEc7BzFAogvLLzt2zLD3IlRs
+UYGmy1Cq4aZCJ6XghmqJVgCI+Q50NXKzVTbDV0cwCVo
--> ssh-ed25519 Nl/5yA kFZMA1SVQI2X5S2aXjnQMFZ2C/meQxb5Lte56Cgq5D0
+-> ssh-ed25519 GdLgCQ 7DVn9soiWBMSoWH8s0vJh9CxTnOGqwT1kCD2kKJffXo
-FtlS4Y2cEkLuMJ8WNSh93S9GougZaIQrx+mFht2VKg4
+1S3yC99Gp7im+ntDy5BF6Gbja0qI1iAcbBnUGBOdG2U
--> ssh-ed25519 GdLgCQ pe/bkOigydEzsrqu+Oq5YIHT0T09VZwSYEEMPEwTTVw
+-> ssh-ed25519 tOH/HQ HjMJb09INVPg9p6eFWDq0x6aXxtv3e9WHns/b9dRq1w
-iqSeqHCuJ1Nz9cylReoHpHZGKIiX+eCRK5K4x3Lm5XU
+rol+78bs1kWGNNT9uGgpyhLo8Qg2KFZOZNV40o9ngjI
--> ssh-ed25519 tOH/HQ HY+keQnvJe7RsG9/fCNKwgEpOvSg7WsmkI5KUwaMvn8
+-> ssh-ed25519 FpzvfQ DYtu2GOhQMVefKgpFzGsUwQE93AABG7o7zlYBx4Sax0
-YiJNm2UHF9xOlmU8JR5qL+/IhmVOmRx/ZvRYLky+baU
+p9aaahOTOcwTwJh887brzzAz0K9eM1Q2okGwS6wcPWA
--> ssh-ed25519 FpzvfQ OJUnmvwDnsLGdlXFuhWvpR4GAUBG8OHHNIAHPOLi+Ao
+-> ssh-ed25519 2UotMw XrenSoEXsC9g8pF+nIYu3/mEEE92h9NsjQlMHWf9RVo
-ADIq39poY1hwe9OqvwMvwy/yuXTZsgdWfwRfTEUgJDk
+c3GnMhYdVXnTZ4zBpp+ZOL47i4iQ7PKKreWCrLz1JC4
--> ssh-ed25519 kdPvzQ W8njxBXDY6IAzwpduheN8oCQo9WBUuFCwPB15wbLDiM
+-> ssh-ed25519 kdPvzQ wKe++MlxxvHTN1fogMxxO/Ek8ytLnUY4rS3/TGwYun0
-wKeT83JqP4OqzDWzAZXfOnQouuMSMgHZyHvD0EgQNNk
+yERY9pzUSb7/YSkVPuhX9fJ6SHFZhgBztvx42wRU9i0
--> ssh-ed25519 onmXpg k3DbEOOt17SYDvExM+3CpBAfepCPKAYz//4xHEkGSi0
+-> ssh-ed25519 onmXpg fccql4vrSXq2rmGNJAwNmnXXj/6rMp9rQL2/T19AeAs
-kmn3tBnfmzRcNCn/bsWM5hTlgymBE+gVwn70UTOmztM
+41pFfrrmas1ttzD/wpQjJIbzgi27p80hJtuyXhpwE+4
--> ssh-ed25519 CnhD0g jCWQ/TzgDBXzQGVa7y+OFGamymNFQGYGRLEi6vYyJy0
+-> ssh-ed25519 CnhD0g cgwxIxMn6IFqHIaFhTrN1ycr9d4B+sSVcLZeiHaVn28
-49hU8S/thJ56pQrT8pYN16FSMN589CYeTFumVuXYze8
+WFaOrcE8RuxatVGWCU+EAYTOZmks9bfKTme7s7VrDpM
--> ssh-ed25519 4ep2UA fY4fefeCcrRv90sudPnyQ2k9EKeoYOIKCjzd5n+B5wU
+-> ssh-ed25519 4ep2UA zStnhLrVw1+BNhOd+LQ1euusmCQnyQx7/ukUSgEs10w
-IYs/RtzBzDQVSffyWk3FxR2NbRTOthtZRCoxik0H0Z0
+NDzx2fwKDs+of+62Gj9dE3l1+Wh0aVQAfjXPjYFjVc8
---- 5XoWoRuBZkC+4WE1lzTwVlwj2XoFOfB/fEmzRWb0+MY
+--- 63bVjaHZOWE+1hpG5yDQN8vMspyOOfw3NnXLCYSL3eE
-+]ÇÉyw aÚ»Ke¡üq9o m^x¶Aüíù˜Ó
+Ú![„•j-C3[ä‡æª0µj gÄѳª‚È(Lv¹•Õ¬›Øþá2Eý+qæ%ª�ѹP­ÃŒíËÑL�s;3˜ù,³7]\¯–
-q‘ù¿)0&ìO}§V“\4jÌþ-êu;z“3ïû+ˆ|P\j
ÿ
fŸ»9—l

secrets/gitea/workerPassword.age

@@ -1,38 +1,38 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg A6H5BG0J9CcPatDKkraXHy+RSdgxtEH/jAaBMJrOT3o
+-> ssh-ed25519 87huqg 9bSltGjltla8XkrCzhfU6yqy/Kb73jHmaaxpgE/mYjc
-67qMA+bupmSdVl3n/Htt0F2DbCjoaHXazrFz5DQNqUQ
+q+UwMDloa3ud2r09prz5/nsIF98LI9xDqnxW12GPx0k
--> ssh-ed25519 8UnW5Q rw5VvXm+g+clTmHSEruaUhZBxCjtdEoFxZtnDNH3kEQ
+-> ssh-ed25519 8UnW5Q MjKIEX54pROJm4wMTQFP9vc1uhz/gN81zyy69zQA2A8
-uyHJMFUC164ggrAoU19kHisWRLxuKke73a5aYArSwCk
+B71KLdMEXUgyD1lg1nyJPXnZXxDSKyvRb0BBOMN/y6E
--> ssh-ed25519 UFfTmg Yby4BvS1V+Rh75Y3blU6c94G4pzrc2B1AiXkz/GdHXs
+-> ssh-ed25519 UFfTmg fk/DRRcki6qQf/TnwBA+FIgLVdrYdktLR9yf9r/82Uc
-Q9J5HrXkuPmpEh8s28Sx+lM0sR+soekQ22g7ri9eu6w
+PUpzNkavVk/VfO8X+mb2IfKrseA1yJJ6xNnap9W+FUM
--> ssh-ed25519 xNtnoA zUICmSlbcLHf8fUW2yZMqwtVVoM62K3X8iq32DNVpR0
+-> ssh-ed25519 xNtnoA 8wXxop/HSkpNJe2W+Lq6J1dPLk8P1w75xHKUxUjv918
-FawGMjW+sjkYZFGOvXft2Is/1Y4eCBq0IZxVaq06rO4
+may0BdqkiYxgaUGxv80Udz+UVCI/+pFgzlCZetEzLoY
--> ssh-ed25519 aY2AXA 1gQtbMWqdwlaH7vUBMukz61J3vuF8FR+xSxHaY6ON2k
+-> ssh-ed25519 aY2AXA /GeX9PATA0svXJ2cq7IIoWAx+Jap36OYFFw52mbtZ3A
-aocdKBkmsZ3J45Fyy1jFovWW8Rh9tQL+AvWBH5C3dW8
+BEOqSa4F8PVxGkVT4lSsP8FiloINw4mEjtZ+Dq6u9Kw
--> ssh-ed25519 AQhf1g u9qN6jmuYK4KtkBFhOcIzxbpFCY1EkqMCYIYx6q/P08
+-> ssh-ed25519 AQhf1g URV4/G7uUPxZNpP09qyS6Tok7KlcfjYCGqEGftwkM3o
-KtvwX3NN6HMc5lOMphqddXEjhuK4rUrFJ3nO8TJxJTg
++l4j3tVMj8TcCE7KobympPIv3fRlLu7UGnZFeNZP4xY
--> ssh-ed25519 mOmPfg oB/4Gy5dWL7EJLwIDLMr4+K2oUlgUIWBy/g7Yx8QyyM
+-> ssh-ed25519 mOmPfg NoIRVRE3P4/nnerdYsAw+S9csK6NB+AhnjYQj7NZZk0
-ZfIjUqOell70m8FJYSNKaLweU+jXtNXafeZ0mktVkac
+GUuYluAhGcuiIfB6oh9rvfcd1Trhb/Jeyb7FAz4Plcs
--> ssh-ed25519 YJiRbw 53FFjal/MjaqaVT3rNqNlmKVKc/P+lp64gW++C4GkxY
+-> ssh-ed25519 YJiRbw n3/TMqijUG2LdAsqrq13Jelw4hEenbjMu70YknGrtCE
-Tu19fCXb/JMXuPqya6GNf1E45c6CmvAe51yFoSiXHMU
+LCfUQDnpe2a7dD5YOKcteXQ4K8FyZNQ1gZi1GPkuCYs
--> ssh-ed25519 0/WsKg TrIDepX4dHixH4AwWaOnwjcHO9RVAqlqwBdr5MlQlmE
+-> ssh-ed25519 Nl/5yA W0IMc+9Mpjehqib77k1LLeUoKSp8QwJkz0aEfAttMTo
-MWUCyLN0YWVXg7VD7vvSYTGdmzm/TBx9fHHffb5OjWU
+0yrHlLQR3g5JGAuICMYQ8UBQ1SEdkPCiVq/j4PBLm+I
--> ssh-ed25519 Nl/5yA aRu6l7Vib4imh9LqQKhoTA33KF5siMIlmK5DktnKJDc
+-> ssh-ed25519 GdLgCQ W1evgMNEDrmT5cgqRPK7NsTde8igIIiYbjRPBu38WSw
-qJeB4YB9Sdm+9NTBwueFLCnbhdi4N6O+ELTVGbJDvz8
+5gDQVJxEcChyAGak31Qh70eFjOu3z4iLXZejBRXjUwo
--> ssh-ed25519 GdLgCQ f93Q/At6T7Vt827F7ytV1bxZEOLtLZFUavsIaeW3agg
+-> ssh-ed25519 tOH/HQ iGA0Bf0Moa6UsXC484hFHp+4by41o8QhjsrCtnlnjDw
-xoChxHLnyEQs1T5ZnuotnwyyMZlZh4PJceOX+tmHAiI
+YELtzO3zBhul4CCPdSaOm5KctPAoU1y27Jgfrs1H7KU
--> ssh-ed25519 tOH/HQ jFZTM/OQpLUXZT4ENX+1Qq9iVJXXpEY+rfLpXJvM5Dk
+-> ssh-ed25519 FpzvfQ LcehUBu0dDyGfYKqbdfxS7d6aTtYTgpokG+GWHnjtzI
-f3ZC7CbikEQpBwZcqYfhBIws4up3ZmMk/2mOS/Rf2vg
+6Rcos5SJmbUXXtMFqge/CRUb4RVYaHrt/H9V9tprBxQ
--> ssh-ed25519 FpzvfQ rxuFxwpguxrqUBe10asuNe33Xg6Ebdoh9oNZdz3fqCo
+-> ssh-ed25519 2UotMw Az0wVK6RPjD6Mm5H+gvCZDRuNbHFmuVXRGMKBgL1SAY
-MfEGIDV2nsX/MhUFEQDbLsWywFLHrk65gbbMVVPdJ/0
+hf/DmLzyPoMQIYoV1A7CEifAdKQD8nOy7kWfpiJnuN0
--> ssh-ed25519 kdPvzQ SdjtFcZ2kzuBSDOF/I6m+e/R/sJdf1gst9AYOpefDVw
+-> ssh-ed25519 kdPvzQ mP9FISgXfkj1Vflxun3bgnlwwqLFhL/RI7knX+Qpml4
-G0+6qeS8QKHvWKbZjOv6+6lR324OVdAo31kTZJ1baC0
+ax99X2ePfqnYIsA3knPz19lcEv35pTF3YgEAI7FI/Xo
--> ssh-ed25519 onmXpg x3F8aAlT9ndzfeWqiOz6HX0Zs9kNIP4sW7mE+caJQmg
+-> ssh-ed25519 onmXpg 1Hg7Hf+HW28fBH4fMvrNUAd1XwiLOFGDQ7Tscqn7UzM
-bz+YEEnu/ETBhqBTZiLRyVnSX1SRJkfWSmrEx2Tzqgc
+Cr1Y/Z60BwLm9b7GA94QnlNBwgmUqe8X8ksAZMHcgCk
--> ssh-ed25519 CnhD0g fNddA6YIHeuKUVFaAkwU9f/rSfYzQXPuw7QbhQD4YFQ
+-> ssh-ed25519 CnhD0g TR6lw5KiTVLkgoErQMMTbgDAhV/Vdka35izHR5SJIjI
-4Vq9uwumfzpgMxtvmxt73EPkkqrhS2qApaJZoQwUEDM
+EJs5EOZlprrfpQfpJgE4//VI3bAWE/OPV6bNOF7O3s4
--> ssh-ed25519 4ep2UA MslFSRrk0185JfNOhRYkJH+GMtKIg4gEcsdsT6CBAX4
+-> ssh-ed25519 4ep2UA pSDKM7BZFXY+6BAfJYTar/eZ2eE2U18iFGdfmb7xPzo
-Ta+Wz13G2NOcdJ7qxZHqBYiDz9fU+ax++BTPSEi6ZVQ
+0Og+gnsiBQcoCJzLIDSfTLRbnPf9ZqF62HKbtNcknrI
---- E31e3DZgEDqDTnYzMI/Pbh1pyQT16bWTzYz3XZY0LsI
+--- 8adV1z73QFaTnpZABU9wkK/QfvnFdsVamSgndB6aGx4
-\™l—`]yɺâ
Y-‰g£‰
+\!Ïç>ín;¥.\¿±¹üÆB�sCÒ#é!)D}ÆPx	ï`
-E»ÊÓ~oÜEåŽÍÓGo«	ø/ܧ
Xg<.O�º €<ƒúÙ °Øû¢ƒC½cûÎðô©UËB(
+O±zø�CÙFB¾tèÞÝnë½vÂßÇxÊŸ÷صÿ @²8+Ê

secrets/gitlab/db-password.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg Eh2E7tXjZj6ydDOSsFD8UKMjSjLWW6YZg/5bzcdMaSU
-0vXZ9AGU3N8Jbep6TRijGKoo89jK0yauG1LmErtdT70
--> ssh-ed25519 8UnW5Q UxbfpTqUcjkdevd0WwFtUxifEtDvedj8l+V2wFVjThw
-6aYQDmzFj1fin7G7e0cUCn55PBU8bDolkw4l+5A25qY
--> ssh-ed25519 UFfTmg Dfm/r13wimRQT2hQSWKhyr14BZliLrLGn/sZq3G3yTY
-qzZLiowHu+HnSY31yXBOFPEYn2lJSJ5MyWvKSe2QZcI
--> ssh-ed25519 xNtnoA AltIha0Z9BqZY4V8LOzCcr5KPWAvoNoyktReER3Glgs
-ac51BT1NGldAn6N/s7KEkNrRLhmntwx09SguGdZRR5o
--> ssh-ed25519 aY2AXA EmE9Bjzme13LSSMZDnJsPFvpXGamtc/H3DOziP+d+Cg
-VN5z1+EzLF6N232QwkO5TT5Kf9NpoPDL2T50qCpCfgc
--> ssh-ed25519 AQhf1g Z3Ezie7ikLb/8u+iNALI8x327lFqLN1NRIqHLfjqNFs
-QQDDH6Dio4zc0FCsLDRWl3ywaEdkp4zwGG+Iaegmi3I
--> ssh-ed25519 mOmPfg mSW3OSIm9/8myqUxEJlsf0LT7vCO9i6/D3WkWKCD7l4
-U6TkEVyzxnb+9B2wLeEkQ4g6w5s31Q30/Q4ehQplf3c
--> ssh-ed25519 YJiRbw Gs9VBwzEPr1QA1PcaQUCUwS+jwXYVniqe5TaZBjrJmQ
-rFS24MN8bzA+vj6/sJHuEC4yYglpf0OJT0GgUVm0HTs
--> ssh-ed25519 0/WsKg MbcckXyUg5JfGafnhidk4dH6mEuhZOPac4YncYeYOR4
-oeFwgCrjDPauQSCgE1Q1/Smz6SI44TVfuNH0oP9WcdM
--> ssh-ed25519 Nl/5yA 9xL4/5nxpciN9HFFO/X3xQ1oMe+EvLohnI6631amwhw
-n4As363EPOxuzN5f5RNuUrlEDFgmhVvjtEosQKTPVII
--> ssh-ed25519 GdLgCQ P+jwMHdoS74jIdGQjOx4sDngWs+zxNpnzSgrDXD7Vkk
-NuGd8agrw/8PT+dw9RirCYATZRPnF5rKDSfyDaJ17iw
--> ssh-ed25519 tOH/HQ u7gM8oYWpfFFW54TqoisGDEeX5MKxaVxT+ozl4miF0I
-avmdzbzCSDv4ovYMMmqx//G5FVEuz+hOJpr9/49w1Rk
--> ssh-ed25519 FpzvfQ 3bDfVBMNavjfMFaKO8C5VvXiDMQxfB4WYp9mJ1LnIQI
-bl1KwNL5M8gJlqE/R5/lY7UlLOgeftiwinyC8yDb71A
--> ssh-ed25519 kdPvzQ 2Y9lCbnjBhF3N0BTzhBqxJ/NDe7Z9/Vpkd8bbL29D0k
-pL4VMb6jnQv4bwt5SjcORlTWsvSWOhTNZXNYEkCZH5E
--> ssh-ed25519 onmXpg 2Nw16oXRct8XDRqs6TRiOK6tBk9kNZcR2VDLy9GvOkM
-N95+6Ia9lpbKenojMDDAuLrT4cqjENsWzrwplcBKiUs
--> ssh-ed25519 CnhD0g j7udTMCoQHrqYnH/mxGgRzor7RaTm2HjaSwuoVQqCGw
-ivg32RGKKCqe2yBjq58ym8shWlrYNfcvuK7xy1F2mmg
--> ssh-ed25519 4ep2UA bBdPC5asgGcu60Y/i0yVKvAQc9U+7Jruik0xT8rDUA0
-ul6uiMBstdXVVmuIpgsZPSt6MQiyklPGYSbxOTLndeQ
---- 5mAFqAG9hgU00QxYRKkhNl3fJ1KwDevvTnUhf0xYUog
-TW"	ȧ]h|nÁdÇ„Œô¡QFWv¬à©»®¨oµiÅZÂSŸŽ‡ÑG–í`|Д "�¬ó8n}:Î:ú6”

secrets/gitlab/db.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg KMaYb+ubBiCqBKr08lmrIhiuNcvH/WnnEDYYvdgnvgk
-lJM8dGwT3LYvI9NtPZOzY94bFhk6sxO6F4NCMJBDBuA
--> ssh-ed25519 8UnW5Q rUXfXe6S1jgTfJJGhT3NfIGhvYaf4aUAuD7wAa5GaxU
-OCe5kE+IM1MHqMPfLpgO5spYxDm1SDp5euubLkOF6K4
--> ssh-ed25519 UFfTmg 8ZIBc9wr/hoQE/ItltZhSbqlZ3qEQMyLajy0cORbOQo
-DocUbgXT5m8CgExF1ICAJv+Nu4rBogwaYz5vJKNRQhs
--> ssh-ed25519 xNtnoA x0uU0K78XzA9yYXg+jR6MIJASRxsJ9eMZctm276tP08
-SGZYFFkfbQpLVqV9OUQMMbOmv+0qNS3bO7IkWWjqohE
--> ssh-ed25519 aY2AXA D5xP6cDYNLUsGeLgLO2x2gkBzfPByR58G2PjjGs/rxA
-wiqNVVjyQPnZop7q0PXmOOw7cJr8WKQVl1mk7zL+/cM
--> ssh-ed25519 AQhf1g MJuVLCVIdZ7fKnXVvtJvSLriX1Q+2u20Y+aNI7N75hM
-EocXr6NlaanErb3Nmc9R+3DSdfoCAyHa5gDYzBX+xJk
--> ssh-ed25519 mOmPfg wbQrmVm8CEeAHpJIjCyFI7Mfhn3i9bER7FppanAneTQ
-jAvjziCLYUl//6ZlZ5d3gE1ONRjhEnPLTabvTJEhFg4
--> ssh-ed25519 YJiRbw 6ZAb7+mWKPCkYZrpcW1g1JoL9Q72rWwLIEZJtPx4ayY
-WtKeYr7wxCVisATDyejwnasFcVRtGa175wJoXNzhyKk
--> ssh-ed25519 0/WsKg yyQBUeYAFIJUuH6xsMYztjO8zeswUWFCgqiNoMqxijY
-y5azJJfyU9NgyY8kuIoWRfY1kMJUzgxx8UtqJ3XBNvI
--> ssh-ed25519 Nl/5yA Ffb3McX/NVo56cJXA51n9yrpeSTvD5/0S9n7ObeYrXA
-Wg1EhU0nk/Wh3Jf3+LY6dVLXBNbAM8miuC8gYdabIwY
--> ssh-ed25519 GdLgCQ x/k3xO9fHAPFeOdeAwgWVNqWtU9u6RVXXNUnhUXk1B8
-aNeOSmnUILJTjof6+7sN8h2zA+pqBmU6cpmD81xcmtw
--> ssh-ed25519 tOH/HQ ZEBu38T0q6tZkZSZIbGc3Kn9acTGqSbquPC6xlXt90o
-LPvS9dVaPUiE5nxVV8LsAjfRdyKBNmCwGTxOcyCxWMA
--> ssh-ed25519 FpzvfQ iU+7myrJIbc+xbVZf7OxGSBy7Vq+FqItVYECvrvV7V4
-YkMvBRDnkGf+zznWTVSbFbR/2BaqOT1ja7piiyRL+uM
--> ssh-ed25519 kdPvzQ cuzIgrPaJK1SY4soXT2lQkF8Ji7GZq+ihH2vYmbyDXY
-E7cA3PDHBsqm7Z9SbflHXQXMzv7B0uxYR4UQv9NHZ70
--> ssh-ed25519 onmXpg aNcwAfrg7CfnC9Whp/qjikADbZzeSVM0m+kLkjExg1A
-1RWx1F4Q6zA91UHxBmvuxqABv+mZZwNayAVAz0EqGQg
--> ssh-ed25519 CnhD0g LrFzQX5UKZAizqYkDCT/k6CWdFZYFqPguyLjgfcfQ2U
-O7Ta5mpAcLI2XswerqtW2fC0evmy/gdSQqLgW7L99zo
--> ssh-ed25519 4ep2UA 8B0v6mE+hB0iKaZNrkvdlI4E2y4lWNR4zJ8oJS75jR0
-l5M6WSWKGuHMCiL5V5PCyDfFCElGNmR5UIkXRivSl5Y
---- 1PM/nhbi3rtn26S1rtNwUT97plbJJvHOmPNzIYAsK4w
-W'SàeÚäß>pÎ_­Çª´vcHN›×9¥Å¡àè6�L,_ž[
3Ì
_ìaØí¬¤Õ¦‚>¶¯D0Þ„lô‡F4.Ó’‰µ5±:�úà�0ò±É

secrets/gitlab/jws.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg 3CNYW4sCTBsHWQaRdsyRomLXQ5V9jjzV+V9vHcKtqjc
-ZjGxC8Fqddlzmdd4uZxQWs9aAut+COJ9zWXZFQvRdG8
--> ssh-ed25519 8UnW5Q rgmZ4hwUDXX8VdQQWxZn5NO70j4IuJ1l9aD6uXjAWiE
-SfmW+u09bGEP164j1awAoGpvchg9UZS7tgtSdLeepB8
--> ssh-ed25519 UFfTmg MPZCtrzXXzusawPkfZ+fBWepH7MZihKXlz9ztfp/bBU
-RkLU9HPTJjyiaRczJU3sYMT0RT+oSvL3TozGRxOZM6s
--> ssh-ed25519 xNtnoA HqhyTh67Yww4wHVR9i5+K7388nvAYwkPr1T95Sn3WDk
-entg7nxJXWqq+N0LMUwv+psL+O6ivZjnGo+KbgKthxM
--> ssh-ed25519 aY2AXA XTpM0SssYVVEtnWPCfooazXvVccdO4IX+Zmp7dxoDUY
-mz6v4rzOpLT4fu+XYC5BwkXndNoBbEpazUt2wh0tutk
--> ssh-ed25519 AQhf1g bUAsCyBen89j8JqUV3qAVTZ5QrxluYOmUO7D68Sd50k
-14ebyL+xFEK8NMBzxAArVaxCPZwBPLNBLdalC9TGB/I
--> ssh-ed25519 mOmPfg Mv+p2kGC4PunQGSVD28emoEDra/ohZHK/xxTQVhafTM
-gUrUjDQCxMfgcjWkbGWmi1A2GF5X07pUKdZuuaXWdcE
--> ssh-ed25519 YJiRbw 0jxrJSU71zCnF1bDUieGOsc/TAeR9gv/1ks2kPN2sD0
-yho+rheLys+ET7uKrrlsljQZQ8VuUnzg5eUj7gVMgAk
--> ssh-ed25519 0/WsKg yxsm0H6tRCron9th/e9KfX+zFl5T3DH0/B602ak0s28
-kkmfbZ1SyXLJxlM/EeBRJEf0Rb+15w3nXZEZ35xuCug
--> ssh-ed25519 Nl/5yA IoFwKIz+jrNUm4PB3wX5okeqtPKANPP+/lcZaJ+mZ00
-0ChPqTpzLCCz7die5lgOnO+Yz8JQIqjTX5oLwXv/IbU
--> ssh-ed25519 GdLgCQ Fo9YJGiJMTpnhRQKd2cQ7XfQXLvOQ8+V5rlZvqOhWgQ
-Lhie4dV3210DbNvbkBWFStgycrH3xgE3tt5PYF0OjEU
--> ssh-ed25519 tOH/HQ 7BXNJ/wYMc9HIswKCTkXQF42UXKXCCqcD7/RQINx5g0
-G2HbqhnEuoCGmuowye/EWQJ1UWojp1cFLoyu6b5AaGA
--> ssh-ed25519 FpzvfQ l5jORObNye/4CGt9D0pkP7CAqhWZPPlEhCSmuc5JxVE
-5P/S8vQEzlYgXcM+TxlQnlyO6fK0lUkxBElfTZ8dR14
--> ssh-ed25519 kdPvzQ rbwguFPeDqBJye6fzNAR+zqo3vA13o8VBqTDMtq/xF0
-0wjGYDkSgeB1H4GvjFfM5HIxCFs1s6R/6US0TFv/o0I
--> ssh-ed25519 onmXpg GB5Hi8wAOxRaoyzcDuHK96+JNd/zfBdmR6oJdpYkmi8
-svDcX5tYRR8IzuQi36TpxqKu/vKiDj290e1Hx/RoBAs
--> ssh-ed25519 CnhD0g 4vM1+uQTV/dYAbYP7Nsj9DZFjFVc1yFqNzKxWyz1OWQ
-G7ifv77YIefxMqK1vSEzxPCxQaf8Sd2cdpyoy3DxGZg
--> ssh-ed25519 4ep2UA V+2q8xrX8eAQzuNV8Se/BUtut4EbkRsy/svnbRVO1TM
-WYJTqLxIqFC3a4z3UtMp4z7CAXEZ2NJUGzxftIvgoeQ
---- t27r1Bedv2MW11oCtfWXl0ijG9/aiiWMdEbgymIqdSY
-§66^¹‹�§ÌVUÃuï6°â$	ÜQ[a²U�W*©Ò&s9Iª23HœR÷ÖOJŠüÒ§É)CXeRýŽXi¾6yØB:b<tWÓ­¹nÀ>\+ûî

secrets/gitlab/otp.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg 6Yf7i221QUp6qN/CZOSjHzaycZUgAGSwTRjlKZ8Pw3g
-xQWKonF6dDP5hXg3tFNPim6zb6XxcJ7T96+YQ16ziMo
--> ssh-ed25519 8UnW5Q 8dkjCC6pl0z5l/ZB/M3JC9eUOyB6WipF08rJB7Sa40I
-kVuyfXIBCR1iu6tp/a8CBOQcXHv0Pvn/7PXuFvpnKQo
--> ssh-ed25519 UFfTmg Sa/x4f5tvvQjI1ZdEhklMIimXiDkId/6nXJwlo5z3Gs
-jXkH3gVRv7f1dsZMdVDHMh2BQ5Or66eIrwfoHm/C/Os
--> ssh-ed25519 xNtnoA GueQcHnvRtnftKkVehS9GeL4YVe6PonxbY6hMGdGhmc
-lM3gdP9edOI2mBJrHnD91g7R1ucR4xP3IfDLLrMeizY
--> ssh-ed25519 aY2AXA 42K0aTzZIKipmq7d8XGGgyIMB/dJALos4AZsl4tQaBo
-/k8yNXeksAXy7EzNVXQTGNJ18lVc7SxJDJhr9E5F15Q
--> ssh-ed25519 AQhf1g ql3uiFEScr0CbIALP0oD3+X56ti/egAjj4T6usJfkjM
-S3ZgjLc0ALm1PsSgxqAYECRDzqRF9BOCGZhT95Nin2c
--> ssh-ed25519 mOmPfg 70rXi96dEVYo+Vb0ekr0POh1RWWVE7QcySWIHmfNol4
-iGuntLq8pBbrOpdrfrhSfBHpnPxadDD0F28yeyFehmA
--> ssh-ed25519 YJiRbw 0e6SH2cQmLZStVR8zMixESrCnHFGiuFNvY5rr5cKgkQ
-mQDjego0IL9bATA5BkNjWhMRj+zwgjyZsrDDnV+d/5Y
--> ssh-ed25519 0/WsKg 0kLNpZmoY18kHQHcnfmcl9jbCuXhCwHObsUtSXK7IlA
-P73mC2PUI4LODn+0c5UBZvDmUqb4nuvNq07aqI5oR/I
--> ssh-ed25519 Nl/5yA bVpuj8uhAEKFTD04b3irvAJWcNOdFQzaUY/5LlyT8BY
-wLUHnoHvzRiYGd7WlYBamPzbsKnUYOxLgoQbp0f4S1Y
--> ssh-ed25519 GdLgCQ 9m6Y7d3PFFeOw7DngkZIFqBl86lL20cBr+IiNMTc4XE
-I9cHA5tTpUeTkglotot2aBetRhJrpTHEl629/I6GImA
--> ssh-ed25519 tOH/HQ yH4uXFXonl3GdB6qNMI1Bai9Dm7TAjbuHkpipGQJC0Y
-E7WK4YWwR+CzoO3827NhburCB0O6U8ioFZrvlnzvm+c
--> ssh-ed25519 FpzvfQ qKBmiRCSDG1P/ijVqIv3vMI/3k3Owf4faDzh0DBKMWE
-cAbGPLI6b1+2juLbY/eB8zr2/1hKPD/G++igdkWF06c
--> ssh-ed25519 kdPvzQ cCSoUaZSwYd03DAblZp8lVF1KqKgH/0Tgm9EnveJ80E
-FcLYsv9JmE9RuK+080kJxSj+/5trUIj0EDPf75bl/BU
--> ssh-ed25519 onmXpg h2aRUyrSFBupqLERDanFEVXReOut4Y94aq7EVmj4JgM
-yfDYFFI6p/M4bWcvHBSFe449WDg/0FlCCGeFkGgUWNk
--> ssh-ed25519 CnhD0g amEQyS8R7p/qJIlKNOdsHgukKMCVj1ypsPqWTsnuoCk
-+ZRH39P3lLs0W7S5iuLPBs9UIPmp7tw/gXvJhhPXahg
--> ssh-ed25519 4ep2UA hjodTPrxShfnJJpHLK7qD4f4m+jR2Pc43s3bRASoHg0
-GXiO0cSAG/aes2yqq9abdWqKH/9ZIk04TAVdiLpg1uY
---- JGKP15sCEBNrbkcbzcQmkNjSUvyuONGaM2SiRGK3WW4
-€ãÀUíñfÏ2&YìmŽ�k*¶Ü£c4�T”Ê«?„ÒÎ.\<í	ÇX²z,—Ó©þNþhXRðÉ16À¬áhþürˆ1‚ÆMŽÔfJVùØÜÎí¡Rvç*

secrets/gitlab/primary-key.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg pxinVlRwRapBcR4go0sPkLXzqQoGfqnXy2xFdTsiclo
-iik2P9JMR6rE7Dz7eACovjT6OCG07AD6kxbuAmKrPqw
--> ssh-ed25519 8UnW5Q 2dDafRkl6O3JY4dg1fEF0OVAAkHTXxOvn7L0wyeJmXw
-0tj+wY2S8G26Lpvn6wWGxx888VRNqvHC0+d7pfaZqDI
--> ssh-ed25519 UFfTmg 4pP9ht7a/ZcQkpZTacUBK0euaUbI6z13l74vpjpDgS8
-1kiQcsgUBhc5wDAzQqeHHtaNBQ0NgOa/nWzdvKqjgKM
--> ssh-ed25519 xNtnoA is0caVhVtHiGINKHJaXYn018HtF78KcXGzlGYnRhehY
-BBe830cvdSS4WHn+2AGZ4SuxspBaVErw1Pu95d9Zw5o
--> ssh-ed25519 aY2AXA VDMqxKqzMo1BrcSnc26pkXhlisxnfo0jEKyKKQ70sl4
-km1hfV+9sx2WDtDQMdA1Q2KdQ3lw/nmaUAOL0v4bQe4
--> ssh-ed25519 AQhf1g ye8KsZ7/Qmmo3gMmTRxCRux+0X/TDIkMfJfwEF56CwM
-ZWTF/Wl3G1pVPIxCBoLpq4eWuf4pcKSoQM7+p7vsJOg
--> ssh-ed25519 mOmPfg d5I0xYKepGdgVQ4f9A0+FLwxA0XRpyjpZ4YQoQ12/2Q
-e9O2/ROORHHuDhnZgn0KegO8QqXNycBu06ZD00qIZRk
--> ssh-ed25519 YJiRbw oydLfhPROsG3AIjcaSR/3rRXJCnljtQ33t7p2OFMYSY
-Q+7cbIZ+E2S591aIB/zcDmOnPHto3zxRlEYwRejOTjM
--> ssh-ed25519 0/WsKg RFPRDaH1bWOqy9T+IfTkeehB+b1xr+3VzHnMJy1ezAE
-DRxwHAcJ5g7aryUFiE9YzgMBXGlwCrzfspeB9ZLZCto
--> ssh-ed25519 Nl/5yA XBWei39hiN3SKNmXUKkv2ve5Us78lRLq4qsdQ5uoXTY
-HSiYWXkHhsT9aVJBVYJn7lAU6mkuDoO4pZj4TKHs3CM
--> ssh-ed25519 GdLgCQ FmskZXs0zQizSLjetVFUeekOB5MffZQu34kgzhpdX04
-b1P7JaVmwPqPQZohFHmDoe9n6WtSvOBD3/Puon7N81Q
--> ssh-ed25519 tOH/HQ MrCEOqQbdQktOmeC4sEEy7vX6SjhqunMpmnZ+ogDahU
-XDxLRZ2aiaEnq+t12SgSCbv3ZZclkJFmeFX47TzM38M
--> ssh-ed25519 FpzvfQ MlDNZs1/L8sAdDv0iAHiAKHC0ORn1XnS5st6l7Nd3kg
-kcZEp5WRPtZATThbThjiSLU21Xmfu6BwiB03kTUOTRE
--> ssh-ed25519 kdPvzQ dUWPf++1B9TU3jpaC3O2aFXCMlF4YvzZCAjASc5Rjwo
-5Hg9oalicLh09YSb7FokQSqkBcLMZ3ePGnzKCMCjjcE
--> ssh-ed25519 onmXpg 9WQusW0nfo/gUChf6plb3xQLAdu8Zdovlt+SHFFP+Fk
-RYHWttktn30aUkTSpRiY6jvVp6kZGDru6Ce7FWpYUmE
--> ssh-ed25519 CnhD0g etVMbgOUosTxt5J+oO2z4f4Zaf9XmzKZKiYzyRON0Eo
-bjo0/trYvXCNG4nFSl4VmKke2Dr2sJvD2Ps3KVnz9K0
--> ssh-ed25519 4ep2UA W9MEIlu/M1bQQFT/F0ns78lBvyVonXBpCSQysMV0hyc
-oH3V4KxWtL2eJvqxjxKcd/pGgaNilwxStNpKo29wPFs
---- +nY/B5L7D+piJGp7RbzbFeAw3EM0X5QJ6aEAlaVU1Mo
-#°y¬‡!c*WåÀ
èÈ4R2,ˆÇ^ë ˜`m¨~Ã¥$LJóü�ÏíÌs»*pÚ.+L‰þ{]=uš¡Sö™øç 

secrets/gitlab/salt.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg WtxBR7tl7c5kqqNY5RZrQIthLIG58hZx/ngR8cYdURs
-G7+mhXcqFOdOioKJFdykwOrakVbhtK5efxtisd11yw8
--> ssh-ed25519 8UnW5Q s8GNXAmhc1a+luGrtXDj/AvIm+YwIpZwKyKhkFx6dSU
-AvE+KIJzNJxSWHOCqp7lt3yqal7lt0EyqzvFlOi93qI
--> ssh-ed25519 UFfTmg a2kAjGgd44RH5l782bx+ZE5kyoOychrl0HNR4CMNtCM
-4fzO1n99/S4hjrKGUPcQ6RDfNOp03hW9TSLvXm9Gmvk
--> ssh-ed25519 xNtnoA AQHswbi52dxuyx0xcNQszHZiqmWYet408Vk4xwdAAWE
-TbtKqouXNL4ibrA/5ysqRukgrlVpQva0qBYW+lNg/lg
--> ssh-ed25519 aY2AXA am3EZYO/A2NgPgSfXmv4oBWG31Ylneo5aAhE3fxyrDA
-FD87d17FaaP4Zxc6bUW7EPOdlNbpZW6nL2SLL3pvuzs
--> ssh-ed25519 AQhf1g lpI5cpau4ld8sKIeL2rUzvfMgoKpYFL3K1x05tI0hAo
-9FS6CCEh+ozunq1b+wb6/4XJTDD4a/FclmfEPXJ17bM
--> ssh-ed25519 mOmPfg Na+4qv+953ioMI8SBAqWkZoiOFwddLrQbQ9ht8OQ4HM
-0Wy3e5+Qbu/A/vTX9c87c0AWB0d/oCB16b73OZ/QvAE
--> ssh-ed25519 YJiRbw y0sOGLFgINIwTMOvwHbf2UF7CmtjeQh78CauAbdpKTQ
-FjQigm97STgQnCzvKJTHfmIc1dd5ipECzi/0mCG2x1A
--> ssh-ed25519 0/WsKg rpxWL89TERJ3QVc7eU/aKTt4hkEXuwaCsGLxc/MWVmM
-ywI9bG65CcNTtWizrPL56jE3kF0bkM+3Y4JY8d8FY8M
--> ssh-ed25519 Nl/5yA tawS9A4aoCw63qALl3cnNLXEpHafDqQTwcfkfk6BOVQ
-FcJYQu54IgibrjK8TMK+MijSxylmIITv60jHhi4xrq4
--> ssh-ed25519 GdLgCQ HazAqkEjG3n/zJ1OKI30EtVjuLh7N1ThOlI/KUOZF0k
-YJNWVPWB+2ega6CPQd4VX7dKwt+/jsd6zgwujO/rep0
--> ssh-ed25519 tOH/HQ BD4L9RxVDyhrGs314dbl85VKVWwG8gV+mUo9il6c3Wg
-SNG3HFG0rEXasfabMWxzOS7hU0H64a4jz93hJhVHLIw
--> ssh-ed25519 FpzvfQ OuagwUFjEkdwuE7CvhxG6rX4cHhULqJiiXe8A0YkjAk
-XZxhnisJC9vin1t5EBkAYk2UFvGiqhkQAwtW+MD/ZUQ
--> ssh-ed25519 kdPvzQ INs91qrXdBsMfPq4rFlqXBOaAH/YGNB3krOzl6+UNhA
-0cZTjvo84WMFDLo9MOhRt/tY3xfBLl9WKVapgA2ecRg
--> ssh-ed25519 onmXpg mIwVuIwLVOHfs81bmScGFc+ztwYLoL7nXtw79lGhW2U
-SYgy4giBk8C+OrOj5TGCyn0Bh/jWciT1mtUTsu5B6T4
--> ssh-ed25519 CnhD0g 080GDLh3bH6ils+v/Yh2wTM5mNTiLDKeOGAEtvLC0x8
-IHMimypNNW5BYk0rJhlrLS5pcVXiAsgSrcWE9jflQBg
--> ssh-ed25519 4ep2UA SyPq6Akc95C785pmpa0jn/FUDDXIw/W5StmtbPKk7mE
-lxa5YbmvxvO1OPmT6BHSRWw+VYZL5irA2Hxrl3bbTwo
---- oPPMefKWvJVhcKuSHDg9Lk34q9+GKM4LHU5ejAp9hTU
-�Ï6IÁ’Õ!üòE‹k7WzŒypš˜?ÍÎ3_ ïÄ[UD²g¡åÅM)ÃÏ\á[+Ž£i”™gâµh¶4HÎ

secrets/grafana-secret-key.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg X/WiWcKfKUrySxBYaS50hMWmFCIkZZo85Oa5mS0H2gU
+-> ssh-ed25519 87huqg 4imtB78FqoMY9NrpnUqx8laJYPvR6Y/4unT0Yx+r9D4
-TTPstszz10pk4Q7/BZ4vmxl7EJqlWLWuIAj78CYw6gA
+dkFCwD1ZQHUVEbk3c46MFjfe84Gr+9JFY3cM4fX/qto
--> ssh-ed25519 8UnW5Q l6Y2VjFtX3BQzFSMoat05G8PWvoMUs20YxEfNgiqODU
+-> ssh-ed25519 8UnW5Q ZMebFCDpAO2tzL7QLHzyq9t0Q7Escrooxz1iZit+2Hg
-7jRxwa2ot+RjEncbSasPA0QyN5rJ/9KcBlFeJSrCUzY
+D/5Vtbq1xob13K1LRC978D+FOUqP3Mpeyc+JjFvsXxU
--> ssh-ed25519 UFfTmg 5VEvpZVQuVGctJ++fiBCOFNxfep9HPou/b1RDmerfA4
+-> ssh-ed25519 UFfTmg h/ide1M5xfsiWWTQgq4fORUvF1tnk70PAgnmrBZC+1c
-5tw66zAndyRzCXiR75hQQFL2BwWfPvnbm/YfdbKUdLI
+citT/IavIS7UGO14JhnqD0cVeErVQYveoQzUn2XHHrE
--> ssh-ed25519 xNtnoA lDnNKjP+4LmC69L+lS7ItKXlL6iHbI+z0+S208TdJks
+-> ssh-ed25519 xNtnoA sGyjrbntQRxHVGceKHNxIZSoHMmQw7YeMI4xc1cTYiE
-HViAVNAqUpcJah4gQzfAAlpfe4CvlRDkKyKyAHN+sJQ
+aATE5RthE9VHbjNFpLqrZCA4nRqzzOtuX9xsG62Fog4
--> ssh-ed25519 aY2AXA 0m5snhqLLevXntHbcLbXeZPYleCGrj5GmMGYw7o/1AY
+-> ssh-ed25519 aY2AXA cvoOV250VlD457rmCOBt/O2zO8tYZTARdd0DcfD+Mz4
-X6p3+DCLURhShWemK8t6hqZaByAvbqsuYNqQ0cJ7Fs0
+g5MPyZUtmYp9Xvr+SAB8XL7ru8becKN+gzsiCFSq+LA
--> ssh-ed25519 AQhf1g kkNoHO53xVmTj8qwbz9VECJ7jVyZCgqgLDvoOZP9mmA
+-> ssh-ed25519 AQhf1g wijsxw0j4hCW+LZoDiWax8Xt3zx7KEx1FGykHWMURnQ
-/ZZA3Uhz0W3mtY4/4G/HVF4gz2MtsL8C4Mz2OcnPysE
+ECB//PR0Q21RuXYaJ/3JQkVd9SKfs1NvmEea+06CbWI
--> ssh-ed25519 mOmPfg EdeLqgc0EvGowYkuF4436C8o+4we2FnlaxfPqd9mbDU
+-> ssh-ed25519 mOmPfg Il7TQ7PR83W6yQLsJZ/IuqX0xQqQCy9TKGMCH6j/wAI
-cQooIOjuGT/i/QbV4lYIP8QxWxtX49mZJpBlrtRJftw
+hy9/lPJ48v8W1g2lOuoArEm4BqT6broUy/p1BbSdO/A
--> ssh-ed25519 YJiRbw I6Wk+Bq9U9yMw0fSHG+vjxXQ6vyeIoqv2Dw4LS1EFj0
+-> ssh-ed25519 YJiRbw YlOmjiSm/Ppb4eFJkT8NAc0lrRWEq7h5sz8AlJHRaxA
-Jvt0gujTYp5kYGew3TwN8uuqRfZH+KyWyXajMhHfb5Q
+AlShI5xiA6lsYpURJL1GA+A5Q4RGQov86EswdsfBfOo
--> ssh-ed25519 0/WsKg 2mO7BzVlAlHIsq6PjnsXPlDeX5GTJ7h3LxOqnYMi4X4
+-> ssh-ed25519 Nl/5yA BhtmDI17gcP071u/keXn4pk8Lzk2RrHFUj5SA86YPjc
-Opxp2EZgTrV3/SNlRXcU432eIz9EZMuZIkfwzUuqHb8
+w3klEe6jsFHxny1DkvsC8zHc/wwdPZsn3Ekxrop3Xws
--> ssh-ed25519 Nl/5yA ZTXjKkQqcAr0qgUPoPmjFeBBkwTkxdpsQUNAYZ3Fih0
+-> ssh-ed25519 GdLgCQ kRBH7X+OONkYlv2av7y371WxkhRfj9gNBG+5giG3LwE
-ekZbDidS5UHhvfSqPqUlgfgFz4u8bdDx4IPFWj6YI3Y
+amS7HHCavB5Gr3BtmFjntD0Sx+H3bXWtaoSf6jVmFO8
--> ssh-ed25519 GdLgCQ HSzv8LUC0hX+pN4jKsTcGekrG1jVO+l4yf8HIT5o7Qs
+-> ssh-ed25519 tOH/HQ eER991bgNQRsADztOtmua6uiOQXEvnGLVZxios5ta3Y
-HRWZikq9o1/3BfUmYhAQtYjo72lWPeHTCcJejR+KehM
+tEdCqRSuUtxpea8HfvgniwOsNRp5xfMqjMDIlErv56M
--> ssh-ed25519 tOH/HQ X5ovKDga8yPDrstzgB2AQHCmIoyLKmR9fFWMI7OoBTA
+-> ssh-ed25519 FpzvfQ cuXaHencZnnjeehxIu6ly/RuyGmJpfUneO3JFE4dTlo
-Hn9l2qk/nYeZVxv/3pE65jMe5gBCSHolHMgKgqZcl8M
+OSWFiVWRZFfRlNqyb1uKaCf08MIs8vq5wv8D8NhTAD8
--> ssh-ed25519 FpzvfQ oXPL8Xv/KKZpyhEsCDBoBe3e1SUrdBweqbrO3zX8AwA
+-> ssh-ed25519 2UotMw 5UnadpCeceAWgVt7fY1TvdQXb9W3s/IxpS/2KnkNOjA
-UODBP2UzgHPSbtBMwIfZlK7QgEYT15BOD6zVhZfUby4
+IrSCTgxIWW7FX5BswNjnWYHyLG8x2SSZ+lyfT+NGR3Y
--> ssh-ed25519 kdPvzQ xdXBsTF/bhyUwerBh0M0jTMXiB2jlvqbaLOGXlerMQg
+-> ssh-ed25519 kdPvzQ /Rv/935vYmo0ZKS7ZSr2gV8f9PtfRND2PKHQ7MqAdSU
-rErtHvD21aB7AuHOVTjdFq08xn5BSYxGyyd41F9nNcE
+FPLlv/gzTSKJUjXjUdU5wx0TOVEJCsCKTNXdAcuv4MM
--> ssh-ed25519 onmXpg /TJ0Lk+CyArYKZZO7UHqJExiTiCYwHSK0YphGXyzBnw
+-> ssh-ed25519 onmXpg mW/e5COuywLc37juvVAJisyj6BGwFIjWDu6PLSBiNio
-1GiYuhSSIieuCVOGYNHZyNEoJlykokHG/7cHQbfpy88
+uba4LFRs/83aaylrJxCJfOYmYPkhb+B9OK8q3Mvjh9E
--> ssh-ed25519 CnhD0g /siurjKr3wuF8aPFnS9tKTbzuBIYjV7HehUQt3L1QjU
+-> ssh-ed25519 CnhD0g yYdtSbtbhuqj8eFByPLuPrMwJ8/Y9l4MstlwwxN4m3k
-JHXhMGkLcUo+jxtsxM8TMei7hXcappY1AKbCGT2v73U
+8Ud99nL6ss6a/qGvkvPp2ktqcPeCbC7QcPpubBDZmzA
--> ssh-ed25519 4ep2UA UAgBtNaV/A5RAEze4X2zky5s+TgHIQ5ufHCx8neJZC8
+-> ssh-ed25519 4ep2UA f1Qtpz9OfqMHwMErL9GFTmb/vQuNcy9z3wj8YZ+P9nw
-evGC3PCZxfIrmWj0ERxO+AVFZyQuharOLYxzLkt2NsU
+3iEe/oUuiwiaaOAMrFmxHkqKEBx2G7PiKHvYO5eGM7Y
---- XEXFLANMMaS8UXRrZh3crxuY68pP3pH+BEEDP+G/hYE
+--- zjpoq6iZ3w19eqyHXVOUDgJSNT2D2DqILWfKD4CmJiQ
-{Qá*+ŽloÞø�yâoXV
tÔt`£ÓFcO¹ìSCÓ½
ôšêÀMíù÷ˆ'’ö3ˆVý›hŒÃøô±p&‚FYínª«¼ßzö”¬%¡¿¤·šÈ%Sa¶˜;
v�dÎ8Þ
+’SK&­[|ƒ6¾ð‡!»|t
+»¬¸ËB^O†d‡ØzkrÙð»(ÔÆ-êê²â¡+1R8
+BÍO¬L€gEH3Îiä\HÅqBcx'^gÑx¶Ûm·²v²¥Ýî�ÉÁlû}

secrets/jude-forgejo-runner.age

@@ -1,38 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg T3PxgBg0pfNuZKS0YL/i/zQVbeRjnb72P+FRwMAQ334
+-> ssh-ed25519 87huqg U8uPBXNbi62qdlf1E2o2FrI/fqVqFyXmu/ULCXnpHGM
-7SKL/KVhoG3v4wSnta0IgsIoh8BHR4oxga5peCMj9ic
+IunC0CoSgR95ajkrqox9fw3lMk05o0c5VeKklP+JLEo
--> ssh-ed25519 8UnW5Q lNkmK94pnuKJaZsQGidqlZ8o7+8E9Z1k0paLi3DqhjY
+-> ssh-ed25519 8UnW5Q VN8Pn7h65r1CCq4TX/0/i7CR12uNGYpH9a/wBwXzbgU
-CVNxtRg5ccb2aHzKlp8H7xil88wZ4oKV3Jd47S94Ak8
+Gzu05BaP3A4rwhsfAwDgNEa8a+qlYWf+BJpxGGbjIGw
--> ssh-ed25519 UFfTmg JvSv4a8hsyIRDinwXBfRWsDkyOeBZl0dapik4DtMvDg
+-> ssh-ed25519 UFfTmg 0aRMaqK95Xaxm9jHV9VHDsTQRcQFE4861N0mtKIQNlY
-N7wymvJluW/fV4RCTNeWZmELsleTguzmnhO6p5VAzNc
+XJjbY5BMJKLFzPh8EnsuUGddKgY1Et7MfkXbtSeN2E4
--> ssh-ed25519 xNtnoA tjf+tIZBerm8FlnXCiuBNjuQCYxVXMGaR4/sbvy6ak8
+-> ssh-ed25519 xNtnoA GhQ/AZC+5kQIhxOXJy592Dtk88yFsskT2e84p0dqij4
-CE6Iobx4fJAFMwQAsHCUhpz0RrelHcxE6uWC9y75E1A
+AehOjw0IYQ3jFYvyeT+AoOr9KCgm2tPpEOb49JK+VRg
--> ssh-ed25519 aY2AXA FLrOeA9AFvidwFFpp4jfEdp/9XKZOZqnhgMfkQHOMGs
+-> ssh-ed25519 aY2AXA WevuwuDwXqOST+E8+WmSSdRRO0AAk7zSrSCx7W7O9lY
-MYMk8gRK++s63F0r2AXy69sqEodww2ua/SGMUU2nPzI
+aHFYfor2DwmXelh6Bo8QNr+OTtku6jKnLOPK8MAVMcM
--> ssh-ed25519 AQhf1g QF0KlR3wHA1sT//j1Src0lP5cOxL6zizgAj6cPECuXY
+-> ssh-ed25519 AQhf1g r89DcqddHqaMsIc1JA3bRYcBEozm48riPGzDbj1edB4
-49gGbae04hEa12u1s9hQzkX/4cIY1H1hDDKD+VaaFLA
+Xhhcb9EFo+f98nCQZcbGDsBSSPp7oaUpI7TbE3wL6fw
--> ssh-ed25519 mOmPfg NoxbtJcMcQTRgWDHVENIUZ7z2yL7M1bz2h1W17lTu2U
+-> ssh-ed25519 mOmPfg 7HRNQ2uGBYTCEcNVzBYdV6EYY4uaWlvOyod2MHYYTy4
-vDunWrrgtoH+dnNgOvpbxoLWgv1wk49eIagwDOgbwME
+kSATymc+CkV81UlULdmR9pcVlRQSPDOVPiImbProIuQ
--> ssh-ed25519 YJiRbw 2ayUuS/nbPzydjLmYfIT0O87FctlhU640ePeuWjNNAM
+-> ssh-ed25519 YJiRbw DN/cmcdvFuyWoadDv17T4VVdRiLxmGQR2L1pj4iCoBA
-9W4vm7jbbC/JVEUqamBKiGFaWdNE35v7Byw1pgfgKhc
+50uR0WxUPclelkW34H5YHg/DwCpGXWKz/TpsLI/G7NM
--> ssh-ed25519 0/WsKg mFpy6qEC0gF4qBNzZcY3rDB2p7PeyhNlEmLGJEsTixU
+-> ssh-ed25519 Nl/5yA 9ddHSHSnUhQSGku3IiGzSCSWm7FnxmrKbLbcCNaEBTo
-QPrEOTazlkWnJN4f9/LW5Tf0cfI5zghiinBsyALmvm4
+2tCo9JH6zGZI7WVQfyduLKzKjjxkvOkozhjweaf4iLc
--> ssh-ed25519 Nl/5yA DqNMvJYPP1Xu43+LFCEMcxyTLUl3EHhPUIg/cna1NAg
+-> ssh-ed25519 GdLgCQ 4wvfVoBYh0h16OWu3ZzRbr+dol2lngyvj1rJN4i1uT4
-nqvWhQILmnpMkmtkYf8Er8ztqP3xH/dEk9oFycEoDqQ
+biuW9V+AlvmgZ6mysvL1vhB9bixlaEHVtXIipHkMeyE
--> ssh-ed25519 GdLgCQ PgZY49A0SL8cyHdxc5BD4yrwjGD9DcrQmdxZtlIdoiU
+-> ssh-ed25519 tOH/HQ QfhF+jx9QwF+O9JBUAUR52KC54c+8uWAhyG/2QGYn08
-q6hu5XxQgujMlejQGST9Ka7hlJagwTiwRQaFj8fi/28
+QJhHnuCH4lhLk+c6PRgdBxalKw+GnXSHemjANwzUPUs
--> ssh-ed25519 tOH/HQ 5fIvkG+emjJySd/7DdMVAtkEOwUH+YaXXONZ6nKshAI
+-> ssh-ed25519 FpzvfQ KskGYGofL8Pqhd/w+lS1r0pYADgnl/YvsO7CIDBIgT0
-vVOUJRKWcRmwG1Wufm+EUwdDLHewFFGJARwNDCV156U
+IhnEjqIe84snAczdB7w9Pu2oxfmSRCcIbLuFJvKPXwc
--> ssh-ed25519 FpzvfQ xVNdop7LoydHHG8GtCiAOf3STnCOPvSNzXkfAyGwOAY
+-> ssh-ed25519 2UotMw +enPlZd+vgBCBGOM0qiJ1ho8KIh27DupWzt5tD7Zl38
-Jy+teMo/UnAOAmLkGK/H3tkWNdI3Vl7NONzQ3LpVy7w
+ui1jDgw+mrlKS/6/2MsgHHhFnGpe08QdD2nwcnU6rWE
--> ssh-ed25519 kdPvzQ wQ9y5YROKeQWeTPjQl80yRwosyU6ZbOTNmrlCyE9SSo
+-> ssh-ed25519 kdPvzQ /MPjIuGxfLHPzo2nn1tjIzpFKpmifFYntyWJ886YUBg
-3ld+z64d26fnYSNrM/lgAp+m/GMmD8G7aJouszUAvqU
+thzutSnYQriI0NxPUhEotCTWWZ6rjj9FhBv5e6/HCZY
--> ssh-ed25519 onmXpg x+/a4ta0k7ENV6Ka+5pkSwdcbKgxGAz74t5PYt2gcmM
+-> ssh-ed25519 onmXpg uyfJ3oEuR8N3+gf9AC0BXBfkv43iSFmSqLV1qMLFzGM
-oCIWVpt/a+VaxEa0qW6YpDDTwFelJeLEcrmo71/UtSg
+DjUnrn8uZqqOTgQ9fJK3mV1qLEbFfLSi0s6vJ0vULlQ
--> ssh-ed25519 CnhD0g gvGoeS24lFxtrfKfUn7EaI8baaGkl7k2uYxTjU+PZC8
+-> ssh-ed25519 CnhD0g 9nH5vKR7QFOhe/bj1yoiU9/NAwbx3X7eTlFcpfqjf0U
-JJePTz8xhu35c2AvZrXyFDw8yYRicWSTrKUSwEe9oJI
+nVFLIzj84ezlygoAQc/qayRitkDY+hO0PcMl2VJ8SMQ
--> ssh-ed25519 4ep2UA 9dAa07MiGZKqp5L+Pn/Y0OXoy6N1pYmpFQPLR5gty2o
+-> ssh-ed25519 4ep2UA 2Oxpu+LjXH8IUEeIf5gTF6RA+btk5h24TpZuY4in2kA
-4Hduoi4utPgwuts4d6fx1V8AFTAdn6OLO9wDAIQZUlI
+7QzWbGo4tbywGWfMi79f2deB+D8j8oWyNp/WGCfaMoc
---- IgCY0Hr7grc/YQkWfwlksRLfK2200lkhIwb3tuNqv7c
+--- 45iGBeXO4jCDGIXRimelAK5/mAK0GDxNkHzjEChYnS4
-}‰¥rÏ�´Æ•²$¾¥jBû"œíw(±
7#¥1š¥4„¾~Í9Q­Q‹Ôî’ú‘^zÞ`¨d*¸$sÎ@
+ü´
cïØÇyiÇÇ%­ôËRÑ%[-5Hдàç󢺅<‹>ø{í€93§z']qG#¹%h-ŸSPàn‰©oÈŸy'�64þñ`Tå
-ݾ¡^ßl0п