chore: fix wait-forever bug in updater

Zims update script has been slightly mangled since nix-prefetch stopped
working.

Now it is updated to use nix-prefetch-url and no longer pulls from the
Torrent sources. That script exports a regular SHA256 hash and not an
SRI signature, so we now convert that to SRI as a second step in the
pre-fetch pipline

Also adding a cron to run the tool every month on the first, in order to
keep it up to date.

.gitea/workflows/update-zims.yaml

@@ -0,0 +1,51 @@
+name: Update zims pin
+
+"on":
+  schedule:
+    - cron: "0 2 1 * *"  # 0200 on the first of every month
+  workflow_dispatch:
+
+jobs:
+  update-flake-lock:
+    runs-on: nix-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Update flake.lock
+        run: nix run .#zim-updater -- --output pkgs/zim/blobs.json
+
+      - name: Create PR if changed
+        env:
+          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
+          GITEA_URL: https://src.thehellings.com
+          REPO: greg/nixos
+        run: |
+          if git diff --quiet pkgs/zim/blobs.json; then
+            echo "blobs.json unchanged, nothing to do"
+            exit 0
+          fi
+
+          BRANCH="auto/update-zims-$(date +%Y%m%d)"
+          git config user.email "klaatu@thehellings.com"
+          git config user.name "klaatu"
+          git checkout -b "$BRANCH"
+          git add pkgs/zim/blobs.json
+          git commit -m "chore: update zim blobs.json $(date +%Y-%m-%d)"
+
+          # Push branch using token auth
+          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
+          git push origin "$BRANCH"
+
+          # Create PR via Gitea API
+          curl -s -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
+            -d "{
+              \"title\": \"chore: update zims $(date +%Y-%m-%d)\",
+              \"head\": \"$BRANCH\",
+              \"base\": \"main\",
+              \"body\": \"Automated monthly zims update.\\n\\nGenerated by Gitea Actions.\",
+              \"assignees\": [\"greg\"]
+            }"

ca/intermediate_ca.crt

@@ -1,12 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIByDCCAW+gAwIBAgIRANS+dPEH5Vqug7OWhCMmcx4wCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
-MjQwMjIwMjEyNzIxWhcNMzQwMjE3MjEyNzIxWjA2MREwDwYDVQQKEwhIZWxsaW5n
-czEhMB8GA1UEAxMYSGVsbGluZ3MgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0C
-AQYIKoZIzj0DAQcDQgAErZUhPfx5MpNbNVyqHDrIgUGnb6Hitl8hXlpH+kgjBzCi
-7I/+TQnl9Tc0VVNOFOYLOfBi7hV3/QudUtLGk0FKeaNmMGQwDgYDVR0PAQH/BAQD
-AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFMZR8LDd+hNy+TmtEHvt
-zRzXboh2MB8GA1UdIwQYMBaAFAlH11TwIFGB/K75qZ3e0S+fN3JUMAoGCCqGSM49
-BAMCA0cAMEQCIBxHK6r8pMX5hrTwYKRfMmRIt44m0KtNejA2T5t09hs+AiBfvmHb
-LfoE4qoC6NgpvXorAbx+O7xkem/9svF0Ob+RsA==
------END CERTIFICATE-----

ca/root_ca.crt

@@ -1,11 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBoTCCAUagAwIBAgIRAL/1mvE8+73nRFGsvzaaVSAwCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
-MjQwMjIwMjEyNzIwWhcNMzQwMjE3MjEyNzIwWjAuMREwDwYDVQQKEwhIZWxsaW5n
-czEZMBcGA1UEAxMQSGVsbGluZ3MgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
-AwEHA0IABEgNBjlT/7gmzNp9vKJvGPJn9/IizuMGVpucdrN9+J1u1ABkLNRzj5p2
-g7s3e/BG+EJnnTf/2tuq3p/wPqmQkdujRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
-HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQJR9dU8CBRgfyu+amd3tEvnzdyVDAK
-BggqhkjOPQQDAgNJADBGAiEA/uBclcFCOpkEgAeBAVurktYB82sMdIyyDGHcjlwi
-pvkCIQC2kuZ/nXRjibeIebQIVTBskQ1LxlLxnx7zNSjtr3kFfQ==
------END CERTIFICATE-----

compose/attic.yaml

@@ -1,54 +0,0 @@
-services:
-  attic:
-    container_name: attic
-    image: ghcr.io/zhaofengli/attic:latest
-    command: ["-f", "/attic/server.toml"]
-    restart: unless-stopped
-    ports:
-      - 8080:8080
-    networks:
-      attic:
-      pgattic:
-    volumes:
-      - /mnt/all/configs/attic/server.toml:/attic/server.toml
-      - /mnt/all/containers/attic/data:/attic/storage
-    env_file:
-      - stack.env
-    depends_on:
-      pgattic:
-        condition: service_healthy
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "wget --no-verbose --tries=1 --spider http://attic:8080 || exit 1",
-        ]
-      interval: 15s
-      timeout: 10s
-      retries: 10
-      start_period: 15s
-    deploy:
-      resources:
-        reservations:
-          cpus: 1.0
-
-  pgattic:
-    container_name: pgattic
-    image: postgres:17.6-alpine
-    restart: unless-stopped
-    ports: []
-    networks:
-      pgattic:
-    volumes:
-      - /mnt/all/containers/attic/postgres:/var/lib/postgresql/data
-    env_file:
-      - stack.env
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-networks:
-  attic:
-  pgattic:

compose/pinchflat.yaml

@@ -1,9 +0,0 @@
-services:
-  pinchflat:
-    image: ghcr.io/kieraneglin/pinchflat:latest
-    ports:
-      - "8945:8945"
-    volumes:
-      - "/mnt/all/configs/pinchflat:/config"
-      - "/mnt/all/video/yt:/downloads"
-    restart: unless-stopped

compose/restic.yaml

@@ -1,19 +0,0 @@
-# Demo of rest-server with prometheus and grafana
-version: "2"
-
-services:
-  restserver:
-    image: "restic/rest-server:0.14.0"
-    volumes:
-      - /mnt/all/backups:/data
-      - /mnt/all/configs/certs:/certs
-    environment:
-      OPTIONS: >-
-        --tls
-        --tls-cert /certs/nas1.shire-zebra.ts.net.crt
-        --tls-key /certs/nas1.shire-zebra.ts.net.key
-        --path /data
-        --prometheus
-        --debug
-    ports:
-      - "30248:8000"

flake.lock

@@ -176,27 +176,6 @@
       }
     },
     "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "hermes",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1772408722,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "nixvimunstable",
@@ -217,7 +196,7 @@
         "type": "github"
       }
     },
-    "flake-parts_4": {
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "nurpkgs",
@@ -256,31 +235,6 @@
         "type": "github"
       }
     },
-    "hermes": {
-      "inputs": {
-        "flake-parts": "flake-parts_2",
-        "nixpkgs": [
-          "nixunstable"
-        ],
-        "npm-lockfile-fix": "npm-lockfile-fix",
-        "pyproject-build-systems": "pyproject-build-systems",
-        "pyproject-nix": "pyproject-nix",
-        "uv2nix": "uv2nix"
-      },
-      "locked": {
-        "lastModified": 1784663791,
-        "narHash": "sha256-bPip7Rk/5n5idLvedBXWjzuRw6cc30XGxCRJewlwwUE=",
-        "owner": "nousresearch",
-        "repo": "hermes-agent",
-        "rev": "e2e8823f1d2de2aa95c8147d0abd105539d5daff",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nousresearch",
-        "repo": "hermes-agent",
-        "type": "github"
-      }
-    },
     "hmunstable": {
       "inputs": {
         "nixpkgs": [
@@ -558,7 +512,7 @@
     },
     "nixvimunstable": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs_5",
         "systems": "systems_4"
       },
@@ -577,30 +531,9 @@
         "type": "github"
       }
     },
-    "npm-lockfile-fix": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775903712,
-        "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=",
-        "owner": "jeslie0",
-        "repo": "npm-lockfile-fix",
-        "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "jeslie0",
-        "repo": "npm-lockfile-fix",
-        "type": "github"
-      }
-    },
     "nurpkgs": {
       "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
@@ -617,56 +550,6 @@
         "type": "github"
       }
     },
-    "pyproject-build-systems": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "hermes",
-          "pyproject-nix"
-        ],
-        "uv2nix": [
-          "hermes",
-          "uv2nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1772555609,
-        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "rev": "c37f66a953535c394244888598947679af231863",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1772865871,
-        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -674,7 +557,6 @@
         "colmena": "colmena",
         "darwin": "darwin_2",
         "flake-parts": "flake-parts",
-        "hermes": "hermes",
         "hmunstable": "hmunstable",
         "minecraft": "minecraft",
         "niks3": "niks3",
@@ -806,31 +688,6 @@
         "type": "github"
       }
     },
-    "uv2nix": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "hermes",
-          "pyproject-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1773039484,
-        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
-    },
     "vsext": {
       "inputs": {
         "nixpkgs": "nixpkgs_7"

flake.nix

@@ -19,10 +19,6 @@
       inputs.nixpkgs.follows = "nixunstable";
     };
     flake-parts.url = "github:hercules-ci/flake-parts";
-    hermes = {
-      url = "github:nousresearch/hermes-agent";
-      inputs.nixpkgs.follows = "nixunstable";
-    };
     hmunstable = {
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixunstable";

home/baseline/nushell/functions.nu

@@ -13,9 +13,41 @@ def --env unlock [] {
 }
 
 def nebulaIps [] {
-    open ../../network.json | get hosts | items { |h, e| $e.nebulaIp? } | filter { |e| $e != null } | sort
+    open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort
 }
 
+def genNebulaCert [ --ips: string, --name: string ] {
+    let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand
+    let private = $'~/SynologyDrive/nebula/($name).key' | path expand
+    let cert = $'/etc/nixos/secrets/nebula/($name).crt'
+    let ca_cert = '~/SynologyDrive/nebula/ca.crt' | path expand
+    let ca_key = '~/SynologyDrive/nebula/ca.key' | path expand
+
+    # Generate public key if there isn't one already
+    if ( not ($public | path exists) ) {
+        nebula-cert keygen -out-key $private -out-pub $public
+    }
+    # Clear old cert if there is one
+    if ( $cert | path exists) {
+        rm $cert
+    }
+
+    # Create and sign certs
+    (nebula-cert sign
+        -ca-crt $ca_cert
+        -ca-key $ca_key
+        -name $name
+        -networks $ips
+        -out-crt $cert
+        -in-pub $public
+    )
+
+    # Agenix update
+    cd /etc/nixos/secrets
+    cat $private | agenix -e $'nebula/($name).key.age'
+}
+
+
 def rebuild [ $target: string = "switch" ] {
     if (uname | get operating-system) == "Darwin" {
         sudo darwin-rebuild $target
@@ -39,7 +71,8 @@ def deploy [ $host: string, $build: string = "" ] {
     if $buildhost == "linode" or $buildhost == "genesis" {
         $buildhost = "isaiah"
     }
-    nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
+    colmena apply --on $host
+    #nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
 }
 
 def ff [ $file: string ] {

home/baseline/tools.nix

@@ -8,7 +8,6 @@
   home.packages =
     with pkgs;
     [
-      attic-client
       dig
       jqp
       kubernetes-helm

home/hosts/hermes/default.nix

@@ -1 +0,0 @@
-{...}: {}

home/hosts/icdm-root/default.nix

@@ -1,4 +0,0 @@
-{ ... }:
-
-{
-}

hosts/unstable/exodus/default.nix

@@ -9,13 +9,9 @@
 {
   imports = [
     ./hardware-configuration.nix
-    top.nix-hardware.nixosModules.framework-11th-gen-intel
+    top.nix-hardware.nixosModules.framework-intel-core-ultra-series1
   ];
 
-  age.secrets = {
-    compose-attic.file = ../../../secrets/compose/attic.env.age;
-  };
-
   boot = {
     loader = {
       systemd-boot = {

hosts/unstable/genesis/networking.nix

@@ -130,7 +130,7 @@ in
         lib.mapAttrs
           (domain: net: {
             master = true;
-            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
+            file = makeZoneFile (lib'.hostsByNet net (metadata.hosts // metadata.external)) domain;
           })
           {
             "shire-zebra.ts.net" = "tailscale";

hosts/unstable/hermes/default.nix

@@ -1,161 +0,0 @@
-{
-  config,
-  modulesPath,
-  lib,
-  top,
-  ...
-}:
-{
-  imports = [
-    (modulesPath + "/virtualisation/proxmox-lxc.nix")
-    top.hermes.nixosModules.default
-  ];
-  age.secrets.hermes = {
-    file = ../../../secrets/hermes.age;
-    owner = "hermes";
-  };
-  greg = {
-    nebula = {
-      enable = true;
-      nebulaIp = "10.157.0.8";
-    };
-    nix.cache = false;
-    proxies = lib.genAttrs' [ "thehellings.lan" "nebula.thehellings.com" "shire-zebra.ts.net" ] (
-      name:
-      (lib.nameValuePair "${config.networking.hostName}.${name}" { target = "http://127.0.0.1:9119"; })
-    );
-  };
-  nix.settings = {
-    sandbox = false;
-  };
-  proxmoxLXC = {
-    manageHostName = true;
-    manageNetwork = false;
-    privileged = true;
-  };
-  services = {
-    fstrim.enable = false;
-    hermes-agent = {
-      enable = true;
-      addToSystemPackages = true;
-      environment = {
-        MATRIX_HOMESERVER = "https://thehellings.com";
-      };
-      environmentFiles = [
-        config.age.secrets.hermes.path
-      ];
-      settings = {
-        agent = {
-          reasoning_effort = "medium";
-          reasoning_overrides = {
-            claude-fable = "xhigh";
-            claude-opus = "high";
-          };
-          tool_loop_guardrails = {
-            hard_stop_enabled = true;
-            warnings_enabled = true;
-          };
-          tool_use_enforcement = "auto";
-        };
-        code_execution = {
-          mode = "strict";
-          timeout = 300;
-        };
-        compression = {
-          enabled = true;
-          protect_first_n = 3;
-          protect_last_n = 5;
-          target_ratio = 0.25;
-          threshold = 0.75;
-        };
-        context_file_max_chars = 25000;
-        file_read_max_chars = 100000;
-        goals = {
-          max_turns = 20; # Number of times Hermes tells the model to keep working towards the goal
-        };
-        matrix = {
-          allowed_users = [
-            "@greg:thehellings.com"
-          ];
-          allowed_rooms = [
-            "!agents:thehellings.com"
-          ];
-          free_response_rooms = [
-            "!agents:thehellings.com"
-          ];
-          require_mention = true;
-        };
-        memory = {
-          memory_enabled = true;
-          user_profile_enabled = true;
-          write_approval = true;
-        };
-        model.default = "anthropic/claude-opus-4.8";
-        quick_commands = {
-          disk = {
-            type = "exec";
-            command = "df -h";
-          };
-          free = {
-            type = "exec";
-            command = "free -h";
-          };
-          restart = {
-            type = "alias";
-            target = "/gateway restart";
-          };
-        };
-        skills = {
-          guard_agent_created = true;
-          write_approval = true;
-        };
-        stt = {
-          enabled = true;
-          echo_transcripts = true;
-          provider = "local";
-          local.model = "medium";
-        };
-        terminal = {
-          backend = "local";
-        };
-        tool_output = {
-          max_bytes = 50000;
-          max_lines = 2000;
-          max_line_length = 2000;
-        };
-        toolsets = [ "all" ];
-        worktree = true; # Enable multiple agents in the same repo
-      };
-    };
-    nebula.networks."nebula.thehellings.com" = {
-      tun.disable = true;
-    };
-    openssh = {
-      enable = true;
-      openFirewall = true;
-      settings = {
-        PermitRootLogin = "yes";
-        PasswordAuthentication = true;
-        PermitEmptyPasswords = "yes";
-      };
-    };
-    wyoming.faster-whisper.servers.medium = {
-      enable = true;
-      device = "cpu";
-      initialPrompt = ''
-        The user's name is 'Greg Hellings'. The street he lives on is 'Kardinal Court'
-        in 'Midlothian'. Keep these in mind as they are often misspelled.
-      '';
-      language = "en";
-      model = "medium";
-      uri = "tcp://127.0.0.1:10300";
-      sttLibrary = "faster-whisper";
-    };
-  };
-
-  systemd.suppressedSystemUnits = [
-    "dev-mqueue.mount"
-    "sys-kernel-debug.mount"
-    "sys-fs-fuse-connections.mount"
-  ];
-}

hosts/unstable/icdm-root/boot.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  # Bootloader.
-  boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/sda";
-    };
-  };
-}

hosts/unstable/icdm-root/default.nix

@@ -1,28 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ pkgs, ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ./boot.nix
-    ./filesystem.nix
-    ./location.nix
-    ./networking.nix
-    ./wiki.nix
-  ];
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.greg = {
-    isNormalUser = true;
-    description = "Gregory Hellings";
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-    ];
-    packages = with pkgs; [ ];
-  };
-}

hosts/unstable/icdm-root/filesystem.nix

@@ -1,13 +0,0 @@
-{ ... }:
-
-let
-in
-{
-  fileSystems."serve" = {
-    #device = "10.42.1.4:/volume1/icdm-mysql/";
-    #fsType = "nfs";
-    device = "/dev/sdb1";
-    fsType = "auto";
-    mountPoint = "/srv";
-  };
-}

hosts/unstable/icdm-root/hardware-configuration.nix

@@ -1,53 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
-    fsType = "btrfs";
-    options = [ "subvol=@" ];
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
-    fsType = "ext4";
-  };
-
-  fileSystems."/var" = {
-    device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
-    fsType = "btrfs";
-  };
-
-  swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/unstable/icdm-root/location.nix

@@ -1,15 +0,0 @@
-{ ... }:
-
-{
-  # Set your time zone.
-  time.timeZone = "America/Chicago";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  # Configure keymap in X11
-  services.xserver.xkb = {
-    layout = "us";
-    variant = "";
-  };
-}

hosts/unstable/icdm-root/networking.nix

@@ -1,63 +0,0 @@
-{ ... }:
-let
-  dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
-in
-{
-  # If we have to do proxying in Bayonnais, we can start to work on that here
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-  networking = {
-    hostName = "icdm-root";
-    useDHCP = false;
-    defaultGateway = "10.42.1.1";
-    nameservers = [
-      "100.100.100.100"
-      "10.42.1.2"
-    ];
-    enableIPv6 = false;
-
-    interfaces = {
-      eno1.ipv4.addresses = [
-        {
-          address = "10.42.101.1";
-          prefixLength = 16;
-        }
-        {
-          address = "10.77.1.2";
-          prefixLength = 16;
-        }
-      ];
-    };
-    # Allow traffic through
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 53 ];
-      allowedUDPPorts = [
-        53
-        67
-      ];
-    };
-
-    extraHosts = "${dnsHosts}";
-  };
-
-  services.dnsmasq = {
-    enable = true;
-    settings = {
-      domain = "icdm.lan";
-      dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
-      dhcp-option = [
-        "eno1,option:router,10.77.1.1"
-        "eno1,option:dns-server,10.77.1.2,1.1.1.1"
-        "eno1,option:domain-search,icdm.lan"
-      ];
-      expand-hosts = true;
-      log-dhcp = true;
-      log-queries = true;
-      # Upstream servers
-      server = [
-        "1.1.1.1"
-        "8.8.4.4"
-      ];
-    };
-  };
-}

hosts/unstable/icdm-root/wiki.nix

@@ -1,17 +0,0 @@
-{ pkgs, ... }:
-let
-  wikiHost = "wiki.icdm.lan";
-  kiwixport = 8080;
-in
-{
-  services.kiwix-serve = {
-    enable = true;
-    port = kiwixport;
-    library = {
-      inherit (pkgs) zim;
-    };
-  };
-
-  greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
-  networking.firewall.allowedTCPPorts = [ 80 ];
-}

hosts/unstable/jeremiah/default.nix

@@ -88,6 +88,7 @@ in
       priority = 254;
     };
     nebula.enable = true;
+    proxies."buildbot.nebula.thehellings.com".target = "http://buildbot.nebula.thehellings.com:8010/";
     tailscale = {
       enable = true;
       tags = [ "home" ];
@@ -142,12 +143,12 @@ in
             updateOutputs = false;
           };
         };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
+        domain = "buildbot.nebula.thehellings.com:8010";
         evalMaxMemorySize = 8192;
         evalWorkerCount = 4;
         gitea = {
           enable = true;
-          instanceUrl = "https://gitea.shire-zebra.ts.net";
+          instanceUrl = "https://src.thehellings.com";
           oauthId = "7ec9107d-379b-47c8-870f-1191956d0500";
           oauthSecretFile = config.age.secrets.gitea-oauthSecret.path;
           tokenFile = config.age.secrets.gitea-oauthToken.path;
@@ -155,7 +156,7 @@ in
           webhookSecretFile = config.age.secrets.gitea-webhookSecret.path;
         };
         showTrace = true;
-        #webhookBaseUrl = "http://${config.networking.hostName}.shire-zebra.ts.net:8010";
+        #webhookBaseUrl = "http://${config.networking.hostName}.nebula.thehellings.com:8010";
         workersFile = config.age.secrets.gitea-buildbotWorkersFile.path;
       };
       worker = {

hosts/unstable/proxmoxtemplate/default.nix

@@ -1,60 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ pkgs, ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-  ];
-
-  # Bootloader.
-  boot.loader = {
-    systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-  ];
-
-  greg = {
-    home = true;
-    tailscale = {
-      enable = true;
-      tags = [ "home" ];
-    };
-  };
-
-  networking = {
-    hostName = "proxmoxtemplate"; # Define your hostname.
-    # defaultGateway = {
-    #   address = " 10.42.1.2";
-    #   interface = "enp6s18";
-    # };
-    # interfaces = {
-    #   enp6s18 = {
-    #     ipv4.addresses = [
-    #       {
-    #         address = "10.42.1.8";
-    #         prefixLength = 16;
-    #       }
-    #     ];
-    #   };
-    # };
-    nameservers = [ "10.42.1.5" ];
-  };
-
-  services.qemuGuest.enable = true;
-
-  system.stateVersion = "24.11"; # Did you read the comment?
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.greg = {
-    isNormalUser = true;
-    description = "Greg Hellings";
-    extraGroups = [ "wheel" ];
-    packages = with pkgs; [ ];
-  };
-}

hosts/unstable/proxmoxtemplate/hardware-configuration.nix

@@ -1,50 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "uhci_hcd"
-    "ehci_pci"
-    "ahci"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/7115-EFA6";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
-}

modules/nixos/kubernetes.nix

@@ -15,6 +15,8 @@ let
     sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
   };
   keepaliveIp = "10.42.5.1";
+  nebulaName = "k3s.nebula.thehellings.com";
+  nebulaIp = "10.157.100.1";
 in
 {
   options.greg = {
@@ -44,6 +46,13 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.greg.nebula.enable;
+        message = "Configure Nebula for this host, first";
+      }
+    ];
+
     age.secrets = {
       bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
       dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -97,6 +106,8 @@ in
           "--tls-san ${config.networking.hostName}.thehellings.lan"
           "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
           "--tls-san ${keepaliveIp}"
+          "--tls-san ${nebulaName}"
+          "--tls-san ${nebulaIp}"
         ];
         manifests = {
           cert-manager.source = cert-manager;
@@ -112,20 +123,37 @@ in
       keepalived = {
         enable = true;
         openFirewall = true;
-        vrrpInstances.kubernetes = {
-          interface = cfg.vipInterface;
-          priority = cfg.priority;
-          state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
-          virtualIps = [
-            {
-              addr = "${keepaliveIp}/16";
-              dev = cfg.vipInterface;
-            }
-          ];
-          virtualRouterId = 77;
-          extraConfig = ''
-            advert_int 1
-          '';
+        vrrpInstances = {
+          kubernetes = {
+            interface = cfg.vipInterface;
+            priority = cfg.priority;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${keepaliveIp}/16";
+                dev = cfg.vipInterface;
+              }
+            ];
+            virtualRouterId = 77;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
+          k3s-nebula = {
+            interface = "nebula0";
+            priority = 1;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${nebulaIp}/16";
+                dev = "nebula0";
+              }
+            ];
+            virtualRouterId = 78;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
         };
       };
       openiscsi = {

network.json

@@ -13,13 +13,6 @@
       "ip": "10.42.1.17",
       "system": "x86_64-linux"
     },
-    "chronicles": {
-      "ip": "10.42.1.4",
-      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
-      "external": true,
-      "ts": "100.119.228.115",
-      "aliases": ["s3"]
-    },
     "exodus": {
       "ip": null,
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3",
@@ -35,15 +28,6 @@
       "tags": ["router", "server"],
       "nebulaIp": "10.157.0.2"
     },
-    "hermes": {
-      "external": true,
-      "ip": "10.42.1.18",
-      "mac": "BC:24:11:E4:72:AB",
-      "nebulaIp": "10.157.0.8",
-      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
-      "system": "x86_64-linux",
-      "tags": ["server"]
-    },
     "hosea": {
       "ip": "10.42.1.7",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
@@ -52,10 +36,6 @@
       "tags": ["server"],
       "nebulaIp": "10.157.0.3"
     },
-    "icdm-root": {
-      "external": true,
-      "system": "x86_64-linux"
-    },
     "isaiah": {
       "builder": true,
       "ip": "10.42.1.6",
@@ -76,6 +56,7 @@
       "user": "gregory.hellings"
     },
     "jeremiah": {
+      "aliases": [ "buildbot" ],
       "builder": true,
       "ip": "10.42.1.8",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0",
@@ -85,11 +66,6 @@
       "tags": ["builder", "kube", "server"],
       "nebulaIp": "10.157.0.5"
     },
-    "joel": {
-      "external": true,
-      "ip": "10.42.0.4",
-      "ts": null
-    },
     "gregs-MacBook-Pro-16-inch-Nov-2024": {
       "external": true,
       "system": "aarch64-darwin"
@@ -118,58 +94,10 @@
       "external": true,
       "system": "aarch64-darwin"
     },
-    "nas1": {
-      "aliases": [ "*.nas1" ],
-      "external": true,
-      "ip": "10.42.1.14",
-      "ts": "100.114.187.61"
-    },
     "nixos": {
       "external": true,
       "system": "x86_64-linux"
     },
-    "printer": {
-      "external": true,
-      "ip": "10.42.1.3"
-    },
-    "proxmoxtemplate": {
-      "external": true,
-      "system": "x86_64-linux"
-    },
-    "pve2": {
-      "external": true,
-      "ip": "10.42.1.15",
-      "system": "x86_64-linux"
-    },
-    "pve2bmc": {
-      "derp": "10.42.2.129",
-      "external": true,
-      "mac": "00:25:90:4b:34:e8",
-      "ip": "10.42.6.2",
-      "system": "ipmi"
-    },
-    "pve3": {
-      "external": true,
-      "ip": "10.42.1.16",
-      "system": "x86_64-linux"
-    },
-    "pve3bmc": {
-      "derp": "10.42.2.181",
-      "external": true,
-      "ip": "10.42.6.3",
-      "mac": "00:25:90:4a:dc:2e",
-      "system": "ipmi"
-    },
-    "pve4": {
-      "external": true,
-      "ip": "10.42.1.17",
-      "system": "x86_64-linux"
-    },
-    "pve4bmc": {
-      "external": true,
-      "ip": "10.42.6.4",
-      "system": "ipmi"
-    },
     "wsl": {
       "external": true,
       "system": "aarch64-linux"
@@ -184,5 +112,56 @@
       "tags": ["builder", "kube", "server"],
       "nebulaIp": "10.157.0.6"
     }
+  },
+  "external": {
+    "chronicles": {
+      "ip": "10.42.1.4",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
+      "ts": "100.119.228.115",
+      "aliases": ["s3"]
+    },
+    "hermes": {
+      "ip": "10.42.1.18",
+      "mac": "BC:24:11:E4:72:AB",
+      "nebulaIp": "10.157.0.8",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
+      "tags": ["server"]
+    },
+    "joel": {
+      "ip": "10.42.0.4"
+    },
+    "k3s": {
+      "aliases": [ "*.k3s" ],
+      "ip": "10.42.5.1",
+      "nebulaIp": "10.157.100.1"
+    },
+    "nas1": {
+      "aliases": [ "*.nas1" ],
+      "ip": "10.42.1.14",
+      "ts": "100.114.187.61"
+    },
+    "printer": {
+      "ip": "10.42.1.3"
+    },
+    "pve2": {
+      "ip": "10.42.1.15"
+    },
+    "pve2bmc": {
+      "ip": "10.42.6.2",
+      "mac": "00:25:90:4b:34:e8"
+    },
+    "pve3": {
+      "ip": "10.42.1.16"
+    },
+    "pve3bmc": {
+      "ip": "10.42.6.3",
+      "mac": "00:25:90:4a:dc:2e"
+    },
+    "pve4": {
+      "ip": "10.42.1.17"
+    },
+    "pve4bmc": {
+      "ip": "10.42.6.4"
+    }
   }
 }

pkgs/default.nix

@@ -16,12 +16,15 @@ let
     adblock_update = c ./adblock_update.nix { };
     brew = c ./homebrew.nix { };
     create_ssl = c ./create_ssl.nix { };
-    dockerCompat = pkgs.runCommand "docker-compat" {
-      nativeBuildInputs  = [];
-    } ''
-      mkdir -p $out/bin
-      ln -s ${pkgs.podman}/bin/podman $out/bin/docker
-    '';
+    dockerCompat =
+      pkgs.runCommand "docker-compat"
+        {
+          nativeBuildInputs = [ ];
+        }
+        ''
+          mkdir -p $out/bin
+          ln -s ${pkgs.podman}/bin/podman $out/bin/docker
+        '';
     gcc-tune = c ./gcc-tune.nix { };
     #gen-build = c ./gen-build { };
     hms = c ./hms { };
@@ -29,6 +32,7 @@ let
     inject = c ./inject.nix { };
     setup-ssh = c ./setup-ssh { };
     upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
+    zim-updater = c ./zim/updater.nix { };
   };
   x86Linux = {
     qemu-hook = c ./qemu-hook.nix { };

pkgs/zim/blobs.json

@@ -2,18 +2,18 @@
   "en": {
     "gutenberg": {
       "name": "gutenberg_en_all",
-      "version": "2023-08",
-      "hash": "sha256-OXmdHdsLZcW4nCUQsy7sMpUssS8NV7ztkCgS/nsISuw="
+      "version": "2025-11",
+      "hash": "sha256-AWd8jVVKHKssv9AgrJnryn3Wx0084NE/JmorpgPfryg="
     },
     "phet": {
       "name": "phet_en_all",
-      "version": "2025-03",
-      "hash": "sha256-ARuUzU2o17J2/ZedHc2acXl33dtHCbQJEb72UQUEm1Y="
+      "version": "2026-05",
+      "hash": "sha256-zAAq/X5rjQUiYmjMpBtWP5z3J2ZHJMmIxFKnxLAhOlA="
     },
     "wikibooks": {
       "name": "wikibooks_en_all_maxi",
-      "version": "2025-10",
-      "hash": "sha256-ONBh/ze1Fv2Ffm5b9vDzYS/i2cWSa4pM4MLZnozr2n8="
+      "version": "2026-04",
+      "hash": "sha256-wt7Zr+RkfCsFrOudMCYBADacu6IvPQDkZ6Y0VG2j9hA="
     },
     "wikipedia": {
       "name": "wikipedia_en_all_maxi",
@@ -22,40 +22,40 @@
     },
     "wikisource": {
       "name": "wikisource_en_all_maxi",
-      "version": "2025-11",
-      "hash": "sha256-p1Jio+PMTZVSLIDIOBeMG3acXJg83CwQM7zIWDUyozM="
+      "version": "2026-05",
+      "hash": "sha256-OA4b+U8mxpcX3fst6hrMyctucYTQOlG/b4qZDiVlcf4="
     },
     "wikiversity": {
       "name": "wikiversity_en_all_maxi",
-      "version": "2025-11",
-      "hash": "sha256-IG/gAUdc/vHRrIWGHhw8vMJdLWwqrNbfh+SiclQRIAI="
+      "version": "2026-05",
+      "hash": "sha256-8mZ1CSUcF4QnDIyN0M2KedQ4pcSUCmzHBlOm93MYpCE="
     },
     "wiktionary": {
       "name": "wiktionary_en_all_nopic",
-      "version": "2025-09",
-      "hash": "sha256-Ghcb60qeGaSJtTKQkJoMx/XucX7Lt1XY145lD3gHlMg="
+      "version": "2026-05",
+      "hash": "sha256-Dwiz+viVQt0zb077R9KQRgtUtxG9ixA/DeXAkCdD4rM="
     }
   },
   "fr": {
     "gutenberg": {
       "name": "gutenberg_fr_all",
-      "version": "2025-10",
-      "hash": "sha256-gLHxLXJNwwcxM/mZHtoJ8ojbGQ1fugxgni/+RXccwhU="
+      "version": "2026-01",
+      "hash": "sha256-sGn1TeKwBK0+Er5YOJWq6g0itEm4gIGvKxv/PW0DIao="
     },
     "phet": {
       "name": "phet_fr_all",
-      "version": "2025-03",
-      "hash": "sha256-CSboZNTIowLLhp1u9wkxH8xmu3LvQNx5q493AOYJRIc="
+      "version": "2026-05",
+      "hash": "sha256-bJmchFnaPcofE/hy3ZcRggMT9osHqXwLbwMLJ+cpF28="
     },
     "wikibooks": {
       "name": "wikibooks_fr_all_maxi",
-      "version": "2025-09",
-      "hash": "sha256-KHCc/73L5Bd9iZ47SRV6vpI8fVM1v9hk1TpEvTro2uo="
+      "version": "2026-07",
+      "hash": "sha256-csI+E5UFGi42BLGWWHxQhVr5KSihCFc53KGKwo557Ck="
     },
     "wikipedia": {
       "name": "wikipedia_fr_all_maxi",
-      "version": "2025-06",
-      "hash": "sha256-ve7Mbh96/ObNbV/KVNYZpfLN+HdWlJ7C5LItEdVkRH0="
+      "version": "2026-05",
+      "hash": "sha256-YUAbGzYYr+c2RQqGjHIF9XL1kNsxDgRKnHK1H7/PtDE="
     },
     "wikisource": {
       "name": "wikisource_fr_all_maxi",
@@ -64,25 +64,25 @@
     },
     "wikiversity": {
       "name": "wikiversity_fr_all_maxi",
-      "version": "2025-09",
-      "hash": "sha256-55fdtw/cRezq6nkRp6wuwkukBiqsQKdwh9QWVAgFcBI="
+      "version": "2026-05",
+      "hash": "sha256-nVDHtkWIOJkoiGixnA1zVR1QS58thjc12FJyagK3Ec0="
     },
     "wiktionary": {
       "name": "wiktionary_fr_all_nopic",
-      "version": "2025-11",
-      "hash": "sha256-P0CJptee5rDzccxyRDBzyRLuuFOcaLsJYi6DkBFUfIc="
+      "version": "2026-05",
+      "hash": "sha256-7UXByW2IIL0hec8RPT39jpg5IEGvRMD47hc4Y4vFkJs="
     }
   },
   "ht": {
     "phet": {
       "name": "phet_ht_all",
-      "version": "2025-03",
-      "hash": "sha256-bHrPzE8H7ptrP6r5wPlXSsXNlTiKxJ9KatABC4kwx+s="
+      "version": "2026-05",
+      "hash": "sha256-GiJ1jllhioyMYidQ7+Lcbdd9JN2yf04ZQgnO8XaGAqY="
     },
     "wikipedia": {
       "name": "wikipedia_ht_all_maxi",
-      "version": "2026-04",
-      "hash": "sha256-qUX0pKxIyNsWX4V6kNIsP4Z9nc6TDhwdDR0MmpDOQFs="
+      "version": "2026-07",
+      "hash": "sha256-InS9cMRaIv9ArlKVwKUypz56m4DgSR7Tl6XpSTMzH+o="
     }
   }
 }

pkgs/zim/updater.go

@@ -9,7 +9,7 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
-	"path/filepath"
+	"reflect"
 	"regexp"
 	"sort"
 	"strings"
@@ -17,27 +17,144 @@ import (
 
 const BASE = "https://download.kiwix.org/zim"
 
-func getTypes() []string {
-	return []string{
-		"phet",
-		"wikipedia",
-		"wiktionary",
-		"wikiversity",
-		"wikisource",
-		"wikibooks",
-		"gutenberg",
-		"ted",
+// ///////////////////////////////////////////////////////////////////////////
+// ////////////////  THE BLOB ITSELF /////////////////////////////////////////
+// ///////////////////////////////////////////////////////////////////////////
+type Blobs struct {
+	En    Language `json:"en"`
+	Fr    Language `json:"fr"`
+	Ht    Language `json:"ht"`
+	dirty bool
+}
+
+func (b *Blobs) Populate() {
+	done := make(chan bool)
+	waitFor := 0
+	// Launch self-populating efforts
+	blobType := reflect.Indirect(reflect.ValueOf(b)).Type()
+	for f := range blobType.Fields() {
+		if f.IsExported() {
+			//fmt.Printf("%s:\tBeginning population efforts\n", f.Name)
+			waitFor += 1
+			go reflect.Indirect(reflect.ValueOf(b)).
+				FieldByName(f.Name).
+				Addr().
+				Interface().
+				(*Language).
+				Populate(strings.ToLower(f.Name), done)
+		}
+	}
+	// Wait until all languages are completed
+	for d := range done {
+		waitFor -= 1
+		if waitFor == 0 {
+			fmt.Println("Completed waiting for all languages")
+			close(done)
+			break
+		}
+		b.dirty = b.dirty || d
 	}
 }
 
-func getLanguages() []string {
-	return []string{
-		"ht",
-		"en",
-		"fr",
+/////////////////////////////////////////////////////////////////////////////
+//////////////////////// The Language ///////////////////////////////////////
+/////////////////////////////////////////////////////////////////////////////
+
+type Language struct {
+	Gutenberg   *Zim `json:"gutenberg,omitempty"`
+	Phet        *Zim `json:"phet,omitempty"`
+	Ted         *Zim `json:"ted,omitempty"`
+	Wikibooks   *Zim `json:"wikibooks,omitempty"`
+	Wikipedia   *Zim `json:"wikipedia,omitempty"`
+	Wikisource  *Zim `json:"wikisource,omitempty"`
+	Wikiversity *Zim `json:"wikiversity,omitempty"`
+	Wiktionary  *Zim `json:"wiktionary,omitempty"`
+	dirty       bool
+}
+
+func (l *Language) Populate(code string, done chan bool) {
+	childDone := make(chan bool)
+	waitFor := 0
+	languageType := reflect.Indirect(reflect.ValueOf(l)).Type()
+	l.dirty = false
+	for f := range languageType.Fields() {
+		if f.IsExported() {
+			ptrPtrZim := reflect.Indirect(reflect.ValueOf(l)).
+			    FieldByName(f.Name)
+			if ptrPtrZim.IsValid() && !ptrPtrZim.IsNil() {
+				waitFor += 1
+				go reflect.Indirect(ptrPtrZim).
+				    Addr().
+				    Interface().
+				    (*Zim).
+				    Populate(strings.ToLower(f.Name), code, childDone)
+			} else {
+				// TODO: Figure out how to set a value over the nil pointer
+				// of the field, so we can auto-detect when these are available
+				// in the future
+				// waitFor += 1
+				//z := &Zim{Name: f.Name, Version: "1999-01-01", Hash: ""}
+				//ptrPtrZim.Set(reflect.ValueOf(z))
+				//go z.Populate(strings.ToLower(f.Name), code, childDone)
+			}
+		}
+	}
+	// Wait until children are all done
+	for d := range childDone {
+		waitFor -= 1
+		if waitFor == 0 {
+			close(childDone)
+			break
+		}
+		l.dirty = l.dirty || d
+	}
+
+	//fmt.Printf("%s\tFinished populate\n", code)
+	done <- l.dirty
+}
+
+// ///////////////////////////////////////////////////////////////////////////
+// ////////////////////// A Single Zim ///////////////////////////////////////
+// ///////////////////////////////////////////////////////////////////////////
+type Zim struct {
+	Name    string `json:"name"`
+	Version string `json:"version"`
+	Hash    string `json:"hash"`
+	dirty   bool
+}
+
+func (z *Zim) Populate(category string, language string, done chan bool) {
+	//fmt.Printf("%s:%s\tBeginning populate for\n", language, category)
+	// Look for a possible Zim file
+	links := getLinks(getPage(category))
+	link, err := getName(links, category, language)
+	if err != nil {
+		fmt.Printf("%s:%s\tNo zim found\n", language, category)
+		done <- false
+		return
+	}
+	//fmt.Printf("%s:%s\tFound link: %s\n", category, language, link)
+	// Extract name and version
+	re := regexp.MustCompilePOSIX("^([a-zA-Z_]+)_([0-9-]+)\\.zim$")
+	match := re.FindStringSubmatch(link)
+	if len(match) != 3 {
+		fmt.Printf("%s:%s Matches: %s", language, category, match)
+		os.Exit(1)
+	}
+	// Check if the name and version mismatch
+	if match[1] == z.Name && match[2] == z.Version {
+		fmt.Printf("Skipping existing hash: %s\n", link)
+		done <- false
+	} else {
+		z.Name = match[1]
+		z.Version = match[2]
+		// Fetch the Zim file, if it differs from what we currently have
+		z.UpdateHash(category)
+		done <- true
 	}
 }
 
+// Helper function to fetch the HTML of a given type page
 func getPage(t string) string {
 	page, err := http.Get(fmt.Sprintf("%s/%s/", BASE, t))
 	if err != nil {
@@ -48,6 +165,7 @@ func getPage(t string) string {
 	return string(pageBytes)
 }
 
+// Helper function to parse out all the links from the page
 func getLinks(page string) []string {
 	ret := []string{}
 
@@ -60,6 +178,7 @@ func getLinks(page string) []string {
 	return ret
 }
 
+// Helper function to get the most likely link for this particular entry
 func getName(links []string, t, lang string) (string, error) {
 	candidates := []string{}
 	prefix := fmt.Sprintf("%s_%s_all", t, lang)
@@ -79,44 +198,39 @@ func getName(links []string, t, lang string) (string, error) {
 	}
 }
 
-func getHash(ch chan result, file, category, language string) {
-	// TODO: Only call this if the file doesn't already have a hash
-	// in the existing file
-	fmt.Printf("Fetching hash for %s\n", file)
-	cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
+// Helper function to get the hash value from the resulting link
+func (z *Zim) UpdateHash(category string) error {
+	file := fmt.Sprintf("%s_%s.zim", z.Name, z.Version)
+
+	// First fetch the file into our local Nix store
+	fmt.Printf("Fetching hash: %s\n", file)
+	cmd := exec.Command("nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
 	out, err := cmd.Output()
 	if err != nil {
-		fmt.Printf("Error fetching hash for %s (category: %s, language: %s): %v\n", file, category, language, err)
+		fmt.Printf("%s: ERROR fetching hash: %v\n", file, err)
 		if exitErr, ok := err.(*exec.ExitError); ok {
 			fmt.Printf("Command stderr: %s\n", string(exitErr.Stderr))
 		}
-		ch <- result{category, language, ""}
-		return
+		return errors.New("Error fetching file")
 	}
 	hash := strings.TrimSpace(string(out))
-	fmt.Printf("Successfully fetched hash for %s (category: %s, language: %s)\n", file, category, language)
-	ch <- result{category, language, hash}
-}
+	fmt.Printf("%s: Successfully fetched raw hash\n", file)
+	fmt.Printf("%s: Hash is: %s\n", file, hash)
 
-func outputIsValid(o map[string]map[string]Zim) bool {
-	for a := range o {
-		for b := range o[a] {
-			if o[a][b].Hash == "" {
-				return false
-			}
+	// Then, convert the hash to SRI
+	cmd2 := exec.Command("nix", "hash", "convert", "--to", "sri", hash, "--hash-algo", "sha256")
+	out2, err2 := cmd2.Output()
+	if err2 != nil {
+		fmt.Printf("%s: Error converting hash to SRI: %v\n", file, err)
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			fmt.Printf("%s: Command stderr: %s\n", file, string(exitErr.Stderr))
 		}
+		return errors.New("Error fetching file")
 	}
-	return true
-}
-
-type result struct {
-	category, language, hash string
-}
-
-type Zim struct {
-	Name string `json:"name"`
-	Version string `json:"version"`
-	Hash string `json:"hash"`
+	z.Hash = strings.TrimSpace(string(out2))
+	z.dirty = true
+	fmt.Printf("%s: Successfully convert hash to SRI: %s", file, out2)
+	return nil
 }
 
 func main() {
@@ -125,90 +239,31 @@ func main() {
 
 	// Determine the output file path
 	var outputPath string
-	if *outputFile != "" {
-		outputPath = *outputFile
-	} else {
-		// Get the directory where updater.go is located
-		execPath, err := os.Executable()
-		if err != nil {
-			// Fallback to current directory if we can't determine executable path
-			outputPath = "blobs.json"
-		} else {
-			dir := filepath.Dir(execPath)
-			outputPath = filepath.Join(dir, "blobs.json")
-		}
-	}
+	outputPath = *outputFile
 
 	fmt.Println("Writing file to ", outputPath)
 
 	// Read existing cache if it exists
-	cached := make(map[string]map[string]Zim)
+	var blobs Blobs
 	if data, err := os.ReadFile(outputPath); err == nil {
-		if err := json.Unmarshal(data, &cached); err != nil {
+		if err := json.Unmarshal(data, &blobs); err != nil {
 			fmt.Printf("Warning: could not parse existing cache file: %v\n", err)
 		} else {
 			fmt.Printf("Loaded existing cache from %s\n", outputPath)
 		}
+	} else {
+		fmt.Printf("Error reading file: %s", err)
+		os.Exit(1)
 	}
+	blobs.Populate()
 
-	output := make(map[string]map[string]Zim)
-	comms := make(chan result)
-	pendingHashes := 0
-
-	for _, t := range getTypes() {
-		page := getPage(t)
-		links := getLinks(page)
-		for _, lang := range getLanguages() {
-			if file, err := getName(links, t, lang); err == nil {
-				if _, ok := output[lang]; !ok {
-					output[lang] = make(map[string]Zim)
-				}
-
-				// Check if this file already exists in cache with same name
-				if cachedLang, ok := cached[lang]; ok {
-					if cachedEntry, ok := cachedLang[t]; ok && cachedEntry.Name == file {
-						// Reuse cached hash
-						fmt.Printf("Using cached hash for %s (category: %s, language: %s)\n", file, t, lang)
-						output[lang][t] = cachedEntry
-						continue
-					}
-				}
-
-				// File is new or name has changed, fetch hash
-				output[lang][t] = Zim{file, ""}
-				pendingHashes++
-				go getHash(comms, file, t, lang)
-			}
-		}
-	}
-
-	// Only wait for results if we actually spawned goroutines
-	if pendingHashes > 0 {
-		hashesReceived := 0
-		for r := range comms {
-			if entry, ok := output[r.language][r.category]; ok {
-				entry.Hash = r.hash
-				output[r.language][r.category] = entry
-			}
-			hashesReceived++
-			if hashesReceived >= pendingHashes {
-				close(comms)
-				break
-			}
-		}
-	}
-
-	// Verify all hashes are present
-	if !outputIsValid(output) {
-		fmt.Println("Warning: Some hashes are missing from the output")
-	}
-	ret, err := json.MarshalIndent(output, "", "  ")
+	ret, err := json.MarshalIndent(&blobs, "", "  ")
 	if err != nil {
 		fmt.Printf("Error marshaling JSON: %v\n", err)
 		os.Exit(1)
 	}
 
-	err = os.WriteFile(outputPath, ret, 0644)
+	err = os.WriteFile(outputPath, []byte(fmt.Sprintf("%s\n", ret)), 0644)
 	if err != nil {
 		fmt.Printf("Error writing to file %s: %v\n", outputPath, err)
 		os.Exit(1)

secrets/acme_password.age

@@ -1,39 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg cU4X1qZK41KRZ0pQvjGaVNDslGG9qmf0WROZIsq3WTE
-fjJ4+eYXeuTts1ZPbaB5YzhPoHi6UGewDmlzrwOeOGs
--> ssh-ed25519 8UnW5Q Ror4AvYpT9lzfnr+LgNu3XZpRKIjocRRZHD7Zb1h5GE
-krvgjoP6tgHsEWQCWA9z2VbBdwR5TmAA+xLmXoBNUYI
--> ssh-ed25519 UFfTmg qFTu8meX/IPp8DsbMgBX9LNRbVAeW1ge1GjMsbZwI3I
-8YGOxIvbkC02Gy6TpPvxdAJkboB6RiXyMboDgY57HGw
--> ssh-ed25519 KbVVUw Ar4IGQSYFb+hIm8o3wI/9rgBgP4F2/W45YlUxsPnUCM
-tTPESO6d1pEumLGV+uew7IzqxdG9/EtGbb0vOfXtMRc
--> ssh-ed25519 xNtnoA 4HBphnFMeJPSTQO3/GI7phbhW98gNALrvY3lFgBshkU
-8adXWowmuIbNruPWNTE6x1Om2JstPUrUoaS97N+bhZI
--> ssh-ed25519 aY2AXA vmvo0o12q9meAnnAg+wDqDtkOTOFZ358ZrT5d62X2y4
-Y0qxZmOiqhBsQT5XfJtK0m47Z+dOO27bA4iWXDF1n3U
--> ssh-ed25519 AQhf1g p0Xv0K3xtwpNmfNN9lvQ39cZw8/G6ToDHdmWbuwk1yo
-Ds1oqffX9y+WzNsznWsF+/RUTNQkZzVW6Sw8X+vuoW4
--> ssh-ed25519 mOmPfg rfAZzFVagHhbeK3esrQ67i61HWicvMiwal09Di+3K1A
-fxjUJS+640QyJo/Bg44ci+imnc3nLKgUUKr28AjSpAE
--> ssh-ed25519 YJiRbw 75uSheAYHchkQg64z6mo9h5SbN7jJ+wRo/89ZAhHM0w
-xaBNhUzKhx4KKYEfu0v3av7fxge3r7Jgoym4SxAgx5U
--> ssh-ed25519 Nl/5yA W+9F2FObW6hlX7gdzXCcD+XxVJD+7zjcY6cwfg2c+nY
-QOZdYtwrlUqUh57lceLQNx4qPlFcQaak+p8w+xvm4Is
--> ssh-ed25519 GdLgCQ XtYujNgBU7VIYy4F5Sx8Lfma2eI8xObwsWlsTWVQ4nQ
-bj0pRWsqH3FxBwSv2cWuhLZSISY9BXK2yJT7K8lzc8Q
--> ssh-ed25519 tOH/HQ ij84H+oh2GuFQQ6u84ecs1DZWDE8PKiUo/5xShokJRg
-WKCqL+TyxHmtG4W2HqiuuBT7NWUL1X1YAkbHk7vPcTs
--> ssh-ed25519 FpzvfQ FVbQ4Pj1Gcxi0R1QrfNbOjJExDET9cf6HJGEf3xaMFo
-b721HyfPvlsd+yAYonnFUvb9a11/NJtwPX6RSqPsvnc
--> ssh-ed25519 2UotMw z2IdT+cIwDEpbzcdPSzZXfpYdPuShklqNfatDVLGSgM
-qM31ztK1C30tt09lQQcaP2B+k2NOxtkQBXcedx8xL5o
--> ssh-ed25519 kdPvzQ Ee7pccj9/YeQ+kUOpmDy0gHeCCNiVP8br954ZBoO+xY
-w4JmkNKb3vIvBRY6FdB1tpdCO/I0xyrnHL/99W5UYms
--> ssh-ed25519 onmXpg tPWNTbyC8ihTBwkj4xKPKgjONNE7X/By9064z2BEGyQ
-D6gjS7m3Dyk2BYhe5WjRAUFR3ayfsi4N6z0dklHFzWs
--> ssh-ed25519 CnhD0g SDxHr7dhCuF4DCu0PF0EgvmPDcTYOwleqkRw2I0F4xs
-WFzD7T2pQsDDwEovp6xpVXC1Uny9ImbrIuR5fSDLj1Y
--> ssh-ed25519 4ep2UA wmk4HIdMZ/3N9TB90WEJC9ZGXgSGPsN+4uo5P3LAwSs
-Y99wQAsjnHgOhAEGd5CzYUd+0WXA3QVvcmt8z68RR8o
---- UR17+b75zlMoHrIalvpAmdSegLhlbNIDnqZZBAI6LUo
-Þc™Úxä=EŸÂËpÖ\”eÜ)Ñ£{š´Íû®2p=FkÑeæîẠO␍nÈ€,ƒà´�¢Ž=ÌzƒnŠ>V|(Q

secrets/nebula/isaiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEac2MaYYEa668pYcgg4lMYGB2VakRFO6b
-K9vHSLzjZpuqhBVQ7MReOwUHQKyCIBv+1Lr/E3Q6d99laLGdXRTss2SIL4OGBp8z
-qqfEsAMpg0CyDSEYuL8GaHQq708GbCxhxFifCZaRTB+ReGBScmhT9XhIwSLHRRZJ
-1TmoY4QvrdPOS3NAWvlawk/JUqN7SWQL
+MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg
+dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx
+2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO
+71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ==
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/jeremiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRpzYxphgRrrrylhyCDiUxgYHZVqREU
-7psr28dIvONmm6qEFVDsxF47BQdArIIgHXr6BLGmqfF92GXiN6MBj3ac0p/EtNYf
-xR3/EdI5GnGDQIFxfV5fVwi26+IRk9QIFxyyFBtmsZyPbdxL8ca1WUPm3lCNA4BT
-Knd9Y3Zlp6L35L4/dzSqAVoXu2nlHF6SOAA=
+MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM
+YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi
+8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf
+IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/zeke.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGjoD2ABHpla2WhBwQFCp0ABhCFBGnNjGmGBGuuvKWHIIOJTGBgdlWpERTumyvb
-x0i842abqoQVUOzEXjsFB0CsgiCirKKbej7yAALn41C+MYmertD9LOv09gZ61ODF
-wEcnB4NAfix/r3q+XLYe3egKUoqJUW2i11x0ST0hxqhJUd8LjHKirRyHsvUraMbG
-c8x+CXsCPLgheGt548PpmrObQWtrBA==
+MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV
+qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58
+jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa
+DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8=
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/zeke.key.age

@@ -1,41 +1,35 @@
 age-encryption.org/v1
--> ssh-ed25519 87huqg 59/Hfejnlp8Qk6VTcVpsaB2su+p/LjxnXCI3+uoxeXs
-DW3LJMJ7nK3ySrDVrZTUhOCiDBujWh2ycGjpfMkddJw
--> ssh-ed25519 8UnW5Q 2ESBP1XYX71s9tlf1YC9lL+UmJPYjf5qiNNGUsEtnWU
-jWRnunZ2ub0QAvQaRznVGTIPIxHrzw8B620zFeZUx3Y
--> ssh-ed25519 UFfTmg Vs0zDRmw2scS8exINo2lBO1x2UqVXEElWFtCnGwrzWI
-SQM1l0GhHyDqzvykuyvR62XCeQPl/JaEttZJXFdvSFo
--> ssh-ed25519 KbVVUw WVNEfBAAEGP0O7vtL04/IaM9nCR57UJkTcT+96ZtaHQ
-3m/lb1USu6Vng2+4IEfXsdNwF4NMuVjZ5H/1+QUX4Q8
--> ssh-ed25519 xNtnoA cWYQoTMQmxpFPDCsj8AGOqxx4ErhHnsMiOgJJvhjBCI
-6GU/IeVZB1ECMAGYiL8tLPqgCuC2ujNcdSgzhOof7hI
--> ssh-ed25519 aY2AXA n1f3kFHxIvt5CbiBq6Vs32zoZEeYC5aBAZz5lCUEuxI
-OuFwQTJAdv2oMxzFbce6iqUa7SAu3aHMYU+D3L0gNbo
--> ssh-ed25519 AQhf1g hjjixHEYRom6XjHsIf2pMZvcMNxfeBw79+ApOheQezc
-/HvBy+L5eaz9NAShIeNfagE8LzamzxolD5ZIdapiyPA
--> ssh-ed25519 mOmPfg JJQYaT1ch0i4xeMrCVCgzq25dy7GhqNCHGXTd3syHCI
-4F+EQY7WbDJ8DwukaMelfYi9Q3LjYBpfhgCJVyXUtWI
--> ssh-ed25519 YJiRbw eFi1X3pmVVmkCDl8Jr+lIv2LeuSbMg6WqrpezABmOR8
-2arsXH0pdYxINujCFonHrqwEDVr4qR5ugXix8uu+cOk
--> ssh-ed25519 Nl/5yA ScYVPC1pyYkgweGi+hxQaXJ8UEnKta2VqbyHgSPTKCY
-CLiTEjJ6ylD3SlzrFHaz8yHaqc5KbCs3x3ij8Mgdnks
--> ssh-ed25519 GdLgCQ TQHucvsozqInbmCsh1GHZ2JF5pbUteT/W3XieSIfmj4
-Owq1wb9MdMD9pVJj24QCTvmkyh57Q2cKqfMRxj3ZFq4
--> ssh-ed25519 tOH/HQ KVKjt9GYmfcNOO7LTA1bypmtoYTYHgKWgD2dpD4zxUA
-VjlWDbSZp0NHC9VfRONz8UH2JtvIQWzqc7V/gJef/5A
--> ssh-ed25519 FpzvfQ gAlbAOE0Zz2A0391SyUKfLQDBt0+9HYPn54rG5HY/hM
-4t/wJ7L7yJvnFkdonsKTBFza+C7gXr8AI1PMEH58sO8
--> ssh-ed25519 2UotMw rrb5P6bPLUibtQ8Pkz533mQe65XA4DZOyw7B3GV6oHg
-Xs9cK2GZ3k2FgrHjIeB4DTe3gdahFFvS892siiAyEvI
--> ssh-ed25519 kdPvzQ JTPJpaE97otqsADN017u6dw2h9DWlD2NkwIyT5+b8yo
-QroD7owHZ4ThrVDBTJO3/wn6PK8wfrOwypjbjTxGkSM
--> ssh-ed25519 onmXpg QuQjNKosTocZ4y2KRvqMISezBbSll9ERKBTtKEVMIRs
-R0mgBtM2iZ6lcBzGC5hDz5G06G5O8FM2C1Vll2NW/Ag
--> ssh-ed25519 CnhD0g tSMysXdWjfmoBkVXD/wCIUEikjH7jiuEFlmrbfjIkmE
-xrkP8nl1nE+LvHA0vb1rOnQKNR/SB+KaqYBvJHDa3fs
--> ssh-ed25519 4ep2UA o1Vut8uttNV4+3DuZ67gURlGdnRittoON/xPE05i838
-03mFKfz89r0EKnY4tRL1zd9jKarZFW9TdX9nvvgAOTU
---- At7cFNjOg5E5WlaySJtqRZoK2/Gu+sXMI/cITd1SOKA
-〹Ýäöß6v’z³ªâ0{ŸÝšj& �úöw®ÂmÝeªEþ�ÒæÔ,|
-_ŽaÍDóº#qó]Lõã"íW ê(Ѷʹw¾µ¦˜ÕmÂÖ]O#
-T ô†•kÉ—gÜòrá]Þf¡T©_·‚Æö'¿•wÜ;Àƒ!N\¹¤¿g!TcØbê…7ëæïXmãLxã®þ‘ð
+-> ssh-ed25519 8UnW5Q E8Ki3oFCl3dLp9gxZ7/Ene8NMM26OVJ4PMJQQYQnBm0
+3rC3LMfdPCvSsiwaVnAb7VHwyw7KjZKcASdWm0lDg5E
+-> ssh-ed25519 UFfTmg 6q8nJbCIQe2IV/W/31OpuI6sZI833IbU+weSTU05Mng
+EgiGZwIN0oRjw9pAaHjypWtswBA1c5PCkNeN9K4YlT8
+-> ssh-ed25519 xNtnoA cyxa8uxevJ9VEaYLg2g9rewcAMhsZRAPEkzqd9k6ngE
+SedkkmBd4foxqB1MlCAkfIqO6ft5xnmLBa2cShzw/GI
+-> ssh-ed25519 aY2AXA biY7lFtfvr6vBv/XBhZ6Uh7Hpj+Du0NuEjo2RMp6USI
+5DgzmbEw5f6h4lHm7FlRZHXn4C9vCJ6IguXk7jZXxqM
+-> ssh-ed25519 AQhf1g e3g+IdnzmuJZj3H4LWdbZ8yaj5GM21zz3HCgkzFG5Cg
+oyzAIsqnL9ypSOCHINMu/+VM9TJeqgY9jLumhmAFIu8
+-> ssh-ed25519 mOmPfg o4pCs9ferfC6+OawWXsM5Wa/5q+4EN+lEg/diMrjVhQ
+H1gSB90UuJaivo2MhinPQGCV+rmSX1ZWazfhOxIDcaM
+-> ssh-ed25519 YJiRbw o33TjJkI7rc1DxXRMdgwoHfCqzU3sGd7BZo7Uw0I8iA
+/PiNDHyAl54HYszKkRzsjuoAZ53Ly1Oizf6NUIDB+I4
+-> ssh-ed25519 Nl/5yA FUycbaA303kvgINg9eNM53lN6aUXQPBxWz9liuhZ6Vo
+nNMPiq0w06WWfe73fpj/9ixunwgzZUCEi6pIKWuNWvQ
+-> ssh-ed25519 GdLgCQ sD2xKKzEyD7GsnFJCrDi40sJX0yBIXLr3pLx1R6RT1g
+ThDfA6T5/9cgAFKZPQtxGhKHdYOZx4sSQnoxzJMsLwc
+-> ssh-ed25519 tOH/HQ YeQfSV5UxsYAMEIOq1FNpkNcM4LEA8zvcbOceZ/26ws
+KMeeyObeOBmqxS6hqhVbDgvoB5jUJr8k21igT3rqoww
+-> ssh-ed25519 FpzvfQ GbT7exaVbqJNP7LdV/wyye89yXuN6FI20j7ckx5r5nI
+bNMqf7oY6NWVTPvVLOy+UpJKT0C9m6WunfdvMXCUZzk
+-> ssh-ed25519 2UotMw Zpco9IYJXyl9wIZo22g/kp/OjfClOtUP2in+N0hYX3o
+e68dEYPiNdlrSFaMTzvrhCz9/5V5zFAvrTnPtNSyI4c
+-> ssh-ed25519 kdPvzQ 2j64L6rV5b5+sbKbNAGf9+7uKLgdBpKNv9umHtSW4wY
+3y74VGUzKb9uhh3DvlkvZ5Jxtgfku7s1kDKrGDWUUvk
+-> ssh-ed25519 onmXpg 8GDMsteOopCnaaVkXAoRMbGuXeKoSqpyZhLvbnEWBQU
+X0HsZbpT4Wc/KO0TBwVSyjK6Zcbz1A34VCozNrMH4Lw
+-> ssh-ed25519 CnhD0g uHIeQtUwcDRXdJpFglJ12ptOPP64yMP6WKPz00sAQ0c
+yIKZNODIQSkNr4UilEHZzOBxeRA4G/sAbkppyOdUjkQ
+-> ssh-ed25519 4ep2UA k+cteVM7cMWQk7xDcCZgWlZxgA4ZBmUlbZHQFmMoi0Q
+YC2fptyb258arEdeOcPhCc3+z/vIgEElbqn2Ik3r2Lo
+--- NJ2uO0A/UbPrw+IgObiiXTwV75xgsWTjYvLpTwznDXM
+³B Ð-ø�`8nß=m5/s”zǼmÚÝØ
ˆ‚Sþ”ÖÍÆ œ¿Âõ&_¤WÛRpõß²“�=iG’FyÃEíІ¹¥èIñq:ö|-~$ò>ûÄbv~l­eè/ñd•V Ùˆq”ªÐ¾±¶
˜Â€ƒ•‰5¯ÝýŠÏ‚é|¸‘JÅí␍´£_£°l¯¬ñZ2°rìPÞ—p½‚.

secrets/secrets.nix

@@ -93,10 +93,6 @@ in
   "gitea/workerPassword.age".publicKeys = everyone;
   "gitea/runner-isaiah-podman.age".publicKeys = everyone;
 
-  "acme_password.age".publicKeys = everyone;
-  "ca/intermediate_key.age".publicKeys = everyone;
-  "ca/root_key.age".publicKeys = everyone;
-
   "minio_secret_access_key.age".publicKeys = everyone;
   "minio_access_key_id.age".publicKeys = everyone;