nixos/kelder: Add acquisition

2023-05-23 21:32:38 +01:00 · 2023-05-23 21:32:38 +01:00 · 1fa718c20a
commit 1fa718c20a
parent 18ad20a8c5
42 changed files with 964 additions and 407 deletions
--- a/lib/default.nix
+++ b/lib/default.nix
@ -261,13 +261,24 @@ rec {
    };
  };
  kelder = rec {
+    groups = {
+      storage = 2000;
+      media = 2010;
+    };
+
    domain = "hentai.engineer";
    vpn = {
      port = 51820;
-      start = "100.69.69.";
    };
-    start = "172.16.69.";
-    prefix = "${start}0/24";
+    start = {
+      all.v4 = "172.16.64.";
+      vpn.v4 = "172.16.69.";
+      ctrs.v4 = "172.16.64.";
+    };
+    prefixes = {
+      all.v4 = "${start.all.v4}0/20";
+      ctrs.v4 = "${start.ctrs.v4}0/24";
+    };
  };
  sshKeyFiles = {
    me = ../.keys/me.pub;
--- a/nixos/boxes/colony/vms/estuary/default.nix
+++ b/nixos/boxes/colony/vms/estuary/default.nix
@ -137,7 +137,7 @@ in
                in
                {
                  after = [ waitOnline ];
-                  requires = [ waitOnline ];
+                  # requires = [ waitOnline ];
                };
              };
            };
@ -185,7 +185,7 @@ in
                      {
                        wireguardPeerConfig = {
                          PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
-                          AllowedIPs = [ "${lib.my.kelder.vpn.start}2" ];
+                          AllowedIPs = [ "${lib.my.kelder.start.vpn.v4}2" ];
                          PersistentKeepalive = 25;
                        };
                      }
@ -336,7 +336,7 @@ in
                };
                "95-kelder" = {
                  matchConfig.Name = "kelder";
-                  address = [ "${lib.my.kelder.vpn.start}1/30" ];
+                  address = [ "${lib.my.kelder.start.vpn.v4}1/30" ];
                };
              } ];
            };
@ -388,7 +388,7 @@ in

                    {
                      port = 6922;
-                      dst = "${lib.my.kelder.vpn.start}2";
+                      dst = "${lib.my.kelder.start.vpn.v4}2";
                      dstPort = "ssh";
                    }
                  ];
--- a/nixos/boxes/colony/vms/shill/containers/middleman/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/default.nix
@ -167,6 +167,14 @@
                  dnsProvider = "cloudflare";
                  credentialsFile = config.age.secrets."middleman/cloudflare-credentials.conf".path;
                };
+
+                "${lib.my.kelder.domain}" = {
+                  extraDomainNames = [
+                    "*.${lib.my.kelder.domain}"
+                  ];
+                  dnsProvider = "cloudflare";
+                  credentialsFile = config.age.secrets."middleman/cloudflare-credentials.conf".path;
+                };
              };
            };
          };
--- a/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
@ -45,6 +45,8 @@ let
    };
    "/.well-known/webfinger".return = "301 https://toot.nul.ie$request_uri";
  };
+
+  kelderUpstream = "http://${lib.my.kelder.start.vpn.v4}2:80";
 in
 {
  my = {
@ -368,6 +370,39 @@ in
        };
        useACMEHost = lib.my.pubDomain;
      };
+
+      "torrents.${lib.my.kelder.domain}" = {
+        locations."/".proxyPass = kelderUpstream;
+        useACMEHost = lib.my.kelder.domain;
+      };
+      "jackett.${lib.my.kelder.domain}" = {
+        locations."/".proxyPass = kelderUpstream;
+        useACMEHost = lib.my.kelder.domain;
+      };
+      "radarr.${lib.my.kelder.domain}" = {
+        locations."/" = {
+          proxyPass = kelderUpstream;
+          proxyWebsockets = true;
+          extraConfig = lib.my.nginx.proxyHeaders;
+        };
+        useACMEHost = lib.my.kelder.domain;
+      };
+      "sonarr.${lib.my.kelder.domain}" = {
+        locations."/" = {
+          proxyPass = kelderUpstream;
+          proxyWebsockets = true;
+          extraConfig = lib.my.nginx.proxyHeaders;
+        };
+        useACMEHost = lib.my.kelder.domain;
+      };
+      "media.${lib.my.kelder.domain}" = {
+        locations."/" = {
+          proxyPass = kelderUpstream;
+          proxyWebsockets = true;
+          extraConfig = lib.my.nginx.proxyHeaders;
+        };
+        useACMEHost = lib.my.kelder.domain;
+      };
    };

    minio =
--- a/nixos/boxes/kelder/containers/acquisition/default.nix
+++ b/nixos/boxes/kelder/containers/acquisition/default.nix
@ -0,0 +1,105 @@
+{ lib, ... }: {
+  nixos.systems.kelder-acquisition = {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+
+    assignments = {
+      internal = {
+        name = "acquisition-ctr";
+        domain = lib.my.kelder.domain;
+        ipv4.address = "${lib.my.kelder.start.ctrs.v4}2";
+      };
+    };
+
+    configuration = { lib, pkgs, config, ... }:
+    let
+      inherit (lib);
+    in
+    {
+      imports = [ ./networking.nix ];
+
+      config = {
+        # Hardware acceleration for Jellyfin
+        hardware.opengl = {
+          enable = true;
+          extraPackages = with pkgs; [
+            vaapiIntel
+            intel-ocl
+          ];
+        };
+
+        my = {
+          deploy.enable = false;
+          server.enable = true;
+          user.config.name = "kontent";
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSJ8d0prcSvyYi0UasnxMk/HGF5lWZz/t/VFYgQuFwO";
+          };
+        };
+
+        users = {
+          groups.media.gid = lib.my.kelder.groups.media;
+          users = {
+            "${config.my.user.config.name}".extraGroups = [ "media" ];
+
+            transmission.extraGroups = [ "media" ];
+            radarr.extraGroups = [ "media" ];
+            sonarr.extraGroups = [ "media" ];
+            jellyfin.extraGroups = [ "render" ];
+          };
+        };
+
+        environment.systemPackages = with pkgs; [
+          libva-utils
+          clinfo
+          jellyfin-ffmpeg
+        ];
+
+        systemd = {
+          services = {
+            jackett.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
+            transmission.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
+
+            radarr.serviceConfig.UMask = "0002";
+            sonarr.serviceConfig.UMask = "0002";
+          };
+        };
+
+        services = {
+          transmission = {
+            enable = true;
+            downloadDirPermissions = null;
+            performanceNetParameters = true;
+            settings = {
+              download-dir = "/mnt/media/downloads/torrents";
+              incomplete-dir-enabled = true;
+              incomplete-dir = "/mnt/media/downloads/torrents/.incomplete";
+              umask = 002;
+
+              utp-enabled = true;
+              port-forwarding-enabled = false;
+
+              speed-limit-down = 20480;
+              speed-limit-down-enabled = true;
+              speed-limit-up = 1024;
+              speed-limit-up-enabled = true;
+              ratio-limit = 2.0;
+              ratio-limit-enabled = true;
+
+              rpc-bind-address = "::";
+              rpc-whitelist-enabled = false;
+              rpc-host-whitelist-enabled = false;
+            };
+          };
+
+          jackett.enable = true;
+          radarr.enable = true;
+          sonarr.enable = true;
+
+          jellyfin.enable = true;
+        };
+      };
+    };
+  };
+}
--- a/nixos/boxes/kelder/containers/acquisition/networking.nix
+++ b/nixos/boxes/kelder/containers/acquisition/networking.nix
@ -0,0 +1,137 @@
+{ lib, pkgs, config, assignments, ... }:
+let
+  inherit (lib) mkMerge mkIf;
+  inherit (lib.my) networkdAssignment;
+
+  wg = {
+    keyFile = "kelder/acquisition/mullvad-privkey";
+    fwMark = 42;
+    routeTable = 51820;
+  };
+
+  # Forwarded in Mullvad config
+  transmissionPeerPort = 56630;
+in
+{
+  config = mkMerge [
+    {
+      my = {
+        secrets = {
+          files."${wg.keyFile}" = {
+            group = "systemd-network";
+            mode = "440";
+          };
+        };
+
+        firewall = {
+          extraRules = ''
+            # Make sure that VPN connections are dropped (except for the Transmission port)
+            table inet filter {
+              chain tcp-ext {
+                tcp dport ${toString transmissionPeerPort} accept
+                iifname vpn return
+
+                tcp dport { 9091, 9117, 7878, 8989, 8096 } accept
+                return
+              }
+              chain input {
+                tcp flags & (fin|syn|rst|ack) == syn ct state new jump tcp-ext
+              }
+            }
+          '';
+        };
+      };
+
+      environment.systemPackages = with pkgs; [
+        wireguard-tools
+      ];
+
+      services = {
+        transmission.settings.peer-port = transmissionPeerPort;
+      };
+
+      systemd = {
+        network = {
+          netdevs."30-vpn" = with wg; {
+            netdevConfig = {
+              Name = "vpn";
+              Kind = "wireguard";
+            };
+            wireguardConfig = {
+              PrivateKeyFile = config.age.secrets."${keyFile}".path;
+              FirewallMark = fwMark;
+              RouteTable = routeTable;
+            };
+            wireguardPeers = [
+              {
+                # mlvd-ie-dub-wg-101
+                wireguardPeerConfig = {
+                  Endpoint = "146.70.189.2:51820";
+                  PublicKey = "lHrukA9+vn7Jjzx2Nb/1NQ0WiaiKppEqVxrGT5X1RFQ=";
+                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                };
+              }
+            ];
+          };
+
+          networks = {
+            "80-container-host0" = mkMerge [
+              (networkdAssignment "host0" assignments.internal)
+              {
+                networkConfig.DNSDefaultRoute = false;
+              }
+            ];
+            "90-vpn" = with wg; {
+              matchConfig.Name = "vpn";
+              address = [ "10.66.242.99/32" "fc00:bbbb:bbbb:bb01::3:f262/128" ];
+              dns = [ "10.64.0.1" ];
+              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+                {
+                  Family = "both";
+                  SuppressPrefixLength = 0;
+                  Table = "main";
+                  Priority = 100;
+                }
+
+                {
+                  From = lib.my.kelder.prefixes.all.v4;
+                  Table = "main";
+                  Priority = 100;
+                }
+                {
+                  To = lib.my.kelder.prefixes.all.v4;
+                  Table = "main";
+                  Priority = 100;
+                }
+
+                {
+                  Family = "both";
+                  InvertRule = true;
+                  FirewallMark = fwMark;
+                  Table = routeTable;
+                  Priority = 110;
+                }
+              ];
+            };
+          };
+        };
+      };
+    }
+    (mkIf config.my.build.isDevVM {
+      virtualisation = {
+        forwardPorts = [
+          # Transmission
+          { from = "host"; host.port = 9091; guest.port = 9091; }
+          # Jackett
+          { from = "host"; host.port = 9117; guest.port = 9117; }
+          # Radarr
+          { from = "host"; host.port = 7878; guest.port = 7878; }
+          # Sonarr
+          { from = "host"; host.port = 8989; guest.port = 8989; }
+          # Jellyfin
+          { from = "host"; host.port = 8096; guest.port = 8096; }
+        ];
+      };
+    })
+  ];
+}
--- a/nixos/boxes/kelder/containers/default.nix
+++ b/nixos/boxes/kelder/containers/default.nix
@ -0,0 +1,5 @@
+{
+  imports = [
+    ./acquisition
+  ];
+}
--- a/nixos/boxes/kelder/default.nix
+++ b/nixos/boxes/kelder/default.nix
@ -1,17 +1,32 @@
 { lib, ... }: {
+  imports = [ ./containers ];
+
  nixos.systems.kelder = {
    system = "x86_64-linux";
    nixpkgs = "mine";
    home-manager = "mine";

+    assignments = {
+      ctrs = {
+        name = "kelder-ctrs";
+        domain = lib.my.kelder.domain;
+        ipv4 = {
+          address = "${lib.my.kelder.start.ctrs.v4}1";
+          gateway = null;
+        };
+      };
+    };
+
    configuration = { lib, pkgs, modulesPath, config, systems, assignments, allAssignments, ... }:
      let
+        inherit (builtins) mapAttrs;
        inherit (lib) mkIf mkMerge mkForce;
+        inherit (lib.my) networkdAssignment;

        vpnTable = 51820;
      in
      {
-        imports = [ ./boot.nix ];
+        imports = [ ./boot.nix ./nginx.nix ];

        config = {
          hardware = {
@ -56,6 +71,16 @@
            };
          };

+          users = {
+            groups = with lib.my.kelder.groups; {
+              storage.gid = storage;
+              media.gid = media;
+            };
+            users = {
+              "${config.my.user.config.name}".extraGroups = [ "storage" "media" ];
+            };
+          };
+
          environment = {
            systemPackages = with pkgs; [
              wireguard-tools
@ -83,6 +108,11 @@
          systemd = {
            network = {
              netdevs = {
+                "25-ctrs".netdevConfig = {
+                  Name = "ctrs";
+                  Kind = "bridge";
+                };
+
                "30-estuary" = {
                  netdevConfig = {
                    Name = "estuary";
@ -115,12 +145,18 @@
                  matchConfig.Name = "et1g0";
                  DHCP = "yes";
                };
+                "80-ctrs" = mkMerge [
+                  (networkdAssignment "ctrs" assignments.ctrs)
+                  {
+                    networkConfig.IPv6AcceptRA = mkForce false;
+                  }
+                ];
                "95-estuary" = {
                  matchConfig.Name = "estuary";
-                  address = [ "${lib.my.kelder.vpn.start}2/30" ];
+                  address = [ "${lib.my.kelder.start.vpn.v4}2/30" ];
                  routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                    {
-                      From = "${lib.my.kelder.vpn.start}2";
+                      From = "${lib.my.kelder.start.vpn.v4}2";
                      Table = vpnTable;
                      Priority = 100;
                    }
@ -128,9 +164,17 @@
                };
              };
            };
+
+            services = {
+              "systemd-nspawn@kelder-acquisition".serviceConfig.DeviceAllow = [
+                # For hardware acceleration in Jellyfin
+                "char-drm rw"
+              ];
+            };
          };

          my = {
+            server.enable = true;
            user = {
              config.name = "kontent";
            };
@ -146,7 +190,41 @@
              };
            };

-            server.enable = true;
+            firewall = {
+              trustedInterfaces = [ "ctrs" ];
+              nat = {
+                enable = true;
+                externalInterface = "et1g0";
+              };
+              extraRules = ''
+                table inet nat {
+                  chain postrouting {
+                    ip saddr ${lib.my.kelder.prefixes.all.v4} oifname et1g0 masquerade
+                  }
+                }
+              '';
+            };
+
+            containers.instances =
+            let
+              instances = {
+                kelder-acquisition = {
+                  bindMounts = {
+                    "/dev/dri".readOnly = false;
+                    "/mnt/media" = {
+                      hostPath = "/mnt/storage/media";
+                      readOnly = false;
+                    };
+                  };
+                };
+              };
+            in
+            mkMerge [
+              instances
+              (mapAttrs (n: i: {
+                networking.bridge = "ctrs";
+              }) instances)
+            ];
          };
        };
      };
--- a/nixos/boxes/kelder/nginx.nix
+++ b/nixos/boxes/kelder/nginx.nix
@ -0,0 +1,137 @@
+{ lib, pkgs, config, allAssignments, ... }:
+let
+  inherit (lib) mkMerge mkIf;
+in
+{
+  config = {
+    my = {
+      secrets.files = {
+        "kelder/htpasswd" = {
+          owner = "nginx";
+          group = "nginx";
+        };
+      };
+
+      firewall = {
+        tcp.allowed = [ "http" "https" ];
+      };
+    };
+
+    services = {
+      nginx = {
+        enable = true;
+        enableReload = true;
+
+        recommendedTlsSettings = true;
+        clientMaxBodySize = "0";
+        serverTokens = true;
+
+        # Based on recommended*Settings, but probably better to be explicit about these
+        appendHttpConfig = ''
+          # NixOS provides a logrotate config that auto-compresses :)
+          log_format main
+            '$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
+          access_log /var/log/nginx/access.log main;
+
+          # optimisation
+          sendfile on;
+          tcp_nopush on;
+          tcp_nodelay on;
+          keepalive_timeout 65;
+
+          # gzip
+          gzip on;
+          gzip_proxied any;
+          gzip_comp_level 5;
+          gzip_types
+            application/atom+xml
+            application/javascript
+            application/json
+            application/xml
+            application/xml+rss
+            image/svg+xml
+            text/css
+            text/javascript
+            text/plain
+            text/xml;
+          gzip_vary on;
+
+          # proxying
+          proxy_buffering off;
+          proxy_redirect off;
+          proxy_connect_timeout 60s;
+          proxy_read_timeout 60s;
+          proxy_send_timeout 60s;
+          proxy_http_version 1.1;
+
+          ${lib.my.nginx.proxyHeaders}
+
+          # caching
+          proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=4g;
+        '';
+
+        virtualHosts =
+        let
+          withAuth = c: mkMerge [
+            {
+              basicAuthFile = config.age.secrets."kelder/htpasswd".path;
+            }
+            c
+          ];
+          acquisition = "http://${allAssignments.kelder-acquisition.internal.ipv4.address}";
+        in
+        {
+          "_" = {
+            default = true;
+            locations = {
+              "= /".root = "${pkgs.nginx}/html";
+
+              "~ /media/?".return = "302 $scheme://$host/web/";
+              "= /web/".proxyPass = "${acquisition}:8096/web/index.html";
+              "/socket" = {
+                proxyPass = "${acquisition}:8096/socket";
+                proxyWebsockets = true;
+                extraConfig = lib.my.nginx.proxyHeaders;
+              };
+
+              "/".proxyPass = "${acquisition}:8096";
+            };
+          };
+
+          "media.${lib.my.kelder.domain}" = {
+            locations = {
+              "/".proxyPass = "${acquisition}:8096";
+              "= /".return = "302 $scheme://$host/web/";
+              "= /web/".proxyPass = "${acquisition}:8096/web/index.html";
+              "/socket" = {
+                proxyPass = "${acquisition}:8096/socket";
+                proxyWebsockets = true;
+                extraConfig = lib.my.nginx.proxyHeaders;
+              };
+            };
+          };
+          "torrents.${lib.my.kelder.domain}" = withAuth {
+            locations."/".proxyPass = "${acquisition}:9091";
+          };
+          "jackett.${lib.my.kelder.domain}" = withAuth {
+            locations."/".proxyPass = "${acquisition}:9117";
+          };
+          "radarr.${lib.my.kelder.domain}" = withAuth {
+            locations."/" = {
+              proxyPass = "${acquisition}:7878";
+              proxyWebsockets = true;
+              extraConfig = lib.my.nginx.proxyHeaders;
+            };
+          };
+          "sonarr.${lib.my.kelder.domain}" = withAuth {
+            locations."/" = {
+              proxyPass = "${acquisition}:8989";
+              proxyWebsockets = true;
+              extraConfig = lib.my.nginx.proxyHeaders;
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/nixos/modules/firewall.nix
+++ b/nixos/modules/firewall.nix
@ -144,7 +144,7 @@ in
    (mkIf cfg.nat.enable {
      assertions = [
        {
-          assertion = with cfg.nat; (forwardPorts != [ ]) -> (externalInterface != null && externalIP != null);
+          assertion = with cfg.nat; (forwardPorts != [ ]) -> (externalInterface != null);
          message = "my.firewall.nat.forwardPorts requires my.firewall.nat.external{Interface,IP}";
        }
      ];
@ -199,8 +199,8 @@ in
            }
            chain prerouting {
              ${optionalString
-                (cfg.nat.externalIP != null)
-                "ip daddr ${cfg.nat.externalIP} jump port-forward"}
+                (cfg.nat.externalInterface != null)
+                "${optionalString (cfg.nat.externalIP != null) "ip daddr ${cfg.nat.externalIP} "}jump port-forward"}
            }
          }
        '';
--- a/secrets/chatterbox/nul.ie.signing.key.age
+++ b/secrets/chatterbox/nul.ie.signing.key.age
@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBmcHZW
-SzVuZVNqZFdTcy9aaFFhZndJMUtXbnlFaXRrTmxNLzVvMVljS1RZCjFLVHNjcCtn
-SDBaM0tibFppVXBUalQzWkc0U2hkZnJoYXpvaE52TXFXczAKLT4gWDI1NTE5IGMy
-RlNCdjN3NjQxMnVOQVhIenhJQ3FRTjBqUkxBRnRqTTFRN0lNaXN5RVkKbVVoeFpp
-VDlSdkFwaEt3YWF4K1dDVXBvTXFRZGtCeFcvVDQwaGhyQzUzWQotPiBOSyktZ3Jl
-YXNlCkRWVlJIZzhuUzF4SmdWaVowbG5NNEgxbkJvWU5jRmQxemY3Vm9tU0J6UmR2
-QXB3U2JNNVR6UXJYLzB6ZlZSeGMKCi0tLSBJZVdoUXBoZkZGdGZUYW9jQ0ZGbVhD
-Q3dPVHI3RnFzQ0JWUDY1clJrNkRNCl3iu5E5FjB5bIoiZpQE7iiNQG8I+aVliUvz
-iYgpxJWfMcubrBYpvRInUFrzgdyAtBI6js6V/wPpM6+5GcmCDe4k1pgPtWP68BwB
-umH2L2yUJavjzIpjUzmNobM=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBzb0dz
+WUZWdWVnb2RqMlU0UmlRaUlpQXZGYU02ODNyQW5yb1FZL080TENnCnN4TDFxQ0Vq
+eDhENk11NkJGaVJxcmNpNDQ0RDdITmgzMjd6U1ZNdmpNcXMKLT4gWDI1NTE5IEhR
+L2sxYktBNGRndVAxaEpVWmF4NGo3ZnBxcC9xTk9MU0FNbUNTb1VqaFEKM0RpdXZv
+VkR6R25rdWM4MGpheFVrRzFXREw4QnlKVkh4OVdqU3ZRd1pOcwotPiAiIi1ncmVh
+c2UgZXB9cSB5d09uVmBkYSB4IgppT0drQkhoeUxxS3BRRk5ESDh6bXgzU0lPZHQ2
+N0xhSGlQdmhUTk1NUWttcHNHWVJOSzd5RURQa20zcG42dEZrCnp5d1ZYeXpOdnQ2
+VFUzMEovM0UKLS0tIE5KS2ZrcW1MQjA2WmUrRjYzbEo1VGpQVjV0TTFGT3lIMVc5
+bE9PaTQxYzgK5NER3DWdaq8ESmVHzRb0QR8RmN1tdUMtUaa3PJX8tZFhw8EDddQr
+BHif7Yf3Ip8QVIr3IL9QV93DTE4AlgI5ybJ6u84sez1SgVIQdHUWLedrkRIZPH5C
+My61+Q==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/synapse.yaml.age
+++ b/secrets/chatterbox/synapse.yaml.age
@ -1,24 +1,24 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBITFdt
-ZCtRUXdFV0pwQUNCMnNQWVFLazFGMWJybDN2a1hjamIyeEtZYUU4CmlNSWZIdXo1
-YzVOOE5RQzlnZ0xkSGd6U0RzRXRKMU0wQmRObWlXNHNEL1UKLT4gWDI1NTE5IFF0
-TmJVWmk0NnFwUENDQW8yTzh5NU9rR05nRHZqSXlBYzYvbDBLeTlLVXcKbGx4MXdF
-Y000SmQ4NUp2bHpVM2ZPdXJOSTAxL3JTSWpRRFpaMGlITTB0TQotPiA0XEZuLy1n
-cmVhc2UgQ3ZZRGFfeCB8YCA/NgppbWl0Um5Yd1NMQXdaSTh3R044ZkVxKy85SEE2
-Mm1CVU9ueUcKLS0tIEZ1dFQ3N2RtZzM4ODVIcWNia0thTnl4ZjBqaGhRR1ZTRlMz
-aEJXR2gvMGMK/HHYlBDS1LnyculvgtgW8Ln50cOjk68I+Y/Rn4i8jFJ1ieQInjYU
-2qselRZxrf2fb8FvDPEZNfKW2Bo9Y6PuOe+XKJyo1qHVS430Y29Dt5Pbd2+BNqoM
-9ujoTgq0FZNsXwt1wbb3WhmvRZfn7LLJDJxDLb7QFz09voXN90Q+INnsZqrZkzkI
-iJfLR4zahViXz6N73uy+b1JO6q1yncNtWQQFKbdVjerqiISMkeXZMXwIGVAxhOtm
-Q+E9oX2IpugnJ3pOq8HkCcMUjv/BGN8WxtvkBejnv4eYG4ck3rBrrJOJQghObvYO
-sErY5Nu6pexi0Af0NiT9MnZglLmzJDdFwCcdhvo5rwEX4WY567vntcgqPTa7dhUU
-MWk5R9cIGGB6xmPx8+eby7x3HbGE3BNtdG1LoDXdWsXnKQTpGQjeshO2LOityNii
-ZirniN6C8Pxl1P0Ffb1JvBmGE1adNpWmrtOk5Fxn+EGrC3QLfIXcv5cjhJiZ078y
-+4BUjplw61w2xBmb0zDJ65Dpb9ZavMgwgbcxAZRTgsPPyT41iYGhgDvtvYFz/rQj
-XIaEyAuG1RWRsZIKLyMBndYgkup6cYwDa8n36XRDH7rPjaYprREi2fKCn97Iw6NL
-7/pk3RawoQeHMBXBl4Z3C57LXeTIY281LbzjRlbk5wsVocSm40uqlj9ng6OXYnXT
-A35rvVX7T/I3xWW5Beb/WtFTibH+6r7w12+oviswiJQYBN3W/aQoR3CfDR7rvtbl
-Gv+bmdRckT8ifdyFHeDR8SoJqMnRMFj9usm6hMuP+MtOmalqdUDSHoR0bNdu25Z5
-qPAVsWwHVnE4YffthjKGv8xbTBPcLh4xsYtU7Zj8Sn8wPrUyRNEzwvgm3Vy24b+j
-X2nYROVuuiPhv1eL+oVHmW685ruTL0fLYqPlgtlu4kR2EUmXAczbbCidJjmk
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBmeEZ4
+NlhaTHVFY25BbTdUVThYVjFvb1dBdmUyRVJhclJEWXFSbklrakdvClorbnZ5V1pL
+Yi82Y2t4akI3UlNXbldnZ1l0TzNwcStFY3JXemVXaExpNk0KLT4gWDI1NTE5IGtv
+K0l3WHl5aXY2b1RySzJscnhZYnorb3BjNFM3WDhxN1RETVpZeTAwVWcKdHdSUjBL
+L2txS0VpNWVoM1BET25TRTNEYkpCK3VqTE5PZjhWakhacHkyOAotPiBfLWdyZWFz
+ZQpQNFNoZXYwSWtaV1pLUGJxWGM3Y3FyV3FkS202ZHZrU1lOSmRjTW56T091cXR0
+Y1MwZWQ4bHcKLS0tIEhkcG9DRitpWDl2VkpWM3YrbExWMVFrMGFqc3pjUVNmd1JK
+NDVCelNTeTQKbjaXilXK+ugzVQxDcvcMGTpZCWB56iGrsmjSpU2NHl4V5qu4ihuC
+urPKk+It7pkNW/0JREyrbNjs+z0O7AsTDTikDGU/rBX9qXumi3aJcqPMc6vXj9iv
+wuP9LmoA6Pq/ZFxzEd/duR0eOsQ1WXucKfp2ZfslPedx7hS29WbKJIg95Ar11UKk
+Ky4slBE1jUVu1QYsWMOz3SzBLOWZ83hMJauqFEPazezL7Du6HnzieKEDYr5Kxz3Z
+a649tOo+nvXQ2WiX4bXKXfEcLeCHz0QvYinLCYs5/aYtFake0KF/acGZSe5iLjO9
+w6CTzvhhnmIwzElQuX0FfwU5WzpM/ONs71AWIHQut/QV7mprcEFLYXun2GXH5+S3
+EOEh3uWw21rOHVfg9gYqdZazqkZU9IrEYvuOaVlW/dv7nk7MlB8cM0VYGzYYijX6
+UWP0fRMcZ+brNW7eRhxMRDmjtChjqtj4cURDTZYOciZTzTiCxVYLBGAs7xqWr3ZG
+mb+AE6M9kFSxsddjMxCrgPiOyu/cqazZmvvlfFAKqdog/U5DuSg3HxbglMQPAGlE
+m5J6nSoVOoNJvfO6xHpMJsEKee8ZEuXMKckaY3t56+MPk+fWugXJcj/X1FLKbIwQ
+FEQHNgIcriJ32egNpjHMxreRV7Zqy3TVcWrvdiURDLJ67WgSjdO8Rh+Nb4b7re4T
+F1YPhL8zlVekx0qX5/2qdpMVc072606rjt/Noj5NVbFiEynW5DzfUL7sy+t9TCyP
+NOnPw1r8bRT0tz8gnGb4arLC8FzNzuoyLMbebiYYoCXC6YffqfyezsBttt9gChGz
+dxhe1cAZuLAuHk/vvn3U9jF2i9lbnfyO5T4GRBfAg8tLo+yKRBbOfITFJxCYjavy
+siQZ3GxiQ9ismt7iTHzf4TRqONhbkPvOCeEObgokZlxzsqHb+AdIM9AJs1Pe
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/colony/borg-pass.txt.age
+++ b/secrets/colony/borg-pass.txt.age
@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBmM0lL
-VUVVTFU1Wm1JMU9UbFNNZ3VlelpWUVN6b01FM0ZnV1Voa1hJbUNjCjdnOFhWa3kz
-THorMksyV3VQUDh1SHRZTGE2QlBJNDlaNHprTUZrY2JselkKLT4gWDI1NTE5IHJM
-djlOTlM0dkZJVmJHTWJJdXBBQkR6Q1pjWll2ejdUUnFiMHpxVlhJUTAKY3R2WWZH
-c3F5eVpuaGdCaCsyYTZmN25TTmFXdURlNHJYTndsYjNQc2h4UQotPiBuKipSZGwt
-Z3JlYXNlClpKWTRWQVk5VThteDF0cVRnM0pBOWVpdDU3MUJmSkd4eldQdElmazZY
-NTNCejhHVlFWRGdYTCthVWdweGRHSVgKM3E4VHUzY1lhdEs5bFZSczlldkFqMnA3
-VTIvSGtickYKLS0tIFNnaWpFMVdFdHNyZjRSdmRNbEQ4YWxrckw2b0lxRmtRQzJl
-VWpvSnlPSkkKPew0Ns2erp0/bVVTBQSwBZmoKq9jeuhR4r3P4fQphYz8rmh0EQb+
-v9kXPVT0EyL7ZTR07VB0zG2qF7SQhIs1RW99nMo7yOlb5suWIdMcwpUxPdbk37uj
-p8tUKnspKQN1Sw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBzaWpR
+ZGs2STgxMDdueC9Tbm4vbkFyUXZyZVovMlo3ZnRlUFlrc2k0aW5jCkZteGs3V3hv
+UTFBRHV2cDFFc2Y1YlAvTUFUSGpyRzVjTDBkSTFJWHg4UVUKLT4gWDI1NTE5IGZu
+QVp2ZlBVQ2lmSDczN1Vrc21FUTZhK25MKzRDSkhjWW42ZVgvRHJTMGMKeUtJcklo
+SCtYTXd6cEtyUCtiekZxWmFmU1BzZW5CRlM4ZXN2dDlFbktmNAotPiAsJi1ncmVh
+c2UgLiJ7IDk0UT1nIC0yLE5GJSBqV00KT29zZ2psUi9PZ28wY3FLUTMraXJFV2Vy
+MnJkVEt2NnRyR3lPQndEQWJGRHptU0lKbE5tVHNoSDkzMXdLK3ZZWgozRUhCa044
+Zy9ReWxBaWVGWjE2U3U5V0RxUnNMSU9TSFgxSFpOVG5iK1B6bTFNQ3lHQQotLS0g
+WWlEWlREUUpVWmdaVHJLK0hIY3hvamNOS0lRL29TdUtHaHc2dmtZenlKOAowf9TV
+PYrbdDe1Blf3CYvHIRY5PC9CYk+fNwQi7dK6UtICrUW8UBnBiPy7FVPxAsH4MOTj
+LFlICTZ75+0MykDMGqjmzdnX4Nc59k0EqgvnxPURDQbdJZBuOeI/5eOMsZrC
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/dhparams.pem.age
+++ b/secrets/dhparams.pem.age
@ -1,25 +1,26 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBMMU8y
-dXBpMW54WTEzd2x2RHBwWkFTSFVka3Bnb2lKS1JHOHRWQUpiSFJnCjR0bTg0MTJG
-Y2NjRHEvbWZvOExyMEhqNHdSUjlsWWUzYk5FUnVkbStCODQKLT4gWDI1NTE5IEsr
-Z0IxWTdsRnhaT0V6ZFlBK1FhZ1hJaGlYL2dha1d1RytBMkNtblJjbjgKQW51Sm5C
-c1ozM216YmJFSDhnRVNhR3ZIUlZUcDBVcUMrdGYybzZ6U3E4ZwotPiB6I3xTLWdy
-ZWFzZQpmU1IwVVEKLS0tIFltcVhJYy81UmRDQ0N4R0lXR3FSOUhHWUd6andQd1RW
-bE40UGw5UzFqRVEK+asmnvJ8V8JaFjrotIXKaKPyU+Ugbhg45IGNfuoNmRzTmN83
-GXPZlQ/bn3RbDNb7/UNUpmt/tC4wFqxfeUi+OCR7NGtOOWU/WYuPVBGjogoMjEQI
-Dwgfm9yC9VEJLUS51cGkNyc1bORODa3GoCESJCKLJu54fgFlCZjnOox8Byn57HaL
-cTjiDEGCyX8nBNcV+vSr6rX6tTlGqm4Xm8fcmct1edhTBfmZ8o31pJXfa3Jnk68s
-Uw0B9NfbGtgZ7GuJZbRzsZ5H2wdbBeLeu6e7xC7ePaXXbeMnzKEfznU1gSydDRGl
-Ti06Me67V4SJCxOdCzeqLh3iUqr1KzLeXhrSjJ82F3lB+DtmYdWHjXQ1ncmPR2xr
-TX69Q+CwxpT5DeAp3YDDDV3IsrKrKqtkqvjVFj4j6SlxF4hqruy2OcxfhQvKOPu0
-W8otGmjMhjE8iK6yyd9n1WGn8HHu49joPm7thuLKce18FLfoPOlKU06kyyU0sCd4
-uDxs6Df6v6KJoX0L1DNXLd7mNlygtQrMPzfT6VkzQerQZUFdm6Gi/RWDbLi1Ofs1
-qGNLc3TVps9rLpjPnUlI/Kov98z+eOCSwGdr7/a9HIsg+7Fgwk+YgsxGK3LwBC9k
-fJcGekvkE4cr2wJsQs8iCy2mn+n0PBl0mIt0S+o9bBKcZSdwWqnBfvmFed+DIXfT
-B9JMSDu53B4boNptYqlNro0IARNCOYnC+rlUxlKDtYxIHXWAT5WaTRyGvvu9ELQK
-pjG7EjL9/t0nljSWUN4HPM9UmpgPgG8m3LJ5EZheprWrsCf3SpIRK4d3BAg11EY9
-PveqnDiXJZIsa9xBELXZratGx2o9N1ZcOHCNvY5e9yFXZ8yz+a79otHK4pJqCEi3
-fV0c4BABTNV9A/twuw3zd0a1deK+kxJd/KR5GKFA2ZanKN8KTnv1xjbisHH5r1GQ
-WXzRLmChJ0N38+YXQStV5OET8nrM3QNj1YGbAb4axqiB6u256tyJ9AlmS0XHMhhE
-g3YoGJ/J2Gxp4g7kMDt3ny7Cp1WpfvzSz7R4LixVSSGtZxHzUjMwoQwOg8GC
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyA2TWpU
+L2ViZDk2cytDcXVFSnFWM0lzaWFZZ09DL2x4Ymg5MVYrVGprTDA4ClVNc0U2eVVF
+cURSR0JoMFJuQnRxWU1tRDd5b0JtNjVzeS85ZTNUdkNNMkUKLT4gWDI1NTE5IFNO
+cUxiTUdoaG5YYkFZQTNVRmYvdjlaOXpLdkV5KzA3TzJuZ3o2SlRnbHcKSXpXS2JX
+Uk5ubDQraE1QbFRqYlJXbHNGYmZHTjhrRmNzM3BybkxFeHhkTQotPiB9dGtcRC1n
+cmVhc2UgOiJqRwpUaDVJCi0tLSBZMzA4R0VZTThRbitYaUZRQmt1bHZudFFGVXdK
+UVhySFlFc0ZKV252aGkwCqq3kRmldX71qj+xeF+0OlZ3k37BoxUk55+TivtjZrGS
+iYOeuwl2qXkyQ4JGGRKvqYsX/38wSDQce8noV7qv+2B3/s9Bv2623e5rXIw9Axx1
+E6a5XJEkHK3y7krORd63WVS01jaZ3Dn8rIIqIPWAtLTzzTTbvg/vtLtaB/DcMJ/v
+q3HQY2jBQp41db9mWpRvVMscrBilS1xoNiwPY7vxCpK3fRA51WrBZBV0uYZBKA1/
+3UiIOkGyUbBEittxeTx+CFRViYo0eQvhcKK9w4VPPUSU6DEE+nFfzS3VJ6WtN4lj
+ppWEZibjl0F7uPOXlwvcKkae8Lbsf6JrpGlolmBDjoeWB/3rW+4Wo45bthLqwe6
+DmdBa9Nawvq1sdfjqjyJYLig3q/UjF8azldRHSy8AEYBg1XCvyq0MnxRSQggut+L
+oN53dI/HlZYiVlZIKAECeGGQji9GEUzydKNAXBb8zyirrL7urv0AQT+gNPvemoiy
+emmXlx1fcOYt+En9hEOCYv6ZjAeWW0/b+y9avFMNWWhf53YvY3/AnQLwUXR6IuKp
+Kg0hrHFkbXcCkmizpGykiXE/GP+Y4/pecg3l4Eze8bJtCw46k9VE3rVIXbJworm9
+WZ8c5lmODC4wsjG3/c1NAoQd/Y9QSPv9ea51nocP9UF500kC22JUrr0EJY8gFSzu
+JIyumSBVQRfXtl1FNeyFWEopieO632LRSy808AiIHRQL18oo3Hdc3yLtqlaTVfAl
+898/pSIg8VQXkRM1gL6GOhYoUeZLAbx0ypjo6Ld5pZ97IXMsFShDQDwlxx3sBOZM
+iQDKKxT33aq83fTvbZHbiF/84Hg+cmJmE8y0+/b8x8A1Pull/OiHZ5BiCU+UW+/e
+rmvcCyL0kuZoo487tVYCZEmOEdKz71qG3aleMrKJc+ygEAURGOBIYWEBJFXhFOvK
+UEAEMJyXwEiuQDkLV1uBS+o/sEmltH5Xytr7isuaPgI4xoMIJMjuZfbtmXoJNlYp
+vepxqMLZNnYc6+Vg5TGg2OHu5BzKj/7eBGmNrRMp2XjpCWtyemB+cBTwUjM9jFvM
+qQ==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/kelder-wg.key.age
+++ b/secrets/estuary/kelder-wg.key.age
@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyB2dVJq
-ZmdZWnV2R2JUU1hPYnQ3ak4rTTFUamw0aG92L1pyenlZN0hDZVRFClV4UThWL3hr
-TGltOUNRc2FUZUdWUHRQNnZuK09BQ1RJR0gzaHZaOGFoV2sKLT4gWDI1NTE5IGYw
-TGFvMi8reDcwa1ZkVWFucmVHTG90dlVkUnY1VGdmdUh1UFVvNUFyRUUKcHZXWE1K
-Nk43NzV5djdkUFVZbGRwalhZYm84bUU5NEVJYzRTMmVPM0ROSQotPiBZZiMtZ3Jl
-YXNlIHYrIDwhaz53Xjcge1NpKm89IEQoPy8oLGUKOEsySnM0S1Y1ZGpReGRJU3ZL
-RHpiRGl0VlZERlJNczFVb3Y0WW5YanZaOAotLS0gZHhkNTZEUUI5OFBwdWtaVEYw
-Y3o1ak9DbG8vM1RSOGk1MzE0VUdxS2JHWQquguFjLOP0I+STSbo6YBmgPielDdT3
-0lvk4KTTx1HP2gjRBBFTS6cJ0HDCORpnWXIhoanj+MDPejWXj9sDPh1zhYKrWCB6
-ZbGE5Waphg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBvYXFt
+eWhuL1FkVW4vWnhmOWZlTUlVdTBML0ZzbjBqT1BvaEJYd2tpTFNBCkJzQ04vay95
+SzdHaDViMjZyMGNQZXJQZHJhem44NmxWWUFoOFdpVGlGaFUKLT4gWDI1NTE5IFpL
+TG9ia1NFY2Q4NmFQejUyeTlpdVhNelZYWXp0bkRzWEQ0T1puT1pMRm8KM0ZiRm11
+cFZsUE5ZeHRsNEtoU1FLM2tOanM4OE9LRHo3eTd5YlNYOUUxNAotPiBjLWdyZWFz
+ZSAiWXxiZEggUFB+Ij0/RSBrfiZtSG9gTgo3cVpYbjh4Z0xpTHhwcnFlRVJLK1lI
+OVhzeDdIcGcKLS0tIDRLNWZzOUN6R3ZPL1U1ajFkdGptMnlVMGJxUEtwVk5sZWlv
+TTUzcVY1UFEKBfX2d4c09v/4Yd7uFWc4YHzLvfEIRKEC9MERsZkSV3+N3HjYHleY
+oBN760QIpZEqxehG0xprLbylnEPBxi3KkNSFMHdQc6xjrrxgE8o=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/netdata/powerdns.conf.age
+++ b/secrets/estuary/netdata/powerdns.conf.age
@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA3SVBr
-Z21mRlFHYWI1ZzBlWDZZNElPRkt3SEJYdjFRenpSdzBwa0JRa1VjCjFxSFlxZ0tu
-UDJqMjVndnFmdkU4RDJIeTNKSTBkTDkyaFNQemFqdFpuNVEKLT4gWDI1NTE5IDFi
-elhGSkZDZDhCSUVOM2laSHFRbWMwemJOSmc2NnlwVkMvSkEwc0FKeDgKSC93SlUy
-bXI2WDk2eUhzNXJTdXhLNmdvcVovODF0R1NKQmljSXVPUkVTQQotPiA9QG1oV3Ut
-Z3JlYXNlIC4+QmJYL2JUIFdeQ2EgSm90CmMzTCtQRk8zRCtEdW92bWkxN1hxM0cx
-UDZsY2l0ejVhWHNvUjlzcjM1NkpZdUcxUTJBCi0tLSBCd0pyWnNUbVZMRWIzSlZS
-NlFEMWRlODJ2MlpYTnVpK1hwRzI5MlNCelhNCqId58s7hQmbS5bXu7cCO73Q9keD
-O+ibwZFC3WlySAT5+8VN0db9x1gbJ2hSzibFrW1mw3SGl4YUg/qcoD6zuIHcENlU
-BI2kwf3FfEyD+Pp9WS/8AQaMmfcspSR0+ww2GjRr9J0qjuLIFb3wf9/P3fDmn0lO
-rZZNqrhI/WuNTBVMC4gd1rH8whTsrZvqcnqOG3oKIdQ=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBHR29x
+dUIzQ3ZuUDBRdEloK200RTlJbk9ESUVoUWxUaFlEeStNNWZqbFdnCk04ZE1EcE1a
+cVJVTVNSUTNlQitwZndWc1pSSm05SmMvKzhDTGRzWlRNMVEKLT4gWDI1NTE5IEJm
+anNXblBqMzJWWndBZy9leUprNENudDZmMHY2czQvTktTMG10NVBPakUKZUo2SFVt
+NjFFbktPMnMzNUNqbEJQL245Vyt6UlBQdWFrZXVXL3RDazVtOAotPiB+LWdyZWFz
+ZSB5MENiQgpoTlRoaVBiaXNDYy9GQXdWUCtwNTlkTU8KLS0tIHF5elRDeGFoR09L
+OEJoSVJjYkFFUU5Nc1VoNVJQTFgyMzhoM3hXSTZzc3cKoJJ44bRdYWIJJ2ddK6+j
+Z0B+v7P6MarUL/3Me7j2WZh4bUAs2Z29OtEDh9tY0fVsKszs/Dvln9OHBp1gMxQg
+tQlIMh8QMCpOOn+Mgq7PwQPM7jcXv6RUT13vt+KTkZ9A8fhdwRVy+OCjdTwNTC//
+ahi6nPCADDtsmVJA1bXDHdE54nDcLZtzXmqfRrQ3HKAGXSPA9Q==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/netdata/powerdns_recursor.conf.age
+++ b/secrets/estuary/netdata/powerdns_recursor.conf.age
@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBvd0dX
-eFliZ1RETzNYdEdDcWt6MXYrZVd5YjU2RHFtQ2ZZejd2RXFXRVEwCklGTlExR0p3
-WlM0YzlCdG5HakdZbnM0K1ZjZWZDSk5mR1hlQUtITmJ3SmMKLT4gWDI1NTE5IG9I
-d2hZblJXamhPVGdMSmtldkJHcUJVT25wUDhnMW43Z2Y3UDFUa2w4VFEKbVNqNVNq
-eFhBTWR5ZGYzK2lKbzA1amdSbldua3NqT1VTYmhCTzNZYzZEWQotPiBQe0N0ZS1n
-cmVhc2Ugci46LH04fDQKY3FBVVZHclRsNTlDWVJ2emI4S29zT0hIZlB1VGFOcW5l
-U0gxcC9uRTlDMTBJNWg3eEFuUUh3Ci0tLSBQQVZsQjVkQmYrVkFkaHVBN01zUUx6
-NEtFNFhvcitoZ0dCN1hyakI4QW5FCrrD1/ZypY9SnHx17LAZbM1O+ARNj5+1RV0/
-DvhQw3xUcuJfSL1GX3D2daS0GllzCesBzBcvO5JCaoKatKPW1serrIE5l7sOkvFl
-gU79fJXnL50I6O8aXt5x5BjkKbmpZaiXPOaGCYxxkmGqV9K5Lc3qDQkCDOdCDvgB
-/V9S/LmpZKuojLUQP3E9WOombO5Y4RCbZEo=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBBVHhO
+ZCttQlpqSVBWcWprV0lqMjAzUnJWT2RidkJEazB1eGovaWNHNUJjCnJKRnpGN25h
+c3dIYURCekFnZTFvT2VqaXFoOStib2wxOXQrbzhrMnJXbXcKLT4gWDI1NTE5IEV3
+WXBKcHV6WkNnR01UTjV6WGtSVXFRUDRsMHd5MkJDODlhNFN0Y3dFVDAKaGpWWXNH
+V01jNlFUcXZMUWxNeVVRcGpjQ0w3eFhHT0d1em50YmFRdnc5NAotPiBDVD45LWdy
+ZWFzZSBOID53SXpXaSA1c3kge0xkIwpGZWdmSE9OOGg0UTJyT00KLS0tIHdzeU1s
+cjl1S29TRnNwVU9meEE0dG5xOTExVHViYVBMVXVNY2F5N1NJWm8K58iGhhV0S7UH
+9kJBKzxjVWTRoeT9Cio6Ar/XrgIQUN5VfMhcE/874Jna0BVFYMMpa7hQJt1xfEpM
+neho37pyShHBEke7q7/+IXBnwK73ZOYHvXCzV3kD+f/6HgFRqqu21ZkC4LgTL5XQ
+ygEQRMyLqUSZqGsXP/bxu1HH53OvTpXslxy8MqBBJwsUtUP4+wWjR27VrQ==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/auth.conf.age
+++ b/secrets/estuary/pdns/auth.conf.age
@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyAxNnNO
-ZzRnWnowaFFtanczNlBlaC9sbExHM2NvV1h4eUYxU3VKb1pncDJnCmg3bGFYK3FT
-WEJwbENGNzZEdmI1ZFlndHFYWHQvWERwYnY5bjNZVEk5TTAKLT4gWDI1NTE5IE5J
-UGhBdnNoVmFBY3hGQ1JSamY1TVhrR2hYS1k3V0hDWm56ckJRUWxKZ2sKbVpUWkhD
-RWxCdnJYcjdGcXNrc3dDMkpiK3lXTDgzeXk5SnVzVDZiZkZxRQotPiBlITI8LWdy
-ZWFzZSBYdGQ3IEswZyQ6CkJDQy8vZ0ZvSVFuaQotLS0gK3YvR2ZPU2VUZEozZnQr
-K09Ec0pBcHIzbzBJTkx5MXNSdW84Qk1EQ1VLOAoBdasYTVPfeZwtgHsopN3H4k6x
-skLR2110eG7Qk4GzGqHp5FBMyks6wm+r2UcGN8LooyjrhUkrTlJaSy/ExQP4etmn
-ETE998l3t4g=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBsWnZD
+aFErL3ZpdTlYTndKcUloTkppeFkyc005VCtlbERHYlQ2SEhvTlZZCkdhZlNzZ2RX
+V1lxZkNiU0dyZkppZUR4b0ZYelZnT2VuUmtNTkJXcU9VV2MKLT4gWDI1NTE5IENo
+cm1pMVY1cE93SnpDOHdUbmtVaS9vSUJTMFkzLzhMaDBzVXVXKzM3M3MKWjE1TWRJ
+TS9nSVpaVGhRZTB2MUp3eGJlQ2RuaEQ0a1lFOEFOY0s2a0JCdwotPiBNPTBXei1n
+cmVhc2UKcVBZY0JYVVcrU2FyQ2MyWE8zeUlLZmxGQXVnQURFeE0KLS0tIE5jMThD
+TlRuNHY3dTJzM25aMVArT3ZEMzVjSDYzeElzN3ZnQzdRNEtNT1EKEikrZE0LFFGW
+EIZrV5YkOS9AgV+yx+5jEaEx66QaACKXaPiizeT23w+mXpYdWG52b4uLMyrnx8Xf
+g1NNT8XKVRyl0ums5E2lqd+q
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/recursor.conf.age
+++ b/secrets/estuary/pdns/recursor.conf.age
@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBXeHdX
-UEtwaDlUcFZNQ2VqbmVabGJkSjFMZWVXRldIa3dZRHJvSzBobkdzCno0S05ncHUx
-VEllbzhIWWdCUnZVeDJNZHlUeDhxWUJ3b2I1a0htOTVrZGMKLT4gWDI1NTE5IHdT
-Q3F4ZC9BSG5UVEIvbkYxUWM2bGFabHhVMmZXaG03c1dzb0JGOHlHMkEKUjVFSlVC
-eCszTHEzT3pXRkl2dTV2Q0JhMFlMYWRpcmF1ckIvK2YrN3JnSQotPiA6cCp4cTUt
-Z3JlYXNlClpPZ1FVVnRwRkxkdXJOZmtpR3BRby9NZy9SdFdickRoaUZoUkxzdTcw
-RlZLCi0tLSBkRU1aaElGVVI4bkFUVE80b1IycWdPem5iWGxTMmQ0bmtvejI0WVFZ
-Nm1jCtKQ947hSJYpEnW3+MQklC4q0LE98+KPQzVQfRok6Qb9OCBnC7BoxOEunEyL
-K81ZGLinFZ5/15WYznRsfipfvbPt+VFTzNevMYPEPA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyB0bUtM
+OFo5V0ZGemU5YmNEQU85a05yK3hzMEUxRGFHSTJTRkFjVzN2OUdBClY0aXE5aGdu
+eWZ6RmU5ZGRlN0pSaW4xL05hWXUwc1htYy90WVhuMGZEYjgKLT4gWDI1NTE5IFd1
+NVVpaXNsZCtaSlZkTUN1b3NJT29CMFY5TVBRenlRTitUajhYOUlyVTQKbEJqbUVB
+TmhDMlZlNC9wcXN1c0kvZW1IWk51Uks5RUZzeHBGUGdHd1U1RQotPiByIig5P1JQ
+Yi1ncmVhc2UgfT8gfC0wIG1yJy1NXXx6Cm4vSVQ3UU9PRzgzMVNVTXZwbFpvdytr
+WU1DUXdmanVpTzNPWVJPTWRzWmI5OVBYbXJqWUJrSGxzM1EyS3p2ZEEKdlhza0hl
+bms5WG1Yamlab0dMRQotLS0gWXE2VmhWb1VhRG1BOVFUZTlhM2RGck9lZXRKV2hT
+R2Ztbk81RUFUanhHRQpWHjKGB9CwAWNId59nC4lFZKTXBbhsaCL9jwLJ6/uJoql2
+ovCiHzXI/xJZ7El07QrwPfb9Gy9hsFu8FPGGn2acfWc5f0javGj42Ds=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/hercules/aws-credentials.ini.age
+++ b/secrets/hercules/aws-credentials.ini.age
@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyBIU1d2
-TXFIN2xxMTZRdnM3YThWbEhMckYzdWVUaVRSeEl3eEZ4UTNucUFFCkJhZTltV09M
-V2FyOU1KZFcya2l0TEx2eG1nbFFleTFlTFkrbkpLdXZmaTAKLT4gWDI1NTE5IHlm
-bFg1d3QzK2l3WWZFSUdQU1JiMWc4QWdQVmRJWmh0QUxleGQ2bFBHM2sKQVhMNkRl
-SFY3Yyt2a3ozTmN5eUxGZmJSVGhJc0dhZUtBVXhBT2hieE9qawotPiAxMEo4Pl4w
-LWdyZWFzZSAiYElHKF0xIEljClpCTXFYV20yWE8rQ2t2K2w3Wmp4dUc4ZVVpRWxw
-UQotLS0gc0FLbUhHc0p6ZjRxTU91NnRiWlE5UVNPYmQ5aDJFeE1RRE5ZQ0ZldTdO
-cwqzygEUbViaBWccOe9YjMxbPgpg5+GfJh+rD0aGvmLpx/hBSNBIsLnUJrT1JLY2
-j7qCTMqthMKaevIXU9y0Auwxl0aJBKk71pblg0NvocZyK3w/IkV52UgIPJk/Cew1
-QPmPW/cXxo9b3uXl5QY0TaxQ3J/1ijLCrxndm6L/sTs/Zg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyA4SWQx
+WTNObTlOSUFLM3JGRFF2ZU5tcWlSWUlvWlZJci9jTDY2U3NKODFVCnppZ3YvZWpv
+NGtPYUlVbWVTMnhpVTE3am8zeTUvTkQzRjAvWXhkYjZFMWsKLT4gWDI1NTE5IDVO
+OFdtSmJPeXVXdU9jRXV6YzZmNmcwNHB0MHZaZmxwS2JxY0FkZnQ0bU0KU3BZS0dY
+RDZFVllFakJWZ0Jybzk4Z002d0hxMTI3V2ZuOHJLc2NrT1RYMAotPiA5W1pIRSUt
+Z3JlYXNlIHNwISBUX1deOFBTUCBjbT4KdzhyUFlXZEt3WDZtQW1kb1YycEg0QmQ2
+ZG9HSUhJZktGcUFUSncwcFY2ZDdBWUpHUmcKLS0tIGxjZEs2bENPMWkrWGk0Um5R
+Q3k0MStYbW9uMzZHMWZqMHRGWWdPSXFlUW8KibwES+E438c36xJmpLnpHvGOCBS/
+Y0X/DmzG12N4iziRH2aVGTx60nybA+YrnL6SPiLJ3EF8i/g4BFGJFdP1q5qTzujr
+m9yNW0c9Ee5aeGUBV6YfutL5aNEi62Mb4m+wZnSqFI51R7hGY9iZGUYlxpaZuN3t
+GZ1PhL4tTfXwe74=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/hercules/binary-caches.json.age
+++ b/secrets/hercules/binary-caches.json.age
@ -1,20 +1,19 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyBHVXY0
-NUQrUVc2emVnenkwV1U3YlNnbXQ5TUxjRStjL05SQ2tvZHdXUkMwCmE2MTdXRGVL
-VXBjRmI2NzVuY0gxaWxwVVEwUXNKaXFqWDBvTDlEN0UxV0EKLT4gWDI1NTE5IHFD
-NVlITGx2VEpoK3IxTFJvK2Z4Wm5oU2pHOHR6ZmJaWlVSQmRML1QzVm8KSVJFYlM4
-ZVF1RE0xWUhNSEhRNCtmNzgxS1RaSWsyZ0tJcC83WlF5MHFpdwotPiBmVCdaLWdy
-ZWFzZSBFUyswdmwpIHogck98IGRdRyY4ClZoSVUxc3haQ25tcGxmcEJwNjZyMnYv
-K09yb3dxR0dIYlJvTEV5MUZSb0hUSFN4MUEwa2F1VlpNdlZHSGtWaSsKSE9PcWd6
-M1dxQzcxWDJJOThrS3RhRWNHaVhMRAotLS0gdytoMlJxSm9SV1NSRHVBamk1ejR0
-YVd6R3BkbUxCS1VsSVZQNXVSRWtQTQrDyp5DiePx9CEGn/j3rBJm3EZIX8XEupi8
-onHzWrWJVz/NnLCjSgaRDqQ8Z374XgWxcQRTThaXhoZyOD3q8b8CLYYp6VbQVKpM
-VlrqxozdMA6ZgcTqQkAjAeo1HdfNxx0oG9NqwnyjWe4OkmcjPKN5lmdkBHuvgfBO
-dBA54tCGWzNDNomO+O6THDYss+3DeUE4TsGVxOcf1jZci1ewI5K1bYg5gCRTuvKI
-cMyaNulCI3s7bNtGlg9C/0MOLSOxpJtwMeBHRoqaZ05qgUD33KVMM4VeRa9hZf5O
-eV6kvIbdR+5M+aRYz4tooc4pl0JtOcmJ0QwIdZW8rDses+y2QjOheU60DLhD4nAn
-o0jxmJeWr+AWHh+YUNhXPjeLYJFTNNM/1Qjmyx7s60wRW65SzlZ/HO5idshBrzaO
-5syld+4QnwigEbS08aykQoNCKIrIhpxqn/szMnCVbPbk995DTtrHA+tRVRQ0GcTf
-YuEefp5jp1XT0H2zpxyNsm83GaMwith8YEDUO6At+IV67amjCYZRhNlnJMxWiSVS
-4ZNKWtYcJvt+V15oooHCawZMN/3Zm2+h8cA=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyBNTzEr
+WjN1NnhsWk1YTWE2a1VvVWd6TTZtZnhPMkFEdm9qZ1duQWI3TUhJCk9ISFBvWlhZ
+czdRaVpzdzdWQTFnUDZNQ2szNnc1TzB1QjY4aFdxa0RyajAKLT4gWDI1NTE5IFdV
+ZlFoYVNyUFZUWXJ0SG5DaUlIVDNudjFRZmxnSzR6T1BKNWZSaHY1U1UKVC83dzZu
+d2w2K1YzaXVVM0dycXA1a0h5L3BSc1dEVGhLY3l1WmQwS0NIawotPiBVeWxJUnlk
+bC1ncmVhc2UgQDZhWCUyfTsgfSM+SHlEV0cgPEc5fDF0CjZHQTdNRHUvZnpRZCta
+aU14b3RUMXlrcEFiQlhuZ3V4TUY2UTNyNGRwUlhQZzZvSDRNZDc4ZHZ3ZXcKLS0t
+IDBldzhiMHU0SFhialU1NFZ5UmN0L0JYSTQyLzlZRlRpaXJReFhqeUx2RFUKhLkh
+uo+iBm0vk40kVIXUNS2Mfcgud7OqjeZ3IjeL4b3zCn2K4Rxr2ZG6P0jUtOMoyr7S
+mZe+esqUVAbJNSqc0nzfO3Un8xqcVDoJHarLux8jKq+Bz1ukOVSptsQ176cj7Mdo
+31LGpmVkmuRTmvAgRyiFtNaJjLHktc03H2+rPfAeqDSI+q402Q+BebouLVP4MtBO
+uyfFnr/PxLgCr0uyCnJhYruFydZdDKNV1JOYufbWY11bRic1NfNDSChAaSuUqUWH
+LehSeJneox+jYPfkFGRQKdmPR/XJE1+SiB1W2UBffgcVsDIQ+VLCd96b7jXz9Kcf
+GEa1JZsW1s2Jj+Dl9wot27CBcf0tL7iCk0t8eJl1NUGY6qKzOqlczJFzkHu2lHit
+9QuPWgWHkNBJviT3sYPCyqBBoLRPSCcBE4XflCclYBud6B3KMzxzSLf2bu1pbLwj
+it5+J7adICTYq1BiEKOrBLHYtvxpwxQN70nTIPQG/wqrXSZYF380+xlLDBj7jrPs
+tYDn3wKJpYcvOH/EaTCv4+lY0nc2ud9hCseOCyYbdl2NAI4co4CtNI6Y6A5mDUXI
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/hercules/cluster-join-token.key.age
+++ b/secrets/hercules/cluster-join-token.key.age
@ -1,16 +1,17 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyBhNlZ2
-SUt4SHEvbWFlSEpUeUNNWGppZGgwalFTNGVxWHZNTXhCaFBTdWpNClkvc3YyeUtF
-ZHlBRGs0Y3piT1ZiRnozV0IxUWJIZjlvYnNreDRjNk1pdUUKLT4gWDI1NTE5IHhI
-b0FoZHg2Q2x5anN2eU5EMmRVdEdwcVBPcTVjUzJKem1CQUMzTUxhaUEKNXE3aVJv
-Ykx4Z1dQUnh4czEwaDNYUWRmL2o2OTJEN2E1MW9tTHM3OFN6SQotPiBlQ2dQLWdy
-ZWFzZQo1Y3dqODk0QVBBMXZmWGV3cXlkNFlWQ0FxQnlpTFJvS01NNVhXbFlpTEJX
-UzJZOXpyTlB3QktrOWlxQmhFSDQzCm5DK2pCUGM1K0pkMVprMTE4eURmeVUrVXJS
-RmZhaTU5R0xRCi0tLSBUVVFyUzVURFhJYWFvN0k2SkpyL3pEWFFJUXQwMUpPQW9t
-WXB3TzM1QzFvCj+68U+OQa7E6gyKk++zWLEYtGf0j2I2hGZWAkQBvL3gwiWn0dh0
-S0sZQn1aoNusnIKEHM5SqQGhZhQowVkIfDLbioL3pXcoKrGFfDtDb/QHTUeD3A5X
-BC3eeGmcSlCEQSrw3rTGEkzjj3PK933PEADq4t8ecnS6UAqN9T/PLGP1F19W+9pJ
-dQi+tE/cBnk+LfWDVV9wHLbNErdCDamGiZDo927n46ejxo5bkbK0FIzqf7dXeW5Y
-3gAS8gGA7L2uQctEd5GtHIM+VtDyyntqR64cGwQ+nFNRqaNlilAyqhaUFL7X1tLq
-55gpk/X9JWi+zaFn/j0KuhNhdAb6m2BcLexoVFPVe29XteaXxFw=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyBia29N
+MmY5ZmxieWZ4VnFuN2VOZmExSkRRT1NLN0dqU0I4R3VKbGxVQUc0ClNVSEZ0UFMz
+UFFBMkZ2MnN4anoxNDJjRUZMeFVHUXpMRUs1NzFDRU5DRGcKLT4gWDI1NTE5IFJy
+SlZXTmxTTlBjY0RFZlp2MGR0NTd1c0xOU2F1UEkwM3pkR29CSVJKVWcKaFpXTEVI
+VG9BeGVoZG9uOWYxajNRWTVBOGYrU1h4OXYzRUZURHA1N0dSbwotPiAsI09jNTkt
+Z3JlYXNlIE8zbElDfTkgY25sXWp+MApmSkVsbDhXSmtUaDBIb1dxa0c5VEttNHI5
+VldIVDFON3AvRHRNcDhCL2E4K3ZXeWZicXRKTWJkY3d0Slp4WjBxCndMWGdmaXFB
+RWxVMXBBTnVCdi9xaEE2cnNrNGIrUm8rS1lCdGIwN3RpaFVrQnJIK1BuQQotLS0g
+RjJOb1RmOVhlSGQ4eU1lY2FHSzZIS01DY05ZOGVwK1BiakNXcWVFbWFSUQo3TNUg
+K3vD0DtZ8FQdrRAXobC7hVDe5AJXq9pDpHNizqPNRP3gbcznzkReHmFP+jFTVANz
+BFgNMb/HSX9ffI2s4AHIrBF/7576v90jNpK7gKPmaiv6gR9vZnxGBZphD2l43CDl
+q8/jygfQdTqFWw2ZberBaSOHmza8vgxhejE0cJXG1yakWP10hMcKyMKrnofNpjJB
+hrOTdknfS3JAZ16XYI8L1l1jgkUwL6z5+io/uoC3mHq38LimktzBVWEnG4sV9I2w
+tFzQV20hLyHm3y+FOL4ktrqrA3V+K4PNIigOtu5q7sGgzyEOexeT9nI7eEFC7AyK
+i1zuJPsMkjTw9v7bZOoW0ywgQnlaHHeE
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/mullvad-privkey.age
+++ b/secrets/jackflix/mullvad-privkey.age
@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBrcDVq
-TmlLZUE2UjVuMGxuOHk5TzBYZ3E4VTVkOGxTdWFsMWdiYnRHd3dvCnZ5eGRDOFRJ
-alNYVzh4ODE1U3pTcGp5SXRTZHhSTkhyUER5aVVXdXlBdGcKLT4gWDI1NTE5IFFw
-Z3JuUjlUai9iNVJCSVpsZ2ZydGxFaWJuMUVDRXdqUDMrVU8ybXNrU3cKT255eTFI
-akFPbXFLUUQ3Q1IxNEt3VXJjT3h2V1N3ZXh5Y3IyaDZSY1RpQQotPiB5LWdyZWFz
-ZSBvClV3dE9IRUdLUjAwYTRZUG4zZDFGV2hCVDFzMktWcUhGcFFkUytmdzIzQkp2
-dWRBZDFCNElxT2tLME5QSzNzK0MKRXdSSXdjaE9NR29lRDlHZklIYndWV3R4OEEK
-LS0tIGQzZFJUU29uTzVJaXRxN0JRb3VvYlpCVUp1a2kxWTduakVuMVVQdk9JbG8K
-3nIS+gMmkGGeweE4hBDsb/MkY3T8pJd9OPM4dabMO+hhlEaKG+N1pHz/vdcYrhLV
-KqNRqmocVdVNcXzJwY/L/ypVQXfabQ15lFx1VAY=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyAyWVJI
+MWM4bmx6NE5adk9kRUtZUnl4R29BSnVOZUlVbllDM01EaUdnMTE4CnhRcVFFRllO
+U1JCb3NvRmlPZ2Y1R00rMS9xblgrMnBNdkExSVRJcURGNTgKLT4gWDI1NTE5IEhD
+T1RzaWtkWjZIaXpUZzNHZU1INWgvV1RuajlXQ2MvSFJJZm9oY3RSWEkKbGw1VlR1
+L0hBTlZBVk9HS2s3cFNKUGJZOFUwUFd1Um9vY1RiMXdhZUVHMAotPiBTLWdyZWFz
+ZQpEb01nbjhIWnVUYTB0QmRtZUIwT0VYcVRQK1ovc1Z3SCtucnZpWlE0WTRpNmN0
+WkZmdFZUNE5mKzY1SElmOTRsCncvMUhQc3J2RW1QbjBrVE5USDZYaVUvRjhlNGxT
+bDAzbk9QOE9RTXpaeDZCQ3cKLS0tICs4YjhVemhjVXpUbUsrTmM1RWJjOFl1YjFS
+MmdoMTUrZlpyTzVOcHcyUWsKlctqS5EB9vl76mVXiu34BNCV9kv6ujOZ+a2RPXoH
+eNA/MMjUNaZBGBefKSkQQ+4ib8cZ+drapnUOGC6citpFEJCV/QHpVKfp/tm+ECE=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/acquisition/mullvad-privkey.age
+++ b/secrets/kelder/acquisition/mullvad-privkey.age
@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSA2VGVE
+WUZaczJDVllpR0RUREVwdTcvSUQ4ZU44RUpUOFdDMUJHb3k0YWlJCmxwQmxabDB4
+VlRHcGdpaU9TVnU2Yk1BOTh6bVdZQmNHMFhZWjgvWDRTeGsKLT4gWDI1NTE5IFBB
+ODJRaHF6YkFhYXBBTHRvbUVzUUR5MlMzcFhqNWNiTXhoUmcwRFl1QWsKcU1YVm8y
+N1BMWXU5M09IV2tFcUNBaTc1dlgvRHBZREFVYktXZkE2VDcxOAotPiBALWdyZWFz
+ZSAsXjtweApBTzl0S3EzYkVPS0dBQTE3dmRjRkZJUWlTTzNud3N6TC9iMlJmZW5L
+cDd3WXNNazgzQnpVaUJBdy9EWWNEanMKLS0tIGpXdXFTR2svSXgwZ0ZkYTRZdWhD
+MU5QYjBjT2MvWXVXUXRmUURDZHNJWkUKAp2RHgrTk9CXeftTqUCSbWeQPdPWhwcI
+hbpqT3bmmtlrgnd5wMw6D+3N6OAuxWPmlIboDPHxE7oGBo5TYnfkytoblvAPKsSI
+kS/Vkhg=
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/estuary-wg.key.age
+++ b/secrets/kelder/estuary-wg.key.age
@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyA1Skpw
-c2FiaFBFTzcydXFIN25yRFlKeDk1UkQydWdkaWJTVUJhRHVQd1dJCjN2RkN5ZDBD
-RllGWkk2VEZYRDFUMXF6STFQRVVCRTA0UnAzTk5tc0NWT1kKLT4gWDI1NTE5IDVi
-MVl4VFVxeVhFaUkrV1RqaDk5Q2ZSdDFUTTI3V3J4aS93RzVDOVU1MlkKMXcwMFc1
-RlA0N09UT0daMjRmbTNnbnBPc2JRNXQzNzY0TTJUcEpmdUFRawotPiBNN3s0YC1n
-cmVhc2UgKyh3NSdNIEhndz13UF48IH1WREpwIFdmJgpYSDJEUWNtUEl6L0h4OXJI
-OTdJTjJEdjBLQzdCVUVheit5OTc5T3Rsb3ZTTFlnQ3RiMVg0L1pyT3FtSE1mRW5z
-Ck1nZUhFYncKLS0tIEJHYVFoVXVTamEzYXlDTlY3dy84ZGxobm5PcytNMzJjTWlv
-eTVuUEduRGMK7gE8vk0dwaoaVoDEjLej2eKtqOMcU7lYUOVtAgHC+YLvgaC5YB1y
-3Q5cWVkA4StDI7wgPp58+jEM+7VzwdOhqgsGhdX2qehd20GKTOQ=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyBSeXRJ
+UmV4S0FTM1VGU2k5cmhPbHFUT1dGdFNTM2FLbEx2SmNMSkl3YXp3CkloV1F5RTJl
+dTVUUEcrZ1I0Y3pVQlgvM0laYlpORUlEcjlVY2RzUXZRbzgKLT4gWDI1NTE5IDdO
+VDgwN3poeHlUSlZKR1NzTk1jbEhiL3lzV1NMdnp6cjNLK0ZvbW95V0kKOHlvaktR
+WXBIV3ptbm1tS1FSQWpDNHNmRVJKQ0ZVS1RXVHc2M1dGaTYyYwotPiAxM3N8flci
+XC1ncmVhc2UgVUkqdSBnbCZWNW0iCnFyKzBEcUFxWjBNOTJNKzB2YlFHbXdITG5n
+OE41M1dYMnJ5YndoR1RPTWR6VDlRd3ZMVVduVzV0S3kvZWxkdXYKWjY1Qkl0UFJ6
+RWVtOUlsdDBmdnBCWW5kTU51TVE5QnFxbTE4bXFYckR3UW5xWG1IWVhtQm5CUnc4
+aE0KLS0tIDJ0WExrbEM5VDN0YzYzUXdFL2h3bjNnZzlLYWpNQ2VwTlh5M0w3U3Vk
+V0kK48BtL7/ajg4PifGBpBFGbYryt3dfGddqSLwT6E+rCdQ5xFyIuCWXK8u0RUaX
+jipdtRSfqXe+QphKnvBWjFS944NZ9Jo1z94TNVxh4LU=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/htpasswd.age
+++ b/secrets/kelder/htpasswd.age
@ -0,0 +1,14 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyBZOW5M
+TnQ2NWEyUWdMY3V4T3k2RnhpN2NRV0NDd1c3dlNHVjNac29mVEVRCnc5Z2FsZzJB
+djh1ajhidERJcWFNSjJOS2ZFZ0xaL29xeHB6UGVHanZ4YXcKLT4gWDI1NTE5IFJl
+c0dtYmk1L0ZXT083TlB1MnQwMnlKaXdFZ1JvcnFYT2RHMFhOcGVOa1kKREkxVkFm
+dERTOUVrSWZqdkdleXhINVU0MGlGZUtqWm0zM3p3YzhaWXFwSQotPiAsOmw7Z1xj
+KC1ncmVhc2UgLG9fIHdKOGxkcUczClhqaDI2OWFMbUJmWWxPV1A5Nk9nb1JvVHhl
+dzZwcGlEbVpPamZpMDFPR0ZMd09EeVNGOXd6UFRNc2RRM3k5Y2oKaXE0WVpEZUxk
+ZDlkQ3BvZDJ1dG5tVExFbXJkYzdFRHBDYUtKCi0tLSBSRWF6N3EzWWJyZGtzRHBP
+NWtYZ2NIci93V0RTakxWZWZKKzJTQlN6OWdzCqtZKtTsduPF58pP9XWpiEtJizHF
+diAG/x9bJdE6kkbRcpcV320jqE4HAbl5MR0BmH5Nmt3k1ch+umwwNmqO8Fvqft90
+eX0Ua+VP+DHyRJ5H0KRCxIZ4Fff86PVpp/1jV5RRKxH4lFgAdWeqTQJcvFZy4Ttt
+yoyf
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/middleman/cloudflare-credentials.conf.age
+++ b/secrets/middleman/cloudflare-credentials.conf.age
@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBtUktO
-Z0ZVRWU4b2JFTWZSTjZwOXRDdzdyNXJUZzl5d2VPaHdkYmUvaEc0CmxNY2dPdHgr
-SFdVSytOdVp4QmJSMWJKQThnTTcySWxzOWpMNENCWG16N0UKLT4gWDI1NTE5IFhk
-aVF1Q3dYbnJ4MndFSTVMUHZERlo2a1ZWSUxPK2JaZWszak94ODcxUXcKTG5Gck1D
-Wk1DWkRrZEgyaEdXdFMxdTlSbTQzMXo4UVZzaEt0aURCZ3duNAotPiB5SWlpU3I5
-LWdyZWFzZSBWIGwuLDsvZHsuIHx0UyZfaXN+CkRac0pJRndaRHEwCi0tLSBLWDYv
-dDAybUhJenJPY1JoWEFwTTdRVFN2ZHVadGRrOHdWWGJMSkNxdmZZCu1Pv6KZYWsG
-VWGC1fSh2wPcz36whO7nbVVcWtoTr1sr5iMucr98MFYxbgJwldbtYcsNlz7ZcLQS
-TPPiYfDjpZkkjccEjc6bm/0J9oIHpeNQndgCZbEgdJt2gkN0t3OQGJSZ8qiXYQq8
-a21215+Sp3qC2NmLHq0JfuWqEVCEj8aohlp3bsJrVzmnP8HGFe9Y5EQbOhpF/guC
-KNp/U7NgeoC93niUsXXuv4vEQgTzQN46kCRGMmZ3FHGn87frvYybi7XmcI4bZ4t8
-WccIEkW8XBaprgTV0Q0Xk9PJEWSI+Q8eX1XefjwHNJtLVU017thDZlBac0Qudw4u
-q7WPXem+vgG1NCZfRLiLwxtopJCkDGU=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBRdlVG
+dVdFb2FFb3dKamhGaXN0L3ZEZHI5YjJDenEyU0JBL1JlWGg3SGhNCld2QmIvN2VO
+dHRiQUVNVTRtRW9FbnBuVTgyK3MwZEw3Zzd0SExoWGNiWW8KLT4gWDI1NTE5IDFQ
+TG1qMG5mcW5RSGFoeHdFOVBCQTZ2TWFFYTRTRzFlRjEzc3RJZlBld2sKdGpsSHpT
+eUlUQlJjYmMzSjJCaWd0S1BpVk5wVmI1Y3d4UEwwUXZoQjUvSQotPiAtcndTby1n
+cmVhc2UgNF88Q1RJCm5objlDQ3UxNFp1OAotLS0gVWhDTVc5RDJXYUxGL2ZhTWZQ
+L0UrUDZVdXE0VlYxTmM4UWloVFRhLzBVVQpfSffTSZbAAfIZGbp3ddfFRcgj9UKX
+Gxyf4ESAvIIBw0IisaswD/K4tu/IU7fyhHDOqFeInjgKHbGdaBdsyXydRQe0dYAD
+AnwvAwU8Uizei+ntjc9lgPiJ6Rp4ANnCQCwgGdUIA9RZ/N4rQH6FIIfAuLg3IXr+
+OJasz5IqU77vcCuqbAG7qbEpLfKgDtxxwPvWa6gUnUZRdMjMpmO7TBH/fCd/lMWV
+2gDEIahpZhULh9U3dL0qmO1iflDHHCFF0Kr9r5H5tqxWcrfo1VmkbIVBbWKq5FnX
+8UzdE4powJAMExvp6P7+KNz8IfQSBBQGSP8KC5c23p0bnSMvczzCXHFS+iY+lLzd
+N6KhGQ8fvHcu
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/middleman/nginx-sso.yaml.age
+++ b/secrets/middleman/nginx-sso.yaml.age
@ -1,20 +1,21 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBxNXN1
-OWFhMFV0ZUl3TWtwVk94bHE5emgyWXo1TnJ0bUpTREZPa0VlU2dNCmVaRnIyYWRV
-TEtXZDU0T0hkWVpDVTgrR1hVdVZNS2x6U3ZFL0RtUkMybEUKLT4gWDI1NTE5IDdG
-QTk4RXFIS2VxTUc3bEluYkNib2NKc2lzcVEwZGFCd0pYcWNjY09nejgKeXczaVpP
-a0tVaG1YMzJ4ZmR6NjIxVDIrVVVVWXdXajVjTExCUVdVMzVlYwotPiBuZy1ncmVh
-c2UKamttRzRTUlJCUGVsd2tUdGd1R1o4cjdsOGZFQlBxUFYyeGZtaGZTVklUbDhl
-NGR6Z1l1SXErWThSNlc4MUxZRAoKLS0tIDQrdkRaeHE1WnZlRTJxaGFvSTdNc2Q3
-N2l0N00rZERIUmJYb1hZL0N0Q1kKDlnITQhuf9wOE4z3IeanlcZf6XZDxgERLpWn
-Y15uEh6Oz8xVJeECZ11OUvWAotaro8FNyG0Q8HizxDvr+FC6cUAhJsGwO2WM7FLr
-mU2gYo+ai1dXcxI3ELJF2MLWtMUPZrugsa8+eF5vjJJN4Oz602ohpr+iyNHPywKS
-ZjxwvJ7QC8eBrWZVFuFc0XFf1uEq9csIQD7aUmlE+9WM+qLW4fyeLr+CS9Q9CUfB
-1sdqWQbpZ81tx+u3LVsJ9pDsqGWKjBLTr1KZMRAc6XhPTRc0qOHz5FLtUvsMmBvv
-z59bM2j6BK+woZazzYgY3nxeRWUlfqHgZHgfU2TxHUar0FKoE25e/ie/2RVW0/UJ
-+bf2SNEh3yRNIiwwXDRsp6gaerjimFZND9isq0jZSfqYoIDwJN2dSd+I5Vz4AIH1
-kPBQXpGNabguobmBXSq779UXnctWBfpTkcXIMP8Rp5roi6jCJtrrfrGA3gAN0ezK
-ud7YL+zXmhEZvgvfMaKjWhH3VEfXFAuYgCvaor+kA2N34xVzktOn5BSWWVwcFRQo
-HJKRoEJf/z1COGRhrMAV6LomU/n06Lyyc4mouCAz5fkVTf+wTg1gZj+E3ASDkhaE
-IsTmh/FIUv5N8U4I5mmG4EiiC/g/Rt6aAhK9YRbb1gIUgletyoyKiosbEXQx
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBYUnN1
+NDJyaVBGWGlNMEhqblVDTHdyUC9RYUlMQW55TnRxNUhjNEVIR0ZrClppVFZZaEk2
+TnBwb2xBUnAzZDg5UnEyaHNnT2NCSDRiVUh2MmM4dGNjKzAKLT4gWDI1NTE5IDBR
+b0MxQVdoMmRWaGU4RXRBZG5zNGkrRVdDUDBhYjUrT1RVMFlqK1pyMUkKdG1IQTJG
+ZjY5amdCdWl3VWVIdGdEME5XSFVHOXVFbnBkTHdGSWFYRDYyVQotPiBAKy5aREJS
+JS1ncmVhc2UgWFkleTEKaXhCZjhhZUtjazRXenhpREF6MzFnVnhOcGE3QW1NRkdy
+amZOZmcyTE41SjNRbzhza1dKcXdMZEVQbVF2M2s3NQppVFdXZW5Jc0sxWktzdzNv
+Ujl4anRxanlvWEtOS2FXSXRsRQotLS0gNy9IbEZta0wxWW9XdUd4dEN5UXFXc1ZQ
+NGFUQm1Xa1FlVzRVU0dMV2VZSQqpku4VkYjnF4JMYU98yq8kqbIE8N7lA4r5ThaT
+YCQ8IHvBIVvM9Pb/vCSA/mOT2XMyJ+ND6BCGsmq7UE8dgWaTDmW6KKKLp0JmkKqT
+7zj6crVxrsSO/XeXlg7W/wVRpIq1OjGOh90k+p6MHaGaryRy6flORHuyiRUVl6Yu
+tmG6asPD4yT0k4ptzGYB53XZfE2MyWtJDGER8q1JlzULLSBqMvO5JQVxIzWu/O4K
+rpQIbN1m3uHJjfsRqyaKDsOuEKFXSwvUx+9M5wczMBA/SmXuDiUwRFMowWFRKJim
+pE6vMvJw1SiFOl+qz5e3+7mBxltNsgL8hMAZFW1aNEx1TjB3Ktrln0cMvwH3qG1v
+O1KoDh1VMjH3yXpxD0vgYIQtX8c8DMBx4vs0QUgs06DRUfy4ZRH4MeU6oVIxtzZm
+0Lh6FFlzGQMmllLAmB4R/S+ZzTgQlja9YpqsHkifgI0A6tFHL57kt3U/bdn9/oz8
+V0yv9h3EgwwFEZtrBANKmNryO3or0p9O26IMKr1PKao/zdo3Cf9GZZ2NT+JUOT2e
+Bkjm1HHrKOj/+oeluSTuOVMv4zZfwFVgB3LfWUju9iSv5mFCcnlK8gCojkehtSfT
+5wPuXyTWmUiacsgOtmA2A1WXICnk/9ckahCOtfg1VakQK0Qp51FzelaivXk=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/nix-cache-gc.ini.age
+++ b/secrets/nix-cache-gc.ini.age
@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyBENkVu
-NHhlUXI3N3IyQUN3N0hRVHBiNklvc2dGTFNMa0xRencvY3pIcEhBCkhtTktnM3VM
-dVNQZExIQjBQTzBtWGdyUGw1b2FlQXNTS0M0YjhrRXQzdEUKLT4gWDI1NTE5IEZV
-OFV2OXI0WGpybTgxYWwwRStCMjVLdlkwS25tUXZrdCtDT3o1c2tEZ2sKdDBTOWFD
-RFA3c0F4VmlVV0h1UjJVNXJzbnFlSU9RR1RnQkU0U1k1ZzI5YwotPiBbVSgvfSkt
-Z3JlYXNlIENhUGBdVDUKRDI5bFVxR0xOZ3B5cncrMjhsYWkxdnhqY2k4eUgxawot
-LS0gUkpyYjJ2WXlTeHd1a2lucHp3MU9Xa3hWRVcxS0xkK2tSTWt5ZkY5UU1lRQpR
-L1PDozt0iIzWzDq1Qs3By8zk4ltIb7mqWraA8iqIWKECXFyLsLaSCn8gdak5b7iY
-neGiBqVkyOHwDX6bOSRrC2PgowkCOR801/N2/tQ7oy7hCOgiLMtIaL9Y
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyBYbzVv
+eTZucHpHbnMzUXVxUCt4R3VlVmt6c3VMZGlWdVJjSW9pbnBLWHl3CmxRRUJ4cXdE
+eXJyM3QrZ202c3VMa1h4RVVwT3JreXU0UjJlTW1RakxvOE0KLT4gWDI1NTE5IC9m
+SWdJczZPRFowejFQMm9hUk50bDl3YVNORmxwK3c5eTRXcHRTcUxSR28KbmVFT084
+UnpWY1U3Vitid0xmaTNCQXEvL2R3WTV1SUxQN0loOUhXdUQ1UQotPiBvWnYxcTEo
+LWdyZWFzZSAvCgotLS0ga0U0T1c2bWYzdVdoU3FvRFBiVVo2cTQvRkNlc25uZDlM
+Q3hZWkYyNXVjUQr9W48C2szCN39IOF8I5LNSH330AGnZByr+1guZm6FxGNzQPMuX
+jIbZHOBYRhqZON1TvI4jR2/Yvtn5CKKSosdPmIl2O5qPCQxYV9/vv/xGyuURX/aL
+WgIZBxfU
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/object/minio-client-config.json.age
+++ b/secrets/object/minio-client-config.json.age
@ -1,16 +1,17 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBscEln
-NEpBWkNici9jVEtBa2ZYLzFuOWpmODhtbk1nRGQwMWh4UHJHb2s0CnVCR2wvb3Zw
-eFNaTXVkVjhaakxpVjNsYitsT0ZURHRYTUpraTVKaWg5OHcKLT4gWDI1NTE5IEZU
-R25DUER5ME1RcVJyQllUTWtlMnlwelBqSFlCMjEvVWVHdkFwVTVpVDgKVmwyUDVo
-bVdCbWQyVkl4ZmJFRVBJM3dnK0xnTDZpbld2WVdqcUNLbHNYTQotPiBBVGtfLWdy
-ZWFzZSB0cEcgSFBKJnpgIHtdCndXeG9SUQotLS0gS09Uem9EUHdzeU5rSTloa0Nh
-WFRDTXk2Rjd5TzVrdFl0dUxkOHh3Zmx4MArlRN032deDy5RD6TzsmBwY6dO6VfFM
-GwGYb+ssVN7V/dQborfz22mhqiceT6PhKUmFdBbWz7vijh7qCsPImThm6olgM50u
-KbATn+d5goWHQJ3H4KeNc75wsYhoj5WKranKdGo9LEbY+525K3hjIVSynLix5ZH2
-Emb+5A5BLK3AKFD8g2ckGKrsS+sHxzb6n6yGM+C4AwjhUlnY7kt9n65wS6AQAptW
-MQRVrE8VoRxoZWJ1wkGIgppwGDzGk+R47TkeRXWOIeUgb0y13b1PG6MOS0IBrNB2
-ui3YIDs3CrQif5h/SV+Kqub4oyUMakJAs2coN7FHUdnw9PnaIToyuHTUq1Gi03Ja
-KvOjIgApkWviTtV005V+OJpY09fN4PDUKMkf/ibS7HVEtvTAgBMKnL9Dtwr4Eli8
-T9lT5Q==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyB5N0dZ
+b1EzU3dlc01DRkhPQllJZ0gyZlNpbGt5aEEwR3N1YkZOOVpoK1drCjE1VWJoRksx
+Vnp5eVp6MEYxUnFWREQvRjZSZTNFaHJjR2xMSXIrVlVyQXMKLT4gWDI1NTE5IGRU
+OWNzUnVYWWZDbnJoWHhsZ2xBdDdFL004QlBhbXByWjZZTThoVGd6U00KNkJwZEN4
+cE9MbTkzTEVPUm9NclIwdmwzYTF0VGFJb1pUcDJZUlc5T09aWQotPiB2bjptdE1x
+Ky1ncmVhc2UgPixaKQpCeFhtbXUvaC9ybXp4MUpzV1VYM0cvdjNyM054UVduaUVa
+QVYzcjlMckxhNXhWcW5DZXJYNjk3S2JLQU9NZGJrCjJHcmc0UXMKLS0tIDVIWlRT
+bkNkSzgxNmd6a0VlYUQyUU94WjJSbXJFVDB5WHh2TkpOaFNvelUK4X4nWl1u2VA7
+24U5qd4GT2WAoebG0RoxXI83J5v4WMc/CRuPhhnlQjp2IwjLqRuB+0wMHRFB1L4M
+x0jEtqy2FQuB1DZBiWxm2RFBQNPmYdm6WxjP/wpxA9+h9ocTEINxvbJZRz1xAZR0
+GmUIQIuWYh3lX6dvTmbXSleLWc2bRnfMCapBFgYpt1hSLVfaiSVoOGq8+F5d5Zkv
+uQJX/GoDXe7e7XcnFvFHr73SSdR5SFK7tcmbE7Pf0VPBcNE3U6yNvEUfO9qI/oau
+fQnFWYj41nYHQyKHU63r/zPfYyzQv6UUsT6c7p5eQkyN2VqRh2vCDpP7pMpT4XRc
+Y1GQKbreTN9lICfpVoNJlXYG7CB0aMgiwKsfljbl82mMSjVUH27TsC534ChGv1JX
+b/3HDbmca09Jl73TfKtHDIQ=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/object/minio.env.age
+++ b/secrets/object/minio.env.age
@ -1,11 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBWbjU1
-T0E1RUl0aEh1a2tKWHY4RS9aSGJMK3JCanF6SDd6aUxuU1RSMkZNCjNJT1VNbkZF
-YStuays2Wll2diswWlhzWnZnN1hNNkV5b1cwNkRuUkNJQnMKLT4gWDI1NTE5IDB5
-MlFyZUtueE0vQmJ5R0x0K3dLcnlsUG1VbXcrOTVIR0NITEE0eFNOUWMKTUdObVow
-bWFxZTNVZHcrcW1yOUhJV2RIdmcycEx5RFZ3Sk1RR3FLc3NSSQotPiA8QyFURS1n
-cmVhc2UgTXpbOS9WZGUgLCAyV3EtJChiMyA6Om5DCjE0T3lacmg4WUhWSzhEM1p5
-SUUKLS0tIGJGVGhtRCs0OGlXQ1FiU2VoYlVucFU1T1hWMzhXclY1SC8wdFd6Uk9a
-UE0K2skK+SHk1WaZHftWxDm0pj4otkdKhp9GDUf26j/nJlGJmXln0HEAyIVP0inf
-2U1eXFmcL8+yoYWN8G6mvAztOk1cLjqZY6894b6W59ZOwWQHntbch18TfgBDKO2Y
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBtRDdI
+cXRNNlpXeUhyZnZMY1pyVklmYm90V1FUdlV3TExCMWhrU2t5MVZJCmoxRkR5Qmt6
+MjgvT0dlOUhaNUlsbW1taFNWVXd1M3NPeXBRVkU0MVZSalkKLT4gWDI1NTE5IGRN
+ays2NU5JYWxXd1lUSVo2R3l2U0R4UVZrVHgya2RDTHdVUHNYcGp3MTQKU3AvcEN5
+aGpCV1hrRDZLRWJROWt1V0FRQWYyalRyWjlaTUpqcElLVmhaRQotPiBXeX0rKksv
+Xy1ncmVhc2UgdDlccQpkOGhtay9RbEJGZDEwMGdYS3NvQ1F0TERIYllDVWJrT2hD
+R0R6T09LbTdkVFo3b0xIQy9ic0xzT3VVckQyekpQCnhzK3VOTzFUdlJOcWNBV09u
+ZWNIN3hQNTRBCi0tLSA2clZPdGVESEdGZEJiYUpYT1RRb2lnQlkxTVd6YkxMd2V4
+OUZYN2FtcXQ0ClUdmp1fMrdVf5dynjUyL2DPYqXc6Je21ygGKxzxlvXHs6y2HnCr
+C7tbuS/HlvvqaVTQBK6WC5u0WEbtj4MZeDpnF38PZunT6BDpT3vDtnv+txJ7EMhv
+VL2Lk+bz2Q==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/object/sharry.conf.age
+++ b/secrets/object/sharry.conf.age
@ -1,18 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyAyb3Qz
-a2FRV3lVSkxWMy8vOE1nY0pSVlNZRlZDV0dWUlpPSGIrQVUrckFzCnBGWGN0bnBB
-YnZ0NldOSWx6VFB5TGw3QTUwT0NsOFg4azQ5cmJ2VVRSVUEKLT4gWDI1NTE5IEVK
-UFFlUG9vNFhKZ3hKNmg3YkNKUG5sUGRTdXBXVEhRWDIvcGE2ZTZ2dzgKeFR6aEx6
-dVpHZHpNMGlSTnAyQjdXL3FYWEVlbThzanYwdno3MDVweThRcwotPiBsLWdyZWFz
-ZSBdbUdcb1gxeSAzIzZ9PmhmCnhiaFd0R01XeGltRzR0YytJOEdDUlJNQWpwMEZj
-ek03cDBwbmUyMXdYS1Nvc0lydXRNUUpaSEp2YTMvZ3pzT00KMldWdDgzam9SMXk1
-djM1ZDkvZmlQWVN2bXFYVnZKdFFpanlSSWRnZ0JaRkZwUm8KLS0tIGhGN1FSYy9I
-U2lEYnR5d1FSaXExcE9aRkNlZk1Xc3F3R2FlRnRROGlYWlUKU2/4kQhDLsl1g+Qo
-VLIGDSnxSl3aK3Dvhak8x2SJBlE3CCqeWuZ/wYz5p5ln/GvQjZpG/bNP1L+WKwiW
-ErJfBCvg6Fmhtzz3PggXh8PnSB/qFonzOvJ/2MxMqaSDgaBRX5jhmIVylUbFaYGY
-Qj7/ndpkCaOs2W5dsEk0cP8H6jvPYK40PIVyy7rovv1hsy0SbBS9cy2HyZvcCH9J
-FesaP3GJjZgmVC09qedEVoKsEu8YxvePC4ltaZ/+oGYY+Rr+9YaNv4v27H8i40E8
-Jk/Cr/HIDinrBZCyCB+/YoVGI4D2Kjjvj+UpPw5pDiC/PfBgWkUopeijR2xkt9Om
-tSZoLZaiaEB5JsOOkEcDM6kg7xTfkjBadysxy+z6hh+mIyKF9d88UPbBShFEOLh+
-3oV/jjcSCOp8fVZmAUyCELJHUnkBa8er1CUyjHvKX02vz9JJ/N96UsNJ9sjsmw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyA1MUY2
+WHZlWFZ6Qm5NbUh0UVJBQUdkdDZZYWNNTjZpUFhSd3BqL1Y0QVcwClFSeUJNQ091
+RDQwZUk4OWF3Z29nWFJsdTNTbkp6ZmNyMXJQR2N6c2tuZjgKLT4gWDI1NTE5IGtS
+bXVQcXZScEcyU3JaUFUxcXdBRXIrd2hXK3pKTVR3OVU0OW5RYVdsM00KWTBLSVFU
+MGF1ZWFEUXRldWFVd05FVnQ3RU0yZS84U2VXWjBMRWNqZElIdwotPiA1XS1ncmVh
+c2UgYmE2WnogO2RWID4genkrCm1UV1FtL3gzVGVEK1JRMGk0K2hMMGlZVVBEdmp1
+RXhyZlA0eDV6TU9NcFN2WFcvVmVaM0NJYS8yNEhpOVVzcmcKZnpMdGxPeTdKZW1j
+eWtSUjlDbnVkSWsKLS0tIDFuS09yTmd4MzY2RVRSek5RTlBKVTZaSURLVE1paU9w
+NkV1dVV0MVJpZTQKQmL0EFysABHb6WIA5hzW3z20VXH7UhA22vEMmhOpUdGFEqB/
+juRQyOjIZqEEJaBMtzlkQ/RR6/QkW+Zzx7UgeECfpHfVGLnwWEKoJcQMFUkF9y3D
+g0K2uFHPKSJTuvZf7/vHqBiheUrQaxxhdSOvlIi+Dj52dkP+LWDXwlE5ekRDXx/E
+P828WNGWD8ovpDb5UFBs/ymwdmuoaLUomLEHEViMQxB1O2uqAHuRJ8VYLZ/58qBV
+wQHqALZA1Y8EXTd6vV1Xa1iZW9QZ4MplBeAUSxoIuSOZlCAG681oHDzOraYC4k30
+VegDOZ8VcxiRxYXFi6EINAcvuPTs3/ZWkpyo3nsfxfEKvnQJimF5gMxmV+YWKZOl
+9cxFqyeil5mZpEAtc1bnGd3IO3bod8U2LYAXR+brdLZXfN+j9EUgu1nH8bJWe2ct
+0YUMI0EiqcW+zC5hBeLRz+TxULgpmA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/pdns-file-records.key.age
+++ b/secrets/pdns-file-records.key.age
@ -1,19 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBiN0NB
-ZGtsa3o3U3A3cnlMYnJPNExZNnNZNVYybkhWOHlRS0wvQS80eHhVCmlZTnlhUU1N
-VXNHUTRTTytrKzFiVTRrYUdRYmZpT0Z6UitRSElNVTZ5MzgKLT4gWDI1NTE5IEI0
-UWVJeit5WDFkNnFsMk9NTWd6eEtEWEtqbk9zY1p5amZxa25JcmNCZzQKN3ovbHBR
-aEh6RlBZVFdwWHZDWjA2V2dGZFN0ZGFDa2Y4OWpMVUdTMzVjawotPiBqNnotZ3Jl
-YXNlIENOYCFATwpkYUViV3N6SUtWRDFpbVlCa2Jxc3JuakhDaEdGZy8reS8zZWlL
-RWVRTEtuOW1QdWVZWTJESm9wZG1qQWRQZ3cKLS0tIExiQlkyVWRlbnpUZVZHbXFi
-MmFLZGV6QUJUSnA5cDN1L3J1a2taRmVXUTQKLPconuu2z7wK1ygNWnGS56NwxcMh
-kLdoaiHAdaLiIkKO+JIBUiEoma2gJ5+H8lZ1g/Te5gJCyEJ6VyATRdjlNP7heIbl
-8yXV1K9SrBdEAeuoRwemRgduv+OuUM76wJUJM5Vmqqc7P6MZPKkV8vuQjqkOXoNy
-a6WknhU544skpXNAfVsZDpf5MzCq8PbhyGkOgcUCm8pAYbzhLOkU045JPq3XfreW
-mPZNScqQQg/Ye3AKyThAK8ncjGCJXFH2XcvkGPCNfxMP8h9hOb3HOB0QQMJHToDQ
-25ZCVU96C0osw0Bb5ls3ZyH8qqwF9qVSvaqM2shiJn9lvgQiIp6ij+9WUJyH32ru
-I2oW83roVSEtQxpYRcadGelt8pJQNv2YOA1qqg9uEZHcQ/qsPcT/gW+EvGoJTv3M
-9M0/tOhG8cKVjArnR7QNRV96UmMU5/qAAcU9di12yCJVgkEwtML+LNKdvWUs9MUw
-09a3YA9Ja4zmXskmdVsUmkhK15JlsFiEdPOHpMxQ1G8uF//w3CVJMaNRc+NJ4km+
-iriOPYmHuNTa0l9ifCZ/279+Rp01RIzQPnhjBuwy07OIWNPajnRJ
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBLS2tN
+amFtTWJzdVM3OEdUY2s2bkdtRlZpRDhkMnhDNzJsWWZ0enZvakFNCkdHYVRxMDg1
+d094ZzZ5RldJRzJ0dDR5UlM4VmYvRzNWSHliNHdVUkpRZEkKLT4gWDI1NTE5IFFz
+bW11ait4UDhUeHZCcnpvMWZmUWxTRTJXMmlYc1gyRlRyRjhoeU5nQXMKYjhnako0
+ZVRKbzE1RG1OanVtRDNwMzgvK1NiUFl6Ym1NbWxnM1lnKzRtVQotPiBPPy1ncmVh
+c2UKMzlJWHJ0U256eFBsVk5KRQotLS0gQTBITHkxSlJwWnc1aHd2M045a0E5L0hi
+MjF4Vyt4NVlFNTdpVGUyanhEYwpV8y9HB4Fg3pFss1E4Y2sIekapLyMPqFB1+VCP
+0OkrR52F0Fcg3FL1XBoVFBnyi0OfC6W6nwGsDh2npzFTneIJNzO0qUuHBA+1KfDx
+T5NWi94gtn/jv5p5eVaztdfduhVu7BKRereVvxV9TSYw5eYIcDDoo9f0PsuJTXxG
+zENjlBCZWjhLTnbJYT3U3qTlIqNr7o76PHhcS9xQLsbBya6VJZ5/KkBNzxj17MUp
+GG/PlMeWudN1ZFUtc/JRWnTfc+y7RTlwZAQr6ZNbsHLP8mXCJB7pfN1xScJlHk4/
+mKWR9w4PLkqv/QYfZSQHCHUMtg5lYlo0ExlO7jX2+4SdTNPVQrmEfHoX2q2nUgol
+z6/BMTVy/DtrFT7bdLXW1KPJE1eedbOOSTFm3MvZ8UDhhCjIhSdlSe/AH/BKfE7b
+dxV9MzLLSVpaVmKWK3tM5yiMb/SJB4HN+nBYtptklPWQUH0AJ/op+Ai+VnmZtTC9
+ZW5ImFzOQHFDteI8QgTBYL5Lx48kCUqU1wpg4VIKXw/BAy1y+q85PWMDJVVwk1p0
+fjAxGF10leqmTgmBDJoqwEhFPlOfJjVH9E2oYacrhD8=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/otp-secret.txt.age
+++ b/secrets/toot/otp-secret.txt.age
@ -1,14 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSAvRloz
-NGpiUVJvSWVQempSdGJtcVhRNjdjYjJUT3pDWlBGY1BrYlg4UHhzCnZKTVRkUGk5
-U3RBRm9ibnl3UHAxNlhrK2ZOSVJsQ1VscFExZ3J4SnVGcFUKLT4gWDI1NTE5IDFK
-TUt3VHduVWgzT25rM1YvZU5taTdZaFR1eWhPMzRzdDJLbGw5L1U2MTgKc21oanpO
-WlFSTi93Y0xrSkVSK0NEdXlJellhN3d6RUpuVk5abkhTOEh4dwotPiBybXMiai1n
-cmVhc2UgKWoKQzZRV2xacmd6UDBkU2RKUlJnRTltaXlKWVNGdjBUOG1ZTGZQZEdk
-ZFYvMWVxUzUwc0lncDFweExoZE9ZT2ZYbgpIS1hkdi92bk0rQVhEQjNTM0RhRlQ2
-dUx2ZGVPWFEKLS0tIFBxVlJNLzFTTTJPS1VoRGxwcXM2ZnE1UkNXdTBoaW9KT1pK
-bVFiYnBHZncKRWP5RMFsuOqztnAuihBPja2Wc9NpMKAY126WJgjFJ6zRbNYGKTi0
-80cdczYNwfNzce+2/EOW7GFyL8IF5iUt+u/19BtP3tnG/4fe2yBES3HC3bIyEKoN
-DeZjDunQayY0Df04uWw8Bf+YLCwhMUPtJOZBB2Xq13KjjlAkocurN/7w/jQY/Ubh
-nWGAyzGXDDi2b1mUI3+KmLvteziYPegHHWs=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSAzdHRC
+bkl0b3dPbVhCdVd6akpCMUZBOGxMcW5oc0FBK1hMNEFpN3JmbWlJCjB2Q0dLbjhJ
+QkFYRXIweWZ1MEJ2ZmtyclpYRzJFTHVhRTJGQlRkVlcwWU0KLT4gWDI1NTE5IFhQ
+Q3dHQUxCM1d5NzNsTUN6cFFHUnBzU1FaenVuaUUzOTV6bCtFVVhBeHcKSGdTbEtG
+cDF6Y1F2NmlUMkVGUEQvYy84Z1B5cUJLY1dZSytZRUNSVS9FUQotPiA+cnhGdj9m
+Ly1ncmVhc2UgV3tyfEouVAp3aEJSMUxNSUppaUtMY0R2SmtJTzNXSHk5QVJ1TjIr
+aEtqQ01xS3pQU1E2cVczK0ViU2tTSDkwUmRDSHZLbkZwCkhGTENFeXhJSWE4Ci0t
+LSBvZFR1S3R0NzJoSkJmeDZ3MzFVSUxiOWJiRmxwT2c3QUJHZnNXSnZMZVVRCr8Z
+APLJ+JGZpqb+L8zO4fjj41BG2sJnacB6cTaGjsMo6J0/4so0iasExS59BJkDeBA6
+SQTuZr91+KKNQcr57vA6RZrXw0mf1xafQx4mUzJaXJCBJdrRw/WETjk7RZOGaPHR
+AIfHZ5io/uOOmcHZT5nGjekZtGJcyO1RG/IgRQG4pktZHniA7iZNdQdyj4Qu59TL
+vqDbGhbOwu4K/i6UhyKl
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/postgres-password.txt.age
+++ b/secrets/toot/postgres-password.txt.age
@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSB0aUI0
-eE4yYzBsSWlJa2R4eGYrSU9sK25GUW92c0VFKyswY1MrZjM0K25BClNJaTZqd0Jq
-SEx0NlNjTmVmbVkzM0Z0L0FDQlNNNWJnRFpvRjVhZmwzdW8KLT4gWDI1NTE5IFpI
-bzVFMWVLdHR4cEtqeTBMSEg4Q1U5TjJvT2dRT1RTdkwxb1hvakdmUjAKc3M5c2RI
-RnlyeXdlSlZ0MVhKR3VmeWVURldNK2tydy9kU1dFSldmdk1USQotPiBBRGdvLWdy
-ZWFzZSBCTy5jIGInb1h6Cjd2M01SL0JhS1BQNkN6QlpUa3ZIaFAyK3VvWlRJWWNu
-MXdFU3Q5OHU0eVhPM0VFQVBwb3kzb3hsdGVuV1cwc2UKL2J0enNHUHR4ejRSZ2pQ
-OHUxb05wM1hmQWViTkh3Ci0tLSBpanJ1Ly9UTUp0UVJNWE9jYjVpd1l4T0xMQ1pC
-R1duRVprQlBOcXBOMHUwCowxhE+lGyvnEscTl18E+XyLbVxgl2MJ+vx9INukJpWC
-uEsLrHYkkVI2nz3E9RDIgvg=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSA4QkpO
+NHVvS1pLL1BZR01NaWR6WnhBd0V3a0UxMUtVbEZUK0wzaUhRR1VJCml5SzdsWGQw
+eTJtNC8yNnhKY0ZscU1pSU5YaG1UUjRvejZMZ2s3bDhOZEkKLT4gWDI1NTE5IHZM
+UTQ4djJMN1JjUHROU2x4cjF0ZkhEQWlkckdjNVVxVzdEa3BWdVFVRzgKSHJmUDh3
+OUNrUVB5ekhEUkl4cjV5Mm45MXRYWVl5V1JlNWlHa1F2QUxWbwotPiAsMiRSLWdy
+ZWFzZSBxJUs9PEIiLCArYTsgbzxfbyAkUXdUcSsKT282TnJpWjY0ZitnNkVDbUNJ
+K0tpY2NEaXFJRG5xZlR1MTJ2RDVGWXJVakxiNHVVZGN0Z2lEWGcraEdUck9KSgpt
+RGhoQUk3elBjVk02dzYyeEYxQXUxMXp5MzNvQkJtWU9zUVJpNEQ4NitycWx3WEtF
+c093TUhyckJybWt6RG1MCnF3Ci0tLSBUdnE5TVFJdW9GTUZjRDVBK3pDVjMzSmt5
+SXFWWkJsaGFHQWdBVk1iZVdBCuXFy4h3YcLb2mJjl/is3Q5rd/dMo/u36gCr/6Od
+kEXj86TxNJP0l35VEuAHcslsFFU=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/s3-secret-key.txt.age
+++ b/secrets/toot/s3-secret-key.txt.age
@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSB4Q05L
-WDJSL3BaR3VxcFhiNHFSSTBkUk5DNWtQTkVMTzJEUS94TzQxcmdNCnZjM05DQjhF
-L3ZFZDJla1NYZEUvM0ZOSllpTFlqMjBJU3lCa0hsc2VseFEKLT4gWDI1NTE5IDha
-NkxIYko2cHp5MFcxTi84ajFxbDZVSzQrTHZqczl2RDdzNEFPVjhxdzgKaVhKTGhy
-Vkc3cnlYV2FFVGdHcDFYd1FnK0JGcTRUOUpuckJDdlBVeThKUQotPiBzdk0jUy1n
-cmVhc2UgVXYgcjptJ3Z3OSBEIiBxRG83SSUKSGtEenB2YS80Qyt5RjhmTjM3ZW4K
-LS0tIG1YZ0V5K0xWT3RlWk42eXpoRU1Gb2tVekJJc29PbXBiQytIaTVYTVZYOWsK
-gQCzgSuplna4yXBUOEk6JocjLQdCS1LNp8nY3PU95AYZkKR5G1tvXy/lfTO65BwQ
-Gw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBJRzJW
+Zk5weUJvMTVKVUlXZmRFV1BZVzVIbFhUNGlJZm9uMGs1OStRUjJ3CjVzZFJtRWEx
+SWhiNnZ3VE42RjA4UlJPcU02c0MzSGxUMXVteXFTM01oSW8KLT4gWDI1NTE5IHZF
+NWdpRkNnSXE4Y1AxaWY2cmpOcDVoeUxrcVJ6Z1A4RmYyMU96YUNvVFEKODVzdXVa
+bjVHdFdUcENTN1hLQURiRG9yYW1xWmg1cVMzSjZZVXRoZmNCNAotPiBfUi1ncmVh
+c2UKbC9hOVZjdWpNZnFoZWNrSVZLVzBVaU5VU29DZnhIK1BSbXRCLzBnbkI5dG1o
+QWluM1BpOHRyL1BhNEFDNzJpNApPY2hURTkvN2RzSUdXcTFGd3I3Q3VBQ1FmYXZ0
+cUZVCi0tLSAwZkxsdzhSN0YyeENZK1lpVHlNcVBoMXdiVXJ4R0tQNHdoZ3VLS0Ex
+eVhrCvULli5yGkTvWWb5gTRMcFdSx/53/KPP0JLFQhOt/Xl1Qo2AfRUd1JSxbNh6
+Pa7D2LA=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/secret-key.txt.age
+++ b/secrets/toot/secret-key.txt.age
@ -1,13 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBPL1NB
-SWZFSEpvSEtLYkx6MERxYk9Qb3JzdzRyUGI2UXBqVklzN0VVWlU0CndITjlmR2lw
-emZkZGUxNnBDcURkc3hFekQxS3gvSlhPUWc3RlFMRVV5WjAKLT4gWDI1NTE5IGNT
-TFhQUDJjWkIxR1IzV0RzOEEzblEwcDBXY2Q2ZG16RWorRmx2U1hCeG8KMWtHU1h6
-RkZKN0RPNUVzckU0SGVZdndrSDBEc1BVcmNIWDZ6K3hBb3FXOAotPiB0ND94LWdy
-ZWFzZSAsNz84UF8gJXxiQiIgbgpQS0t4OFFKMDl0cmpza0t1TXNCRmRvVDZBQWxm
-QnlVCi0tLSBpbG5ONlFXeERqRWMzMEh1M0JtL1huc1k1a2pkMzFtZHVZZjFTczJE
-eUF3Chc3yOn1jyStstz8RfirGwg16ZiZQyRuDdn8c+6DhAMMkAIgSHVx23QvWxWL
-8XRC9jYIUEyyoF+8UR2HKfb9KK8pjmHtohjtsdvvC9wyO0VuN1HVMtLxSIt8VKyz
-T8rHT0lYkzy5hH+ILv68CFdtYgZ9h0sbLvmu+Iwxqo374z7OJlB4etG7kjQZVy0c
-Ylx+IuaWWrpJ400E8FPsdNpiQUVs
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBRTDhq
+SkNBcTZRa1VzT29kcTlvdnBmUGRJS3NtTG9hdGYwMFJ0TEFGYWx3CldzVXJTU1h1
+T1BxT0dnSUEzb01UazNjY0F0dnl0bkIyWGxpbi81VHRqVTQKLT4gWDI1NTE5IGJH
+cWdzQlBmT2EwSmJraWpPZ2xDL3p4eWkxb2lQalV3M1VaKytNM3dNUWMKTy9FUytW
+OWZFV0trS3pNanRqbHE5UnZoaUlLZXE0SHowQnI4MXhIamlKawotPiBdLWdyZWFz
+ZSB6QislCmR6bVJUeldVK1dJYThDWEoxK2tXb0xwL1ZkSUl2WXU3MlI4QjVOMm9q
+Ym14R08wSStmTnJoNytRVm9wMjZHU2MKOFprWjdGaUpTeFVSCi0tLSArc0FsUGdz
+WCtOVnQ2ZE1JM011Z2dRaVQyRitaSzZGbEhPR1A0TFhlMmdnCpjzBfRIhQ2wPVxK
+vWlaXIj9dsSpuAfUlRThKCHSxyhRfiz/kwLs4sgK7VGk9RpL6qy3VwL8GLLNGxwp
+yQuCIN+brHrwfhL2obZ/0JJZp59AjjZUgnG1YQJSiqe/cvE1gn15CK+BMz7QACxv
+S7GY966wCs7TE600Cez2QW1YEeyoDYxbOLWI8nkoYilCCGMOOjmFGgmJYgpcF+Q
+b7NQsFlC
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/smtp-password.txt.age
+++ b/secrets/toot/smtp-password.txt.age
@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBLMy91
-MjN2Zk9rck56SDFMRlF0ODRPb2N4QXowN1RlTjNid3N3YlZQV1RjCnBoblVjTmc3
-R3BLc21VK3o4a05wUDFPd0FTeDRHUGcxNVNGQTlxTm05OUUKLT4gWDI1NTE5IHJw
-WDBOdEFBUXM5Z2tTMzhzRmtXNG5wQWFXNFJlcVl6N28wME1lZUpGak0KUHZyQ3Fs
-RTdnSHRMWEFYWEFIcVlyazZVa2djME9haFRxQ29lS2NmRitFNAotPiBnMGUtZ3Jl
-YXNlIFc/IHVOXlJ+MkQKZlFZUHZMTDNHYWNsQWtJdjFZczAwQ2E0My9FWTJtM0Jn
-WUlTYVVLOUg2L0VycjhpZG5xdk92QkUzZ2pwbVRFdgpSUDRib1EKLS0tIEVFOG81
-NjVWTjQ1SVpGMnF6NUU5VmVHUHpSeFFibEYxMWQxV0NQaGRkbTAK85TAk7EsxvBq
-nmC9QfVZHcXHGrC1u/JiMuXTqekG/Z3eS89TUlt6fAEI5zHvU4JZUQ==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBBMXRq
+alZBTGJ6U1YwNGljKzl2dFFxYXRHVUg4M2dTVTYvUEZjUTdFT0F3CkU0a3lVNnI0
+MEd4WWpEcDdwVUd3dC9uc2hRZW1ud3h4cXNtQnV1UGV6MVEKLT4gWDI1NTE5IExa
+UmE5Tm5uMGROMThmbVhCQjYvdi96eVBacGcrc3ROTy9mSDRtYk8rekEKSVpiVlox
+WjRCWEw3WklGajNjVENsUFhZemFOSmhsUGQvUmx5UXRreUxrOAotPiBuLWdyZWFz
+ZSApWCBOUyB0X3JzTyUuCkJZZGY3enZCSWZMMlZSYllVMTdoWUpmaXdSeFZKZFlT
+Z1U2YW93QnVUaVZ3WHNlem5NL0FCTVZ1MkNYKzRMTVEKQ2ZlR1ZUaDhzeFJKNnVI
+L2hSZzJrd3AxNjJnWC93NAotLS0gWVBpakRUbC9FaVZMMld2elk5REUwY0tteEhN
+enZ3UVdjSXZHSkRubHpjcwqaRtnEU0aa1blt4GoSR4MZ5K5jGl3qenZKMJomh6ve
+xTU168kK0KEiWMS1raKoS6Eo
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/vapid-key.txt.age
+++ b/secrets/toot/vapid-key.txt.age
@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBPY3Fw
-dFo0dms5YzJmTUxWOFBPVE9NRi9TQlV5SlcybE1BdUZjK2h6clI0CjRLeUZGcTBD
-VTlKb090ejc3WDVQay9qeERkbFUyTWtRV3N2YzdrUnYyWjgKLT4gWDI1NTE5IDVK
-ekxWQ1pyNXFHZTEzNnhJR0RUdzRNdUdWYlNCcFp3WFNGN014NnhVaWsKa0FzaVdW
-QlZSdlZwVmhNYlMxbTdINndSQUVTZWo4WC85Y2RSSklBeHhwTQotPiBQQXpSY0Ut
-Z3JlYXNlIGpCS1IgOWRXP09SIHYgZAphdkVFeEdiekQ2QjUvMUdzRU9zWjNRTjNV
-azl5VnYvNmRSdkhQUXZZQytCVU9ZNTJmNFlmYWIrMytHdVhlQkkKLS0tIHJnWkZ6
-YUxYaUdNNkhwV21mMjVoMXQ0dmZCM3hUYzU2cmF1eVQ2RFlRelkKS59StNd3JyKD
-9mNPgaPRo3/nRR0acTirJgt7rgsmaIQ+5m1WBFwSKRyA6FMqav6zVWzL8ALb5imb
-+afJDxf+w5G9hnlZk6oSpL3i39s=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBkNllO
+eEpVcU42OE0vRzAxM3F6b2V0dmYzTHplVkQ1MXlFMzRrZEtHT1FnCkxMV1kwM2lL
+NGlyZGd3YW5Qa0pjL0tTb2htdjZ4UmRWY3N0Yi9DdzFBWDAKLT4gWDI1NTE5IFRZ
+N3A5U2dnR29hYWxkKzVMSkpVbGE5Nk52eEJNSG1UZU1HRzJmcTNYU0EKeE9VaXpr
+aDNuWmhUSjFvbU9KN0hmQUh2YWxyNVIrTngrTzA2bUdGc1VzawotPiBoQSYxWG1r
+Yy1ncmVhc2UgaDMgdWt1aSA6VyAkVElaTmsKSHEvYW9uRkxreTFaL2c5aFV4Zwot
+LS0gNUZtczB0VVRReTl6aWF1L0p6N0t2V3pEQm1YMm9oc3BXeHViQnM0Ymp2SQrQ
+0ARq6ATsp+UtblDWXSl1/DOCqRb7tdH9mmLkyWZAFCPct5AvXaUcz2vkFy95Ru9Z
+d/HzlaVMbSP/JKoOnBiA0mKbfAHo/DSreWDpkg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/user-passwd.txt.age
+++ b/secrets/user-passwd.txt.age
@ -1,42 +1,45 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDNiQjNaZyB0OFVT
-VDNodzRQaXRHMDRldGlEcUtjbkUyWElRZXdIN0FTNGVPekVFdGw4CnBWaEJnd1pu
-Ky9YRlFQYkpvYWp3SjVuTjQxRGxqKzBFR3pzYWNzYjBERU0KLT4gc3NoLWVkMjU1
-MTkgWkIzZTZRIEhpY3AyZTE3clJJek80NVY5S3NuWG9VbitLcnJqU2tabjVlYm9J
-OVR2WFEKR0xvN0tvdW9GUlQvWEZ6LzFETlF2TE02RC9qTGYvaDUxbE9CNVlwak9K
-QQotPiBzc2gtZWQyNTUxOSBqNjdGWFEgU0k4N2VXdDRibDBxWlFsMkQ4TUF0d2tk
-T1ZvbUt3M0tDNHlyOFpMOVpWTQozdThicS9DWDJLRzdlR0U1N3BObFpVUlZ4QWVr
-QlFZNkE5SzZweFJLTElVCi0+IHNzaC1lZDI1NTE5IGMwVE5hUSBhK3YrMTcrV250
-Z015UDJiTTNGRWtSQzhDNEVPK0prSG9OaTRMbUxEWlIwCjBoRmsrdzQ2akhnVmxl
-SFRTRkFJV2RVUFI1Y0pHZUhNYTVOaFZ3R0QwdjQKLT4gc3NoLWVkMjU1MTkgbjhD
-cFV3IDNOR3JqMlBYdThFM3BXY3VzdlBlOUZVKzdjOU5mQVhvY2Z0aTFlVEV2eXcK
-eHlsaHdXNjhvVEwyeVlEZTlhNkZ1YkJVbHNkaDByWnFxMEJrUzF4dHJmUQotPiBz
-c2gtZWQyNTUxOSBoTWE0bncgU3dIVEVyd1JWR0tUTmtpRnY3amdoRkNBTWhpWXNp
-Q1JtSjVCMEd5YnFTRQpOL216cUZwQnVDdCtsd2x1Z1lnZERWUGlvVGpTa0R4V1hs
-YW1xSHh3T1NZCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyBmbjFkYUwyb2RsY2pZNHBV
-cm41bUFYb3V2N2ljVjIxMDVuZTF0aEszVXhVCk5ROVhWQ016dFVrVGZTSUJPa2o5
-MXRMMWlyeXpvZ0k0Z0pJTHFSLy9ZNU0KLT4gc3NoLWVkMjU1MTkgVkZjdzVnIG82
-Vmlsa2xyc0pwd0VMcTBDejc2V0dkckNkTWNiMHE1WWJPSUQ2NmpsRmMKanQxajVp
-MWJZZjNqcTZ3cHV2RWFGZm90RlNzUml4Njhyc0lzWDNIVWpQMAotPiBzc2gtZWQy
-NTUxOSBoa2J0dmcgYXQwVkhRRUhvbS9BR2FpQlVHUldUK3J1c3E0SCtiVUNIR1Ju
-QTE5d3FpYwp4dG1YYlY4T1FGVWFIc040ZTVmTTA2OUdHb1RyZ2ZTNjVnNTYyQkxC
-VndZCi0+IHNzaC1lZDI1NTE5IEJhUWxSZyAvSitKNWsyc1FVVzdVckFHazhYR2V4
-VjRab2FzNE4wT0NtRW5zZ3RtQlNZCjA4dWYzbmc1S0xEMWJjTzIwVkhJRU1TZDFL
-S0FVM0FlTURmTzEySkE4L0kKLT4gc3NoLWVkMjU1MTkgNjJKY2NBIFJUOVVXc2x5
-aHBDYmpZWmtNUW0yT3RYOXl0Rmp2VUFMenFZV2E0R2tNVEUKb21sMXVIU1Ftd3o5
-OENxWEt6ZitmOG55TmpTTXVnM1luWElqZi9OMHo3RQotPiBzc2gtZWQyNTUxOSAv
-aHgvZEEgdUZyM1NMZmp0YTRJa3VvOFdvaG8wdkF6cXpCVDlacmtZVk54RUNWZnFp
-RQpTSXVXcnRGL3RYa0R4c2ZHRzR0T2F3bGVNdzFOUVhuNjhKVmF5NXlQc05JCi0+
-IHNzaC1lZDI1NTE5IEhKL0o3QSBMWE9RbURzVnF1OFFmZFJ1YW1ETmNqWUN3ZFNi
-cWQ4RGQ2bk0xZmJXUFdRCkRpQzJpVW9jMnBrVmNBTnJiOTZ3TXdndE85M0dFMHEy
-OGNiaVRWaGErVFkKLT4gc3NoLWVkMjU1MTkgL0VKWHZnIG9ZSklSemRsZ21ycHJt
-eTJlSFZGQ1Y0Q0VWMXQyL1QwTDNqeUdYQ0dzaTQKa3I1RERNQm9JUVhBQlZHV3BG
-QWZCWG5JY2ROZlpQOTFoWmNqZU1ta1ZTRQotPiBYMjU1MTkgbDUzN0Z1d3JvVFRx
-aGxqMXh6SktXK3VoSmplVTE0SUxsRmtRMlZmRXFWRQp6bUU1UHovN2txQ29aZkhY
-SWE4OTlJWnY2RkMyRW5lMW81cytNRWI0aEU4Ci0+IDV5K2l2LWdyZWFzZSBVeXRV
-JTIgMiBYMSxjCk1PNEpvaDg2aG9oUHJvZTRUWHU5cUpVcTBDS2FHWmFrcTdCNXhi
-bUUKLS0tIGxGeTZWaFFteXNMVmp6Sm1ld2ZlcE1TVUtWVWYwK2Z6UXVrVnBvZitz
-ekEKm0tc5p4w4P4l5ZhEelC3M62yfxOZIIDYbv8f2BKZWbjQR9RTDtXnKq2z0Blh
-9wNpC8FfN73aCePzpJ7xk8SQ98OXpDih2yhTJnxqKh1C5Y9ubXdzsoYxGogaXrSj
-IJWQl2Xkg8BslJsh42dHs3EcCr+kH5HhmN/nwvQBGCUXNT9M91ucPzbAvWgPnQ==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDNiQjNaZyBSZGRl
+Mm1Ea2hPZzJTUWdqcjlPZlRqbnNNUnJaeDNLOG82ZWZiNlo4Tm1ZCjgvTXBRUTNj
+dkszTmNNVHA2c3hZN0J1Skl4akdKWGk2OHZtRHdvd1orWk0KLT4gc3NoLWVkMjU1
+MTkgWkIzZTZRIDc2eHhiSDlBWEN6dkpsZDJDT2JlaVZlVUc5NmtCb1VHeHVWcXo2
+cEhLbmMKR083U0YzbTloSm0zc2tEbUthTW1tQkhSR1RISzlCVDdnZXE2TnJyblZS
+RQotPiBzc2gtZWQyNTUxOSBqNjdGWFEgdVB0WUQvMmZqcDJxK1VrZ1RZRW15ZEtu
+cmw5dVZOWW1JYU8wNVo0RkNTSQp0b2tmNTFEb1FJMy8ydWZjcGdXMnR2K3JybXZH
+aGc0b2V6MEFnSEo0SGJVCi0+IHNzaC1lZDI1NTE5IGMwVE5hUSAxT0NVWW5XRTRj
+UUFQVFBqdlZ4dDZvM3gzbXFTT1Rhd0ZjeGNHaFg3UHpBCmNyUHBJMndVN3JSV09k
+NE1xcWI3MDVBbjQ3L1Z0djN5TXZGa2NPcGN1ckEKLT4gc3NoLWVkMjU1MTkgbjhD
+cFV3IEVLZ05jaVdmRkNqMUtmNFRoMWQ5dXpTeXY2Qm85UkxSOXpWNHM5UlZ6VjQK
+MDVqVTJ0cDJBQ2VsVzVndXpwcmFRVGplaGtmN3ljUy9SUmo2VXorTnlOYwotPiBz
+c2gtZWQyNTUxOSBoTWE0bncgMGVMbC9GNEg4TjQ3WlRDTlJFVEdoTWNaRVlYcERI
+Wk1sS09yaDYwUDdFQQpFbHdWaXlPbzEzWTVhTkdncHFsK203My9jNy9nWTlPeEVV
+UlVQbXFhODEwCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyBibVg0d1JTeHVmWWIzYzlz
+YXA5N1RXRlZwZmVqbzl0bzNVcHR0WW9XcHlnCklINW9GdmdvMUNVVUszcXdHOGpM
+TnVmM3lEUEFUa2k2RldWTVpmY0U3R1kKLT4gc3NoLWVkMjU1MTkgN1dROVBBIFlo
+QktDbmxBY29uWkhiWmdGRGVRcHExVmRsNWRHdzl1MDhFSnM2SjhEME0KTHkrSm9E
+K2VhNlVBdGNkbElXc2lvVXBSSnExVUxMVTNiMERqVzVtYzRWawotPiBzc2gtZWQy
+NTUxOSBWRmN3NWcgaXROdEU0TXBsVHJ5MFlhSzZpZW9tWjJPUFlNc0Q0bWhORlYy
+amNwc1B3QQpXZlA1T1lxam41eWRVR1dWL1hLRDhLd2tLSUpJQWcvaHpNbXkrRVR1
+TEw0Ci0+IHNzaC1lZDI1NTE5IGhrYnR2ZyArcVNUZkw2UUZOR2FJN0pLbW5CYkh1
+VXRlZm9BZVFPK2gzdjRONlRFZG1VCmdhQTFldE1BenJRODJTNGtrcGhXRFZkMzdJ
+ejJuTDdhYXU4bGxQejR5VUkKLT4gc3NoLWVkMjU1MTkgQmFRbFJnIEhrUjJFcnpW
+bTN6U0VuMGt1eFFvQ0tsdkdXRWx5MnI1VWo1cnBwVzN2WE0KMW1TNFUzcnJrUCtS
+MjZvdTl5YkdraGFHR2ZSRFZVWXR1a2pzendZSVl5QQotPiBzc2gtZWQyNTUxOSA2
+MkpjY0EgL01GbitCRkFZc2JYRjFwMm9ldXBzNFRZV3E1d2lrT0MzVWxCZjN4Wmgx
+bwpydC9mVDc4S2hrMlQyQWx3czI5UU1Remkxc3hMM3pNUjBxbmg3WmVLYVpNCi0+
+IHNzaC1lZDI1NTE5IC9oeC9kQSB0VWI4ak1NNFY0TUgyU2htUWwvOVJtVktBRnow
+VkFvNFBzRTdES1hlQ3lvClhRZnljWUNDcEUwU0tYZDhtUDdpeXBvWTBNanAvQlJ4
+R3VFaFNhVlZiR28KLT4gc3NoLWVkMjU1MTkgSEovSjdBIHM0eFkrY2h2RFZrMHBx
+YWozVXZzY0NUN3VUcWlWSVZzazg0N1NFSVBCM1UKYkhxRmREQUJycFJBSkFoYjFr
+d05XL2lrNGZRVG9YTTBLeEJaSnZoWUZMawotPiBzc2gtZWQyNTUxOSAvRUpYdmcg
+N3VRc29jRGhaejhnTS9zVCsxdzF2RC9qL3A3Y05ySTN4TUtQcjhNYUtqQQpNVm03
+QmwyZXg1M0twRzRBTkoyU1BidHpqSmFzQTl3K1BKUGtRSDlySFlzCi0+IFgyNTUx
+OSB3Z2EyVGtUOHk0TCtsVGxNbEZZZTl4bThucFJaNFplNUplRmNia3JSZ1M4CkhN
+NEl0Mmk5S0c0Qk0wTy9NeGgvTVRXUUtlSXQ1dTZBVTJDRC9lc2xEU2cKLT4gWFIm
+YiItZ3JlYXNlIG8zdCA8IFogJ3AvdQpuNFhTZFF1RXpHeDZtbHJkZ2ttdmU1Nm80
+MnRPaXlDUzNCUEhIN1kKLS0tIEF2OXBJQW1rbmozdXZOeU1PV3pnSEljVmhVb1lC
+ZVhzVzhzYW5XbFB6Q1UKy8FeP1uH8ADKxwM5CTqy5btqMdv5lxSQnacScFSNcIbj
+8qgMlbjx3siYJUdTFzp3lBymeMBfMSh3tMfGvvWqwPSaDYGb3CjYyllUkPxh0CL8
+TjlnIZIjloamI5tA+EQNc3zEXuv6gvXKBu01t88zZOfuA3U+kWG3f/2sgvhK4peg
+D0C37c2jWq4KIw==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/vaultwarden.env.age
+++ b/secrets/vaultwarden.env.age
@ -1,12 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEhKL0o3QSBzdXlh
-VFM2ak5uNUhLL0w0UlNZMDJCY0F5R0tTN1JJYXdtNWlSaEZIZ1RZCmRmcUJGQm1Q
-L2RyZndBaHFYQjJRT0hRK3FibnNHK01xWC9ZRmhRY1NiWGsKLT4gWDI1NTE5IGU3
-MUF5ZTdLdnphUGZMUTZlVDRRdVE4R2Q5TGxsU0xyTHZNSkpIejdleXcKSmJPby9Y
-NnczckZOY24rZCszNVVlLy9ISisxZVZZa05LYzIvcTl1b1pnQQotPiBILygtZ3Jl
-YXNlIHItcFE/IW5aIDIyXCB4cVVoIFIKMTZUeGNQdUIrOVBBQU5RM1hUTQotLS0g
-NEZoenZIRFR0bUlqWlZkOEJIaEZBaDVUL1JCS2JxeWFGNFBPS0JNYldGYwqwsDp+
-nLFXQs+W8dAT4hMecQpm1RuZoFJijH8L9v0PZNiNzaxHRsx4KsWJBStX9F1laGeK
-mm6eXQqwwk/EO1E5cydJKBuH9DcQcF4pjkPI5stX9HmGu/CzqYRlScd8eFsln50C
-nXjB271Oy7j2N2rIc9sygNb14N0vFh5P8eY2hIxf4XaYD3ZMUBOPkg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEhKL0o3QSA0MEVj
+ajhVUlRvUk1EUHF1aWxxdmkzL1U0dEZsTXNGQ25zdDRnQloxajNjClRvYnhIRXdr
+TjYyWVk0R25Odml1dW05VVh5bVo3cmVFUlM3b0tWYUFhUW8KLT4gWDI1NTE5IDN5
+NDE2Q1ptNy8xT0twTzdoNHJTUms3Vll6elBvaU5nOWxwS29ybG5sQWsKekZwc3Fq
+N1JrcTNGNkFQOVpMVXpLUzI4NE9nZ3V2WVdFT2tOSzc5aENFbwotPiBuNS1ncmVh
+c2UgVU5AKmZ4ICs6R21DIElzTit4JgpuWGdYUEkySlBDdmhYN2hmNXBxRCtreXFw
+YkVnV3JYTjNCYVBrZStMNWMrYmJxQmlNZGJvS084OEd4V0FoaUhKCmtaNDhjaGVR
+RC9Gcnh0WTJNcWxEMVltbnFMNWZSN1pmUHh6bwotLS0gOHdWR1p1NEFaOGJCRzQ3
+OGFsUi9JRy9VcVVCK3RsdmRmanBsSiswdHd2WQp5cmVtkg2KgLXeQjt586jpszpo
+hdWVyVpRUT/9+7SS+7pt3g/kSTpE4jnQtHJ6Yqs8lTRnRJRjaQzKAV/vl38mw2kZ
+r2hGntzH24ocBBlQZV3uF0H+k33zq8/XY2CnXK88cSil0qTXFhwiE04e0wVSTOaD
+iyYF0R+geQib858mv9Ps+d/ZdiC+4ufjmQ==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/whale2/valheim.env.age
+++ b/secrets/whale2/valheim.env.age
@ -1,10 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC9FSlh2ZyBidFFO
-WWc1U2ZrOGdFQTVBa0hCTDBOalRYSTFPb3o0SzBxN0t1b1RLSzJzCmJEUlB5TDgw
-b3RqcTZMSmU5S2RiYVFVTEFSNTBEYzhxZjBEWjBTMU9QbmMKLT4gWDI1NTE5IHlq
-K2drWWNCQlhndkNseGNiWjVpMlF6NUdoempIOEw4TmptMkZnbHJTbE0KOUJYV0dx
-ZjdSQ0crWVNYenBIeEdIRm9DN2hNYUttdlA4Q3NleEFIc2tCawotPiAzUzE1Ji1n
-cmVhc2UgWX5kdQprdU9VCi0tLSBkVzBtbm8yOUFSRkNYb1dwOU9zbWRNUmtodEkr
-NVBrZzlaRG5JbldBZ2NJCqh9nc/hBHAhoxrEyRRrfjfZzyn5pSdq0EYotD9ysTUX
-flCc5RTOuNF9w2b1Rwb6hUus
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC9FSlh2ZyBkUHhJ
+UWVGL3R5S3lsTDF4aTFnS0FYRFJjWmF3azE1VkMrY3RiYTB4bXlvClBETEFBcG1a
+WWlLckpyc3d6NS9RL0loeGR0VFlnNFBTbXJpbjVqRCtSbE0KLT4gWDI1NTE5IEp1
+QXoxcE10djlNRVlXblg5WjVGSS9tVG1rb3l0VC9kN3BQOE5QZDhxZ3cKdkFhVncr
+MXZpWjdjQXJGOERjajQzYXhlVWxSQjUxMnozMHZzTWE5VElJVQotPiAkNyxmMS1n
+cmVhc2Ugd1d6fD1LWXAgfFRjbXg3T0sgNiw+aT0ifFEKMUpTa0kvVDZIclJhZ0Z0
+QWEyK01SMk5QNld0MWhqWTdkQzltdncxdmNmYkZXWldCTGlxeEROREVkd29SaTRW
+dApDMlNCQ0lHRjRXWWdORVlWCi0tLSBybmlxWHJSbXZweDVJemVsV0VpYXBybWNy
+UG9DaXI0d2orWjdiRFBSN2lFCp8m8bNEcr56+bz6qSz/UZWKGe7eYheNi8NM+2WM
+uvghtdP1UpbD0cySMNWS6qRCwHVX
 -----END AGE ENCRYPTED FILE-----