chore: update even farther

.gitea/workflows/update-zims.yaml

@@ -1,51 +0,0 @@
-name: Update zims pin
-
-"on":
-  schedule:
-    - cron: "0 2 1 * *"  # 0200 on the first of every month
-  workflow_dispatch:
-
-jobs:
-  update-flake-lock:
-    runs-on: nix-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Update flake.lock
-        run: nix run .#zim-updater -- --output pkgs/zim/blobs.json
-
-      - name: Create PR if changed
-        env:
-          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
-          GITEA_URL: https://src.thehellings.com
-          REPO: greg/nixos
-        run: |
-          if git diff --quiet pkgs/zim/blobs.json; then
-            echo "blobs.json unchanged, nothing to do"
-            exit 0
-          fi
-
-          BRANCH="auto/update-zims-$(date +%Y%m%d)"
-          git config user.email "klaatu@thehellings.com"
-          git config user.name "klaatu"
-          git checkout -b "$BRANCH"
-          git add pkgs/zim/blobs.json
-          git commit -m "chore: update zim blobs.json $(date +%Y-%m-%d)"
-
-          # Push branch using token auth
-          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
-          git push origin "$BRANCH"
-
-          # Create PR via Gitea API
-          curl -s -X POST \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
-            -d "{
-              \"title\": \"chore: update zims $(date +%Y-%m-%d)\",
-              \"head\": \"$BRANCH\",
-              \"base\": \"main\",
-              \"body\": \"Automated monthly zims update.\\n\\nGenerated by Gitea Actions.\",
-              \"assignees\": [\"greg\"]
-            }"

flake.lock

@@ -31,11 +31,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1785648274,
+        "lastModified": 1784438381,
-        "narHash": "sha256-25piX3cCXleOWo3L1TVc+/tNVDSDGctGTREcMKzp0KA=",
+        "narHash": "sha256-OuKnPzVTpGYaUQp/GjR7NFY8ezVRlR2V2CUxkHkI2UU=",
         "owner": "nix-community",
         "repo": "buildbot-nix",
-        "rev": "9a8ea9a47dfccbdf08d5a9cad7b99e6212d4027a",
+        "rev": "72e12f1a1381321e07279b18f3d401c29871b50e",
         "type": "github"
       },
       "original": {
@@ -53,11 +53,11 @@
         "stable": "stable"
       },
       "locked": {
-        "lastModified": 1785930890,
+        "lastModified": 1784448989,
-        "narHash": "sha256-QN4Oy1B4Vma9DiMyXiyssrpgMuIPgkNyO8jb6k2H4oY=",
+        "narHash": "sha256-XC0OkWCiTM91msCp0o7zfM+iBv06mLlCzFxkP8vf+ac=",
         "owner": "zhaofengli",
         "repo": "colmena",
-        "rev": "a156fd9146e69a577fe6f5542a7c6ed83a6888ce",
+        "rev": "e5eda626e459f7043868fd2e3b3bf8ce0d1992e6",
         "type": "github"
       },
       "original": {
@@ -95,11 +95,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785389976,
+        "lastModified": 1784500460,
-        "narHash": "sha256-0tLW8Ff5yt8AH97jw4ZpFJ0OCJ122zIlgWGDmOfU/VU=",
+        "narHash": "sha256-UvORnAxTRHax7RG74W8Z2t4GvIkX6AjJ5kk0QlwZomo=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "15abb8c98f336cd8bd840d71059adebabe60bf04",
+        "rev": "57a3171f94705599a2499248ca5758d5eb47c0e0",
         "type": "github"
       },
       "original": {
@@ -162,11 +162,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1785627969,
+        "lastModified": 1782949081,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -242,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786031233,
+        "lastModified": 1784913159,
-        "narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
+        "narHash": "sha256-JWq0BfjO4ktpH5USfQNQzdvHpIDT8fSKD5K7LvdMRFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7834e82588860aaf780cec1366524456a70898d7",
+        "rev": "079a3b5d1aa6a719920a51316253b7d6dd22738d",
         "type": "github"
       },
       "original": {
@@ -284,11 +284,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1786154692,
+        "lastModified": 1784949919,
-        "narHash": "sha256-+KyMg7tMfMcfFjUg59BD3OMUzehv9xsNK7ZMY3ZepGc=",
+        "narHash": "sha256-itGqjPYHqEUqabXbQb+eHguk1c6rBTRGZS4KImp45kM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "fad712d66c18a08c582214c3f52c3d12e0cc16f9",
+        "rev": "a58c1fa23ec0273eb085be1e7874e964aa3cd34f",
         "type": "github"
       },
       "original": {
@@ -303,11 +303,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1786014695,
+        "lastModified": 1784621916,
-        "narHash": "sha256-to1UGPixvqyQwl1UC05/e+o3MYiIJ1DZ6m48xovDsq0=",
+        "narHash": "sha256-JGjvWpNNrbhiYhx+z9l/iDw1J48TrirfZC6R3yWjmU4=",
         "owner": "Mic92",
         "repo": "niks3",
-        "rev": "76cb73a99911bef6a395cf331c36e6f4e620c6a9",
+        "rev": "abbc291d372d2d821327516b5f5224de03113204",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1785232496,
+        "lastModified": 1784723954,
-        "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
+        "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
+        "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
         "type": "github"
       },
       "original": {
@@ -373,11 +373,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1785031560,
+        "lastModified": 1782614948,
-        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -388,11 +388,11 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1785636265,
+        "lastModified": 1785031560,
-        "narHash": "sha256-trTbhoc8hhPiGVDpNGGYA4scDV/4d01iNH/cFemblEg=",
+        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "77a147ce329a5800bc001a45b356fad3397ee184",
+        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
         "type": "github"
       },
       "original": {
@@ -419,11 +419,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1785708545,
+        "lastModified": 1783978241,
-        "narHash": "sha256-Kx+ica895RPt90eYPC99xe54mKse9FmfbIVZV1rE+9E=",
+        "narHash": "sha256-7kK0Y/fIV2NTKArkd/eZGaFg+dEmgP8KDRsGK2vB5M4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ccdb97fdbee71215dbcff68dcab5ea9991020651",
+        "rev": "a8b81d3cc8d35af7bc98694696bea61ad4f8fca7",
         "type": "github"
       },
       "original": {
@@ -464,11 +464,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1786106723,
+        "lastModified": 1784796856,
-        "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "github"
       },
       "original": {
@@ -496,16 +496,16 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1785349197,
+        "lastModified": 1784796856,
-        "narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=",
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
-        "owner": "geri1701",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "af4902d1e79cbeade8e0d9e10e7a9ada4dce01b5",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "github"
       },
       "original": {
-        "owner": "geri1701",
+        "owner": "nixos",
-        "ref": "lego-v5-acme-spike",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -517,11 +517,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1785763201,
+        "lastModified": 1785001306,
-        "narHash": "sha256-wA373y/B9orM3HatLu9oS+Ke5lmdZyBl/bdjd2gLMq4=",
+        "narHash": "sha256-xWqmquUtqKXLeDZ1oQUO+rV4sjA9TShIJhLL8M5Bozo=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "c7be49306b23a952c0151cf4bbeacd944ed82f2a",
+        "rev": "48409beb41e8e28b64e8160ca82d8a93fb628963",
         "type": "github"
       },
       "original": {
@@ -537,11 +537,11 @@
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1786233186,
+        "lastModified": 1785034246,
-        "narHash": "sha256-sqDu3uQvU1LimxIZ907iFGqwVEBBZIB5ZSgGlb7zKqY=",
+        "narHash": "sha256-/Wul0/XyCTasQ4WYUMHksMffgOOhwJudIzwWT9HpCY4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "317f059fb7463680165802d82ddad2126fabf8d3",
+        "rev": "8020cdf42a4c803d7e48bf1375177145deb6cfac",
         "type": "github"
       },
       "original": {
@@ -654,11 +654,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785360170,
+        "lastModified": 1784369104,
-        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
         "type": "github"
       },
       "original": {
@@ -675,11 +675,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785360170,
+        "lastModified": 1780220602,
-        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {
@@ -693,11 +693,11 @@
         "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1786154646,
+        "lastModified": 1784949765,
-        "narHash": "sha256-MDOvpk7B1eImC2TQbz4KoqKtYnnXOznGHx+2KaTLJBE=",
+        "narHash": "sha256-MB+0noLfsYMoMsBkyG5CKYZmSk7dSXendvvjfQFUiPw=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "7c0ca0a27c2e7338e2c7d61599c0de4873081d7c",
+        "rev": "242a696abba55b45d577b5292e90b597284f5f85",
         "type": "github"
       },
       "original": {

flake.nix

@@ -28,8 +28,7 @@
     nix-hardware.url = "github:nixos/nixos-hardware";
     nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
     nixvimunstable.url = "github:nix-community/nixvim/main";
-    #nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixunstable.url = "github:geri1701/nixpkgs/lego-v5-acme-spike";
     nurpkgs.url = "github:nix-community/NUR";
     vsext.url = "github:nix-community/nix-vscode-extensions";
     wsl = {
@@ -101,7 +100,7 @@
                 {
                   deployment = {
                     inherit (v) tags;
-                    targetHost = if (v ? "connectAddr") then v.connectAddr else v.nebulaIp;
+                    targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
                     targetUser = "greg";
                   };
                 }

home/baseline/nushell/functions.nu

@@ -16,10 +16,6 @@ def nebulaIps [] {
     open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort
 }
 
-def localIps [] {
-    open /etc/nixos/network.json | get hosts | items { |h, e| $e.ip? } | where $it != null | sort
-}
-
 def genNebulaCert [ --ips: string, --name: string ] {
     let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand
     let private = $'~/SynologyDrive/nebula/($name).key' | path expand

home/hosts/exodus/default.nix

@@ -25,7 +25,6 @@
     mumble
     nebula
     nix-index
-    adoptopenjdk-icedtea-web
     pre-commit
     prismlauncher
     rclone

hosts/unstable/builder2/default.nix

@@ -0,0 +1,19 @@
+{ config, modulesPath, pkgs, lib, ... }:
+{
+  imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
+  nix.settings = { sandbox = false; };  
+  proxmoxLXC = {
+    manageNetwork = false;
+    privileged = true;
+  };
+  services.fstrim.enable = false; # Let Proxmox host handle fstrim
+  services.openssh = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+        PermitRootLogin = "yes";
+        PasswordAuthentication = true;
+        PermitEmptyPasswords = "yes";
+    };
+  };
+}

hosts/unstable/exodus/default.nix

@@ -9,7 +9,7 @@
 {
   imports = [
     ./hardware-configuration.nix
-    top.nix-hardware.nixosModules.framework-intel-core-ultra-series1
+    top.nix-hardware.nixosModules.framework-11th-gen-intel
   ];
 
   boot = {

hosts/unstable/genesis/net/hosts

@@ -1,11 +1,12 @@
 # Local hosts
 10.42.0.1 switch switch.thehellings.lan  # Core switch for the network
 10.42.0.3 ap ap.thehellings.lan  # OpenWRT access point (static IP)
-10.42.0.4 pve1.thehellings.lan  # Proxmox
+10.42.0.4 joel.thehellings.lan  # Proxmox
 10.42.0.5 sanswitch.thehellings.lan  # Core switch for the SAN
 
 # Home servers
-10.42.1.1 udm router udm.thehellings.lan router.thehellings.lan  # Ubiquiti UDM gateway
+10.42.1.1 pve1.thehellings.lan
+10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan
 10.42.1.3 printer.thehellings.lan
 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan
 10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan

hosts/unstable/genesis/networking.nix

@@ -77,7 +77,7 @@ in
       };
     };
     firewall = {
-      enable = true;
+      enable = false;
       allowedUDPPorts = [
         dhcpPort
         dnsPort
@@ -88,7 +88,7 @@ in
         80
       ];
     };
-    nftables.enable = true;
+    nftables.enable = false;
   };
 
   environment.etc."hosts.d/local".text = extraHosts;

hosts/unstable/genesis/networking/dhcp.nix

@@ -60,7 +60,7 @@
         reservations = [
           # Static IPs for personal work
           {
-            hw-address = "00:23:24:72:64:32"; # PVE1
+            hw-address = "00:23:24:72:64:32"; # Joel
             ip-address = "10.42.0.4";
           }
           {
@@ -76,6 +76,10 @@
             #ip-address = "10.42.2.253";
             ip-address = "10.42.100.6";
           }
+          {
+            hw-address = "7c:83:34:b9:ee:ec"; # PVE1
+            ip-address = "10.42.1.1";
+          }
           {
             hw-address = "74:ee:2a:66:b3:51"; # printer
             ip-address = "10.42.1.3";

hosts/unstable/isaiah/default.nix

@@ -47,10 +47,6 @@
       enable = true;
       extraLabels = [ "bare-metal:host" ];
     };
-    vmdev = {
-      enable = true;
-      host = "libvirt";
-    };
   };
 
   networking = {

hosts/unstable/kuma/default.nix

@@ -1,76 +0,0 @@
-{
-  config,
-  metadata,
-  modulesPath,
-  pkgs,
-  ...
-}:
-{
-  imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
-  greg = {
-    home = true;
-    nebula.enable = true;
-    proxies =
-      let
-        tgt = {
-          target = "http://localhost:${config.services.uptime-kuma.settings.PORT}";
-          genAliases = false;
-        };
-      in
-      {
-        "kuma.nebula.thehellings.com" = tgt;
-        "kuma.thehellings.lan" = tgt;
-        "kuma.shire-zebra.ts.net" = tgt;
-      };
-  };
-  nix.settings = {
-    sandbox = false;
-  };
-  networking = {
-    defaultGateway = metadata.infra.gw;
-    nameservers = [ metadata.infra.dns ];
-    interfaces.ens18 = {
-      useDHCP = false;
-      ipv4.addresses = [
-        {
-          address = metadata.hosts."${config.networking.hostName}".ip;
-          prefixLength = 16;
-        }
-      ];
-    };
-  };
-  proxmox.cloudInit.enable = false;
-  services = {
-    fstrim.enable = true;
-    mysql = {
-      enable = true;
-      ensureDatabases = [
-        config.services.uptime-kuma.settings.UPTIME_KUMA_DB_NAME
-      ];
-      ensureUsers = [
-        {
-          name = config.services.uptime-kuma.settings.UPTIME_KUMA_DB_USERNAME;
-          ensurePermissions = {
-            "uptimekuma.*" = "ALL PRIVILEGES";
-          };
-        }
-      ];
-      package = pkgs.mariadb;
-    };
-    openssh = {
-      enable = true;
-      openFirewall = true;
-    };
-    uptime-kuma = {
-      enable = true;
-      settings = {
-        PORT = "3001"; # Default, but this allows us to explicitly use it elsewhere
-        UPTIME_KUMA_DB_TYPE = "mariadb";
-        UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
-        UPTIME_KUMA_DB_NAME = "uptimekuma";
-        UPTIME_KUMA_DB_USERNAME = "uptimekuma";
-        UPTIME_KUMA_DB_PASSWORD = "uptimekuma";
-      };
-    };
-  };
-}

hosts/unstable/linode/default.nix

@@ -1,85 +1,34 @@
 {
-  config,
-  lib,
-  metadata,
   pkgs,
-  pkgs',
+  lib,
+  config,
   ...
 }:
 
-let
-  homepage = "127.0.0.1:30080";
-  nextcloudPort = 8080;
-  sshPort = 2222;
-  matrixServer = pkgs.writeText "matrix_server" (
-    builtins.toJSON {
-      "m.server" = "matrix.thehellings.com:443";
-    }
-  );
-  matrixClient = pkgs.writeText "matrix_client" (
-    builtins.toJSON {
-      "m.homeserver" = {
-        base_url = "https://matrix.thehellings.com";
-      };
-      "m.identity_server" = {
-        base_url = "https://vector.im";
-      };
-    }
-  );
-in
 {
   imports = [
+    ./git.nix
     ./hardware-configuration.nix
+    ./podman.nix
+    ./matrix.nix
+    ./nextcloud.nix
+    ./nginx.nix
+    ./postgres.nix
   ];
 
-  age.secrets = {
-    acme.file = ../../../secrets/acme.age;
-    nextcloudadmin = {
-      file = ../../../secrets/nextcloudadmin.age;
-      owner = "nextcloud";
-    };
-  };
-
   environment.systemPackages = with pkgs; [
     bind
     graphviz
     nix-du
     pgloader
-    podman-compose
-    pkgs'.upgrade-pg-cluster
   ];
 
   greg = {
-    backup.jobs = {
-      nextcloud-bkup = {
-        src = "/var/lib/nextcloud";
-        dest = "nextcloud-backup";
-        pre = lib.getExe (
-          pkgs.writeShellApplication {
-            name = "nextcloud-backup-pre";
-            runtimeInputs = [ config.services.nextcloud.occ ];
-            text = "nextcloud-occ maintenance:mode --on";
-          }
-        );
-        post = lib.getExe (
-          pkgs.writeShellApplication {
-            name = "nextcloud-backup-post";
-            runtimeInputs = [ config.services.nextcloud.occ ];
-            text = "nextcloud-occ maintenance:mode --off";
-          }
-        );
-      };
-      greg-postgresql-backup = {
-        src = config.services.postgresqlBackup.location;
-        dest = "linode-postgres";
-      };
-    };
     gitea-runner = {
       enable = true;
-      labels = [
+      extraLabels = [
         "vps:host"
         "blog:host"
-        "nixos-linode:host"
       ];
     };
     home = false;
@@ -87,29 +36,20 @@ in
     nebula = {
       enable = true;
       isLighthouse = true;
-      unsafeRoutes = [
+    };
-        {
+    proxies."immich.thehellings.com" = {
-          route = "10.42.0.0/16";
+      genAliases = false;
-          via = metadata.hosts.genesis.nebulaIp;
+      target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
-        }
+      ssl = true;
-      ];
     };
     tailscale.enable = true;
   };
 
   networking = {
-    domain = "thehellings.com";
-    firewall.allowedTCPPorts = [
-      sshPort
-      80
-      443
-    ];
-    hostName = "linode";
-    nameservers = [
-      "10.157.0.2"
-      "100.96.198.104"
-    ];
     networkmanager.enable = lib.mkForce false;
+    hostName = "linode";
+    domain = "thehellings.com";
+    nameservers = [ "100.88.91.27" ];
   };
 
   programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
@@ -120,254 +60,10 @@ in
     "    UserKnownHostsFile /dev/null"
   ];
 
-  security.acme = {
-    acceptTerms = true;
-    defaults = {
-      dnsPropagationCheck = false;
-      dnsResolver = "92.123.95.3:53,92.123.94.3:53,92.123.94.2:53,92.123.95.4:53,92.123.95.2:53";
-      email = "greg.hellings@gmail.com";
-      extraLegoRunFlags = [ "--ipv4only" ]; # Force IPv4 only
-      #server = "https://acme-staging-v02.api.letsencrypt.org/directory";
-    };
-    certs."thehellings.com" = {
-      dnsProvider = "linode";
-      environmentFile = config.age.secrets.acme.path;
-      extraDomainNames = [
-        "*.thehellings.com"
-      ];
-    };
-  };
-
   services = {
-
-    anubis = {
-      instances = {
-        git = {
-          enable = true;
-          settings = {
-            BIND = "/run/anubis/anubis-git/anubis.sock";
-            COOKIE_DOMAIN = "thehellings.com";
-            SERVE_ROBOTS_TXT = true;
-            SLOG_LEVEL = "DEBUG";
-            TARGET = "http://git.k3s.thehellings.lan";
-          };
-        };
-      };
-    };
-
-    haproxy = {
-      enable = true;
-      config = ''
-        global
-          nbthread 4
-          maxconn 80
-          log /dev/log local0
-
-        defaults
-          timeout connect 500s
-          timeout client 500s
-          timeout server 1h
-
-        listen gitsshd
-          bind *:${toString sshPort}
-          timeout client 1h
-          mode tcp
-          server git-isaiah isaiah.thehellings.lan:32222
-          server git-jeremiah jeremiah.thehellings.lan:32222
-          server git-zeke zeke.thehellings.lan:32222
-
-        frontend https
-          bind *:80
-          bind *:443 ssl crt ${config.security.acme.certs."thehellings.com".directory}/full.pem
-
-          http-request redirect scheme https unless { ssl_fc }
-          http-request add-header X-Forwarded-Proto https
-
-          http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure
-
-          option http-server-close
-          option http-keep-alive
-
-          #option httplog
-          #declare capture response len 80
-          #http-response capture res.hdr(Location) id 0
-
-          use_backend git if { hdr(host) -i src.thehellings.com }
-          use_backend git if { req_ssl_sni -i src.thehellings.com }
-          use_backend next if { hdr(host) -i next.thehellings.com }
-          use_backend next if { req_ssl_sni -i next.thehellings.com }
-          use_backend matrix if { hdr(host) -i matrix.thehellings.com }
-          use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
-          use_backend immich if { hdr(host) -i immich.thehellings.com }
-          use_backend immich if { req_ssl_sni -i immich.thehellings.com }
-          use_backend web if { hdr(host) -i thehellings.com }
-          use_backend web if { req_ssl_sni -i thehellings.com }
-
-        backend git
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          http-request set-header Host git.k3s.thehellings.lan
-          server git-isaiah isaiah.thehellings.lan:80
-          server git-jeremiah jeremiah.thehellings.lan:80
-          server git-zeke zeke.thehellings.lan:80
-
-        backend immich
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          server immich-proxy 127.0.0.1:${builtins.toString config.services.immich-public-proxy.port}
-
-        backend matrix
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          http-request set-header Host matrix.k3s.thehellings.lan
-          server git-isaiah isaiah.thehellings.lan:80
-          server git-jeremiah jeremiah.thehellings.lan:80
-          server git-zeke zeke.thehellings.lan:80
-
-        backend web
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          http-request return status 200 content-type "application/json" file ${matrixClient} hdr "cache-control" "no-cache" if { path /.well-known/matrix/client }
-          http-request return status 200 content-type "application/json" file ${matrixServer} hdr "cache-control" "no-cache" if { path /.well-known/matrix/server }
-          server web-container ${homepage}
-
-        backend next
-          log global
-          mode http
-          balance roundrobin
-          option accept-unsafe-violations-in-http-response
-          retries 3
-          option forwardfor
-          #http-response replace-value Location http://localhost:${builtins.toString nextcloudPort}/(.*) https://next.thehellings.com/\2
-          server nextcloud 127.0.0.1:${builtins.toString nextcloudPort}
-      '';
-    };
-
     immich-public-proxy = {
       enable = true;
-      immichUrl = "http://immich.k3s.thehellings.lan";
+      immichUrl = "https://immich.shire-zebra.ts.net";
     };
-
-    logrotate = {
-      enable = true;
-      settings = {
-        postgresBackup = {
-          enable = true;
-          files = "${config.services.postgresqlBackup.location}/*.gz";
-        };
-        postgresLog = {
-          enable = true;
-          files = "/var/lib/postgresql/*/log/*.log";
-          compress = true;
-          compresscmd = "${pkgs.xz}/bin/xz";
-        };
-      };
-    };
-
-    nextcloud = {
-      enable = true;
-      package = pkgs.nextcloud33;
-      appstoreEnable = true;
-      hostName = "127.0.0.1";
-      https = false;
-      config = {
-        adminpassFile = config.age.secrets.nextcloudadmin.path;
-        adminuser = "greg";
-        dbhost = "/run/postgresql";
-        dbtype = "pgsql";
-      };
-      settings = {
-        default_phone_region = "US";
-        overwriteprotocol = "http";
-        trusted_domains = [ "next.thehellings.com" ];
-        trusted_proxies = [
-          "localhost"
-          "127.0.0.1"
-        ];
-      };
-    };
-
-    # Move to :8080 so that we can run haproxy as the primary HTTP service
-    nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
-      {
-        addr = "127.0.0.1";
-        port = nextcloudPort;
-      }
-    ];
-
-    openssh.settings.PasswordAuthentication = false;
-
-    postgresql = {
-      enable = true;
-      package = pkgs.postgresql_15;
-      checkConfig = true;
-      ensureDatabases = [ "nextcloud" ];
-      #initialScript = pkgs.writeText "create-matrix-db.sql" ''
-      #	CREATE ROLE "matrix-synapse" WITH LOGIN;
-      #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
-      #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
-      #'';  # These are done manually in order to set the LC_COLLATE values properly
-      ensureUsers = [
-        {
-          name = "nextcloud";
-          ensureDBOwnership = true;
-        }
-      ];
-      settings = {
-        log_connections = true;
-        log_statement = "all";
-        logging_collector = true;
-        log_filename = "postgresql.log";
-      };
-      identMap = ''
-        root root postgres
-      '';
-    };
-
-    postgresqlBackup = {
-      enable = true;
-      databases = [ "nextcloud" ];
-    };
-  };
-
-  systemd.services = {
-    haproxy = {
-      after = [
-        "nextcloud.service"
-        "network-online.target"
-      ];
-      wants = [
-        "nextcloud.service"
-        "network-online.target"
-      ];
-    };
-  };
-
-  users.users.haproxy.extraGroups = [ config.security.acme.certs."thehellings.com".group ];
-
-  # Actually serve the content from here
-  virtualisation.oci-containers = {
-    backend = "podman";
-    containers."homepage" = {
-      image = "src.thehellings.com/greg/homepage:latest";
-      ports = [ "${homepage}:80" ];
-    };
-  };
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-    dockerSocket.enable = true;
   };
 }

hosts/unstable/linode/git.nix

@@ -0,0 +1,148 @@
+{ config, ... }:
+
+let
+  srcDomain = "src.thehellings.com";
+  sshPort = 2222;
+in
+{
+  greg.proxies."${srcDomain}" = {
+    target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
+    ssl = true;
+    genAliases = false;
+    extraConfig = ''
+      #proxy_ssl_verify off;
+      #proxy_ssl_server_name on;
+
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Http-Version $server_protocol;
+      proxy_set_header User-Agent $http_user_agent;
+      client_max_body_size 100000m;
+
+      #proxy_set_header Host $host;
+      #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      #proxy_set_header X-Forwarded-Proto $scheme;
+      #proxy_set_header X-Forwarded-Ssl on;
+
+      # Ultimate AI Block List v1.7 20250924
+      # https://perishablepress.com/ultimate-ai-block-list/
+
+      if ($http_user_agent ~* "(openai\.com|\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ Content\ Detector|AI\ Detection|AI\ Dungeon|AI\ Journalist|AI\ Legion)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(AI\ RAG|AI\ Search|AI\ SEO\ Crawler|AI\ Training|AI\ Web|AI\ Writer|AI2|AIBot|aiHitBot|AIMatrix|AISearch|AITraining|Alexa|Alice\ Yandex|AliGenie|AliyunSec|Alpha\ AI|AlphaAI|Amazon|Amelia)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(AndersPinkBot|AndiBot|Anonymous\ AI|Anthropic|AnyPicker|Anyword|Applebot|Aria\ AI|Aria\ Browse|Articoolo|Ask\ AI|AutoGen|AutoGLM|Automated\ Writer|AutoML|Autonomous\ RAG|AwarioRssBot|AwarioSmartBot|AWS\ Trainium|Azure)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(BabyAGI|BabyCatAGI|BardBot|Basic\ RAG|Bedrock|Big\ Sur|Bigsur|Botsonic|Brightbot|Browser\ MCP\ Agent|Browser\ Use|Bytebot|ByteDance|Bytespider|CarynAI|CatBoost|CC-Crawler|CCBot|Chai|Character)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Charstar\ AI|Chatbot|ChatGLM|Chatsonic|ChatUser|Chinchilla|Claude|ClearScope|Clearview|Cognitive\ AI|Cohere|Common\ Crawl|CommonCrawl|Content\ Harmony|Content\ King|Content\ Optimizer|Content\ Samurai|ContentAtScale|ContentBot|Contentedge)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(ContentShake|Conversion\ AI|Copilot|CopyAI|Copymatic|Copyscape|CoreWeave|Corrective\ RAG|Cotoyogi|CRAB|Crawl4AI|CrawlQ\ AI|Crawlspace|Crew\ AI|CrewAI|Crushon\ AI|DALL-E|DarkBard|DataFor|DataProvider)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Datenbank\ Crawler|DeepAI|Deep\ AI|DeepL|DeepMind|Deep\ Research|DeepResearch|DeepSeek|Devin|Diffbot|Doubao\ AI|DuckAssistBot|DuckDuckGo\ Chat|DuckDuckGo-Enhanced|Echobot|Echobox|Elixir|FacebookBot|FacebookExternalHit|Factset)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Falcon|FIRE-1|Firebase|Firecrawl|Flux|Flyriver|Frase\ AI|FriendlyCrawler|Gato|Gemini|Gemma|Gen\ AI|GenAI|Generative|Genspark|Gentoo-chat|Ghostwriter|GigaChat|GLM|GodMode)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Goose|GPT|Grammarly|Grendizer|Grok|GT\ Bot|GTBot|GTP|Hemingway\ Editor|Hetzner|Hugging|Hunyuan|Hybrid\ Search\ RAG|Hypotenuse\ AI|iAsk|ICC-Crawler|ImageGen|ImagesiftBot|img2dataset|imgproxy)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(INK\ Editor|INKforall|Instructor|IntelliSeek|Inferkit|ISSCyberRiskCrawler|Janitor\ AI|Jasper|Jenni\ AI|Julius\ AI|Kafkai|Kaggle|Kangaroo|Keyword\ Density\ AI|Kimi|Knowledge|KomoBot|Kruti|LangChain|Le\ Chat)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Lensa|Lightpanda|LinerBot|LLaMA|LLM|Local\ RAG\ Agent|Lovable|Magistral|magpie-crawler|Manus|MarketMuse|Meltwater|Meta-AI|Meta-External|Meta-Webindexer|Meta\ AI|MetaAI|MetaTagBot|Middleware|Midjourney)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Mini\ AGI|MiniMax|Mintlify|Mistral|Mixtral|model-training|Monica|Narrative|NeevaBot|netEstate|Neural\ Text|NeuralSEO|NinjaAI|NodeZero|Nova\ Act|NovaAct|OAI-SearchBot|OAI\ SearchBot|OASIS|Olivia)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Omgili|Open\ AI|Open\ Interpreter|OpenAGI|OpenAI|OpenBot|OpenPi|OpenRouter|OpenText\ AI|Operator|Outwrite|Page\ Analyzer\ AI|PanguBot|Panscient|Paperlibot|Paraphraser\.io|peer39_crawler|Perflexity|Perplexity|Petal)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Phind|PiplBot|PoeBot|PoeSearchBot|ProWritingAid|Proximic|Puppeteer|Python\ AI|Qualified|Quark|QuillBot|Qopywriter|Qwen|RAG\ Agent|RAG\ Azure\ AI|RAG\ Chatbot|RAG\ Database|RAG\ IS|RAG\ Pipeline|RAG\ Search)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(RAG\ with|RAG-|RAG_|Raptor|React\ Agent|Redis\ AI\ RAG|RobotSpider|Rytr|SaplingAI|SBIntuitionsBot|Scala|Scalenut|Scrap|ScriptBook|Seekr|SEObot|SEO\ Content\ Machine|SEO\ Robot|SemrushBot|Sentibot)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Serper|ShapBot|Sidetrade|Simplified\ AI|Sitefinity|Skydancer|SlickWrite|SmartBot|Sonic|Sora|Spider/2|SpiderCreator|Spin\ Rewrite|Spinbot|Stability|StableDiffusionBot|Sudowrite|SummalyBot|Super\ Agent|Superagent)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(SuperAGI|Surfer\ AI|TerraCotta|Text\ Blaze|TextCortex|Thinkbot|Thordata|TikTokSpider|Timpibot|Tinybird|Together\ AI|Traefik|TurnitinBot|uAgents|VelenPublicWebCrawler|Venus\ Chub\ AI|Vidnami\ AI|Vision\ RAG|WebSurfer|WebText)") {
+        return 444;
+      }
+      if ($http_user_agent ~* "(Webzio|WeChat|Whisper|WordAI|Wordtune|WPBot|Writecream|WriterZen|Writescope|Writesonic|xAI|xBot|YaML|YandexAdditional|YouBot|Zendesk|Zero|Zhipu|Zhuque\ AI|Zimm)") {
+        return 444;
+      }
+    '';
+  };
+  #greg.proxies."registry.thehellings.com" = {
+  #target = "https://gitea.shire-zebra.ts.net:5000";
+  #ssl = true;
+  #genAliases = false;
+  #extraConfig = ''
+  #proxy_set_header X-Forwarded-Proto https;
+  #proxy_set_header X-Forwarded-Ssl on;
+  #client_max_body_size 25000m;
+  #'';
+  #};
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+
+  services = {
+    anubis = {
+      instances = {
+        git = {
+          enable = true;
+          settings = {
+            BIND = "/run/anubis/anubis-git/anubis.sock";
+            COOKIE_DOMAIN = "thehellings.com";
+            SERVE_ROBOTS_TXT = true;
+            TARGET = "https://gitea.shire-zebra.ts.net/";
+          };
+        };
+      };
+    };
+
+    haproxy = {
+      enable = true;
+      config = ''
+        global
+          daemon
+          maxconn 20
+
+        defaults
+          timeout connect 500s
+          timeout client 500s
+          timeout server 1h
+
+        listen gitsshd
+          bind *:${toString sshPort}
+          timeout client 1h
+          mode tcp
+          server git-isaiah isaiah.shire-zebra.ts.net:32222
+          server git-jeremiah jeremiah.shire-zebra.ts.net:32222
+          server git-zeke zeke.shire-zebra.ts.net:32222
+      '';
+    };
+  };
+
+  systemd.services = {
+    haproxy = {
+      after = [
+        "network-online.target"
+      ];
+      wants = [
+        "network-online.target"
+      ];
+    };
+  };
+
+  users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
+}

hosts/unstable/linode/matrix.nix

@@ -0,0 +1,70 @@
+# Registration of new users is disabled for the public, but I can create
+# them by the following commands:
+# nix run nixpkgs.matrix-synapse
+# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
+{ config, ... }:
+let
+  domain = "${config.networking.domain}";
+  fqdn = "matrix.${domain}";
+in
+{
+  greg.proxies."${fqdn}" = {
+    extraConfig = ''
+      error_log /var/log/nginx/debug.log debug;
+      proxy_ssl_verify off;
+      proxy_ssl_server_name on;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-Ssl on;
+    '';
+    genAliases = false;
+    ssl = true;
+    target = "https://matrix.shire-zebra.ts.net";
+  };
+  services.nginx = {
+    virtualHosts = {
+      # Server the '.well-known' files to find the Matrix API server
+      "${domain}" = {
+        enableACME = true;
+        forceSSL = true;
+        # This is needed so that servers contacting hellings.com can find
+        # the actual application server at matrix.thehellings.com
+        locations."= /.well-known/matrix/server".extraConfig =
+          let
+            server = {
+              "m.server" = "${fqdn}:443";
+            };
+          in
+          ''
+            add_header Content-Type application/json;
+            return 200 '${builtins.toJSON server}';
+          '';
+
+        locations."= /.well-known/matrix/client".extraConfig =
+          let
+            client = {
+              "m.homeserver" = {
+                "base_url" = "https://${fqdn}";
+              };
+              "m.identity_server" = {
+                "base_url" = "https://vector.im";
+              };
+            };
+          in
+          ''
+            add_header Content-Type application/json;
+            add_header Access-Control-Allow-Origin *;
+            return 200 '${builtins.toJSON client}';
+          '';
+      };
+    };
+  };
+
+  # Open networking ports for the server
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [
+      80
+      443
+    ];
+  };
+}

hosts/unstable/linode/nextcloud.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  age.secrets.nextcloudadmin = {
+    file = ../../../secrets/nextcloudadmin.age;
+    owner = "nextcloud";
+  };
+
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud33;
+    appstoreEnable = true;
+    hostName = "next.${config.networking.domain}";
+    https = true;
+    config = {
+      adminpassFile = config.age.secrets.nextcloudadmin.path;
+      adminuser = "greg";
+      dbhost = "/run/postgresql";
+      dbtype = "pgsql";
+    };
+    settings = {
+      default_phone_region = "US";
+      overwriteprotocol = "https";
+    };
+  };
+
+  services.nginx.virtualHosts."next.thehellings.com" = {
+    forceSSL = true;
+    enableACME = true;
+  };
+
+  # Otherwise nginx errors looking for the nextcloud sock file
+  systemd.services.nginx.after = [ "nextcloud.service" ];
+
+  greg.backup.jobs.nextcloud-bkup = {
+    src = "/var/lib/nextcloud";
+    dest = "nextcloud-backup";
+    pre = lib.getExe (
+      pkgs.writeShellApplication {
+        name = "nextcloud-backup-pre";
+        runtimeInputs = [ config.services.nextcloud.occ ];
+        text = "nextcloud-occ maintenance:mode --on";
+      }
+    );
+    post = lib.getExe (
+      pkgs.writeShellApplication {
+        name = "nextcloud-backup-post";
+        runtimeInputs = [ config.services.nextcloud.occ ];
+        text = "nextcloud-occ maintenance:mode --off";
+      }
+    );
+  };
+}

hosts/unstable/linode/nginx.nix

@@ -0,0 +1,38 @@
+{ ... }:
+let
+  homepage = "127.0.0.1:30080";
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "greg.hellings@gmail.com";
+  };
+
+  services.nginx = {
+    enable = true;
+
+    clientMaxBodySize = "25000m"; # To help with uploading container images
+    # If there are recommended settings, let's use them!
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  # Actually serve the content from here
+  virtualisation.podman.enable = true;
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers."homepage" = {
+      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
+      ports = [ "${homepage}:80" ];
+    };
+  };
+  greg.proxies = {
+    "thehellings.com" = {
+      target = "http://${homepage}/";
+      ssl = true;
+      genAliases = false;
+    };
+  };
+}

hosts/unstable/linode/podman.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    podman-compose
+  ];
+
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+  };
+}

hosts/unstable/linode/postgres.nix

@@ -0,0 +1,63 @@
+{
+  config,
+  pkgs,
+  pkgs',
+  ...
+}:
+
+{
+  environment.systemPackages = [ pkgs'.upgrade-pg-cluster ];
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_15;
+    checkConfig = true;
+    ensureDatabases = [ "nextcloud" ];
+    #initialScript = pkgs.writeText "create-matrix-db.sql" ''
+    #	CREATE ROLE "matrix-synapse" WITH LOGIN;
+    #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
+    #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
+    #'';  # These are done manually in order to set the LC_COLLATE values properly
+    ensureUsers = [
+      {
+        name = "nextcloud";
+        ensureDBOwnership = true;
+      }
+    ];
+    settings = {
+      log_connections = true;
+      log_statement = "all";
+      logging_collector = true;
+      log_filename = "postgresql.log";
+    };
+    identMap = ''
+      root root postgres
+    '';
+  };
+
+  services.postgresqlBackup = {
+    enable = true;
+    databases = [ "nextcloud" ];
+  };
+
+  services.logrotate = {
+    enable = true;
+    settings = {
+      postgresBackup = {
+        enable = true;
+        files = "${config.services.postgresqlBackup.location}/*.gz";
+      };
+      postgresLog = {
+        enable = true;
+        files = "/var/lib/postgresql/*/log/*.log";
+        compress = true;
+        compresscmd = "${pkgs.xz}/bin/xz";
+      };
+    };
+  };
+
+  greg.backup.jobs.greg-postgresql-backup = {
+    src = config.services.postgresqlBackup.location;
+    dest = "linode-postgres";
+  };
+}

hosts/unstable/zeke/default.nix

@@ -32,10 +32,6 @@
       enable = true;
       tags = [ "home" ];
     };
-    vmdev = {
-      enable = true;
-      host = "vbox";
-    };
   };
 
   hardware = {
@@ -75,4 +71,10 @@
   users.users.greg.extraGroups = [
     "podman"
   ];
+
+  # virtualisation.virtualbox.host = {
+  #   enableExtensionPack = true;
+  #   headless = true;
+  #   enableWebService = true;
+  # };
 }

manifests/donetick/configmap.yaml

@@ -0,0 +1,79 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: donetick-config
+  namespace: donetick
+data:
+  # Value pulled from
+  # https://github.com/donetick/donetick/blob/main/config/selfhosted.yaml
+  selfhosted.yaml: |-
+    name: "selfhosted"
+    is_done_tick_dot_com: false
+    is_user_creation_disabled: false
+    telegram:
+      token: ""
+    pushover:
+      token: ""
+    database:
+      type: "sqlite"
+      migration: true
+      # these are only required for postgres
+      host: "secret"
+      port: 5432
+      user: "secret"
+      password: "secret"
+      name: "secret"
+    jwt:
+      secret: "This is really a secure JWT secret now!"
+      session_time: 168h
+      max_refresh: 168h
+    server:
+      port: 2021
+      read_timeout: 10s
+      write_timeout: 10s
+      rate_period: 60s
+      rate_limit: 300
+      cors_allow_origins:
+        - "http://localhost:5173"
+        - "http://localhost:7926"
+        # the below are required for the android app to work
+        - "https://localhost"
+        - "capacitor://localhost"
+      serve_frontend: true
+    logging:
+      level: "info"
+      encoding: "json"
+      development: false
+    scheduler_jobs:
+      due_job: 30m
+      overdue_job: 3h
+      pre_due_job: 3h
+    email:
+      host:
+      port:
+      key:
+      email:
+      appHost:
+    oauth2:
+      client_id:
+      client_secret:
+      auth_url:
+      token_url:
+      user_info_url:
+      redirect_url:
+      name:
+    # Real-time configuration
+    realtime:
+      enabled: true
+      sse_enabled: true
+      heartbeat_interval: 60s
+      connection_timeout: 120s
+      max_connections: 1000
+      max_connections_per_user: 5
+      event_queue_size: 2048
+      cleanup_interval: 2m
+      stale_threshold: 5m
+      enable_compression: true
+      enable_stats: true
+      allowed_origins:
+        - "*"

manifests/donetick/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: donetick
+  namespace: donetick
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: donetick
+  template:
+    metadata:
+      labels:
+        app: donetick
+    spec:
+      containers:
+        - name: donetick
+          image: donetick/donetick
+          ports:
+            - containerPort: 2021
+              name: http
+          env:
+            - name: DT_ENV
+              value: "selfhosted"
+            - name: DT_SQLITE_PATH
+              value: "/data/donetick.db"
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: config
+          configMap:
+            name: donetick-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: donetick-data

manifests/donetick/ingress.yaml

@@ -0,0 +1,15 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: donetick-tailscale
+  namespace: donetick
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: donetick
+      port:
+        number: 2021
+  tls:
+    - hosts:
+        - todo

manifests/donetick/kustomization.yaml

@@ -0,0 +1,9 @@
+namespace: donetick
+
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

manifests/donetick/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: donetick

manifests/donetick/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: donetick-data
+  namespace: donetick
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

manifests/donetick/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: donetick
+  namespace: donetick
+spec:
+  selector:
+    app: donetick
+  ports:
+    - name: http
+      port: 2021
+      targetPort: 2021
+      protocol: TCP

manifests/gitea-runner/chart.yaml

@@ -0,0 +1,56 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: gitea
+spec:
+  interval: "24h"
+  url: https://dl.gitea.com/charts/
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-runner
+  namespace: gitea-runner
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: actions
+      version: "0.0.4"
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+      interval: "1h"
+  values:
+    rbac:
+      create: true
+    serviceAccount:
+      create: true
+    gitea:
+      instanceURL: https://src.thehellings.com
+      runnerToken:
+        existingSecret: gitea-runner
+        existingSecretKey: token
+    imagePullSecrets:
+      - name: image-pull-secrets
+    config:
+      runner:
+        labels:
+          # Ubuntu
+          - "ubuntu-22.04:docker://ubuntu:22.04"
+          - "ubuntu-24.04:docker://ubuntu:24.04"
+          - "ubuntu-24.10:docker://ubuntu:24.10"
+          # Fedora
+          - "fedora-41:docker://fedora:41"
+          - "fedora-42:docker://fedora:42"
+          # CentOS Stream
+          - "centos-stream-9:docker://quay.io/centos/centos:stream9"
+          - "centos-stream-10:docker://quay.io/centos/centos:stream10"
+          # Nix
+          - "nix:docker://nixos/nix:latest"
+          # ci-images (internal registry: src.thehellings.com/greg)
+          - "ci-builder:docker://src.thehellings.com/greg/builder:latest"
+          - "ci-vm-test:docker://src.thehellings.com/greg/vm-test:latest"
+          - "ci-sword:docker://src.thehellings.com/greg/sword-container-builder:latest"
+          - "ci-bitwarden:docker://src.thehellings.com/greg/bitwarden:latest"
+          - "ci-immich:docker://src.thehellings.com/greg/immich:latest"

manifests/gitea-runner/kustomization.yaml

@@ -0,0 +1,6 @@
+namespace: gitea-runner
+
+resources:
+  - namespace.yaml
+  - secrets.yaml
+  - chart.yaml

manifests/gitea-runner/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea-runner

manifests/gitea-runner/secrets.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-runner
+  namespace: gitea-runner
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    name: gitea-runner
+    creationPolicy: Owner
+  data:
+    - secretKey: token
+      remoteRef:
+        key: 11419680-5338-4f19-bdd9-b422007046af
+        property: password

manifests/gitea/chart.yaml

@@ -15,7 +15,7 @@ spec:
   chart:
     spec:
       chart: gitea
-      version: "12.7.0"
+      version: "12.6.0"
       sourceRef:
         kind: HelmRepository
         name: gitea-repository
@@ -35,7 +35,7 @@ spec:
       storageClass: longhorn-default
 
     image:
-      tag: "1.27.1"
+      tag: "1.26.2"
 
     replicaCount: 1
 
@@ -67,7 +67,7 @@ spec:
           RUN_MODE: dev
         server:
           DOMAIN: "shire-zebra.ts.net"
-          ROOT_URL: "https://git.k3s.thehellings.lan"
+          ROOT_URL: "https://gitea.shire-zebra.ts.net"
           SSH_PORT: "2222"
         database:
           DB_TYPE: postgres
@@ -85,15 +85,15 @@ spec:
           DISABLE_REGISTRATION: "true"
         storage:
           STORAGE_TYPE: minio
-          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:30188"
+          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
           MINIO_BUCKET: gitea
-          MINIO_LOCATION: garage
+          MINIO_LOCATION: us-east-1
           # MINIO_ACCESS_KEY_ID: ""
           # MINIO_SECRET_ACCESS_KEY: ""
           MINIO_USE_SSL: "false"
           MINIO_INSECURE_SKIP_VERIFY: "true"
-        security:
+        webhook:
-          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com,*.thehellings.lan
+          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net
 
       metrics:
         enabled: false
@@ -102,8 +102,8 @@ spec:
 
     persistence:
       enabled: true
-      create: false
+      storageClass: longhorn-default
-      claimName: gitea-new
+      size: "50Gi"
 
     # I will manage my Postgres externally
     postgresql:

manifests/gitea/dump-cronjob.yaml

@@ -18,12 +18,12 @@ spec:
           volumes:
             - name: gitea-data
               persistentVolumeClaim:
-                claimName: gitea-new
+                claimName: gitea-shared-storage
             - name: dump-staging
               emptyDir: {}
           initContainers:
             - name: gitea-dump
-              image: "gitea/gitea:1.27.1"
+              image: "gitea/gitea:1.25.4"
               command:
                 - /bin/sh
                 - "-c"
@@ -51,12 +51,12 @@ spec:
                 - |
                   set -e
                   # Configure mc alias for MinIO
-                  mc alias set nas1 http://nas1.shire-zebra.ts.net:30188 \
+                  mc alias set nas1 http://nas1.shire-zebra.ts.net:9000 \
                     "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
                   # Upload dump to backup-gitea bucket
                   DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
-                  mc cp "${DUMP_FILE}" "nas1/gitea-backup/$(basename ${DUMP_FILE})"
+                  mc cp "${DUMP_FILE}" "nas1/backup-gitea/$(basename ${DUMP_FILE})"
-                  echo "Uploaded $(basename ${DUMP_FILE}) to gitea-backup"
+                  echo "Uploaded $(basename ${DUMP_FILE}) to backup-gitea"
                   # Set 30-day lifecycle on the bucket (idempotent)
                   mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
               volumeMounts:
@@ -69,10 +69,10 @@ spec:
                 - name: MINIO_ACCESS_KEY
                   valueFrom:
                     secretKeyRef:
-                      name: gitea-backup
+                      name: gitea-config
                       key: minio_key
                 - name: MINIO_SECRET_KEY
                   valueFrom:
                     secretKeyRef:
-                      name: gitea-backup
+                      name: gitea-config
                       key: minio_secret

manifests/gitea/ingress.yaml

@@ -12,20 +12,3 @@ spec:
   tls:
     - hosts:
         - gitea
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gitea-direct
-spec:
-  rules:
-    - host: git.k3s.thehellings.lan
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: gitea-release-http
-                port:
-                  name: http

manifests/gitea/secrets.yaml

@@ -1,32 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: gitea-backup
-spec:
-  target:
-    name: gitea-backup
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        minio_key: "{{ .minio_key }}"
-        minio_secret: "{{ .minio_secret }}"
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  data:
-    # MinIO credentials
-    - secretKey: minio_key
-      remoteRef:
-        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
-        property: username
-    - secretKey: minio_secret
-      remoteRef:
-        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: gitea-config
 spec:
@@ -48,14 +21,23 @@ spec:
     name: bitwarden-login
     kind: ClusterSecretStore
   data:
+    # MinIO credentials
+    - secretKey: minio_key
+      remoteRef:
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        property: username
+    - secretKey: minio_secret
+      remoteRef:
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        property: password
     # MinIO credentials for NAS1
     - secretKey: minio_nas1_key
       remoteRef:
-        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: username
     - secretKey: minio_nas1_secret
       remoteRef:
-        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: password
     # Postgres credentials
     - secretKey: dbuser

manifests/helm/longhorn.yaml

@@ -27,7 +27,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: "1.11.3"
+      version: "1.11.2"
       sourceRef:
         kind: HelmRepository
         name: longhorn
@@ -141,10 +141,6 @@ spec:
                   number: 80
     - <<: *host
       host: longhorn.kubernetes
-    - <<: *host
-      host: longhorn.k3s.nebula.thehellings.com
-    - <<: *host
-      host: longhorn.k3s.thehellings.lan
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass

manifests/immich/backup.yaml

@@ -33,24 +33,24 @@ spec:
         access-key: "{{ .minio_key }}"
         secret-key: "{{ .minio_secret }}"
         rclone.conf: |
-          [garage]
+          [nas1minio]
           type = s3
           provider = Minio
-          endpoint = http://nas1.shire-zebra.ts.net:30188
+          endpoint = http://nas1.shire-zebra.ts.net:9000
           access_key_id = {{ .minio_key }}
           secret_access_key = {{ .minio_secret }}
-          region = garage
+          region = us-east-1
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore
   data:
     - secretKey: minio_key
       remoteRef:
-        key: 8fce2750-aa62-4892-b90c-b49c001f494b
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: username
     - secretKey: minio_secret
       remoteRef:
-        key: 8fce2750-aa62-4892-b90c-b49c001f494b
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: password
 ---
 apiVersion: v1
@@ -128,7 +128,7 @@ spec:
                     --progress \
                     --transfers 4 \
                     --checkers 8 \
-                    /staging garage:immich
+                    /staging nas1minio:immich
               volumeMounts:
                 - name: staging
                   mountPath: /staging

manifests/immich/chart.yaml

@@ -32,7 +32,7 @@ spec:
         containers:
           main:
             image:
-              tag: v3.1.0
+              tag: v2.7.5
             env:
               DB_HOSTNAME: immich-rw
               DB_DATABASE_NAME: immich

manifests/immich/ingress.yaml

@@ -22,10 +22,6 @@ spec:
                 name: immich-server
                 port:
                   name: http
-    - <<: *host
-      host: immich.k3s.nebula.thehellings.com
-    - <<: *host
-      host: immich.k3s.thehellings.lan
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/kustomization.yaml

@@ -10,4 +10,7 @@ resources:
   - immich
   - monitoring
   - pinchflat
+  - smokeping
+  - uptimekuma
+  - donetick
   - gitea

manifests/matrix/ingress.yaml

@@ -13,20 +13,3 @@ spec:
   tls:
     - hosts:
         - matrix
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: matrix-direct
-spec:
-  rules:
-    - host: matrix.k3s.thehellings.lan
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: dendrite
-                port:
-                  number: 8008

manifests/monitoring/config.yaml

@@ -51,8 +51,8 @@ data:
         static_configs:
           - targets:
               - "10.42.0.3"    # OpenWRT access point
-              - "10.42.0.4"    # pve1 (Proxmox)
+              - "10.42.0.4"    # Joel (Proxmox)
-              - "10.42.1.1"    # UDM gateway (Ubiquiti)
+              - "10.42.1.1"    # pve1 (Proxmox)
               - "10.42.1.4"    # chronicles (Synology NAS)
               - "10.42.1.14"   # nas1 (TrueNAS)
               - "10.42.2.57"   # odoo

manifests/smokeping/deployment.yaml

@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: smokeping
+  labels:
+    app: smokeping
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: smokeping
+  template:
+    metadata:
+      labels:
+        app: smokeping
+    spec:
+      containers:
+        - name: smokeping
+          image: docker.io/linuxserver/smokeping:2.9.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: data
+              mountPath: /data
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: "America/Chicago"
+            #- name: MASTER_URL
+            #  value: "https://ping.shire-zebra.ts.net"
+            # SHARED_SECRET if you want to run a cluster
+            # CACHE_DIR if you need to explicitly state that
+      restartPolicy: Always
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: smokeping-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: smokeping-data

manifests/smokeping/ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: smokeping-tailscale
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: smokeping
+      port:
+        name: http
+  tls:
+    - hosts:
+        - ping

manifests/smokeping/kustomization.yaml

@@ -0,0 +1,8 @@
+namespace: smokeping
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

manifests/smokeping/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: smokeping

manifests/smokeping/pvc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: smokeping-config
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-default
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: smokeping-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-default
+  resources:
+    requests:
+      storage: 25Gi

manifests/smokeping/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: smokeping
+  labels:
+    app: smokeping
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: smokeping

manifests/uptimekuma/chart.yaml

@@ -0,0 +1,38 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+spec:
+  interval: "24h"
+  url: "https://helm.irsigler.cloud"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: uptime-kuma
+      sourceRef:
+        kind: HelmRepository
+        name: uptime-kuma
+      interval: "1h"
+  dependsOn:
+    - name: longhorn
+      namespace: longhorn-system
+    - name: mariadb-cluster
+      namespace: mariadb-operator
+  values:
+    volume:
+      storageClassName: longhorn-default
+    image:
+      tag: "2.0.2"
+    externalDatabase:
+      enabled: true
+      hostname: mariadb-cluster.mariadb-operator.svc.cluster.local
+      database: uptimekuma
+      existingSecret: uptimekuma-mariadb-password

manifests/uptimekuma/ingress.yaml

@@ -0,0 +1,15 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: uptime-kuma-tailscale
+  namespace: uptime-kuma
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: uptime-kuma
+      port:
+        number: 3001
+  tls:
+    - hosts:
+        - kuma

manifests/uptimekuma/kustomization.yaml

@@ -0,0 +1,7 @@
+namespace: uptimekuma
+
+resources:
+  - namespace.yaml
+  - secrets.yaml
+  - chart.yaml
+  - ingress.yaml

manifests/uptimekuma/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: uptimekuma

manifests/uptimekuma/secrets.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: uptimekuma-mariadb-password
+spec:
+  target:
+    name: uptimekuma-mariadb-password
+    deletionPolicy: Delete
+    template:
+      type: kubernetes.io/basic-auth
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    - secretKey: username
+      remoteRef:
+        key: 4df95656-9f9c-4916-8e34-b3a200376365
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: 4df95656-9f9c-4916-8e34-b3a200376365
+        property: password

modules/hm/gui/bookmarks.nix

@@ -230,7 +230,7 @@
             bookmarks = [
               {
                 name = "PVE1";
-                url = "https://10.42.0.4:8006/";
+                url = "https://10.42.1.1:8006/";
               }
               {
                 name = "Jeremiah";

modules/nixos/gitea-runner.nix

@@ -98,19 +98,6 @@ in
         inherit labels;
         inherit (cfg) name;
         enable = true;
-        hostPackages = with pkgs; [
-          bash
-          buildah
-          coreutils
-          curl
-          gawk
-          gitMinimal
-          gnused
-          nix
-          nodejs
-          podman
-          wget
-        ];
         url = cfg.instanceURL;
         tokenFile = config.age.secrets."gitea-runner-${host}-podman".path;
         settings = {

modules/nixos/kubernetes.nix

@@ -15,6 +15,8 @@ let
     sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
   };
   keepaliveIp = "10.42.5.1";
+  nebulaName = "k3s.nebula.thehellings.com";
+  nebulaIp = "10.157.100.1";
 in
 {
   options.greg = {
@@ -44,6 +46,13 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.greg.nebula.enable;
+        message = "Configure Nebula for this host, first";
+      }
+    ];
+
     age.secrets = {
       bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
       dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -97,6 +106,8 @@ in
           "--tls-san ${config.networking.hostName}.thehellings.lan"
           "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
           "--tls-san ${keepaliveIp}"
+          "--tls-san ${nebulaName}"
+          "--tls-san ${nebulaIp}"
         ];
         manifests = {
           cert-manager.source = cert-manager;
@@ -128,6 +139,21 @@ in
               advert_int 1
             '';
           };
+          k3s-nebula = {
+            interface = "nebula0";
+            priority = 1;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${nebulaIp}/16";
+                dev = "nebula0";
+              }
+            ];
+            virtualRouterId = 78;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
         };
       };
       openiscsi = {

modules/nixos/vmdev.nix

@@ -23,13 +23,6 @@ with lib;
         type = types.str;
         description = "Kernel module type to install - amd, intel, etc";
       };
-      host = mkOption {
-        type = types.enum [
-          "libvirt"
-          "vbox"
-        ];
-        description = "Which VM hosting type to configure";
-      };
     };
   };
 
@@ -42,6 +35,7 @@ with lib;
       nixos-generators
       packer
       swtpm
+      virt-manager
       virtio-win
       xorriso
     ];
@@ -50,7 +44,7 @@ with lib;
 
     # Enable the virtualisation services
     virtualisation = {
-      libvirtd = mkIf (cfg.host == "libvirt") {
+      libvirtd = {
         enable = true;
         onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
         qemu = {
@@ -60,11 +54,6 @@ with lib;
           };
         };
       };
-      virtualbox.host = mkIf (cfg.host == "vbox") {
-        enable = true;
-        enableExtensionPack = true;
-        headless = true;
-      };
     };
 
     boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";

network.json

@@ -28,15 +28,6 @@
       "tags": ["router", "server"],
       "nebulaIp": "10.157.0.2"
     },
-    "gregory.hellings-mbp": {
-      "external": true,
-      "system": "aarch64-darwin",
-      "user": "gregory.hellings"
-    },
-    "gregs-MacBook-Pro-16-inch-Nov-2024": {
-      "external": true,
-      "system": "aarch64-darwin"
-    },
     "hosea": {
       "ip": "10.42.1.7",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
@@ -59,12 +50,13 @@
       "external": true,
       "system": "x86_64-linux"
     },
-    "ivr": {
+    "gregory.hellings-mbp": {
       "external": true,
-      "system": "aarch64-darwin"
+      "system": "aarch64-darwin",
+      "user": "gregory.hellings"
     },
     "jeremiah": {
-      "aliases": ["buildbot"],
+      "aliases": [ "buildbot" ],
       "builder": true,
       "ip": "10.42.1.8",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0",
@@ -74,19 +66,15 @@
       "tags": ["builder", "kube", "server"],
       "nebulaIp": "10.157.0.5"
     },
-    "kuma": {
+    "gregs-MacBook-Pro-16-inch-Nov-2024": {
-      "ip": "10.42.1.19",
+      "external": true,
-      "nebulaIp": "10.157.0.8",
+      "system": "aarch64-darwin"
-      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIhr+LmYMOk4Hixxew2FiAvL8sycgQvnhK8PBGjfnkJb",
-      "system": "x86_64-linux",
-      "tags": ["server"]
     },
     "lithic": {
       "external": true,
       "system": "aarch64-darwin"
     },
     "linode": {
-      "connectAddr": "thehellings.com",
       "ip": null,
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
       "ts": "100.109.86.8",
@@ -94,6 +82,10 @@
       "tags": ["public", "server"],
       "nebulaIp": "10.157.0.1"
     },
+    "ivr": {
+      "external": true,
+      "system": "aarch64-darwin"
+    },
     "MacBook-Pro.local": {
       "external": true,
       "system": "aarch64-darwin"
@@ -135,22 +127,22 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
       "tags": ["server"]
     },
+    "joel": {
+      "ip": "10.42.0.4"
+    },
     "k3s": {
-      "aliases": ["*.k3s"],
+      "aliases": [ "*.k3s" ],
       "ip": "10.42.5.1",
       "nebulaIp": "10.157.100.1"
     },
     "nas1": {
-      "aliases": ["*.nas1"],
+      "aliases": [ "*.nas1" ],
       "ip": "10.42.1.14",
       "ts": "100.114.187.61"
     },
     "printer": {
       "ip": "10.42.1.3"
     },
-    "pve1": {
-      "ip": "10.42.0.4"
-    },
     "pve2": {
       "ip": "10.42.1.15"
     },
@@ -169,8 +161,7 @@
       "ip": "10.42.1.17"
     },
     "pve4bmc": {
-      "ip": "10.42.6.4",
+      "ip": "10.42.6.4"
-      "mac": "00:25:90:4a:d8:2e"
     }
   }
 }

pkgs/default.nix

@@ -16,15 +16,12 @@ let
     adblock_update = c ./adblock_update.nix { };
     brew = c ./homebrew.nix { };
     create_ssl = c ./create_ssl.nix { };
-    dockerCompat =
+    dockerCompat = pkgs.runCommand "docker-compat" {
-      pkgs.runCommand "docker-compat"
+      nativeBuildInputs  = [];
-        {
+    } ''
-          nativeBuildInputs = [ ];
+      mkdir -p $out/bin
-        }
+      ln -s ${pkgs.podman}/bin/podman $out/bin/docker
-        ''
+    '';
-          mkdir -p $out/bin
-          ln -s ${pkgs.podman}/bin/podman $out/bin/docker
-        '';
     gcc-tune = c ./gcc-tune.nix { };
     #gen-build = c ./gen-build { };
     hms = c ./hms { };
@@ -32,7 +29,6 @@ let
     inject = c ./inject.nix { };
     setup-ssh = c ./setup-ssh { };
     upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
-    zim-updater = c ./zim/updater.nix { };
   };
   x86Linux = {
     qemu-hook = c ./qemu-hook.nix { };

pkgs/zim/blobs.json

@@ -2,18 +2,18 @@
   "en": {
     "gutenberg": {
       "name": "gutenberg_en_all",
-      "version": "2025-11",
+      "version": "2023-08",
-      "hash": "sha256-AWd8jVVKHKssv9AgrJnryn3Wx0084NE/JmorpgPfryg="
+      "hash": "sha256-OXmdHdsLZcW4nCUQsy7sMpUssS8NV7ztkCgS/nsISuw="
     },
     "phet": {
       "name": "phet_en_all",
-      "version": "2026-05",
+      "version": "2025-03",
-      "hash": "sha256-zAAq/X5rjQUiYmjMpBtWP5z3J2ZHJMmIxFKnxLAhOlA="
+      "hash": "sha256-ARuUzU2o17J2/ZedHc2acXl33dtHCbQJEb72UQUEm1Y="
     },
     "wikibooks": {
       "name": "wikibooks_en_all_maxi",
-      "version": "2026-04",
+      "version": "2025-10",
-      "hash": "sha256-wt7Zr+RkfCsFrOudMCYBADacu6IvPQDkZ6Y0VG2j9hA="
+      "hash": "sha256-ONBh/ze1Fv2Ffm5b9vDzYS/i2cWSa4pM4MLZnozr2n8="
     },
     "wikipedia": {
       "name": "wikipedia_en_all_maxi",
@@ -22,40 +22,40 @@
     },
     "wikisource": {
       "name": "wikisource_en_all_maxi",
-      "version": "2026-05",
+      "version": "2025-11",
-      "hash": "sha256-OA4b+U8mxpcX3fst6hrMyctucYTQOlG/b4qZDiVlcf4="
+      "hash": "sha256-p1Jio+PMTZVSLIDIOBeMG3acXJg83CwQM7zIWDUyozM="
     },
     "wikiversity": {
       "name": "wikiversity_en_all_maxi",
-      "version": "2026-05",
+      "version": "2025-11",
-      "hash": "sha256-8mZ1CSUcF4QnDIyN0M2KedQ4pcSUCmzHBlOm93MYpCE="
+      "hash": "sha256-IG/gAUdc/vHRrIWGHhw8vMJdLWwqrNbfh+SiclQRIAI="
     },
     "wiktionary": {
       "name": "wiktionary_en_all_nopic",
-      "version": "2026-05",
+      "version": "2025-09",
-      "hash": "sha256-Dwiz+viVQt0zb077R9KQRgtUtxG9ixA/DeXAkCdD4rM="
+      "hash": "sha256-Ghcb60qeGaSJtTKQkJoMx/XucX7Lt1XY145lD3gHlMg="
     }
   },
   "fr": {
     "gutenberg": {
       "name": "gutenberg_fr_all",
-      "version": "2026-01",
+      "version": "2025-10",
-      "hash": "sha256-sGn1TeKwBK0+Er5YOJWq6g0itEm4gIGvKxv/PW0DIao="
+      "hash": "sha256-gLHxLXJNwwcxM/mZHtoJ8ojbGQ1fugxgni/+RXccwhU="
     },
     "phet": {
       "name": "phet_fr_all",
-      "version": "2026-05",
+      "version": "2025-03",
-      "hash": "sha256-bJmchFnaPcofE/hy3ZcRggMT9osHqXwLbwMLJ+cpF28="
+      "hash": "sha256-CSboZNTIowLLhp1u9wkxH8xmu3LvQNx5q493AOYJRIc="
     },
     "wikibooks": {
       "name": "wikibooks_fr_all_maxi",
-      "version": "2026-07",
+      "version": "2025-09",
-      "hash": "sha256-csI+E5UFGi42BLGWWHxQhVr5KSihCFc53KGKwo557Ck="
+      "hash": "sha256-KHCc/73L5Bd9iZ47SRV6vpI8fVM1v9hk1TpEvTro2uo="
     },
     "wikipedia": {
       "name": "wikipedia_fr_all_maxi",
-      "version": "2026-05",
+      "version": "2025-06",
-      "hash": "sha256-YUAbGzYYr+c2RQqGjHIF9XL1kNsxDgRKnHK1H7/PtDE="
+      "hash": "sha256-ve7Mbh96/ObNbV/KVNYZpfLN+HdWlJ7C5LItEdVkRH0="
     },
     "wikisource": {
       "name": "wikisource_fr_all_maxi",
@@ -64,25 +64,25 @@
     },
     "wikiversity": {
       "name": "wikiversity_fr_all_maxi",
-      "version": "2026-05",
+      "version": "2025-09",
-      "hash": "sha256-nVDHtkWIOJkoiGixnA1zVR1QS58thjc12FJyagK3Ec0="
+      "hash": "sha256-55fdtw/cRezq6nkRp6wuwkukBiqsQKdwh9QWVAgFcBI="
     },
     "wiktionary": {
       "name": "wiktionary_fr_all_nopic",
-      "version": "2026-05",
+      "version": "2025-11",
-      "hash": "sha256-7UXByW2IIL0hec8RPT39jpg5IEGvRMD47hc4Y4vFkJs="
+      "hash": "sha256-P0CJptee5rDzccxyRDBzyRLuuFOcaLsJYi6DkBFUfIc="
     }
   },
   "ht": {
     "phet": {
       "name": "phet_ht_all",
-      "version": "2026-05",
+      "version": "2025-03",
-      "hash": "sha256-GiJ1jllhioyMYidQ7+Lcbdd9JN2yf04ZQgnO8XaGAqY="
+      "hash": "sha256-bHrPzE8H7ptrP6r5wPlXSsXNlTiKxJ9KatABC4kwx+s="
     },
     "wikipedia": {
       "name": "wikipedia_ht_all_maxi",
-      "version": "2026-07",
+      "version": "2026-04",
-      "hash": "sha256-InS9cMRaIv9ArlKVwKUypz56m4DgSR7Tl6XpSTMzH+o="
+      "hash": "sha256-qUX0pKxIyNsWX4V6kNIsP4Z9nc6TDhwdDR0MmpDOQFs="
     }
   }
 }

pkgs/zim/updater.go

@@ -9,7 +9,7 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
-	"reflect"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
@@ -17,144 +17,27 @@ import (
 
 const BASE = "https://download.kiwix.org/zim"
 
-// ///////////////////////////////////////////////////////////////////////////
+func getTypes() []string {
-// ////////////////  THE BLOB ITSELF /////////////////////////////////////////
+	return []string{
-// ///////////////////////////////////////////////////////////////////////////
+		"phet",
-type Blobs struct {
+		"wikipedia",
-	En    Language `json:"en"`
+		"wiktionary",
-	Fr    Language `json:"fr"`
+		"wikiversity",
-	Ht    Language `json:"ht"`
+		"wikisource",
-	dirty bool
+		"wikibooks",
-}
+		"gutenberg",
-
+		"ted",
-func (b *Blobs) Populate() {
-	done := make(chan bool)
-	waitFor := 0
-	// Launch self-populating efforts
-	blobType := reflect.Indirect(reflect.ValueOf(b)).Type()
-	for f := range blobType.Fields() {
-		if f.IsExported() {
-			//fmt.Printf("%s:\tBeginning population efforts\n", f.Name)
-			waitFor += 1
-			go reflect.Indirect(reflect.ValueOf(b)).
-				FieldByName(f.Name).
-				Addr().
-				Interface().
-				(*Language).
-				Populate(strings.ToLower(f.Name), done)
-		}
-	}
-	// Wait until all languages are completed
-	for d := range done {
-		waitFor -= 1
-		if waitFor == 0 {
-			fmt.Println("Completed waiting for all languages")
-			close(done)
-			break
-		}
-		b.dirty = b.dirty || d
 	}
 }
 
-/////////////////////////////////////////////////////////////////////////////
+func getLanguages() []string {
-//////////////////////// The Language ///////////////////////////////////////
+	return []string{
-/////////////////////////////////////////////////////////////////////////////
+		"ht",
-
+		"en",
-type Language struct {
+		"fr",
-	Gutenberg   *Zim `json:"gutenberg,omitempty"`
-	Phet        *Zim `json:"phet,omitempty"`
-	Ted         *Zim `json:"ted,omitempty"`
-	Wikibooks   *Zim `json:"wikibooks,omitempty"`
-	Wikipedia   *Zim `json:"wikipedia,omitempty"`
-	Wikisource  *Zim `json:"wikisource,omitempty"`
-	Wikiversity *Zim `json:"wikiversity,omitempty"`
-	Wiktionary  *Zim `json:"wiktionary,omitempty"`
-	dirty       bool
-}
-
-func (l *Language) Populate(code string, done chan bool) {
-	childDone := make(chan bool)
-	waitFor := 0
-	languageType := reflect.Indirect(reflect.ValueOf(l)).Type()
-	l.dirty = false
-	for f := range languageType.Fields() {
-		if f.IsExported() {
-			ptrPtrZim := reflect.Indirect(reflect.ValueOf(l)).
-			    FieldByName(f.Name)
-			if ptrPtrZim.IsValid() && !ptrPtrZim.IsNil() {
-				waitFor += 1
-				go reflect.Indirect(ptrPtrZim).
-				    Addr().
-				    Interface().
-				    (*Zim).
-				    Populate(strings.ToLower(f.Name), code, childDone)
-			} else {
-				// TODO: Figure out how to set a value over the nil pointer
-				// of the field, so we can auto-detect when these are available
-				// in the future
-				// waitFor += 1
-				//z := &Zim{Name: f.Name, Version: "1999-01-01", Hash: ""}
-				//ptrPtrZim.Set(reflect.ValueOf(z))
-				//go z.Populate(strings.ToLower(f.Name), code, childDone)
-			}
-		}
-	}
-	// Wait until children are all done
-	for d := range childDone {
-		waitFor -= 1
-		if waitFor == 0 {
-			close(childDone)
-			break
-		}
-		l.dirty = l.dirty || d
-	}
-
-	//fmt.Printf("%s\tFinished populate\n", code)
-	done <- l.dirty
-}
-
-// ///////////////////////////////////////////////////////////////////////////
-// ////////////////////// A Single Zim ///////////////////////////////////////
-// ///////////////////////////////////////////////////////////////////////////
-type Zim struct {
-	Name    string `json:"name"`
-	Version string `json:"version"`
-	Hash    string `json:"hash"`
-	dirty   bool
-}
-
-func (z *Zim) Populate(category string, language string, done chan bool) {
-	//fmt.Printf("%s:%s\tBeginning populate for\n", language, category)
-	// Look for a possible Zim file
-	links := getLinks(getPage(category))
-	link, err := getName(links, category, language)
-	if err != nil {
-		fmt.Printf("%s:%s\tNo zim found\n", language, category)
-		done <- false
-		return
-	}
-	//fmt.Printf("%s:%s\tFound link: %s\n", category, language, link)
-	// Extract name and version
-	re := regexp.MustCompilePOSIX("^([a-zA-Z_]+)_([0-9-]+)\\.zim$")
-	match := re.FindStringSubmatch(link)
-	if len(match) != 3 {
-		fmt.Printf("%s:%s Matches: %s", language, category, match)
-		os.Exit(1)
-	}
-	// Check if the name and version mismatch
-	if match[1] == z.Name && match[2] == z.Version {
-		fmt.Printf("Skipping existing hash: %s\n", link)
-		done <- false
-	} else {
-		z.Name = match[1]
-		z.Version = match[2]
-		// Fetch the Zim file, if it differs from what we currently have
-		z.UpdateHash(category)
-		done <- true
 	}
 }
 
-// Helper function to fetch the HTML of a given type page
 func getPage(t string) string {
 	page, err := http.Get(fmt.Sprintf("%s/%s/", BASE, t))
 	if err != nil {
@@ -165,7 +48,6 @@ func getPage(t string) string {
 	return string(pageBytes)
 }
 
-// Helper function to parse out all the links from the page
 func getLinks(page string) []string {
 	ret := []string{}
 
@@ -178,7 +60,6 @@ func getLinks(page string) []string {
 	return ret
 }
 
-// Helper function to get the most likely link for this particular entry
 func getName(links []string, t, lang string) (string, error) {
 	candidates := []string{}
 	prefix := fmt.Sprintf("%s_%s_all", t, lang)
@@ -198,39 +79,44 @@ func getName(links []string, t, lang string) (string, error) {
 	}
 }
 
-// Helper function to get the hash value from the resulting link
+func getHash(ch chan result, file, category, language string) {
-func (z *Zim) UpdateHash(category string) error {
+	// TODO: Only call this if the file doesn't already have a hash
-	file := fmt.Sprintf("%s_%s.zim", z.Name, z.Version)
+	// in the existing file
-
+	fmt.Printf("Fetching hash for %s\n", file)
-	// First fetch the file into our local Nix store
+	cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
-	fmt.Printf("Fetching hash: %s\n", file)
-	cmd := exec.Command("nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
 	out, err := cmd.Output()
 	if err != nil {
-		fmt.Printf("%s: ERROR fetching hash: %v\n", file, err)
+		fmt.Printf("Error fetching hash for %s (category: %s, language: %s): %v\n", file, category, language, err)
 		if exitErr, ok := err.(*exec.ExitError); ok {
 			fmt.Printf("Command stderr: %s\n", string(exitErr.Stderr))
 		}
-		return errors.New("Error fetching file")
+		ch <- result{category, language, ""}
+		return
 	}
 	hash := strings.TrimSpace(string(out))
-	fmt.Printf("%s: Successfully fetched raw hash\n", file)
+	fmt.Printf("Successfully fetched hash for %s (category: %s, language: %s)\n", file, category, language)
-	fmt.Printf("%s: Hash is: %s\n", file, hash)
+	ch <- result{category, language, hash}
+}
 
-	// Then, convert the hash to SRI
+func outputIsValid(o map[string]map[string]Zim) bool {
-	cmd2 := exec.Command("nix", "hash", "convert", "--to", "sri", hash, "--hash-algo", "sha256")
+	for a := range o {
-	out2, err2 := cmd2.Output()
+		for b := range o[a] {
-	if err2 != nil {
+			if o[a][b].Hash == "" {
-		fmt.Printf("%s: Error converting hash to SRI: %v\n", file, err)
+				return false
-		if exitErr, ok := err.(*exec.ExitError); ok {
+			}
-			fmt.Printf("%s: Command stderr: %s\n", file, string(exitErr.Stderr))
 		}
-		return errors.New("Error fetching file")
 	}
-	z.Hash = strings.TrimSpace(string(out2))
+	return true
-	z.dirty = true
+}
-	fmt.Printf("%s: Successfully convert hash to SRI: %s", file, out2)
+
-	return nil
+type result struct {
+	category, language, hash string
+}
+
+type Zim struct {
+	Name string `json:"name"`
+	Version string `json:"version"`
+	Hash string `json:"hash"`
 }
 
 func main() {
@@ -239,31 +125,90 @@ func main() {
 
 	// Determine the output file path
 	var outputPath string
-	outputPath = *outputFile
+	if *outputFile != "" {
+		outputPath = *outputFile
+	} else {
+		// Get the directory where updater.go is located
+		execPath, err := os.Executable()
+		if err != nil {
+			// Fallback to current directory if we can't determine executable path
+			outputPath = "blobs.json"
+		} else {
+			dir := filepath.Dir(execPath)
+			outputPath = filepath.Join(dir, "blobs.json")
+		}
+	}
 
 	fmt.Println("Writing file to ", outputPath)
 
 	// Read existing cache if it exists
-	var blobs Blobs
+	cached := make(map[string]map[string]Zim)
 	if data, err := os.ReadFile(outputPath); err == nil {
-		if err := json.Unmarshal(data, &blobs); err != nil {
+		if err := json.Unmarshal(data, &cached); err != nil {
 			fmt.Printf("Warning: could not parse existing cache file: %v\n", err)
 		} else {
 			fmt.Printf("Loaded existing cache from %s\n", outputPath)
 		}
-	} else {
-		fmt.Printf("Error reading file: %s", err)
-		os.Exit(1)
 	}
-	blobs.Populate()
 
-	ret, err := json.MarshalIndent(&blobs, "", "  ")
+	output := make(map[string]map[string]Zim)
+	comms := make(chan result)
+	pendingHashes := 0
+
+	for _, t := range getTypes() {
+		page := getPage(t)
+		links := getLinks(page)
+		for _, lang := range getLanguages() {
+			if file, err := getName(links, t, lang); err == nil {
+				if _, ok := output[lang]; !ok {
+					output[lang] = make(map[string]Zim)
+				}
+
+				// Check if this file already exists in cache with same name
+				if cachedLang, ok := cached[lang]; ok {
+					if cachedEntry, ok := cachedLang[t]; ok && cachedEntry.Name == file {
+						// Reuse cached hash
+						fmt.Printf("Using cached hash for %s (category: %s, language: %s)\n", file, t, lang)
+						output[lang][t] = cachedEntry
+						continue
+					}
+				}
+
+				// File is new or name has changed, fetch hash
+				output[lang][t] = Zim{file, ""}
+				pendingHashes++
+				go getHash(comms, file, t, lang)
+			}
+		}
+	}
+
+	// Only wait for results if we actually spawned goroutines
+	if pendingHashes > 0 {
+		hashesReceived := 0
+		for r := range comms {
+			if entry, ok := output[r.language][r.category]; ok {
+				entry.Hash = r.hash
+				output[r.language][r.category] = entry
+			}
+			hashesReceived++
+			if hashesReceived >= pendingHashes {
+				close(comms)
+				break
+			}
+		}
+	}
+
+	// Verify all hashes are present
+	if !outputIsValid(output) {
+		fmt.Println("Warning: Some hashes are missing from the output")
+	}
+	ret, err := json.MarshalIndent(output, "", "  ")
 	if err != nil {
 		fmt.Printf("Error marshaling JSON: %v\n", err)
 		os.Exit(1)
 	}
 
-	err = os.WriteFile(outputPath, []byte(fmt.Sprintf("%s\n", ret)), 0644)
+	err = os.WriteFile(outputPath, ret, 0644)
 	if err != nil {
 		fmt.Printf("Error writing to file %s: %v\n", outputPath, err)
 		os.Exit(1)

secrets/dendrite.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q MDrURGpcaqY6DVIURK6dJs7xKCGLtFS8+hH0UCRT7G4
+-> ssh-ed25519 87huqg tRkWo/tXovX5ukc6DRiC55s28fMJvry4lgSWeGnQXHY
-qsqMoWCrssVlJ2kP1cvP9+Fj+c07iFvbFs3Cs+RYVLM
+G266810Co/QUFWle5j9W8P2+cfoUmZ5gEKcCNg5jw1A
--> ssh-ed25519 UFfTmg lTHOOV5/G7IPaYWqrAwM9Nb75//N9O1wMDFSUtyo1gI
+-> ssh-ed25519 8UnW5Q OqyBBxWRBBpAlS93lZ+TGl2O2NwhS5/ZsMbN/sUiUVI
-kEWctDmQRHNzxMIwONsZo9EEIc/wkPxqX851BO6ohYo
+N6csZzFJUU17JEsLUVRzBhM1at00bu9rUzXE5JAML9Q
--> ssh-ed25519 xNtnoA lm6OHoKNa8wB1ML5lA/xl13Xp8WUSF2UY89bP8BZP0E
+-> ssh-ed25519 UFfTmg iuxAyKikNUPm9QJU9O8UYspvWjWe7Te26uzPN6s8yww
-iPDWUaoViQ7faVkUf2V1MQxrklAw8lJ2KXfJZTYN2X4
+VCpWZVtTwHlOC7PXk6xIezNbIMgFObavv1AFinouU40
--> ssh-ed25519 aY2AXA 4E8FsRsfsEKsLNVvBRTAoxghfex8omAQcy8NKzJ17kw
+-> ssh-ed25519 KbVVUw pVU1pSoYn5SiePORWE9bJk+w8pn76xyhFrXi3PQJ0GE
-uzZQp9nVfyVH3dz0UinqZjsZ0Kft7tPVSk1EkE6NvA8
+d8Y2dt840M954ZrqRoSeUPDjPLoM4EJwKwu4+5ehddw
--> ssh-ed25519 AQhf1g rgcA2UeG0s75kSpok9+VR4ixNyZUqD+8ye1TJsMMA3Q
+-> ssh-ed25519 xNtnoA L8MxfT93s2I42dirqXnf+VRWq26NPuZ6Ta+0vcbwYRs
-rfM5/54WWHrnG1qfex57tGH97lbvKM+J6TGztYOrU+c
+0RyuZdK1sqCpuMDVpUpJkOs8OGhjz4vojNpmInX4a9o
--> ssh-ed25519 r/3ipA 7pNJRvOFO5v2nlMPbXP9oad6jp1pPAsByfiEhdCTAWI
+-> ssh-ed25519 aY2AXA prgbsTVqCxDqX9fB1SwH0Pz3wHNNut2Kd/g2CT3pE1I
-Vh+iyg2P6fvNWyCS+V4087zRf+pCIBj0jsPX0DtPp0c
+12LcMPa0xpx3vtrmNQ0JrJa5PUCcV+jj5s4c4ttRn18
--> ssh-ed25519 mOmPfg 9WuzH4QasTe0NNcIf+XSremq5GuBZoKP+7t4MJNAFA0
+-> ssh-ed25519 AQhf1g Tdph+xLV/TIYMxExaUo+xgqd2Cl5o+BCSEKHWhYpTio
-5E1Rbupw8IUnTuicTubXWmwkJ2xVg5K4BpkZCsUj5UU
+ecuPMlwtgIbBoZ5mucYglIamW8FqeJT4ZXs84CcSaAM
--> ssh-ed25519 YJiRbw msPFM69Tuy/luxASGVA8ey77vqtvXNy7ytf2VxQWNi8
+-> ssh-ed25519 mOmPfg pmE+ZERem6G19KtQ339alV0mlSZxOdU0s/NSY9oykzQ
-oD5vRs439A/YT5FxkSltl1Qf56NNhiKt17++vlFvwPA
+i57l9Oxl4mLYquHwFIsbPtmhyjyH62MereQzNf/vvhg
--> ssh-ed25519 Nl/5yA C3zn641k6eFQePbp2q7dwlIu7Iiw2aU5dmSrH2HCai4
+-> ssh-ed25519 YJiRbw 7Q2ue0YEapF+lK7204mDbRTOxU4BrWC/01umQw0DCCM
-v1/XJRKIrIgHWfFtSDaFCvOKtcIR84abUZHPjaxP5bw
++Ulv7yL+02WvDmrtlujCD7zR6V2Npm3WMqvvSyIpOH0
--> ssh-ed25519 GdLgCQ ZztOWiw1ao1pvJ9REB/wBuxq00uyO+JAkIWjLUMueSc
+-> ssh-ed25519 Nl/5yA 0FmOQ2WA+qXbhHy6WimadXJKVmgUsRBbOPsgFJ6Qtiw
-zXSv3MauG2E2el+Yv5oocTgDQjQ1fKXLpm6y2OTyIvw
+xhJkG+SSdnYgMWeJk7ciLI9bS+c403p2PqVRObk9ezA
--> ssh-ed25519 tOH/HQ /eEgAf2KH1Zgd4yQf+kzyESkvPI8GKJC0MAJl+8+WD4
+-> ssh-ed25519 GdLgCQ Ovn3zHYbFImNyPz07xjMDYnUCnHpejotNfVyD6olgGc
-H35T+ulGSCrWAuIsZs8ISRJRj2wqpRrOGlaoq9fnN5o
+AfF78TueIj5jnz+q7vrXyu1BZ6VN0hkTpg1LItmnCYw
--> ssh-ed25519 FpzvfQ dRq/NtT/TxJ/k9WlaMl/PrLTvPzkhV8LpF/LxjqjGmM
+-> ssh-ed25519 tOH/HQ x9alUL3V2mHyQHt5vPIDBq+TNE0tYkJuP8KYE80VinI
-LJN8xxnNF3EcMmXKdLhc70b2Y6n9qS3A5wdFXY6hUjw
+se1kqe3o8bKr1AkgH55NTPMD6ZRkdcLIIZ0YhEVkTq8
--> ssh-ed25519 2UotMw I+kJsu4GAflSfMjzE/8+vp6AZb88OpiCREuxfAnQPis
+-> ssh-ed25519 FpzvfQ W6oRWhWgbZjLrJTkFj9LJWcq3gapz6vRtdSjV4g/yzE
-hRu7IbLMdc3U+NQo1PDhc+O9uyd/wJZyPtfTv9z9TvI
+GYh8HSC0mPRGRu7jT7DGx3py0Gvu/zu3BzVdXL8gU1A
--> ssh-ed25519 kdPvzQ uOLSQFzsGSNg1HsiJLCYi2Lp8pasc7H/jhUBlf6b0zg
+-> ssh-ed25519 2UotMw +XsUycMbAALayfAxF/SvkoWv5ubzWp/RvJcD9sWeSAY
-KbUOl2WOsc6VuAC33SjEJS3tM3o82A3QO0bA9wd0rbA
+j3lHaEJzFk7R48RNbGNzcMs97p12n88L9WjockK1N+g
--> ssh-ed25519 onmXpg NKdAvcN3TStWYtQeLW1oEn7+shQuuNBndHaQRAU4f1o
+-> ssh-ed25519 kdPvzQ X06P2aEDkUoSk0KVLZWC9DGyNnVlleeBft1xQPecDnA
-vCuDnPc3tayIwDbHJneLQNoENyfA6GRpQi6+OZ34Jjc
+6p3jxcHePWO+cf4hnALXxaa5bN8B9AZo+qodDyK/Evc
--> ssh-ed25519 CnhD0g Co6fy3fm8BUi2qn+xBY1X33N2m40jEM7CJhSQcLokR0
+-> ssh-ed25519 onmXpg +9uXItde+0h/bBcSEwZ57y36bxwwoCWY2SvN1jG7rVM
-kwrOzTRiVe1aQH/P+ua3xZNgNRZh2pfQrQl2k2Y727Q
+2VyLiThmzYQeDOk7TaUUslec0qvr7UMSiBTHsEpR6ss
--> ssh-ed25519 4ep2UA /f1HxU62FqhDJyJ9fPMKiqJdw1m/UjASKuYhY5Aq8D8
+-> ssh-ed25519 CnhD0g feqQLfUYnakAiHJo+gWHrbd5o9WyQ/qluJ7/d/n7PGU
-tckIOvPq3Qid9Z5ud2v9syaed/h+3GrackXKZonDYEg
+g5l7RvpeBRwnFRKhAED75QC0d6DiGlFho3D5tPumiIY
---- FHj/yA6RDV1VYPsi84z5Y3NrbfVUthwdtuRWqiKC57Q
+-> ssh-ed25519 4ep2UA nkc+pDUli0BTe7XoDAJEOLnBDeiekZSv7XVL3POXCTc
-Õ=Â7T÷Ü`6¦K./	¾¿àO	Ö¼‰R•Pá€K…2NYqWÖ¹£®ê0v{±µi'¢žÖVûÆ!+‘|ÎÕ0¿ŽšÆ¼ú´Ìi ½†Ä?Q�Žq¢2Ô5ÖÀéŽgÜ/c_
+iWQSdc2hWP2UvyyISoUBKOhRotPCv2ySsfmoAAOLgFM
+--- YRWXRvqVNx+YrIEW8vp0RcJLM/leQUhHD1WKnaEqprA
+$f4jAjlÚaôp@™ e¢!(°^˜rˆèJ÷¾%h¼h@37üß1š+'žª´pŸ­œ†ÿbÿó1,¦jÂôA´n£€X¹ð‰¤3jýÈÇ[ìÑW#E\NÑÓÖ}¤

secrets/dendrite_key.age

@@ -1,38 +1,40 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q 5p80c2oBsZh9KTXU+ZT2AKbbEMOKxlAouHew8KU8kns
+-> ssh-ed25519 87huqg 42tvGwJ82PwlXbr+TqSz08omHABPqv1TH5plKNLLvkY
-ZvUnyZjn/HYmxHBth7ognoHB9zsUe43Y6c084D4xdHc
+4Xwl0lc+zSL4k1PuIO9qF1Ci8mOOWciq5yGbbqW6nLE
--> ssh-ed25519 UFfTmg 9ol6Gp3stU0jwPzkr9CcLLYftYTr614jBfba226E7xU
+-> ssh-ed25519 8UnW5Q gGcbBcV2tF2UaaYBvM/jiNH8Lc9Fl62NZIWSbNVZeX8
-i7CZagRKOmUn2uVmzyuCJQdbtAJoDbJZxpMNDtrH7/M
+1TLxRM4e4/T/q/8Bdx/W3Sg5eeq3g6aUcka2kizF1O0
--> ssh-ed25519 xNtnoA QZ/CQO4j7T5qC4ohLMEt0i1B8cuMGYgWOAwj6HSPDVs
+-> ssh-ed25519 UFfTmg oNyxvAIg2hYEJ6Z3r9MzuR5YgPW432T03/mcjLeLOgs
-Nh30qP0yZcAw2azpFA+Pi6746+kmM5D0fZUYL1uTzmU
+NZOFUzuaaxwGbQDkDinSzjbFPrFETbQOEJwrgyYtKpY
--> ssh-ed25519 aY2AXA C+1SvOQKdrTk3UNOLdiHrK8e88BBztlMqE3Cofm6ZUI
+-> ssh-ed25519 KbVVUw annu9kT2zbKvaE3WwGtDGhvku/Pj8a4P5GEQLhahZiE
-F26HpuL7HY2nsC72KDgZMbfQ9Hbmvcr/nms/d8cCjro
+RKg/owcXYN5pqsDxjlaNPg6um/7/eoXxZ5oJxxouxjE
--> ssh-ed25519 AQhf1g ZWLSoDJiiQswh4GyhL4P82X03SNSRnDPmZk3w5nyakU
+-> ssh-ed25519 xNtnoA tN13P6fRYHjVTmXo7w6y/ljzr/8nEqrlgZXpG5jA218
-r6k53tUfB/J6WJuGSmU23frSkcw3jpe76d6vlIfPXcw
+wg4SUSCWqE3iskGPE9qJ5Ot68pcvwCi9fmE5NXZqYCI
--> ssh-ed25519 r/3ipA cH7gfgcgS8oRx/GKlolPIQ5WzbP+i+xGHfzjqCQ7NwI
+-> ssh-ed25519 aY2AXA VdvvL8lgjZBhflonEI96VSFgYaUX3Tfvjo148BA+Uks
-Tv8lSRcUitEx3oWa8hT330K8DYt+PWR2mHetY1rzCPE
+ZljFDZ61GKr24lWG8z8sKke1TpTCiSeqyd05yxNFTVo
--> ssh-ed25519 mOmPfg sfr1m6QIkqpHLeunlYCc9LjVPC0XqXnH9z75IoSRgCs
+-> ssh-ed25519 AQhf1g jKvD41VnPGoCBEva5llD2NQo42TDnpp9M28BTBewuR8
-heS/IaQwkt2IQRNcKeNfsAzKGGLEdiUzQxdPll4CRt8
+TSBZqNLhG/PyToBnX2kwevA35QKmKcjwcPe8/JUcywM
--> ssh-ed25519 YJiRbw 9oF0E5s2LCHrjFozDq6GbYH8UkzSaPH/4ore75bwe24
+-> ssh-ed25519 mOmPfg /yX7XUVozu8ZTCW9gJyoGd7EzBISb0c+i08HEsN7ODw
-8PHPtU/fDDFkcEPXHAyrp7LBDHwRtTX/u29+jJCzsXQ
+e1rAICTZajIF0AaWXBATDNuqQK4GAqxEjgxvaRzDark
--> ssh-ed25519 Nl/5yA 3xAZWLQ27UtB3kZiEbIBPlkO99ZsAD6k0oOTmXODLT4
+-> ssh-ed25519 YJiRbw cy9m8KQln8ryxLEqx1tIoZRq4SiABQFT5IzmMlgkQjA
-ia6BrKBYSe3BM728ysyBfSjwtQoev/NrTq+Bnp+z7hM
+P4OLv+oTFhgnLzb4YrhFdV6jreAGhXBkMCe7pb31KTw
--> ssh-ed25519 GdLgCQ otupOJf1nJV+w4BlivVEer7x4C1aEU8zIMLmLSlPiyM
+-> ssh-ed25519 Nl/5yA Nx8mErRdN8sIaj8ueWnDkSw5vBhfkOW5Rk2ND3gwZmY
-BHv9OTNsxkYBlA2sI3x3cEXjr7GSyVlaQZIGBSua4+s
+6elVFcWQnwmh7NvRm17+WahOkvLmQbqBBKnruHT3yp0
--> ssh-ed25519 tOH/HQ UnszNH3sEPqlpEuhJTzYG/gwBE7e4/P2VVRkroceZD0
+-> ssh-ed25519 GdLgCQ WwKSzJsPG8vJjRjc+nkyvGKtqLvpKe3V158fRezWtzk
-L9HBZkhn3zbOIhrkBo3ezvp/Qv8Lc/BzS57npaH+nwQ
+mKdk9Z2wOipmc6brgNWeIbxADdkkXAFcs8E956RdHTs
--> ssh-ed25519 FpzvfQ S8QZlLoN2FVpAajpsOqaEPHZGfXAr/k4ZXY8PKEiA28
+-> ssh-ed25519 tOH/HQ /CL2OxE6C8ZCfHgHTQQJmuACG5lZ8AdVpDe1YfG9mHw
-hJsIvLf77JG87Gqe0dDq16dsSKSlJZZPGbYrWv1oBlU
+7uaalUdP5vCjsLEYdp+LREaxU3Vo0VUCVXn/H0WAa4I
--> ssh-ed25519 2UotMw kRIdExrBlEQToh6itvMGel7UIVDTEIVqb159d1CWmAI
+-> ssh-ed25519 FpzvfQ hE8FGN82H81RWUm+LgCuvQMWra0ulwMHuGSYTdQvc10
-Bkse9A2smfngBC5WmDmes3ALMvoxeZw3ypvVBxWjWcY
+Eq/btSgef+2nkQGreBhqRKAt/6CFo5ahdRbBfCO5Bv8
--> ssh-ed25519 kdPvzQ 4O3g6LMdWv6OiBP5mjZtWa6ERd4s3d1mawlW3ZjajjI
+-> ssh-ed25519 2UotMw mqdgTsPI9vockRACf/NdD466WkIyQvSLuEJSrT5mDwo
-HqzRVYB5Vko0x2rK1d6DHcAQdla3gsTSyTXcZNeP2c4
+hyZQCiUCu8gfVTCZ8wMxo+i+CqjhE9t+hdJrJcm1dNs
--> ssh-ed25519 onmXpg grxgbmSfJvZ4lNpBOEsVUVnRXNmXe8GybiTg4BhzWBc
+-> ssh-ed25519 kdPvzQ fO2iL5QnWBxRFe88W488dkezFsMxJtMBc5GKACOZYjk
-po3Ka11xxQobByCWHvzj4z2MT7AYtoUEvHPkdlVcyPw
+NPa4r9t7lPt3mMgHjT6soAK/RWLUe70Lh5i7LwRYlgE
--> ssh-ed25519 CnhD0g hwhHSq2AFrZelQtkfegSSLXbUVAERTH6yoiehI+xbHE
+-> ssh-ed25519 onmXpg 9N98xltPTCAb42chNAOb4hYr7equq0lk9nTqol3EKXU
-sGBl0wu73Refzt/k2iM5BFw5rhFiXV+PKO6L4PrDsJE
+tdQ7FSABTifm9sHKzOVFyoEbOjS9TYS7DPsFrBqmnLo
--> ssh-ed25519 4ep2UA aNkohdDISDwG6Tuqq9IStUqwIgC0gueGAiCh+gyDsl4
+-> ssh-ed25519 CnhD0g 1oi9mdmL6ODCgi3pWGKEqU/QN/v41XQg7nUZiu5frWw
-Kl0AQrVRSfvR8X1zT4ws2paVuZdb+xI4BYFJFMbYmDg
+zXOUj1z6Z6DKyWr2ZqyFFZGNwKkz3NdyEUqWpnl1xI0
---- jS9nG8Wyoh+2f66Ew/ebH5LYRt73NIi+WnEJLHAoyTA
+-> ssh-ed25519 4ep2UA RKc7+piJY2Fh4NnZGvEuAzJIMxr9NBQQBSMj3xQqrSc
-¥¯fŸ
+yqLK6nR4b46QPwnH9DuZ5spzIu8fQMAxmLYNtj5jAu4
-
ä(‹r¶OîŠërv,¸w\Rx¶€§Â޶ܢÚÇrq9Γ’uŒK•j1ÂàSÚa@“¾|pÔ‰Ãy»ª«³Ga¦ƒúfJÆEDŽ¯•]å, ÉjÎL¿äì¼v3Œ<y(õÛûiH›™x=‡	ú:“‰/Õ`üëÏ™h
{¦ñÑN Á\·Í8ЇiJóêvaT…‹÷ÊÏ'¤4xÁÖ*áÏ+¹À=6{ˆŽù‚OÝKEØ'ýøÈ=Q¦!ÿÊI#.˜{yÚIrà´èêf
/
Ýw��Wª—âꎿè%ÊT£ÿ�9x…#n²:MhÏèÅ–µ~3G=¼øF=;9o,ó
+--- R87vMnH5oLHLJgD7rCGZwz6dpc/a0kpm/fi28jqVcT8
+\_UvF9‘ˆ±gøË2�Ä®Ôbá/0=íOÙµò´``lú©žµ^2&…àâWëñº‰W§¼
+Pc–�‹,™häZO'kÒ2›f'hB©ºp>¯l\›M§¤;‰òouFü	ë…œ¥X)P!hÂRo]¬Ø† Ù/{—¶6Ä•÷ƒt»¢¶Á<Þ$6tá[6ÑüAéaó7œÙ–òúhiç«d´Y-jëº »_ý)£“Ò‘b˜˜ƒpÉªÙ9Hå»\HBÂ6dß(}ˆ…~¨¦íåèq¡x5P{x…@ü°G�E0x&0ðYÐÆgó¤¿4•—±z‡•n•!Ù¿ªðòˆÍ�Ð{ú9

secrets/gitea/webhookSecret.age

@@ -1,38 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q FRrvjiuNlnu4/DkwfY2K5p3MdQ5bDF3+u+JKrYiHzGw
+-> ssh-ed25519 87huqg dA1cGGZS6hZzglVHlyxZA6HAGBtZfXYHedZLebiJuxk
-9dGLw4PT4OapoTW2GnoJ85GEWgO3Aepj7hl0LpPZylk
+9jOUxFha5O0lOo/p09thxSrGBeABTiAtc9caKRCXvSs
--> ssh-ed25519 UFfTmg uMTPiCPPoVqt/3SOr+y5oKGTxpFq2UNGrwaRVmnZT1Q
+-> ssh-ed25519 8UnW5Q sT/26ON89MZLDFoMec531z4jvN4zcwtocwKpsy1agm8
-Rn7dRYCGZwYN7sCmAsne6kAuKmD6CFlGXR130ELiJCA
+5lm9F/vDdN0do3Q02VYofWbXVv3v+POcVKe6hQBg4oM
--> ssh-ed25519 xNtnoA FW0dLFehc2yVvpxIDEcVWD1zHspZuvwrn2qgYltdp1Y
+-> ssh-ed25519 UFfTmg mBEIRRxLahorqsYdWRfLKG3Atb0+ks3UPTLZbN/p9Qs
-1zYm+LF/8lvfEhQVr4cbyDF5CfhPu/fNBYZMQLtTrqw
+DMGHYSpSQG+rhg0wB0MUJBVARCcu3fIPodQxEO/glXY
--> ssh-ed25519 aY2AXA aNRD8OIqKluKhHQZCGkW+kS71vlU2N8K6k590eLO7HM
+-> ssh-ed25519 KbVVUw Pbn4kkRR1xiVeGlHqNR3oHCpqVpftztRyyTRI7jbQDs
-PZHX6fqbX0U+55MtJ2iSur7TSHFEgQBiAgpXiGlHbuU
+4Ep3S6WUDXipUdmxuWdZJGy20HWR8MeJ0qG92dkVqRo
--> ssh-ed25519 AQhf1g cIhfdle1UsPx86LETXhB46evMenWtypO4GmL2/oLbXs
+-> ssh-ed25519 xNtnoA tqndUQdkCW7dc/tCVRNwC1953WC8/25J+CuNz7iFXy0
-ezwVMUSz5KbBymwnZlKuLD7RbNBJigfkb4sOpHAAnBk
+jkiSMT9RSIkhyypkhMtKMDAaZcEOfuOs8PN+Fm5RJho
--> ssh-ed25519 r/3ipA Gt94r1I1CUMKrGQKBVgq/FLlOa7V3weD6N1rv/dVIV0
+-> ssh-ed25519 aY2AXA 8c4P/cE9ISbxW1h8j9eMSJ1+Y8mId5AMj6KVW90bHTc
-UsBIZfHiU17IjzhcKc1kvSEIMIk7I/DizSdBGhXNwqA
+Mn7nW8NRF+a/6d+Lv4RlxEkyH4GZnQjo+IrZQpjPscw
--> ssh-ed25519 mOmPfg b3/Gwqh1kik/AuBzcpqsuSuFcK0Pko3hRu32wFB/yks
+-> ssh-ed25519 AQhf1g yGuKYOPodxketnWOUwwsec93545XHR77DdBcSt0nQh4
-X9AXKVJ3d0IV7wkV2ZibScIV9En9uJNyUIPIk7WFKb0
+78/c4+H8hGJFBkG+jHfL20W2rUSO6QeWR1s1YG9rEUE
--> ssh-ed25519 YJiRbw yDkwCFtGXgS18DwqMCBied8+Jt8u2GBWuFQSrajij1s
+-> ssh-ed25519 mOmPfg U+17chXPF1QtSBBS7KIZS2ye63ZnKd55CLspwRmVSig
-eSeFTNbeOT/tDb9iQo/YzThtQeMgNYmEK61o8hjG43k
+nje/FT7zkwDr9/gEzyd5oFBpZ4XmmPbJq0u24eUhHeY
--> ssh-ed25519 Nl/5yA ee68eLzrRi35az65YmfA/WF9VliRmnlPEbGQAet91nw
+-> ssh-ed25519 YJiRbw z1WWdaDEbV46mo1s7c5COi8nsse9G7kZP82+ON8WznM
-2KdTnyBTyJu8q03eH5s4oRyvhTQ6f/qvwrLabvk3C3o
+1sj1t9sM//HcTdaDJDG+sIz55jJ995qVtuE5v83q37M
--> ssh-ed25519 GdLgCQ DAlJqI0uIBSrFpPMfl4FkrpjCO5qkzvJU/PBOWFh+XQ
+-> ssh-ed25519 Nl/5yA kZzDe+hZVtexOK2cWp+xC+avuzOTVhw++MkfdQ/1wjY
-S5tkvMrTrYbOK3U3wWxLn3MuJTfrP8vUIYe6nBpixQo
+XMfktagqBs1UE4iVPPx2rM3SnPns27m4KtqldWVFj+A
--> ssh-ed25519 tOH/HQ zQMhFkG/vkqosDn3VvzuKt4xagkUWoqE/DW6AsYtBGE
+-> ssh-ed25519 GdLgCQ CDa6LXTJhViLliv5wOTxlh1bKVVdhW08cSFggxQAdA4
-MGQA/Jxv/YTny5CyqfQBorfwIUVPZFf/hAcUTFrX9vk
+YzaJCQw5Bnh2buHVTFLCmgQ2+xta5BHvR08gwOxE4Lc
--> ssh-ed25519 FpzvfQ d4cgnsFfo5xGDUFyT65HJ6S6vtzLmvB0eugwq6t0nGg
+-> ssh-ed25519 tOH/HQ 4YF1ffsWDtKw/7A17kmFOVukG9K5jGL3gzVye0FzZ3c
-0hEFjipS1Jbp6xycUsZYHzcjQVJ22JlGMUsjPCkDfbI
+BODYure5YmXASU5XhlfeksA4VqsKaKNp6Q0laeJ3z8s
--> ssh-ed25519 2UotMw C8ukSysPTKrwKCVnqjBzspXLLyJyhn2YCHcr1n0ulRg
+-> ssh-ed25519 FpzvfQ H+dvG6G/fEDsLqHoHW4G8c0RSPooRhRgWUzL+5igAkM
-NErsgu49C3ElHmpsz4q+zR/0Oj+9jBPnC0BErB/48Fc
+BFe1mOGLLURn0I0LHjw4Zue+3s6Ta+GA9vCj+ZNSGpM
--> ssh-ed25519 kdPvzQ oreOkf0nFgkgm5KuEjP28nbbqRZTA/b+bj7SSBmAslc
+-> ssh-ed25519 2UotMw lSaXW+ve24TZnJf0RXdLEJ4FfGiYNZ67LqfkrUWo8Cw
-OrQ99MlWePEk5IVeoC/X4UYLhK10oTLFrS4KqzoVOE0
+45ZTeg1Y1P/DOa/yAbtrTLwNA897X9iuN3ZP/q0/rM0
--> ssh-ed25519 onmXpg v8MQUHZj5sSu2XqiUH+8wcvEJmrGWQqs0e9evQKkzHw
+-> ssh-ed25519 kdPvzQ XVaKM5korb9tfFDIYs4ueREKcw8U3VGRonwp/QmLK2E
-ffZTIoH8stR+ZLhoz8GjvGG61xVbv4+VkHbd25Jyc/w
+RacYxiFK1vhTbJyfm0ffHxAq+JGFa9A5WtHWQ4iOEKg
--> ssh-ed25519 CnhD0g Ja9KftQBH93zJAl8nOMQZXHbXIFIs9W4UqXwYr9gdDI
+-> ssh-ed25519 onmXpg apxJc3hLsgsudKiXwvXE59FDMW9H8qXtlRcdhqVvzxo
-StRE03gMP6QQ+fCuhE1Q5ptCpBrUxrWINgCrWzwSqxo
+5RYr4G2YSLLSQKpgaB3g1HkcD7Xv+1Q2XKRp4SGKv5c
--> ssh-ed25519 4ep2UA fbcuNM4FWkTOVSNSJGAwncdkjLN1K2Uv3dxFsnC60VU
+-> ssh-ed25519 CnhD0g iiUwUS6wpQTXCL0qR2nUzkuG9bytZoQGI+0Xhq5O/VE
-uVbHhoO/IXfakiYFJ4yrtReK9uvYLsj4BTILRBqbRgk
+OLhhRnnAJATapn2WGr9UepY62D6DjCaoprZqMAiisBs
---- dYPR49CT7omcJ7jDRNUAoc4t7az/pEg00aqPF00OlA4
+-> ssh-ed25519 4ep2UA WOSiDKxTlL97otLBmox6lvMabltrvUy8IqNsNQOCDAA
-„Ï¿Ÿ ðç(C›Ø
+4CY2Gq4E7iLbeqMup8mQEdOiOEbE9mWHNtwsaOOFWj0
-I'ð^¿mc¶bßH…¹«Cû�K
0ýĉwé¯;lú¿P<üH㛬õI¿{àÈ|øª·ý Páy(Oì«81åÐß
+--- ULVOLUkx4Hzk0DLOpFgD3ypoU+vv90TnWTIaPNWxyUk
+˜iTSBý¥#õÛO×·Q¨�Ödzia¸�ÏjƒX ‡[d�ù†z¤å¢>AáúŽ
*Ocî�B×ß…P°AErÐs“ø³YeföÛãœÌïÉÑù

secrets/gitea/workerPassword.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q mCwgPdwCWzi8QXME7vc1nncnCjUdhXJfHgz5CI2ppWI
+-> ssh-ed25519 87huqg wEnsPg/GBsOZp/g5+Wt5U86tA3LCSuuvqK3YKU22wgg
-rnBpIQ9WYgFs65Rh4eMICoesrg76o46AjmtY9fTbCl4
+8H1eScTy08OWQ3Wm70UwpXkxQEJV//DDnKXO1Tsy3x8
--> ssh-ed25519 UFfTmg EW1P9WRcH6esoNH098Vj4E+udGzKWYw+HkxaHcRpF3M
+-> ssh-ed25519 8UnW5Q 9McAlT3KjxwW4uA8JLW/IZ95NtyU8MB5XSzwJi00D08
-t3AsT1kOCeDbpYotmYAFQA5/k0NA9KJ+R1DRnbLX63c
+jsJkSSVLMAhBrTSyjKg7q+ez6PnKdYP0GIOTG+BX6q8
--> ssh-ed25519 xNtnoA shOVkNxHyvKcLRYAAIW1C6UPAGiwxZl0Y7i73DkA3j0
+-> ssh-ed25519 UFfTmg HxnyFdoHZMYBD+RZqTCGnzVv0y6KlHdvV5obWrzzzkc
-MgFo9Gy+24rWvIkqQKDogakf4q1nE+MTdmXg2nYMNR0
+l9LCV/K18AwxfNIaMDc3ES7TZgHzBpMwPaHY6Mpwxtc
--> ssh-ed25519 aY2AXA dXi7BYpOVSGbbxI5KOQkElq0GQj3vmbU8AA9rzqGIE0
+-> ssh-ed25519 KbVVUw cZ7aPpgdgNGg7tAmV8efvkMgVDUIyqZjc/WQMkv52Bg
-GlpXrUk11XX6zirXrTK3uIhLBwlTKwn4/cyCWjPBVTE
+td9LF8Pp4dhz8coW/DWBdBgRkM6+FGbHzCqvrdbm9nE
--> ssh-ed25519 AQhf1g qV41Qx3onxW0Z91xCiUwse51OoEU7tBAi9t6MrwF8Fw
+-> ssh-ed25519 xNtnoA 2Gvn1fR8ufGGBkl8u8WdIb1Lo/UxkKkUXwEzmKK/VSU
-rFXGO8JG1HE916LMS8xMLACVqHuQzP/SAgM5Ngi9tLQ
+s/4U7eALr0f8Yqk5SN5O2z0eZz8PslFZ7ikbmngvSX8
--> ssh-ed25519 r/3ipA u1cHvRRt6JrScsmCY6PtybjU80VuU7NuRwtBW+Omc28
+-> ssh-ed25519 aY2AXA e6nGnQE0/UTqUX12blfWq4CpNe/QkEMnztWQHyHuxjc
-ztXCVbWHTMBY/x6dDdSSPQmTWfLCGNG7xkYBtupKRQ0
+OdUQMd5+x/x6NAs0nbtr9pM7q+nF8ZybZBJD7mNNcg0
--> ssh-ed25519 mOmPfg jCT547k33Dxx8nTS/WVe+Peo1eViKVSjLumucXempBc
+-> ssh-ed25519 AQhf1g qvmETHVucAF76fq+UkRyoK0Kw+nYVu18jn12ragg1T0
-X2SCtafedtleUTQoYtKN/85uUnWS3kuY9Bb90xHXXBM
+XEhKDlikdstmSSZOKs1Zhkm2XhtW19F4k+H+cKIvjzM
--> ssh-ed25519 YJiRbw j16MQ20JnMktKiREpNRx5qed8jXXKCAq+8b5AvkW0gM
+-> ssh-ed25519 mOmPfg Qb/Yfy6jl10V0wTr/61/GbbYhkBciOx1ryYvzyTBpRo
-KovMsW55OvGyjSJuAN5M0Ga7ln0TOQoQEQKvCkODJJs
+kHMnWdDA02C7rAyJ11JMbmJaCjKkj1fBXZqJdGES+IY
--> ssh-ed25519 Nl/5yA oYGAT0greb0CHjptVKt1vPBhBX1KXsJAVlU4WoV0vjo
+-> ssh-ed25519 YJiRbw m58K4+oJ8ike/v8bhpGveQF6UxEBTuqjiM5UpRZUpV8
-SI4ZXY4pHqYEn2AKEX7MpcYT71LsVUGiZQd0LmwGywY
+Cq1BpdnViOmd0JwdZf2gBB2vpcafm54FIaZWOhviP6s
--> ssh-ed25519 GdLgCQ rEB3gHJ+MovVDQsQd3X4pGI03itwoUGeHg7aCQ9oUms
+-> ssh-ed25519 Nl/5yA tNzmgsTG7d5xRhX6j5iwEnxtLYz8gJQmMWzBSOqaxwQ
-mAVXvwQqslqP4sm7uG9LXfNvD0XtnaB5W37esGyRsgU
+WuYPgCAxhsHvXKty0dncAl9ejqF1b9ZHSFqtmOEDQAU
--> ssh-ed25519 tOH/HQ XPExYlY9j8DKCZwviAAgSvJ2+xpx3lUBsktfMPwo8U4
+-> ssh-ed25519 GdLgCQ gyuGdMzsShKl1TPOt6IrJYJ383CCK33+BXo3sELKvkc
-v2PV6wtTTQINJ2XfCcA/0OpNkOHr4AER3lG73CJL7J8
+m02EYJ47DcH5wK+eDcvs5yyTwsH6cT8rWbf1BoGemQ8
--> ssh-ed25519 FpzvfQ RRpPZ5GIdzvRimAXe1ybhxs+lV+SSigyyvEn3qmkOUg
+-> ssh-ed25519 tOH/HQ EpuIe55eq9FvBnygY1gn9o+MSU0AjxDHeIPwqGWAkDQ
-z7QV/M3zO3tnOO3XiabL62w7Uphs9OxARpGbND1tm1I
+pypq4SL/0311MvwkilKPAI9Ho1gvOjsohnDwe4pDKPQ
--> ssh-ed25519 2UotMw JfTnR9wed+1B9Hung4FdV3Zvx8eQ+lrweFiFrhX8B2g
+-> ssh-ed25519 FpzvfQ EY3I/fZxRn9qxZz5KmXjf5MDfXt9lhMmsj9ZW3nTdBE
-k2KYxpsSoTBaHuXCCl5fBgn/jyi4KDKvg2QShU0Awpc
+ktSKonkZwKcC7zvkddr8B0bg4M4pkeuukKOuZz9YauU
--> ssh-ed25519 kdPvzQ GrUGPXTVNTMafGGfn2xA5pTIBEnEfSKmDtQ+W/QYpUU
+-> ssh-ed25519 2UotMw P+I74r2Z6TKpTehCrstz8bvG2sWPDmcKLYOwS20Smgo
-eDNGzwGWhnZ2kLXzDLVWJNvl6F6vZBTFZ16zrh87bxY
+zOGqtVouwCOiMi/D+XjitWtQGdRrfrJw3cYU5v30Kb4
--> ssh-ed25519 onmXpg LiArSCT2VCCbEE02Q9n6fsWP1VtYL7OcahnM7CJyywU
+-> ssh-ed25519 kdPvzQ JdHJ0HiJUO7h+fx86QJQvlwoLWjr1SWLll+sBHfmmic
-LUKTMk2IAFpg7mPpHjBBw8NbpbgpDGnH9FCvjuF9qBw
+tQQ+MEKgwYl/Ms76B1cPl8AA2HlrXqbF4cLmBdHBbck
--> ssh-ed25519 CnhD0g H2M/9h954AS4ROeJFDfOpwU2DsACwQ/20OdGVaeGxxE
+-> ssh-ed25519 onmXpg KXbZQecpbZQLB/4slZl3hqOXldgyqHADIy6OkdnHbTA
-tSMsZUT079DdPhW1yvFbk4DBlNd6Lvhk4SAarFjYfpY
+GltoWSI3qht8w6Bb90K27qJdW/fB5GflCLQlnu9ffkc
--> ssh-ed25519 4ep2UA /FZ8+q7M90Iug7/qUkpmyL3uhUz2WTBSoc2O719JhBs
+-> ssh-ed25519 CnhD0g wpoGeyLxBfk8tJkJSwWnFXhFLXrU4ezFaxWGVrnPIgI
-y0dpaERxrnygXbDhp6v/rIZsoKx7kv/aQI667jt+/t8
+RVAJ8njeIBbQtHNM0hslbD8ft9VuRlqcSyyKRN9cxjA
---- K04yLmYsJIXBing2v+tijM5K1vOLQy0hWu7TItk3xCM
+-> ssh-ed25519 4ep2UA Ydu1eNy1WiHw8bRwMQc29UsN6l0Kvs0MknyeNnDx4z0
-‡t	�Hëw’÷ìgn$c\ÑØG>T¤bÃ,z¿ì|~u§Dhs±KP©íÜ0c‹ªŒ–÷ÙþÔ{™­w`ZªPODmüxOägƒ+FäCH
+RjvAAe5nOkCHrZXn0u94NA7jWcNC9xAu9aly9tQC0q4
+--- ZVJux6CJ52ghYaSl16+PH5uUQqk0T+VkMVDOHO7HKMI
+¸ÐŽÕ%T–7]õ3¢¼D¼î·V!#NUžî~¸2·Ãc1duÁ6,¾Ÿ¿QD�DDŸ{ß'êÉÕlý¯ïñx÷%J�Ï	+kõyiÝa

secrets/hermes.age

@@ -1,39 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q AvtCfDMZZ51gAeWxQlfxp+AEZDM/54vKlH96kU+sgn8
+-> ssh-ed25519 87huqg Mee69P2bZ8khxGigG1Vl7emFQo/VzNHWtFIhDWGseCA
-IE9cWU99bJ8RJd/q1NCLwvjBozHsKNVLLxj4vX+f1nI
+VLqtbTpir8TdVMxPeEx087c3joM84Mt8A+UTJxsRzp8
--> ssh-ed25519 UFfTmg jN40d8++rmq4aJ2MY7Mb2zrj4gWV67GqHjv29QRNxjs
+-> ssh-ed25519 8UnW5Q eAb4LVWqqgoIyQKoC78/ZnZx8aj5HH0ti9rO5B+UA1s
-jJJx3pTDSQ/0QescNSbnWmI4aJx/mvqXg7YJeYY384o
+HVjKBLYj66fyfeq7wMNEZl61Lx2l3/d3/2+1sv9yLCc
--> ssh-ed25519 xNtnoA MJrW1Ti4mAhq3b490wLp61PTe4IhEPokfeMxSek/7QY
+-> ssh-ed25519 UFfTmg +xgy7TGSaxi5djSwYavqocqGdYpkmivs3JmE6MqsQSA
-AdgEkxhMRWcswzmLFzbbIKPW4a40Vlrct+ivvNGYhW0
+6Mn3jdSQPap//l6mAS9NBmvNQPmLPb+SbQtlWvwN3mI
--> ssh-ed25519 aY2AXA 5is/WyAjC4/oqlDIxAwq/Eaw6ZV9NLtQGFnBqWBm+mo
+-> ssh-ed25519 KbVVUw FfuBVEGAjQUdvkUKzktLOt3uQjsMyoVFTTrQprtpVSs
-gadDw+GbSmtYxI7DZUIWOLaH2i67eaM1m1uJakDTg8o
+aolel9YqAYvFuQqe21l0Argp3KUPrlhxBjIn8KjGHq8
--> ssh-ed25519 AQhf1g SSk081gv31ND5QM1V0KzlFQw05Hfx0UJ2EosCAzeS0k
+-> ssh-ed25519 xNtnoA kn7ZO/8ODnFJU6QazOVvOiwYWJYU+t1t9JQa9Nsifw0
-wpefMRyZgwWcaP5mZBPVnL3MZ2k+L5a+ChLqRGCa/4g
+0DBsts1m+FeyVtO4ygSZnphMj0o758wDFiX3DKnHVH0
--> ssh-ed25519 r/3ipA 5FoRCnYDLxjERHPTR+vY+2Y9ewOBZoXrvy+N6wnAS3Y
+-> ssh-ed25519 aY2AXA vuMeVWDvHPc13tNyDJq1IQnVXEgmWkGpj5JMMQcyljU
-7Z+5IwEeM1iRlr/cUWt+sfv1QEOJmkvEG91xq1LmajA
+6ZWisLYylYryvYq062ve3YgboX5Zpb4VbJw1kiHXbi0
--> ssh-ed25519 mOmPfg YMuWe/N8ZOrUdSnu2blap3HP+q1XJtVaK5pSUG44RBE
+-> ssh-ed25519 AQhf1g kYsUrTF8sTTcTCz1Z3f2zWdp3FmFgaF71rY/uDxxDWw
-bvvZrMAGJ4hj83Kl6MYA5IXRgJidJGpYHVfqN1w3zBk
+4GQKIVIS/Qdi8PhH+RjHDQAQIJs68a8o/txGaSA1EEI
--> ssh-ed25519 YJiRbw fOo8kP29gbO6OI6Zq2YBvcX07Wjrm0qlZv+AS7KLcVI
+-> ssh-ed25519 mOmPfg qyNnz4x8l0RyVYZ1I+Xby6H4qpghX2rIC+OC2+q0AWY
-7CCA1UgDtjmQi4L58TG2qVxxiDuxFm70LgOFpG18d/4
+he0iGH843fs+93tsMF/mU/oDMjxe8os6NxI7jdBrvGc
--> ssh-ed25519 Nl/5yA MZl/ydcywiEBzU2P396An7TVnTdtclNwsoItiSiUNRQ
+-> ssh-ed25519 YJiRbw TvHApjsVbTUUD+Xxdbb2OZXkpN8T1S7SFgR66GLr3lc
-upyVL3DUnmIE61NWVu0+gqaHNfmWIToOwJzLZOCsyo4
+73dXSGSh4Tonajg/Ux+TQo/CSdWm8NfoWpmuCT1nQ4A
--> ssh-ed25519 GdLgCQ dva4KwyCz99k3Ah8WibFI2ez+hUdK6wFzMLS/bQJdAI
+-> ssh-ed25519 Nl/5yA K3Qwv+HpwSzrt3L0wGOm8UnLST22gYtkNcmva1i1sAY
-k5rNjS1IszxzKy3t8FFNoclyYRpkaWRgyzP5D/RAdc8
+HFTnVYDdyFaCeuxadpRhRhvVzlJf0QJkzTSH6OBx3V4
--> ssh-ed25519 tOH/HQ AL1zBCwXkMLNQWiD8eoGbTJKI6+ja22p5NH/dHitgFU
+-> ssh-ed25519 GdLgCQ K+6xSzErhvyDiEIWSH0LwCMRymyRp8qxxL6KZg1mtyk
-qJPaXsp4k5g/D0/wmcHtAAqqCeiFDpRhftXWAhxzr5o
+daIC/jUY8etaJzKTk3ZyGaGFzmc1alo7avDtHkdAQ78
--> ssh-ed25519 FpzvfQ 4IOwoeQE5od8jFEqWziCF2mzqCLoxOEdUM6sFOp8Zjw
+-> ssh-ed25519 tOH/HQ 8ovAhEqzIreGrBlOmwxH1s2W/ZJNk5alJWbP5XagF0A
-Ea5bSCfza6i4cd8nL5p7tcoYyHC0B0V9lyuBM/PR3LI
+j39E5SWyMGOtT/K2IKUJ1UNkcUhghdhtUXtoYiEssho
--> ssh-ed25519 2UotMw 942H9PoyZwAfevk1yVlTLSUTQh17U/UjGfBcbHO0EEw
+-> ssh-ed25519 FpzvfQ uxdXTR4oXg/IzujvLmRceFzGHmTp6OjF0zjLboqA5iw
-UMLFxLUf1Xv31JCyri1YcYKezAy9p/C5gc3EJMlSIvM
+JH3aYGksptbasR5695/5unh4k2NFNMPwUTEAwKlTnSs
--> ssh-ed25519 kdPvzQ rYlwUzY8uJIe87A/x50Al3WMnPxnvxCOEZiYOvhPwF0
+-> ssh-ed25519 2UotMw 7ZaLT8Uh18XMPUKBk6KXqYpndQR0/YiwGjuw9YcyaXY
-WmP5r+aWqNkmO2PQwLPdxIKIUr2BYzsU0I8U+kwhF+g
+fVRD9iLC9Cof5Tw2luQLMPiCiqqhs7w9lsQqL9puxVs
--> ssh-ed25519 onmXpg mIhPpC8xYbbf6DK0Upag73K7k+YfCE1S+ZgCfvu1fik
+-> ssh-ed25519 kdPvzQ q1O+1RqZmV1W/28K/JlkUzs+G5brmi59gwS6CRPkN10
-XgJ655mD/y8bWwrhjdMNH/v0J9DWJQiXVBgGTsSRr+8
+KKiNVbg0FDiKdsV1HQ7BHdgNU52y/Qhnu87O9D0lntM
--> ssh-ed25519 CnhD0g UvRupvnJ0zqie6y891Au6EBw+1YZ1Mc3rYWOOBZH5Ho
+-> ssh-ed25519 onmXpg BUKYeyaXQjpVw6L/wiY7OuJMfyhFnW4S98nNofqVsXo
-WMBj6BdYtIxgzSCVbqRXBIbFQhmXCPJMyLxG8OgZXAQ
+dMWTebeJi5azBo/RInB/XSF8BNElBlK0gH7qLBNmI6s
--> ssh-ed25519 4ep2UA hyu7qF9mof2QhPfgMm2Xe/xsfJVQV03UK67b05ODeRw
+-> ssh-ed25519 CnhD0g 7cWyBDXml7SMfBaDb4MKMgrdgrzl38EGZi6ZGX8msS4
-tb54Ihc54Yeew4pRp0Y3aKAy9W7bpw++VeT9trHq4oQ
+CI1eUlcgo60xIc5e2CIlTsWDWG4GINmvXcDCd4MoMnE
---- XXv9DYSwOiHB+rSASovGULreR0ZUVPr4MYYFrH9SnSw
+-> ssh-ed25519 4ep2UA i7ev8lkp+O9nNHb8f06QWNjM71UUWQMZVbKHXZLt4mo
-7µ¾�ø—Ó½{O�¼™y�—Ì?Ma§ß³2é‰y�
à£à‰§8¸E5¶jdµÀ	�‚ŸBûn	ôgþÞgb,NئH|
+BwZ9ouzTIm45LR+O7KySmsCbUIxwcDkRawBMyjlT0do
-cA,<»XFãò(
Ke7þ
Ný
+--- v8KgdgIDf+1iLNG08ZPZx9A0dz7JGbZrdpBW+lQaS6w
-½ÁP‹Ò{&HK$
+�Œ#O5°ÚË\¼KÏ´m�~•˜§>[ŒÂsp±×ÊT™ßÏd»EOOԦюMR¶CöÖ×yá¹6¢�G€ÀÏ~¾^^yoyD«+µÓ[•Ë+ô
E“™p†Ý!¶‹WnÆyœV»7™

secrets/jude-forgejo-runner.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q zKwZaiVwcb3twBRyisICah2+RLb5NUStt0h3Ch7t/Tw
+-> ssh-ed25519 87huqg FT8+PzbWYp1G2XqxQh/wIV9cAUxZrLIdBZ2sMC+9szk
-9O3yKkWIOiJy6ese/ytnDRvyNbytQKDXR7HSZLNWNjY
+6TnThj3i7+q+JaJGgX9gtSOyLIqXwfqJhV7FXnffMFA
--> ssh-ed25519 UFfTmg erGwb0GnZV12BoEa1JYiYevuf3Uq0Tv73ObbDRvv+Tw
+-> ssh-ed25519 8UnW5Q PgKl4RxTUiazuCkN8RcRKCO1+XyIQzfKz4SygoFojwU
-a0YD87ft8y3ZTYWw38GSwbmIUHe3HW6FuaGksF5pi3I
+O21D2VTrhKcz3H9yQ6v3HMg3yu6Oml6elssq4EZLOJY
--> ssh-ed25519 xNtnoA KajAZC29v2JqZY+OPkeHpKv0biPJLDgnT2CN//WnjhM
+-> ssh-ed25519 UFfTmg 64GTWzZguBnlbrkI37vPO4VHGq38ewzGJbf41fmFs20
-GJdu44xGefwsI0g99wuwTmWGVQD8uwIcyINRCHMb6I4
+SgbbJCitU6YS7xhyF5jvTRKgpd8JjQCn5goCDqGmP2o
--> ssh-ed25519 aY2AXA aQk0/BCQyyPCZCuaI8NiyjuDZBIRB+nAWZBKs+3Z8Wk
+-> ssh-ed25519 KbVVUw DWHG10kp4J0uQaU2UZLORMBrOkXXWL8hl9LmOQFHvVI
-KSZxNCGThfNjoSZh9hIRjP9o5cQ1FjZP4G7GuLbBZn8
++5aIgcoPshO0m0Kkt15TmKOrw9fmYjA/CQBW78j5Rmo
--> ssh-ed25519 AQhf1g 6usKpTxVUNIT92ugQl7Z8LFPFPStTgoPhEGdyXjmhwQ
+-> ssh-ed25519 xNtnoA zNpZX9ymrcO0W6FfXgmQz9VcEa97s54DYdsb3ThhWwc
-QqGWtkb4Bom4sKMrV347/jf6YptbQIm78zzNwxZN1UU
+7F+/fHUNOAyFjBBEGfep9bSBQsPWehglpFoSniEYRJA
--> ssh-ed25519 r/3ipA M77+oa8Kbvt6eGbAaq6/0oG9ggXSbYZeBOkced0F5zg
+-> ssh-ed25519 aY2AXA qZFD9Sn7wSgZCEJ/bqdh8Pr1Bcalf0NU99Tq8aFGXB4
-hkEFOfMRY4iIZ31X8ty11lGkouOxHm2r/tLwPRfQ050
+z9Q08OxS0sgPYMYBwJa1H8KMj3EU2nbyp3fB6+j6icM
--> ssh-ed25519 mOmPfg RohXdUXobV/fC3JYQ9IuVvDqdfnS2xodARJYmT1Ch3A
+-> ssh-ed25519 AQhf1g B4W2oj6J9B9ktt/QchkT7kQgRWOxHfEqFDyIka7ttDo
-VdDNZFmvud6FGSX/I1c4iKg+6uhWgslPKAk0Uf5Vhds
+zAEaVCYNT+Ldk+2OMElMqN0WXCTnSgeV45f5QTocIps
--> ssh-ed25519 YJiRbw /xSl3swqNc5q0hsY+hO4nSk6PzPk9lRV7Hni/yNX4WE
+-> ssh-ed25519 mOmPfg rGWRrIHZ7Hzys2X8hlSHis6eoH6bJWZYq2BR94gYexo
-GXD3wBcBf6k1mjr14vIP58bjRWOnnVBxm1zunv7SVo0
+0kXY8xNmqshw4swmsIigJ3hUihlkoj8SSsLGdNB6Nbc
--> ssh-ed25519 Nl/5yA BAgdJDYBnUE0/8dR32V5D/ONiwLufRL9/9CY0YgpW1U
+-> ssh-ed25519 YJiRbw RB2Ocz6kqAY7daf/cpHazgwuqK4WL7obmN1p24X/h1k
-aUgdT4MPYEAVjSuWm2lqr+r3xwlX35UyrbYGh5v5C6s
+xV9OqnHeDJnLgmOYjbPDchp4uVlV05BwT/1eTBmXyMw
--> ssh-ed25519 GdLgCQ fOAibyd4PSLdTsOM/ntG3/Jcz6TZFTlGk1oO9MLQWXc
+-> ssh-ed25519 Nl/5yA QqqZ3YRVdWt0bPCCTdtYipR8/c+YEx/J1Bdy2EdfMWg
-HNyui1pe4ZcrjHafzZtCad6Nc3MbzFu8YSMS6qae+mo
+leURB55yT6GyWO965kmBWeVwzGnHaPyGv88pcO7Yuq0
--> ssh-ed25519 tOH/HQ oE4PbISWQe/kW2DxIkwqJKhKp/SNNa2OVje5iX21RA0
+-> ssh-ed25519 GdLgCQ r1G2p2VwiSanA5qjASjCTfunoZ+y0UhNIAxm6Z8N/E4
-lx0r//kRfV5df3+5cApTmpE9zxFjKoNBSguhoeHqgjQ
+tIku23bpxx0SG9iIh2h6UCWDQAq85Gj7YlMlk0Jdb2Y
--> ssh-ed25519 FpzvfQ L5a5UzaBYkaDLRKKu3z/9tou8SFmzL7615l8Ejyb23w
+-> ssh-ed25519 tOH/HQ IJee8JIPvGwIT9c7deikAyxAd8rvq4s67B3an9htvh0
-Z9G1pnjjBk7H+XoNGNiBUtsZVQYiXe6/crYjUb4LIFM
+VvGG/yilaEe8+bOqc72+rY87wv6F3Ss2b+RF5aOCOD8
--> ssh-ed25519 2UotMw sw24R6i1jaa2t2NcPsXxeJz1FSNGY8dpTJQBPM4Y60M
+-> ssh-ed25519 FpzvfQ S6qhDcpBEdrk7ydvID0iwmoY8CBtjP6tUhax/O8ORl4
-t+fZa71iWWxAqfusahrNV/Gx4RvlklnmZHgz4VsxGRk
+wqkt0wEv3lXw8bpF/oMmCD7O1S2OXJJo3Y2xKhLgeD4
--> ssh-ed25519 kdPvzQ BevwDGBlvPar9elbiiFK5gnbF1qjXG4lsTSaOHdZwA4
+-> ssh-ed25519 2UotMw AVmF4uIN2reJA2pPg1KZT84pbnG3Y5laZalJ7sdD6GY
-DBYjAo0HLsF7GzGPAw5wGate8QIpFQ2F/FNEITQqOrk
+36Pdc0awqnlzZ13p19yqDnnikRV4NUaJ5LEMTzYzB6g
--> ssh-ed25519 onmXpg XFXmGNe6X+JbLS6f26x8OEooWGCsSKdPXfNwFoSDknE
+-> ssh-ed25519 kdPvzQ UvJj47WTQTM9VEzIdX+O7s7nMfO8TLAn3fTCYQl80mE
-zEKhchCyQN+rMBGXpnwMeOoRLDPiQSRQbHeG3V9ifLE
+njyOgBl8LsaRKRRNeumQbYRHnUtT8SWtCT/RLoQ0ioo
--> ssh-ed25519 CnhD0g Cua/knFngt15egS+o7s848bfy9YM0/fFijrdkrreWi4
+-> ssh-ed25519 onmXpg jeup0qoEJhTYKJBNQkNf6frrP14xf4NeSWk2b3L0wUg
-tSj9HuyLRTiLPFlkNUHQrmY2scEBQvzYIXUuuUuYyjc
+9HvGi1r/Wm2YRCpl+Bvp2t2L9q3ci/Mbg0N+5LgIz98
--> ssh-ed25519 4ep2UA lZYn4isPidCnEz33aBI0Q+oONJqFy+a63slmhw2rBlo
+-> ssh-ed25519 CnhD0g Q+Q9n6e70v2Q+4UWPznvh0dot/hjHGnIPDOLIDsNDws
-i0zEbwLS3kXVoqfMpdnti0UIn5pDEd7OJjX1cA2idWs
+KnqhFsNIArU4JeK0Vqou4zewrO+ul0uJE6oVvTapaZg
---- H8Qm4uuJHlwWSBopEIN+ZUr0hZ5RndYYO2jQWAIDW4Q
+-> ssh-ed25519 4ep2UA 4wTgnS1jJZzww5ktip5vzsDEA9ERi8v9l1RqjrPB7x4
-‘g¡CèæPÖ•ê²¢dW\@Mïs¨×þ‡[‚Á_‹ü±®¶ÁNÇžBÜïo§Í,0ƒt…d8Þ"Ÿ“Ã#¥ŽET¯t»‡h=GTOh’+Mú
+t70NW6zcVLV2UXdacJ/tqxvEMS9MrumEKoy+F+UvnHE
+--- 4WejiRlNCP3hQqi2+8WD53mX/lptc0N4AbhBkw7mt5o
+—"åUÑMÄ„2Ç£%°ö×)»voŸCo|>­šÐa†À†¡‹6¥äE˜ùn�OV¬©HÖäßD6i .†C¦Ýs0sÂj]Ü ªÛ¿

secrets/linode-forgejo-runner.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q Z1Zt3ObMDbq7suhJb1k/O9dgrQN95vTIDu2STbO71g4
+-> ssh-ed25519 87huqg whvk8HVYi639QPcR+0keIqsiiKQOTZYx7chqIA6itVA
-UiyIVoagk70mtct1YxFQtUCHcGbfYhtA1QDUtfFz+eQ
+ofWFgGafX/qrEbIWhq+Nj3QmXSggoHM4jjoKw0qQ9wc
--> ssh-ed25519 UFfTmg IsYLw4pCTs1Xkels8aGAGSc6Lqx5Y8mWBpervFWsKUA
+-> ssh-ed25519 8UnW5Q u0ku0vlGo3PnDRG+WH1jim+X4WAcvHupx0LmtYiOWW8
-eBFYqndg81YgePY0yEuKWDCD9LTnOxLevT7iy6m6Nfo
+v2y8uAYt15OQRYJcNwabugVInSPluuECKVLuzT/Ulbk
--> ssh-ed25519 xNtnoA H5M7J8lYq8r5GuNNjx+1QHCtiTNw9SSWdWcpmRlTUyQ
+-> ssh-ed25519 UFfTmg jRxo/hK+Pf6TXktwkWyhKvTRhJL8yu/aUtQE2tTtkSs
-4N/qiG/TZoWIn2KuZwlrqxt27wB7HGtxJPxHRzeRXo4
+smZO57lraFgHrzITmMrX2YN+zUPmPBzMR7DTokz7vF0
--> ssh-ed25519 aY2AXA wN6zKGGRfj9Uyib2+94wRnqzkltJbjn6LyOjnJGMXEk
+-> ssh-ed25519 KbVVUw CWyZ23afjLH+gYTd65bbFn8WsANQ9aTP+yzLTB+kfXQ
-Rx5FQte2kyo1m05YMupG2LA6Ddzp0kAVFkoB2tpgV0w
+3DwNcjOK1RN+3h11F5EW+vuQ5XWFi3YWCRH/cCk07ME
--> ssh-ed25519 AQhf1g ocOb67dklB9G6Pi0icJ6OuB0nvMsb3gyvSdkTulqbUI
+-> ssh-ed25519 xNtnoA fVijhVsClnRApihRPJIXy8opdauQqn+U91BpOzFXs0c
-PEjigA1SVW19c/yyWxCNrRbxWNAowcQYbw2z9busLIY
+p43mj62qt3UwZIJ3sEca7KOyVLm6Cf9pESPypynDisc
--> ssh-ed25519 r/3ipA vFM4wk+L8Wv04+Rry0brtnSLz/ChaNYup4VI1Fm/kmc
+-> ssh-ed25519 aY2AXA 54bAi78JemUIoQc/Pb/8LAsJxbFpFHHIN1UcntdyXCg
-Du849WnNg6E/CQ+ui4+9vFAZJ47jJ0L2o/T2Sv0j/UY
+cq0NBRonzLdQdFLPLUcjvx4Il1UWVLnFsICBCqevlMQ
--> ssh-ed25519 mOmPfg NrTgNtkHKFT+ZPmW4ga8DGrJk7tiDF8Lel3By8uRRic
+-> ssh-ed25519 AQhf1g c9N1Qdzcy69F/YIELCkLL7N+bhlrrayTaVnYUCfg9Ug
-y39BsMv6CAjVU0EYdfMA9Z+Sc0dFG89Toz/EBvFLMYE
+geeeJijhKWMWnFw9SM1KzXobiIRSa9KlUHALZZ96U7U
--> ssh-ed25519 YJiRbw k4IxoHzHTll31zEQldtYFJLAZcoACKulR1L/ch9lRRw
+-> ssh-ed25519 mOmPfg LZx58dG8J26Wuo170v9wAwRU4CwDeE1zFdTriT9vakg
-/EPni0kgRovc2cESxbAV9c8hCLXzxBqr5S8Lt4WXrqU
+DHuw7aQRfZMlSB9A0i+Ky1Edk7PXBBcPaAg8y6AbmG0
--> ssh-ed25519 Nl/5yA uC1gIjNtYyoJ1bsemEJRFnBV7MAAVrV5beyDpIJj5nE
+-> ssh-ed25519 YJiRbw mM+A4CrVmyP16e+LlVIBxXEs9c34ulR3sGN2uzVL5Q4
-K+n4T8IGULklGYuoCr0x3Q4sN1NZ3YwAyEORG1Y0YiI
+j0csX74W7AG2icm+3tIA4jedXOFEt/OlBhFYpuY8a4o
--> ssh-ed25519 GdLgCQ dljs/yoxh5IV8S1wjksMF3f3+xw3Tsqv3ZPj459KWjo
+-> ssh-ed25519 Nl/5yA erYJzDKqw+UTMMnBJGPw8jyz4yXUBV3y9JiQbgmDUkM
-SZclrcYwhgwyrG6Sg4iHjN+PbKvet3B0AcaWFlMvdpA
+EaTzI4aqX2X9uEfn2RPIQb+m9aTr+gW2rkPuEgmDEA0
--> ssh-ed25519 tOH/HQ 9zHh+cM1vXMRx3zZwfOCkyQ2eBobH50JcWIO5UmoDB0
+-> ssh-ed25519 GdLgCQ +wsQawmcu8rGdV8UDDCKKDIWY3L9EZ5Fwfmbtedz1BU
-lEA2DAb0UuiRknrKfmKjEpHnuWpSYEWw5Qk0s1JB3bY
+dDesLgik+S47jKjEe+UDYiMQfTgTQpcdSwnudMvyaJ0
--> ssh-ed25519 FpzvfQ WxXIAYo3SVayrHVhiIS0enua5l+1LHuEYLI2ZJcrVkE
+-> ssh-ed25519 tOH/HQ UY3eAd44x9k5wNCPjX9YIp6aat8FT/UJRExONGvPnEg
-5siODJVz1gQxoZgeUfl25Koqt4ilTYIYqxOGGwyh3Gk
+0eZw751dXjs+BCmkQijmusvRy1ustwuX6MfIutFtu+4
--> ssh-ed25519 2UotMw 7v7u40Gn57E1M/VNNTpgFhg7nsa0JmcZvOBjJ+/Y1mc
+-> ssh-ed25519 FpzvfQ kLixy4M/wruC/wZh67BhRnomKyV8ui8VoYtTzwjFr0c
-yT1hqZue6sN65PnKgRr/upxXQlloD5s1WS/sosBKH6k
++onxi4oeyZSfw7vj2LARTy9Se+BEg0PyK0Ts7cx294k
--> ssh-ed25519 kdPvzQ Ey8yhg4MocBop8aKb9Y5Vulz26NleTREH0O9ga8kgmw
+-> ssh-ed25519 2UotMw DgMN2c+WcPSpjbJ/NOTtkBJUywVGqBOfHr7lM9AKtEs
-eGr2QQasypgk26uQVwUkgjHGjgYVtJfjb80y9fht3qo
++7+P2Odquk8CwBrpcjtJGGHCIWMGd3JO/coRDwn4ZNc
--> ssh-ed25519 onmXpg Gk8NZVb+7qaAdps/C5u1CG+2DIFtHFDhAu+m/43Gd2Y
+-> ssh-ed25519 kdPvzQ ZckKwL+D3JGoXz/XG4LVSFs5+esEQ4sBQn9cvGR1gCI
-A3WMc+zyVq2ra80T8SeXWxe+eeN/SmdicoOGQJaohDQ
+l1psNLjdEeCKhBI6TBEqHbroyQuT52szY8leXYIdxqo
--> ssh-ed25519 CnhD0g MR+oV7rqxoBN3Xkoo4FJeMpMamkbU8kAbIivnzQDDlY
+-> ssh-ed25519 onmXpg uJ7DNclFa7PrStOsVOPS0tDLRyGHz6VQIms1eUMGVR0
-djQB7mKq8raqp2Yy/N8s1fcoQ4Xi7KoWgn0axihsPm8
+NLKFC+Q4YAongfCoVCFsdm8J+Tg1iFtG7q07VJZVX48
--> ssh-ed25519 4ep2UA Cxu6m1Fu9gmC6Y14Yo6nebc2tUyo6zc2RRrskhoavE8
+-> ssh-ed25519 CnhD0g waKnwNZsusul3ApZwQAWe7G2Nnn18xnlCo4gzDh85ig
-g56/R04ow0jremNusFjtkWahskNc4pfynVKG+C4WYIY
+qSwoGa5SEQ6hEDDusUTiXDbbrW7MYWLNH1LF2bCo9TQ
---- yn/4D5+C+8iqvDcMNFOrozE6KeEjPq35cMW468nMjzk
+-> ssh-ed25519 4ep2UA XJL0990Wn/KVL9gtbvklvPrC6WfjXpzcS+5HLdUe0F0
-ôvœíJëiÀ~ö³Ä*, i¹þ®‡¸QkÌz�yµ,Ncæ­BÔºœ•ìk—~$ᤈž2¼¤/[¹®Tª‰¥¢,þCchÁ$à
+o8Om0BXgLFRqFGGZxKYiYiVWndb/FB2W4HmMtkCXLqo
+--- e1pf5cHwhg79dMr7isV1uaWHdciGO4Tf4Jc3fsxgmqs
+®
ƶ òobeZ/ˆÈ˜¥¶9
Ëý†…�—}¦t,Ô%îÄlìœÅrÅ(ÚŸHé°[Ä�B³µ1C;[ɦ‰žDËL‚$
V¥l|…Ø

secrets/minio_access_key_id.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q y9PK+VDf73/nElH7/STk9n0ru0NIGJ0qp4eQTokEKWs
+-> ssh-ed25519 87huqg 4rubYX2N8plEhgEVszXOutIHPKZR+eQPHAkr5nXEWFo
-8HF0hEGCfbmYfEj0gn2EWUOBo8KC9/znCo7nxW3rkeQ
+G4neow1D6lLIkTrx+ccq4Z1nyZgSIgUtlb1wZ3SbVYw
--> ssh-ed25519 UFfTmg piv4fjTj3Ua1VdM82I5B8BI0jk3Qh4S29PnKs9GmokE
+-> ssh-ed25519 8UnW5Q jIXXbl3YNXdsJbSTUvM4p4qlNnQ8Asp7tZ3klcZV4lw
-inY59fSHk4xAZn8xkBQQIoI7xnQW6rsRKCCnszngq34
+00k1oQ4AWGQ0arsGcuZYbQ3F8yRXJN1Ay6RwVN1eihk
--> ssh-ed25519 xNtnoA vNufVdYaFm+k78r+ioCcm9EWuwCF+zoH1bffrOEmJTQ
+-> ssh-ed25519 UFfTmg cs2FP8tR0wK9AdFI1mnMc0B7qrCYE5JEVi1VEj+ufEA
-Y/NDZ01jQEJYAu9U7d5nRI9S67wj6SNz1FXNBoVzho8
+U3zPZxBCPiNksQ+q0MWWANTgzmLmscj5tmGj0IF3TVY
--> ssh-ed25519 aY2AXA pHfVblA8IhBLMiTWmq9KT+EBv5/AP3XSQ01bT2VY+lk
+-> ssh-ed25519 KbVVUw H8UZ3gkVdSsLN87NwqrOpIG6sVujrPswkDsjaLjJamw
-kTiFQBOh2sYHx+CAHyduwVauYDOXtfPc4FrKeNZHcE8
+JxS2otXY7zeYoGjqCGleE9V9mfgsKQCqnCTRBxoAWvM
--> ssh-ed25519 AQhf1g uWlt9FLfTmlFmVlPx3o57lVQInTRuT80YZbbwFSAVjM
+-> ssh-ed25519 xNtnoA ExNmgY2PpIUAu+Z5CmRJ05vs12cLMGG6hUggbBefz1A
-3PscKZhny+pMuy+Q4C994e9o9sxsONdZCgewkuo4l3g
++/j9p+eF829pCHDMzPG8RjjpACe5WZMFaXfX1kr5m64
--> ssh-ed25519 r/3ipA ksZgnGbPwj14xBftMDA4R2o7ui1KNOVVunBrA3xwjy8
+-> ssh-ed25519 aY2AXA RR67pXhqkXPdd/lmeNAkbaabYY14CDn/owXqFGI2ATo
-IZZX800pMneP/0SAMDiFlt2wlRqIyMW9bNm19E0uqtQ
+/gi50YHg8l8GUsaXzBXlws1pMrj+DFOwbODyFeHKY2A
--> ssh-ed25519 mOmPfg 6iuNsMJ5qbGog2wMnjLJ3AnQpeTK/oiKmJFU4NmpbXo
+-> ssh-ed25519 AQhf1g lvmxLx+q9dgMJWtUqZGiZYEVV+KP6X3N8RdvljSkO38
-rWPbp574Zb6sU8RFXD4Sw1d6yatcW45LTMkT10FL2ZI
+ds+oivil+c1kGPXYFLJrHRpAxjrYEVlo7DFQa8IUjd8
--> ssh-ed25519 YJiRbw MutfBuiITaQ4zs+ELUihuB1Rl7LeAICL2+c5xbr5Rj8
+-> ssh-ed25519 mOmPfg b7t0jYHFvt7T+eV9hS9aoO7Wua7XMjkFbaTz+5I1HyQ
-o0mGn86fAERZ8DQ4rSWZh1MOaPLCZ5Su27U+5XExxV0
+eaaaMX/bDszieKcHemk+2tW8pQEgo1VtmwloFz+DrZk
--> ssh-ed25519 Nl/5yA NKo72CIorQwlJ3vcfjWZ7IcEWgkrxSpp81P3k2nTk3c
+-> ssh-ed25519 YJiRbw t6qPGZI+7g/qW21haqBhCqsiC2mLtMPs+9A93fdiZT8
-4/0XpBgS3C44qqU5zcWBqAzFbMl6DV8V5+xYxBiXCCk
+j3pZO9rP+wasPlfMz0Og/ApYbdNrQbwD5LDhcPYUrdo
--> ssh-ed25519 GdLgCQ jJ99c7pKMPL9jGM45fbcYRv9k2aeXKFcBidMxinmYQQ
+-> ssh-ed25519 Nl/5yA b15TTp3eFsOkuCETjO8+V0sJyQogK0sqZSQY6nLhaTM
-6pA6kX5sxxQLY+IFpVnIp7ximqAsA2Ifo/d2gYTy9uk
+aiOAoUayhcQ+EPsMYZyTUTNd0BOywwYxWeqre7Uvg2A
--> ssh-ed25519 tOH/HQ o1g4ibiZdld2EzoPUYsEJKUwMciJlqvzpv4hL42WfRk
+-> ssh-ed25519 GdLgCQ XN+zojRCG5AganOFNy05CGU17NcnHq94XqryxiGeGkY
-ZYi5u8ep38jxeHDKq4uCAB13wSb/oJC2+Lpyjyk4UHQ
+4jzkOuEzhZEup8hcgIEOvZCwF8uybs5rJMiasqvUk7A
--> ssh-ed25519 FpzvfQ YN3SyUVugq1S/4GkWtnfs6qeQ1ukpX64k1dZNFV+UBk
+-> ssh-ed25519 tOH/HQ x8y0qF7cNiLwvtXGhzvzD/vgkiHOQJvAhrWiFFRB/Wc
-Yaq2dI1oBEQ228g9f3i9mFGklUbOk9s7DFDHTXZN/J0
+let76nZdw/5IwnrM2Nz2qQvvCxu8O6bly/hdG4e2b4U
--> ssh-ed25519 2UotMw /93PQpOj4bxRoi7Z38nioyN0IHi8Fi9ERBqnZIZ7rh0
+-> ssh-ed25519 FpzvfQ p20npi5vdMpzqQBN6zYrzAjioDuKaqlQYuUsxIQgcS4
-M45TdKIss0NkVObm5T95npKzyBM7A1QcT5DORLORnFI
+3QudwIIhnZ5Qe3gc3kM+/Ojgy5+vm893I9clkKKNqlQ
--> ssh-ed25519 kdPvzQ v5oxUVW0nFpWJt8NFuVubwXhQrx+SHpJ38BU2kJKqnQ
+-> ssh-ed25519 2UotMw jY5jp7L87aRhJKx5jvywgQPp6TtQdFU3JqPt73htcTk
-dYeaVnni5QQUg4CaNxbuNYzQsL/KPuQNgFtXk96adXc
+7SNliVrYcS6j2Ye1qR7lVbiEMU0DiW6j3f1h1Vhd9io
--> ssh-ed25519 onmXpg K+8SnidvOmL3kzDCRnJdHg/RFCLcUaWJ2HrA4Awe7lA
+-> ssh-ed25519 kdPvzQ /jY68QmEs0hKQcZ1x4ugi+StD1tCtUZVlCUp0CWIgQY
-iyYRzYexYHNYhI0mlEZyNth7LBYVW9pL67E+gxLf4Is
+0ZbUzSb4ib4fgNlzqJL7sbRlhAvH4rLi+IVkPDAlSQw
--> ssh-ed25519 CnhD0g inYTXGWEAMNKTpK+uj1xN6jg2xfVzO6s9j5R/bUx6D4
+-> ssh-ed25519 onmXpg br6n1R28ydO0ymoHXCCdPNFomf1Rh7qkZ6RlrW75aEo
-Sas1bzhaBLXDRkG0dvfEtXn689aLGih+NJ5IVoEAvC8
+OtNpq0AHIDxB+w3dpNHSQ6vZf/wToJR04yC8TzT4XAs
--> ssh-ed25519 4ep2UA UokZFgeEqY3/7DABaODXVpxxhjhUrBx1ZWMv4xJdYDQ
+-> ssh-ed25519 CnhD0g pU0gkvHuyk+x3CPWzXoHyzWqop1GlrjvszdDmWIMVhM
-ral1UaG6TlRUVZRTYhpHknIeTrhRvS2LfZ9ET/LM6bY
+tOnn4v7WY7as0mVsTprNE72vdtPcmgvOBg0817mXF6A
---- 5KW+UYA/aip08dG72P0VeJteMlK5lW3vfrCxoMV4+yE
+-> ssh-ed25519 4ep2UA 69JFTOIPD+4ehAxFshy4FzQpoRwegsHB6WQNRx0mSmU
-¯�뛫	ž¦ðýÿ:¡˜Ü,ú.Nn,3îà.W3b‡%�˜ê$ê
+rAjP+jOaEbedfbyFiRSuE2b8e6czzvqfWQGeUBWchgY
+--- PWUznJ/BapYDil87UPCNH/FtAjYTWA4+EMFcFTZSTMU
+ぞ孱2卜s?f)ﾉｻ�=C_�Aｳ衍稿Uﾊｯｫ�ﾄpｦ

secrets/nebula/isaiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEanOBO4YEa668pYcgg4lMYGB2VakRFO6b
+MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg
-K9vHSLzjZpuqhBVQ7MReOwUHQKyCIOhUElXVoqzDIo+rUThkf0fbW3HYgHSkp8So
+dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx
-1V04tV51g0AXR6vPKFhC1rfiDtslbhxwBNYgiUrRDxcNiAYAQFCyjTijj2+tqxyD
+2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO
-pwL29i7NlcW+QgBxmtiSf8UW06MbzOkF
+71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ==
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/jeremiah.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRqc4EPhgRrrrylhyCDiUxgYHZVqREU
+MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM
-7psr28dIvONmm6qEFVDsxF47BQdArIIgEcrTTRT0HRNWO6hNoyFBkWLxwrK3DyKz
+YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi
-ZypRbhcAQ0GDQNX6euu+o8qczoXIHt7hfpbVc57YvtYQZ1v350iiyNhM0I0oZsV9
+8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf
-oVEBR9rg39/lsXjFX6UtC/H3RKo+arlhDQ4=
+IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/kuma.crt

@@ -1,6 +0,0 @@
------BEGIN NEBULA CERTIFICATE V2-----
-MIGjoD2ABGt1bWGhBwQFCp0ACBCFBGppSlqGBGuuvKWHIIOJTGBgdlWpERTumyvb
-x0i842abqoQVUOzEXjsFB0CsgiDh5M2hyejw6E2FJKlukNDuEBUWhctocJ3Zovyc
-x+HwE4NAGX+FSOpGbnZ9QFYBfq1FvRqXdyFtAyXWqOkq59j3hR5QSG7E7/KAHFFS
-1NJ60rKABZhTepqhACZRCeyoGfMFAA==
------END NEBULA CERTIFICATE V2-----

secrets/nebula/linode.key.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q n9GImTATabmorvZdYfmlwogI19kDC2q0Pn36oIaHjV0
+-> ssh-ed25519 87huqg NYVu9aSf47nYXXNeU1rhDwstbkzm0pQJRKk9R5ZLMm0
-LIbb+QWyJTMKeSb7brkPtRrp1Hzh1wAEoQaWjLd3faA
+xVciFeDQ6gfad3K1bSr3oEXPh6v6dzOxEWCfrXbBvyY
--> ssh-ed25519 UFfTmg wsBWO0eruy1hTfDW+hRogrdBmCKwCBApdfWbl446tyI
+-> ssh-ed25519 8UnW5Q 85+eCqAGGA1tWzHa998eQOfocPZxwyhg40pAmAmnNxo
-S4Di+tWvsWChYEcnIAvDJHBCKODEbwZfkhV7UOsLXs0
+eIJwpBAdWz9FoD+wYc+DGUSYJKEnjsRrjyLXVFF1t8Q
--> ssh-ed25519 xNtnoA G/7vE3GJBDY9JrwnlHsR3WlaysDUpib8a3cqSNINE0g
+-> ssh-ed25519 UFfTmg yLw2DrMr91PeLFr6J5Okq8pPk8OW9PDQ8q+dbG69QFo
-ckMLqrwEyf4/k9DN+sjhBsHiyABBlCAEpzjA3M3wzvo
+CRsUSDF4v3z6Wvko2yrSxLkCqcRt4+V/9OaDLwEZCGs
--> ssh-ed25519 aY2AXA PmlfZmS6gON8BtCCnklSE7iYyXtCwc+hYKZ8BeS9ohU
+-> ssh-ed25519 KbVVUw gCQNDBHD4ZvYThSMM4Vc/YQuWFZdI/InmxEOJ6UmGVs
-A4bBzr+64i5VQo0TR2+FwUucODgCRWQGaOBQKh+DRzI
+D3CDin3g3Td2wQPjXAVWW8JJ9Ta82cl+kgU6hoPSw/k
--> ssh-ed25519 AQhf1g qvdgQJVD6LUcQ4SBp3QQv995bGS06StlMtgLkkwGVBY
+-> ssh-ed25519 xNtnoA tThWOoELNEpFvYhqSeFD6Bd6UQfNj6QQZLlSVCvlbEs
-wEUduXnr2lEl1QSAdIi+U5lCzs2vXAxTTtFL116NxSA
+P/17T3ZbwguJr5FNP2JRn8YFoDhDW/uB6EaKZVVIMp8
--> ssh-ed25519 r/3ipA idNoKxD2x/oipXYfx5BzFKMbj//odBWcodAKEhQ72Qg
+-> ssh-ed25519 aY2AXA 9QSb5rIp/89PVuTKBE0oLnDaRvoke/7tlwG1NL7I0Xs
-Z5Agpyxc6e5hhXfkW38m24apmdL0YQkA/Sv44NNBnoU
+aWLJ3htST398fd7A5y2Pow6IUVxiNZrBS+0lEQIPGLk
--> ssh-ed25519 mOmPfg Z1dCxZcYXJtsGYQQ6T6Ua0B8oNiWM+KtdxhwpP7C/gY
+-> ssh-ed25519 AQhf1g LIha2OADbGBA25jV4GdOSST2kFFNWx/nXhQDyBwSrR8
-ZXlHq7tFJdrZBjpoaR5kWrwTHi0m0FaiMG5RHPs75vY
+zpEhxUC3EkWq2hQHnmh0t04JlbEn5cB8dFjKYtF3Tro
--> ssh-ed25519 YJiRbw jb8zqdGeli0yTTabdv+C72UHd3F3Kf1VCeOGjqi6oxk
+-> ssh-ed25519 mOmPfg i97muvfIspxC43LzSDXoVQk6cAjI10MsqC210B2f61U
-y0OBqyi5Rgdxdfdcdrt9SC+rqUfwB/Db9YGx1jBIn1g
+gEHIUZ8Gh1iRMFgyORZVMoCGHVBBM4tgy9a3ZhGLPVY
--> ssh-ed25519 Nl/5yA XABrTPgqVEU+H3vVciDTE5cUOiLogPNtnKgc0hFfjjY
+-> ssh-ed25519 YJiRbw 08/8XgHVe6HPb6nQJna86m4PfanX0G5DZGAzpKl2rkg
-PGcnW9bss2ST4sbM5c1OemW8sjZb4JmgjokAwICPR3o
+v/Mp1GS3hlR4gLoejh+EZKbbK8jT2zw+V67OYalM6Nc
--> ssh-ed25519 GdLgCQ IxqW2RoEzka8OLv1t84UJ4QIZgdMC7uv1VC/1aOCKTU
+-> ssh-ed25519 Nl/5yA FypdqFMg8qQkfz0oc6AS6/HRPUyFYSaFSvj/lnhnT0A
-681zK7CVFrn692BsZ0nKnIdgv5lZteuzgX57VuTPds4
+VjRospt1aMg7KHjegD5z3DDv3+1Ybb37xDI21ujhSgA
--> ssh-ed25519 tOH/HQ ffHb95tfhzMnUOR3JzsN3SynReV7hzaS5CG8ETwS61M
+-> ssh-ed25519 GdLgCQ mBN97cY0tIoqeMeyFrzUdIM+vNIwXsD5+Cb1HYmz1n8
-1WkVjlKTu3qHci8yfgsr1zifjvbZqAZW+KHWQv1z+g0
+6Ot2LzuSF0JMwlamrGzvBMj/vpbWnqz1YuUAi025Ysw
--> ssh-ed25519 FpzvfQ 1I1miMxckl6r4MJlsaHUGQeRlF/MArYOvVpxWoR1WCA
+-> ssh-ed25519 tOH/HQ 4FRGUx9UfjL25KmJiyvRg6/ZHqt1egyuTdTY5lZGJWY
-G686WbFoGcUrlSTqJ8ZhXxg57hgt2OwOLGPUUxVepVU
+CVCC9sT0yXp8xBT2klU0ZsL+BzMF9ZoDLYdmjX1r/Qs
--> ssh-ed25519 2UotMw 13+e9PAn6rScb8SlQyrpuVJGgQxhRF6PnFIAhmuMKhY
+-> ssh-ed25519 FpzvfQ +5E/wW7sBd1dxFhdyV0GGUQP1fQTYLvUmqyAfYvwEGY
-0OBeqN1Lok4iVN3ybcKvn5N8PkysO2KOhLVxVm0Hp4M
+DFeNc8xFBZntBE5i7aYx9G5Bo0yO4TwoGcTRU+b5NGk
--> ssh-ed25519 kdPvzQ 05Mecby4PtXbMG6PrRkRCehFoX5+E+iElj0OhC28uFQ
+-> ssh-ed25519 2UotMw +kPcnMUigPBK32qHQ2moQ6Be+RBSiDLkIH8uqWLkLhA
-Dz1SW3MYl9po/wOJrvZP547PYxNy6g/nfdFI7+AizhQ
+ax0FOwxReFDHaFHugnpMYWMm8N/L+wq2xmpZlI5jzzg
--> ssh-ed25519 onmXpg dO+Z197lqZNCYj8QMjuI+JegkECteQUNO0N2WgcW/30
+-> ssh-ed25519 kdPvzQ MmGp1AHkHBOFssvykM0kXaZVOdnCMXn3tVtmBtosxxA
-SfhhHvb5j/BPHKksMzQwMF02K7RhlQ2T4dIQc+h96sU
+rQM+5VE/ZGOyg/YPeE/9wixVP8nhFVnDSYEH8+uqQ8Y
--> ssh-ed25519 CnhD0g qMU+iswZGN3HrgRTRLvpmZBspUhzOhxaB4IEgZGeO10
+-> ssh-ed25519 onmXpg IbrF77RJ5aJ3Qb+rax7VDD/CTarHd0LBUxdtaI84zjk
-kLLPnVwr7BNz3m0ZsXOkrWijQimiaNh85uhGFpvGZQQ
+SiVII5TaDeUX0wcaI7grFSGICasbVc880PQFET4Cxi0
--> ssh-ed25519 4ep2UA CEndKjv+s2dcIHFJaI60dB79S/HRiEVZmWaga3AvmH8
+-> ssh-ed25519 CnhD0g /p2jgsOabLoJ9PSo39aKbXR72ri0mY8dgUxkAn9Kon4
-oDfdLqU29FEORoqHzerZe6PRXomtfYLE1FrwLiaa2Jw
+aQVSFx75uDIgEtbxupGh4qiZ46EsIDZBArN9Q4jx2qw
---- U7vY+jp7wVpzuA640iJfNm1OsRfjQwbmvfF0z7VleTM
+-> ssh-ed25519 4ep2UA aA1EvSgI0c5i0XSMtdieIU4z9ugyi1Tenkx8mqZKVgY
-O!PÁSÛ¹åQãו"O×2«µL•—A¯rèÿ\6ç»ï9|qÑà:ÀŠ±­q�ü½ÜdˆõFק†Ø\JH¢1;ñ…l.OŸj­cH‘e�
Ú-¢Ë.ší:�¶ç�ê6žñÖ_òº&8Ý3‰‰5�p,ݤ¶Ä€&4Ÿk„Ó¤y¿Í–3Á�½VNè”S齜¼§)ÔøuD
+t7vuvcBlaRRkihHE9YsSzJEUWq4dv7RwALrAmgC0DOI
+--- xQHTWIvQbA7XkRitcNRsdAod4d2AuFsfrQPbVXcp9yI
+JE–wJnܥإrIæúl´D¢_#ÑÅbgëý‹tžWöMu�Í"Á0ÍJÈè�ŸÂw¥oe^Æs,œíëDæ…À¾ÚývÓG¼#îuP„î7ÙX|€Ú÷Ý[ð¢8 ³$èm¯Å8’u%¼Z&=BZôãó{ïæ3mtyç£ÊRhÿöÀô¡ÓHvˆ	À 9‘¯¤T@ óHŽîÞ

secrets/nebula/zeke.crt

@@ -1,6 +1,6 @@
 -----BEGIN NEBULA CERTIFICATE V2-----
-MIGjoD2ABHpla2WhBwQFCp0ABhCFBGpzgSyGBGuuvKWHIIOJTGBgdlWpERTumyvb
+MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV
-x0i842abqoQVUOzEXjsFB0CsgiD4WYoZNy8i9RwV1yC4RNHJufeOHnyMkvpfkEdy
+qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58
-avE5Y4NAVS1PQZIausgi1JekcdvwJ/+G64bLjzjznKD72u4XJfl7WKaO1O+RYOf7
+jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa
-/2YdsUCODDzoGjdEtrQVftiz8RxRBg==
+DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8=
 -----END NEBULA CERTIFICATE V2-----

secrets/nebula/zeke.key.age

@@ -1,37 +1,35 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q RZaa6sKEE57cPNGq0i71GIwnGaaVTOrbVRi6Jn51Ag0
+-> ssh-ed25519 8UnW5Q E8Ki3oFCl3dLp9gxZ7/Ene8NMM26OVJ4PMJQQYQnBm0
-pesn34IPUu5KqvBXNV4pJRc+VbhWOV0AJtc+avWUm7k
+3rC3LMfdPCvSsiwaVnAb7VHwyw7KjZKcASdWm0lDg5E
--> ssh-ed25519 UFfTmg JVean8h3mnv0U/mkvO7aiAnSFNNWsUn9JRLbezVaRjo
+-> ssh-ed25519 UFfTmg 6q8nJbCIQe2IV/W/31OpuI6sZI833IbU+weSTU05Mng
-quaD/FbGLxmZi3b1h295ENlEWjpCbw8Pp5alwxR4cFk
+EgiGZwIN0oRjw9pAaHjypWtswBA1c5PCkNeN9K4YlT8
--> ssh-ed25519 xNtnoA +HqFSjrcgSTG3xPa/P65zxn9Cz3Yxe4eYzN5PldzoQE
+-> ssh-ed25519 xNtnoA cyxa8uxevJ9VEaYLg2g9rewcAMhsZRAPEkzqd9k6ngE
-zuohvjM/h1Fx84EH0fMMTR+49kNT2fM2FXmLNr38mR8
+SedkkmBd4foxqB1MlCAkfIqO6ft5xnmLBa2cShzw/GI
--> ssh-ed25519 aY2AXA q/QKxTAgQGRmzADx89SZCN9695ALg5/N6APnGH9IxBY
+-> ssh-ed25519 aY2AXA biY7lFtfvr6vBv/XBhZ6Uh7Hpj+Du0NuEjo2RMp6USI
-JmATp8b6YOAXCLh8JhFqgwadW0Ny+yHVnuDgLVQ189M
+5DgzmbEw5f6h4lHm7FlRZHXn4C9vCJ6IguXk7jZXxqM
--> ssh-ed25519 AQhf1g omF+JqRyN70CT/8IdECVcPmAVVzboo9UVq1AF6dPSGo
+-> ssh-ed25519 AQhf1g e3g+IdnzmuJZj3H4LWdbZ8yaj5GM21zz3HCgkzFG5Cg
-pobUt/MZUn+prhtJK8glDICD1JIBC6K06yYLGnVRTys
+oyzAIsqnL9ypSOCHINMu/+VM9TJeqgY9jLumhmAFIu8
--> ssh-ed25519 r/3ipA xCMqzT590mCVsAbPl1OWRdP74MBX0pfb0qobFnO8gxI
+-> ssh-ed25519 mOmPfg o4pCs9ferfC6+OawWXsM5Wa/5q+4EN+lEg/diMrjVhQ
-y/lcNLh5Rir//JthjrpBjhgIBrYMBE888077RHSh1sg
+H1gSB90UuJaivo2MhinPQGCV+rmSX1ZWazfhOxIDcaM
--> ssh-ed25519 mOmPfg xGf6g2NKz66txprOPW+5+NWkY3zVk742CHJo7VOwF1w
+-> ssh-ed25519 YJiRbw o33TjJkI7rc1DxXRMdgwoHfCqzU3sGd7BZo7Uw0I8iA
-sL4yh0PBIvdDBtBV3WNdTulD6GQQnQz5eVl2jmEqP2c
+/PiNDHyAl54HYszKkRzsjuoAZ53Ly1Oizf6NUIDB+I4
--> ssh-ed25519 YJiRbw gEp7n1Ne3dCc6dw9PwFr+CNbs4LDuqZdba/jwhLVuD8
+-> ssh-ed25519 Nl/5yA FUycbaA303kvgINg9eNM53lN6aUXQPBxWz9liuhZ6Vo
-0d3IQFCUVG3cTn+tkfoTIHh0oZ69NZnCNyjCVgPtg9c
+nNMPiq0w06WWfe73fpj/9ixunwgzZUCEi6pIKWuNWvQ
--> ssh-ed25519 Nl/5yA JaUM4j7ujiaXVzLWbGH9wdkpLSVFgaZZILuQGz0zU0Y
+-> ssh-ed25519 GdLgCQ sD2xKKzEyD7GsnFJCrDi40sJX0yBIXLr3pLx1R6RT1g
-IeenYloIBqSUADSaqscvXBfgStVbVzsR1R9iy0WsG6M
+ThDfA6T5/9cgAFKZPQtxGhKHdYOZx4sSQnoxzJMsLwc
--> ssh-ed25519 GdLgCQ cgRT+L39RcSNAlysZ4QoTzQS05E3IS+ovIndMC4CYzU
+-> ssh-ed25519 tOH/HQ YeQfSV5UxsYAMEIOq1FNpkNcM4LEA8zvcbOceZ/26ws
-MkpqlNRgAXD+A5IhM9OxsPNOzmGvTtxopyRLVNZ1yVQ
+KMeeyObeOBmqxS6hqhVbDgvoB5jUJr8k21igT3rqoww
--> ssh-ed25519 tOH/HQ mxphlwK/5sx1gjYIn2QXsleK0kf8kKXm8GURh3HUTBA
+-> ssh-ed25519 FpzvfQ GbT7exaVbqJNP7LdV/wyye89yXuN6FI20j7ckx5r5nI
-QsZqmYrl8js0tryfuF7LLSdEJ6jCnFNoufq/S1HWjlI
+bNMqf7oY6NWVTPvVLOy+UpJKT0C9m6WunfdvMXCUZzk
--> ssh-ed25519 FpzvfQ 2SBBbx61IWhbo7Ok19QKQFJY+8V55fqtemqpsIiGUlQ
+-> ssh-ed25519 2UotMw Zpco9IYJXyl9wIZo22g/kp/OjfClOtUP2in+N0hYX3o
-KpV7xQVcbl7pF51OlvBIclBAMpmtQz88msAkZyusf40
+e68dEYPiNdlrSFaMTzvrhCz9/5V5zFAvrTnPtNSyI4c
--> ssh-ed25519 2UotMw CD9qB3JQsE+Lq79hoGXNgUAJ4g1OdQmBXrR6PtT78iU
+-> ssh-ed25519 kdPvzQ 2j64L6rV5b5+sbKbNAGf9+7uKLgdBpKNv9umHtSW4wY
-o6nOndGlmlb36iB/MIUKKPkkr1Tq8MkVmy/kVCN1eik
+3y74VGUzKb9uhh3DvlkvZ5Jxtgfku7s1kDKrGDWUUvk
--> ssh-ed25519 kdPvzQ 4SXmcs4lZo7ykrBaEelSALMwcpWkH1daxU9j0MM6biA
+-> ssh-ed25519 onmXpg 8GDMsteOopCnaaVkXAoRMbGuXeKoSqpyZhLvbnEWBQU
-+H2h9h8Fp57wf1cxxy2pobK/VJ7c5L2qyVGgOE2pmYU
+X0HsZbpT4Wc/KO0TBwVSyjK6Zcbz1A34VCozNrMH4Lw
--> ssh-ed25519 onmXpg 98Ji8sqEbmUxRHWKr4Wyv9JfFToywXtnR4jMAz+1xA4
+-> ssh-ed25519 CnhD0g uHIeQtUwcDRXdJpFglJ12ptOPP64yMP6WKPz00sAQ0c
-gMzNojDh24mr6gd4QiumwmBG3yE4XkEeBj3mF1Kpaf8
+yIKZNODIQSkNr4UilEHZzOBxeRA4G/sAbkppyOdUjkQ
--> ssh-ed25519 CnhD0g DvGhJNOvn9hoQC4SInkqMehVmyHjaZGwVL2qxdDHPyE
+-> ssh-ed25519 4ep2UA k+cteVM7cMWQk7xDcCZgWlZxgA4ZBmUlbZHQFmMoi0Q
-TTWdemLOD5gq6PbStBcubTjSpUVosZgtTXT8IK7edow
+YC2fptyb258arEdeOcPhCc3+z/vIgEElbqn2Ik3r2Lo
--> ssh-ed25519 4ep2UA uYgbtUOrHY8tffrfDiUg8pg86X2WUXnGTBd0fhoCRiM
+--- NJ2uO0A/UbPrw+IgObiiXTwV75xgsWTjYvLpTwznDXM
-zk/qnapTdAXTYrrGuvbmYEaEf4+OhmcBaouH6Ec28p0
+³B Ð-ø�`8nß=m5/s”zǼmÚÝØ
ˆ‚Sþ”ÖÍÆ œ¿Âõ&_¤WÛRpõß²“�=iG’FyÃEíІ¹¥èIñq:ö|-~$ò>ûÄbv~l­eè/ñd•V Ùˆq”ªÐ¾±¶
˜Â€ƒ•‰5¯ÝýŠÏ‚é|¸‘JÅí
´£_£°l¯¬ñZ2°rìPÞ—p½‚.
---- BJAX2O7CUM+MAUaXtRpLkt1S7Hq6X7Vo8pOnFagnCeU
-Uj…ε8‰ß«‰†Fž�š¯0œ{SP¤q„Z˜
�蓤üCB¾Þ
hvÝŽ€ÐëÀ§‡­Ò<½ ²Ê0?«•ö	ßɲY=ªò^'¬96ÉZûÆôMˆú$y­t^83Ôô%ÿÒ8;?<|¹ä¤o©úûΪõ`ºÍãNb©HánÑ3hwê%Q½º/§¤M?3£šU6Z¥Üä¿ÝÍý¨ËŽ\	0

secrets/nextcloudadmin.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 8UnW5Q LRvQ8+42bvJAT2MOgqWSS8J+fmbRNCEM6YHKa3jjFxg
+-> ssh-ed25519 87huqg 3GQFjURPxvmYZHxYY5rlHBn7FOYFhj4DQk0ehW0rSHM
-Yyl9rQO5jXfU6kP9AaPFD9U86qJYJ3KoRKWcnfbJVRY
+anGlFUAIe7reh8wjs+9bjv7LuOD4j2SMS/sg5b8M6+U
--> ssh-ed25519 UFfTmg vtRUvGhG2wcgmH0OUUGt5FySPfpb3RlBcNPL0soDMks
+-> ssh-ed25519 8UnW5Q jfzOveDXi9BruyfwrnzbbIqJMDF7rFhHUg/NIWYRoRo
-7U7vuIyXvVptLSUzBcLGVvdBIieucypfl7j/zQE4cKE
+/O5e7gIVK6D1Dp3P87c51ff+tOGzp3SGTmGjel8ixhI
--> ssh-ed25519 xNtnoA AE8W822QM3xRZcBupY+PX5n62eyHKhtKYfHVmMf5pl8
+-> ssh-ed25519 UFfTmg qkUtoDm/UdhxPErvqGsoKmeMPzyiN0CeCnyloIiM8zQ
-1a5C8vdYt+jjM8Ynzja4cIkitn8CIBfpp49leDooCCg
+taivAoakVzDP7dIM56FVBBTRTK7jUI9yE5nBDZlZ3ok
--> ssh-ed25519 aY2AXA VwO5CmrX4w+7C6FN3da632C4ODT8PWVsdFDmDPa36Cc
+-> ssh-ed25519 KbVVUw tgUU2+jcmv2IiXCGAOd9u9klxq4a+msiaiVrgZxUg3Y
-tm0Ns5TvK2TT8k0pWdUFVazXOqAdkQhUtqnsH/Nr7T4
+G4eNn3Ib93eDtyiDvqI8R8aqVDa/RrSNCx3qpfPeg3k
--> ssh-ed25519 AQhf1g elDKAgwosKD5fplGb2imeKOz2xAubcKM2UF9brhSZ1A
+-> ssh-ed25519 xNtnoA hAQ0MQqLpgxI+WDEcMHPc/rj9Iajkt5jGDHuwQIOlFU
-lBWix7EZiL3NUNJBfvmSX8rSzkjnJjlz78g3CowUFr0
+gsrtBJG39f/SxtaHSQlhrB2j2YNqpd2LOM3oMegHj2M
--> ssh-ed25519 r/3ipA Q36VYC3Ckdzo1tJvIHSFoXtDX771ajE13D3JDdy7jgM
+-> ssh-ed25519 aY2AXA gAhU38iv5KabRNmC0Nv5Zb6NzgfC4DND/fXBhMPP4i4
-VxhKh5JMXfkIy/r9osMYIBZmyzwMg8Xv5S5ZOXhQY3Q
+dyH20irV5/UlAU8YpDJ2EGNDzomp+s70J/jryDZzJIw
--> ssh-ed25519 mOmPfg 78q+bNPxfpfa+Zu3t8JB/H8WCU4o9bKNzC3v2hpAGwk
+-> ssh-ed25519 AQhf1g 4y+5KVC/Tej7f1M6E7yzrOyMC6K3bFPbru88+ti2WwY
-FXkTocxcJHBLkWtbZjK8C1GQCWJ9yGEeItxifDCXZy8
+Tkq6RK50Zqots2ZfDTtKOHT9c3Cjkp1imjBkaOlm7Uc
--> ssh-ed25519 YJiRbw SKyKYiMkqumdiZaMHNIBtmjR6YxFN5w8zOtJUN2y9ko
+-> ssh-ed25519 mOmPfg si3XZXemqRwJcTvfGOdqOel7Nz880oAZa2MNqSukG0A
-I3IIGNBfLYK+PGPak8iolGmJAdKScoUkYMWl75nBQeY
+hhh/N9cEakzOLbu9Aqku7TLWQjNx5lm389MDF6ftlHY
--> ssh-ed25519 Nl/5yA RBxxSP4VcIYvOTB77GeqxQjJ/xlP0pwwXQteqK4OqAU
+-> ssh-ed25519 YJiRbw TYd7FcMfSxlEoyjPhfy/Mtde7vrzP057v9Rrbit/RG0
-nw8eBzXxsTx811GlrIlYBUAVcAK5mvRcq/aQYggc6vo
+/r1Y3IXUF1Ye2CuTXCd9+mS44n+JbtYpGIFSW1LkcmU
--> ssh-ed25519 GdLgCQ +/McIrzLSB2b6UYj4Z5rLvbFki0VlLw1zXEyjw4xiSE
+-> ssh-ed25519 Nl/5yA L5BIY2unn0RbeX8hdL1+jLS82yqIuBmqo2B4DuQjzQ0
-yOwqVibA6P0gMDucd035F3FgJdVGsTShzRB2eN7WGEo
+7U6JGC/mZU4gpDUNBS7iiIYp9tqUM4S+EZaeOciJMcQ
--> ssh-ed25519 tOH/HQ cqI4xCjgQOtkackr6ePk34O3V5aFjsPaBo5oCb7OcQk
+-> ssh-ed25519 GdLgCQ dCr8qBTxs0kltrhtL7m812KD+OTuFXHAE7tikhzSyTo
-jbPrD0oPOPwEMU2ULIu7fBykyKlCPZMuMylJ1GgP0W4
+ahTyjll6x+g22Hu9jBR3eLM6C0hicz8n8GfojM+Em0E
--> ssh-ed25519 FpzvfQ K32LF8T/BFTU6FemV7WSNWYTJIN6nipDga6WDyO/2GI
+-> ssh-ed25519 tOH/HQ WbODKZXUVGpNH8+Q0/R3Gfo4/AtZxc8XV4gaZHEy0D4
-BTFm8nsGPI0jOJUng4s2BF8PnLL9gT+0pyNzpBmVkXo
+RGsiXjuAr70v7rbScGozDnL9PGzETib7cCQ7VINt2QI
--> ssh-ed25519 2UotMw VJWGl59Jvze5lPcmylykXMH+Xmv1rP1zA+6ZEtsZxyU
+-> ssh-ed25519 FpzvfQ YFysfaHAuxpg3HhOwLsMnZHkXRfB30cQ2ZyI73+bTRA
-kvgE3l2WsoJS7HyiLO6WONfGa0odaixqRDkhGi0gLms
+mZQUKw/0odOl1ZkAiQEnCt/eINEPW5rXeA3Y4p1N46E
--> ssh-ed25519 kdPvzQ UnD1nnR2KC9lPicQPuGKe1j9vbAnyPz8+X+H1QqlyG8
+-> ssh-ed25519 2UotMw ZKsl+/EjxFspSZ6Zs+ZfNmklbAm1luw3RK6BiIKo3i8
-sBaVB0r2E05V38znyhehorQB6IZe/B17sDO58JhHKyg
+sVwUAgZ7/JZVHRyhCZFCLFaYopfj+nk4EyctGCHcggo
--> ssh-ed25519 onmXpg ww4Plkb0njPIQoPXH5V3Pmz0ko/1hzR64T1S3P3EW0Y
+-> ssh-ed25519 kdPvzQ CYrPhiUbDNOKfQX36HnG5fC96bBLOWX6wkQ3usw9hE8
-wkrx5164EA+gOP5mPX3QY0467CGl0E61xltHZT4j+xk
+vjF3sAI6cN987OGNVtIiwAQtkQKlzpuOGOtSqTlE58s
--> ssh-ed25519 CnhD0g FbaDeR0/3k0565LIzeO8KuwQ0KJInmJm1eyLj8U8W0M
+-> ssh-ed25519 onmXpg N4bbv2cKbh7KdiRZ+7pbtxyG0QQj2tVcp/LVxNtuenc
-ync9BVgY6Z0eeTrJ1rTBjHwRjBu8ocL2RvtYKo7fZXQ
+UOMvWOY7jabEdUWOfK1Ao0n0d3GJeiP36U2REYHFLnI
--> ssh-ed25519 4ep2UA my+YNWCA8Y6glJcGMroChKMP2CYXCMPKJCPe7F4G/3g
+-> ssh-ed25519 CnhD0g WCUVLCGQAr2kxkE+wzp/pMHqYhD2sROb5H5+jUCjkHk
-u9gsSRBIwf+KO44A6BBP1rx3SOJIZ1mYKH8JhuP2kws
+QLlX5xxrj4s/t09IZkJsnQstnraSBycIp5IRN66SCQw
---- aTzCD5KDcWPRhV8hAh4fdeDKHScvtHS7yuE9Th2xE7I
+-> ssh-ed25519 4ep2UA Q7rwzd0fpqve0do8NFjikaVJ7JYMlc4Gl9Id8nlVSmk
-ÌÁôq(s–½i÷þµ¬WûdŠ®�¶ÐÚ‰ˆûÕ‡
-½B¯v a¥�
+5EU6xOdw2aGUsdaGTdksevrwwtufsKNQsPlTUpivgZE
+--- EeaIf7OWV3H79Nf3Jvfynt32XSZJwU7Wcby9ndc9aBY
+ì^†ñ5�ðØ<ÇòÈaƒ^!¡ieZ
¥›ÿ¡¸žµ¸nÄ�	R�»Bž