chore: update flake.lock 2026-08-02

* Consolidate Linode into a single file
* Convert gitea and matrix to using Nebula connections
* Have Linode proxy to Nebula connections instead of Tailscale
* Update Acme to use DNS-01
* Update Flake to pull from branch that supports ACME 5.x client

.gitea/workflows/update-zims.yaml

@@ -0,0 +1,51 @@
+name: Update zims pin
+
+"on":
+  schedule:
+    - cron: "0 2 1 * *"  # 0200 on the first of every month
+  workflow_dispatch:
+
+jobs:
+  update-flake-lock:
+    runs-on: nix-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Update flake.lock
+        run: nix run .#zim-updater -- --output pkgs/zim/blobs.json
+
+      - name: Create PR if changed
+        env:
+          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
+          GITEA_URL: https://src.thehellings.com
+          REPO: greg/nixos
+        run: |
+          if git diff --quiet pkgs/zim/blobs.json; then
+            echo "blobs.json unchanged, nothing to do"
+            exit 0
+          fi
+
+          BRANCH="auto/update-zims-$(date +%Y%m%d)"
+          git config user.email "klaatu@thehellings.com"
+          git config user.name "klaatu"
+          git checkout -b "$BRANCH"
+          git add pkgs/zim/blobs.json
+          git commit -m "chore: update zim blobs.json $(date +%Y-%m-%d)"
+
+          # Push branch using token auth
+          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
+          git push origin "$BRANCH"
+
+          # Create PR via Gitea API
+          curl -s -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
+            -d "{
+              \"title\": \"chore: update zims $(date +%Y-%m-%d)\",
+              \"head\": \"$BRANCH\",
+              \"base\": \"main\",
+              \"body\": \"Automated monthly zims update.\\n\\nGenerated by Gitea Actions.\",
+              \"assignees\": [\"greg\"]
+            }"

ca/intermediate_ca.crt

@@ -1,12 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIByDCCAW+gAwIBAgIRANS+dPEH5Vqug7OWhCMmcx4wCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
-MjQwMjIwMjEyNzIxWhcNMzQwMjE3MjEyNzIxWjA2MREwDwYDVQQKEwhIZWxsaW5n
-czEhMB8GA1UEAxMYSGVsbGluZ3MgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0C
-AQYIKoZIzj0DAQcDQgAErZUhPfx5MpNbNVyqHDrIgUGnb6Hitl8hXlpH+kgjBzCi
-7I/+TQnl9Tc0VVNOFOYLOfBi7hV3/QudUtLGk0FKeaNmMGQwDgYDVR0PAQH/BAQD
-AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFMZR8LDd+hNy+TmtEHvt
-zRzXboh2MB8GA1UdIwQYMBaAFAlH11TwIFGB/K75qZ3e0S+fN3JUMAoGCCqGSM49
-BAMCA0cAMEQCIBxHK6r8pMX5hrTwYKRfMmRIt44m0KtNejA2T5t09hs+AiBfvmHb
-LfoE4qoC6NgpvXorAbx+O7xkem/9svF0Ob+RsA==
------END CERTIFICATE-----

ca/root_ca.crt

@@ -1,11 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBoTCCAUagAwIBAgIRAL/1mvE8+73nRFGsvzaaVSAwCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
-MjQwMjIwMjEyNzIwWhcNMzQwMjE3MjEyNzIwWjAuMREwDwYDVQQKEwhIZWxsaW5n
-czEZMBcGA1UEAxMQSGVsbGluZ3MgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
-AwEHA0IABEgNBjlT/7gmzNp9vKJvGPJn9/IizuMGVpucdrN9+J1u1ABkLNRzj5p2
-g7s3e/BG+EJnnTf/2tuq3p/wPqmQkdujRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
-HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQJR9dU8CBRgfyu+amd3tEvnzdyVDAK
-BggqhkjOPQQDAgNJADBGAiEA/uBclcFCOpkEgAeBAVurktYB82sMdIyyDGHcjlwi
-pvkCIQC2kuZ/nXRjibeIebQIVTBskQ1LxlLxnx7zNSjtr3kFfQ==
------END CERTIFICATE-----

compose/attic.yaml

@@ -1,54 +0,0 @@
-services:
-  attic:
-    container_name: attic
-    image: ghcr.io/zhaofengli/attic:latest
-    command: ["-f", "/attic/server.toml"]
-    restart: unless-stopped
-    ports:
-      - 8080:8080
-    networks:
-      attic:
-      pgattic:
-    volumes:
-      - /mnt/all/configs/attic/server.toml:/attic/server.toml
-      - /mnt/all/containers/attic/data:/attic/storage
-    env_file:
-      - stack.env
-    depends_on:
-      pgattic:
-        condition: service_healthy
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "wget --no-verbose --tries=1 --spider http://attic:8080 || exit 1",
-        ]
-      interval: 15s
-      timeout: 10s
-      retries: 10
-      start_period: 15s
-    deploy:
-      resources:
-        reservations:
-          cpus: 1.0
-
-  pgattic:
-    container_name: pgattic
-    image: postgres:17.6-alpine
-    restart: unless-stopped
-    ports: []
-    networks:
-      pgattic:
-    volumes:
-      - /mnt/all/containers/attic/postgres:/var/lib/postgresql/data
-    env_file:
-      - stack.env
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-networks:
-  attic:
-  pgattic:

compose/pinchflat.yaml

@@ -1,9 +0,0 @@
-services:
-  pinchflat:
-    image: ghcr.io/kieraneglin/pinchflat:latest
-    ports:
-      - "8945:8945"
-    volumes:
-      - "/mnt/all/configs/pinchflat:/config"
-      - "/mnt/all/video/yt:/downloads"
-    restart: unless-stopped

compose/restic.yaml

@@ -1,19 +0,0 @@
-# Demo of rest-server with prometheus and grafana
-version: "2"
-
-services:
-  restserver:
-    image: "restic/rest-server:0.14.0"
-    volumes:
-      - /mnt/all/backups:/data
-      - /mnt/all/configs/certs:/certs
-    environment:
-      OPTIONS: >-
-        --tls
-        --tls-cert /certs/nas1.shire-zebra.ts.net.crt
-        --tls-key /certs/nas1.shire-zebra.ts.net.key
-        --path /data
-        --prometheus
-        --debug
-    ports:
-      - "30248:8000"

darwin/baseline.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  pkgs',
   top,
   ...
 }:
@@ -31,22 +32,51 @@ let
   };
 in
 {
-  environment.systemPackages = with pkgs; [
-    agenix
-    hms
-  ];
+  environment = {
+    launchDaemons = {
+      "limit.maxfiles.plist" = {
+        enable = true;
+        text = ''
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+        <plist version="1.0">
+          <dict>
+            <key>Label</key>
+            <string>limit.maxfiles</string>
+            <key>ProgramArguments</key>
+            <array>
+              <string>launchctl</string>
+              <string>limit</string>
+              <string>maxfiles</string>
+              <string>524288</string>
+              <string>524288</string>
+            </array>
+            <key>RunAtLoad</key>
+            <true/>
+          </dict>
+        </plist>
+        '';
+      };
+    };
+    systemPackages = with pkgs; [
+      agenix
+      pkgs'.hms
+      procps  # Includes tools like `watch`, `kill`, and `ps`
+    ];
+  };
 
   fonts.packages = with pkgs; [
     dejavu_fonts
     nerd-fonts.hack
   ];
 
-  launchd.daemons.darwin-builder = builder;
+  #launchd.daemons.darwin-builder = builder;
 
   nix = {
+    #buildMachines = [ { systems = ["aarch64-linux"]; sshUser = "builder"; sshKey = "/etc/nix/builder_ed25519"; hostName = "localhost:31022"; protocol = "ssh-ng"; }];
     enable = true;
     gc.interval.Hour = 3;
-    linux-builder.enable = true;
+    #linux-builder.enable = true;
     settings.auto-optimise-store = false; # Darwin bugs?
   };
 

darwin/default.nix

@@ -19,6 +19,7 @@ let
       specialArgs = {
         inherit metadata top;
         inherit (top) self;
+        pkgs' = top.self.packages.${system};
       };
       modules = [
         {

darwin/hosts/lithic/default.nix

@@ -11,6 +11,7 @@ in
     enable = true;
     brews = [
       "bitwarden-cli"
+      "colima"
       "direnv"
       "github-mcp-server"
       {
@@ -37,7 +38,6 @@ in
       "notion"
       "notunes"
       "onlyoffice"
-      "podman-desktop"
       "tabby"
       "zed"
     ];

flake.lock

@@ -31,11 +31,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1778391342,
-        "narHash": "sha256-7FVIfUHdQEB6HM+gUPLJVaL7ABrqlnMxS/pO+vNvjd8=",
+        "lastModified": 1784438381,
+        "narHash": "sha256-OuKnPzVTpGYaUQp/GjR7NFY8ezVRlR2V2CUxkHkI2UU=",
         "owner": "nix-community",
         "repo": "buildbot-nix",
-        "rev": "0bedd1aafd1653858d5f1e0f08eba3d7ec397dff",
+        "rev": "72e12f1a1381321e07279b18f3d401c29871b50e",
         "type": "github"
       },
       "original": {
@@ -53,11 +53,11 @@
         "stable": "stable"
       },
       "locked": {
-        "lastModified": 1762034856,
-        "narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
+        "lastModified": 1785582945,
+        "narHash": "sha256-PI+qji1xkJm3PV7l7/PKJDumFz0fbA4etXE614jRnls=",
         "owner": "zhaofengli",
         "repo": "colmena",
-        "rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
+        "rev": "84d419ad080477ed2f31fbf3866551393df647a7",
         "type": "github"
       },
       "original": {
@@ -95,11 +95,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777780666,
-        "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=",
+        "lastModified": 1785389976,
+        "narHash": "sha256-0tLW8Ff5yt8AH97jw4ZpFJ0OCJ122zIlgWGDmOfU/VU=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777",
+        "rev": "15abb8c98f336cd8bd840d71059adebabe60bf04",
         "type": "github"
       },
       "original": {
@@ -112,11 +112,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1650374568,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
@@ -162,11 +162,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1777988971,
-        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
+        "lastModified": 1785627969,
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
         "type": "github"
       },
       "original": {
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777932387,
-        "narHash": "sha256-nUYVPiqrzr36ThiQOAr5MKeGHDBSDM3OFWkz0uDjOvc=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "71a3a77326609675e9f8b51084cf23d5d1945899",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -218,12 +218,15 @@
       }
     },
     "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
       "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -239,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778365864,
-        "narHash": "sha256-ImoT/wqmgMImf2dAC+E0MverAdA4QXsedOeES9B7Ezw=",
+        "lastModified": 1785531816,
+        "narHash": "sha256-vkMnV0JIyw+g/NmcfoajlGaAO+9a0ezia+FZohQJrik=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2f419037039a152448c5f4ae9494154753d1b399",
+        "rev": "bf9ce9fec78f95f374e8dd3b503863a3ec128ebe",
         "type": "github"
       },
       "original": {
@@ -278,14 +281,14 @@
       "inputs": {
         "flake-compat": "flake-compat_2",
         "nixpkgs": "nixpkgs_2",
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1778039471,
-        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
+        "lastModified": 1785555369,
+        "narHash": "sha256-KUHFKv51VoV1wpyIreeusIkFsgycjeuRA9vDsBmCUu0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
+        "rev": "76a82a08c36423e5ff627c62f55797de52c3061b",
         "type": "github"
       },
       "original": {
@@ -294,6 +297,25 @@
         "type": "github"
       }
     },
+    "niks3": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1785226690,
+        "narHash": "sha256-H7lhfp4ja6vysomufDgVoRgiBUyEcQDnN6rGB9yDIDM=",
+        "owner": "Mic92",
+        "repo": "niks3",
+        "rev": "ce7cd4b0462c634802a9faf0cb19f4718d115ec8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "niks3",
+        "type": "github"
+      }
+    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -302,11 +324,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729742964,
-        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "lastModified": 1737420293,
+        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
         "owner": "nix-community",
         "repo": "nix-github-actions",
-        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
         "type": "github"
       },
       "original": {
@@ -316,12 +338,15 @@
       }
     },
     "nix-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_4"
+      },
       "locked": {
-        "lastModified": 1778143761,
-        "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
+        "lastModified": 1785232496,
+        "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
+        "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
         "type": "github"
       },
       "original": {
@@ -332,11 +357,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750134718,
-        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
+        "lastModified": 1783224372,
+        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
+        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
         "type": "github"
       },
       "original": {
@@ -348,11 +373,26 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1777168982,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "lastModified": 1785031560,
+        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1785031560,
+        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
         "type": "github"
       },
       "original": {
@@ -379,43 +419,56 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1777954456,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
-        "owner": "nixos",
+        "lastModified": 1783978241,
+        "narHash": "sha256-7kK0Y/fIV2NTKArkd/eZGaFg+dEmgP8KDRsGK2vB5M4=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "a8b81d3cc8d35af7bc98694696bea61ad4f8fca7",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1777207419,
-        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
-        "owner": "nixos",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1784555310,
+        "narHash": "sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl+HHZ+DrtM=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
+        "rev": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
-        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
         "type": "github"
       }
     },
-    "nixunstable": {
+    "nixpkgs_6": {
       "locked": {
-        "lastModified": 1777954456,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "lastModified": 1785571196,
+        "narHash": "sha256-KoTsyMQqnXQZq8deCEnu4QkyldkwH/bpMMhUcfMdGIw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "148bab9c1c3c53136ecb44a6ea356a0ed5b39b06",
         "type": "github"
       },
       "original": {
@@ -425,20 +478,50 @@
         "type": "github"
       }
     },
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1784564315,
+        "narHash": "sha256-7OpsHHIZFUBLbeHNQ0oC40DZRQjsmGWodXge+OqgPgk=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "0c2094806c9e542f31785ef3569ab9e900e3ce9c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "0c2094806c9e542f31785ef3569ab9e900e3ce9c",
+        "type": "github"
+      }
+    },
+    "nixunstable": {
+      "locked": {
+        "lastModified": 1785349197,
+        "narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=",
+        "owner": "geri1701",
+        "repo": "nixpkgs",
+        "rev": "af4902d1e79cbeade8e0d9e10e7a9ada4dce01b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "geri1701",
+        "ref": "lego-v5-acme-spike",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixvimunstable": {
       "inputs": {
         "flake-parts": "flake-parts_2",
-        "nixpkgs": [
-          "nixunstable"
-        ],
-        "systems": "systems_3"
+        "nixpkgs": "nixpkgs_5",
+        "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1777991353,
-        "narHash": "sha256-DFwjggMV+nzCZpwK6Obxj9F+P59rbLVowGqHETfctBk=",
+        "lastModified": 1785527278,
+        "narHash": "sha256-rYFSM491MFFA1V6oax5PngXbevGt6n0o8sKhwFoItE0=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "7986a276960b4dfaed9bb2c3c438b5ba71ae08f1",
+        "rev": "a19efae6c1afe426e8243d79f6dfbab186be6df8",
         "type": "github"
       },
       "original": {
@@ -451,14 +534,14 @@
     "nurpkgs": {
       "inputs": {
         "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1778395809,
-        "narHash": "sha256-Jl3fg2TTQpFEFR4Xg9wdrNEohWIZI2jrLPO84ctFfPc=",
+        "lastModified": 1785627680,
+        "narHash": "sha256-uWtMa2bwZdK3GPIaSRikEezgHK/dvpawxzjqm4BIHfk=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "4d723c32ac8ccbf63f6f201c95195fae1ac1d11c",
+        "rev": "b4d9d89f110d52db3cf336cb9f8b4448e6648e87",
         "type": "github"
       },
       "original": {
@@ -476,7 +559,9 @@
         "flake-parts": "flake-parts",
         "hmunstable": "hmunstable",
         "minecraft": "minecraft",
+        "niks3": "niks3",
         "nix-hardware": "nix-hardware",
+        "nixpkgs-lib": "nixpkgs-lib_2",
         "nixunstable": "nixunstable",
         "nixvimunstable": "nixvimunstable",
         "nurpkgs": "nurpkgs",
@@ -486,16 +571,16 @@
     },
     "stable": {
       "locked": {
-        "lastModified": 1750133334,
-        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
+        "lastModified": 1783625654,
+        "narHash": "sha256-pI1244/PJfTyKhlAr2QYQC55vR6UQdnGA0rJUgtO2IQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
+        "rev": "a0230bd8d5cbd13893b2263918d396a2c7dd0407",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "release-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -545,6 +630,22 @@
         "type": "github"
       }
     },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "ref": "future-26.11",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -553,11 +654,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "lastModified": 1784369104,
+        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "niks3",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {
@@ -568,14 +690,14 @@
     },
     "vsext": {
       "inputs": {
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1778384975,
-        "narHash": "sha256-+27MJizhdJGXTl3jzNKnGU3C+fJJBcTsBQb6PtS5vBE=",
+        "lastModified": 1785555171,
+        "narHash": "sha256-MLBtKBAbLXB81qm5UZq7w0IFnP/fh6QWhfU55dA8uFo=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "5d9f84ecc813690afdd4b35c896904fc02ab6cac",
+        "rev": "730fe1d38d63878df9cf6b46b36308d197a9334e",
         "type": "github"
       },
       "original": {
@@ -592,11 +714,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777732699,
-        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
+        "lastModified": 1784642409,
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
         "type": "github"
       },
       "original": {

flake.nix

@@ -24,12 +24,12 @@
       inputs.nixpkgs.follows = "nixunstable";
     };
     minecraft.url = "github:Infinidoge/nix-minecraft";
+    niks3.url = "github:Mic92/niks3";
     nix-hardware.url = "github:nixos/nixos-hardware";
-    nixvimunstable = {
-      url = "github:nix-community/nixvim/main";
-      inputs.nixpkgs.follows = "nixunstable";
-    };
-    nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
+    nixvimunstable.url = "github:nix-community/nixvim/main";
+    #nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixunstable.url = "github:geri1701/nixpkgs/lego-v5-acme-spike";
     nurpkgs.url = "github:nix-community/NUR";
     vsext.url = "github:nix-community/nix-vscode-extensions";
     wsl = {
@@ -63,7 +63,10 @@
           config = {
             allowUnfree = true;
             allowUnfreePredicate = _: true;
-            permittedInsecurePackages = [ "ventoy-1.1.05" ];
+            permittedInsecurePackages = [
+              "ventoy-1.1.05"
+              "electron-39.8.10"
+            ];
           };
         }
       );
@@ -84,6 +87,7 @@
                   self
                   top
                   ;
+                pkgs' = top.self.packages.x86_64-linux;
               };
             };
           }
@@ -97,7 +101,7 @@
                 {
                   deployment = {
                     inherit (v) tags;
-                    targetHost = v.ts;
+                    targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
                     targetUser = "greg";
                   };
                 }
@@ -145,16 +149,17 @@
             pkgs = imported_packages.${system};
           };
 
-          packages = (import ./pkgs { inherit pkgs; });
+          packages = (import ./pkgs { inherit pkgs top; });
 
           checks = import ./checks.nix {
             inherit system top self';
-            inherit (pkgs) lib;
+            inherit (top.nixpkgs-lib) lib;
           };
 
           devShells = import ./shells.nix {
             inherit pkgs;
             inherit (top) colmena;
+            inherit (self') packages;
           };
         };
     };

garnix.yaml

@@ -4,14 +4,6 @@ builds:
       - "homeConfigurations.*"
       - "nixosConfigurations.*"
       - "packages.*"
-      # bitwarden-cli package is broken on aarch64-darwin
-      - "packages.aarch64-darwin.img-bitwarden"
-      # kmod-31 is not a thing on Darwin
-      - "packages.aarch64-darwin.qemu-hook"
-      - "packages.aarch64-darwin.vfio_shutdown"
-      - "packages.aarch64-darwin.vfio_startup"
-      # This one is a bit of a beast and shouldn't take up Garnix time
-      - "packages.aarch64-darwin.zim"
       # These are just images which I will build when
       # I feel like it
       - "devShells.*"
@@ -28,3 +20,4 @@ builds:
       # to build at home
       - homeConfigurations."gregory.hellings-mbp"
       - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
+      - homeConfigurations.ivr

home/baseline/nushell/functions.nu

@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis]
+let servers = [isaiah jeremiah zeke genesis hosea]
 
 def par-map [ items: list, c: closure ] {
   let results = $items | par-each -k $c
@@ -12,15 +12,55 @@ def --env unlock [] {
     }
 }
 
-def rebuild [] {
+def nebulaIps [] {
+    open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort
+}
+
+def localIps [] {
+    open /etc/nixos/network.json | get hosts | items { |h, e| $e.ip? } | where $it != null | sort
+}
+
+def genNebulaCert [ --ips: string, --name: string ] {
+    let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand
+    let private = $'~/SynologyDrive/nebula/($name).key' | path expand
+    let cert = $'/etc/nixos/secrets/nebula/($name).crt'
+    let ca_cert = '~/SynologyDrive/nebula/ca.crt' | path expand
+    let ca_key = '~/SynologyDrive/nebula/ca.key' | path expand
+
+    # Generate public key if there isn't one already
+    if ( not ($public | path exists) ) {
+        nebula-cert keygen -out-key $private -out-pub $public
+    }
+    # Clear old cert if there is one
+    if ( $cert | path exists) {
+        rm $cert
+    }
+
+    # Create and sign certs
+    (nebula-cert sign
+        -ca-crt $ca_cert
+        -ca-key $ca_key
+        -name $name
+        -networks $ips
+        -out-crt $cert
+        -in-pub $public
+    )
+
+    # Agenix update
+    cd /etc/nixos/secrets
+    cat $private | agenix -e $'nebula/($name).key.age'
+}
+
+
+def rebuild [ $target: string = "switch" ] {
     if (uname | get operating-system) == "Darwin" {
-        sudo darwin-rebuild switch
+        sudo darwin-rebuild $target
     } else {
         let hostname = uname | get nodename
         let build = ^nom build --keep-going $"/etc/nixos#nixosConfigurations.($hostname).config.system.build.toplevel"
         if $env.LAST_EXIT_CODE == 0 {
             nvd diff /run/current-system result
-            run0 result/bin/switch-to-configuration switch
+            run0 result/bin/switch-to-configuration $target
         } else {
             print "Error during build"
         }
@@ -35,7 +75,8 @@ def deploy [ $host: string, $build: string = "" ] {
     if $buildhost == "linode" or $buildhost == "genesis" {
         $buildhost = "isaiah"
     }
-    nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
+    colmena apply --on $host
+    #nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
 }
 
 def ff [ $file: string ] {
@@ -69,13 +110,6 @@ def dc [ $cmd: string = "sh" ] {
     }
 }
 
-def claude [ ] {
-    unlock
-    $env.GITLAB_TOKEN = ^bw get item 7d3da4e9-5f9a-49d0-8e14-b39c010a4001 | from json | get fields | find claudeapi | get value
-    #$env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
-    ^claude
-}
-
 if ("/usr/local/bin" | path exists) {
     $env.PATH = $env.PATH | append "/usr/local/bin"
 }

home/baseline/ssh.nix

@@ -13,24 +13,25 @@
     includes = [ "config.local" ];
     enableDefaultConfig = false;
 
-    matchBlocks =
+    settings =
       let
         nas = {
-          user = "admin";
+          User = "admin";
         };
         owned = {
-          user = "greg";
+          User = "greg";
         };
       in
       {
         inherit nas;
 
         "*" = {
-          dynamicForwards = [ { port = 10240; } ];
-          serverAliveInterval = 60;
-          extraOptions = {
-            LogLevel = "error";
-            SetEnv = "TERM=xterm-256color";
+          DynamicForward = [ "10240" ];
+          ForwardAgent = "yes";
+          LogLevel = "error";
+          ServerAliveInterval = 60;
+          SetEnv = {
+            TERM = "xterm-256color";
           };
         };
 
@@ -41,46 +42,46 @@
         "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
 
         gh = {
-          user = "git";
-          hostname = "github.com";
+          User = "git";
+          Hostname = "github.com";
         };
         "src" = {
-          user = "git";
-          hostname = "jeremiah.shire-zebra.ts.net";
-          port = 32222;
+          User = "git";
+          Hostname = "jeremiah.shire-zebra.ts.net";
+          Port = 32222;
         };
         srcpub = {
-          user = "git";
-          hostname = "src.thehellings.com";
-          port = 2222;
+          User = "git";
+          Hostname = "src.thehellings.com";
+          Port = 2222;
         };
         ivr = {
-          user = "git";
-          hostname = "gitlab.com";
+          User = "git";
+          Hostname = "gitlab.com";
         };
 
         "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          user = "gregory.hellings";
+          User = "gregory.hellings";
         };
 
         "*.thehellings.lan" = owned;
         "10.42.*" = owned;
 
         "host.crosswire.org crosswire" = {
-          hostname = "host.crosswire.org";
-          user = "ghellings";
+          Hostname = "host.crosswire.org";
+          User = "ghellings";
         };
 
         fedpeople = {
-          hostname = "fedorapeople.org";
-          user = "greghellings";
+          Hostname = "fedorapeople.org";
+          User = "greghellings";
         };
 
         "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          user = "greghellings";
+          User = "greghellings";
         };
 
-        "127.*".extraOptions = {
+        "127.*" = {
           PubkeyAcceptedAlgorithms = "+ssh-rsa";
           HostkeyAlgorithms = "+ssh-rsa";
         };

home/baseline/tools.nix

@@ -8,7 +8,6 @@
   home.packages =
     with pkgs;
     [
-      attic-client
       dig
       jqp
       kubernetes-helm

home/default.nix

@@ -10,6 +10,7 @@ let
     let
       inherit (metadata.hosts.${host}) system;
       pkgs = nixpkgs.${system};
+      pkgs' = top.self.packages.${system};
       username =
         if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
     in
@@ -25,6 +26,7 @@ let
           host
           username
           metadata
+          pkgs'
           ;
         nixvim = top.nixvimunstable;
         gui = false;

home/home.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  pkgs',
   lib,
   host ? "most",
   top,
@@ -38,7 +39,7 @@ in
       gh
       git
       gnupatch
-      hms
+      pkgs'.hms
       btop
       inetutils
       jq
@@ -46,7 +47,7 @@ in
       nix-prefetch
       nmap
       openssl
-      setup-ssh
+      pkgs'.setup-ssh
       tmux
       tree
       unzip

home/hosts/builder2/default.nix

@@ -0,0 +1 @@
+{...}: {}

home/hosts/exodus/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   greg = {
@@ -23,8 +23,12 @@
     mattermost-desktop
     minio-client
     mumble
+    nebula
+    nix-index
+    adoptopenjdk-icedtea-web
     pre-commit
     prismlauncher
+    rclone
     restic
     restic-browser
     tea
@@ -36,4 +40,13 @@
       settings.SKIP_HOST_UPDATE = true;
     };
   };
+  xdg.desktopEntries = {
+    prismlauncher = {
+      name = "Prism Launcher - Minecraft";
+      actions.minecraft = {
+        name = "Minecraft";
+        exec = lib.getExe pkgs.prismlauncher;
+      };
+    };
+  };
 }

home/hosts/gregory.hellings-mbp/default.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  pkgs',
   lib,
   username,
   ...
@@ -20,6 +21,7 @@
       claude-code
       direnv
       home-manager
+      pkgs'.dockerCompat
       python3Packages.ipython
       just
       glab
@@ -36,18 +38,22 @@
       ".pip/pip.conf".text = ''
         [global]
         retries = 1
-        index-url = https://pypi.python.org/simple
+        index-url = https://pypi.python.org/
         extra-index-url =
-            https://pypidev.ivrtechnology.com/simple/
+            https://pypidev.ivrtechnology.com/
       '';
       ".config/uv/uv.toml".text = ''
         index-strategy = "unsafe-first-match"
         [[index]]
-        url = "https://pypidev.ivrtechnology.com/simple/"
+        url = "https://pypidev.ivrtechnology.com/"
         name = "pypidev"
         ignore-error-codes = [403]
       '';
     };
+    sessionVariables = {
+      BW_GITLAB_ITEM = "7d3da4e9-5f9a-49d0-8e14-b39c010a4001";
+      BW_ANTHROPIC_ITEM = "e122fd08-3506-4f21-9c6a-b42b00fe5be1";
+    };
     username = username;
     homeDirectory = "/Users/${username}";
   };

home/hosts/icdm-root/default.nix

@@ -1,4 +0,0 @@
-{ ... }:
-
-{
-}

home/hosts/lithic/default.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  pkgs',
   lib,
   ...
 }:
@@ -26,12 +27,17 @@ in
       ansible
       awscli2
       cargo
+      clippy
       direnv
+      docker
+      docker-compose
+      docker-buildx
+      go
       home-manager
       just
       mcp-grafana
+      nil
       nixVersions.stable
-      podman
       poetry
       pre-commit
       (pulumi.withPackages (
@@ -45,6 +51,7 @@ in
       ))
       python
       rustc
+      rustfmt
       terraform
     ];
   };

hosts/baseline.nix

@@ -3,19 +3,24 @@
   lib,
   metadata,
   pkgs,
+  top,
   ...
 }:
 {
   imports = [
     ../modules/nix-conf.nix
+    top.niks3.nixosModules.niks3-auto-upload
   ];
 
+  age.secrets.niks3-api-token.file = ../secrets/niks3/api_token.age;
+
   console = {
     font = "Lat2-Terminus16";
     keyMap = "us";
   };
 
   environment.systemPackages = with pkgs; [
+    top.niks3.packages.${pkgs.stdenv.hostPlatform.system}.niks3
     agenix
     bitwarden-cli
     bmon
@@ -26,10 +31,9 @@
     efibootmgr
     findutils
     file
-    gcc-tune
     git
     gnupatch
-    hms # My own home manager switcher
+    top.self.packages.${pkgs.stdenv.hostPlatform.system}.hms # My own home manager switcher
     iperf
     killall
     nano
@@ -97,6 +101,12 @@
   # Enable the OpenSSH daemon for remote control
   services = {
     locate.enable = true;
+    niks3-auto-upload = {
+      enable = config.greg.nix.cache;
+      authTokenFile = config.age.secrets.niks3-api-token.path;
+      serverUrl = "http://hosea.nebula.thehellings.com:5751";
+      verifyS3Integrity = true;
+    };
     openssh = {
       enable = true;
       settings.X11Forwarding = true;

hosts/default.nix

@@ -15,15 +15,22 @@ let
     }:
     let
       inherit (metadata.hosts.${name}) system;
+      pkgs' = top.self.packages.${system};
     in
     channel.lib.nixosSystem {
       pkgs = nixpkgs.${system};
       specialArgs = {
-        inherit metadata top lib';
+        inherit
+          metadata
+          top
+          lib'
+          pkgs'
+          ;
       };
       modules = [
         {
           nixpkgs.hostPlatform = system;
+          networking.hostName = name;
         }
         # Imported ones
         top.agenix.nixosModules.default

hosts/unstable/builder2/default.nix

@@ -0,0 +1,60 @@
+{
+  config,
+  metadata,
+  modulesPath,
+  ...
+}:
+{
+  # Then build nixosConfiguration.<host>.config.system.build.images.proxmox
+  # SCP that to /var/lib/vz/dumps on the Proxmox host
+  imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
+  greg = {
+    home = true;
+    nebula.enable = true;
+  };
+  networking = {
+    defaultGateway = metadata.infra.gw;
+    nameservers = [ metadata.infra.dns ];
+    interfaces.ens18 = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = metadata.hosts."${config.networking.hostName}".ip;
+          prefixLength = 16;
+        }
+      ];
+    };
+  };
+  virtualisation.diskSize = 20480; # Size in mebbibytes for the base disk image
+  # Use these instead of the above to run an LXC image
+  # The main reason I wouldn't use these is because Proxmox LXC does
+  # not seem to be well supported by either Nebula VPN or Tailscale,
+  # both of which I use for my mesh networking. If there isn't a need
+  # for the service to run on those networks, then by all means go ahead
+  # and use LXC!
+  # imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
+  # proxmoxLXC = {
+  #   manageNetwork = false;
+  #   privileged = true;
+  # };
+  # systemd.suppressedSystemUnits = [
+  #   "dev-mqueue.mount"
+  #   "sys-kernel-debug.mount"
+  #   "sys-fs-fuse-connections.mount"
+  # ];
+  nix.settings = {
+    sandbox = false;
+  };
+  services = {
+    fstrim.enable = false; # Let Proxmox host handle fstrim
+    openssh = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        PermitRootLogin = "yes";
+        PasswordAuthentication = true;
+        PermitEmptyPasswords = "yes";
+      };
+    };
+  };
+}

hosts/unstable/exodus/default.nix

@@ -9,13 +9,9 @@
 {
   imports = [
     ./hardware-configuration.nix
-    top.nix-hardware.nixosModules.framework-11th-gen-intel
+    top.nix-hardware.nixosModules.framework-intel-core-ultra-series1
   ];
 
-  age.secrets = {
-    compose-attic.file = ../../../secrets/compose/attic.env.age;
-  };
-
   boot = {
     loader = {
       systemd-boot = {

hosts/unstable/genesis/default.nix

@@ -2,7 +2,12 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ top, pkgs, ... }:
+{
+  top,
+  pkgs,
+  pkgs',
+  ...
+}:
 {
   imports = [
     # Include the results of the hardware scan.
@@ -31,7 +36,7 @@
   };
 
   environment.systemPackages = with pkgs; [
-    create_ssl
+    pkgs'.create_ssl
     step-ca
   ];
 
@@ -57,6 +62,7 @@
           serverProperties = {
             allow-flight = true;
             motd = "Maya's Minecraft World";
+            online-mode = true;
           };
           whitelist = { };
 
@@ -123,9 +129,14 @@
                 # Better storage engines
                 # https://www.curseforge.com/minecraft/mc-mods/refined-storage
                 refined-storage = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/7961/605/refinedstorage-fabric-3.0.0-beta.5.jar";
-                  hash = "sha256-UiXNrGw/giCZAnCjFzFc9k4mrq6deTtL6Z00arSUFOU=";
+                  url = "https://mediafilez.forgecdn.net/files/8086/588/refinedstorage-fabric-3.0.0.jar";
+                  hash = "sha256-LuOF0aYQon78AQeD5fQ8OXHCnekfa+PNKpH7cqimFNs=";
                 };
+                # https://www.curseforge.com/minecraft/mc-mods/storage-drawers
+                #storagedrawers = pkgs.fetchurl {
+                #url = "https://mediafilez.forgecdn.net/files/7352/799/StorageDrawers-fabric-1.21.11-20.0.0.jar";
+                #hash = "sha256-eBKCmAtjAhdAjOyLMRneu/NZnNt+orIezxPy6V8g/S8=";
+                #};
                 survivalfly = pkgs.fetchurl {
                   url = "https://mediafilez.forgecdn.net/files/7870/312/survivalfly-1.3_fabric-mc26.1.1.jar";
                   hash = "sha256-Kai4wSxckpXbs1yLp8wJ4BmmjNkdDbeqerqWGIz3+Zk=";

hosts/unstable/genesis/networking.nix

@@ -22,6 +22,7 @@ let
     #"1.0.0.1" # Cloudflare
     #"149.112.112.112" # Quad 9
     metadata.infra.gw # Currently using our UniFi router for DNS as well
+    "100.100.100.100"
   ];
 in
 {
@@ -115,16 +116,21 @@ in
                 "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
                 "\tIN\tNS\t${config.networking.hostName}"
               ];
-              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
+              makeHost =
+                host:
+                [ "${host.name}\tIN\tA\t${host.address}" ]
+                ++ lib.map (a: "${a}\tIN\tA\t${host.address}") (
+                  if builtins.hasAttr "aliases" host then host.aliases else [ ]
+                );
             in
             pkgs.writeText "${domain}" (
-              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
+              builtins.concatStringsSep "\n" (preamble ++ (lib.flatten (lib.map makeHost hosts)) ++ [ "" ])
             );
         in
         lib.mapAttrs
           (domain: net: {
             master = true;
-            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
+            file = makeZoneFile (lib'.hostsByNet net (metadata.hosts // metadata.external)) domain;
           })
           {
             "shire-zebra.ts.net" = "tailscale";

hosts/unstable/hosea/arr.nix

@@ -1,70 +0,0 @@
-{
-  lib,
-  metadata,
-  pkgs,
-  ...
-}:
-let
-  ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
-  tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
-  get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
-  getTS = get "ts" tps;
-  getIP = get "ip" ips;
-  whitelists = builtins.concatStringsSep "," (
-    [
-      "localhost"
-      "127.0.0.1"
-    ]
-    ++ getTS
-    ++ getIP
-  );
-in
-{
-  services = {
-    prowlarr = {
-      enable = true;
-      dataDir = "/arr/prowlarr";
-      openFirewall = true;
-    };
-    radarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    transmission = {
-      enable = true;
-      openPeerPorts = true;
-      openRPCPort = true;
-      package = pkgs.transmission_4;
-      settings = {
-        download-dir = "/arr/transmission/downloads";
-        rpc-bind-address = "0.0.0.0";
-        rpc-host-whitelist = whitelists;
-        rpc-host-whitelist-enabled = false;
-        rpc-whitelist = whitelists;
-        rpc-whitelist-enabled = false;
-        watch-dir-enabled = true;
-        watch-dir = "/arr/transmission/incoming";
-      };
-    };
-  };
-
-  systemd.mounts =
-    let
-      nfs = name: {
-        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
-        type = "nfs";
-        name = "${name}.mount";
-        where = "/${name}";
-        requires = [ "tailscaled-autoconnect.service" ];
-        after = [ "tailscaled-autoconnect.service" ];
-        wantedBy = [ "multi-user.target" ];
-        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
-      };
-    in
-    [
-      (nfs "arr")
-      (nfs "music")
-      (nfs "photos")
-      (nfs "video")
-    ];
-}

hosts/unstable/hosea/default.nix

@@ -6,6 +6,7 @@
   config,
   metadata,
   pkgs,
+  top,
   ...
 }:
 let
@@ -17,13 +18,31 @@ in
 {
   imports = [
     # Include the results of the hardware scan.
-    ./arr.nix
     ./hardware-configuration.nix
+    top.niks3.nixosModules.niks3
   ];
 
-  age.secrets.grafana-secret-key = {
-    file = ../../../secrets/grafana-secret-key.age;
-    owner = "grafana";
+  age.secrets = {
+    cache-private-key = {
+      file = ../../../secrets/cache-private-key.age;
+      owner = "niks3";
+    };
+    grafana-secret-key = {
+      file = ../../../secrets/grafana-secret-key.age;
+      owner = "grafana";
+    };
+    niks3-access-key-id = {
+      file = ../../../secrets/niks3/access_key_id.age;
+      owner = "niks3";
+    };
+    niks3-api-token = {
+      file = ../../../secrets/niks3/api_token.age;
+      owner = "niks3";
+    };
+    niks3-secret-access-key = {
+      file = ../../../secrets/niks3/secret_access_key.age;
+      owner = "niks3";
+    };
   };
 
   # Bootloader
@@ -98,6 +117,7 @@ in
         ];
       };
     };
+    firewall.interfaces.nebula0.allowedTCPPorts = [ 5751 ];
     nameservers = [ metadata.infra.dns ];
   };
 
@@ -150,6 +170,27 @@ in
         analytics.reporting_enabled = false;
       };
     };
+    niks3 = {
+      enable = true;
+
+      apiTokenFile = config.age.secrets.niks3-api-token.path;
+      gc.enable = false;
+      httpAddr = "${metadata.hosts.hosea.nebulaIp}:5751";
+      nginx = {
+        enable = true;
+        domain = "hosea.nebula";
+        enableACME = false;
+        forceSSL = false;
+      };
+      s3 = {
+        accessKeyFile = config.age.secrets.niks3-access-key-id.path;
+        bucket = "niks3";
+        endpoint = "nas1.shire-zebra.ts.net:30188";
+        secretKeyFile = config.age.secrets.niks3-secret-access-key.path;
+        useSSL = false;
+      };
+      signKeyFiles = [ config.age.secrets.cache-private-key.path ];
+    };
     prometheus.exporters.graphite.enable = true;
     # Configure keymap
     xserver.xkb = {
@@ -158,6 +199,25 @@ in
     };
   };
 
+  systemd.mounts =
+    let
+      nfs = name: {
+        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
+        type = "nfs";
+        name = "${name}.mount";
+        where = "/${name}";
+        requires = [ "tailscaled-autoconnect.service" ];
+        after = [ "tailscaled-autoconnect.service" ];
+        wantedBy = [ "multi-user.target" ];
+        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
+      };
+    in
+    [
+      (nfs "music")
+      (nfs "photos")
+      (nfs "video")
+    ];
+
   # After first deploy: create a Grafana service account + API token for Klaatu
   # via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
   age.secrets.grafana-api-token = {

hosts/unstable/icdm-root/boot.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  # Bootloader.
-  boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/sda";
-    };
-  };
-}

hosts/unstable/icdm-root/default.nix

@@ -1,28 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ pkgs, ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ./boot.nix
-    ./filesystem.nix
-    ./location.nix
-    ./networking.nix
-    ./wiki.nix
-  ];
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.greg = {
-    isNormalUser = true;
-    description = "Gregory Hellings";
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-    ];
-    packages = with pkgs; [ ];
-  };
-}

hosts/unstable/icdm-root/filesystem.nix

@@ -1,13 +0,0 @@
-{ ... }:
-
-let
-in
-{
-  fileSystems."serve" = {
-    #device = "10.42.1.4:/volume1/icdm-mysql/";
-    #fsType = "nfs";
-    device = "/dev/sdb1";
-    fsType = "auto";
-    mountPoint = "/srv";
-  };
-}

hosts/unstable/icdm-root/hardware-configuration.nix

@@ -1,53 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
-    fsType = "btrfs";
-    options = [ "subvol=@" ];
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
-    fsType = "ext4";
-  };
-
-  fileSystems."/var" = {
-    device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
-    fsType = "btrfs";
-  };
-
-  swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/unstable/icdm-root/location.nix

@@ -1,15 +0,0 @@
-{ ... }:
-
-{
-  # Set your time zone.
-  time.timeZone = "America/Chicago";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  # Configure keymap in X11
-  services.xserver.xkb = {
-    layout = "us";
-    variant = "";
-  };
-}

hosts/unstable/icdm-root/networking.nix

@@ -1,63 +0,0 @@
-{ ... }:
-let
-  dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
-in
-{
-  # If we have to do proxying in Bayonnais, we can start to work on that here
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-  networking = {
-    hostName = "icdm-root";
-    useDHCP = false;
-    defaultGateway = "10.42.1.1";
-    nameservers = [
-      "100.100.100.100"
-      "10.42.1.2"
-    ];
-    enableIPv6 = false;
-
-    interfaces = {
-      eno1.ipv4.addresses = [
-        {
-          address = "10.42.101.1";
-          prefixLength = 16;
-        }
-        {
-          address = "10.77.1.2";
-          prefixLength = 16;
-        }
-      ];
-    };
-    # Allow traffic through
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 53 ];
-      allowedUDPPorts = [
-        53
-        67
-      ];
-    };
-
-    extraHosts = "${dnsHosts}";
-  };
-
-  services.dnsmasq = {
-    enable = true;
-    settings = {
-      domain = "icdm.lan";
-      dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
-      dhcp-option = [
-        "eno1,option:router,10.77.1.1"
-        "eno1,option:dns-server,10.77.1.2,1.1.1.1"
-        "eno1,option:domain-search,icdm.lan"
-      ];
-      expand-hosts = true;
-      log-dhcp = true;
-      log-queries = true;
-      # Upstream servers
-      server = [
-        "1.1.1.1"
-        "8.8.4.4"
-      ];
-    };
-  };
-}

hosts/unstable/icdm-root/wiki.nix

@@ -1,17 +0,0 @@
-{ pkgs, ... }:
-let
-  wikiHost = "wiki.icdm.lan";
-  kiwixport = 8080;
-in
-{
-  services.kiwix-serve = {
-    enable = true;
-    port = kiwixport;
-    library = {
-      inherit (pkgs) zim;
-    };
-  };
-
-  greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
-  networking.firewall.allowedTCPPorts = [ 80 ];
-}

hosts/unstable/jeremiah/default.nix

@@ -88,6 +88,7 @@ in
       priority = 254;
     };
     nebula.enable = true;
+    proxies."buildbot.nebula.thehellings.com".target = "http://buildbot.nebula.thehellings.com:8010/";
     tailscale = {
       enable = true;
       tags = [ "home" ];
@@ -142,7 +143,7 @@ in
             updateOutputs = false;
           };
         };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net";
+        domain = "buildbot.nebula.thehellings.com:8010";
         evalMaxMemorySize = 8192;
         evalWorkerCount = 4;
         gitea = {
@@ -155,7 +156,7 @@ in
           webhookSecretFile = config.age.secrets.gitea-webhookSecret.path;
         };
         showTrace = true;
-        #webhookBaseUrl = "http://${config.networking.hostName}.shire-zebra.ts.net:8010";
+        #webhookBaseUrl = "http://${config.networking.hostName}.nebula.thehellings.com:8010";
         workersFile = config.age.secrets.gitea-buildbotWorkersFile.path;
       };
       worker = {

hosts/unstable/kuma/default.nix

@@ -0,0 +1,76 @@
+{
+  config,
+  metadata,
+  modulesPath,
+  pkgs,
+  ...
+}:
+{
+  imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
+  greg = {
+    home = true;
+    nebula.enable = true;
+    proxies =
+      let
+        tgt = {
+          target = "http://localhost:${config.services.uptime-kuma.settings.PORT}";
+          genAliases = false;
+        };
+      in
+      {
+        "kuma.nebula.thehellings.com" = tgt;
+        "kuma.thehellings.lan" = tgt;
+        "kuma.shire-zebra.ts.net" = tgt;
+      };
+  };
+  nix.settings = {
+    sandbox = false;
+  };
+  networking = {
+    defaultGateway = metadata.infra.gw;
+    nameservers = [ metadata.infra.dns ];
+    interfaces.ens18 = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = metadata.hosts."${config.networking.hostName}".ip;
+          prefixLength = 16;
+        }
+      ];
+    };
+  };
+  proxmox.cloudInit.enable = false;
+  services = {
+    fstrim.enable = true;
+    mysql = {
+      enable = true;
+      ensureDatabases = [
+        config.services.uptime-kuma.settings.UPTIME_KUMA_DB_NAME
+      ];
+      ensureUsers = [
+        {
+          name = config.services.uptime-kuma.settings.UPTIME_KUMA_DB_USERNAME;
+          ensurePermissions = {
+            "uptimekuma.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+      package = pkgs.mariadb;
+    };
+    openssh = {
+      enable = true;
+      openFirewall = true;
+    };
+    uptime-kuma = {
+      enable = true;
+      settings = {
+        PORT = "3001"; # Default, but this allows us to explicitly use it elsewhere
+        UPTIME_KUMA_DB_TYPE = "mariadb";
+        UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
+        UPTIME_KUMA_DB_NAME = "uptimekuma";
+        UPTIME_KUMA_DB_USERNAME = "uptimekuma";
+        UPTIME_KUMA_DB_PASSWORD = "uptimekuma";
+      };
+    };
+  };
+}

hosts/unstable/linode/default.nix

@@ -1,31 +1,65 @@
 {
   pkgs,
+  pkgs',
   lib,
   config,
   ...
 }:
 
+let
+  homepage = "127.0.0.1:30080";
+  nextcloudPort = 8080;
+  sshPort = 2222;
+in
 {
   imports = [
-    ./git.nix
     ./hardware-configuration.nix
-    ./podman.nix
-    ./matrix.nix
-    ./nextcloud.nix
-    ./nginx.nix
-    ./postgres.nix
   ];
 
+  age.secrets = {
+    acme.file = ../../../secrets/acme.age;
+    nextcloudadmin = {
+      file = ../../../secrets/nextcloudadmin.age;
+      owner = "nextcloud";
+    };
+  };
+
   environment.systemPackages = with pkgs; [
     bind
     graphviz
     nix-du
     pgloader
+    podman-compose
+    pkgs'.upgrade-pg-cluster
   ];
 
   greg = {
+    backup.jobs = {
+      nextcloud-bkup = {
+        src = "/var/lib/nextcloud";
+        dest = "nextcloud-backup";
+        pre = lib.getExe (
+          pkgs.writeShellApplication {
+            name = "nextcloud-backup-pre";
+            runtimeInputs = [ config.services.nextcloud.occ ];
+            text = "nextcloud-occ maintenance:mode --on";
+          }
+        );
+        post = lib.getExe (
+          pkgs.writeShellApplication {
+            name = "nextcloud-backup-post";
+            runtimeInputs = [ config.services.nextcloud.occ ];
+            text = "nextcloud-occ maintenance:mode --off";
+          }
+        );
+      };
+      greg-postgresql-backup = {
+        src = config.services.postgresqlBackup.location;
+        dest = "linode-postgres";
+      };
+    };
     gitea-runner = {
-      enable = true;
+      enable = false;
       extraLabels = [
         "vps:host"
         "blog:host"
@@ -37,19 +71,22 @@
       enable = true;
       isLighthouse = true;
     };
-    proxies."immich.thehellings.com" = {
-      genAliases = false;
-      target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
-      ssl = true;
-    };
     tailscale.enable = true;
   };
 
   networking = {
-    networkmanager.enable = lib.mkForce false;
-    hostName = "linode";
     domain = "thehellings.com";
-    nameservers = [ "100.88.91.27" ];
+    firewall.allowedTCPPorts = [
+      sshPort
+      80
+      443
+    ];
+    hostName = "linode";
+    nameservers = [
+      "10.157.0.2"
+      "100.96.198.104"
+    ];
+    networkmanager.enable = lib.mkForce false;
   };
 
   programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
@@ -60,10 +97,242 @@
     "    UserKnownHostsFile /dev/null"
   ];
 
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      dnsPropagationCheck = false;
+      dnsResolver = "92.123.95.3:53,92.123.94.3:53,92.123.94.2:53,92.123.95.4:53,92.123.95.2:53";
+      email = "greg.hellings@gmail.com";
+      extraLegoRunFlags = [ "--ipv4only" ]; # Force IPv4 only
+      #server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+    };
+    certs."thehellings.com" = {
+      dnsProvider = "linode";
+      environmentFile = config.age.secrets.acme.path;
+      extraDomainNames = [
+        "*.thehellings.com"
+      ];
+    };
+  };
+
   services = {
+
+    anubis = {
+      instances = {
+        git = {
+          enable = true;
+          settings = {
+            BIND = "/run/anubis/anubis-git/anubis.sock";
+            COOKIE_DOMAIN = "thehellings.com";
+            SERVE_ROBOTS_TXT = true;
+            SLOG_LEVEL = "DEBUG";
+            TARGET = "http://git.k3s.nebula.thehellings.com";
+          };
+        };
+      };
+    };
+
+    haproxy = {
+      enable = true;
+      config = ''
+        global
+          nbthread 4
+          maxconn 80
+          log /dev/log local0
+
+        defaults
+          timeout connect 500s
+          timeout client 500s
+          timeout server 1h
+
+        listen gitsshd
+          bind *:${toString sshPort}
+          timeout client 1h
+          mode tcp
+          server git-isaiah isaiah.nebula.thehellings.com:32222
+          server git-jeremiah jeremiah.nebula.thehellings.com:32222
+          server git-zeke zeke.nebula.thehellings.com:32222
+
+        frontend https
+          bind *:80
+          bind *:443 ssl crt ${config.security.acme.certs."thehellings.com".directory}/full.pem
+
+          http-request redirect scheme https unless { ssl_fc }
+          http-request add-header X-Forwarded-Proto https
+
+          http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure
+
+          option http-server-close
+          option http-keep-alive
+
+          #option httplog
+          #declare capture response len 80
+          #http-response capture res.hdr(Location) id 0
+
+          use_backend git if { hdr(host) -i src.thehellings.com }
+          use_backend git if { req_ssl_sni -i src.thehellings.com }
+          use_backend next if { hdr(host) -i next.thehellings.com }
+          use_backend next if { req_ssl_sni -i next.thehellings.com }
+          use_backend matrix if { hdr(host) -i matrix.thehellings.com }
+          use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
+          use_backend web if { hdr(host) -i thehellings.com }
+          use_backend web if { req_ssl_sni -i thehellings.com }
+
+        backend git
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          http-request set-header Host git.k3s.nebula.thehellings.com
+          server git-isaiah isaiah.nebula.thehellings.com:80
+          server git-jeremiah jeremiah.nebula.thehellings.com:80
+          server git-zeke zeke.nebula.thehellings.com:80
+
+        backend matrix
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          http-request set-header Host matrix.k3s.nebula.thehellings.com
+          server git-isaiah isaiah.nebula.thehellings.com:80
+          server git-jeremiah jeremiah.nebula.thehellings.com:80
+          server git-zeke zeke.nebula.thehellings.com:80
+
+        backend web
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          server web-container ${homepage}
+
+        backend next
+          log global
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          #http-response replace-value Location http://localhost:${builtins.toString nextcloudPort}/(.*) https://next.thehellings.com/\2
+          server nextcloud 127.0.0.1:${builtins.toString nextcloudPort}
+      '';
+    };
+
     immich-public-proxy = {
       enable = true;
       immichUrl = "https://immich.shire-zebra.ts.net";
     };
+
+    logrotate = {
+      enable = true;
+      settings = {
+        postgresBackup = {
+          enable = true;
+          files = "${config.services.postgresqlBackup.location}/*.gz";
+        };
+        postgresLog = {
+          enable = true;
+          files = "/var/lib/postgresql/*/log/*.log";
+          compress = true;
+          compresscmd = "${pkgs.xz}/bin/xz";
+        };
+      };
+    };
+
+    nextcloud = {
+      enable = true;
+      package = pkgs.nextcloud33;
+      appstoreEnable = true;
+      hostName = "localhost";
+      https = false;
+      config = {
+        adminpassFile = config.age.secrets.nextcloudadmin.path;
+        adminuser = "greg";
+        dbhost = "/run/postgresql";
+        dbtype = "pgsql";
+      };
+      settings = {
+        default_phone_region = "US";
+        overwriteprotocol = "http";
+        trusted_domains = [ "next.thehellings.com" ];
+        trusted_proxies = [
+          "localhost"
+          "127.0.0.1"
+        ];
+      };
+    };
+
+    # Move to :8080 so that we can run haproxy as the primary HTTP service
+    nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
+      {
+        addr = "127.0.0.1";
+        port = nextcloudPort;
+      }
+    ];
+
+    openssh.settings.PasswordAuthentication = false;
+
+    postgresql = {
+      enable = true;
+      package = pkgs.postgresql_15;
+      checkConfig = true;
+      ensureDatabases = [ "nextcloud" ];
+      #initialScript = pkgs.writeText "create-matrix-db.sql" ''
+      #	CREATE ROLE "matrix-synapse" WITH LOGIN;
+      #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
+      #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
+      #'';  # These are done manually in order to set the LC_COLLATE values properly
+      ensureUsers = [
+        {
+          name = "nextcloud";
+          ensureDBOwnership = true;
+        }
+      ];
+      settings = {
+        log_connections = true;
+        log_statement = "all";
+        logging_collector = true;
+        log_filename = "postgresql.log";
+      };
+      identMap = ''
+        root root postgres
+      '';
+    };
+
+    postgresqlBackup = {
+      enable = true;
+      databases = [ "nextcloud" ];
+    };
+  };
+
+  systemd.services = {
+    haproxy = {
+      after = [
+        "nextcloud.service"
+        "network-online.target"
+      ];
+      wants = [
+        "nextcloud.service"
+        "network-online.target"
+      ];
+    };
+  };
+
+  users.users.haproxy.extraGroups = [ config.security.acme.certs."thehellings.com".group ];
+
+  # Actually serve the content from here
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers."homepage" = {
+      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
+      ports = [ "${homepage}:80" ];
+    };
+  };
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
   };
 }

hosts/unstable/linode/git.nix

@@ -1,122 +0,0 @@
-{ ... }:
-
-let
-  srcDomain = "src.thehellings.com";
-  sshPort = 2222;
-in
-{
-  greg.proxies."${srcDomain}" = {
-    target = "https://gitea.shire-zebra.ts.net";
-    ssl = true;
-    genAliases = false;
-    extraConfig = ''
-      proxy_ssl_verify off;
-      proxy_ssl_server_name on;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Ssl on;
-      client_max_body_size 100000m;
-      # Ultimate AI Block List v1.7 20250924
-      # https://perishablepress.com/ultimate-ai-block-list/
-
-      if ($http_user_agent ~* "(openai\.com|\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ Content\ Detector|AI\ Detection|AI\ Dungeon|AI\ Journalist|AI\ Legion)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(AI\ RAG|AI\ Search|AI\ SEO\ Crawler|AI\ Training|AI\ Web|AI\ Writer|AI2|AIBot|aiHitBot|AIMatrix|AISearch|AITraining|Alexa|Alice\ Yandex|AliGenie|AliyunSec|Alpha\ AI|AlphaAI|Amazon|Amelia)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(AndersPinkBot|AndiBot|Anonymous\ AI|Anthropic|AnyPicker|Anyword|Applebot|Aria\ AI|Aria\ Browse|Articoolo|Ask\ AI|AutoGen|AutoGLM|Automated\ Writer|AutoML|Autonomous\ RAG|AwarioRssBot|AwarioSmartBot|AWS\ Trainium|Azure)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(BabyAGI|BabyCatAGI|BardBot|Basic\ RAG|Bedrock|Big\ Sur|Bigsur|Botsonic|Brightbot|Browser\ MCP\ Agent|Browser\ Use|Bytebot|ByteDance|Bytespider|CarynAI|CatBoost|CC-Crawler|CCBot|Chai|Character)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Charstar\ AI|Chatbot|ChatGLM|Chatsonic|ChatUser|Chinchilla|Claude|ClearScope|Clearview|Cognitive\ AI|Cohere|Common\ Crawl|CommonCrawl|Content\ Harmony|Content\ King|Content\ Optimizer|Content\ Samurai|ContentAtScale|ContentBot|Contentedge)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(ContentShake|Conversion\ AI|Copilot|CopyAI|Copymatic|Copyscape|CoreWeave|Corrective\ RAG|Cotoyogi|CRAB|Crawl4AI|CrawlQ\ AI|Crawlspace|Crew\ AI|CrewAI|Crushon\ AI|DALL-E|DarkBard|DataFor|DataProvider)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Datenbank\ Crawler|DeepAI|Deep\ AI|DeepL|DeepMind|Deep\ Research|DeepResearch|DeepSeek|Devin|Diffbot|Doubao\ AI|DuckAssistBot|DuckDuckGo\ Chat|DuckDuckGo-Enhanced|Echobot|Echobox|Elixir|FacebookBot|FacebookExternalHit|Factset)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Falcon|FIRE-1|Firebase|Firecrawl|Flux|Flyriver|Frase\ AI|FriendlyCrawler|Gato|Gemini|Gemma|Gen\ AI|GenAI|Generative|Genspark|Gentoo-chat|Ghostwriter|GigaChat|GLM|GodMode)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Goose|GPT|Grammarly|Grendizer|Grok|GT\ Bot|GTBot|GTP|Hemingway\ Editor|Hetzner|Hugging|Hunyuan|Hybrid\ Search\ RAG|Hypotenuse\ AI|iAsk|ICC-Crawler|ImageGen|ImagesiftBot|img2dataset|imgproxy)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(INK\ Editor|INKforall|Instructor|IntelliSeek|Inferkit|ISSCyberRiskCrawler|Janitor\ AI|Jasper|Jenni\ AI|Julius\ AI|Kafkai|Kaggle|Kangaroo|Keyword\ Density\ AI|Kimi|Knowledge|KomoBot|Kruti|LangChain|Le\ Chat)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Lensa|Lightpanda|LinerBot|LLaMA|LLM|Local\ RAG\ Agent|Lovable|Magistral|magpie-crawler|Manus|MarketMuse|Meltwater|Meta-AI|Meta-External|Meta-Webindexer|Meta\ AI|MetaAI|MetaTagBot|Middleware|Midjourney)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Mini\ AGI|MiniMax|Mintlify|Mistral|Mixtral|model-training|Monica|Narrative|NeevaBot|netEstate|Neural\ Text|NeuralSEO|NinjaAI|NodeZero|Nova\ Act|NovaAct|OAI-SearchBot|OAI\ SearchBot|OASIS|Olivia)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Omgili|Open\ AI|Open\ Interpreter|OpenAGI|OpenAI|OpenBot|OpenPi|OpenRouter|OpenText\ AI|Operator|Outwrite|Page\ Analyzer\ AI|PanguBot|Panscient|Paperlibot|Paraphraser\.io|peer39_crawler|Perflexity|Perplexity|Petal)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Phind|PiplBot|PoeBot|PoeSearchBot|ProWritingAid|Proximic|Puppeteer|Python\ AI|Qualified|Quark|QuillBot|Qopywriter|Qwen|RAG\ Agent|RAG\ Azure\ AI|RAG\ Chatbot|RAG\ Database|RAG\ IS|RAG\ Pipeline|RAG\ Search)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(RAG\ with|RAG-|RAG_|Raptor|React\ Agent|Redis\ AI\ RAG|RobotSpider|Rytr|SaplingAI|SBIntuitionsBot|Scala|Scalenut|Scrap|ScriptBook|Seekr|SEObot|SEO\ Content\ Machine|SEO\ Robot|SemrushBot|Sentibot)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Serper|ShapBot|Sidetrade|Simplified\ AI|Sitefinity|Skydancer|SlickWrite|SmartBot|Sonic|Sora|Spider/2|SpiderCreator|Spin\ Rewrite|Spinbot|Stability|StableDiffusionBot|Sudowrite|SummalyBot|Super\ Agent|Superagent)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(SuperAGI|Surfer\ AI|TerraCotta|Text\ Blaze|TextCortex|Thinkbot|Thordata|TikTokSpider|Timpibot|Tinybird|Together\ AI|Traefik|TurnitinBot|uAgents|VelenPublicWebCrawler|Venus\ Chub\ AI|Vidnami\ AI|Vision\ RAG|WebSurfer|WebText)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Webzio|WeChat|Whisper|WordAI|Wordtune|WPBot|Writecream|WriterZen|Writescope|Writesonic|xAI|xBot|YaML|YandexAdditional|YouBot|Zendesk|Zero|Zhipu|Zhuque\ AI|Zimm)") {
-        return 444;
-      }
-    '';
-  };
-  #greg.proxies."registry.thehellings.com" = {
-  #target = "https://gitea.shire-zebra.ts.net:5000";
-  #ssl = true;
-  #genAliases = false;
-  #extraConfig = ''
-  #proxy_set_header X-Forwarded-Proto https;
-  #proxy_set_header X-Forwarded-Ssl on;
-  #client_max_body_size 25000m;
-  #'';
-  #};
-
-  networking.firewall.allowedTCPPorts = [ sshPort ];
-
-  systemd.services = {
-    haproxy = {
-      after = [
-        "network-online.target"
-      ];
-      wants = [
-        "network-online.target"
-      ];
-    };
-  };
-
-  services.haproxy = {
-    enable = true;
-    config = ''
-      global
-        daemon
-        maxconn 20
-
-      defaults
-        timeout connect 500s
-        timeout client 500s
-        timeout server 1h
-
-      listen gitsshd
-        bind *:${toString sshPort}
-        timeout client 1h
-        mode tcp
-        server git-isaiah isaiah.shire-zebra.ts.net:32222
-        server git-jeremiah jeremiah.shire-zebra.ts.net:32222
-        server git-zeke zeke.shire-zebra.ts.net:32222
-    '';
-  };
-}

hosts/unstable/linode/matrix.nix

@@ -1,88 +0,0 @@
-# Registration of new users is disabled for the public, but I can create
-# them by the following commands:
-# nix run nixpkgs.matrix-synapse
-# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
-{ config, lib, ... }:
-let
-  domain = "${config.networking.domain}";
-  fqdn = "matrix.${domain}";
-in
-{
-  services.nginx = {
-    virtualHosts = {
-      # Server the '.well-known' files to find the Matrix API server
-      "${domain}" = {
-        enableACME = true;
-        forceSSL = true;
-        # This is needed so that servers contacting hellings.com can find
-        # the actual application server at matrix.thehellings.com
-        locations."= /.well-known/matrix/server".extraConfig =
-          let
-            server = {
-              "m.server" = "${fqdn}:443";
-            };
-          in
-          ''
-            add_header Content-Type application/json;
-            return 200 '${builtins.toJSON server}';
-          '';
-
-        locations."= /.well-known/matrix/client".extraConfig =
-          let
-            client = {
-              "m.homeserver" = {
-                "base_url" = "https://${fqdn}";
-              };
-              "m.identity_server" = {
-                "base_url" = "https://vector.im";
-              };
-            };
-          in
-          ''
-            add_header Content-Type application/json;
-            add_header Access-Control-Allow-Origin *;
-            return 200 '${builtins.toJSON client}';
-          '';
-      };
-
-      # Reverse proxy in front of the actual Matrix server
-      "${fqdn}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        extraConfig = ''
-          error_log /var/log/nginx/debug.log debug;
-        '';
-
-        # Not the appropriate place for the chat client
-        locations =
-          (builtins.listToAttrs (
-            builtins.map
-              (
-                val:
-                lib.nameValuePair "/_${val}" {
-                  proxyPass = "http://matrix.kubernetes";
-                }
-              )
-              [
-                "matrix"
-                "synapse"
-                "dendrite"
-              ]
-          ))
-          // {
-            "/".extraConfig = "return 404;";
-          };
-      };
-    };
-  };
-
-  # Open networking ports for the server
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [
-      80
-      443
-    ];
-  };
-}

hosts/unstable/linode/nextcloud.nix

@@ -1,58 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  age.secrets.nextcloudadmin = {
-    file = ../../../secrets/nextcloudadmin.age;
-    owner = "nextcloud";
-  };
-
-  services.nextcloud = {
-    enable = true;
-    package = pkgs.nextcloud33;
-    appstoreEnable = true;
-    hostName = "next.${config.networking.domain}";
-    https = true;
-    config = {
-      adminpassFile = config.age.secrets.nextcloudadmin.path;
-      adminuser = "greg";
-      dbhost = "/run/postgresql";
-      dbtype = "pgsql";
-    };
-    settings = {
-      default_phone_region = "US";
-      overwriteprotocol = "https";
-    };
-  };
-
-  services.nginx.virtualHosts."next.thehellings.com" = {
-    forceSSL = true;
-    enableACME = true;
-  };
-
-  # Otherwise nginx errors looking for the nextcloud sock file
-  systemd.services.nginx.after = [ "nextcloud.service" ];
-
-  greg.backup.jobs.nextcloud-bkup = {
-    src = "/var/lib/nextcloud";
-    dest = "nextcloud-backup";
-    pre = lib.getExe (
-      pkgs.writeShellApplication {
-        name = "nextcloud-backup-pre";
-        runtimeInputs = [ config.services.nextcloud.occ ];
-        text = "nextcloud-occ maintenance:mode --on";
-      }
-    );
-    post = lib.getExe (
-      pkgs.writeShellApplication {
-        name = "nextcloud-backup-post";
-        runtimeInputs = [ config.services.nextcloud.occ ];
-        text = "nextcloud-occ maintenance:mode --off";
-      }
-    );
-  };
-}

hosts/unstable/linode/nginx.nix

@@ -1,43 +0,0 @@
-{ ... }:
-let
-  homepage = "127.0.0.1:30080";
-in
-{
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "greg.hellings@gmail.com";
-  };
-
-  services.nginx = {
-    enable = true;
-
-    clientMaxBodySize = "25000m"; # To help with uploading container images
-    # If there are recommended settings, let's use them!
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-  };
-
-  # Actually serve the content from here
-  virtualisation.podman.enable = true;
-  virtualisation.oci-containers = {
-    backend = "podman";
-    containers."homepage" = {
-      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
-      ports = [ "${homepage}:80" ];
-    };
-  };
-  greg.proxies = {
-    "thehellings.com" = {
-      target = "http://${homepage}/";
-      ssl = true;
-      genAliases = false;
-    };
-    "doubles.thehellings.com" = {
-      target = "http://localhost:8081";
-      ssl = true;
-      genAliases = false;
-    };
-  };
-}

hosts/unstable/linode/podman.nix

@@ -1,13 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    podman-compose
-  ];
-
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-    dockerSocket.enable = true;
-  };
-}

hosts/unstable/linode/postgres.nix

@@ -1,58 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
-
-  services.postgresql = {
-    enable = true;
-    package = pkgs.postgresql_15;
-    checkConfig = true;
-    ensureDatabases = [ "nextcloud" ];
-    #initialScript = pkgs.writeText "create-matrix-db.sql" ''
-    #	CREATE ROLE "matrix-synapse" WITH LOGIN;
-    #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
-    #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
-    #'';  # These are done manually in order to set the LC_COLLATE values properly
-    ensureUsers = [
-      {
-        name = "nextcloud";
-        ensureDBOwnership = true;
-      }
-    ];
-    settings = {
-      log_connections = true;
-      log_statement = "all";
-      logging_collector = true;
-      log_filename = "postgresql.log";
-    };
-    identMap = ''
-      root root postgres
-    '';
-  };
-
-  services.postgresqlBackup = {
-    enable = true;
-    databases = [ "nextcloud" ];
-  };
-
-  services.logrotate = {
-    enable = true;
-    settings = {
-      postgresBackup = {
-        enable = true;
-        files = "${config.services.postgresqlBackup.location}/*.gz";
-      };
-      postgresLog = {
-        enable = true;
-        files = "/var/lib/postgresql/*/log/*.log";
-        compress = true;
-        compresscmd = "${pkgs.xz}/bin/xz";
-      };
-    };
-  };
-
-  greg.backup.jobs.greg-postgresql-backup = {
-    src = config.services.postgresqlBackup.location;
-    dest = "linode-postgres";
-  };
-}

hosts/unstable/proxmoxtemplate/default.nix

@@ -1,60 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ pkgs, ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-  ];
-
-  # Bootloader.
-  boot.loader = {
-    systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-  ];
-
-  greg = {
-    home = true;
-    tailscale = {
-      enable = true;
-      tags = [ "home" ];
-    };
-  };
-
-  networking = {
-    hostName = "proxmoxtemplate"; # Define your hostname.
-    # defaultGateway = {
-    #   address = " 10.42.1.2";
-    #   interface = "enp6s18";
-    # };
-    # interfaces = {
-    #   enp6s18 = {
-    #     ipv4.addresses = [
-    #       {
-    #         address = "10.42.1.8";
-    #         prefixLength = 16;
-    #       }
-    #     ];
-    #   };
-    # };
-    nameservers = [ "10.42.1.5" ];
-  };
-
-  services.qemuGuest.enable = true;
-
-  system.stateVersion = "24.11"; # Did you read the comment?
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.greg = {
-    isNormalUser = true;
-    description = "Greg Hellings";
-    extraGroups = [ "wheel" ];
-    packages = with pkgs; [ ];
-  };
-}

hosts/unstable/proxmoxtemplate/hardware-configuration.nix

@@ -1,50 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "uhci_hcd"
-    "ehci_pci"
-    "ahci"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/7115-EFA6";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
-}

lib/default.nix

@@ -15,6 +15,7 @@
       (name: value: {
         inherit name;
         address = builtins.getAttr netAttr value;
+        aliases = lib.optionals (builtins.hasAttr "aliases" value) (builtins.getAttr "aliases" value);
       })
       (
         lib.filterAttrs (

manifests/gitea/chart.yaml

@@ -15,7 +15,7 @@ spec:
   chart:
     spec:
       chart: gitea
-      version: "12.5.3"
+      version: "12.6.0"
       sourceRef:
         kind: HelmRepository
         name: gitea-repository
@@ -35,7 +35,7 @@ spec:
       storageClass: longhorn-default
 
     image:
-      tag: "1.25.5"
+      tag: "1.26.2"
 
     replicaCount: 1
 
@@ -66,8 +66,8 @@ spec:
           APP_NAME: "Gitea: Greg's Cup of Git"
           RUN_MODE: dev
         server:
-          DOMAIN: "thehellings.com"
-          ROOT_URL: "https://src.thehellings.com"
+          DOMAIN: "shire-zebra.ts.net"
+          ROOT_URL: "https://gitea.shire-zebra.ts.net"
           SSH_PORT: "2222"
         database:
           DB_TYPE: postgres

manifests/gitea/ingress.yaml

@@ -12,3 +12,20 @@ spec:
   tls:
     - hosts:
         - gitea
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-direct
+spec:
+  rules:
+    - host: git.k3s.nebula.thehellings.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: gitea-release-http
+                port:
+                  name: http

manifests/helm/longhorn.yaml

@@ -27,7 +27,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: "1.11.1"
+      version: "1.11.2"
       sourceRef:
         kind: HelmRepository
         name: longhorn

manifests/mariadb-operator/chart.yaml

@@ -19,6 +19,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -33,6 +34,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
   dependsOn:
     - name: mariadb-operator-crds
     - name: longhorn

manifests/mariadb-operator/databases.yaml

@@ -11,6 +11,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
   dependsOn:
     - name: mariadb-operator-crds
     - name: mariadb-operator

manifests/matrix/ingress.yaml

@@ -13,3 +13,20 @@ spec:
   tls:
     - hosts:
         - matrix
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix-direct
+spec:
+  rules:
+    - host: matrix.k3s.nebula.thehellings.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: dendrite
+                port:
+                  number: 8008

modules/hm/gui.nix

@@ -77,6 +77,7 @@ in
 
       programs.firefox = {
         enable = true; # (!pkgs.stdenv.hostPlatform.isDarwin);
+        configPath = if pkgs.stdenv.hostPlatform.isDarwin then "${config.home.homeDirectory}/Library/Application Support/Firefox" else "${config.xdg.configHome}/mozilla/firefox";
         package = pkgs.firefox-bin;
         policies = {
           DisableAppUpdate = true;

modules/hm/gui/bookmarks.nix

@@ -316,6 +316,26 @@
                 name = "Buildbot";
                 url = "http://jeremiah.shire-zebra.ts.net:8010/";
               }
+              {
+                name = "Garage WebUI";
+                url = "http://nas1.shire-zebra.ts.net:30186/";
+              }
+              {
+                name = "Garage RPC";
+                url = "http://nas1.shire-zebra.ts.net:30187/";
+              }
+              {
+                name = "Garage S3 API";
+                url = "http://nas1.shire-zebra.ts.net:30188/";
+              }
+              {
+                name = "Garage S3 Web";
+                url = "http://nas1.shire-zebra.ts.net:30189/";
+              }
+              {
+                name = "Garage Admin";
+                url = "http://nas1.shire-zebra.ts.net:30190/";
+              }
             ];
           }
           {
@@ -399,16 +419,24 @@
         name = "Media";
         bookmarks = [
           {
-            name = "Prowlarr";
-            url = "https://hosea.shire-zebra.ts.net:9696/";
+            name = "Flaresolverr";
+            url = "http://nas1.shire-zebra.ts.net:30098";
           }
           {
-            name = "Transmission";
-            url = "https://hosea.shire-zebra.ts.net:9091/";
+            name = "Prowlarr";
+            url = "http://nas1.shire-zebra.ts.net:30050/";
+          }
+          {
+            name = "Sonarr (TV)";
+            url = "http://nas1.shire-zebra.ts.net:30113/";
           }
           {
             name = "Radarr (Movies)";
-            url = "https://hosea.shire-zebra.ts.net:7878/";
+            url = "http://nas1.shire-zebra.ts.net:30025/";
+          }
+          {
+            name = "Deluge";
+            url = "http://nas1.shire-zebra.ts.net:30038/";
           }
         ];
       }

modules/nix-conf.nix

@@ -62,11 +62,12 @@ in
             if cfg.cache then
               [
                 #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
-                "http://nas1.shire-zebra.ts.net:8080/default"
+                "http://niks3.nas1.shire-zebra.ts.net:30189/"
+                #"http://nas1.shire-zebra.ts.net:8080/default"
               ]
             else
               [
-                "http://nas1.thehellings.lan:8080/default"
+                "http://niks3.nas1.thehellings.lan:30189/"
               ]
           )
           ++ [
@@ -78,6 +79,7 @@ in
             "https://nixhelm.cachix.org"
           ];
         trusted-public-keys = [
+          "niks3:8iztr/NACwYEK5O7JJtGFGuv+ho/cmwql8NeoCiXNto="
           #"chronicles.shire-zebra.ts.net:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
           "default:DTGxNijw2D8FrZJPT1pFTWcLqbt60tovL+9Z+VW0HRY="
           "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="

modules/nixos/home.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 
@@ -18,35 +17,9 @@ with lib;
   };
 
   config = mkIf cfg {
-    age.secrets.attic.file = ../../secrets/attic.age;
     networking.domain = "thehellings.lan";
     time.timeZone = "America/Chicago";
 
-    systemd.services.attic-client = {
-      enable = true;
-      description = "Attic client watch-store service";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        Restart = "on-failure";
-        RestartSec = "5s";
-      };
-      preStart = ''
-        set -x
-        mkdir -p $XDG_CONFIG_HOME/attic
-        cp ${config.age.secrets.attic.path} $XDG_CONFIG_HOME/attic/config.toml
-      '';
-      script = "${pkgs.attic-client}/bin/attic watch-store --ignore-upstream-cache-filter default";
-      environment = {
-        XDG_CONFIG_HOME = "/var/lib/attic-client";
-      };
-    };
-
-    systemd.tmpfiles.rules = [
-      "d /var/lib/attic-client 0755 root root -"
-    ];
-
     # Open Prometheus exporter ports on LAN-connected hosts only.
     # NOT in baseline.nix to avoid exposing these on internet-facing hosts (e.g. linode).
     networking.firewall.allowedTCPPorts = [

modules/nixos/kubernetes.nix

@@ -14,6 +14,9 @@ let
     url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";
     sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
   };
+  keepaliveIp = "10.42.5.1";
+  nebulaName = "k3s.nebula.thehellings.com";
+  nebulaIp = "10.157.100.1";
 in
 {
   options.greg = {
@@ -43,6 +46,13 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.greg.nebula.enable;
+        message = "Configure Nebula for this host, first";
+      }
+    ];
+
     age.secrets = {
       bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
       dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -95,6 +105,9 @@ in
           "--supervisor-metrics=true"
           "--tls-san ${config.networking.hostName}.thehellings.lan"
           "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
+          "--tls-san ${keepaliveIp}"
+          "--tls-san ${nebulaName}"
+          "--tls-san ${nebulaIp}"
         ];
         manifests = {
           cert-manager.source = cert-manager;
@@ -110,20 +123,37 @@ in
       keepalived = {
         enable = true;
         openFirewall = true;
-        vrrpInstances.kubernetes = {
-          interface = cfg.vipInterface;
-          priority = cfg.priority;
-          state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
-          virtualIps = [
-            {
-              addr = "10.42.5.1/16";
-              dev = cfg.vipInterface;
-            }
-          ];
-          virtualRouterId = 77;
-          extraConfig = ''
-            advert_int 1
-          '';
+        vrrpInstances = {
+          kubernetes = {
+            interface = cfg.vipInterface;
+            priority = cfg.priority;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${keepaliveIp}/16";
+                dev = cfg.vipInterface;
+              }
+            ];
+            virtualRouterId = 77;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
+          k3s-nebula = {
+            interface = "nebula0";
+            priority = 1;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${nebulaIp}/16";
+                dev = "nebula0";
+              }
+            ];
+            virtualRouterId = 78;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
         };
       };
       openiscsi = {

modules/nixos/nebula.nix

@@ -27,7 +27,7 @@ let
   nebulaDomain = "nebula.thehellings.com";
   # Linode's public address — used by all non-lighthouse hosts to reach it.
   # Override with greg.nebula.lighthouseAddr if the public IP ever changes.
-  defaultLighthouseAddr = "linode.${nebulaDomain}";
+  defaultLighthouseAddr = "thehellings.com";
 in
 {
   options.greg.nebula = {

network.json

@@ -9,11 +9,9 @@
     "tailscale": "100.64.0.0/10"
   },
   "hosts": {
-    "chronicles": {
-      "ip": "10.42.1.4",
-      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
-      "external": true,
-      "ts": "100.119.228.115"
+    "builder2": {
+      "ip": "10.42.1.17",
+      "system": "x86_64-linux"
     },
     "exodus": {
       "ip": null,
@@ -30,6 +28,15 @@
       "tags": ["router", "server"],
       "nebulaIp": "10.157.0.2"
     },
+    "gregory.hellings-mbp": {
+      "external": true,
+      "system": "aarch64-darwin",
+      "user": "gregory.hellings"
+    },
+    "gregs-MacBook-Pro-16-inch-Nov-2024": {
+      "external": true,
+      "system": "aarch64-darwin"
+    },
     "hosea": {
       "ip": "10.42.1.7",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
@@ -38,10 +45,6 @@
       "tags": ["server"],
       "nebulaIp": "10.157.0.3"
     },
-    "icdm-root": {
-      "external": true,
-      "system": "x86_64-linux"
-    },
     "isaiah": {
       "builder": true,
       "ip": "10.42.1.6",
@@ -56,12 +59,12 @@
       "external": true,
       "system": "x86_64-linux"
     },
-    "gregory.hellings-mbp": {
+    "ivr": {
       "external": true,
-      "system": "aarch64-darwin",
-      "user": "gregory.hellings"
+      "system": "aarch64-darwin"
     },
     "jeremiah": {
+      "aliases": ["buildbot"],
       "builder": true,
       "ip": "10.42.1.8",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0",
@@ -71,14 +74,12 @@
       "tags": ["builder", "kube", "server"],
       "nebulaIp": "10.157.0.5"
     },
-    "joel": {
-      "external": true,
-      "ip": "10.42.0.4",
-      "ts": null
-    },
-    "gregs-MacBook-Pro-16-inch-Nov-2024": {
-      "external": true,
-      "system": "aarch64-darwin"
+    "kuma": {
+      "ip": "10.42.1.19",
+      "nebulaIp": "10.157.0.8",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIhr+LmYMOk4Hixxew2FiAvL8sycgQvnhK8PBGjfnkJb",
+      "system": "x86_64-linux",
+      "tags": ["server"]
     },
     "lithic": {
       "external": true,
@@ -92,10 +93,6 @@
       "tags": ["public", "server"],
       "nebulaIp": "10.157.0.1"
     },
-    "ivr": {
-      "external": true,
-      "system": "aarch64-darwin"
-    },
     "MacBook-Pro.local": {
       "external": true,
       "system": "aarch64-darwin"
@@ -104,23 +101,10 @@
       "external": true,
       "system": "aarch64-darwin"
     },
-    "nas1": {
-      "external": true,
-      "ip": "10.42.1.14",
-      "ts": "100.114.187.61"
-    },
     "nixos": {
       "external": true,
       "system": "x86_64-linux"
     },
-    "printer": {
-      "external": true,
-      "ip": "10.42.1.3"
-    },
-    "proxmoxtemplate": {
-      "external": true,
-      "system": "x86_64-linux"
-    },
     "wsl": {
       "external": true,
       "system": "aarch64-linux"
@@ -135,5 +119,57 @@
       "tags": ["builder", "kube", "server"],
       "nebulaIp": "10.157.0.6"
     }
+  },
+  "external": {
+    "chronicles": {
+      "ip": "10.42.1.4",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
+      "ts": "100.119.228.115",
+      "aliases": ["s3"]
+    },
+    "hermes": {
+      "ip": "10.42.1.18",
+      "mac": "BC:24:11:E4:72:AB",
+      "nebulaIp": "10.157.0.8",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
+      "tags": ["server"]
+    },
+    "joel": {
+      "ip": "10.42.0.4"
+    },
+    "k3s": {
+      "aliases": ["*.k3s"],
+      "ip": "10.42.5.1",
+      "nebulaIp": "10.157.100.1"
+    },
+    "nas1": {
+      "aliases": ["*.nas1"],
+      "ip": "10.42.1.14",
+      "ts": "100.114.187.61"
+    },
+    "printer": {
+      "ip": "10.42.1.3"
+    },
+    "pve2": {
+      "ip": "10.42.1.15"
+    },
+    "pve2bmc": {
+      "ip": "10.42.6.2",
+      "mac": "00:25:90:4b:34:e8"
+    },
+    "pve3": {
+      "ip": "10.42.1.16"
+    },
+    "pve3bmc": {
+      "ip": "10.42.6.3",
+      "mac": "00:25:90:4a:dc:2e"
+    },
+    "pve4": {
+      "ip": "10.42.1.17"
+    },
+    "pve4bmc": {
+      "ip": "10.42.6.4",
+      "mac": "00:25:90:4a:d8:2e"
+    }
   }
 }

overlays/default.nix

@@ -30,4 +30,3 @@ final: prev:
     tpmSupport = true;
   };
 }
-// (import ../pkgs { pkgs = prev; })

pkgs/default.nix

@@ -1,36 +1,47 @@
 {
   pkgs,
   system ? pkgs.stdenv.hostPlatform.system,
+  top,
   ...
 }:
 
 let
-  c = pkgs.callPackage;
+  c = pkgs.newScope packages;
+  packages = if system == "x86_64-linux" then (allSys // x86Linux) else allSys;
+  allSys = {
+    #default = iso;
+    #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage;
+    #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
+    aacs = c ./aacs.nix { };
+    adblock_update = c ./adblock_update.nix { };
+    brew = c ./homebrew.nix { };
+    create_ssl = c ./create_ssl.nix { };
+    dockerCompat =
+      pkgs.runCommand "docker-compat"
+        {
+          nativeBuildInputs = [ ];
+        }
+        ''
+          mkdir -p $out/bin
+          ln -s ${pkgs.podman}/bin/podman $out/bin/docker
+        '';
+    gcc-tune = c ./gcc-tune.nix { };
+    #gen-build = c ./gen-build { };
+    hms = c ./hms { };
+    inject-darwin = c ./inject-darwin.nix { };
+    inject = c ./inject.nix { };
+    setup-ssh = c ./setup-ssh { };
+    upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
+    zim-updater = c ./zim/updater.nix { };
+  };
+  x86Linux = {
+    qemu-hook = c ./qemu-hook.nix { };
+    vfio_startup = c ./vfio_startup.nix { };
+    vfio_shutdown = c ./vfio_shutdown.nix { };
+  }
+  // (import ./zim {
+    inherit (top.nixpkgs-lib) lib;
+    inherit pkgs;
+  });
 in
-{
-  #default = iso;
-  #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage;
-  #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
-  aacs = c ./aacs.nix { };
-  adblock_update = c ./adblock_update.nix { };
-  brew = c ./homebrew.nix { };
-  create_ssl = c ./create_ssl.nix { };
-  gcc-tune = c ./gcc-tune.nix { };
-  #gen-build = c ./gen-build { };
-  hms = c ./hms { };
-  inject-darwin = c ./inject-darwin.nix { };
-  inject = c ./inject.nix { };
-  setup-ssh = c ./setup-ssh { };
-  upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
-}
-// (
-  if system == "x86_64-linux" then
-    {
-      qemu-hook = c ./qemu-hook.nix { };
-      vfio_startup = c ./vfio_startup.nix { };
-      vfio_shutdown = c ./vfio_shutdown.nix { };
-      zim = c ./zim.nix { };
-    }
-  else
-    { }
-)
+packages

pkgs/zim/blobs.json

@@ -1,72 +1,88 @@
 {
   "en": {
     "gutenberg": {
-      "name": "gutenberg_en_all_2023-08.zim",
-      "hash": "sha256-wWi0vTyMD/Es0w/jk9uyg4DN94080thPfT5uphEqbUc="
+      "name": "gutenberg_en_all",
+      "version": "2025-11",
+      "hash": "sha256-AWd8jVVKHKssv9AgrJnryn3Wx0084NE/JmorpgPfryg="
     },
     "phet": {
-      "name": "phet_en_all_2025-03.zim",
-      "hash": "sha256-HT/gVNydkOitny6oUl2A+JvbFDGAIeb0h+xbMeQ2Rqs="
+      "name": "phet_en_all",
+      "version": "2026-05",
+      "hash": "sha256-zAAq/X5rjQUiYmjMpBtWP5z3J2ZHJMmIxFKnxLAhOlA="
     },
     "wikibooks": {
-      "name": "wikibooks_en_all_maxi_2025-10.zim",
-      "hash": "sha256-zmcvrvGO+LEHt7x8/SoguBDODUyRXy9x5LUGAkS+fF8="
+      "name": "wikibooks_en_all_maxi",
+      "version": "2026-04",
+      "hash": "sha256-wt7Zr+RkfCsFrOudMCYBADacu6IvPQDkZ6Y0VG2j9hA="
     },
     "wikipedia": {
-      "name": "wikipedia_en_all_maxi_2025-08.zim",
-      "hash": "sha256-r7Cd0vjEb84Ftw+EwZSlqb8qhqm8WA3LAPdHAav7wrg="
+      "name": "wikipedia_en_all_maxi",
+      "version": "2026-02",
+      "hash": "sha256-vwhTv5TtjFNSTl7mcoi8SJiBm8nUlq8rP4UrZYir3Sc="
     },
     "wikisource": {
-      "name": "wikisource_en_all_maxi_2025-11.zim",
-      "hash": "sha256-jPHh/C20PARN6K7aPNw3k9fFHhpwzsREi/1o1DIISS4="
+      "name": "wikisource_en_all_maxi",
+      "version": "2026-05",
+      "hash": "sha256-OA4b+U8mxpcX3fst6hrMyctucYTQOlG/b4qZDiVlcf4="
     },
     "wikiversity": {
-      "name": "wikiversity_en_all_maxi_2025-11.zim",
-      "hash": "sha256-0DaE2EUdHvaX3XqD3f0lwurSAaDZ4hEKtrMEutL5xt0="
+      "name": "wikiversity_en_all_maxi",
+      "version": "2026-05",
+      "hash": "sha256-8mZ1CSUcF4QnDIyN0M2KedQ4pcSUCmzHBlOm93MYpCE="
     },
     "wiktionary": {
-      "name": "wiktionary_en_all_nopic_2025-09.zim",
-      "hash": "sha256-EzrrruJQWY/3pP93WCTeCCfaPvpshqdkR0TFxVz7bEI="
+      "name": "wiktionary_en_all_nopic",
+      "version": "2026-05",
+      "hash": "sha256-Dwiz+viVQt0zb077R9KQRgtUtxG9ixA/DeXAkCdD4rM="
     }
   },
   "fr": {
     "gutenberg": {
-      "name": "gutenberg_fr_all_2025-10.zim",
-      "hash": "sha256-1gU7v//LYX/2LyIRjO02A1fWPQz9Y7Qt5ftgeazd3G8="
+      "name": "gutenberg_fr_all",
+      "version": "2026-01",
+      "hash": "sha256-sGn1TeKwBK0+Er5YOJWq6g0itEm4gIGvKxv/PW0DIao="
     },
     "phet": {
-      "name": "phet_fr_all_2025-03.zim",
-      "hash": "sha256-K56i55WPu5EMQHIrnnqhgJ32WozZ6oYD9X3IBytGA0A="
+      "name": "phet_fr_all",
+      "version": "2026-05",
+      "hash": "sha256-bJmchFnaPcofE/hy3ZcRggMT9osHqXwLbwMLJ+cpF28="
     },
     "wikibooks": {
-      "name": "wikibooks_fr_all_maxi_2025-09.zim",
-      "hash": "sha256-PQSdPbBHwK3IfFPH5GsKaxkNGTlZVJNJEI8gNioBl1U="
+      "name": "wikibooks_fr_all_maxi",
+      "version": "2026-07",
+      "hash": "sha256-csI+E5UFGi42BLGWWHxQhVr5KSihCFc53KGKwo557Ck="
     },
     "wikipedia": {
-      "name": "wikipedia_fr_all_maxi_2025-06.zim",
-      "hash": "sha256-zzDhITMd1nRMYTUlvn56l4VBnpFuhiNrhhYMcrrBuOQ="
+      "name": "wikipedia_fr_all_maxi",
+      "version": "2026-05",
+      "hash": "sha256-YUAbGzYYr+c2RQqGjHIF9XL1kNsxDgRKnHK1H7/PtDE="
     },
     "wikisource": {
-      "name": "wikisource_fr_all_maxi_2025-09.zim",
-      "hash": "sha256-2gEY5nTBecrmg61VJerxO4/oV7dZJmRgzLkqrcocW/0="
+      "name": "wikisource_fr_all_maxi",
+      "version": "2025-09",
+      "hash": "sha256-FdLYCjoT6Yk34AZKFND/NaBHNe+GzW9Ibpd6mVPWlxI="
     },
     "wikiversity": {
-      "name": "wikiversity_fr_all_maxi_2025-09.zim",
-      "hash": "sha256-4vOxYiX3TYht7ARY+PeCJ0ArVZZn9TeGtwCieqn3xUw="
+      "name": "wikiversity_fr_all_maxi",
+      "version": "2026-05",
+      "hash": "sha256-nVDHtkWIOJkoiGixnA1zVR1QS58thjc12FJyagK3Ec0="
     },
     "wiktionary": {
-      "name": "wiktionary_fr_all_nopic_2025-11.zim",
-      "hash": "sha256-oQS8DzKioceCER1p1oAvaS1gRooMLJLYnCqy1aLARi4="
+      "name": "wiktionary_fr_all_nopic",
+      "version": "2026-05",
+      "hash": "sha256-7UXByW2IIL0hec8RPT39jpg5IEGvRMD47hc4Y4vFkJs="
     }
   },
   "ht": {
     "phet": {
-      "name": "phet_ht_all_2025-03.zim",
-      "hash": "sha256-UjC0REJ5d5wIKccutZADX74IxvZuF+CD/caVzZfHg9s="
+      "name": "phet_ht_all",
+      "version": "2026-05",
+      "hash": "sha256-GiJ1jllhioyMYidQ7+Lcbdd9JN2yf04ZQgnO8XaGAqY="
     },
     "wikipedia": {
-      "name": "wikipedia_ht_all_maxi_2025-09.zim",
-      "hash": "sha256-spT7EFXLnI0FWT9Vlvp7QEP0urntmQ2C+fQB5bVLoLE="
+      "name": "wikipedia_ht_all_maxi",
+      "version": "2026-07",
+      "hash": "sha256-InS9cMRaIv9ArlKVwKUypz56m4DgSR7Tl6XpSTMzH+o="
     }
   }
 }

pkgs/zim/default.nix

@@ -0,0 +1,24 @@
+{ pkgs, lib, ... }:
+let
+  zimMetadata = builtins.fromJSON (builtins.readFile ./blobs.json);
+  oneZim =
+    sourceType: info:
+    pkgs.callPackage ./one_zim.nix {
+      inherit sourceType;
+      sourceName = info.name;
+      sourceHash = info.hash;
+      sourceVersion = info.version;
+    };
+  # Preserves structure in the blobs.json file, turning leaves into drvs
+  zimFileDrvs = builtins.mapAttrs (
+    _language: types: (builtins.mapAttrs (sourceType: info: oneZim sourceType info) types)
+  ) zimMetadata;
+  # Flattens leaf drvs into the structure that flake packages expects
+  zimFilePkgs = builtins.listToAttrs (
+    lib.mapAttrsToListRecursiveCond (_path: x: !(x ? "name")) (_path: drv: {
+      inherit (drv) name;
+      value = drv;
+    }) zimFileDrvs
+  );
+in
+zimFilePkgs

pkgs/zim/one_zim.nix

@@ -0,0 +1,33 @@
+{
+  sourceType,
+  sourceName,
+  sourceVersion,
+  sourceHash,
+
+  fetchurl,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  name = "zim-${sourceType}-${sourceName}.zim";
+  version = sourceVersion;
+
+  src = (
+    fetchurl {
+      url = "https://download.kiwix.org/zim/${sourceType}/${sourceName}_${sourceVersion}.zim";
+      hash = sourceHash;
+    }
+    # fetchtorrent {
+    #   inherit (val) hash;
+    #   url = "https://download.kiwix.org/zim/${type}/${val.name}.torrent";
+    #   backend = "transmission";
+    #   postUnpack = "mkdir -p $downloadedDirectory/tmp; mv $downloadedDirectory/*.zim $downloadedDirectory/tmp";
+    # }
+  );
+  phases = [ "installPhase" ];
+  preferLocalBuild = true;
+  installPhase = ''
+    set -x
+    ln -s ${finalAttrs.src} $out
+  '';
+})

pkgs/zim/updater.go

@@ -9,7 +9,7 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
-	"path/filepath"
+	"reflect"
 	"regexp"
 	"sort"
 	"strings"
@@ -17,27 +17,144 @@ import (
 
 const BASE = "https://download.kiwix.org/zim"
 
-func getTypes() []string {
-	return []string{
-		"phet",
-		"wikipedia",
-		"wiktionary",
-		"wikiversity",
-		"wikisource",
-		"wikibooks",
-		"gutenberg",
-		"ted",
+// ///////////////////////////////////////////////////////////////////////////
+// ////////////////  THE BLOB ITSELF /////////////////////////////////////////
+// ///////////////////////////////////////////////////////////////////////////
+type Blobs struct {
+	En    Language `json:"en"`
+	Fr    Language `json:"fr"`
+	Ht    Language `json:"ht"`
+	dirty bool
+}
+
+func (b *Blobs) Populate() {
+	done := make(chan bool)
+	waitFor := 0
+	// Launch self-populating efforts
+	blobType := reflect.Indirect(reflect.ValueOf(b)).Type()
+	for f := range blobType.Fields() {
+		if f.IsExported() {
+			//fmt.Printf("%s:\tBeginning population efforts\n", f.Name)
+			waitFor += 1
+			go reflect.Indirect(reflect.ValueOf(b)).
+				FieldByName(f.Name).
+				Addr().
+				Interface().
+				(*Language).
+				Populate(strings.ToLower(f.Name), done)
+		}
+	}
+	// Wait until all languages are completed
+	for d := range done {
+		waitFor -= 1
+		if waitFor == 0 {
+			fmt.Println("Completed waiting for all languages")
+			close(done)
+			break
+		}
+		b.dirty = b.dirty || d
 	}
 }
 
-func getLanguages() []string {
-	return []string{
-		"ht",
-		"en",
-		"fr",
+/////////////////////////////////////////////////////////////////////////////
+//////////////////////// The Language ///////////////////////////////////////
+/////////////////////////////////////////////////////////////////////////////
+
+type Language struct {
+	Gutenberg   *Zim `json:"gutenberg,omitempty"`
+	Phet        *Zim `json:"phet,omitempty"`
+	Ted         *Zim `json:"ted,omitempty"`
+	Wikibooks   *Zim `json:"wikibooks,omitempty"`
+	Wikipedia   *Zim `json:"wikipedia,omitempty"`
+	Wikisource  *Zim `json:"wikisource,omitempty"`
+	Wikiversity *Zim `json:"wikiversity,omitempty"`
+	Wiktionary  *Zim `json:"wiktionary,omitempty"`
+	dirty       bool
+}
+
+func (l *Language) Populate(code string, done chan bool) {
+	childDone := make(chan bool)
+	waitFor := 0
+	languageType := reflect.Indirect(reflect.ValueOf(l)).Type()
+	l.dirty = false
+	for f := range languageType.Fields() {
+		if f.IsExported() {
+			ptrPtrZim := reflect.Indirect(reflect.ValueOf(l)).
+			    FieldByName(f.Name)
+			if ptrPtrZim.IsValid() && !ptrPtrZim.IsNil() {
+				waitFor += 1
+				go reflect.Indirect(ptrPtrZim).
+				    Addr().
+				    Interface().
+				    (*Zim).
+				    Populate(strings.ToLower(f.Name), code, childDone)
+			} else {
+				// TODO: Figure out how to set a value over the nil pointer
+				// of the field, so we can auto-detect when these are available
+				// in the future
+				// waitFor += 1
+				//z := &Zim{Name: f.Name, Version: "1999-01-01", Hash: ""}
+				//ptrPtrZim.Set(reflect.ValueOf(z))
+				//go z.Populate(strings.ToLower(f.Name), code, childDone)
+			}
+		}
+	}
+	// Wait until children are all done
+	for d := range childDone {
+		waitFor -= 1
+		if waitFor == 0 {
+			close(childDone)
+			break
+		}
+		l.dirty = l.dirty || d
+	}
+
+	//fmt.Printf("%s\tFinished populate\n", code)
+	done <- l.dirty
+}
+
+// ///////////////////////////////////////////////////////////////////////////
+// ////////////////////// A Single Zim ///////////////////////////////////////
+// ///////////////////////////////////////////////////////////////////////////
+type Zim struct {
+	Name    string `json:"name"`
+	Version string `json:"version"`
+	Hash    string `json:"hash"`
+	dirty   bool
+}
+
+func (z *Zim) Populate(category string, language string, done chan bool) {
+	//fmt.Printf("%s:%s\tBeginning populate for\n", language, category)
+	// Look for a possible Zim file
+	links := getLinks(getPage(category))
+	link, err := getName(links, category, language)
+	if err != nil {
+		fmt.Printf("%s:%s\tNo zim found\n", language, category)
+		done <- false
+		return
+	}
+	//fmt.Printf("%s:%s\tFound link: %s\n", category, language, link)
+	// Extract name and version
+	re := regexp.MustCompilePOSIX("^([a-zA-Z_]+)_([0-9-]+)\\.zim$")
+	match := re.FindStringSubmatch(link)
+	if len(match) != 3 {
+		fmt.Printf("%s:%s Matches: %s", language, category, match)
+		os.Exit(1)
+	}
+	// Check if the name and version mismatch
+	if match[1] == z.Name && match[2] == z.Version {
+		fmt.Printf("Skipping existing hash: %s\n", link)
+		done <- false
+	} else {
+		z.Name = match[1]
+		z.Version = match[2]
+		// Fetch the Zim file, if it differs from what we currently have
+		z.UpdateHash(category)
+		done <- true
 	}
 }
 
+// Helper function to fetch the HTML of a given type page
 func getPage(t string) string {
 	page, err := http.Get(fmt.Sprintf("%s/%s/", BASE, t))
 	if err != nil {
@@ -48,6 +165,7 @@ func getPage(t string) string {
 	return string(pageBytes)
 }
 
+// Helper function to parse out all the links from the page
 func getLinks(page string) []string {
 	ret := []string{}
 
@@ -60,6 +178,7 @@ func getLinks(page string) []string {
 	return ret
 }
 
+// Helper function to get the most likely link for this particular entry
 func getName(links []string, t, lang string) (string, error) {
 	candidates := []string{}
 	prefix := fmt.Sprintf("%s_%s_all", t, lang)
@@ -79,43 +198,39 @@ func getName(links []string, t, lang string) (string, error) {
 	}
 }
 
-func getHash(ch chan result, file, category, language string) {
-	// TODO: Only call this if the file doesn't already have a hash
-	// in the existing file
-	fmt.Printf("Fetching hash for %s\n", file)
-	cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s.torrent", BASE, category, file))
+// Helper function to get the hash value from the resulting link
+func (z *Zim) UpdateHash(category string) error {
+	file := fmt.Sprintf("%s_%s.zim", z.Name, z.Version)
+
+	// First fetch the file into our local Nix store
+	fmt.Printf("Fetching hash: %s\n", file)
+	cmd := exec.Command("nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
 	out, err := cmd.Output()
 	if err != nil {
-		fmt.Printf("Error fetching hash for %s (category: %s, language: %s): %v\n", file, category, language, err)
+		fmt.Printf("%s: ERROR fetching hash: %v\n", file, err)
 		if exitErr, ok := err.(*exec.ExitError); ok {
 			fmt.Printf("Command stderr: %s\n", string(exitErr.Stderr))
 		}
-		ch <- result{category, language, ""}
-		return
+		return errors.New("Error fetching file")
 	}
 	hash := strings.TrimSpace(string(out))
-	fmt.Printf("Successfully fetched hash for %s (category: %s, language: %s)\n", file, category, language)
-	ch <- result{category, language, hash}
-}
+	fmt.Printf("%s: Successfully fetched raw hash\n", file)
+	fmt.Printf("%s: Hash is: %s\n", file, hash)
 
-func outputIsValid(o map[string]map[string]Zim) bool {
-	for a := range o {
-		for b := range o[a] {
-			if o[a][b].Hash == "" {
-				return false
-			}
+	// Then, convert the hash to SRI
+	cmd2 := exec.Command("nix", "hash", "convert", "--to", "sri", hash, "--hash-algo", "sha256")
+	out2, err2 := cmd2.Output()
+	if err2 != nil {
+		fmt.Printf("%s: Error converting hash to SRI: %v\n", file, err)
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			fmt.Printf("%s: Command stderr: %s\n", file, string(exitErr.Stderr))
 		}
+		return errors.New("Error fetching file")
 	}
-	return true
-}
-
-type result struct {
-	category, language, hash string
-}
-
-type Zim struct {
-	Name string `json:"name"`
-	Hash string `json:"hash"`
+	z.Hash = strings.TrimSpace(string(out2))
+	z.dirty = true
+	fmt.Printf("%s: Successfully convert hash to SRI: %s", file, out2)
+	return nil
 }
 
 func main() {
@@ -124,90 +239,31 @@ func main() {
 
 	// Determine the output file path
 	var outputPath string
-	if *outputFile != "" {
-		outputPath = *outputFile
-	} else {
-		// Get the directory where updater.go is located
-		execPath, err := os.Executable()
-		if err != nil {
-			// Fallback to current directory if we can't determine executable path
-			outputPath = "blobs.json"
-		} else {
-			dir := filepath.Dir(execPath)
-			outputPath = filepath.Join(dir, "blobs.json")
-		}
-	}
+	outputPath = *outputFile
 
 	fmt.Println("Writing file to ", outputPath)
 
 	// Read existing cache if it exists
-	cached := make(map[string]map[string]Zim)
+	var blobs Blobs
 	if data, err := os.ReadFile(outputPath); err == nil {
-		if err := json.Unmarshal(data, &cached); err != nil {
+		if err := json.Unmarshal(data, &blobs); err != nil {
 			fmt.Printf("Warning: could not parse existing cache file: %v\n", err)
 		} else {
 			fmt.Printf("Loaded existing cache from %s\n", outputPath)
 		}
+	} else {
+		fmt.Printf("Error reading file: %s", err)
+		os.Exit(1)
 	}
+	blobs.Populate()
 
-	output := make(map[string]map[string]Zim)
-	comms := make(chan result)
-	pendingHashes := 0
-
-	for _, t := range getTypes() {
-		page := getPage(t)
-		links := getLinks(page)
-		for _, lang := range getLanguages() {
-			if file, err := getName(links, t, lang); err == nil {
-				if _, ok := output[lang]; !ok {
-					output[lang] = make(map[string]Zim)
-				}
-
-				// Check if this file already exists in cache with same name
-				if cachedLang, ok := cached[lang]; ok {
-					if cachedEntry, ok := cachedLang[t]; ok && cachedEntry.Name == file {
-						// Reuse cached hash
-						fmt.Printf("Using cached hash for %s (category: %s, language: %s)\n", file, t, lang)
-						output[lang][t] = cachedEntry
-						continue
-					}
-				}
-
-				// File is new or name has changed, fetch hash
-				output[lang][t] = Zim{file, ""}
-				pendingHashes++
-				go getHash(comms, file, t, lang)
-			}
-		}
-	}
-
-	// Only wait for results if we actually spawned goroutines
-	if pendingHashes > 0 {
-		hashesReceived := 0
-		for r := range comms {
-			if entry, ok := output[r.language][r.category]; ok {
-				entry.Hash = r.hash
-				output[r.language][r.category] = entry
-			}
-			hashesReceived++
-			if hashesReceived >= pendingHashes {
-				close(comms)
-				break
-			}
-		}
-	}
-
-	// Verify all hashes are present
-	if !outputIsValid(output) {
-		fmt.Println("Warning: Some hashes are missing from the output")
-	}
-	ret, err := json.MarshalIndent(output, "", "  ")
+	ret, err := json.MarshalIndent(&blobs, "", "  ")
 	if err != nil {
 		fmt.Printf("Error marshaling JSON: %v\n", err)
 		os.Exit(1)
 	}
 
-	err = os.WriteFile(outputPath, ret, 0644)
+	err = os.WriteFile(outputPath, []byte(fmt.Sprintf("%s\n", ret)), 0644)
 	if err != nil {
 		fmt.Printf("Error writing to file %s: %v\n", outputPath, err)
 		os.Exit(1)

secrets/acme_password.age

@@ -1,38 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg HqGj+5hXjRLJcrRMC3biBE8K9B/OAJj68gqTqg9ja1k
-K25Z2YGlWnUK02EUQmdNo0QM13apME/mc5w0gydrEDc
--> ssh-ed25519 8UnW5Q Pj4iDE8Q9FhzudZ341W+V2aaWuotfzOZzN18fRnPqh8
-kujFDr1mL/0YrsyoVpWQhkEwwjXr3l3AbbD2787z8zo
--> ssh-ed25519 UFfTmg Ga4FQrnrejoa6uSNDh0VMgB7ntPrp4Z2Ic8n5XCosHM
-cquCWegeBg6Mtv3/t5RAEmh66p6oHBlQvbuJMaZTB6g
--> ssh-ed25519 xNtnoA Mf9EJ6mB79mWBN383e8t/BZQVjB7mXuFKvhyJdT9GA0
-QnnrGVbZIHMDBS4ZZrj8BDwx6deSP10t2kLLzu2ewXs
--> ssh-ed25519 aY2AXA 0Lop9E46qiaGNrFTVbgg0O1yKbqwCFmG9pjssoclMUM
-I5lOVEogB8XV9pkyqmYcFojvZlAX31ADlMyHgDluxjY
--> ssh-ed25519 AQhf1g Ktn1BuWcwx0eJS0ZJugnRiTmvAht6ABOVzTDcw58HlM
-7Vm9rx9P+rXDvrxTQnxxpUBZbvNRgd6UafmzuG0ePwM
--> ssh-ed25519 mOmPfg VhUpDomkduEthbPGMr4bFpLqVcXgn3OrQojPjA+s8k4
-1nrS2JxDSSe6PvPRK9VNBh7RTMiFChSiM3xbCQAQw/4
--> ssh-ed25519 YJiRbw XVylSfHTRne3B5zWru6x+yhAPJEp9Jj27P0Y63Wp2SE
-APDEG5J9tBR1boxpsUBarSC8vN6q34KElRUK98fsQ+0
--> ssh-ed25519 0/WsKg FVXUmVyse3msAkDSkznhcUw5VYd4vwsKd9PCDBJwLiM
-hRIDpMGWWFu127Q/jvxr+ieSM7KQfNagqhUZUnTwJMM
--> ssh-ed25519 Nl/5yA qO4YJ4/gnfbLOdJFyGq1J4AJH5pMTPhR2IvEKMt4IlM
-Dyhj/RQQ3LxgJVc5drDdgw0cAJi1t3zCFnO1zWKaWIw
--> ssh-ed25519 GdLgCQ GyVGc/nK0Zu3/Gm76KRvXHwjdnRvoM+WuY/psFaIv2Y
-1O56ZsNvSBzhcFRPoIOyUCMQCGQYn3w5ES2AfGP75uw
--> ssh-ed25519 tOH/HQ wR3dxHjLSzkHIG/6UX45qiGFqX0cHA18/oEFatBthUc
-J/gpGWp8kOdmtFs9A65B68lsnD68gxfheiOZfp0AeI4
--> ssh-ed25519 FpzvfQ 0sdlOKrumgCJedenPUNY/QSIDmhrP3J077qZxTwvdQE
-DdWxilImsFB/XXgbZNYXEjSCoqmVd0vaTH7rhR73fsw
--> ssh-ed25519 kdPvzQ 9PxMQp7Y4Gh0V2uMa8K6SmldUhcqcBfYgVtMkzzzdAc
-sS8Fqm1p72IPOKNZfJKIJTxTLoNt3MQaOI6w8qYCTRo
--> ssh-ed25519 onmXpg Ig9ABzLLazyW4wxkUmq87XR7hmUt6l5/X0R9Zf2qBlE
-n3DO7o4NdWRefqEkexyIJLeOQ8w1q9QN+wIslQNXIF4
--> ssh-ed25519 CnhD0g wtGoi7CzfIAs8ezcIF7ecjTXshD96xG8ZLlhYYaM6HQ
-4hwG3V1Cf/iYDsNXT0RmzWJnW5kxnBWNvX3ECrP1/oE
--> ssh-ed25519 4ep2UA AKSh5d04251XgyZKKscIJjU7RSpKclMqO5qPTEMQygo
-wSyIxArdlbLafOKmUyrlUqOZQbF1PXZND/PAFYCjClU
---- DnRePhJDkX5QDmrkH5jiZkuljvOFaVm1BrqYMTDP3tg
-\bºîç:ý]3\ô<™rÔhމ׋|ÈFz.R{FEÝá<RòôœÊ'=ðY”­v xˆ˜o½ßÌF
-q
¤lî0¥ä»

secrets/ca/intermediate_key.age

@@ -1,38 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg FccJVul84RKDnR/TVE5Ev6SAi9wi5d3UjyAYNCmncHk
-335MAD56KCN4ZGZSyj65MygHEhvyunxooQEby+tjJJg
--> ssh-ed25519 8UnW5Q lGN+NyMtGXFXkmpBHr6cnioq7ji4RQU6nSEA7IbVLjI
-9CPRIUIBJcY17pomQx4usFpywYYWBcb4DKVS3rrcW8c
--> ssh-ed25519 UFfTmg RsrK6+eHpdGn42Aek2c+sWSqGEPQuPCQ1cltmSNJ1RY
-JLP7SKLeQXx+1EiVBSVb2eyFBC6f7rAmMx6c8MuRUuI
--> ssh-ed25519 xNtnoA HBJnWH8buvy0uN0PWNBHWelQQcQ7sVuwX5PIxnmE71Y
-iPxler8tH9q3xvy/53Lz2wyyBtrQ+nCVZ/qRkK0LXZU
--> ssh-ed25519 aY2AXA RaRgPcFOxKx/BvPt56IEDltUiFF1wxFERpxEmybg6yA
-ewJFmwI+3pTFwPDtPDitrEcK8dogu/4Y5dWIaCCSMWg
--> ssh-ed25519 AQhf1g awiDTZLnt/wxMcz3Snn5rFV3irY0ma/cxYylmFx8uwY
-zOU3skyoRENDxJldzaLjA2WOv24vD41thPSfS9VN9B8
--> ssh-ed25519 mOmPfg 7bx2mIA0YoeyHfY6HccoDJWLCEjz0XQW+C0XZi09bkE
-2H8+g+4+itKcwy4NfOo4rz5gG45FZ4ilqbPnw5p5Jp4
--> ssh-ed25519 YJiRbw H7FN13mZ11Im4R0cJs6Y0qs2xkLLqjEAM+QMUlt1XFI
-xEak37igbuepX8/m5irRyJPUvYz+jMp1XENmsPLg6oU
--> ssh-ed25519 0/WsKg FPuZmZPpjXVooyVhDZoqu7b6sqXXxN/Y3giiWmtfc0I
-rNRSpOubIcbm5V/yOgprZ/D0KqbmBAf47ySfnejK7xo
--> ssh-ed25519 Nl/5yA 9D+4HJ14L5KX2FzGRhltE/pPePUgZSufkA/t+aN3Umo
-jVH3RgVxqNgxu/+8Y/09nUqlUezl0VaYlD6HdqzO5Jg
--> ssh-ed25519 GdLgCQ kpfgJsFC+alhCcXyJzm4qrGO/WzY52PeUfPxBWNQshE
-pDrLxhlC6SZ0HoohQahcIMGf6yE/LX9qjIKvlfenABA
--> ssh-ed25519 tOH/HQ ghzvgNIYF4NUN23+juvWcSF9a33kmMi3b14L1DijlBY
-p2SYIjMzVgMiRUkRidlfme9ZaANLL87phGWtMtvPd24
--> ssh-ed25519 FpzvfQ CdGC9zHx5NTdevkHc0u0GUO/qWR9eoWK5gkqht6SvyA
-hJ2ZqqVISnPfBGt10H0m6d6ZuLglq5qGdZj/lMZxVxg
--> ssh-ed25519 kdPvzQ sFoIh+4wud+wg0XTE/GvDchVyLsnd/QNS0FU5LFjBjU
-RGpXyV247iG28UonB97cE1I0pghwq0eVCoRoRdzxvJI
--> ssh-ed25519 onmXpg 7NX8gGOL8gGli/gIIlItygEh6amLgUCEoNch6PrxyVk
-4Ysx7HznkM7yA3FE4f7rHIQYXTXzSHizT07bo0jCYqI
--> ssh-ed25519 CnhD0g sU3lmlZuRMTCnDxoRfmmZUvZ4AkS0w/D38w3CTKfkQY
-usqUhcEZv/M7nIdPY85LVZLcp7aktiAopF/bvK7xu8I
--> ssh-ed25519 4ep2UA 89XKS2W/kjrFZYLxWmKFpGfwvVo1r8kiRT27vU+Q9Wg
-b04KiZG/ucpSkJ+DFV+JHniYdzOMTKpR8zK/XVkUWGI
---- C+p6CysdP9b8jPInNdYJrbQziDTry08D2okJRVngKMg
-µß±±úªc½ð¸±¸ò¹cÀ>‹Ù·	ÂÂ�f_÷V³{sª¹âÿ
–}EJ^6v<«õ¦è6
�݉=Tk²A€O¬üögŸCËZâÂKê×rw ’ØXP½ég'm~­û`-Ø|çKOƒ�n¸àD%7Ïa~¨¹|Œf�gîÆqËP 
G_£õ|çÕ–n^ñr‚µ�ü<ä°òH°æ¹²»¬-Ìûs]Øc™>}º›8G‡¿BM©Û„‡_¢-Ð q¶M‡�Šî§Þ2hÙñÙ€3nýáásrO< ò¥
-v` ËŠX;ǯ•­n‘e°†<pÜ%š#Ø¥q&¿·â
æ”?€I%�8ê
oŒ8=R¤Çã@P]=U®Hð[ÄÕ7ú …‹% ¡ÏÞôÖÞ5Û¨üm¼»½ö-F�Á‹~±7)è`äÎ*Zo-	@“²ÕþáëÈá	
+-> ssh-ed25519 87huqg 2adw32Tmw7tjm3xy/PxRAukA4BkhHC6xMhP07hgP1R0
+ZxgOS1yxXmJ0fHcz1cRnChxcyby2BrNGcDNKXmJkB0Q
+-> ssh-ed25519 8UnW5Q LSb0iW8mFQp6R1EgpAeqPBnBYTffyQbnuHF4gbG9gwg
+t6KO1HrgctPwz+xooRgAt350MApIQQJkNfYLxFEBF0o
+-> ssh-ed25519 UFfTmg gxk9KLVLlYsX7ipfhxtoeRmU2LA50PsJ92hSUem+Sjk
+0IvqPWsOCUj7ViDWOzf49m+wDnq6ZD5FP2UXB1o43LU
+-> ssh-ed25519 KbVVUw yVOQRLw8aMcoi3Bq8zVisFHYK5Jua5TCsxUdRtqn4AY
+K7EJl3+WbqEmng14SIsDMcBRhO3MADuSD5Vvu4+/1+o
+-> ssh-ed25519 xNtnoA Zyqz/uE56D/KnED9zT5YZkN3fcBt4p9V4s4KItxC+Ag
+6jAtJ00gf+HLAWno+qjXbz+o+vl7BXuRuzJ6RUtKcIQ
+-> ssh-ed25519 aY2AXA yliUQYKNuq/Oo92SbaM9hh0COTZtLp2EES++JFQqaWQ
+ZkZGRr0cGp7JOsExxnq2YFTFETPiVS/dZfozVdeNdAQ
+-> ssh-ed25519 AQhf1g dhzGNjEsT7hhX/K/ta+dJbXI3v2p6IyVXHWaS8nuzz4
+Xab2y3S8AoLgnQNO4SdHx8ioG1DsWRJUfKM3RsmLkjQ
+-> ssh-ed25519 mOmPfg Wb+LA3666buEuwE7S5353mZdU5hkjRlB+zwe7niPCEY
+0+A9g3FFQYT4N8lM0d3KjPOGNlxJ8pKpuvOoTR960Oc
+-> ssh-ed25519 YJiRbw 7VQNPch30Ew5NAHh5Bmbe3JdCq7bTEG/ndCo2PC0Vx4
+TmhQJzu/m7DfLnzsKl7tcIHl0k+TGJ7OasFWgwaF+YA
+-> ssh-ed25519 Nl/5yA Jq1ncqj6vnygwCQeSdYttMmWkikpsQZVm8MpZgGlFwk
+mTz+IK0CYcBlqAJ7/eNYdYchQiyfK+ILAjraJaULGiE
+-> ssh-ed25519 GdLgCQ cRx9RTWXYDqtBDi9MKLVW6wRXjbwk8JZ8IWHwc3Xwww
+4VhHvHBVnKLo/8dqfMORCTEV4pGGvs7QaQjlJi97GTA
+-> ssh-ed25519 tOH/HQ CLzuVJ/C6CXqOHSTAwlHSSnHTQdhtZHOX6JN9DlXC3c
+HmPZ4REBwaJWcRMTyThIZ5ZKz6P167+Qf6gCIdozblw
+-> ssh-ed25519 FpzvfQ jx88nIHu2H8XJky3qAQhTr9wE54D1eZgaR82UrfJFxY
+pWIJCFJWoZq5ivah4Ynlo9ob9hGAkXJT5UyGbV5s0hk
+-> ssh-ed25519 2UotMw EOSb36AGm6JZYAVhCJAr+H77rGKLdMef2GwLRlH1GAI
+1ZaO3t5TAI9t0d7E4X5mSUjAmdqyQenjP65Mr8pITb4
+-> ssh-ed25519 kdPvzQ N0bGzFuEbcSdKk98BManPHjHM3rYrImzI6JdIOUTzho
+DV3TR0f25qcv9GJ5yuq1psKlcioXnwLyAcvXNsFq3Zg
+-> ssh-ed25519 onmXpg rHXkabxqIP99M1SZgwCOx5thK3ibguONh+42sGL5Uk0
+AF+sIC4kvcMMlTmjgsBNFjXnMkgnHI7lfq7tiUWz2zk
+-> ssh-ed25519 CnhD0g YFuDnyk5ML+8kqAZqznPkhrdlebgPO8ncatfLeDNNxY
+cnu39kgkX5CdCy9dmcYKvlQPu5NxqdKkbuoUkKb+FI0
+-> ssh-ed25519 4ep2UA q1lMSlB+P8mgPeHrMnlshDq0ckjAnHQ74Mp+2kwpzXg
+0Lhvb7tvDmLKoFhACmRtWKhSVtCc31IjSENhih5GVEc
+--- FjiOMHh95R2Q8Ft3G/7VUbojHcWC3JXZ+nXBnZ9fSk0
+h6~l|\fhIª¨ðå —,`•�¼5ÐÏ¥²Íkorä¥w˜ÆžqÊ	\vIËû¹woÅ„geÓ¡»J)\+ÅY˜å»±&uP&¹Ã³Ú�êëݪR³ø¸<2™;Ãqþ¬ïtýRƒ¸²«qŸ'E’¢áUëþé)ø›ßµ5]!¸{’o!Ï#ætƒ×mÉu¯5ÝC™ªövÕ�1ÿRéÐ’ýš|óᤅ$ÁP¹”“ëßéË6€åºŽ„B
óÀVéÅù@1LÉgÄð¼À¸‡_ŒƒÒÑ•;³tWý
²yŽ`K
�®®„z(Ç@}Ú?Üå~£¬¢8+¥‹„“7Ül¨Ë2†_^¦n“érˆë¢/¹ÜÀ‡€Êk«¢fMð)áÅ+6Ø)Ù²²ÞØÝÍÙîyë´Ñ ÏRTQ xn
6•ï	Þæ�Ó?-B×ìY�Z“F²~½WÖê'

secrets/dendrite.age

@@ -1,37 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg gv0jzWC7KtVxSEeepOckxiDwxN6VdPzYaXjZryNlUjE
-04mMQsL99xW+VbpELVdnWehgq/3u50l5f98ZFTscSwU
--> ssh-ed25519 8UnW5Q GzZDPqTzZNU5Dun3u7rSane+MXkDcbIM3TlEEJr7cUI
-Dh/3ObCIG56797AvmSh5yrUk+MWqjxJ42/b4i2smnos
--> ssh-ed25519 UFfTmg 7EWxx0WGxxAP2sErB6Rfteg2o1su5n1ELN7oCUsodEQ
-S5x8TAYvjxjtCJgmY4ttCxvoZDdHMxY2RbsAJ7DxfJY
--> ssh-ed25519 xNtnoA 9mPAgc7YI355QYNlTlJWmMhaScCNbCH9EofQcJJDeWk
-QSlYi9COKd5ZjkC7Qxp8IcmmVJifJ1qy70VnExASqBM
--> ssh-ed25519 aY2AXA JUIOcOAjshTPueqEo/GDXWzEubBt1JuMM4NLv89zfTA
-njcVfVgCmT374IdMqke8AWGyGcpCgpu5rGs2zrn/A2Y
--> ssh-ed25519 AQhf1g faN3428QM/K0P7o6nlPxT3lHlx88PBIWxw1mSN07zy8
-6G8FARubsbz7TtQWeQ5biww7XoXZrs0xDFdxKwyov/U
--> ssh-ed25519 mOmPfg b7LviVrLo50sU195qKNxtD6lEqq/QJBnHFkQ3WdKT2g
-USSSrAIA3v3Luzt2Kft6fpMx4fXHAPBtWQVAAliiV2o
--> ssh-ed25519 YJiRbw QjrEHQL9zx6pIR/HzrKyM94JF7efjkMo+ArkVOjkQlU
-MfUl5yYO/LtxrENlcw2KgzyJiLpd/Xk0CbEJicxgG0E
--> ssh-ed25519 0/WsKg ER1PXYwpONwb3U77qUoH2ZDFmfvRQ7SV8lkgHqRJQig
-MCRbKzFD72DdZwoVrV5DesMbNG6ikMlL5C6mTSVGtj8
--> ssh-ed25519 Nl/5yA XKaH3S150ZwHo4uyLwaBrn2od5v6MRvc0bOR83Sz5Ag
-RqQn4/jo122fZA1oujOkwe4gbnGfn5BK8CJXi42NsDM
--> ssh-ed25519 GdLgCQ XVrC/NooMQFg4bSPQ09avkJ2mwROHp8mYbBA7dWjSCs
-Q72VZnjs6Y574eRwheabzTW2GH8A2oEOEyk1Mkh+NzU
--> ssh-ed25519 tOH/HQ b55WhSZiczkXRQQTxAFBeN4HKyi2orpR+ikGiSyaonU
-woTljkdrDmI6iCwUnJ7i1kLdfH3QaZgkxxQ+Upik6/E
--> ssh-ed25519 FpzvfQ +kFO6lyChWKyGs1vN8XmRnp5wNUrOvKGAMtQB5gYJyQ
-xQbRbUfvk9Eoi/JLfzugHeUVbPGfFItkul33A7MVx3Y
--> ssh-ed25519 kdPvzQ dv1xr07TrUQRGwl6jbxMQlocvvYlTmyzyZpbRAU5rg0
-IYO9Af8yAxY5499AArmWCy1aV/ZB3w3deBS4OAHq+LY
--> ssh-ed25519 onmXpg 8cNof6Uwd2MpA3ydHLQHAQvFvl7Kk5moWMRD5qVFxGs
-hTMO0oPxHajokrzMIWB5ksbrVFcpQGo6Jje9FWoiPxE
--> ssh-ed25519 CnhD0g kqhzl+91aQ7CDRrXzrLPo+P5GuEOSF0MGQlfZESPJDA
-64xA1PirxldhnScyJ0njwaOMZ/EgPRm1hQzojJIa+84
--> ssh-ed25519 4ep2UA Zss5olMIbVxEJT8XdrFSrBOppplv8+x5ej3CktSUNDs
-ldPkN2iSBrU8M7WCZx+PlgUhEIZEoUmRWRgRHvG7+Dk
---- emzp8uRGi0GDRt9HS6E6NvmwB7LyI8mWED2Mof9KFrA
-WK 烾ÄÆý;m7…%‘cl4‹8Wáå‡÷'›D} ýœ.x÷l»fGºj�«yàÈI2ˆ~h•YKè‚Ͼ†Ù‡Ńɺ…"VÕ"(HQ>å­EAG€æx1
+-> ssh-ed25519 8UnW5Q MDrURGpcaqY6DVIURK6dJs7xKCGLtFS8+hH0UCRT7G4
+qsqMoWCrssVlJ2kP1cvP9+Fj+c07iFvbFs3Cs+RYVLM
+-> ssh-ed25519 UFfTmg lTHOOV5/G7IPaYWqrAwM9Nb75//N9O1wMDFSUtyo1gI
+kEWctDmQRHNzxMIwONsZo9EEIc/wkPxqX851BO6ohYo
+-> ssh-ed25519 xNtnoA lm6OHoKNa8wB1ML5lA/xl13Xp8WUSF2UY89bP8BZP0E
+iPDWUaoViQ7faVkUf2V1MQxrklAw8lJ2KXfJZTYN2X4
+-> ssh-ed25519 aY2AXA 4E8FsRsfsEKsLNVvBRTAoxghfex8omAQcy8NKzJ17kw
+uzZQp9nVfyVH3dz0UinqZjsZ0Kft7tPVSk1EkE6NvA8
+-> ssh-ed25519 AQhf1g rgcA2UeG0s75kSpok9+VR4ixNyZUqD+8ye1TJsMMA3Q
+rfM5/54WWHrnG1qfex57tGH97lbvKM+J6TGztYOrU+c
+-> ssh-ed25519 r/3ipA 7pNJRvOFO5v2nlMPbXP9oad6jp1pPAsByfiEhdCTAWI
+Vh+iyg2P6fvNWyCS+V4087zRf+pCIBj0jsPX0DtPp0c
+-> ssh-ed25519 mOmPfg 9WuzH4QasTe0NNcIf+XSremq5GuBZoKP+7t4MJNAFA0
+5E1Rbupw8IUnTuicTubXWmwkJ2xVg5K4BpkZCsUj5UU
+-> ssh-ed25519 YJiRbw msPFM69Tuy/luxASGVA8ey77vqtvXNy7ytf2VxQWNi8
+oD5vRs439A/YT5FxkSltl1Qf56NNhiKt17++vlFvwPA
+-> ssh-ed25519 Nl/5yA C3zn641k6eFQePbp2q7dwlIu7Iiw2aU5dmSrH2HCai4
+v1/XJRKIrIgHWfFtSDaFCvOKtcIR84abUZHPjaxP5bw
+-> ssh-ed25519 GdLgCQ ZztOWiw1ao1pvJ9REB/wBuxq00uyO+JAkIWjLUMueSc
+zXSv3MauG2E2el+Yv5oocTgDQjQ1fKXLpm6y2OTyIvw
+-> ssh-ed25519 tOH/HQ /eEgAf2KH1Zgd4yQf+kzyESkvPI8GKJC0MAJl+8+WD4
+H35T+ulGSCrWAuIsZs8ISRJRj2wqpRrOGlaoq9fnN5o
+-> ssh-ed25519 FpzvfQ dRq/NtT/TxJ/k9WlaMl/PrLTvPzkhV8LpF/LxjqjGmM
+LJN8xxnNF3EcMmXKdLhc70b2Y6n9qS3A5wdFXY6hUjw
+-> ssh-ed25519 2UotMw I+kJsu4GAflSfMjzE/8+vp6AZb88OpiCREuxfAnQPis
+hRu7IbLMdc3U+NQo1PDhc+O9uyd/wJZyPtfTv9z9TvI
+-> ssh-ed25519 kdPvzQ uOLSQFzsGSNg1HsiJLCYi2Lp8pasc7H/jhUBlf6b0zg
+KbUOl2WOsc6VuAC33SjEJS3tM3o82A3QO0bA9wd0rbA
+-> ssh-ed25519 onmXpg NKdAvcN3TStWYtQeLW1oEn7+shQuuNBndHaQRAU4f1o
+vCuDnPc3tayIwDbHJneLQNoENyfA6GRpQi6+OZ34Jjc
+-> ssh-ed25519 CnhD0g Co6fy3fm8BUi2qn+xBY1X33N2m40jEM7CJhSQcLokR0
+kwrOzTRiVe1aQH/P+ua3xZNgNRZh2pfQrQl2k2Y727Q
+-> ssh-ed25519 4ep2UA /f1HxU62FqhDJyJ9fPMKiqJdw1m/UjASKuYhY5Aq8D8
+tckIOvPq3Qid9Z5ud2v9syaed/h+3GrackXKZonDYEg
+--- FHj/yA6RDV1VYPsi84z5Y3NrbfVUthwdtuRWqiKC57Q
+Õ=Â7T÷Ü`6¦K./	¾¿àO	Ö¼‰R•Pá€K…2NYqWÖ¹£®ê0v{±µi'¢žÖVûÆ!+‘|ÎÕ0¿ŽšÆ¼ú´Ìi ½†Ä?Q�Žq¢2Ô5ÖÀéŽgÜ/c_

secrets/dendrite_key.age

@@ -1,38 +1,38 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg +F2U3yjndWx1Xb0oDf09pUyd+xljCHWyt9xcT8mjWkM
-PcPUpkFUsc7gnAHZ+lkKqkHf4TWlrbQAjDRTCc2xXxg
--> ssh-ed25519 8UnW5Q Xeq4SvJ6FYT1mIWhBUiNqqAF7aJKbjzRiIYBpnvDRlc
-zG8aAFlLimU0SqnC2z5bDQw2Zm1cW2vvYqnVjMcxNSY
--> ssh-ed25519 UFfTmg 5FIJ9JJPIuMuK7BpVEZBbB0rztiLhu2G3dfRX52pYhs
-sbRMpJTh0ANEVIUUBAgr2i6Hs1cdy8r1wmMPkANE5DM
--> ssh-ed25519 xNtnoA hQ0T/i4bj096xuY0GUYM4N6GhyyFUv/dajBD27SA/wA
-hmV8mKYGOR3WjAkH/mO8ZFyDGe3N6R3ze+dGVh7OGIM
--> ssh-ed25519 aY2AXA QML1/v/gxLxdKa0zzKYPOWIAUVqcG8wRcx0HnM38B0A
-5hC6Si/IV1dmImIkn6SlIkWNRFgjNOmUTC6MjGTE0GA
--> ssh-ed25519 AQhf1g 7h8ZokLoQFV3eUdzzt9qzRhxtP7U8Zl70ds+znsa8yg
-M1WUYlD+1ZzrkiSEQG1CyyViv5Z/gqPEa8j6AGSbyOA
--> ssh-ed25519 mOmPfg xxbhbwb6mdf6q0G6TaXXSt8qN47ruYhDLCMnwYZyMS0
-fnsG3+N8DSQCxUGksvHmWQNdN00I0OO76YlDRFUW+no
--> ssh-ed25519 YJiRbw Og85bpfNOPBZkIeD6qS022hxu/A9AyiS5rAodpblLzU
-qX3irxsnsRO55DCQvzIkxxpQeIhWhfUNjlONJuGmXeY
--> ssh-ed25519 0/WsKg hDApnBntBbGhAJtVGVujL3kJDzFMpOh6zIsIowlJOF0
-wNTOOqR/tnZujRMlt/AqzTscsz46sbf6NSauj6uMunk
--> ssh-ed25519 Nl/5yA O1CBq1B+yjgO5XW4zT1sQHXPX8QioIj1mbyWHDvtiyg
-L/Duen+XqSD+mwe51nZSxT5MIa4nnywvVsq/Jgrujn8
--> ssh-ed25519 GdLgCQ 5Df3/IrcNYYFcSOyuDpHgtaJOtEPVaK++YhiUh1NvXw
-K2Dmj4jajj6Df7zcjquFtTKZvUo3cDwBcCOpBaizv6E
--> ssh-ed25519 tOH/HQ FgS143ErZf0eA7522s0KwCQWz3CSxyMWYo2a0N+bZ1A
-byGgVzxGE9zfbg3aEgm3goeKGKvcgnYu/gmsi3aJZ9U
--> ssh-ed25519 FpzvfQ +PrSsNewNU/exnAS9MD1IzqNar71A/4u89DaZvJCkF8
-FLDdWILk85mpwgQHnzPGltf1Ua2EVKfxhBxgpDhFPZs
--> ssh-ed25519 kdPvzQ Tvto3BbEHZmOhEoRqDySQhVikIK3yn1+uCqoTC7kFxI
-cQBdUfwLrJf/7eRNsXzc3u2McgoOdQC0bfwprg2JJPo
--> ssh-ed25519 onmXpg OHIlO+j2WYPOeNnZiQzH9uHL9ERpgmAXuy1pFF8i00Y
-6x8w3js70/Uk9BJJ62eXjxIkjEMs6hIL6lrnk+YMW+Y
--> ssh-ed25519 CnhD0g EhEsiEqqpUuwmyrE2GIujh7sZf5/v7Ban5Lzx6sFOUY
-t9rI2DwfK8HRkSmGHsWMX+trPekWRRbLWQt/CFqwUCQ
--> ssh-ed25519 4ep2UA DsFQi2CtVrLPUdC4ReFKWIXDFsGoBXGjyFYKSHkGjiY
-M/cGbVkMhKrTkPl5cMV64MyI4tHrhPcW5hgeys3Tphk
---- or7WlSQMXGKm4n9gglHmDGy05/fieyJcU4ytHyqHWeI
-ÑrèM‘IqTd¿oŸ BX.%µ£Òµ�¦ÅvµL>	%â"¯ÆæYxK²ÝÁÁ}s8ñM„9eŸ²NñË
>&£?’“I(\KB~ùù3ØôZ鼃µ$Wıu•±€`‚�€+Ùvˆieâü¼ÀÎÂÀÈ) =®�²99›ú_pHŸñçP×ÅAnOÄÄõc«FÌî½R±ƒ�)Ò_Ûd®ÈÞ(ûÖ%^S’ÊŽï¸õãX@ã,c«ÔKæ�¼ç Tþ§CkúõÆ
-öQˆ8Íp0~RˆÕh±‡ªaïƒlš�¬À)Œ"\LŠ-.©?à±DÄ®)/'W¸®Ô`iþé©´ª@%™UAÏûó[
+-> ssh-ed25519 8UnW5Q 5p80c2oBsZh9KTXU+ZT2AKbbEMOKxlAouHew8KU8kns
+ZvUnyZjn/HYmxHBth7ognoHB9zsUe43Y6c084D4xdHc
+-> ssh-ed25519 UFfTmg 9ol6Gp3stU0jwPzkr9CcLLYftYTr614jBfba226E7xU
+i7CZagRKOmUn2uVmzyuCJQdbtAJoDbJZxpMNDtrH7/M
+-> ssh-ed25519 xNtnoA QZ/CQO4j7T5qC4ohLMEt0i1B8cuMGYgWOAwj6HSPDVs
+Nh30qP0yZcAw2azpFA+Pi6746+kmM5D0fZUYL1uTzmU
+-> ssh-ed25519 aY2AXA C+1SvOQKdrTk3UNOLdiHrK8e88BBztlMqE3Cofm6ZUI
+F26HpuL7HY2nsC72KDgZMbfQ9Hbmvcr/nms/d8cCjro
+-> ssh-ed25519 AQhf1g ZWLSoDJiiQswh4GyhL4P82X03SNSRnDPmZk3w5nyakU
+r6k53tUfB/J6WJuGSmU23frSkcw3jpe76d6vlIfPXcw
+-> ssh-ed25519 r/3ipA cH7gfgcgS8oRx/GKlolPIQ5WzbP+i+xGHfzjqCQ7NwI
+Tv8lSRcUitEx3oWa8hT330K8DYt+PWR2mHetY1rzCPE
+-> ssh-ed25519 mOmPfg sfr1m6QIkqpHLeunlYCc9LjVPC0XqXnH9z75IoSRgCs
+heS/IaQwkt2IQRNcKeNfsAzKGGLEdiUzQxdPll4CRt8
+-> ssh-ed25519 YJiRbw 9oF0E5s2LCHrjFozDq6GbYH8UkzSaPH/4ore75bwe24
+8PHPtU/fDDFkcEPXHAyrp7LBDHwRtTX/u29+jJCzsXQ
+-> ssh-ed25519 Nl/5yA 3xAZWLQ27UtB3kZiEbIBPlkO99ZsAD6k0oOTmXODLT4
+ia6BrKBYSe3BM728ysyBfSjwtQoev/NrTq+Bnp+z7hM
+-> ssh-ed25519 GdLgCQ otupOJf1nJV+w4BlivVEer7x4C1aEU8zIMLmLSlPiyM
+BHv9OTNsxkYBlA2sI3x3cEXjr7GSyVlaQZIGBSua4+s
+-> ssh-ed25519 tOH/HQ UnszNH3sEPqlpEuhJTzYG/gwBE7e4/P2VVRkroceZD0
+L9HBZkhn3zbOIhrkBo3ezvp/Qv8Lc/BzS57npaH+nwQ
+-> ssh-ed25519 FpzvfQ S8QZlLoN2FVpAajpsOqaEPHZGfXAr/k4ZXY8PKEiA28
+hJsIvLf77JG87Gqe0dDq16dsSKSlJZZPGbYrWv1oBlU
+-> ssh-ed25519 2UotMw kRIdExrBlEQToh6itvMGel7UIVDTEIVqb159d1CWmAI
+Bkse9A2smfngBC5WmDmes3ALMvoxeZw3ypvVBxWjWcY
+-> ssh-ed25519 kdPvzQ 4O3g6LMdWv6OiBP5mjZtWa6ERd4s3d1mawlW3ZjajjI
+HqzRVYB5Vko0x2rK1d6DHcAQdla3gsTSyTXcZNeP2c4
+-> ssh-ed25519 onmXpg grxgbmSfJvZ4lNpBOEsVUVnRXNmXe8GybiTg4BhzWBc
+po3Ka11xxQobByCWHvzj4z2MT7AYtoUEvHPkdlVcyPw
+-> ssh-ed25519 CnhD0g hwhHSq2AFrZelQtkfegSSLXbUVAERTH6yoiehI+xbHE
+sGBl0wu73Refzt/k2iM5BFw5rhFiXV+PKO6L4PrDsJE
+-> ssh-ed25519 4ep2UA aNkohdDISDwG6Tuqq9IStUqwIgC0gueGAiCh+gyDsl4
+Kl0AQrVRSfvR8X1zT4ws2paVuZdb+xI4BYFJFMbYmDg
+--- jS9nG8Wyoh+2f66Ew/ebH5LYRt73NIi+WnEJLHAoyTA
+¥¯fŸ
+
ä(‹r¶OîŠërv,¸w\Rx¶€§Â޶ܢÚÇrq9Γ’uŒK•j1ÂàSÚa@“¾|pÔ‰Ãy»ª«³Ga¦ƒúfJÆEDŽ¯•]å, ÉjÎL¿äì¼v3Œ<y(õÛûiH›™x=‡	ú:“‰/Õ`üëÏ™h
{¦ñÑN Á\·Í8ЇiJóêvaT…‹÷ÊÏ'¤4xÁÖ*áÏ+¹À=6{ˆŽù‚OÝKEØ'ýøÈ=Q¦!ÿÊI#.˜{yÚIrà´èêf
/
Ýw��Wª—âꎿè%ÊT£ÿ�9x…#n²:MhÏèÅ–µ~3G=¼øF=;9o,ó

secrets/gitea/oauthSecret.age

@@ -1,37 +1,38 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg iDDZb1/mBldfguf43wN0TSuqOXsEScH+aDZDKrVl9m0
-FSHO4h9Csu9lJqlNpsY3bcDt58eSUxi9ENr365lBvEs
--> ssh-ed25519 8UnW5Q TzreBNEiSrZEVSzdZCzm4J7BP0IJ0U3U+FdINlUvMRw
-X1SKp6T7YVTuqRD9ozJWl9wGLQS2XpL2SsP9JLHdoHo
--> ssh-ed25519 UFfTmg F2LDdqKDkBIHrvcT4lZs7fnpRVH83/Rxnt65ATqVETk
-did174XGfcJQNubK1B7W9F5+ZL4XDQfa7zb+3WXsd1g
--> ssh-ed25519 xNtnoA H/lAt2D/IK8qCWzTDh8hrm54OrO42ETYJIcOqYgF7Uo
-+yOkmOn65o1X5Mv5PiQhAhFDJ/R//6f96i7PslUsNYw
--> ssh-ed25519 aY2AXA N98Z0KfofoC/OOYyEhUnzQNMJIuKQN/n3t34/j7rHDQ
-sL2tca3lYlgrz8BE6cSbWyOL8/p3ocgpR75BmP14tpY
--> ssh-ed25519 AQhf1g w0czfp/ljjiS6a5SU/stgWSw1yIIxgxaEQAQPFUzrjE
-mdVPm1r9VTXvAaGS7Bajg/yiUE4Hv8UMF9dSsTTwEiA
--> ssh-ed25519 mOmPfg oh9DqeeAL5sFTB6baYe5QGcyZOi+/90kIltmTA/bpmE
-jA6K/lAEBjhSdgpoZ+qLlCtS0RpbyOMrETXtuvOxv4s
--> ssh-ed25519 YJiRbw 1dT8jG+xx1GNSISZdT7WAmaP2ltxkMKmPAGCde+ucRM
-gYae0N5DuZRZ4S7KufXlO5K6kC71YTGbEVx4p3oYBT8
--> ssh-ed25519 0/WsKg 5z5D+ckewk4cXzygfGrcPE4e01rDKo2yFU8MFzxjz34
-Su0ZzamKBmyALZ06iU/4fthHnaimTX+MZ7g+SMNCmYg
--> ssh-ed25519 Nl/5yA SpZyA5mzLrtF0TyAUnAf4pplmAda/ZkNP/2mW1VbhEQ
-HcHUXgrdd8MobLl2KonByGUg3xIF3LtJ8dfAjTMeubc
--> ssh-ed25519 GdLgCQ 9ty+jQ1QEmakbYfYRglH3aYRiWDlWVoyoAvr4mhaIhI
-AWurwo3gS/sqFYA2x43uf6bVQMPgIScTl3bO6rBTH2Q
--> ssh-ed25519 tOH/HQ xf9oXzcY8WhHKo0+igVMXftblQEgtsYRiQr2HIBvWDY
-ErehHTChNeBt8QL6LGduelH38xmH6g+EJ3HeLcGKfqI
--> ssh-ed25519 FpzvfQ WwI5B4bhYqUd+kyv/qfsdZF++vPwv0z/VHs1rLgA+EQ
-TbZcSqK++NDFivpCvDbVJsrgh99BlkTtrEaX8N7AyO0
--> ssh-ed25519 kdPvzQ SzDbjtauFcizhjnZfG4QWtU/OuAP6A3zAC5IU1bVgyI
-f6VAcC6ZJ/a/Iqy+nAQcR6QSIOxQ0w9rEV3Dl1AcgSc
--> ssh-ed25519 onmXpg 6N3pFYE/eAfEHSos6DJCqWj98lzh8eKWTX8cKqtr9BQ
-f8q/cHQ3+n49H5VP9/KERqJelasa34FZvBe6Suj0SR4
--> ssh-ed25519 CnhD0g gGrIh8bxCV52xGc83dGIUBvfSwVLW4Vg0iKlc9Gz+nI
-TjgGfOIDKMtha50mPumPHqgaITYRnuEXVfrBGmxzlVI
--> ssh-ed25519 4ep2UA TdsseBn5UGPnXtrChro0wf4IHMrudNTNYKzbRiG3AxE
-USm6bS3A3m8vUO3JY54dcTtODZAdZsJSbAuRD1y5Rt0
---- htoy3HVrfZj0Pfl6qkK8DCj+kARn6O8M/BhkXpLcu1E
-�º~\t¦Ü×a|Ä“ôá	�ׯQʯw(˜ÔÃ.•SeJÜkÔ
‹‹¹Ùâ·ùazµS&Í5Î7*›ÔKèfÌo«KT©5
ų0·Ý�Y˜\Ø£GE2‰Ký
+-> ssh-ed25519 8UnW5Q UlSvWFtyzP1itr1QuvrEQYhvw1oMjOgXyR1H8Geyc30
+m7GOH/FvAh35dmtU8SrQUcHre3QjrHZ/rvbSzq+DJFI
+-> ssh-ed25519 UFfTmg 4ifiDuC+WyaZCJEWLkUogxEFz/3CnwlMbBojSznie1A
+qgeDtFVdt2+WGGlYJL43iIdu3+nmtHZJEh5R1PdwL/g
+-> ssh-ed25519 xNtnoA g73KMG80Xe8DP3ou9YllkmG4f5RtTu70md3WG6XVkzE
+gUylPhlmUwx2y4Ld2ibDFdIQHHPYGkbI9ghT/YBYuME
+-> ssh-ed25519 aY2AXA VHCrb4MI+LIY169KZIOqlRoRHl7qeqeweI5/Q6IFq24
+hA1eiydZmy+A8FtX8kPP9biAzI7SUPRzaJAMvayBXvE
+-> ssh-ed25519 AQhf1g Ht0O8KwIzi4FSjj3Gsx3d6tR9L1VWDssNw4MI0JH0GE
+6xWDy+DXY3etU3QSNs+6nS2vQ/zO6tBUcMKlpyCnWlA
+-> ssh-ed25519 r/3ipA CkosmEHp1uLBUzMTWkQLLT/2HicXU6QNQhbe2hyK3xo
+rHAaWdoqLtK7awKgXixVudFkzvvuJLqW0esFFJRTxOY
+-> ssh-ed25519 mOmPfg z/D9xXbXsI2O4kOtHnaB9uqA7pAB6q2mpNzkQInNxRU
+ELp9idvf6ytjUlwXcwjDskx/nNxWzZBAu3z/35H2raA
+-> ssh-ed25519 YJiRbw PuTysdLGmt/N0K3HirjfBRv1v+rvnfXOl5EOZDyKOWU
+XQitNgPuduUQ0/kYD2oKgDaDAkM+eUsRDtJimxulE2E
+-> ssh-ed25519 Nl/5yA F8xymke/81LlgOQq4IZtpUL8zAYIZLDU7/hYPbDW+UQ
+BL5pks4vXzbM2Obzmb3vEUdYe/dEP5cm6490o1MjpMY
+-> ssh-ed25519 GdLgCQ J7fDZ4MEt/A8jhfCM8Qq2++v/bwhpSvykKefrp0R2Dk
+E8BrcouvDsBTcAITuhUyENKTR2U3SlyUFgHThBkZ5NU
+-> ssh-ed25519 tOH/HQ 5pbs0Qpugt2Z4GnERpgG7V1E+u/PqQZ8jmdhxiGAKmY
+B6HXWpicDrESt1NcCrpjTTmWla11zRGInKpe5EqRKK8
+-> ssh-ed25519 FpzvfQ ErKw/iWsCByk10H1SRr0771IsOF5kuKZYYynOI4NIhk
+DXo1XN6lRhGcbZ0wOn4FKK+k3Qx8jp5jY2GYJ+5S/Oo
+-> ssh-ed25519 2UotMw JvfWHcMKFS/FNr6dpLso8xDEmtKrd+bf6W4FSU+9vys
+MSHnO/7jZUAo/7FKWOYzaRWbLAC1Sn7JfSyN0Shoo7U
+-> ssh-ed25519 kdPvzQ TqAXhvp06kZR6czrD0ZKWRlyqU6kUYoZfP8gakziS2U
+ad0/vG0CRQ7sHiHvzedRAkdWarR+vHfgPMAjvXHBk7M
+-> ssh-ed25519 onmXpg ndkl5ubOnF20q+1Cd5d8b5Zy6KZ88EjWlmhGzy8+70c
+18mzoHrH0VHlDfia5ch2+pLy/EA6PejcVEkV1+cWQnI
+-> ssh-ed25519 CnhD0g JJ20jASeobaaiVJvg2m/JYp57UeCs9P0ddDJbE0I5E4
+uxGbgcL7CA+Gk8p0jRtc/1uXMM6fflOJKKvCCscsYMw
+-> ssh-ed25519 4ep2UA Gt5+6tALjGgyLYln/5GME6/cyX6zBIIoKEbfU3k5XVo
+8+jhXYNZqIGP9gxYPTEUAeclc2yOoi1iPc0Wlsb2Fw4
+--- C93ywGKoxGqj+uUh7M8VrRr9+6/sl4jbUWvIUlwOack
+8ÕXÛêÐÞQŸà
¡•$Œ“¬G¹„Ön.
+2sÏÞ›n®ê®‘&­›XÙßü«?‡!Ñþ`g7Ó§DÕ‘ôëMìÓæŽi‹ÍŒáé±è*ú 

secrets/gitea/webhookSecret.age

@@ -1,38 +1,38 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg iCgUGB5ce7TRS5Cm7+ROuxs4Rc4LXGsIEFFRd3Is+DQ
-95deqc2X7cXJOkBAJOu6mdk/gf4g0mOV41vWupQmRIo
--> ssh-ed25519 8UnW5Q QTtK5n/dtnm5JzzeNrxh1JmvnVQMgu2Wz1G6MAq3LCk
-WAIkKpMJLYMATfHCyj0AJVzTPnAlMGqqirn83NLXVeY
--> ssh-ed25519 UFfTmg t+Deer+hgn2+45pkjuzW+hzJRocLdTSwZpbVRSrSeHA
-2Gb9IEKRPmSwE/lWS/lwQszl+y2YsiO7wIv21h2wXnw
--> ssh-ed25519 xNtnoA 4pov/sXP+HqiW3T6/kmOtOPlsmUGEScRRTq/ajvVGV4
-eVXJAcNQ5JoFC9lZF8vtmLfGUiUqWUouvQSaMFpYGS0
--> ssh-ed25519 aY2AXA FPATcHTZrjb709XkHJp6iqYQYtr0DECYHQiqM1jH71g
-cLK2Fm7oDL6L2BBH5Gnoy3pn3bEJIIoAczYefN6+Dk4
--> ssh-ed25519 AQhf1g XQfu4fJWgrdr7rm1kWVGq44wWTMa2ihE1XDi3etugxI
-4utpAuup+QisLRX62TiwjzkDxWRQ1OCX6JAdVXRTC8w
--> ssh-ed25519 mOmPfg DkI63znwJU3S1gjsSu++DZwV6ESAJ2gOroj2JgEToUI
-9gxNErI/wYffYOno/1s5tTDj8qrFOUOfM2BHR/p8am4
--> ssh-ed25519 YJiRbw X2PJfMTDs6kQ+pecTkVATjtm5kzGNs0hKuM01GqzBVw
-pp5IZxmsNI8DaYyETCPz72BHdamsmT9e/0HH6M59kOA
--> ssh-ed25519 0/WsKg sYiDJlriTlNsDiE/pJx62UVmaiuB4TLuhMJ034PKUgA
-jv7IHgZBEBSslBfN0AbiEc7BzFAogvLLzt2zLD3IlRs
--> ssh-ed25519 Nl/5yA kFZMA1SVQI2X5S2aXjnQMFZ2C/meQxb5Lte56Cgq5D0
-FtlS4Y2cEkLuMJ8WNSh93S9GougZaIQrx+mFht2VKg4
--> ssh-ed25519 GdLgCQ pe/bkOigydEzsrqu+Oq5YIHT0T09VZwSYEEMPEwTTVw
-iqSeqHCuJ1Nz9cylReoHpHZGKIiX+eCRK5K4x3Lm5XU
--> ssh-ed25519 tOH/HQ HY+keQnvJe7RsG9/fCNKwgEpOvSg7WsmkI5KUwaMvn8
-YiJNm2UHF9xOlmU8JR5qL+/IhmVOmRx/ZvRYLky+baU
--> ssh-ed25519 FpzvfQ OJUnmvwDnsLGdlXFuhWvpR4GAUBG8OHHNIAHPOLi+Ao
-ADIq39poY1hwe9OqvwMvwy/yuXTZsgdWfwRfTEUgJDk
--> ssh-ed25519 kdPvzQ W8njxBXDY6IAzwpduheN8oCQo9WBUuFCwPB15wbLDiM
-wKeT83JqP4OqzDWzAZXfOnQouuMSMgHZyHvD0EgQNNk
--> ssh-ed25519 onmXpg k3DbEOOt17SYDvExM+3CpBAfepCPKAYz//4xHEkGSi0
-kmn3tBnfmzRcNCn/bsWM5hTlgymBE+gVwn70UTOmztM
--> ssh-ed25519 CnhD0g jCWQ/TzgDBXzQGVa7y+OFGamymNFQGYGRLEi6vYyJy0
-49hU8S/thJ56pQrT8pYN16FSMN589CYeTFumVuXYze8
--> ssh-ed25519 4ep2UA fY4fefeCcrRv90sudPnyQ2k9EKeoYOIKCjzd5n+B5wU
-IYs/RtzBzDQVSffyWk3FxR2NbRTOthtZRCoxik0H0Z0
---- 5XoWoRuBZkC+4WE1lzTwVlwj2XoFOfB/fEmzRWb0+MY
-+]ÇÉyw aÚ»Ke¡üq9o m^x¶Aüíù˜Ó
-q‘ù¿)0&ìO}§V“\4jÌþ-êu;z“3ïû+ˆ|P\j
ÿ
fŸ»9—l
+-> ssh-ed25519 8UnW5Q FRrvjiuNlnu4/DkwfY2K5p3MdQ5bDF3+u+JKrYiHzGw
+9dGLw4PT4OapoTW2GnoJ85GEWgO3Aepj7hl0LpPZylk
+-> ssh-ed25519 UFfTmg uMTPiCPPoVqt/3SOr+y5oKGTxpFq2UNGrwaRVmnZT1Q
+Rn7dRYCGZwYN7sCmAsne6kAuKmD6CFlGXR130ELiJCA
+-> ssh-ed25519 xNtnoA FW0dLFehc2yVvpxIDEcVWD1zHspZuvwrn2qgYltdp1Y
+1zYm+LF/8lvfEhQVr4cbyDF5CfhPu/fNBYZMQLtTrqw
+-> ssh-ed25519 aY2AXA aNRD8OIqKluKhHQZCGkW+kS71vlU2N8K6k590eLO7HM
+PZHX6fqbX0U+55MtJ2iSur7TSHFEgQBiAgpXiGlHbuU
+-> ssh-ed25519 AQhf1g cIhfdle1UsPx86LETXhB46evMenWtypO4GmL2/oLbXs
+ezwVMUSz5KbBymwnZlKuLD7RbNBJigfkb4sOpHAAnBk
+-> ssh-ed25519 r/3ipA Gt94r1I1CUMKrGQKBVgq/FLlOa7V3weD6N1rv/dVIV0
+UsBIZfHiU17IjzhcKc1kvSEIMIk7I/DizSdBGhXNwqA
+-> ssh-ed25519 mOmPfg b3/Gwqh1kik/AuBzcpqsuSuFcK0Pko3hRu32wFB/yks
+X9AXKVJ3d0IV7wkV2ZibScIV9En9uJNyUIPIk7WFKb0
+-> ssh-ed25519 YJiRbw yDkwCFtGXgS18DwqMCBied8+Jt8u2GBWuFQSrajij1s
+eSeFTNbeOT/tDb9iQo/YzThtQeMgNYmEK61o8hjG43k
+-> ssh-ed25519 Nl/5yA ee68eLzrRi35az65YmfA/WF9VliRmnlPEbGQAet91nw
+2KdTnyBTyJu8q03eH5s4oRyvhTQ6f/qvwrLabvk3C3o
+-> ssh-ed25519 GdLgCQ DAlJqI0uIBSrFpPMfl4FkrpjCO5qkzvJU/PBOWFh+XQ
+S5tkvMrTrYbOK3U3wWxLn3MuJTfrP8vUIYe6nBpixQo
+-> ssh-ed25519 tOH/HQ zQMhFkG/vkqosDn3VvzuKt4xagkUWoqE/DW6AsYtBGE
+MGQA/Jxv/YTny5CyqfQBorfwIUVPZFf/hAcUTFrX9vk
+-> ssh-ed25519 FpzvfQ d4cgnsFfo5xGDUFyT65HJ6S6vtzLmvB0eugwq6t0nGg
+0hEFjipS1Jbp6xycUsZYHzcjQVJ22JlGMUsjPCkDfbI
+-> ssh-ed25519 2UotMw C8ukSysPTKrwKCVnqjBzspXLLyJyhn2YCHcr1n0ulRg
+NErsgu49C3ElHmpsz4q+zR/0Oj+9jBPnC0BErB/48Fc
+-> ssh-ed25519 kdPvzQ oreOkf0nFgkgm5KuEjP28nbbqRZTA/b+bj7SSBmAslc
+OrQ99MlWePEk5IVeoC/X4UYLhK10oTLFrS4KqzoVOE0
+-> ssh-ed25519 onmXpg v8MQUHZj5sSu2XqiUH+8wcvEJmrGWQqs0e9evQKkzHw
+ffZTIoH8stR+ZLhoz8GjvGG61xVbv4+VkHbd25Jyc/w
+-> ssh-ed25519 CnhD0g Ja9KftQBH93zJAl8nOMQZXHbXIFIs9W4UqXwYr9gdDI
+StRE03gMP6QQ+fCuhE1Q5ptCpBrUxrWINgCrWzwSqxo
+-> ssh-ed25519 4ep2UA fbcuNM4FWkTOVSNSJGAwncdkjLN1K2Uv3dxFsnC60VU
+uVbHhoO/IXfakiYFJ4yrtReK9uvYLsj4BTILRBqbRgk
+--- dYPR49CT7omcJ7jDRNUAoc4t7az/pEg00aqPF00OlA4
+„Ï¿Ÿ ðç(C›Ø
+I'ð^¿mc¶bßH…¹«Cû�K
0ýĉwé¯;lú¿P<üH㛬õI¿{àÈ|øª·ý Páy(Oì«81åÐß

secrets/gitea/workerPassword.age

@@ -1,38 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg A6H5BG0J9CcPatDKkraXHy+RSdgxtEH/jAaBMJrOT3o
-67qMA+bupmSdVl3n/Htt0F2DbCjoaHXazrFz5DQNqUQ
--> ssh-ed25519 8UnW5Q rw5VvXm+g+clTmHSEruaUhZBxCjtdEoFxZtnDNH3kEQ
-uyHJMFUC164ggrAoU19kHisWRLxuKke73a5aYArSwCk
--> ssh-ed25519 UFfTmg Yby4BvS1V+Rh75Y3blU6c94G4pzrc2B1AiXkz/GdHXs
-Q9J5HrXkuPmpEh8s28Sx+lM0sR+soekQ22g7ri9eu6w
--> ssh-ed25519 xNtnoA zUICmSlbcLHf8fUW2yZMqwtVVoM62K3X8iq32DNVpR0
-FawGMjW+sjkYZFGOvXft2Is/1Y4eCBq0IZxVaq06rO4
--> ssh-ed25519 aY2AXA 1gQtbMWqdwlaH7vUBMukz61J3vuF8FR+xSxHaY6ON2k
-aocdKBkmsZ3J45Fyy1jFovWW8Rh9tQL+AvWBH5C3dW8
--> ssh-ed25519 AQhf1g u9qN6jmuYK4KtkBFhOcIzxbpFCY1EkqMCYIYx6q/P08
-KtvwX3NN6HMc5lOMphqddXEjhuK4rUrFJ3nO8TJxJTg
--> ssh-ed25519 mOmPfg oB/4Gy5dWL7EJLwIDLMr4+K2oUlgUIWBy/g7Yx8QyyM
-ZfIjUqOell70m8FJYSNKaLweU+jXtNXafeZ0mktVkac
--> ssh-ed25519 YJiRbw 53FFjal/MjaqaVT3rNqNlmKVKc/P+lp64gW++C4GkxY
-Tu19fCXb/JMXuPqya6GNf1E45c6CmvAe51yFoSiXHMU
--> ssh-ed25519 0/WsKg TrIDepX4dHixH4AwWaOnwjcHO9RVAqlqwBdr5MlQlmE
-MWUCyLN0YWVXg7VD7vvSYTGdmzm/TBx9fHHffb5OjWU
--> ssh-ed25519 Nl/5yA aRu6l7Vib4imh9LqQKhoTA33KF5siMIlmK5DktnKJDc
-qJeB4YB9Sdm+9NTBwueFLCnbhdi4N6O+ELTVGbJDvz8
--> ssh-ed25519 GdLgCQ f93Q/At6T7Vt827F7ytV1bxZEOLtLZFUavsIaeW3agg
-xoChxHLnyEQs1T5ZnuotnwyyMZlZh4PJceOX+tmHAiI
--> ssh-ed25519 tOH/HQ jFZTM/OQpLUXZT4ENX+1Qq9iVJXXpEY+rfLpXJvM5Dk
-f3ZC7CbikEQpBwZcqYfhBIws4up3ZmMk/2mOS/Rf2vg
--> ssh-ed25519 FpzvfQ rxuFxwpguxrqUBe10asuNe33Xg6Ebdoh9oNZdz3fqCo
-MfEGIDV2nsX/MhUFEQDbLsWywFLHrk65gbbMVVPdJ/0
--> ssh-ed25519 kdPvzQ SdjtFcZ2kzuBSDOF/I6m+e/R/sJdf1gst9AYOpefDVw
-G0+6qeS8QKHvWKbZjOv6+6lR324OVdAo31kTZJ1baC0
--> ssh-ed25519 onmXpg x3F8aAlT9ndzfeWqiOz6HX0Zs9kNIP4sW7mE+caJQmg
-bz+YEEnu/ETBhqBTZiLRyVnSX1SRJkfWSmrEx2Tzqgc
--> ssh-ed25519 CnhD0g fNddA6YIHeuKUVFaAkwU9f/rSfYzQXPuw7QbhQD4YFQ
-4Vq9uwumfzpgMxtvmxt73EPkkqrhS2qApaJZoQwUEDM
--> ssh-ed25519 4ep2UA MslFSRrk0185JfNOhRYkJH+GMtKIg4gEcsdsT6CBAX4
-Ta+Wz13G2NOcdJ7qxZHqBYiDz9fU+ax++BTPSEi6ZVQ
---- E31e3DZgEDqDTnYzMI/Pbh1pyQT16bWTzYz3XZY0LsI
-\™l—`]yɺâ
Y-‰g£‰
-E»ÊÓ~oÜEåŽÍÓGo«	ø/ܧ
Xg<.O�º €<ƒúÙ °Øû¢ƒC½cûÎðô©UËB(
+-> ssh-ed25519 8UnW5Q mCwgPdwCWzi8QXME7vc1nncnCjUdhXJfHgz5CI2ppWI
+rnBpIQ9WYgFs65Rh4eMICoesrg76o46AjmtY9fTbCl4
+-> ssh-ed25519 UFfTmg EW1P9WRcH6esoNH098Vj4E+udGzKWYw+HkxaHcRpF3M
+t3AsT1kOCeDbpYotmYAFQA5/k0NA9KJ+R1DRnbLX63c
+-> ssh-ed25519 xNtnoA shOVkNxHyvKcLRYAAIW1C6UPAGiwxZl0Y7i73DkA3j0
+MgFo9Gy+24rWvIkqQKDogakf4q1nE+MTdmXg2nYMNR0
+-> ssh-ed25519 aY2AXA dXi7BYpOVSGbbxI5KOQkElq0GQj3vmbU8AA9rzqGIE0
+GlpXrUk11XX6zirXrTK3uIhLBwlTKwn4/cyCWjPBVTE
+-> ssh-ed25519 AQhf1g qV41Qx3onxW0Z91xCiUwse51OoEU7tBAi9t6MrwF8Fw
+rFXGO8JG1HE916LMS8xMLACVqHuQzP/SAgM5Ngi9tLQ
+-> ssh-ed25519 r/3ipA u1cHvRRt6JrScsmCY6PtybjU80VuU7NuRwtBW+Omc28
+ztXCVbWHTMBY/x6dDdSSPQmTWfLCGNG7xkYBtupKRQ0
+-> ssh-ed25519 mOmPfg jCT547k33Dxx8nTS/WVe+Peo1eViKVSjLumucXempBc
+X2SCtafedtleUTQoYtKN/85uUnWS3kuY9Bb90xHXXBM
+-> ssh-ed25519 YJiRbw j16MQ20JnMktKiREpNRx5qed8jXXKCAq+8b5AvkW0gM
+KovMsW55OvGyjSJuAN5M0Ga7ln0TOQoQEQKvCkODJJs
+-> ssh-ed25519 Nl/5yA oYGAT0greb0CHjptVKt1vPBhBX1KXsJAVlU4WoV0vjo
+SI4ZXY4pHqYEn2AKEX7MpcYT71LsVUGiZQd0LmwGywY
+-> ssh-ed25519 GdLgCQ rEB3gHJ+MovVDQsQd3X4pGI03itwoUGeHg7aCQ9oUms
+mAVXvwQqslqP4sm7uG9LXfNvD0XtnaB5W37esGyRsgU
+-> ssh-ed25519 tOH/HQ XPExYlY9j8DKCZwviAAgSvJ2+xpx3lUBsktfMPwo8U4
+v2PV6wtTTQINJ2XfCcA/0OpNkOHr4AER3lG73CJL7J8
+-> ssh-ed25519 FpzvfQ RRpPZ5GIdzvRimAXe1ybhxs+lV+SSigyyvEn3qmkOUg
+z7QV/M3zO3tnOO3XiabL62w7Uphs9OxARpGbND1tm1I
+-> ssh-ed25519 2UotMw JfTnR9wed+1B9Hung4FdV3Zvx8eQ+lrweFiFrhX8B2g
+k2KYxpsSoTBaHuXCCl5fBgn/jyi4KDKvg2QShU0Awpc
+-> ssh-ed25519 kdPvzQ GrUGPXTVNTMafGGfn2xA5pTIBEnEfSKmDtQ+W/QYpUU
+eDNGzwGWhnZ2kLXzDLVWJNvl6F6vZBTFZ16zrh87bxY
+-> ssh-ed25519 onmXpg LiArSCT2VCCbEE02Q9n6fsWP1VtYL7OcahnM7CJyywU
+LUKTMk2IAFpg7mPpHjBBw8NbpbgpDGnH9FCvjuF9qBw
+-> ssh-ed25519 CnhD0g H2M/9h954AS4ROeJFDfOpwU2DsACwQ/20OdGVaeGxxE
+tSMsZUT079DdPhW1yvFbk4DBlNd6Lvhk4SAarFjYfpY
+-> ssh-ed25519 4ep2UA /FZ8+q7M90Iug7/qUkpmyL3uhUz2WTBSoc2O719JhBs
+y0dpaERxrnygXbDhp6v/rIZsoKx7kv/aQI667jt+/t8
+--- K04yLmYsJIXBing2v+tijM5K1vOLQy0hWu7TItk3xCM
+‡t	�Hëw’÷ìgn$c\ÑØG>T¤bÃ,z¿ì|~u§Dhs±KP©íÜ0c‹ªŒ–÷ÙþÔ{™­w`ZªPODmüxOägƒ+FäCH

secrets/grafana-secret-key.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg X/WiWcKfKUrySxBYaS50hMWmFCIkZZo85Oa5mS0H2gU
-TTPstszz10pk4Q7/BZ4vmxl7EJqlWLWuIAj78CYw6gA
--> ssh-ed25519 8UnW5Q l6Y2VjFtX3BQzFSMoat05G8PWvoMUs20YxEfNgiqODU
-7jRxwa2ot+RjEncbSasPA0QyN5rJ/9KcBlFeJSrCUzY
--> ssh-ed25519 UFfTmg 5VEvpZVQuVGctJ++fiBCOFNxfep9HPou/b1RDmerfA4
-5tw66zAndyRzCXiR75hQQFL2BwWfPvnbm/YfdbKUdLI
--> ssh-ed25519 xNtnoA lDnNKjP+4LmC69L+lS7ItKXlL6iHbI+z0+S208TdJks
-HViAVNAqUpcJah4gQzfAAlpfe4CvlRDkKyKyAHN+sJQ
--> ssh-ed25519 aY2AXA 0m5snhqLLevXntHbcLbXeZPYleCGrj5GmMGYw7o/1AY
-X6p3+DCLURhShWemK8t6hqZaByAvbqsuYNqQ0cJ7Fs0
--> ssh-ed25519 AQhf1g kkNoHO53xVmTj8qwbz9VECJ7jVyZCgqgLDvoOZP9mmA
-/ZZA3Uhz0W3mtY4/4G/HVF4gz2MtsL8C4Mz2OcnPysE
--> ssh-ed25519 mOmPfg EdeLqgc0EvGowYkuF4436C8o+4we2FnlaxfPqd9mbDU
-cQooIOjuGT/i/QbV4lYIP8QxWxtX49mZJpBlrtRJftw
--> ssh-ed25519 YJiRbw I6Wk+Bq9U9yMw0fSHG+vjxXQ6vyeIoqv2Dw4LS1EFj0
-Jvt0gujTYp5kYGew3TwN8uuqRfZH+KyWyXajMhHfb5Q
--> ssh-ed25519 0/WsKg 2mO7BzVlAlHIsq6PjnsXPlDeX5GTJ7h3LxOqnYMi4X4
-Opxp2EZgTrV3/SNlRXcU432eIz9EZMuZIkfwzUuqHb8
--> ssh-ed25519 Nl/5yA ZTXjKkQqcAr0qgUPoPmjFeBBkwTkxdpsQUNAYZ3Fih0
-ekZbDidS5UHhvfSqPqUlgfgFz4u8bdDx4IPFWj6YI3Y
--> ssh-ed25519 GdLgCQ HSzv8LUC0hX+pN4jKsTcGekrG1jVO+l4yf8HIT5o7Qs
-HRWZikq9o1/3BfUmYhAQtYjo72lWPeHTCcJejR+KehM
--> ssh-ed25519 tOH/HQ X5ovKDga8yPDrstzgB2AQHCmIoyLKmR9fFWMI7OoBTA
-Hn9l2qk/nYeZVxv/3pE65jMe5gBCSHolHMgKgqZcl8M
--> ssh-ed25519 FpzvfQ oXPL8Xv/KKZpyhEsCDBoBe3e1SUrdBweqbrO3zX8AwA
-UODBP2UzgHPSbtBMwIfZlK7QgEYT15BOD6zVhZfUby4
--> ssh-ed25519 kdPvzQ xdXBsTF/bhyUwerBh0M0jTMXiB2jlvqbaLOGXlerMQg
-rErtHvD21aB7AuHOVTjdFq08xn5BSYxGyyd41F9nNcE
--> ssh-ed25519 onmXpg /TJ0Lk+CyArYKZZO7UHqJExiTiCYwHSK0YphGXyzBnw
-1GiYuhSSIieuCVOGYNHZyNEoJlykokHG/7cHQbfpy88
--> ssh-ed25519 CnhD0g /siurjKr3wuF8aPFnS9tKTbzuBIYjV7HehUQt3L1QjU
-JHXhMGkLcUo+jxtsxM8TMei7hXcappY1AKbCGT2v73U
--> ssh-ed25519 4ep2UA UAgBtNaV/A5RAEze4X2zky5s+TgHIQ5ufHCx8neJZC8
-evGC3PCZxfIrmWj0ERxO+AVFZyQuharOLYxzLkt2NsU
---- XEXFLANMMaS8UXRrZh3crxuY68pP3pH+BEEDP+G/hYE
-{Qá*+ŽloÞø�yâoXV
tÔt`£ÓFcO¹ìSCÓ½
ôšêÀMíù÷ˆ'’ö3ˆVý›hŒÃøô±p&‚FYínª«¼ßzö”¬%¡¿¤·šÈ%Sa¶˜;
v�dÎ8Þ
+-> ssh-ed25519 8UnW5Q CqKPHehQL2BnMddbuQneUdwqNiUP7R5tJd6T6ziapzs
+RusP1Hx9OPTlwxDo+wUZMIN0uUkBvRHABx1YBtWX458
+-> ssh-ed25519 UFfTmg JUmMJZQepN/3eH7tm3xg0rPdcX2lKnKLnXz0BdTsQWc
+BWuon+vqjGb0FzRBLrF47zz+fCXrEm4Q7Rn145hGtaM
+-> ssh-ed25519 xNtnoA hA890A2iPMkKNVRpeoLD9f1ra7bTIyooNk8HxKihpEs
+Fhs8yKdEQBBnPKK71petL/buoQ/u5qQu9QUzPQk9kEE
+-> ssh-ed25519 aY2AXA Xh3Q/V4hhIzEWA/nyzm2cJl4Gc1CEjaGPzNkHsu5tTE
+epgPCd650QcZklIEvA2N+Fo2092nridRmOznqyhjEYo
+-> ssh-ed25519 AQhf1g SfFv871Bk8fNlYwaCdUGqX6CFHzx9yRh7CuVsDmQL3c
+E2iXIVWGaxBUpskndz2JzaxqpSPe+oHG7GoRCGy56ic
+-> ssh-ed25519 r/3ipA 3xGxebUpT7Pzy44AmTGKHARM6E4qMzWJftnYWrUtik0
+GZLGvM+p8Frm1xnW+KtvD4RDN6+NB/v9qSg+O9skLQY
+-> ssh-ed25519 mOmPfg jQSfjwVwDV5bPch7RxZen9ZgwkI4IgQ5L5uW+8HQm2E
+/+UkOQMpEwZClSiDYGNbRNO5C9IaNhABtzHAeFIu0WI
+-> ssh-ed25519 YJiRbw KV4Z8+jYtQ3WLijaT2ZsKwMsTXkRJt7bNSPZEj4xPkc
+i66H3Li7nT8FcTwrEnKhEhKjEW1uJcQ4GuZHYk38bI8
+-> ssh-ed25519 Nl/5yA p/qQ9BaVRLvRbKStTBCaH8Ntq7zi74JzmIDFTAFOgAI
+iTWXq8Ku1VHTn12P8zsoj4SnWvM63AKjt488t1R/cWQ
+-> ssh-ed25519 GdLgCQ 0ZOAYbrOH78UxqWRcOgNj0oRn8/AGFslaYSJ5PRUbAw
+xZCujxWQPdATjVRk1H9L0gNZ+ckXLh4yC3ceIW1Ml70
+-> ssh-ed25519 tOH/HQ J+0byujDRE/R+PoQliD1cibDyY5RY5Qn8OqNE+V4phM
+mtg7BbrYgCbhPmjr/O6xbh0js31eCxwoKqKsg5fgkB0
+-> ssh-ed25519 FpzvfQ 7P7MocdQ3F+2teb1l94cIyl5JyQUpXt0NAPwJMYZr2Q
+9vL3xZtGzea52omaxAFzHdx3Jw/yD/U5i5XTi8W0KHs
+-> ssh-ed25519 2UotMw C7tThItOAHfQyJ1MlHIDplHd8PPZu/5VgpGrxeu/tWY
+DR27WXj+eR0IEyNNdvMyQqy9qeWl0DlF/eulSJnLthk
+-> ssh-ed25519 kdPvzQ omZiV5NRshERdMvvTfdveSNdD8scIfN6w1/c7u7yyVU
+DZuLNfOnEhnZZupK3n9mwAt1WO+NnAasQ6hFQYJyOJM
+-> ssh-ed25519 onmXpg LMn2z/lokc1nGWRgqoy3MEjWzhT1IoZPjb6yeL5tMSI
+0EYg5UBrjCyNBTWleKanrOLed0Y5EMHTfbFmyzbv/uY
+-> ssh-ed25519 CnhD0g /U+AshTlGAoXgcMGSLxI+zgc8lqVZQ/GwdiNol0r8BE
+hKMI0WdzqScgtEChnF3PZbkjdtr2nA87HNHhk3W1jhA
+-> ssh-ed25519 4ep2UA qrrOtCpjyVdRPaWTFgfAQhZAwFB5q7DKVdj2qUr4VRc
+FwQKHyUNciA+kBB/NnIftVParmV7nEFSdYQjrOIr6xA
+--- lWmGHk4zxXa+0DmZj1CnYHOYWlxlQPSB8gTpknMFYQE
+ZØÙC
+Õ•Qþ,’��hëoK$Ÿñ�
¸€²¯ê
+êB»`'¼#ä`k}�h¾5¯�MHäé2UÖ# s	yØ^ØøÒ7çµÞ†4mØÂf�8þ©â�sƒÃ

secrets/hermes.age

@@ -0,0 +1,39 @@
+age-encryption.org/v1
+-> ssh-ed25519 8UnW5Q AvtCfDMZZ51gAeWxQlfxp+AEZDM/54vKlH96kU+sgn8
+IE9cWU99bJ8RJd/q1NCLwvjBozHsKNVLLxj4vX+f1nI
+-> ssh-ed25519 UFfTmg jN40d8++rmq4aJ2MY7Mb2zrj4gWV67GqHjv29QRNxjs
+jJJx3pTDSQ/0QescNSbnWmI4aJx/mvqXg7YJeYY384o
+-> ssh-ed25519 xNtnoA MJrW1Ti4mAhq3b490wLp61PTe4IhEPokfeMxSek/7QY
+AdgEkxhMRWcswzmLFzbbIKPW4a40Vlrct+ivvNGYhW0
+-> ssh-ed25519 aY2AXA 5is/WyAjC4/oqlDIxAwq/Eaw6ZV9NLtQGFnBqWBm+mo
+gadDw+GbSmtYxI7DZUIWOLaH2i67eaM1m1uJakDTg8o
+-> ssh-ed25519 AQhf1g SSk081gv31ND5QM1V0KzlFQw05Hfx0UJ2EosCAzeS0k
+wpefMRyZgwWcaP5mZBPVnL3MZ2k+L5a+ChLqRGCa/4g
+-> ssh-ed25519 r/3ipA 5FoRCnYDLxjERHPTR+vY+2Y9ewOBZoXrvy+N6wnAS3Y
+7Z+5IwEeM1iRlr/cUWt+sfv1QEOJmkvEG91xq1LmajA
+-> ssh-ed25519 mOmPfg YMuWe/N8ZOrUdSnu2blap3HP+q1XJtVaK5pSUG44RBE
+bvvZrMAGJ4hj83Kl6MYA5IXRgJidJGpYHVfqN1w3zBk
+-> ssh-ed25519 YJiRbw fOo8kP29gbO6OI6Zq2YBvcX07Wjrm0qlZv+AS7KLcVI
+7CCA1UgDtjmQi4L58TG2qVxxiDuxFm70LgOFpG18d/4
+-> ssh-ed25519 Nl/5yA MZl/ydcywiEBzU2P396An7TVnTdtclNwsoItiSiUNRQ
+upyVL3DUnmIE61NWVu0+gqaHNfmWIToOwJzLZOCsyo4
+-> ssh-ed25519 GdLgCQ dva4KwyCz99k3Ah8WibFI2ez+hUdK6wFzMLS/bQJdAI
+k5rNjS1IszxzKy3t8FFNoclyYRpkaWRgyzP5D/RAdc8
+-> ssh-ed25519 tOH/HQ AL1zBCwXkMLNQWiD8eoGbTJKI6+ja22p5NH/dHitgFU
+qJPaXsp4k5g/D0/wmcHtAAqqCeiFDpRhftXWAhxzr5o
+-> ssh-ed25519 FpzvfQ 4IOwoeQE5od8jFEqWziCF2mzqCLoxOEdUM6sFOp8Zjw
+Ea5bSCfza6i4cd8nL5p7tcoYyHC0B0V9lyuBM/PR3LI
+-> ssh-ed25519 2UotMw 942H9PoyZwAfevk1yVlTLSUTQh17U/UjGfBcbHO0EEw
+UMLFxLUf1Xv31JCyri1YcYKezAy9p/C5gc3EJMlSIvM
+-> ssh-ed25519 kdPvzQ rYlwUzY8uJIe87A/x50Al3WMnPxnvxCOEZiYOvhPwF0
+WmP5r+aWqNkmO2PQwLPdxIKIUr2BYzsU0I8U+kwhF+g
+-> ssh-ed25519 onmXpg mIhPpC8xYbbf6DK0Upag73K7k+YfCE1S+ZgCfvu1fik
+XgJ655mD/y8bWwrhjdMNH/v0J9DWJQiXVBgGTsSRr+8
+-> ssh-ed25519 CnhD0g UvRupvnJ0zqie6y891Au6EBw+1YZ1Mc3rYWOOBZH5Ho
+WMBj6BdYtIxgzSCVbqRXBIbFQhmXCPJMyLxG8OgZXAQ
+-> ssh-ed25519 4ep2UA hyu7qF9mof2QhPfgMm2Xe/xsfJVQV03UK67b05ODeRw
+tb54Ihc54Yeew4pRp0Y3aKAy9W7bpw++VeT9trHq4oQ
+--- XXv9DYSwOiHB+rSASovGULreR0ZUVPr4MYYFrH9SnSw
+7µ¾�ø—Ó½{O�¼™y�—Ì?Ma§ß³2é‰y�
à£à‰§8¸E5¶jdµÀ	�‚ŸBûn	ôgþÞgb,NئH|
+cA,<»XFãò(
Ke7þ
Ný
+½ÁP‹Ò{&HK$

secrets/jude-forgejo-runner.age

@@ -1,38 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg T3PxgBg0pfNuZKS0YL/i/zQVbeRjnb72P+FRwMAQ334
-7SKL/KVhoG3v4wSnta0IgsIoh8BHR4oxga5peCMj9ic
--> ssh-ed25519 8UnW5Q lNkmK94pnuKJaZsQGidqlZ8o7+8E9Z1k0paLi3DqhjY
-CVNxtRg5ccb2aHzKlp8H7xil88wZ4oKV3Jd47S94Ak8
--> ssh-ed25519 UFfTmg JvSv4a8hsyIRDinwXBfRWsDkyOeBZl0dapik4DtMvDg
-N7wymvJluW/fV4RCTNeWZmELsleTguzmnhO6p5VAzNc
--> ssh-ed25519 xNtnoA tjf+tIZBerm8FlnXCiuBNjuQCYxVXMGaR4/sbvy6ak8
-CE6Iobx4fJAFMwQAsHCUhpz0RrelHcxE6uWC9y75E1A
--> ssh-ed25519 aY2AXA FLrOeA9AFvidwFFpp4jfEdp/9XKZOZqnhgMfkQHOMGs
-MYMk8gRK++s63F0r2AXy69sqEodww2ua/SGMUU2nPzI
--> ssh-ed25519 AQhf1g QF0KlR3wHA1sT//j1Src0lP5cOxL6zizgAj6cPECuXY
-49gGbae04hEa12u1s9hQzkX/4cIY1H1hDDKD+VaaFLA
--> ssh-ed25519 mOmPfg NoxbtJcMcQTRgWDHVENIUZ7z2yL7M1bz2h1W17lTu2U
-vDunWrrgtoH+dnNgOvpbxoLWgv1wk49eIagwDOgbwME
--> ssh-ed25519 YJiRbw 2ayUuS/nbPzydjLmYfIT0O87FctlhU640ePeuWjNNAM
-9W4vm7jbbC/JVEUqamBKiGFaWdNE35v7Byw1pgfgKhc
--> ssh-ed25519 0/WsKg mFpy6qEC0gF4qBNzZcY3rDB2p7PeyhNlEmLGJEsTixU
-QPrEOTazlkWnJN4f9/LW5Tf0cfI5zghiinBsyALmvm4
--> ssh-ed25519 Nl/5yA DqNMvJYPP1Xu43+LFCEMcxyTLUl3EHhPUIg/cna1NAg
-nqvWhQILmnpMkmtkYf8Er8ztqP3xH/dEk9oFycEoDqQ
--> ssh-ed25519 GdLgCQ PgZY49A0SL8cyHdxc5BD4yrwjGD9DcrQmdxZtlIdoiU
-q6hu5XxQgujMlejQGST9Ka7hlJagwTiwRQaFj8fi/28
--> ssh-ed25519 tOH/HQ 5fIvkG+emjJySd/7DdMVAtkEOwUH+YaXXONZ6nKshAI
-vVOUJRKWcRmwG1Wufm+EUwdDLHewFFGJARwNDCV156U
--> ssh-ed25519 FpzvfQ xVNdop7LoydHHG8GtCiAOf3STnCOPvSNzXkfAyGwOAY
-Jy+teMo/UnAOAmLkGK/H3tkWNdI3Vl7NONzQ3LpVy7w
--> ssh-ed25519 kdPvzQ wQ9y5YROKeQWeTPjQl80yRwosyU6ZbOTNmrlCyE9SSo
-3ld+z64d26fnYSNrM/lgAp+m/GMmD8G7aJouszUAvqU
--> ssh-ed25519 onmXpg x+/a4ta0k7ENV6Ka+5pkSwdcbKgxGAz74t5PYt2gcmM
-oCIWVpt/a+VaxEa0qW6YpDDTwFelJeLEcrmo71/UtSg
--> ssh-ed25519 CnhD0g gvGoeS24lFxtrfKfUn7EaI8baaGkl7k2uYxTjU+PZC8
-JJePTz8xhu35c2AvZrXyFDw8yYRicWSTrKUSwEe9oJI
--> ssh-ed25519 4ep2UA 9dAa07MiGZKqp5L+Pn/Y0OXoy6N1pYmpFQPLR5gty2o
-4Hduoi4utPgwuts4d6fx1V8AFTAdn6OLO9wDAIQZUlI
---- IgCY0Hr7grc/YQkWfwlksRLfK2200lkhIwb3tuNqv7c
-}‰¥rÏ�´Æ•²$¾¥jBû"œíw(±
7#¥1š¥4„¾~Í9Q­Q‹Ôî’ú‘^zÞ`¨d*¸$sÎ@
-ݾ¡^ßl0п
+-> ssh-ed25519 8UnW5Q zKwZaiVwcb3twBRyisICah2+RLb5NUStt0h3Ch7t/Tw
+9O3yKkWIOiJy6ese/ytnDRvyNbytQKDXR7HSZLNWNjY
+-> ssh-ed25519 UFfTmg erGwb0GnZV12BoEa1JYiYevuf3Uq0Tv73ObbDRvv+Tw
+a0YD87ft8y3ZTYWw38GSwbmIUHe3HW6FuaGksF5pi3I
+-> ssh-ed25519 xNtnoA KajAZC29v2JqZY+OPkeHpKv0biPJLDgnT2CN//WnjhM
+GJdu44xGefwsI0g99wuwTmWGVQD8uwIcyINRCHMb6I4
+-> ssh-ed25519 aY2AXA aQk0/BCQyyPCZCuaI8NiyjuDZBIRB+nAWZBKs+3Z8Wk
+KSZxNCGThfNjoSZh9hIRjP9o5cQ1FjZP4G7GuLbBZn8
+-> ssh-ed25519 AQhf1g 6usKpTxVUNIT92ugQl7Z8LFPFPStTgoPhEGdyXjmhwQ
+QqGWtkb4Bom4sKMrV347/jf6YptbQIm78zzNwxZN1UU
+-> ssh-ed25519 r/3ipA M77+oa8Kbvt6eGbAaq6/0oG9ggXSbYZeBOkced0F5zg
+hkEFOfMRY4iIZ31X8ty11lGkouOxHm2r/tLwPRfQ050
+-> ssh-ed25519 mOmPfg RohXdUXobV/fC3JYQ9IuVvDqdfnS2xodARJYmT1Ch3A
+VdDNZFmvud6FGSX/I1c4iKg+6uhWgslPKAk0Uf5Vhds
+-> ssh-ed25519 YJiRbw /xSl3swqNc5q0hsY+hO4nSk6PzPk9lRV7Hni/yNX4WE
+GXD3wBcBf6k1mjr14vIP58bjRWOnnVBxm1zunv7SVo0
+-> ssh-ed25519 Nl/5yA BAgdJDYBnUE0/8dR32V5D/ONiwLufRL9/9CY0YgpW1U
+aUgdT4MPYEAVjSuWm2lqr+r3xwlX35UyrbYGh5v5C6s
+-> ssh-ed25519 GdLgCQ fOAibyd4PSLdTsOM/ntG3/Jcz6TZFTlGk1oO9MLQWXc
+HNyui1pe4ZcrjHafzZtCad6Nc3MbzFu8YSMS6qae+mo
+-> ssh-ed25519 tOH/HQ oE4PbISWQe/kW2DxIkwqJKhKp/SNNa2OVje5iX21RA0
+lx0r//kRfV5df3+5cApTmpE9zxFjKoNBSguhoeHqgjQ
+-> ssh-ed25519 FpzvfQ L5a5UzaBYkaDLRKKu3z/9tou8SFmzL7615l8Ejyb23w
+Z9G1pnjjBk7H+XoNGNiBUtsZVQYiXe6/crYjUb4LIFM
+-> ssh-ed25519 2UotMw sw24R6i1jaa2t2NcPsXxeJz1FSNGY8dpTJQBPM4Y60M
+t+fZa71iWWxAqfusahrNV/Gx4RvlklnmZHgz4VsxGRk
+-> ssh-ed25519 kdPvzQ BevwDGBlvPar9elbiiFK5gnbF1qjXG4lsTSaOHdZwA4
+DBYjAo0HLsF7GzGPAw5wGate8QIpFQ2F/FNEITQqOrk
+-> ssh-ed25519 onmXpg XFXmGNe6X+JbLS6f26x8OEooWGCsSKdPXfNwFoSDknE
+zEKhchCyQN+rMBGXpnwMeOoRLDPiQSRQbHeG3V9ifLE
+-> ssh-ed25519 CnhD0g Cua/knFngt15egS+o7s848bfy9YM0/fFijrdkrreWi4
+tSj9HuyLRTiLPFlkNUHQrmY2scEBQvzYIXUuuUuYyjc
+-> ssh-ed25519 4ep2UA lZYn4isPidCnEz33aBI0Q+oONJqFy+a63slmhw2rBlo
+i0zEbwLS3kXVoqfMpdnti0UIn5pDEd7OJjX1cA2idWs
+--- H8Qm4uuJHlwWSBopEIN+ZUr0hZ5RndYYO2jQWAIDW4Q
+‘g¡CèæPÖ•ê²¢dW\@Mïs¨×þ‡[‚Á_‹ü±®¶ÁNÇžBÜïo§Í,0ƒt…d8Þ"Ÿ“Ã#¥ŽET¯t»‡h=GTOh’+Mú

secrets/linode-forgejo-runner.age

@@ -1,37 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg UrJ/Fo8Gk3wuJsPQwN1uW9z8nPueEjHTnNY5l3GEOVE
-XKMl9j4Jhjx6pcRMED2mHNjcZ7fgmLYdw6yaxk0Aaec
--> ssh-ed25519 8UnW5Q RterF0/C9LR1Rx4GRkqWHgiaIjFKVAK6h63ga6+AvVs
-6FA+RDXaQLNY5OvdadYKrxLupadsLRFShpBiZ8bbwHg
--> ssh-ed25519 UFfTmg APfW+37oB1M3RnHJxy2vxnD6fA9QMuUOIoA1bzR98is
-Y0ajyDn/ytE9fziEUrRWWc04mnXCWqTrc4sfrIWdgYU
--> ssh-ed25519 xNtnoA 1rW50ufVNntJEMTTy9Ics57y5HQ7fE5PXHN1bmtM0RM
-8A28vUzaqtM9WEaEomHCxUPWpBF9aWHNyStauJzodtg
--> ssh-ed25519 aY2AXA 0cMla6XzGUMV8OOY63FDOf9MbJ+jAHvHNPZG/V5yY04
-HQzAEGHq2Idw3AqVcB517uDiHeFdy3ssizLgLUDeNlo
--> ssh-ed25519 AQhf1g PcsdHND4EBAN0+2MtuOA/hFXVhAptuecimZ2lBLfqGE
-2VwMSdLN28KFgEBSMfEZhWV6ygV0RKbQH40L7rvM14M
--> ssh-ed25519 mOmPfg 1g0WLjrumR88bM2ClP26W+nO4QAfAgbCWjp7+FiVzSA
-2J+wBkpjiVFN1iG8txpLvVK6K6uR+YFhs/+l1bgC+8s
--> ssh-ed25519 YJiRbw izAQaGwummtK61wPrs2jfSOlwI+f8oEUlZOIEholzhs
-mu9Tb8TA4WwAZsctOn2yViJf1ChQBr3Yvd3pmQNiQow
--> ssh-ed25519 0/WsKg cittCRWu4jkN/QTfesBw3ZYJ46RgREBPcrlHitY3fmg
-xe74aLRvBC1FIOH7viH5kGl65HI7F9MtL5kS5mwzam8
--> ssh-ed25519 Nl/5yA dXNWQ4FVeDnqkpy/+YOHeTPZXWwdHz7+aa9HljeoOSE
-ciWExVvv1YbGKmJlVfhiHDJ/mUnp9R2zCAp5pjNPyc8
--> ssh-ed25519 GdLgCQ llE2atewUSFWeRbkoYmt5TGrwBsBHbWFOL6vksackwo
-UbkuzM99uhBZUFAQBADoFRa2iG5GtSCo8BAQYyq8stQ
--> ssh-ed25519 tOH/HQ uCg3AQuP8UFxhurEPjzHnsy0l+YY6sV+T8SmxYsmnHw
-iTXWS/y/pzAEGrtxqgZ7HWzpUSeY9PmOdQDdJcqoXu8
--> ssh-ed25519 FpzvfQ N07YPD+4KbHHypCIvjqWvyd7bDpzTg1MVaoJPmMkenA
-oAfxGm4YgZjNVkrefoRqxnNgSFRyYDHynvphM+DR8NQ
--> ssh-ed25519 kdPvzQ 36HTlyE9kw4peM4KfBagzuZzWng0cIQzaGCDg3YDAzc
-b0Uz5wbAUENn1W/HE9p+ZywhJ++6HvtZ+K6VasW5dho
--> ssh-ed25519 onmXpg UL2M9Srb2ZpUhsQkG1s5axVU9cdD3v3PQ5nic2S9bDo
-wEGKGN/gspmzhDjis0mwfYNL9z+PMI+dBfT65Tb0JlE
--> ssh-ed25519 CnhD0g sInjWL6cdGHREW10ehWK9C0g9RSvf3qaHpYU6xQ6jD0
-HvDkFXl9/w9Ec1K0AkFz6S+lw9XmDDTDTncMG09a5RY
--> ssh-ed25519 4ep2UA SOwxyOMTaqPqiCc75dPh1leExnVi1dsXryxmuOlouEY
-bmVSKNKrkKkLMfWLx1fJv6WjZVWDhMA8kKBN8pyafgY
---- wVpI8r4Ah+buu/nxLL1wUzW+rPaF2oPBlMwd74RbIe4
-3o…¿;tòHþy¢|B‰AÐ⯠·_!X¢%æyÔDôiÊ£o4Ñ$Ûy‡-9&êͤ~ÑÊ™8§6ÂM}„�TæTs®g�Ûò…Ü«
+-> ssh-ed25519 8UnW5Q Z1Zt3ObMDbq7suhJb1k/O9dgrQN95vTIDu2STbO71g4
+UiyIVoagk70mtct1YxFQtUCHcGbfYhtA1QDUtfFz+eQ
+-> ssh-ed25519 UFfTmg IsYLw4pCTs1Xkels8aGAGSc6Lqx5Y8mWBpervFWsKUA
+eBFYqndg81YgePY0yEuKWDCD9LTnOxLevT7iy6m6Nfo
+-> ssh-ed25519 xNtnoA H5M7J8lYq8r5GuNNjx+1QHCtiTNw9SSWdWcpmRlTUyQ
+4N/qiG/TZoWIn2KuZwlrqxt27wB7HGtxJPxHRzeRXo4
+-> ssh-ed25519 aY2AXA wN6zKGGRfj9Uyib2+94wRnqzkltJbjn6LyOjnJGMXEk
+Rx5FQte2kyo1m05YMupG2LA6Ddzp0kAVFkoB2tpgV0w
+-> ssh-ed25519 AQhf1g ocOb67dklB9G6Pi0icJ6OuB0nvMsb3gyvSdkTulqbUI
+PEjigA1SVW19c/yyWxCNrRbxWNAowcQYbw2z9busLIY
+-> ssh-ed25519 r/3ipA vFM4wk+L8Wv04+Rry0brtnSLz/ChaNYup4VI1Fm/kmc
+Du849WnNg6E/CQ+ui4+9vFAZJ47jJ0L2o/T2Sv0j/UY
+-> ssh-ed25519 mOmPfg NrTgNtkHKFT+ZPmW4ga8DGrJk7tiDF8Lel3By8uRRic
+y39BsMv6CAjVU0EYdfMA9Z+Sc0dFG89Toz/EBvFLMYE
+-> ssh-ed25519 YJiRbw k4IxoHzHTll31zEQldtYFJLAZcoACKulR1L/ch9lRRw
+/EPni0kgRovc2cESxbAV9c8hCLXzxBqr5S8Lt4WXrqU
+-> ssh-ed25519 Nl/5yA uC1gIjNtYyoJ1bsemEJRFnBV7MAAVrV5beyDpIJj5nE
+K+n4T8IGULklGYuoCr0x3Q4sN1NZ3YwAyEORG1Y0YiI
+-> ssh-ed25519 GdLgCQ dljs/yoxh5IV8S1wjksMF3f3+xw3Tsqv3ZPj459KWjo
+SZclrcYwhgwyrG6Sg4iHjN+PbKvet3B0AcaWFlMvdpA
+-> ssh-ed25519 tOH/HQ 9zHh+cM1vXMRx3zZwfOCkyQ2eBobH50JcWIO5UmoDB0
+lEA2DAb0UuiRknrKfmKjEpHnuWpSYEWw5Qk0s1JB3bY
+-> ssh-ed25519 FpzvfQ WxXIAYo3SVayrHVhiIS0enua5l+1LHuEYLI2ZJcrVkE
+5siODJVz1gQxoZgeUfl25Koqt4ilTYIYqxOGGwyh3Gk
+-> ssh-ed25519 2UotMw 7v7u40Gn57E1M/VNNTpgFhg7nsa0JmcZvOBjJ+/Y1mc
+yT1hqZue6sN65PnKgRr/upxXQlloD5s1WS/sosBKH6k
+-> ssh-ed25519 kdPvzQ Ey8yhg4MocBop8aKb9Y5Vulz26NleTREH0O9ga8kgmw
+eGr2QQasypgk26uQVwUkgjHGjgYVtJfjb80y9fht3qo
+-> ssh-ed25519 onmXpg Gk8NZVb+7qaAdps/C5u1CG+2DIFtHFDhAu+m/43Gd2Y
+A3WMc+zyVq2ra80T8SeXWxe+eeN/SmdicoOGQJaohDQ
+-> ssh-ed25519 CnhD0g MR+oV7rqxoBN3Xkoo4FJeMpMamkbU8kAbIivnzQDDlY
+djQB7mKq8raqp2Yy/N8s1fcoQ4Xi7KoWgn0axihsPm8
+-> ssh-ed25519 4ep2UA Cxu6m1Fu9gmC6Y14Yo6nebc2tUyo6zc2RRrskhoavE8
+g56/R04ow0jremNusFjtkWahskNc4pfynVKG+C4WYIY
+--- yn/4D5+C+8iqvDcMNFOrozE6KeEjPq35cMW468nMjzk
+ôvœíJëiÀ~ö³Ä*, i¹þ®‡¸QkÌz�yµ,Ncæ­BÔºœ•ìk—~$ᤈž2¼¤/[¹®Tª‰¥¢,þCchÁ$à

secrets/minio_access_key_id.age

@@ -1,39 +1,37 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg tNGyB4cizi/YCIn1ID+lTbCi6xyp1J2fVjrQM04xMhc
-de9qf3luGRKvZBXIjYkfdArjhdvX9Dk1FzvsJ1RMBn0
--> ssh-ed25519 8UnW5Q cDFib5sGOTKD6aBhW7wmdg8n3wR/MpXhyVOXchGl300
-maTreexZTfcXQF/gYOAsRi2/TOXxRIWwBj8ruLkgcpA
--> ssh-ed25519 UFfTmg KAKcJGA/TKK3vNPt7wRrVLQcT1R6hDyQBi13ybcu2yw
-Ofb+s0udi9Bb/Zbb+p8Cyn69sleuR5pa9lL/YavetYg
--> ssh-ed25519 xNtnoA LhOKinNzs28pOkJErbmf/eZlllTgNCi+v5Z6CpZ8Ils
-O8jE3lQI27CumC4TurF7+iJ/T/xktkmFhOwxVteKCoA
--> ssh-ed25519 aY2AXA L1LXHzjKx1Gxjz1EKAgK1nKfNfC/lvsjZlu/2DRCQWw
-iMHB3rH3zKbBxYPr08IwgvxgM0iz02Ag8lut8usTTkw
--> ssh-ed25519 AQhf1g mewgW/+z8kIMRriBc21rwUbkRALi8becYDlR6u22YUk
-Htkb9fAc5kAkaGRUFFUqxj7qxfpfah8/2RaByiHFQFI
--> ssh-ed25519 mOmPfg s7/GwpOjROLmkMXHp9k5g9z0jg1GfXzO+B/nTTa0B20
-Ckr6Wdp7izoLVaF1b+eahtwgjfs3FcFe7bAUyrkB+Tc
--> ssh-ed25519 YJiRbw QM2RAZgdd1whnmBOrQXE7LFos4cuqVt2o0E7tnM1wzA
-9Ib9IVqXhPzThQCS3YRBeQ0nE09obbCxSl2TinYRzkQ
--> ssh-ed25519 0/WsKg c0y1YSCN8lxNm4SthTT9S3vd6S/m7wKiNP1IlF1N0nM
-1Jq/jjGj8WUD/s85/Jt/XatAU0Mndw9Oifv8M65dQ/Q
--> ssh-ed25519 Nl/5yA awxsoi/tdQ9ChkNJJyUnh02JTV1LuS2gmyLR6+wcyVs
-8ryO/UOCG5dzTUwo5ndfPY2vVKCaY3yufgCOuJkrBNI
--> ssh-ed25519 GdLgCQ EWbEFAAZGI2fAnx2nqvhD79gZoAXJbULHSn4n5zjK3A
-z/nviYR7xvCg65JhCz/DPcGDlJjN8yklEW23dC9eZ1c
--> ssh-ed25519 tOH/HQ wkHyoSbyGqWTELejmnePkPIIlnokN4NrAjuuRPK0uRk
-Xq9sawAuJgC9NNM1F5YPslPuXBp6c1K+w+RrLnJQJRo
--> ssh-ed25519 FpzvfQ qT9X0lEoL+xSXIhOUi4bpzf2PrqMsH3OceEArlaAUi0
-4ePC8cr2aG996ZrYC8lqBq+//ifm3anaahMx5Hg9xi0
--> ssh-ed25519 kdPvzQ 7QiJceHBSEheugSm1c2Un38M+HNLrFyCOxeYSCbyqj0
-Z666Yv0hag0bxrYpJ2N+G2U3QLFIPIBN1mTMddQ2yH0
--> ssh-ed25519 onmXpg XWEEkDCIjlVKU1pg8UVlmj1uew5hmuEiBGA0RotFYmU
-DQOB41D0IriwLQ/P3OM34YWnfzL/ywy09PzRVfGC01k
--> ssh-ed25519 CnhD0g t3PLbu4v4gUvOZfRQ1FC/BluiWOkHaA2SL4Lk8dj3z8
-vPS0jP5WqQcctcX9zQUEoUJi5j8NQ+LqklVqlyJgesc
--> ssh-ed25519 4ep2UA YheXy2j61uvqI6EK+5/pJSXkNik/YU311W53T8Ol5ig
-2Bu8knS+3A4PzFZIV5TIe1itxrC6CYa+VARsECW+iUU
---- FV+xULQHrrc7KE1EwUdgCDM07dWpk2JGKVLSTyrnP74
-SÇGIJÍÍ´)KãÚ#hh_¡“?
-‡wÄ@<
-ŒB0:
+-> ssh-ed25519 8UnW5Q y9PK+VDf73/nElH7/STk9n0ru0NIGJ0qp4eQTokEKWs
+8HF0hEGCfbmYfEj0gn2EWUOBo8KC9/znCo7nxW3rkeQ
+-> ssh-ed25519 UFfTmg piv4fjTj3Ua1VdM82I5B8BI0jk3Qh4S29PnKs9GmokE
+inY59fSHk4xAZn8xkBQQIoI7xnQW6rsRKCCnszngq34
+-> ssh-ed25519 xNtnoA vNufVdYaFm+k78r+ioCcm9EWuwCF+zoH1bffrOEmJTQ
+Y/NDZ01jQEJYAu9U7d5nRI9S67wj6SNz1FXNBoVzho8
+-> ssh-ed25519 aY2AXA pHfVblA8IhBLMiTWmq9KT+EBv5/AP3XSQ01bT2VY+lk
+kTiFQBOh2sYHx+CAHyduwVauYDOXtfPc4FrKeNZHcE8
+-> ssh-ed25519 AQhf1g uWlt9FLfTmlFmVlPx3o57lVQInTRuT80YZbbwFSAVjM
+3PscKZhny+pMuy+Q4C994e9o9sxsONdZCgewkuo4l3g
+-> ssh-ed25519 r/3ipA ksZgnGbPwj14xBftMDA4R2o7ui1KNOVVunBrA3xwjy8
+IZZX800pMneP/0SAMDiFlt2wlRqIyMW9bNm19E0uqtQ
+-> ssh-ed25519 mOmPfg 6iuNsMJ5qbGog2wMnjLJ3AnQpeTK/oiKmJFU4NmpbXo
+rWPbp574Zb6sU8RFXD4Sw1d6yatcW45LTMkT10FL2ZI
+-> ssh-ed25519 YJiRbw MutfBuiITaQ4zs+ELUihuB1Rl7LeAICL2+c5xbr5Rj8
+o0mGn86fAERZ8DQ4rSWZh1MOaPLCZ5Su27U+5XExxV0
+-> ssh-ed25519 Nl/5yA NKo72CIorQwlJ3vcfjWZ7IcEWgkrxSpp81P3k2nTk3c
+4/0XpBgS3C44qqU5zcWBqAzFbMl6DV8V5+xYxBiXCCk
+-> ssh-ed25519 GdLgCQ jJ99c7pKMPL9jGM45fbcYRv9k2aeXKFcBidMxinmYQQ
+6pA6kX5sxxQLY+IFpVnIp7ximqAsA2Ifo/d2gYTy9uk
+-> ssh-ed25519 tOH/HQ o1g4ibiZdld2EzoPUYsEJKUwMciJlqvzpv4hL42WfRk
+ZYi5u8ep38jxeHDKq4uCAB13wSb/oJC2+Lpyjyk4UHQ
+-> ssh-ed25519 FpzvfQ YN3SyUVugq1S/4GkWtnfs6qeQ1ukpX64k1dZNFV+UBk
+Yaq2dI1oBEQ228g9f3i9mFGklUbOk9s7DFDHTXZN/J0
+-> ssh-ed25519 2UotMw /93PQpOj4bxRoi7Z38nioyN0IHi8Fi9ERBqnZIZ7rh0
+M45TdKIss0NkVObm5T95npKzyBM7A1QcT5DORLORnFI
+-> ssh-ed25519 kdPvzQ v5oxUVW0nFpWJt8NFuVubwXhQrx+SHpJ38BU2kJKqnQ
+dYeaVnni5QQUg4CaNxbuNYzQsL/KPuQNgFtXk96adXc
+-> ssh-ed25519 onmXpg K+8SnidvOmL3kzDCRnJdHg/RFCLcUaWJ2HrA4Awe7lA
+iyYRzYexYHNYhI0mlEZyNth7LBYVW9pL67E+gxLf4Is
+-> ssh-ed25519 CnhD0g inYTXGWEAMNKTpK+uj1xN6jg2xfVzO6s9j5R/bUx6D4
+Sas1bzhaBLXDRkG0dvfEtXn689aLGih+NJ5IVoEAvC8
+-> ssh-ed25519 4ep2UA UokZFgeEqY3/7DABaODXVpxxhjhUrBx1ZWMv4xJdYDQ
+ral1UaG6TlRUVZRTYhpHknIeTrhRvS2LfZ9ET/LM6bY
+--- 5KW+UYA/aip08dG72P0VeJteMlK5lW3vfrCxoMV4+yE
+¯�뛫	ž¦ðýÿ:¡˜Ü,ú.Nn,3îà.W3b‡%�˜ê$ê

secrets/nebula/hermes.crt

@@ -0,0 +1,6 @@
+-----BEGIN NEBULA CERTIFICATE V2-----
+MIGloD+ABmhlcm1lc6EHBAUKnQAIEIUEal/riYYEa668pYcgg4lMYGB2VakRFO6b
+K9vHSLzjZpuqhBVQ7MReOwUHQKyCIFCN4I/nO1jII+C/GwY6XVW89ddkng95yO4D
+awC9mMYng0DNzKvg2r/X1qyEBzEPu101iikgcSJeQ4X7xkA+UQo3dmXsAiZH6RSu
+ujn0TMZqZpwGP/7lUTcUEjqO7nh/o2kA
+-----END NEBULA CERTIFICATE V2-----