An attempt was made

.envrc

@@ -1,2 +1,2 @@
-nix_direnv_watch_file devshell/{default,commands,install,vm-tasks}.nix
+watch_file devshell/{default,commands,install,vm-tasks}.nix
 use flake

.gitea/workflows/installer.yaml

@@ -33,18 +33,18 @@ jobs:
       - name: Build installer ISO
         run: |
           nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.iso
-          ln -s "$(readlink result)"/iso/nixos-installer-devplayer0.iso \
+          ln -s "$(readlink result)"/iso/jackos-installer.iso \
-            nixos-installer-devplayer0-${{ steps.setup.outputs.short_rev }}.iso
+            jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
       - name: Build installer netboot archive
         run: |
           nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.netbootArchive
           ln -s "$(readlink result)" \
-            nixos-installer-devplayer0-netboot-${{ steps.setup.outputs.short_rev }}.tar
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar
 
       - name: Create release
         uses: https://gitea.com/actions/release-action@main
         with:
           title: Latest installer
           files: |
-            nixos-installer-devplayer0-${{ steps.setup.outputs.short_rev }}.iso
+            jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
-            nixos-installer-devplayer0-netboot-${{ steps.setup.outputs.short_rev }}.tar
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar

flake.lock

@@ -35,11 +35,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1698258239,
+        "lastModified": 1702969472,
-        "narHash": "sha256-qnhoYYIJ0L/P7H/f56lQUEvpzNlXh4sxuHpRERV+B44=",
+        "narHash": "sha256-IJP9sC+/gLUdWhm6TsnWpw6A1zQWUfn53ym63KeLXvU=",
         "owner": "zhaofengli",
         "repo": "attic",
-        "rev": "e9918bc6be268da6fa97af6ced15193d8a0421c0",
+        "rev": "bdafd64910bb2b861cf90fa15f1fc93318b6fbf6",
         "type": "github"
       },
       "original": {
@@ -95,26 +95,17 @@
     },
     "crane": {
       "inputs": {
-        "flake-compat": [
-          "attic",
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "attic",
-          "flake-utils"
-        ],
         "nixpkgs": [
           "attic",
           "nixpkgs"
-        ],
+        ]
-        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1677892403,
+        "lastModified": 1702918879,
-        "narHash": "sha256-/Wi0L1spSWLFj+UQxN3j0mPYMoc7ZoAujpUF/juFVII=",
+        "narHash": "sha256-tWJqzajIvYcaRWxn+cLUB9L9Pv4dQ3Bfit/YjU5ze3g=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "105e27adb70a9890986b6d543a67761cbc1964a2",
+        "rev": "7195c00c272fdd92fc74e7d5a0a2844b9fadb2fb",
         "type": "github"
       },
       "original": {
@@ -185,11 +176,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1698921442,
+        "lastModified": 1703087360,
-        "narHash": "sha256-7KmvhQ7FuXlT/wG4zjTssap6maVqeAMBdtel+VjClSM=",
+        "narHash": "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "660180bbbeae7d60dad5a92b30858306945fd427",
+        "rev": "b709d63debafce9f5645a5ba550c9e0983b3d1f7",
         "type": "github"
       },
       "original": {
@@ -241,14 +232,14 @@
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
-        "systems": "systems_3"
+        "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1698410321,
+        "lastModified": 1701787589,
-        "narHash": "sha256-MphuSlgpmKwtJncGMohryHiK55J1n6WzVQ/OAfmfoMc=",
+        "narHash": "sha256-ce+oQR4Zq9VOsLoh9bZT8Ip9PaMLcjjBUHVPzW5d7Cw=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "1aed986e3c81a4f6698e85a7452cbfcc4b31a36e",
+        "rev": "44ddedcbcfc2d52a76b64fb6122f209881bd3e1e",
         "type": "github"
       },
       "original": {
@@ -276,11 +267,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1668681692,
+        "lastModified": 1696426674,
-        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -418,14 +409,14 @@
     },
     "flake-utils_7": {
       "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1694529238,
+        "lastModified": 1701680307,
-        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {
@@ -451,7 +442,7 @@
     },
     "flake-utils_9": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_6"
       },
       "locked": {
         "lastModified": 1681202837,
@@ -474,11 +465,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700814205,
+        "lastModified": 1703367386,
-        "narHash": "sha256-lWqDPKHRbQfi+zNIivf031BUeyciVOtwCwTjyrhDB5g=",
+        "narHash": "sha256-FMbm48UGrBfOWGt8+opuS+uLBLQlRfhiYXhHNcYMS5k=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "aeb2232d7a32530d3448318790534d196bf9427a",
+        "rev": "d5824a76bc6bb93d1dce9ebbbcb09a9b6abcc224",
         "type": "github"
       },
       "original": {
@@ -494,11 +485,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1701433070,
+        "lastModified": 1703754036,
-        "narHash": "sha256-Gf9JStfENaUQ7YWFz3V7x/srIwr4nlnVteqaAxtwpgM=",
+        "narHash": "sha256-JpJdcj9Tg4lMuYikXDpajA8wOp+rHyn9RD2rKBEM4cQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4a8545f5e737a6338814a4676dc8e18c7f43fc57",
+        "rev": "c24c298562fe41b39909f632c5a7151bbf6b4628",
         "type": "github"
       },
       "original": {
@@ -508,11 +499,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1697303681,
+        "lastModified": 1703656108,
-        "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
+        "narHash": "sha256-hCSUqdFJKHHbER8Cenf5JRzjMlBjIdwdftGQsO0xoJs=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
+        "rev": "033643a45a4a920660ef91caa391fbffb14da466",
         "type": "github"
       },
       "original": {
@@ -531,13 +522,13 @@
       "locked": {
         "lastModified": 1685908677,
         "narHash": "sha256-E4zUPEUFyVWjVm45zICaHRpfGepfkE9Z2OECV9HXfA4=",
-        "owner": "guibou",
+        "owner": "nix-community",
         "repo": "nixGL",
         "rev": "489d6b095ab9d289fe11af0219a9ff00fe87c7c5",
         "type": "github"
       },
       "original": {
-        "owner": "guibou",
+        "owner": "nix-community",
         "repo": "nixGL",
         "type": "github"
       }
@@ -560,11 +551,11 @@
     },
     "nixpkgs-mine": {
       "locked": {
-        "lastModified": 1701607327,
+        "lastModified": 1703756459,
-        "narHash": "sha256-pHX6S1mrUSFVq6v0HiZuShfXLL01wiWvgivCabX2x+M=",
+        "narHash": "sha256-ztEMyPQZh3Pb+LOoWl5lbIK2LenP59sOUBC86CDmLio=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "c8af66cb9046a65cbab33563f804b7bad46173af",
+        "rev": "e80160eb2ac3a7111d07cc43a15c16b9edca01ea",
         "type": "github"
       },
       "original": {
@@ -576,11 +567,11 @@
     },
     "nixpkgs-mine-stable": {
       "locked": {
-        "lastModified": 1701607437,
+        "lastModified": 1703756491,
-        "narHash": "sha256-ozMDOyJtxr/CznI6lrwtt9JkU32Y2cLr2B4vlW85Tfw=",
+        "narHash": "sha256-9VL34e0gzomwqRnryRn23V2ImYcaZIQdp7CsWg5TmlE=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "67ef05e2dd98d1fd856028eba1bb4edb847f6c6e",
+        "rev": "36611f5f7cfd401f51ad4ca76fd6ee85a714bb74",
         "type": "github"
       },
       "original": {
@@ -592,11 +583,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1701389149,
+        "lastModified": 1703467016,
-        "narHash": "sha256-rU1suTIEd5DGCaAXKW6yHoCfR1mnYjOXQFOaH7M23js=",
+        "narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5de0b32be6e85dc1a9404c75131316e4ffbc634c",
+        "rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
         "type": "github"
       },
       "original": {
@@ -607,11 +598,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1701253981,
+        "lastModified": 1703438236,
-        "narHash": "sha256-ztaDIyZ7HrTAfEEUt9AtTDNoCYxUdSd6NrRHaYOIxtk=",
+        "narHash": "sha256-aqVBq1u09yFhL7bj1/xyUeJjzr92fXVvQSSEx6AdB1M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e92039b55bcd58469325ded85d4f58dd5a4eaf58",
+        "rev": "5f64a12a728902226210bf01d25ec6cbb9d9265b",
         "type": "github"
       },
       "original": {
@@ -678,7 +669,7 @@
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
         "lastModified": 1682237245,
@@ -715,33 +706,6 @@
       }
     },
     "rust-overlay": {
-      "inputs": {
-        "flake-utils": [
-          "attic",
-          "crane",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "attic",
-          "crane",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1675391458,
-        "narHash": "sha256-ukDKZw922BnK5ohL9LhwtaDAdCsJL7L6ScNEyF1lO9w=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "383a4acfd11d778d5c2efcf28376cbd845eeaedf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
       "inputs": {
         "flake-utils": [
           "ragenix",
@@ -862,13 +826,31 @@
         "type": "github"
       }
     },
-    "utils": {
+    "systems_6": {
       "locked": {
-        "lastModified": 1667395993,
+        "lastModified": 1681028828,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {

flake.nix

@@ -26,7 +26,7 @@
     impermanence.url = "github:nix-community/impermanence";
     boardie.url = "github:devplayer0/boardie";
     boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    nixGL.url = "github:guibou/nixGL";
+    nixGL.url = "github:nix-community/nixGL";
     nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
     # Packages not in nixpkgs
@@ -63,7 +63,7 @@
         flake = flake-utils.lib;
       };
       pkgsLibOverlay = final: prev: { lib = prev.lib.extend libOverlay; };
-      myPkgsOverlay = final: prev: import ./pkgs { lib = prev.lib; pkgs = prev; };
+      myPkgsOverlay = final: prev: import ./pkgs { lib = final.lib; pkgs = prev; };
 
       # Override the flake-level lib since we're going to use it for non-config specific stuff
       pkgsFlakes = mapAttrs (_: pkgsFlake: pkgsFlake // { lib = pkgsFlake.lib.extend libOverlay; }) {
@@ -129,7 +129,7 @@
         modules = [
           {
             _module.args = {
-              inherit lib pkgsFlakes hmFlakes inputs;
+              inherit lib pkgsFlakes hmFlakes self inputs;
               pkgs' = configPkgs';
             };
 

home-manager/modules/common.nix

@@ -80,6 +80,7 @@ in
 
         tmux = {
           enable = true;
+          keyMode = "vi";
         };
 
         bash = {

lib/constants.nix

@@ -26,7 +26,7 @@ rec {
     latest = pkgs: pkgs.linuxKernel.packages.linux_6_6;
   };
 
-  nginx = {
+  nginx = rec {
     proxyHeaders = ''
       # Setting any proxy_header in a child (e.g. location) will nuke the parents...
       proxy_set_header X-Origin-URI $request_uri;
@@ -40,6 +40,45 @@ rec {
       proxy_set_header X-Forwarded-Protocol $scheme;
       proxy_set_header X-Scheme $scheme;
     '';
+    baseHttpConfig = ''
+      # NixOS provides a logrotate config that auto-compresses :)
+      log_format main
+        '$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
+      access_log /var/log/nginx/access.log main;
+
+      # optimisation
+      sendfile on;
+      tcp_nopush on;
+      tcp_nodelay on;
+      keepalive_timeout 65;
+
+      # gzip
+      gzip on;
+      gzip_proxied any;
+      gzip_comp_level 5;
+      gzip_types
+        application/atom+xml
+        application/javascript
+        application/json
+        application/xml
+        application/xml+rss
+        image/svg+xml
+        text/css
+        text/javascript
+        text/plain
+        text/xml;
+      gzip_vary on;
+
+      # proxying
+      proxy_buffering off;
+      proxy_redirect off;
+      proxy_connect_timeout 60s;
+      proxy_read_timeout 60s;
+      proxy_send_timeout 60s;
+      proxy_http_version 1.1;
+
+      ${proxyHeaders}
+    '';
   };
 
   networkd = {
@@ -130,6 +169,18 @@ rec {
         port = 8448;
         dst = aa.middleman.internal.ipv4.address;
       }
+      {
+        port = 25565;
+        dst = aa.simpcraft-oci.internal.ipv4.address;
+      }
+      {
+        port = 25566;
+        dst = aa.simpcraft-staging-oci.internal.ipv4.address;
+      }
+      {
+        port = 25575;
+        dst = aa.simpcraft-oci.internal.ipv4.address;
+      }
 
       {
         port = 2456;
@@ -141,6 +192,18 @@ rec {
         dst = aa.valheim-oci.internal.ipv4.address;
         proto = "udp";
       }
+
+      {
+        port = 41641;
+        dst = aa.waffletail.internal.ipv4.address;
+        proto = "udp";
+      }
+
+      {
+        port = 25565;
+        dst = aa.simpcraft-oci.internal.ipv4.address;
+        proto = "udp";
+      }
     ];
 
     fstrimConfig = {
@@ -164,7 +227,7 @@ rec {
       "stream"
     ];
     routersPubV4 = [
-      "109.255.31.25"
+      "109.255.1.246"
       "109.255.252.63"
     ];
 
@@ -229,6 +292,34 @@ rec {
     assignedV6 = "2001:19f0:7402:128b:5400:04ff:feac:6e06";
   };
 
+  tailscale = {
+    prefix = {
+      v4 = "100.64.0.0/10";
+      v6 = "fd7a:115c:a1e0::/48";
+    };
+  };
+
+  as211024 = rec {
+    trusted = {
+      v4 = [
+        colony.prefixes.as211024.v4
+        colony.prefixes.all.v4
+        home.prefixes.all.v4
+        tailscale.prefix.v4
+      ];
+      v6 = [
+        colony.prefixes.as211024.v6
+        colony.prefixes.all.v6
+        home.prefixes.all.v6
+        tailscale.prefix.v6
+      ];
+    };
+    nftTrust = ''
+      iifname as211024 ip saddr { ${concatStringsSep ", " trusted.v4} } accept
+      iifname as211024 ip6 saddr { ${concatStringsSep ", " trusted.v6} } accept
+    '';
+  };
+
   kelder = {
     groups = {
       storage = 2000;

lib/default.nix

@@ -1,10 +1,11 @@
 { lib }:
 let
-  inherit (builtins) length match elemAt filter replaceStrings;
+  inherit (builtins) length match elemAt filter replaceStrings substring;
   inherit (lib)
     genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
     mkOption mkOverride mkForce mkIf mergeEqualOption optional
-    showWarnings concatStringsSep flatten unique optionalAttrs;
+    showWarnings concatStringsSep flatten unique optionalAttrs
+    mkBefore;
   inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -166,7 +167,7 @@ rec {
 
   systemdAwaitPostgres = pkg: host: {
     after = [ "systemd-networkd-wait-online.service" ];
-    preStart = ''
+    preStart = mkBefore ''
       until ${pkg}/bin/pg_isready -h ${host}; do
         sleep 0.5
       done
@@ -239,4 +240,18 @@ rec {
 
     filterOpts = filterAttrsRecursive (_: v: v != null);
   };
+
+  versionOverlay = { self, pkgsFlake }: final: prev:
+  let
+    date = substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101");
+    revCode = flake: flake.shortRev or "dirty";
+  in
+  {
+    trivial = prev.trivial // {
+      release = "23.12:u-${prev.trivial.release}";
+      codeName = "Amogus";
+      revisionWithDefault = default: self.rev or default;
+      versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
+    };
+  };
 }

nixos/boxes/britway/default.nix

@@ -1,6 +1,7 @@
 { lib, ... }:
 let
   inherit (lib.my) net;
+  inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.britway) prefixes domain pubV4 assignedV6;
 in
 {
@@ -39,6 +40,8 @@ in
         imports = [
           "${modulesPath}/profiles/qemu-guest.nix"
           ./bgp.nix
+          ./nginx.nix
+          ./tailscale.nix
         ];
 
         config = mkMerge [
@@ -80,6 +83,10 @@ in
             networking = { inherit domain; };
 
             systemd.network = {
+              config = {
+                routeTables.ts-extra = 1337;
+              };
+
               links = {
                 "10-veth0" = {
                   matchConfig.PermanentMACAddress = "56:00:04:ac:6e:06";
@@ -91,7 +98,7 @@ in
                 "20-veth0" = mkMerge [
                   (networkdAssignment "veth0" assignments.vultr)
                   {
-                    address = [ assignedV6 ];
+                    address = [ "${assignedV6}/64" ];
                   }
                 ];
                 "90-l2mesh-as211024" = mkMerge [
@@ -99,6 +106,30 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
+                    routes = map (r: { routeConfig = r; }) [
+                      {
+                        Destination = lib.my.c.colony.prefixes.all.v4;
+                        Gateway = allAssignments.estuary.as211024.ipv4.address;
+                      }
+                      {
+                        Destination = lib.my.c.home.prefixes.all.v4;
+                        Gateway = lib.my.c.home.vips.as211024.v4;
+                      }
+
+                      {
+                        # Just when routing traffic from Tailscale nodes, otherwise use WAN
+                        Destination = lib.my.c.colony.prefixes.all.v6;
+                        Gateway = allAssignments.estuary.as211024.ipv6.address;
+                        Table = "ts-extra";
+                      }
+                    ];
+                    routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+                      {
+                        IncomingInterface = "tailscale0";
+                        To = lib.my.c.colony.prefixes.all.v6;
+                        Table = "ts-extra";
+                      }
+                    ];
                   }
                 ];
               };
@@ -119,7 +150,21 @@ in
               };
 
               firewall = {
-                trustedInterfaces = [ "as211024" ];
+                trustedInterfaces = [ "tailscale0" ];
+                extraRules = ''
+                  table inet filter {
+                    chain forward {
+                      ${lib.my.c.as211024.nftTrust}
+                      oifname as211024 accept
+                    }
+                  }
+                  table inet nat {
+                    chain postrouting {
+                      iifname tailscale0 oifname veth0 snat ip to ${assignments.vultr.ipv4.address}
+                      iifname tailscale0 oifname veth0 snat ip6 to ${assignments.as211024.ipv6.address}
+                    }
+                  }
+                '';
               };
             };
           }

nixos/boxes/britway/nginx.nix

@@ -0,0 +1,109 @@
+{ lib, pkgs, config, ... }:
+let
+  inherit (builtins) mapAttrs;
+  inherit (lib) mkMerge mkDefault;
+  inherit (lib.my.c) pubDomain;
+  inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
+in
+{
+  config = {
+    my = {
+      secrets.files = {
+        "dhparams.pem" = {
+          owner = "acme";
+          group = "acme";
+          mode = "440";
+        };
+        "britway/cloudflare-credentials.conf" = {
+          owner = "acme";
+          group = "acme";
+        };
+      };
+
+      firewall = {
+        tcp.allowed = [ "http" "https" ];
+      };
+    };
+
+    users = {
+      users = {
+        nginx.extraGroups = [ "acme" ];
+      };
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "dev@nul.ie";
+        server = "https://acme-v02.api.letsencrypt.org/directory";
+        reloadServices = [ "nginx" ];
+        dnsResolver = "8.8.8.8";
+      };
+      certs = {
+        "${pubDomain}" = {
+          extraDomainNames = [
+            "*.${pubDomain}"
+          ];
+          dnsProvider = "cloudflare";
+          credentialsFile = config.age.secrets."britway/cloudflare-credentials.conf".path;
+        };
+      };
+    };
+
+    services = {
+      nginx = {
+        enable = true;
+        enableReload = true;
+
+        logError = "stderr info";
+        recommendedTlsSettings = true;
+        serverTokens = true;
+        sslDhparam = config.age.secrets."dhparams.pem".path;
+
+        # Based on recommended*Settings, but probably better to be explicit about these
+        appendHttpConfig = ''
+          ${baseHttpConfig}
+
+          # caching
+          proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=512m;
+        '';
+
+        virtualHosts =
+        let
+          hosts = {
+            "_" = {
+              default = true;
+              forceSSL = true;
+              onlySSL = false;
+              locations = {
+                "/".root = "${pkgs.nginx}/html";
+              };
+            };
+
+            "ts.${pubDomain}" = {
+              locations."/" = {
+                proxyPass = "http://localhost:${toString config.services.headscale.port}";
+                proxyWebsockets = true;
+                extraConfig = ''
+                  proxy_buffering off;
+                  add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+                '';
+              };
+            };
+          };
+
+          defaultsFor = mapAttrs (n: _: {
+            onlySSL = mkDefault true;
+            useACMEHost = mkDefault pubDomain;
+            kTLS = mkDefault true;
+            http2 = mkDefault true;
+          });
+        in
+        mkMerge [
+          hosts
+          (defaultsFor hosts)
+        ];
+      };
+    };
+  };
+}

nixos/boxes/britway/tailscale.nix

@@ -0,0 +1,110 @@
+{ lib, pkgs, config, assignments, allAssignments, ... }:
+let
+  inherit (lib) concatStringsSep;
+  inherit (lib.my.c) pubDomain;
+  inherit (lib.my.c.britway) prefixes domain;
+
+  # Can't use overrideAttrs because we need to override `vendorHash` within `buildGoModule`
+  headscale = pkgs.headscale.override {
+    buildGoModule = args: pkgs.buildGoModule (args // rec {
+      version = "0.23.0-alpha2";
+      src = pkgs.fetchFromGitHub {
+        owner = "juanfont";
+        repo = "headscale";
+        rev = "v${version}";
+        hash = "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=";
+      };
+      vendorHash = "sha256-u9AmJguQ5dnJpfhOeLN43apvMHuraOrJhvlEIp9RoIc=";
+    });
+  };
+
+  advRoutes = concatStringsSep "," [
+    lib.my.c.home.prefixes.all.v4
+    lib.my.c.home.prefixes.all.v6
+  ];
+  pubNameservers = [
+    "1.1.1.1"
+    "1.0.0.1"
+    "2606:4700:4700::1111"
+    "2606:4700:4700::1001"
+  ];
+in
+{
+  config = {
+    environment.systemPackages = [
+      # For CLI
+      config.services.headscale.package
+    ];
+
+    services = {
+      headscale = {
+        enable = true;
+        package = headscale;
+        settings = {
+          disable_check_updates = true;
+          unix_socket_permission = "0770";
+          server_url = "https://ts.${pubDomain}";
+          db_type = "sqlite3";
+          db_path = "/var/lib/headscale/db.sqlite3";
+          noise.private_key_path = "/var/lib/headscale/noise_private.key";
+          ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ];
+          dns_config = {
+            # Use IPs that will route inside the VPN to prevent interception
+            # (e.g. DNS rebinding filtering)
+            restricted_nameservers = {
+              "${domain}" = pubNameservers;
+              "${lib.my.c.colony.domain}" = with allAssignments.estuary.base; [
+                ipv4.address ipv6.address
+              ];
+              "${lib.my.c.home.domain}" = with allAssignments; [
+                river.hi.ipv4.address
+                river.hi.ipv6.address
+                stream.hi.ipv4.address
+                stream.hi.ipv6.address
+              ];
+            };
+            magic_dns = true;
+            base_domain = "ts.${pubDomain}";
+            override_local_dns = false;
+          };
+          oidc = {
+            only_start_if_oidc_is_available = true;
+            issuer = "https://accounts.google.com";
+            client_id = "545475967061-l45cln081mp8t4li2c34v7t7b8la6f4f.apps.googleusercontent.com";
+            client_secret_path = config.age.secrets."britway/oidc-secret.txt".path;
+            scope = [ "openid" "profile" "email" ];
+            allowed_users = [ "jackos1998@gmail.com" ];
+          };
+        };
+      };
+
+      tailscale = {
+        enable = true;
+        authKeyFile = config.age.secrets."tailscale-auth.key".path;
+        openFirewall = true;
+        interfaceName = "tailscale0";
+        extraUpFlags = [
+          "--operator=${config.my.user.config.name}"
+          "--login-server=https://ts.nul.ie"
+          "--netfilter-mode=off"
+          "--advertise-exit-node"
+          "--advertise-routes=${advRoutes}"
+          "--accept-routes=false"
+        ];
+      };
+    };
+
+    my = {
+      secrets = {
+        files = {
+          "britway/oidc-secret.txt" = {
+            owner = "headscale";
+            group = "headscale";
+            mode = "440";
+          };
+          "tailscale-auth.key" = {};
+        };
+      };
+    };
+  };
+}

nixos/boxes/colony/default.nix

@@ -66,10 +66,21 @@ in
             };
           });
           kernelModules = [ "kvm-amd" ];
-          kernelParams = [ "amd_iommu=on" "console=ttyS0,115200n8" "console=ttyS1,115200n8" "console=tty0" ];
+          kernelParams = [
+            "amd_iommu=on"
+            "console=ttyS0,115200n8" "console=ttyS1,115200n8" "console=tty0"
+            "systemd.setenv=SYSTEMD_SULOGIN_FORCE=1"
+          ];
           initrd = {
             kernelModules = [ "dm-raid" ];
             availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+            systemd = {
+              enable = true;
+              # Onlu activate volumes needed for boot to prevent thin check from getting killed while switching root
+              contents."/etc/lvm/lvm.conf".text = ''
+                activation/auto_activation_volume_list = [ "main/colony-nix" "main/colony-persist" ]
+              '';
+            };
           };
         };
 
@@ -137,6 +148,15 @@ in
           services = {
             "serial-getty@ttyS0".enable = true;
             "serial-getty@ttyS1".enable = true;
+            lvm-activate-main = {
+              description = "Activate remaining LVs";
+              before = [ "local-fs-pre.target" ];
+              serviceConfig = {
+                Type = "oneshot";
+                ExecStart = "${pkgs.lvm2.bin}/bin/vgchange -aay main";
+              };
+              wantedBy = [ "sysinit.target" ];
+            };
 
             rsync-lvm-meta = {
               description = "rsync lvm metadata backups / archives to rsync.net";
@@ -248,6 +268,14 @@ in
                       Destination = allAssignments.shill.internal.ipv4.address;
                       Gateway = allAssignments.shill.routing.ipv4.address;
                     }
+                    {
+                      Destination = lib.my.c.tailscale.prefix.v4;
+                      Gateway = allAssignments.shill.routing.ipv4.address;
+                    }
+                    {
+                      Destination = lib.my.c.tailscale.prefix.v6;
+                      Gateway = allAssignments.shill.internal.ipv6.address;
+                    }
 
                     {
                       Destination = prefixes.oci.v4;

nixos/boxes/colony/vms/default.nix

@@ -120,7 +120,7 @@
               cpus = 12;
               threads = 2;
             };
-            memory = 49152;
+            memory = 40960;
             networks.vms.mac = "52:54:00:27:3d:5c";
             cleanShutdown.timeout = 120;
             drives = [ ] ++ (optionals (!config.my.build.isDevVM) [
@@ -160,7 +160,7 @@
               cpus = 12;
               threads = 2;
             };
-            memory = 32768;
+            memory = 40960;
             networks.vms.mac = "52:54:00:75:78:a8";
             cleanShutdown.timeout = 120;
             drives = [
@@ -181,7 +181,7 @@
               cpus = 3;
               threads = 2;
             };
-            memory = 8192;
+            memory = 6144;
             networks.public = {
               bridge = null;
               mac = "52:54:00:a8:d1:03";

nixos/boxes/colony/vms/estuary/bgp.nix

@@ -27,7 +27,9 @@ in
           define HOMENET6 = ${homenet6};
 
           define OWNIP6 = ${assignments.base.ipv6.address};
-          define OWNNETSET6 = [ ${intnet6}, ${amsnet6}, ${homenet6} ];
+          # we have issues with sending ICMPv6 too big back on the wrong interface right now...
+          define OWNNETSET6 = [ ${intnet6}, ${amsnet6} ];
+          define CCNETSET6 = [ ];
           #define TRANSSET6 = [ ::1/128 ];
 
           define DUB1IP6 = ${lib.my.c.home.vips.as211024.v6};
@@ -42,7 +44,7 @@ in
             if net ~ OWNNETSET4 || net ~ OWNNETSET6 then accept; else reject;
           }
           filter bgp_export_cc {
-            if net ~ OWNNETSET4 || net ~ OWNNETSET6 || net ~ CCNETSET4 then accept; else reject;
+            if net ~ OWNNETSET4 || net ~ OWNNETSET6 || net ~ CCNETSET4 || net ~ CCNETSET6 then accept; else reject;
           }
 
           router id from "wan";
@@ -188,10 +190,12 @@ in
           protocol bgp upstream6_coloclue_eun2 from upstream_bgp6 {
             description "ColoClue euNetworks 2 (IPv6)";
             neighbor 2a02:898:0:20::e2 as 8283;
+            ipv6 { export filter bgp_export_cc; };
           }
           protocol bgp upstream6_coloclue_eun3 from upstream_bgp6 {
             description "ColoClue euNetworks 3 (IPv6)";
             neighbor 2a02:898:0:20::e1 as 8283;
+            ipv6 { export filter bgp_export_cc; };
           }
 
           protocol bgp upstream6_ifog from upstream_bgp6 {

nixos/boxes/colony/vms/estuary/default.nix

@@ -298,6 +298,15 @@ in
                           Destination = prefixes.cust.v6;
                           Gateway = allAssignments.colony.internal.ipv6.address;
                         }
+
+                        {
+                          Destination = lib.my.c.tailscale.prefix.v4;
+                          Gateway = allAssignments.colony.routing.ipv4.address;
+                        }
+                        {
+                          Destination = lib.my.c.tailscale.prefix.v6;
+                          Gateway = allAssignments.colony.internal.ipv6.address;
+                        }
                       ] ++
                       (map (pName: [
                         {
@@ -317,6 +326,12 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
+                    routes = map (r: { routeConfig = r; }) [
+                      {
+                        Destination = lib.my.c.home.prefixes.all.v4;
+                        Gateway = lib.my.c.home.vips.as211024.v4;
+                      }
+                    ];
                   }
                 ];
                 "95-kelder" = {
@@ -351,7 +366,6 @@ in
                 };
               };
               firewall = {
-                trustedInterfaces = [ "as211024" ];
                 udp.allowed = [ 5353 lib.my.c.kelder.vpn.port ];
                 tcp.allowed = [ 5353 "bgp" ];
                 nat = {
@@ -379,12 +393,16 @@ in
                       # Safe enough to allow all SSH
                       tcp dport ssh accept
 
-                      ${matchInet "tcp dport { http, https, 8448 } accept" "middleman"}
+                      ip6 daddr ${aa.middleman.internal.ipv6.address} tcp dport { http, https, 8448 } accept
-                      ${matchInet "udp dport { 2456-2457 } accept" "valheim-oci"}
+                      ${matchInet "tcp dport { http, https } accept" "git"}
-
+                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport { 25565, 25575 } accept
+                      ip6 daddr ${aa.simpcraft-staging-oci.internal.ipv6.address} tcp dport 25565 accept
                       return
                     }
                     chain routing-udp {
+                      ip6 daddr ${aa.valheim-oci.internal.ipv6.address} udp dport { 2456-2457 } accept
+                      ip6 daddr ${aa.waffletail.internal.ipv6.address} udp dport 41641 accept
+                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} udp dport 25565 accept
                       return
                     }
                     chain filter-routing {
@@ -401,7 +419,8 @@ in
                     }
 
                     chain forward {
-                      iifname { wan, $ixps } oifname base jump filter-routing
+                      ${lib.my.c.as211024.nftTrust}
+                      iifname { wan, as211024, $ixps } oifname base jump filter-routing
                       oifname $ixps jump ixp
                       iifname base oifname { base, wan, $ixps } accept
                       oifname { as211024, kelder } accept
@@ -414,11 +433,9 @@ in
                   table inet nat {
                     chain prerouting {
                       ${matchInet "meta l4proto { udp, tcp } th dport domain redirect to :5353" "estuary"}
-                      ip daddr ${aa.git.internal.ipv4.address} tcp dport { http, https } dnat to ${aa.middleman.internal.ipv4.address}
-                      ip6 daddr ${aa.git.internal.ipv6.address} tcp dport { http, https } dnat to ${aa.middleman.internal.ipv6.address}
                     }
                     chain postrouting {
-                      ip saddr ${prefixes.all.v4} snat to ${assignments.internal.ipv4.address}
+                      ip saddr ${prefixes.all.v4} oifname != as211024 snat to ${assignments.internal.ipv4.address}
                     }
                   }
                 '';

nixos/boxes/colony/vms/estuary/dns.nix

@@ -52,7 +52,7 @@ in
           allowFrom = [
             "127.0.0.0/8" "::1/128"
             prefixes.all.v4 prefixes.all.v6
-          ];
+          ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
         };
 
         settings = {
@@ -145,9 +145,14 @@ in
 
             http IN A ${assignments.internal.ipv4.address}
             http IN AAAA ${allAssignments.middleman.internal.ipv6.address}
+            librespeed IN CNAME http.${config.networking.domain}.
 
             valheim IN A ${assignments.internal.ipv4.address}
             valheim IN AAAA ${allAssignments.valheim-oci.internal.ipv6.address}
+            simpcraft IN A ${assignments.internal.ipv4.address}
+            simpcraft IN AAAA ${allAssignments.simpcraft-oci.internal.ipv6.address}
+            simpcraft-staging IN A ${assignments.internal.ipv4.address}
+            simpcraft-staging IN AAAA ${allAssignments.simpcraft-staging-oci.internal.ipv6.address}
 
             mail-vm IN A ${net.cidr.host 0 prefixes.mail.v4}
             mail-vm IN AAAA ${net.cidr.host 1 prefixes.mail.v6}

nixos/boxes/colony/vms/git/default.nix

@@ -1,8 +1,11 @@
 { lib, ... }:
 let
+  inherit (builtins) mapAttrs;
+  inherit (lib) mkMerge mkDefault;
   inherit (lib.my) net;
   inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.colony) domain prefixes;
+  inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
 in
 {
   nixos.systems.git = {
@@ -72,9 +75,109 @@ in
               };
             };
 
+            users = {
+              users = {
+                nginx.extraGroups = [ "acme" ];
+              };
+            };
+
+            security.acme = {
+              acceptTerms = true;
+              defaults = {
+                email = "dev@nul.ie";
+                server = "https://acme-v02.api.letsencrypt.org/directory";
+                reloadServices = [ "nginx" ];
+                dnsResolver = "8.8.8.8";
+              };
+              certs = {
+                "${pubDomain}" = {
+                  extraDomainNames = [
+                    "*.${pubDomain}"
+                  ];
+                  dnsProvider = "cloudflare";
+                  credentialsFile = config.age.secrets."middleman/cloudflare-credentials.conf".path;
+                };
+              };
+            };
+
             services = {
               fstrim = lib.my.c.colony.fstrimConfig;
+              # Hacks for Jsch (Minecraft FastBack) to work
+              openssh = {
+                hostKeys = [
+                  {
+                    bits = 4096;
+                    path = "/etc/ssh/ssh_host_rsa_key";
+                    type = "rsa";
+                  }
+                  {
+                    path = "/etc/ssh/ssh_host_ed25519_key";
+                    type = "ed25519";
+                  }
+
+                  {
+                    type = "ecdsa-sha2-nistp256";
+                    path = "/etc/ssh/ssh_host_ecdsa_key";
+                  }
+                ];
+                settings = {
+                  Macs = [
+                    "hmac-sha2-512-etm@openssh.com"
+                    "hmac-sha2-256-etm@openssh.com"
+                    "umac-128-etm@openssh.com"
+
+                    "hmac-sha2-256"
+                  ];
+                };
+              };
               netdata.enable = true;
+              nginx = {
+                enable = true;
+                enableReload = true;
+
+                logError = "stderr info";
+                recommendedTlsSettings = true;
+                clientMaxBodySize = "0";
+                serverTokens = true;
+                sslDhparam = config.age.secrets."dhparams.pem".path;
+
+                # Based on recommended*Settings, but probably better to be explicit about these
+                appendHttpConfig = ''
+                  ${baseHttpConfig}
+
+                  # caching
+                  proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=512m;
+                '';
+
+                virtualHosts =
+                let
+                  hosts = {
+                    "_" = {
+                      default = true;
+                      forceSSL = true;
+                      onlySSL = false;
+                      locations = {
+                        "/".root = "${pkgs.nginx}/html";
+                      };
+                    };
+
+                    "git.${pubDomain}" = {
+                      locations."/".proxyPass = "http://localhost:3000";
+                    };
+                  };
+
+                  defaultsFor = mapAttrs (n: _: {
+                    onlySSL = mkDefault true;
+                    useACMEHost = mkDefault pubDomain;
+                    kTLS = mkDefault true;
+                    http2 = mkDefault true;
+                  });
+                in
+                mkMerge [
+                  hosts
+                  (defaultsFor hosts)
+                ];
+              };
             };
 
             virtualisation = {
@@ -104,11 +207,24 @@ in
             };
 
             my = {
-              secrets.key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+KINpHLMduBuW96JzfSRDLUzkI+XaCBghu5/wHiW5R";
+              secrets = {
+                key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+KINpHLMduBuW96JzfSRDLUzkI+XaCBghu5/wHiW5R";
+                files = {
+                  "dhparams.pem" = {
+                    owner = "acme";
+                    group = "acme";
+                    mode = "440";
+                  };
+                  "middleman/cloudflare-credentials.conf" = {
+                    owner = "acme";
+                    group = "acme";
+                  };
+                };
+              };
               server.enable = true;
 
               firewall = {
-                tcp.allowed = [ 19999 ];
+                tcp.allowed = [ 19999 "http" "https" ];
                 extraRules = ''
                   table inet filter {
                     chain forward {

nixos/boxes/colony/vms/git/gitea.nix

@@ -26,18 +26,6 @@ in
 
     systemd = {
       services = {
-        # TODO: Figure out a way to do this properly... redirecting localhost is awkward...
-        local-http-forward = {
-          description = "Forward local HTTP connections";
-          serviceConfig.ExecStart = "${pkgs.socat}/bin/socat tcp-listen:80,fork tcp:${allAssignments.middleman.internal.ipv4.address}:80";
-          wantedBy = [ "multi-user.target" ];
-        };
-        local-https-forward = {
-          description = "Forward local HTTPS connections";
-          serviceConfig.ExecStart = "${pkgs.socat}/bin/socat tcp-listen:443,fork tcp:${allAssignments.middleman.internal.ipv4.address}:443";
-          wantedBy = [ "multi-user.target" ];
-        };
-
         gitea = mkMerge [
           (lib.my.systemdAwaitPostgres pkgs.postgresql "colony-psql")
           {
@@ -141,21 +129,6 @@ in
           "gitea/minio.txt" = ownedByGit;
         };
       };
-
-      firewall.extraRules = ''
-        table inet filter {
-          chain input {
-            ip saddr ${prefixes.all.v4} tcp dport 3000 accept
-            ip6 saddr ${prefixes.all.v6} tcp dport 3000 accept
-          }
-        }
-        table inet nat {
-          chain prerouting {
-            ip daddr ${assignments.internal.ipv4.address} tcp dport { http, https } dnat to ${allAssignments.middleman.internal.ipv4.address}
-            ip6 daddr ${assignments.internal.ipv6.address} tcp dport { http, https } dnat to ${allAssignments.middleman.internal.ipv6.address}
-          }
-        }
-      '';
     };
   };
 }

nixos/boxes/colony/vms/shill/containers/default.nix

@@ -7,5 +7,6 @@
     ./jackflix
     ./object.nix
     ./toot.nix
+    ./waffletail.nix
   ];
 }

nixos/boxes/colony/vms/shill/containers/middleman/default.nix

@@ -2,6 +2,7 @@
 let
   inherit (lib.my) net;
   inherit (lib.my.c) pubDomain;
+  inherit (lib.my.c.nginx) baseHttpConfig;
   inherit (lib.my.c.colony) domain prefixes;
 in
 {
@@ -65,6 +66,7 @@ in
                   owner = "nginx";
                   group = "nginx";
                 };
+                "librespeed.toml" = { };
               };
             };
 
@@ -121,6 +123,19 @@ in
                 baseURL = "https://sso.${pubDomain}";
               };
             };
+
+            librespeed = {
+              frontend.servers = [
+                {
+                  name = "Amsterdam, Netherlands";
+                  server = "//librespeed.${domain}";
+                }
+              ];
+              backend = {
+                enable = true;
+                extraSettingsFile = config.age.secrets."librespeed.toml".path;
+              };
+            };
           };
 
           users = {
@@ -131,6 +146,10 @@ in
 
           systemd = {
             network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
+            services = {
+              # HACK: nginx seems to get stuck not being able to DNS early...
+              nginx = lib.my.systemdAwaitPostgres pkgs.postgresql "colony-psql";
+            };
           };
 
           security = {
@@ -231,43 +250,9 @@ in
 
               # Based on recommended*Settings, but probably better to be explicit about these
               appendHttpConfig = ''
-                # NixOS provides a logrotate config that auto-compresses :)
+                ${baseHttpConfig}
-                log_format main
-                  '$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
-                access_log /var/log/nginx/access.log main;
 
-                # optimisation
+                resolver_timeout 5s;
-                sendfile on;
-                tcp_nopush on;
-                tcp_nodelay on;
-                keepalive_timeout 65;
-
-                # gzip
-                gzip on;
-                gzip_proxied any;
-                gzip_comp_level 5;
-                gzip_types
-                  application/atom+xml
-                  application/javascript
-                  application/json
-                  application/xml
-                  application/xml+rss
-                  image/svg+xml
-                  text/css
-                  text/javascript
-                  text/plain
-                  text/xml;
-                gzip_vary on;
-
-                # proxying
-                proxy_buffering off;
-                proxy_redirect off;
-                proxy_connect_timeout 60s;
-                proxy_read_timeout 60s;
-                proxy_send_timeout 60s;
-                proxy_http_version 1.1;
-
-                ${lib.my.c.nginx.proxyHeaders}
 
                 # caching
                 proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=4g;

nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix

@@ -347,9 +347,41 @@ in
         };
         useACMEHost = pubDomain;
       };
+      "public.${pubDomain}" = {
+        serverAliases = [ "p.${pubDomain}" ];
+        locations."/" = {
+          root = "/mnt/media/public";
+          extraConfig = ''
+            fancyindex on;
+            fancyindex_show_dotfiles on;
+          '';
+        };
+        useACMEHost = pubDomain;
+      };
 
-      "git.${pubDomain}" = {
+      "mc-map.${pubDomain}" = {
-        locations."/".proxyPass = "http://git-vm.${domain}:3000";
+        locations."/".proxyPass = "http://simpcraft-oci.${domain}:8100";
+        useACMEHost = pubDomain;
+      };
+      "mc-rail.${pubDomain}" = {
+        locations."/".proxyPass = "http://simpcraft-staging-oci.${domain}:3876";
+        useACMEHost = pubDomain;
+      };
+
+      "librespeed.${domain}" = {
+        locations."/".proxyPass = "http://localhost:8989";
+      };
+      "speed.${pubDomain}" = {
+        locations."/".proxyPass = "http://localhost:8989";
+        useACMEHost = pubDomain;
+      };
+
+      "md.${pubDomain}" = {
+        locations."/" = {
+          proxyPass = "http://object-ctr.${domain}:3000";
+          proxyWebsockets = true;
+          extraConfig = proxyHeaders;
+        };
         useACMEHost = pubDomain;
       };
     };
@@ -387,7 +419,22 @@ in
       "s3.${pubDomain}" = {
         serverAliases = [ "*.s3.${pubDomain}" ];
         inherit extraConfig;
-        locations."/".proxyPass = s3Upstream;
+        locations = {
+          "/".proxyPass = s3Upstream;
+          "/gitea/packages/" = {
+            proxyPass = s3Upstream;
+            # HACK: Docker images need the MIME type to be correct for the manifest but Gitea
+            # doesn't tell S3... By hiding the header we can use add_header to set Content-Type
+            # (normally can't be set directly)
+            extraConfig = ''
+              proxy_hide_header Content-Type;
+              add_header Content-Type $upstream_http_content_type always;
+              if ($args ~ "response-content-disposition=.+filename%3D%22manifest\.json%22") {
+                add_header Content-Type "application/vnd.docker.distribution.manifest.v2+json";
+              }
+            '';
+          };
+        };
         useACMEHost = pubDomain;
       };
 

nixos/boxes/colony/vms/shill/containers/object.nix

@@ -48,11 +48,17 @@ in
                   group = config.my.user.config.group;
                 };
                 "object/atticd.env" = {};
+                "object/hedgedoc.env" = {};
               };
             };
 
             firewall = {
-              tcp.allowed = [ 9000 9001 config.services.sharry.config.bind.port 8069 ];
+              tcp.allowed = [
+                9000 9001
+                config.services.sharry.config.bind.port
+                8069
+                config.services.hedgedoc.settings.port
+              ];
             };
 
             user.homeConfig = {
@@ -194,6 +200,26 @@ in
                 };
               };
             };
+
+            hedgedoc = {
+              enable = true;
+              environmentFile = config.age.secrets."object/hedgedoc.env".path;
+              settings = {
+                domain = "md.${pubDomain}";
+                protocolUseSSL = true;
+                db = {
+                  dialect = "postgresql";
+                  username = "hedgedoc";
+                  database = "hedgedoc";
+                  host = "colony-psql";
+                };
+                host = "::";
+                allowAnonymous = false;
+                allowAnonymousEdits = true;
+                email = true;
+                allowEmailRegister = false;
+              };
+            };
           };
         }
         (mkIf config.my.build.isDevVM {

nixos/boxes/colony/vms/shill/containers/waffletail.nix

@@ -0,0 +1,100 @@
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c.colony) domain prefixes;
+in
+{
+  nixos.systems.waffletail = { config, ... }: {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+    rendered = config.configuration.config.my.asContainer;
+
+    assignments = {
+      internal = {
+        name = "waffletail-ctr";
+        inherit domain;
+        ipv4.address = net.cidr.host 9 prefixes.ctrs.v4;
+        ipv6 = {
+          iid = "::9";
+          address = net.cidr.host 9 prefixes.ctrs.v6;
+        };
+      };
+      tailscale = with lib.my.c.tailscale; {
+        ipv4 = {
+          address = net.cidr.host 5 prefix.v4;
+          mask = 32;
+          gateway = null;
+        };
+        ipv6 = {
+          address = net.cidr.host 5 prefix.v6;
+          mask = 128;
+        };
+      };
+    };
+
+    configuration = { lib, config, assignments, ... }:
+    let
+      inherit (lib) concatStringsSep mkMerge mkIf mkForce;
+      inherit (lib.my) networkdAssignment;
+    in
+    {
+      config = {
+        my = {
+          deploy.enable = false;
+          server.enable = true;
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICZc88lcSQ9zzQzDITdE/T5ty++TxFQUAED7p9YfFBiR";
+            files = {
+              "tailscale-auth.key" = {};
+            };
+          };
+
+          firewall = {
+            trustedInterfaces = [ "tailscale0" ];
+            extraRules = ''
+              table inet filter {
+                chain forward {
+                  iifname host0 oifname tailscale0 ip saddr ${prefixes.all.v4} accept
+                  iifname host0 oifname tailscale0 ip6 saddr ${prefixes.all.v6} accept
+                }
+              }
+              table inet nat {
+                chain postrouting {
+                  iifname tailscale0 ip daddr != ${prefixes.all.v4} snat to ${assignments.internal.ipv4.address}
+                  iifname tailscale0 ip6 daddr != ${prefixes.all.v6} snat ip6 to ${assignments.internal.ipv6.address}
+                }
+              }
+            '';
+          };
+        };
+
+        systemd = {
+          network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
+        };
+
+        services = {
+          tailscale =
+          let
+            advRoutes = concatStringsSep "," (with prefixes.all; [ v4 v6 ]);
+          in
+          {
+            enable = true;
+            authKeyFile = config.age.secrets."tailscale-auth.key".path;
+            port = 41641;
+            openFirewall = true;
+            interfaceName = "tailscale0";
+            extraUpFlags = [
+              "--operator=${config.my.user.config.name}"
+              "--login-server=https://ts.nul.ie"
+              "--netfilter-mode=off"
+              "--advertise-exit-node"
+              "--advertise-routes=${advRoutes}"
+              "--accept-routes=false"
+            ];
+          };
+        };
+      };
+    };
+  };
+}

nixos/boxes/colony/vms/shill/default.nix

@@ -139,6 +139,16 @@ in
                         ipv6PrefixConfig.Prefix = prefixes.ctrs.v6;
                       }
                     ];
+                    routes = map (r: { routeConfig = r; }) [
+                      {
+                        Destination = lib.my.c.tailscale.prefix.v4;
+                        Gateway = allAssignments.waffletail.internal.ipv4.address;
+                      }
+                      {
+                        Destination = lib.my.c.tailscale.prefix.v6;
+                        Gateway = allAssignments.waffletail.internal.ipv6.address;
+                      }
+                    ];
                   }
                 ];
               };
@@ -196,6 +206,7 @@ in
                     };
                   };
                   toot = {};
+                  waffletail = {};
                 };
               in
               mkMerge [

nixos/boxes/colony/vms/whale2/default.nix

@@ -50,6 +50,8 @@ in
       };
     }) {
       valheim-oci = 2;
+      simpcraft-oci = 3;
+      simpcraft-staging-oci = 4;
     };
 
     configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -63,6 +65,7 @@ in
           "${modulesPath}/profiles/qemu-guest.nix"
 
           ./valheim.nix
+          ./minecraft
         ];
 
         config = mkMerge [

nixos/boxes/colony/vms/whale2/minecraft/default.nix

@@ -0,0 +1,121 @@
+{ lib, pkgs, config, allAssignments, ... }:
+let
+  inherit (lib) concatStringsSep;
+  inherit (lib.my) dockerNetAssignment;
+
+  # devplayer0
+  op = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
+  whitelist = concatStringsSep "," [
+    op
+    "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56" # Elderlypug
+    "fcb26db2-c3ce-41aa-b588-efec79d37a8a" # Jesthral_
+    "1d366062-12c0-4e29-aba7-6ab5d8c6bb05" # shr3kas0ras
+    "703b378a-09f9-4c1d-9876-1c9305728c49" # OROURKEIRE
+    "f105bbe6-eda6-4a13-a8cf-894e77cab77b" # Adzerq
+    "1fc94979-41fb-497a-81e9-34ae24ca537a" # johnnyscrims
+    "d53c91df-b6e6-4463-b106-e8427d7a8d01" # BossLonus
+    "f439f64d-91c9-4c74-9ce5-df4d24cd8e05" # hynge_
+    "d6ec4c91-5da2-44eb-b89d-71dc8fe017a0" # Eefah98
+    "096a7348-fabe-4b2d-93fc-fd1fd5608fb0" # ToTheMoonStar
+  ];
+
+  fastback = {
+    gitConfig = pkgs.writeText "git-config" ''
+      [user]
+      	email = "simpcraft@nul.ie"
+      	name = "Simpcraft bot"
+    '';
+    knownHosts = pkgs.writeText "known_hosts" ''
+      git.nul.ie ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBD023ECzYmLeXIpcGVaciPjq6UN/Sjmsys5HP/Nei5GkrUZqPa3OJ2uSXKLUSKGYdeNhxaFTPJe8Yx3TsZxMme8=
+    '';
+  };
+in
+{
+  config = {
+    virtualisation.oci-containers.containers = {
+      simpcraft = {
+        image = "ghcr.io/itzg/minecraft-server:2023.12.2-java17-alpine";
+
+        environment = {
+          TYPE = "MODRINTH";
+
+          EULA = "true";
+          ENABLE_QUERY = "true";
+          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t §4§k-----";
+          ICON = "/ext/icon.png";
+
+          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
+          WHITELIST = whitelist;
+          EXISTING_OPS_FILE = "SYNCHRONIZE";
+          OPS = op;
+          DIFFICULTY = "normal";
+          SPAWN_PROTECTION = "0";
+          VIEW_DISTANCE = "20";
+
+          MAX_MEMORY = "6G";
+          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/cdj2bSKg/Simpcraft-0.1.2.mrpack";
+
+          TZ = "Europe/Dublin";
+        };
+
+        volumes = [
+          "minecraft_data:/data"
+          "${./icon.png}:/ext/icon.png:ro"
+        ];
+
+        extraOptions = [
+          ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-oci"}''
+        ];
+      };
+
+      simpcraft-staging = {
+        image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";
+
+        environment = {
+          TYPE = "MODRINTH";
+
+          EULA = "true";
+          ENABLE_QUERY = "true";
+          ENABLE_RCON = "true";
+          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t [staging] §4§k-----";
+          ICON = "/ext/icon.png";
+
+          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
+          WHITELIST = whitelist;
+          EXISTING_OPS_FILE = "SYNCHRONIZE";
+          OPS = op;
+          DIFFICULTY = "normal";
+          SPAWN_PROTECTION = "0";
+          VIEW_DISTANCE = "20";
+
+          MAX_MEMORY = "4G";
+          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/Ym3sIi6H/Simpcraft-0.2.0.mrpack";
+
+          TZ = "Europe/Dublin";
+        };
+        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
+
+        volumes = [
+          "minecraft_staging_data:/data"
+          "${./icon.png}:/ext/icon.png:ro"
+          "${fastback.gitConfig}:/data/.config/git/config:ro"
+          "${fastback.knownHosts}:/data/.ssh/known_hosts:ro"
+          "${config.age.secrets."whale2/simpcraft-git.key".path}:/data/.ssh/id_rsa"
+        ];
+
+        extraOptions = [
+          ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
+        ];
+      };
+    };
+
+    my = {
+      secrets.files = {
+        "whale2/simpcraft.env" = {};
+        "whale2/simpcraft-git.key" = {
+          owner = "1000";
+        };
+      };
+    };
+  };
+}

nixos/boxes/home/palace/default.nix

@@ -94,7 +94,7 @@ in
             extraOptions = [ "-A /var/log/smartd/" "--interval=600" ];
           };
           udev.extraRules = ''
-            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="2"
+            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="3"
           '';
         };
 
@@ -110,7 +110,7 @@ in
           hwloc
         ];
 
-        networking.domain = "h.${pubDomain}";
+        networking = { inherit domain; };
 
         systemd = {
           tmpfiles.rules = [
@@ -144,6 +144,13 @@ in
 
             netdevs = mkMerge [
               (mkVLAN "lan-hi" vlans.hi)
+              (mkVLAN "lan-lo-phy" vlans.lo)
+              {
+                "25-lan-lo".netdevConfig = {
+                  Name = "lan-lo";
+                  Kind = "bridge";
+                };
+              }
             ];
 
             networks = {
@@ -151,6 +158,7 @@ in
                 (networkdAssignment "lan-core" assignments.core)
                 {
                   matchConfig.Name = "lan-core";
+                  vlan = [ "lan-lo-phy" ];
                   networkConfig.IPv6AcceptRA = mkForce false;
                 }
               ];
@@ -173,9 +181,28 @@ in
                   VirtualFunction=1
                   LinkState=yes
                   MACAddress=52:54:00:8a:8a:f2
+
+                  # sfh
+                  [SR-IOV]
+                  VirtualFunction=2
+                  VLANId=${toString vlans.hi}
+                  LinkState=yes
+                  MACAddress=52:54:00:ac:15:a9
                 '';
               };
               "60-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
+
+              "50-lan-lo-phy" = {
+                matchConfig.Name = "lan-lo-phy";
+                networkConfig = {
+                  Bridge = "lan-lo";
+                } // networkd.noL3;
+              };
+              "60-lan-lo" = {
+                matchConfig.Name = "lan-lo";
+                linkConfig.RequiredForOnline = "no";
+                networkConfig = networkd.noL3;
+              };
             };
           };
         };

nixos/boxes/home/palace/vms/cellar/default.nix

@@ -58,6 +58,8 @@ in
               };
             };
 
+            networking = { inherit domain; };
+
             environment.systemPackages = with pkgs; [
               pciutils
               partclone

nixos/boxes/home/palace/vms/default.nix

@@ -55,21 +55,10 @@
       };
     };
 
-    systemd.services = {
+    systemd.services =
-      "vm@cellar" = {
-        serviceConfig = {
-          CPUAffinity = "numa";
-          NUMAPolicy = "bind";
-          NUMAMask = "1";
-        };
-      };
-      "vm@river" =
     let
-        vtapUnit = "sys-subsystem-net-devices-vm\\x2det1g0.device";
+      awaitCellar = {
-      in
+        after = [ "vm@cellar.service" ];
-      {
-        requires = [ vtapUnit ];
-        after = [ vtapUnit "vm@cellar.service" ];
         bindsTo = [ "vm@cellar.service" ];
         preStart = ''
           until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.cellar.hi.ipv4.address} 22; do
@@ -77,6 +66,28 @@
           done
         '';
       };
+    in
+    {
+      "vm@cellar" = {
+        serviceConfig = {
+          CPUAffinity = "numa";
+          NUMAPolicy = "bind";
+          NUMAMask = "1";
+        };
+      };
+
+      "vm@river" =
+      let
+        vtapUnit = "sys-subsystem-net-devices-vm\\x2det1g0.device";
+      in
+      mkMerge [
+        awaitCellar
+        {
+          requires = [ vtapUnit ];
+          after = [ vtapUnit ];
+        }
+      ];
+      "vm@sfh" = awaitCellar;
     };
 
     my = {
@@ -128,7 +139,7 @@
               threads = 2;
             };
             memory = 4096;
-            cleanShutdown.timeout = 120;
+            cleanShutdown.timeout = 60;
             networks = {
               et1g0 = {
                 ifname = "vm-et1g0";
@@ -150,6 +161,29 @@
               };
             };
           };
+
+          sfh = {
+            uuid = "82ec149d-577c-421a-93e2-a9307c756cd8";
+            cpu = "host,topoext";
+            smp = {
+              cpus = 8;
+              threads = 2;
+            };
+            memory = 32768;
+            cleanShutdown.timeout = 120;
+            networks.netboot = {
+              bridge = "lan-lo";
+              waitOnline = "carrier";
+              mac = "52:54:00:a5:7e:93";
+              extraOptions.bootindex = 1;
+            };
+            hostDevices = {
+              et100g0vf2 = {
+                index = 0;
+                hostBDF = "44:00.3";
+              };
+            };
+          };
         };
       };
     };

nixos/boxes/home/routing-common/default.nix

@@ -66,7 +66,7 @@ in
         };
         ipv6 = {
           address = net.cidr.host ((1*65536*65536*65536) + index + 1) prefixes.as211024.v6;
-          gateway = net.cidr.host 1 prefixes.as211024.v6;
+          gateway = net.cidr.host ((2*65536*65536*65536) + 1) prefixes.as211024.v6;
         };
       };
     };
@@ -262,6 +262,21 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
+                    routes = map (r: { routeConfig = r; }) [
+                      {
+                        Destination = lib.my.c.colony.prefixes.all.v4;
+                        Gateway = allAssignments.estuary.as211024.ipv4.address;
+                      }
+
+                      {
+                        Destination = lib.my.c.tailscale.prefix.v4;
+                        Gateway = allAssignments.britway.as211024.ipv4.address;
+                      }
+                      {
+                        Destination = lib.my.c.tailscale.prefix.v6;
+                        Gateway = allAssignments.britway.as211024.ipv6.address;
+                      }
+                    ];
                   }
                 ];
               }
@@ -303,16 +318,29 @@ in
                 enable = true;
                 externalInterface = "wan";
               };
-              extraRules = ''
+              extraRules =
+              let
+                aa = allAssignments;
+              in
+              ''
                 table inet filter {
                   chain input {
+                    ${lib.my.c.as211024.nftTrust}
                     iifname base meta l4proto { udp, tcp } th dport domain accept
                     iifname lan-core meta l4proto vrrp accept
                   }
 
                   chain routing-tcp {
-                    # Safe enough to allow all SSH
+                    ip daddr {
-                    tcp dport ssh accept
+                      ${aa.castle.hi.ipv4.address},
+                      ${aa.cellar.hi.ipv4.address},
+                      ${aa.palace.hi.ipv4.address}
+                    } tcp dport ssh accept
+                    ip6 daddr {
+                      ${aa.castle.hi.ipv6.address},
+                      ${aa.cellar.hi.ipv6.address},
+                      ${aa.palace.hi.ipv6.address}
+                    } tcp dport ssh accept
 
                     return
                   }
@@ -331,8 +359,10 @@ in
                   }
 
                   chain forward {
+                    ${lib.my.c.as211024.nftTrust}
                     iifname lan-untrusted jump filter-untrusted
-                    iifname { wan, lan-untrusted } oifname { lan-hi, lan-lo } jump filter-routing
+                    iifname { wan, as211024, lan-untrusted } oifname { lan-hi, lan-lo } jump filter-routing
+                    oifname as211024 accept
                   }
                   chain output { }
                 }

nixos/boxes/home/routing-common/dns.nix

@@ -2,6 +2,7 @@ index: { lib, pkgs, config, assignments, allAssignments, ... }:
 let
   inherit (builtins) attrNames elemAt;
   inherit (lib.my) net;
+  inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.home) prefixes vips routers;
 
   name = elemAt routers index;
@@ -22,6 +23,7 @@ in
           owner = "pdns-recursor";
           group = "pdns-recursor";
         };
+        "home/ddclient-cloudflare.key" = {};
       };
 
       pdns.recursor = {
@@ -42,7 +44,7 @@ in
             "127.0.0.0/8" "::1/128"
             prefixes.hi.v4 prefixes.hi.v6
             prefixes.lo.v4 prefixes.lo.v6
-          ];
+          ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
         };
 
         settings = {
@@ -63,9 +65,36 @@ in
       };
     };
 
-    systemd.services = {
+    systemd = {
+      services = {
         # Add AF_NETLINK to allow pulling IP from network interfaces
         pdns.serviceConfig.RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+        ddns-update = {
+          description = "DNS update script";
+          after = [ "network.target" ];
+          path = [
+            (pkgs.python3.withPackages (ps: [ ps.cloudflare ]))
+            pkgs.ldns
+          ];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart =
+              ''${./dns_update.py} -k ${config.age.secrets."home/ddclient-cloudflare.key".path} '' +
+              ''${pubDomain} ns${toString (index + 1)}.${config.networking.domain}'';
+          };
+          wantedBy = [ "multi-user.target" ];
+        };
+      };
+      timers = {
+        ddns-update = {
+          description = "Periodically update DNS";
+          wantedBy = [ "timers.target" ];
+          timerConfig = {
+            OnBootSec = "5min";
+            OnUnitInactiveSec = "5min";
+          };
+        };
+      };
     };
 
     environment.systemPackages = with pkgs; [
@@ -153,6 +182,11 @@ in
             dave-lo IN A ${net.cidr.host 11 prefixes.lo.v4}
             dave-lo IN AAAA ${net.cidr.host (65536+2) prefixes.lo.v6}
 
+            ;ap0 IN A ${net.cidr.host 12 prefixes.hi.v4}
+            ;ap0 IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
+            vibe IN A ${net.cidr.host 13 prefixes.hi.v4}
+            vibe IN AAAA ${net.cidr.host (65536+4) prefixes.hi.v6}
+
             ups IN A ${net.cidr.host 20 prefixes.lo.v4}
             palace-kvm IN A ${net.cidr.host 21 prefixes.lo.v4}
 

nixos/boxes/home/routing-common/dns_update.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+import argparse
+import subprocess
+
+import CloudFlare
+
+def main():
+    parser = argparse.ArgumentParser(description='Cloudflare DNS update script')
+    parser.add_argument('-k', '--api-token-file', help='Cloudflare API token file')
+    parser.add_argument('zone', help='Cloudflare Zone')
+    parser.add_argument('record', help='Cloudflare record name')
+    args = parser.parse_args()
+
+    address = subprocess.check_output(
+        ['drill', '-Q', '-p5353', '@127.0.0.1', args.record, 'A'],
+        encoding='utf8').strip()
+
+    cf_token = None
+    if args.api_token_file:
+        with open(args.api_token_file) as f:
+            cf_token = f.readline().strip()
+
+    cf = CloudFlare.CloudFlare(token=cf_token)
+    zones = cf.zones.get(params={'name': args.zone})
+    assert zones, f'Zone {args.zone} not found'
+    records = cf.zones.dns_records.get(zones[0]['id'], params={'name': args.record})
+    assert records, f'Record {args.record} not found in zone {args.zone}'
+
+    print(f'Updating {args.record} -> {address}')
+    cf.zones.dns_records.patch(
+        zones[0]['id'], records[0]['id'],
+        data={'type': 'A', 'name': args.record, 'content': address})
+
+if __name__ == '__main__':
+    main()

nixos/boxes/home/routing-common/kea.nix

@@ -55,7 +55,7 @@ in
             }
             {
               name = "domain-search";
-              data = "${domain}, dyn.${domain}";
+              data = "${domain}, dyn.${domain}, ${lib.my.c.colony.domain}, ${lib.my.c.britway.domain}";
               always-send = true;
             }
           ];

nixos/boxes/home/routing-common/radvd.nix

@@ -11,7 +11,7 @@ let
       AdvLinkMTU ${toString prefixes."${name}".mtu};
       prefix ${prefixes."${name}".v6} {};
       RDNSS ${net.cidr.host 1 prefixes."${name}".v6} ${net.cidr.host 2 prefixes."${name}".v6} {};
-      DNSSL ${domain} dyn.${domain} {};
+      DNSSL ${domain} dyn.${domain} ${lib.my.c.colony.domain} ${lib.my.c.britway.domain} {};
      };
   '';
 in

nixos/boxes/kelder/containers/spoder/default.nix

@@ -92,7 +92,7 @@ in
 
           nextcloud = {
             enable = true;
-            package = pkgs.nextcloud27;
+            package = pkgs.nextcloud28;
             datadir = "/mnt/storage/nextcloud";
             hostName = "cloud.${domain}";
             https = true;

nixos/boxes/kelder/containers/spoder/nginx.nix

@@ -2,7 +2,7 @@
 let
   inherit (builtins) mapAttrs;
   inherit (lib) mkMerge mkIf mkDefault;
-  inherit (lib.my.c.nginx) proxyHeaders;
+  inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
   inherit (lib.my.c.kelder) domain;
 in
 {
@@ -39,43 +39,7 @@ in
 
         # Based on recommended*Settings, but probably better to be explicit about these
         appendHttpConfig = ''
-          # NixOS provides a logrotate config that auto-compresses :)
+          ${baseHttpConfig}
-          log_format main
-            '$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
-          access_log /var/log/nginx/access.log main;
-
-          # optimisation
-          sendfile on;
-          tcp_nopush on;
-          tcp_nodelay on;
-          keepalive_timeout 65;
-
-          # gzip
-          gzip on;
-          gzip_proxied any;
-          gzip_comp_level 5;
-          gzip_types
-            application/atom+xml
-            application/javascript
-            application/json
-            application/xml
-            application/xml+rss
-            image/svg+xml
-            text/css
-            text/javascript
-            text/plain
-            text/xml;
-          gzip_vary on;
-
-          # proxying
-          proxy_buffering off;
-          proxy_redirect off;
-          proxy_connect_timeout 60s;
-          proxy_read_timeout 60s;
-          proxy_send_timeout 60s;
-          proxy_http_version 1.1;
-
-          ${proxyHeaders}
 
           # caching
           proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=4g;

nixos/boxes/kelder/default.nix

@@ -135,12 +135,14 @@ in
             samba-wsdd.enable = true;
 
             minecraft-server = {
-              enable = true;
+              enable = false;
-              package = pkgs.minecraftServers.vanilla-1-19;
+              package = pkgs.minecraftServers.vanilla-1-20;
               declarative = true;
               eula = true;
               whitelist = {
                 devplayer0 = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
+                Elderlypug = "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56";
+                shr3kas0ras = "1d366062-12c0-4e29-aba7-6ab5d8c6bb05";
               };
               serverProperties = {
                 motd = "Simpcraft";

nixos/boxes/tower/default.nix

@@ -107,10 +107,19 @@
 
           fprintd.enable = true;
           blueman.enable = true;
+
+          tailscale = {
+            enable = true;
+            openFirewall = true;
+          };
         };
 
         programs = {
           steam.enable = true;
+          wireshark = {
+            enable = true;
+            package = pkgs.wireshark-qt;
+          };
         };
 
         networking = {
@@ -166,6 +175,14 @@
                 packages = with pkgs; [ ];
               };
 
+              programs = {
+                fish = {
+                  shellAbbrs = {
+                    tsup = "doas tailscale up --login-server=https://ts.nul.ie --accept-routes";
+                  };
+                };
+              };
+
               services = {
                 blueman-applet.enable = true;
               };

nixos/default.nix

@@ -1,4 +1,4 @@
-{ lib, pkgsFlakes, hmFlakes, inputs, pkgs', config, ... }:
+{ self, lib, pkgsFlakes, hmFlakes, inputs, pkgs', config, ... }:
 let
   inherit (builtins) attrValues mapAttrs;
   inherit (lib)
@@ -25,10 +25,14 @@ let
 
       modules' = [ hmFlakes.${config'.home-manager}.nixosModule ] ++ (attrValues cfg.modules);
     in
-    pkgsFlake.lib.nixosSystem {
+    # Import eval-config ourselves since the flake now force-sets lib
+    import "${pkgsFlake}/nixos/lib/eval-config.nix" {
       # Gotta override lib here unforunately, eval-config.nix likes to import its own (unextended) lib. We explicitly
       # don't pass pkgs so that it'll be imported with modularly applied config and overlays.
-      lib = pkgs.lib;
+      lib = pkgs.lib.extend (lib.my.versionOverlay { inherit self pkgsFlake; });
+
+      # Set to null since we pass modularly
+      system = null;
 
       # Put the inputs in specialArgs to avoid infinite recursion when modules try to do imports
       specialArgs = { inherit inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
@@ -51,7 +55,7 @@ let
             pkgs' = allPkgs;
           };
 
-          system.name = name;
+          system = { inherit name; };
           networking = {
             domain = let d = config'.assignments.internal.domain or null; in mkIf (d != null) (mkDefault' d);
             hostName = mkDefault (config'.assignments.internal.name or name);
@@ -86,6 +90,8 @@ let
                   pkgsPath = toString pkgsFlakes.${config'.hmNixpkgs};
                   pkgs' = allPkgs;
                 };
+
+                home.enableNixpkgsReleaseCheck = false;
               }
               (homeStateVersion config'.home-manager)
             ];

nixos/installer.nix

@@ -32,7 +32,8 @@
           };
 
           isoImage = {
-            isoBaseName = "nixos-installer-devplayer0";
+            isoBaseName = "jackos-installer";
+            volumeID = "jackos-${config.system.nixos.release}-${pkgs.stdenv.hostPlatform.uname.processor}";
             edition = "devplayer0";
             appendToMenuLabel = " /dev/player0 Installer";
           };

nixos/modules/_list.nix

@@ -19,5 +19,6 @@
     borgthin = ./borgthin.nix;
     nvme = ./nvme;
     spdk = ./spdk.nix;
+    librespeed = ./librespeed;
   };
 }

nixos/modules/build.nix

@@ -92,6 +92,7 @@ in
     };
     isoImage = {
       isoBaseName = dummyOption;
+      volumeID = dummyOption;
       edition = dummyOption;
       appendToMenuLabel = dummyOption;
     };

nixos/modules/common.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, pkgs', inputs, config, ... }:
 let
   inherit (lib) mkIf mkDefault mkMerge;
-  inherit (lib.my) mkBoolOpt' dummyOption;
+  inherit (lib.my) mkDefault';
 in
 {
   options = with lib.types; {
@@ -121,6 +121,11 @@ in
           services.lvm.enable = mkDefault true;
         };
       };
+      system = {
+        nixos = {
+          distroName = mkDefault' "JackOS";
+        };
+      };
 
       environment.systemPackages = with pkgs; mkMerge [
         [
@@ -151,6 +156,7 @@ in
               font-name=SauceCodePro Nerd Font Mono
             '';
         };
+        getty.greetingLine = mkDefault' ''<<< Welcome to ${config.system.nixos.distroName} ${config.system.nixos.label} (\m) - \l >>>'';
 
         openssh = {
           enable = mkDefault true;

nixos/modules/containers.nix

@@ -209,12 +209,16 @@ in
             mkdir -p -m 0755 "$root"/sbin "$root"/etc
             touch "$root"/etc/os-release
 
-            if [ -e "${containerSystem}"/prepare-root ]; then
+            ${if system == sysProfile then ''
+              if [ -e "${sysProfile}"/prepare-root ]; then
                 initSource="${containerSystem}"/prepare-root
               else
                 initSource="${containerSystem}"/init
               fi
               ln -sf "$initSource" "$root"/sbin/init
+            '' else ''
+              ln -sf "${containerSystem}/prepare-root" "$root"/sbin/init
+            ''}
           '';
           postStop =
           ''

nixos/modules/deploy-rs.nix

@@ -15,16 +15,20 @@ let
   # Based on https://github.com/serokell/deploy-rs/blob/master/flake.nix
   nixosActivate = cfg': base: (pkgs.deploy-rs.lib.activate.custom // {
     dryActivate = "$PROFILE/bin/switch-to-configuration dry-activate";
-    boot = "$PROFILE/bin/switch-to-configuration boot";
+    boot = ''
+      $PROFILE/bin/switch-to-configuration boot
+
+      ${keepGensSnippet "$PROFILE" cfg'.keepGenerations}
+    '';
   }) base.config.system.build.toplevel ''
     # work around https://github.com/NixOS/nixpkgs/issues/73404
     cd /tmp
 
-    "$PROFILE"/bin/switch-to-configuration ${cfg'.mode}
+    "$PROFILE"/bin/switch-to-configuration switch
 
     # https://github.com/serokell/deploy-rs/issues/31
     ${with base.config.boot.loader;
-    optionalString ((cfg'.mode == "switch" || cfg'.mode == "boot") && systemd-boot.enable)
+    optionalString systemd-boot.enable
     "sed -i '/^default /d' ${efi.efiSysMountPoint}/loader/loader.conf"}
 
     ${keepGensSnippet "$PROFILE" cfg'.keepGenerations}
@@ -59,7 +63,11 @@ let
   {
     name = "container-${n}";
     value = {
-      path = pkgs.deploy-rs.lib.activate.custom ctrConfig.my.buildAs.container ''
+      path = (pkgs.deploy-rs.lib.activate.custom // {
+        boot = ''
+          echo "Next systemd-nspawn@${n}.service restart / reload will load config"
+        '';
+      }) ctrConfig.my.buildAs.container ''
         source ${systemdUtil}/bin/systemd-util.sh
         ${if c.hotReload then ''
           if (! systemctl show -p ActiveState systemd-nspawn@${n} | grep -q "ActiveState=active") || \

nixos/modules/firewall.nix

@@ -222,7 +222,7 @@ in
                 "iifname ${cfg.nat.externalInterface} jump filter-iif-port-forwards"}
               ${optionalString
                 dipForward
-                (concatMapStringsSep "\n    " (ip: "${ipK ip} daddr ${ip} jump ${natFilterChain ip}") (attrNames cfg.nat.forwardPorts))}
+                (concatMapStringsSep "\n    " (ip: "jump ${natFilterChain ip}") (attrNames cfg.nat.forwardPorts))}
             }
           }
 

nixos/modules/librespeed/default.nix

@@ -0,0 +1,76 @@
+{ lib, pkgs, config, ... }:
+let
+  inherit (builtins) toJSON;
+  inherit (lib) mkOption mkMerge mkIf mkDefault;
+  inherit (lib.my) mkOpt' mkBoolOpt';
+
+  cfg = config.my.librespeed;
+
+  serversConf = map (s: s // {
+    dlURL = "backend/garbage";
+    ulURL = "backend/empty";
+    pingURL = "backend/empty";
+    getIpURL = "backend/getIP";
+  }) cfg.frontend.servers;
+  frontendTree = pkgs.runCommand "librespeed-frontend" {
+    speedtestServers = toJSON serversConf;
+  } ''
+    mkdir "$out"
+    cp "${pkgs.librespeed-go}"/assets/* "$out"/
+    substitute ${./index.html} "$out"/index.html --subst-var speedtestServers
+  '';
+
+  backendConf = pkgs.writers.writeTOML "librespeed.toml" cfg.backend.settings;
+  generateBackendSettings = base: dst: if (cfg.backend.extraSettingsFile != null) then ''
+    oldUmask="$(umask)"
+    umask 006
+    cat "${base}" "${cfg.backend.extraSettingsFile}" > "${dst}"
+    umask "$oldUmask"
+  '' else ''
+    cp "${base}" "${dst}"
+  '';
+in
+{
+  options.my.librespeed = with lib.types; {
+    frontend = {
+      servers = mkOpt' (listOf (attrsOf unspecified)) { } "Server configs.";
+      webroot = mkOption {
+        description = "Frontend webroot.";
+        type = package;
+        readOnly = true;
+      };
+    };
+    backend = {
+      enable = mkBoolOpt' false "Whether to enable librespeed backend.";
+      settings = mkOpt' (attrsOf unspecified) { } "Backend settings.";
+      extraSettingsFile = mkOpt' (nullOr str) null "Extra settings file.";
+    };
+  };
+
+  config = mkMerge [
+    (mkIf (cfg.frontend.servers != { }) {
+      my.librespeed.frontend.webroot = frontendTree;
+    })
+    (mkIf cfg.backend.enable {
+      my.librespeed.backend.settings = {
+        assets_path = frontendTree;
+        database_type = mkDefault "bolt";
+        database_file = mkDefault "/var/lib/librespeed-go/speedtest.db";
+      };
+
+      systemd.services.librespeed = {
+        description = "LibreSpeed Go backend";
+        wants = [ "network-online.target" ];
+        after = [ "network-online.target" ];
+
+        preStart = generateBackendSettings backendConf "/run/librespeed-go/settings.toml";
+        serviceConfig = {
+          ExecStart = "${pkgs.librespeed-go}/bin/speedtest -c /run/librespeed-go/settings.toml";
+          RuntimeDirectory = "librespeed-go";
+          StateDirectory = "librespeed-go";
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+    })
+  ];
+}

nixos/modules/librespeed/index.html

@@ -0,0 +1,491 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="shortcut icon" href="favicon.ico">
+<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no, user-scalable=no" />
+<meta charset="UTF-8" />
+<script type="text/javascript" src="speedtest.js"></script>
+<script type="text/javascript">
+function I(i){return document.getElementById(i);}
+
+//LIST OF TEST SERVERS. See documentation for details if needed
+var SPEEDTEST_SERVERS=@speedtestServers@;
+// var SPEEDTEST_SERVERS=[
+// 	{	//this server doesn't actually exist, remove it
+// 		name:"Example Server 1", //user friendly name for the server
+// 		server:"//test1.mydomain.com/", //URL to the server. // at the beginning will be replaced with http:// or https:// automatically
+// 		dlURL:"backend/garbage.php",  //path to download test on this server (garbage.php or replacement)
+// 		ulURL:"backend/empty.php",  //path to upload test on this server (empty.php or replacement)
+// 		pingURL:"backend/empty.php",  //path to ping/jitter test on this server (empty.php or replacement)
+// 		getIpURL:"backend/getIP.php"  //path to getIP on this server (getIP.php or replacement)
+// 	},
+// 	{	//this server doesn't actually exist, remove it
+// 		name:"Example Server 2", //user friendly name for the server
+// 		server:"//test2.example.com/", //URL to the server. // at the beginning will be replaced with http:// or https:// automatically
+// 		dlURL:"garbage.php",  //path to download test on this server (garbage.php or replacement)
+// 		ulURL:"empty.php",  //path to upload test on this server (empty.php or replacement)
+// 		pingURL:"empty.php",  //path to ping/jitter test on this server (empty.php or replacement)
+// 		getIpURL:"getIP.php"  //path to getIP on this server (getIP.php or replacement)
+// 	}
+// 	//add other servers here, comma separated
+// ];
+
+//INITIALIZE SPEEDTEST
+var s=new Speedtest(); //create speed test object
+s.setParameter("telemetry_level","basic"); //enable telemetry
+
+//SERVER AUTO SELECTION
+function initServers(){
+    var noServersAvailable=function(){
+        I("message").innerHTML="No servers available";
+    }
+    var runServerSelect=function(){
+        s.selectServer(function(server){
+            if(server!=null){ //at least 1 server is available
+                I("loading").className="hidden"; //hide loading message
+                //populate server list for manual selection
+                for(var i=0;i<SPEEDTEST_SERVERS.length;i++){
+                    if(SPEEDTEST_SERVERS[i].pingT==-1) continue;
+                    var option=document.createElement("option");
+                    option.value=i;
+                    option.textContent=SPEEDTEST_SERVERS[i].name;
+                    if(SPEEDTEST_SERVERS[i]===server) option.selected=true;
+                    I("server").appendChild(option);
+                }
+                //show test UI
+                I("testWrapper").className="visible";
+                initUI();
+            }else{ //no servers are available, the test cannot proceed
+                noServersAvailable();
+            }
+        });
+    }
+    if(typeof SPEEDTEST_SERVERS === "string"){
+        //need to fetch list of servers from specified URL
+        s.loadServerList(SPEEDTEST_SERVERS,function(servers){
+            if(servers==null){ //failed to load server list
+                noServersAvailable();
+            }else{ //server list loaded
+                SPEEDTEST_SERVERS=servers;
+                runServerSelect();
+            }
+        });
+    }else{
+        //hardcoded server list
+        s.addTestPoints(SPEEDTEST_SERVERS);
+        runServerSelect();
+    }
+}
+
+var meterBk=/Trident.*rv:(\d+\.\d+)/i.test(navigator.userAgent)?"#EAEAEA":"#80808040";
+var dlColor="#6060AA",
+	ulColor="#616161";
+var progColor=meterBk;
+
+//CODE FOR GAUGES
+function drawMeter(c,amount,bk,fg,progress,prog){
+	var ctx=c.getContext("2d");
+	var dp=window.devicePixelRatio||1;
+	var cw=c.clientWidth*dp, ch=c.clientHeight*dp;
+	var sizScale=ch*0.0055;
+	if(c.width==cw&&c.height==ch){
+		ctx.clearRect(0,0,cw,ch);
+	}else{
+		c.width=cw;
+		c.height=ch;
+	}
+	ctx.beginPath();
+	ctx.strokeStyle=bk;
+	ctx.lineWidth=12*sizScale;
+	ctx.arc(c.width/2,c.height-58*sizScale,c.height/1.8-ctx.lineWidth,-Math.PI*1.1,Math.PI*0.1);
+	ctx.stroke();
+	ctx.beginPath();
+	ctx.strokeStyle=fg;
+	ctx.lineWidth=12*sizScale;
+	ctx.arc(c.width/2,c.height-58*sizScale,c.height/1.8-ctx.lineWidth,-Math.PI*1.1,amount*Math.PI*1.2-Math.PI*1.1);
+	ctx.stroke();
+	if(typeof progress !== "undefined"){
+		ctx.fillStyle=prog;
+		ctx.fillRect(c.width*0.3,c.height-16*sizScale,c.width*0.4*progress,4*sizScale);
+	}
+}
+function mbpsToAmount(s){
+	return 1-(1/(Math.pow(1.3,Math.sqrt(s))));
+}
+function format(d){
+    d=Number(d);
+    if(d<10) return d.toFixed(2);
+    if(d<100) return d.toFixed(1);
+    return d.toFixed(0);
+}
+
+//UI CODE
+var uiData=null;
+function startStop(){
+    if(s.getState()==3){
+		//speed test is running, abort
+		s.abort();
+		data=null;
+		I("startStopBtn").className="";
+		I("server").disabled=false;
+		initUI();
+	}else{
+		//test is not running, begin
+		I("startStopBtn").className="running";
+		I("shareArea").style.display="none";
+		I("server").disabled=true;
+		s.onupdate=function(data){
+            uiData=data;
+		};
+		s.onend=function(aborted){
+            I("startStopBtn").className="";
+            I("server").disabled=false;
+            updateUI(true);
+            if(!aborted){
+                //if testId is present, show sharing panel, otherwise do nothing
+                try{
+                    var testId=uiData.testId;
+                    if(testId!=null){
+                        var shareURL=window.location.href.substring(0,window.location.href.lastIndexOf("/"))+"/results/?id="+testId;
+                        I("resultsImg").src=shareURL;
+                        I("resultsURL").value=shareURL;
+                        I("testId").innerHTML=testId;
+                        I("shareArea").style.display="";
+                    }
+                }catch(e){}
+            }
+		};
+		s.start();
+	}
+}
+//this function reads the data sent back by the test and updates the UI
+function updateUI(forced){
+	if(!forced&&s.getState()!=3) return;
+	if(uiData==null) return;
+	var status=uiData.testState;
+	I("ip").textContent=uiData.clientIp;
+	I("dlText").textContent=(status==1&&uiData.dlStatus==0)?"...":format(uiData.dlStatus);
+	drawMeter(I("dlMeter"),mbpsToAmount(Number(uiData.dlStatus*(status==1?oscillate():1))),meterBk,dlColor,Number(uiData.dlProgress),progColor);
+	I("ulText").textContent=(status==3&&uiData.ulStatus==0)?"...":format(uiData.ulStatus);
+	drawMeter(I("ulMeter"),mbpsToAmount(Number(uiData.ulStatus*(status==3?oscillate():1))),meterBk,ulColor,Number(uiData.ulProgress),progColor);
+	I("pingText").textContent=format(uiData.pingStatus);
+	I("jitText").textContent=format(uiData.jitterStatus);
+}
+function oscillate(){
+	return 1+0.02*Math.sin(Date.now()/100);
+}
+//update the UI every frame
+window.requestAnimationFrame=window.requestAnimationFrame||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||window.msRequestAnimationFrame||(function(callback,element){setTimeout(callback,1000/60);});
+function frame(){
+	requestAnimationFrame(frame);
+	updateUI();
+}
+frame(); //start frame loop
+//function to (re)initialize UI
+function initUI(){
+	drawMeter(I("dlMeter"),0,meterBk,dlColor,0);
+	drawMeter(I("ulMeter"),0,meterBk,ulColor,0);
+	I("dlText").textContent="";
+	I("ulText").textContent="";
+	I("pingText").textContent="";
+	I("jitText").textContent="";
+	I("ip").textContent="";
+}
+</script>
+<style type="text/css">
+	html,body{
+		border:none; padding:0; margin:0;
+		background:#FFFFFF;
+		color:#202020;
+	}
+	body{
+		text-align:center;
+		font-family:"Roboto",sans-serif;
+	}
+	h1{
+		color:#404040;
+	}
+	#loading{
+		background-color:#FFFFFF;
+		color:#404040;
+		text-align:center;
+	}
+	span.loadCircle{
+		display:inline-block;
+		width:2em;
+		height:2em;
+		vertical-align:middle;
+		background:url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMAAAD04JH5AAAAP1BMVEUAAAB2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZyFzwnAAAAFHRSTlMAEvRFvX406baecwbf0casimhSHyiwmqgAAADpSURBVHja7dbJbQMxAENRahnN5lkc//5rDRAkDeRgHszXgACJoKiIiIiIiIiIiIiIiIiIiIj4HHspsrpAVhdVVguzrA4OWc10WcEqpwKbnBo0OU1Q5NSpsoJFTgOecrrdEag85DRgktNqfoEdTjnd7hrEHMEJvmRUYJbTYk5Agy6nau6Abp5Cm7mDBtRdPi9gyKdU7w4p1fsLvyqs8hl4z9/w3n/Hmr9WoQ65lAU4d7lMYOz//QboRR5jBZibLMZdAR6O/Vfa1PlxNr3XdS3HzK/HVPRu/KnLs8iAOh993VpRRERERMT/fAN60wwWaVyWwAAAAABJRU5ErkJggg==');
+		background-size:2em 2em;
+		margin-right:0.5em;
+		animation: spin 0.6s linear infinite;
+	}
+	@keyframes spin{
+		0%{transform:rotate(0deg);}
+		100%{transform:rotate(359deg);}
+	}
+	#startStopBtn{
+		display:inline-block;
+		margin:0 auto;
+		color:#6060AA;
+		background-color:rgba(0,0,0,0);
+		border:0.15em solid #6060FF;
+		border-radius:0.3em;
+		transition:all 0.3s;
+		box-sizing:border-box;
+		width:8em; height:3em;
+		line-height:2.7em;
+		cursor:pointer;
+		box-shadow: 0 0 0 rgba(0,0,0,0.1), inset 0 0 0 rgba(0,0,0,0.1);
+	}
+	#startStopBtn:hover{
+		box-shadow: 0 0 2em rgba(0,0,0,0.1), inset 0 0 1em rgba(0,0,0,0.1);
+	}
+	#startStopBtn.running{
+		background-color:#FF3030;
+		border-color:#FF6060;
+		color:#FFFFFF;
+	}
+	#startStopBtn:before{
+		content:"Start";
+	}
+	#startStopBtn.running:before{
+		content:"Abort";
+	}
+	#serverArea{
+		margin-top:1em;
+	}
+	#server{
+		font-size:1em;
+		padding:0.2em;
+	}
+	#test{
+		margin-top:2em;
+		margin-bottom:12em;
+	}
+	div.testArea{
+		display:inline-block;
+		width:16em;
+		height:12.5em;
+		position:relative;
+		box-sizing:border-box;
+	}
+	div.testArea2{
+		display:inline-block;
+		width:14em;
+		height:7em;
+		position:relative;
+		box-sizing:border-box;
+		text-align:center;
+	}
+	div.testArea div.testName{
+		position:absolute;
+		top:0.1em; left:0;
+		width:100%;
+		font-size:1.4em;
+		z-index:9;
+	}
+	div.testArea2 div.testName{
+        display:block;
+        text-align:center;
+        font-size:1.4em;
+	}
+	div.testArea div.meterText{
+		position:absolute;
+		bottom:1.55em; left:0;
+		width:100%;
+		font-size:2.5em;
+		z-index:9;
+	}
+	div.testArea2 div.meterText{
+        display:inline-block;
+        font-size:2.5em;
+	}
+	div.meterText:empty:before{
+		content:"0.00";
+	}
+	div.testArea div.unit{
+		position:absolute;
+		bottom:2em; left:0;
+		width:100%;
+		z-index:9;
+	}
+	div.testArea2 div.unit{
+		display:inline-block;
+	}
+	div.testArea canvas{
+		position:absolute;
+		top:0; left:0; width:100%; height:100%;
+		z-index:1;
+	}
+	div.testGroup{
+		display:block;
+        margin: 0 auto;
+	}
+	#shareArea{
+		width:95%;
+		max-width:40em;
+		margin:0 auto;
+		margin-top:2em;
+	}
+	#shareArea > *{
+		display:block;
+		width:100%;
+		height:auto;
+		margin: 0.25em 0;
+	}
+	#privacyPolicy{
+        position:fixed;
+        top:2em;
+        bottom:2em;
+        left:2em;
+        right:2em;
+        overflow-y:auto;
+        width:auto;
+        height:auto;
+        box-shadow:0 0 3em 1em #000000;
+        z-index:999999;
+        text-align:left;
+        background-color:#FFFFFF;
+        padding:1em;
+	}
+	a.privacy{
+        text-align:center;
+        font-size:0.8em;
+        color:#808080;
+        padding: 0 3em;
+	}
+    div.closePrivacyPolicy {
+        width: 100%;
+        text-align: center;
+    }
+    div.closePrivacyPolicy a.privacy {
+        padding: 1em 3em;
+    }
+	@media all and (max-width:40em){
+		body{
+			font-size:0.8em;
+		}
+	}
+	div.visible{
+		animation: fadeIn 0.4s;
+		display:block;
+	}
+	div.hidden{
+		animation: fadeOut 0.4s;
+		display:none;
+	}
+	@keyframes fadeIn{
+		0%{
+			opacity:0;
+		}
+		100%{
+			opacity:1;
+		}
+	}
+	@keyframes fadeOut{
+		0%{
+			display:block;
+			opacity:1;
+		}
+		100%{
+			display:block;
+			opacity:0;
+		}
+	}
+</style>
+<title>/dev/player0's speedtest</title>
+</head>
+<body onload="initServers()">
+<h1>/dev/player0's speedtest</h1>
+<div id="loading" class="visible">
+	<p id="message"><span class="loadCircle"></span>Selecting a server...</p>
+</div>
+<div id="testWrapper" class="hidden">
+	<div id="startStopBtn" onclick="startStop()"></div><br/>
+	<a class="privacy" href="#" onclick="I('privacyPolicy').style.display=''">Privacy</a>
+	<div id="serverArea">
+		Server: <select id="server" onchange="s.setSelectedServer(SPEEDTEST_SERVERS[this.value])"></select>
+	</div>
+	<div id="test">
+		<div class="testGroup">
+            <div class="testArea2">
+				<div class="testName">Ping</div>
+				<div id="pingText" class="meterText" style="color:#AA6060"></div>
+				<div class="unit">ms</div>
+			</div>
+			<div class="testArea2">
+				<div class="testName">Jitter</div>
+				<div id="jitText" class="meterText" style="color:#AA6060"></div>
+				<div class="unit">ms</div>
+			</div>
+		</div>
+		<div class="testGroup">
+			<div class="testArea">
+				<div class="testName">Download</div>
+				<canvas id="dlMeter" class="meter"></canvas>
+				<div id="dlText" class="meterText"></div>
+				<div class="unit">Mbit/s</div>
+			</div>
+			<div class="testArea">
+				<div class="testName">Upload</div>
+				<canvas id="ulMeter" class="meter"></canvas>
+				<div id="ulText" class="meterText"></div>
+				<div class="unit">Mbit/s</div>
+			</div>
+		</div>
+		<div id="ipArea">
+			<span id="ip"></span>
+		</div>
+		<div id="shareArea" style="display:none">
+			<h3>Share results</h3>
+			<p>Test ID: <span id="testId"></span></p>
+			<input type="text" value="" id="resultsURL" readonly="readonly" onclick="this.select();this.focus();this.select();document.execCommand('copy');alert('Link copied')"/>
+			<img src="" id="resultsImg" />
+		</div>
+	</div>
+	<a href="https://github.com/librespeed/speedtest">Source code</a>
+</div>
+<div id="privacyPolicy" style="display:none">
+    <h2>Privacy Policy</h2>
+    <p>This HTML5 speed test server is configured with telemetry enabled.</p>
+    <h4>What data we collect</h4>
+    <p>
+        At the end of the test, the following data is collected and stored:
+        <ul>
+            <li>Test ID</li>
+            <li>Time of testing</li>
+            <li>Test results (download and upload speed, ping and jitter)</li>
+            <li>IP address</li>
+            <li>ISP information</li>
+            <li>Approximate location (inferred from IP address, not GPS)</li>
+            <li>User agent and browser locale</li>
+            <li>Test log (contains no personal information)</li>
+        </ul>
+    </p>
+    <h4>How we use the data</h4>
+    <p>
+        Data collected through this service is used to:
+        <ul>
+            <li>Allow sharing of test results (sharable image for forums, etc.)</li>
+            <li>To improve the service offered to you (for instance, to detect problems on our side)</li>
+        </ul>
+        No personal information is disclosed to third parties.
+    </p>
+    <h4>Your consent</h4>
+    <p>
+        By starting the test, you consent to the terms of this privacy policy.
+    </p>
+    <h4>Data removal</h4>
+    <p>
+        If you want to have your information deleted, you need to provide either the ID of the test or your IP address. This is the only way to identify your data, without this information we won't be able to comply with your request.<br/><br/>
+        Contact this email address for all deletion requests: <a href="mailto:dev@nul.ie">dev@nul.ie</a>.
+    </p>
+    <br/><br/>
+    <div class="closePrivacyPolicy">
+        <a class="privacy" href="#" onclick="I('privacyPolicy').style.display='none'">Close</a>
+    </div>
+    <br/>
+</div>
+</body>
+</html>

nixos/modules/tmproot.nix

@@ -476,6 +476,22 @@ in
           }
         ];
       })
+      (persistSimpleSvc "headscale")
+      (mkIf config.services.tailscale.enable {
+        my.tmproot.persistence.config.directories = [ "/var/lib/tailscale" ];
+      })
+      (mkIf config.my.librespeed.backend.enable {
+        my.tmproot.persistence.config.directories = [ "/var/lib/librespeed-go" ];
+      })
+      (mkIf config.services.hedgedoc.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/hedgedoc";
+            user = "hedgedoc";
+            group = "hedgedoc";
+          }
+        ];
+      })
     ]))
   ]);
 

nixos/modules/user.nix

@@ -38,7 +38,8 @@ in
               [ "wheel" "kvm" "dialout" ] ++
               (optional config.networking.networkmanager.enable "networkmanager") ++
               (optional config.virtualisation.libvirtd.enable "libvirtd") ++
-              (optional config.programs.wireshark.enable "wireshark");
+              (optional config.programs.wireshark.enable "wireshark") ++
+              (with config.services.headscale; (optional enable group));
             password = mkIf (cfg.passwordSecret == null) (mkDefault "hunter2");
             shell =
               let shell = cfg.homeConfig.my.shell;

nixos/modules/vms.nix

@@ -116,7 +116,7 @@ let
         });
         default = { };
       };
-      drives = mkOpt' (listOf (submodule driveOpts)) { } "Drives to attach to VM.";
+      drives = mkOpt' (listOf (submodule driveOpts)) [ ] "Drives to attach to VM.";
       hostDevices = mkOpt' (attrsOf (submodule hostDevOpts)) { } "Host PCI devices to pass to the VM.";
     };
   };
@@ -126,8 +126,8 @@ let
       (map
         (i: mapAttrsToList (name: c: c // { inherit name; }) i.hostDevices)
         (attrValues cfg.instances));
-  anyVfioDevs = any (d: d.bindVFIO) allHostDevs;
+  anyVfioDevs = any (d: d.bindVFIO);
-  vfioHostDevs = filter (d: d.bindVFIO) allHostDevs;
+  vfioHostDevs = filter (d: d.bindVFIO);
 
   mkQemuScript = n: i:
   let
@@ -204,7 +204,7 @@ in
     services.udev = {
       packages =
         optionals
-          anyVfioDevs
+          (anyVfioDevs allHostDevs)
           [
             pkgs.vfio-pci-bind
             (pkgs.writeTextDir
@@ -212,7 +212,7 @@ in
               (concatMapStringsSep
                 "\n"
                 (d: ''ACTION=="add", SUBSYSTEM=="pci", KERNEL=="0000:${d.hostBDF}", TAG="vfio-pci-bind"'')
-                vfioHostDevs))
+                (vfioHostDevs allHostDevs)))
           ];
     };
 
@@ -261,12 +261,15 @@ in
           };
 
           preStart =
+          let
+            hostDevs = attrValues i.hostDevices;
+          in
             ''
               if [ ! -e "$STATE_DIRECTORY"/ovmf_vars.bin ]; then
                 cp "${cfg.ovmfPackage.fd}"/FV/OVMF_VARS.fd "$STATE_DIRECTORY"/ovmf_vars.bin
               fi
 
-              ${optionalString anyVfioDevs ''
+              ${optionalString (anyVfioDevs hostDevs) ''
                 iommu_group() {
                   g=/sys/bus/pci/devices/0000:$1/iommu_group
                   until [ -e $g ]; do
@@ -280,7 +283,7 @@ in
                   done
                 }
 
-                ${concatMapStringsSep "\n" (d: "wait_vfio ${d.hostBDF}") vfioHostDevs}
+                ${concatMapStringsSep "\n" (d: "wait_vfio ${d.hostBDF}") (vfioHostDevs hostDevs) }
               ''}
             '';
           script = mkQemuScript n i;

pkgs/default.nix

@@ -6,4 +6,6 @@ in
   # yeah turns out this is in nixpkgs now... we'll leave it as a sample i guess lol
   monocraft' = callPackage ./monocraft.nix { };
   vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
+  librespeed-go = callPackage ./librespeed-go.nix { };
+  modrinth-app = callPackage ./modrinth-app { };
 }

pkgs/librespeed-go.nix

@@ -0,0 +1,26 @@
+{ lib, fetchFromGitHub, buildGoModule, ... }:
+let
+  webSrc = fetchFromGitHub {
+    owner = "librespeed";
+    repo = "speedtest";
+    rev = "5.3.0";
+    hash = "sha256-OgKGLQcfWX/sBLzaHI6TcJHxX1Wol6K7obLf0+CHrC8=";
+  };
+in
+buildGoModule rec {
+  pname = "librespeed-go";
+  version = "1.1.5";
+
+  src = fetchFromGitHub {
+    owner = "librespeed";
+    repo = "speedtest-go";
+    rev = "v${version}";
+    hash = "sha256-ywGrodl/mj/WB25F0TKVvaV0PV4lgc+KEj0x/ix9HT8=";
+  };
+  vendorHash = "sha256-ev5TEv8u+tx7xIvNaK8b5iq2XXF6I37Fnrr8mb+N2WM=";
+
+  postInstall = ''
+    mkdir -p "$out"/assets
+    cp "${webSrc}"/{speedtest.js,speedtest_worker.js,favicon.ico} "$out"/assets/
+  '';
+}

pkgs/modrinth-app/default.nix

@@ -0,0 +1,97 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, openssl
+, libsoup
+, dbus
+, glib
+, glib-networking
+, gtk3
+, webkitgtk
+, libayatana-appindicator
+, librsvg
+, wrapGAppsHook
+, stdenvNoCC
+, jq
+, moreutils
+, nodePackages
+, cacert
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "modrinth-app";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "modrinth";
+    repo = "theseus";
+    rev = "v${version}";
+    hash = "sha256-gFQXcTqHgSKfne6+v837ENXYYiEYu/Yks9TpnfBCPnA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "tauri-plugin-single-instance-0.0.0" = "sha256-G4h2OXKPpZMmradutdUWxGG5axL9XMz2ACAe8AQ40eg=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    nodePackages.pnpm
+    wrapGAppsHook
+  ];
+  buildInputs = [
+    openssl
+    libsoup
+    dbus
+    glib
+    glib-networking
+    gtk3
+    webkitgtk
+    libayatana-appindicator
+    librsvg
+  ];
+
+  pnpm-deps = stdenvNoCC.mkDerivation {
+    pname = "${pname}-pnpm-deps";
+    inherit src version;
+
+    sourceRoot = "${src.name}/theseus_gui";
+
+    nativeBuildInputs = [
+      jq
+      moreutils
+      nodePackages.pnpm
+      cacert
+    ];
+
+    installPhase = ''
+      export HOME=$(mktemp -d)
+      pnpm config set store-dir $out
+      pnpm install --ignore-scripts
+
+      # Remove timestamp and sort the json files
+      rm -rf $out/v3/tmp
+      for f in $(find $out -name "*.json"); do
+        sed -i -E -e 's/"checkedAt":[0-9]+,//g' $f
+        jq --sort-keys . $f | sponge $f
+      done
+    '';
+
+    dontFixup = true;
+    outputHashMode = "recursive";
+    outputHash = "sha256-9HtTdIotG3sNIlWhd76v7Ia6P69ufp/FFqZfINXSkVc=";
+  };
+
+  preBuild = ''
+    cd theseus_gui
+    export HOME=$(mktemp -d)
+    pnpm config set store-dir ${pnpm-deps}
+    pnpm install --ignore-scripts --offline
+    chmod -R +w node_modules
+    pnpm rebuild
+    pnpm build
+    cd ..
+  '';
+}

secrets/britway/bgp-password-vultr.conf.age

@@ -1,10 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBsKzVa
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBJYzdr
-TWhHZEVLaGRGK0NCRmdOQTFERHZYNE9kZk9yM0VFQk1yMThsdTNVCjlsOE9BS1VX
+b1d2aEtVd3lVb3NBamRwVFpTaTRjZFlCczk4MVIwQUoxWklwN0NrCmFFekpPYUlO
-aW56TlJKTkw2VkQ0SkJpbzVmTExXYmxDRDhISDBMWno2OUUKLT4gWDI1NTE5IERn
+YlgvVlQ2WDR6amZDN0ZSY0Q3WWtTME5pUmhQeks1c3dGOVUKLT4gWDI1NTE5IHVK
-dzNrcktvTk9pbEJiN1ppcktVN2RKaTBmR2JVd0U4Q1dWUVZRcmh6bk0KZ0tuZlc1
+bUZvUVAvL0NmQzFkY3BuYm1wMjcwbFpLRUNpZjJCaW15SEVDUDV0REkKRXFMQ2d1
-N2ZtaE9nWUFoS3VxZzhka1c3YkZCVnRXb1FlaWdFWEFnZUEzcwotPiB1LDl6QSkt
+NlFBejBvTlJrcUtCYWZxSDBkbmxIdExBNTU0aC8zRW5OVWllVQotPiBDLWdyZWFz
-Z3JlYXNlIDY/aVoiQTdJIEZEdG48KiBaMkEgIl91Rwp4bWxXVEEKLS0tIERzT0I4
+ZSBkeC4oTFUgO0FtJG9+RyB2IF1QXGhxVwpJS213MXBRMWY1cXlHZwotLS0gRUF2
-NE11UzRFaVhqeXVvZEFsbzJLdDFBWUUzeGlzSy9Wd0lzZmhIazQKtVqTPjM7O4+C
+ZkswNlhvcDhTc2tybCs1dldwa2l6SDZZVmNkNUNjNGlkV1ZVa09pOAp88dxHGxVU
-QQ9Nfk0O+TVxr1FH/IOoHVJ4R9v8HsuN0z5ZgLUjvIAmPLobUDTk37mu
+vuFQO6JcroY9MF5Te/YV+wMc3hVxksibMnH1TWGh207prwcOWNOEz2iEkZY=
 -----END AGE ENCRYPTED FILE-----

secrets/britway/cloudflare-credentials.conf.age

@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBLVlg2
+ZUdtUlFUQXBLT3B5YmkycWJnMXJyKzltbyt6K2dJK1RBUm5ydWwwCmRUdjJFSEYz
+Wnp4cGtzTXZwc0s0SUJQUjRlOUJlQUoyQ3BETXZmY0ppWG8KLT4gWDI1NTE5IGR5
+QUJzeG1DQTRLUmRwNnNSRUJRSFFtUDl5VjB0clVLYUp3R1g4TEVKaTgKb09tVlhF
+R0tmcmIxMHVHcG80RGxRTEhBcngvT3MrdnNPbmpCTlRyZW5xQQotPiA6RzEtZ3Jl
+YXNlCldSUlN2ejB0MGpyUHYzNS9OQmJTK3MvcXRDakdBVlhuUEt6SFE4QmhnWVN0
+V1JMOE1oaEp5QQotLS0gYW1OMTcxNWJrUndmR2h0ZmRDWk5CYnJjc29pSERUMnNk
+d2VhTGdpOW4yUQrEeH2E9m0YycuW60QrdlRetO1kNU5FaKXRQt46iA9lACIWD4rC
+Cx6WxhCBgz3hvm9x6iuYiiQxZzgJNK7qXcV2MBeQdivazeEbC7blAKVPhwD/dl+b
+PzBDXRXG3c3jMjeZFT69fIBGJfZrrLGKpTALVE4dTVXmQmVVQDTp19IC+jUXHBti
+Pj6Dpc7452s8zPkzZyRbasO9b4PYTwq8IHT6X7ITwbzZZm8gexDYe2SzRZ5VcPz3
+El+yoULZ92WbXPSQIP/Slx4BEZjmsQS+sm0N8AnBRNZkWVbHPF9IZRg3VjDAn2i8
+F3un5js=
+-----END AGE ENCRYPTED FILE-----

secrets/britway/oidc-secret.txt.age

@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAyMWox
+cEFDWWUrVzJSM1o2azJqei9HV2xFY25oQXV5SzM3akxEaUJiN1J3CjkrQVhjWHY5
+Uk01eGp5Q0RKNVREVXJVZytndTM0SXNZSGIvUVp1TnRiNXMKLT4gWDI1NTE5IFZn
+WjAyR1RMajEyMnFSYnNGT2EyekROVWNoakFJQVZxaFc0YThOMHVyanMKWldrdlAv
+cVg0OTFHL2loeGJ3RHA0MnlnckN3czF4RUgyc1NjYXVOSXF5cwotPiBvTFQtZ3Jl
+YXNlIDRsSDp6eikgT1ojIGEzOFZMIFc3MUZGCkttZ3ZLNGxucnlJc01kRXFZTGpC
+eCsvRzl5WnFUMUIyTWNVWGk4SjQyN3V0bXQ4VzFuM1RjSzVMcDJkaW1JYXMKQkE4
+YWI1Mmg3MkpjdVpVYWJkczJQMnM1SVMvNkZhOXBDVEZPCi0tLSB3SVIyU3M5RHBE
+VFRtMFU4OUFLbkNjbkJmVmhlc2VsYzdsd0pFaFkrUmkwCs+h2KlXoyZ8U++A9wmV
+kh4N2YyI/a84yPGDNoFdSlXaU8jxUzolnadImXSXyB4CroqQLvGEbkZZlWqPLVfh
+Iav7Ja8=
+-----END AGE ENCRYPTED FILE-----

secrets/chatterbox/nul.ie.signing.key.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USA5b29F
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB2WFY2
-a2IzUVlHUHNtTjZxbDJORTZOeTNxVUVkZlZiUFdNTHNmQXBVK1dNClpiSnMrZDdV
+MzFnVFYvb0wzc3grRDBrUi9teW1tNmx5dVBIRVc5OUdlcjdvTDJFCmpJL2tlYXND
-NHphUDJjZFVZUUhYSlgxRTRPTkZoSm5CaWxiZ2NyVGNYaUEKLT4gWDI1NTE5IHZM
+bVJKbzd2S3JkSFVMdG40MS84V0lPTVJSNHVBQlNXSkN1eTAKLT4gWDI1NTE5IFBM
-aGtFQ005b2hHL3RwUXpIblAwWlhCVVlFSnlxVG83WFU0SnR0VXJBelUKY1czdGt1
+ZGo3L2VlNUZqOEE1UHBuMHdqc1pyYlQ3R29ucE9pajU0bHMzamlXRDAKcG1Qdmw2
-ODJCdlFmcUdKWm9nMDdmRDl1bEdNZ2lIZ2lYN1ZsdnRBVHh5OAotPiBZRnphLWdy
+cUlncDFWNXBOWnpIeDNZSFA3d1E1bjNaVVpKU3lMRjRaSHNtMAotPiB2XUh8eF4t
-ZWFzZSBSOis0IC5iYFtxZWIjCkxmNjNvLzhLbFNVRzkvRUpNaUV5YnN3SFgrMENi
+Z3JlYXNlICUrO0cxIH4gaTRoIF81SEpTN0Q5CnpWdEZpb1hZa2t5YkE5RnJFMHVZ
-ejhJU3JaWnBkMUFuRW9RVE53ZXFuekxhcE5IUDJrQnhIbjIKUi9DMVdBenQ2Z0x4
+WkhkQ2o0eWtyOE9ueDJkeGd2aUhmLzRUUGs1aUc1NURIOTYxczZhOEVmT0EKd2xk
-azJmOEN2K0EvWEQ2VEZ1ZkdJbVAvUEszYnZBdHJFWE1wRGNqa21JVmZNU3cKLS0t
+TXFHN051d25PQmtNUVZkVEFGUVliZjdmZDF3RWFkaEhNTzd3ZVd5N3dlNzQKLS0t
-IFZMS21HRDdrdkhUR253cWZBeFJvS2RiNzNTZXRqNDlBMkIrUVF5VXBhS2sKuFHr
+IGZDR1Mxd24zOW05bitzQnN5WWVOOGtCNEc5aXIraEF4eXFUQm5CZUdCV2MKd44C
-y12A4zTOz8NCanEmvnX8OTHeWS6uVLEBl/gKnqPU756S8WZ7EUvErZgJSvx7egzV
+/Trgg0OEZ89/jqbj56z/Hia1Ka3ZsEv6bXPI/kcRvFDBFTgtvG3KWCgMBtTUHXzY
-sNIIbA4PtIfXouZHU59C7RjH67J9BiIlx3dDgcaSe8iceNdw8zwQRQ==
+TKBPoQqrUf7plH7a/mTx3KR+4Y+yF+1i86s7TzYjD8d1xfFH3BsVtg==
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/synapse.yaml.age

@@ -1,30 +1,30 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBwL3hL
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBuQjBY
-SUJrckwwbHM1YlBTSTdabGRIMHhsSG1veDNhakh6MWsrM1R4NzJnCnVROVVSa1o3
+K1ZTUzR0SmFoYUZLdzUzNUt2M1B4RFdPZzFkcW8rMWJLUjVHOUN3Cjd3ZHdMSzdp
-bzJsWG93eEZsQ0JFVlJpMVl6MXBMM21yNzJLL2FtQzR1Q28KLT4gWDI1NTE5IGJy
+OWswditVWUhYNjZCdjV6M1d6U3pNak5hUlZjTHNqSkZPSk0KLT4gWDI1NTE5IGNG
-SEJORVJUWUVxMitQZnRoNzBOVUhIeldUWFpjU2doWkF5K3R1OTVFQzQKZ09yd3Ni
+ZytHazJQWTExMjNkZWV2aDUwcnZjUGcwcXRkZWl0M0F2R2JpUVlJekUKWTFlbkEz
-SU16bFNnRkZOUDF2REF5MG55K2o3RENSdlVTSDJjSkQvaUgxTQotPiBxND5da3ct
+YlN6dkgrMmFFcmlZMjQ0b2oySjlEMC85cUF5QlA4NGF3blBKRQotPiA8M1hbWS1n
-Z3JlYXNlIGxBZ2hPWlR1IFxOI04nIDkrCnpmR1JCTnN6Wm1zRm5JUE1vSU1mQXNN
+cmVhc2UgOmlZJFYmJgo3UExzUHhSVi9lbVRjNW4xTnVaUTVGSGVDNzRUNlJ2TnVu
-M0VJUjVLa3Vjd2ZZSHlXM1BkaWxkY3RlMXpHcERwcDFxSnJUYkRwMmMKT0tUL0FZ
+U0wrWU5kd3dyR2phcUNVUHJCYjdzeWhjNVFOV011CmZMOVN0WDk5eUg3ajhwbStQ
-eVpCTHgzb1VJRkRiZzgwekhqNXJIa3dVYmhrRjVpSVBHT1haQ3VUVWRQOUpxVGlU
+aHExT0EwblpreTBXVHh6Zk1HRkhzcmFQNnoyVUlaeStMUkgKLS0tIG1aY3Zadko3
-YmhDTVZKdFB3Ci0tLSA2QjBDbGRoZXBQaEt0ZDV1d3pMZWNpSVV6Q0tXWHJMNlVv
+V3pDMGswSDZCeit4SVhSRCsrZVRVZVkvQkNsQWN1MXFMUGcKcK74YULWqWw9VvkI
-ejRGbmV4ZkhFCtHL99EhZ8RouBXKFdbL2rjMN89NY8UnDdHSlBJJ/GMImjPHTGsW
+NH38VHfDPW5ueSiyHHKn8MI9YosPr/TmkwgKd/DOIMVB74ahPalo1QUeg+eaBVnq
-Rwm8vIG3iHh6R7VN/yU1mvzEa9LgzItqvYH4ao5WQ/GlZzQIEF3rJXXAn9tiVXeT
+Uncsbx5ecW3JswthkAhiktWHcdHmioGD6hCcgbWtfA3VvbAYc2gtAF2plfDVH6BD
-WqBvV/zWoqH3wHe6ZXCXKqSHAJajFoNFbizEQuzN9A7VxuEm3SD+Bwgu4hKdFL7H
+c8veai3B15ZmDmq3b62sgVA9JUgbFaB1eRqcaPXmNgQJR4c8J+CZWXGQ/TKMqtAg
-dL1zjE6R2idgtWGvRdh9lucrqtvPtnGeEOQ84SXGSMCq1sXGiujFp1DydcydM5LF
+chCDuczjLX8IxhMPF1gdCggSt5GtMhY47fpZJRbBUw01l8koqjm63KvEeg2ejFGU
-MrUlAVV1K/PeydqBa/MEztaWkfbCz8Rb7ZRNs8HbxC46/XVl5HwNiTQOe4c6QVoE
++tXonI4jm2JUxlDTqmNSrVpmAgtPoEPszHc+GsnyNjAz4IXMm5UrQAZyDPgxtwQW
-Yvg3KAxeY68pNKLgeX4g6FOjRiMKuftABciXhnXW5h9ki6BzMreZz3ItwlW6yDZF
+ZAn0IdOB8rSL/AnRGUpPrecuauINQjONe8CapijjJPQK7g1AHscfxr+OJD1j2eV3
-SrO6+liRfzwTFPoSzWUwPHcW/LysQ4+AGyjS2YxYlmMcFzUv2Z0bRkeKWAY7aw1N
+O6TNlz8vKW4t/V7CUf46ykxxExhA0mKJ53ksaXy2+HWoro2+c4nao/bEld5gt08U
-qanaMiLpZZR+5rnsRBlHB/JO9PWi+p0pqQphbJlVcpepN7omXMP8YblOlG/UHt/I
+uCpJtjPKB64X6vdzbY21/l87VRDyxbb3poENfrXlawqS0Z7i2gAbHN5EuiMv+35o
-jRXKZsBAnX9/YSxkaAuApoJSvJTYhlxzZgNf8+3bihwygCVwB2OnJhhzjT++Ij1O
+sBaR0BfcbTn6VagC3i8HEEOO964FrW65pkqmGJcJMgUdcZSl+Y7gHMjWyodqGPOY
-0J0jF9ZlG7vlN/xHJHMu1rMl8Gk3kreRv/WQSY9FS6aVgZym+XbnXDLTD1HJdHMt
+evT6xj4iyeM49vXynV2vrJRu5rr02hOS/8rPphV9c9q9ju5n8xbhS6IiybAelPwt
-fqubkjkv/trOBo44RoROc+GqtfGLB9K8wOOgZFb7unexMq0E08+G+Ruh26uD/wKD
+sa+xM+w0n+fxVksiXeFj7qD1LDN4+kwqhYP9SlzbA4fT3AkYYrxthTww4IFAweyQ
-uXB8ShSk+82UuZVUFoy9JVUmMuoZV8OCzm+g6yPdi/ffFT20nXW+SCn+o+ex/V3A
+IJkpVL0/IZEIEfRzpr0lWLprAaoyPc64pecl0z/gBJDgz1kSG6iEh6K4qx7ahGde
-9gsYVzBtxVkL0euW05ELJXus9fGA+jClZM13iDbwsfBhtx/UYFsyKI3vvmA6y7/y
+kBBpS2I2ZsdBkvmQxDSM7tYYBzPxcUNZlSFOIeUy3Xl+OGPlKgtMofbnjV8AFqUf
-DZN1eGIL5w7eBW6bvWu3m1wQIu7pq2SETyVNWWphmELLRxHfNiy7P48X0TpRGLMJ
+tOpgKpLUEkTgXbGUKBxHLj+8pbw7zOFp4sJ00i48ZzLP5D9jom+jS19wGshRc7cH
-rq2IC3rlOZtAFB+YLRZVVR9eYdDE8CUGEsfS2FZWnxLS4fnA8NlxGtNh6pxLqO8A
+dK92CctvrfndQ85yO0vqlyOdMTqjh/z3P2KmhL5SW6P51q5mseTvj7FNM7331DTs
-tZKqyzajAuV35rDx6dySpd7Tb/oMOcXSh1g3mb6L1KvrhI/WOa6ZS68N/uEf/fot
+rq7XWaBLE61eWWQ/dZKnqh5YbkSlU1+08Rl6H/vCU5hTC8fht3KTQSWPofkrP+5f
-VnMjR0tj7CySw35nCcITcKKpUB1a7WYWKhHuYJmb+YucI8jvWZ+jYHQ4HifD/W4/
+We/Pe62LyhV/MbLRA0nmU7Sf4IAnpHfa4kLtlYeB3xiqKd0McM//qzjuk5NoIgE4
-d1tftdPv4E3yKV9Nt+gyPbm4pI5p50F0Q30ZDvQkuSPZlWw/azeKHZS/RY8QKExt
+nL0T8YXdGt8K01w+nt+j5bo5gFoRz5+1/ZZ9BgN2DOo4SClYnJWQ/x80X061yJ33
-YhQaPc0jNxi/sR3qPcmqJ9FKaFAz2mvrZdz8aKc5oFGj
+0SGv4eAC3vFi6xE=
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/syncv3.env.age

@@ -1,16 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBGZWpt
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USA3MEFh
-OSsrMjROMDNUa3AvZnFheDJTYWRWblA1aE40czFudXkyMWxoQ1hZCis5ajhtS0Rw
+YURySHY5RjVQa1c0QmMvTkZtZElNd1BIeDFpR1U1YXZ5dndnclUwClA2M0ZYMk90
-R2JQWFdkeEROZUFWYStjaHBtRVR1QURHSjdGK3FLNS9odjAKLT4gWDI1NTE5IHUw
+RmlCZHVISkxZQTZXeEhZVUROSVRGRVg4TmZKZytSL05FcTgKLT4gWDI1NTE5IFY2
-MVh1V2pqNnFhOHpmd2loSWNXSVhmVitEcTkySlNDVk1uYjhHR2U5Rk0KeTRlYW9L
+V2k3S0VQdGlQZ0hkU2ZoSWdOUG9rQ0p5Ukg3ZHU3MXVvNHlWYVN5VVUKcWtoWDJh
-TkpLZEtRS3QrNkI4NkdDbG1BNmhIdHZYa0hxTGIxWEwxUnBadwotPiBiQS1ncmVh
+LzRwcktWUGQ1bnJvRzVBVlpHU3NhdzYwUDBPTmx3MFNrdWNQYwotPiBKQil6Km0t
-c2UgVj0gRWQpIEJ1Mn5bdiRRCjRBeXRqeDVYUXA5K0NWSlpwUS9OOFdHZGxSUm1J
+Z3JlYXNlIFdlRTlUU2cgVlxLIzUgJlVyQiJ8Cng3NzF2b3d6MnlEdURQWHgrSFJv
-dHB5aTNTZDBIbjhRSEJMSjJHMW1jZld3L1lvcFViaGlTQysKazJQQk4xcTh5UUFm
+Y1BMUkZyelJSdDJvUUUwY1k5R3ZBMnJaa1R4NWxlUll2azNseW5MQlpvVWUKYUdN
-eTNnVjlIYnVuNkc3VjlsNHlUd3pqVVVqMGpabXNRCi0tLSBHNVNzbHpIb2JiQ3Ny
+d1ZscXVxd1dxSGpzMjBYeWhhYyt5ZlNkSjhmV1ZTTDBTCi0tLSBBTG45VUJOSXZv
-azI1aEYyNHN0cGoxRDNXRXlrZUZPdVRzOE9XamJzCnpF0Q4GTTI7n9uBKeM/szN6
+N3lYNVlyZldMVkpZdUMvS21NdSswVmU3VThZK2M2eis4CjwfWWJVR9Ty5dBXEr5s
-H8XCLqPMlG3TRT8KkKEG65tZMqkYR7nCR3Iw/DcaeQr1IBiLsN9zy9f/M4rYulgu
+U+QrifXvyMJJvqOKEfMYYomFLpt/VtbDAUwNlqLnFIk1VZ2xPUBisXPtReiCK3gq
-MD7eLq/T34YQoqhIg/xDEVrtsQbhe/Brzla2Qtcfigqr3elQxwt4KghQTGZT5J9K
+P+i6bUONSmPYvmF82VgiuKDuz/kmWqVGg2iSBPIXAGLNIEojndQwmhnrsN9ex4Xy
-evgwFK6M65MSj0z9HQzg2wQ/9KniZ0PUCz/pRuNSLT4GzdKGOeKqSeuuFduKyW3n
+lBHkvVsN8EamUJwZ+FEZe4+PjA5yEnANWpeTELOt2gA92/jwwnNIsr07eVTlkh8X
-ADddYdum7OpNbCz1xoc2m2+RP9W9qQOe+x51YQYw+V1FFfL22Npok8v8r9xANEj9
+UmQ2owGwktXP7it6//NV3C7sAdazs2bX65WSnog2E8WPNAorKWI8RCYs33CshVFt
-cCXkDGv8TmHQVkI=
+zzclZ4hRmlAmqMHYqFY=
 -----END AGE ENCRYPTED FILE-----

secrets/colony/borg-pass.txt.age

@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBmYzlW
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBoYlRq
-UlVnc2ZhWEk5UnBKWSttS2FaUjJVdnd3Wk9WS1lRcXlTNHpiY0VjCjhDNmdOSlFS
+ckk2c21uMVZSR05SdlJpck5MT0FZeUpLTmpTRVN2WDkxWWxmVTBvCjlHZWtEQ2Jh
-Yzd1ZnhwWkpVZUJSQnRZNE9UQnlVdEFjNENZZW5FdlY2OGcKLT4gWDI1NTE5IG4r
+YUdybjJLWkNsZkxabTVIR0JnMno5YlMvVmhodDU1bktrSzgKLT4gWDI1NTE5IFZT
-V1pRY2lKQTFMOUFGd1NjQTlQZmEyeVAwM0lJYmxqY3ZSeko0MU5iUW8KbFlIUGZ3
+Um9lWXhqRFFLTWdNaTR3Sm1acmY4N0l6WE1FSW54ZEtQcEE5RHBRRHcKcE5KYmp1
-MERlQVBRVHo1TWp6WUZyazVQVStBcEo1S1VKYjJ1MTJZRlZDVQotPiBnajtfMH1S
+WVdCVk0wMHZ2SCtUR0xKWU10N0xETXlXZmgxcmZZOFBXYWtBawotPiBlRm1gKGxU
-Wy1ncmVhc2UgeGlJYGtIZyAhRyd0ZG4gX1NIeQp4UktJY3Z0MG5jSWFwZk5NdHVY
+LWdyZWFzZSAqXF8gOkU8Tm96IGA4IC1TCjY3NUgKLS0tIDhjaTNrbG1iQ05iTWRS
-UWRWbW1PSjFMNkxndWFRSzFyUQotLS0gS3ZXRGFzZStraFlnbHlUaURIR1czUHE2
+UzIvNzA5TmVGS2ozZmYrYjlBY3J4Z1RRUGRNeWcKUTIEhWqr0fOODu86MDll7k3U
-bmtEbng4SFFaRHdKUTdaeW9FMAqJAiLDwYvCPkYf5VxOEpN3F+T6MZO7cCEwbrIV
+ThgmS9nlcUY3fMgXzZLtpHIJ/4ZSI+miu8RmLMaeC61qv6xNThGdx+MvU4tMBWKA
-EV4w6Wyl/BvsV29+0DOTVKNi27ZGk8zSoKNpWDw9+Np13Yj0MNNCEQFofjDltuIr
+Hv3XGi2MYL1jdHh2KYg5PgdqchYuHrFuBPS7c/tQow==
-2RgkfE7bdWJpOfC9Zh/Gl2zrx25r
 -----END AGE ENCRYPTED FILE-----

secrets/colony/rsync.key.age

@@ -1,80 +1,82 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSB2RnVN
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBZVkFh
-OHo2c1JISGJYZGxOMHk3SERaZDU0STRXUkpSMFZIMVNRVGZlTzNZCjRlcmdnWXF3
+RDNNZCtySlNQTTZFbzJvZmF2TEZKVUM5VjFjQWNSeHlNc1JNZ2hNClVac2pEdWdw
-WjRDOExHSmNiSkZocDdOUkJRdkgvcGo4b1loMEQvZXlzc2cKLT4gWDI1NTE5IFJv
+OVpOTmhWWklVRDA3UzZWWk9QVG1ySUFmTzRSVlFReVdFVFEKLT4gWDI1NTE5IDVD
-bWhCWENoLzRQbm1RaEtwTlpoMnNTSnI4QU9hTlY5NE1KU2t3UzAxamsKY3M0NWtC
+eWN2S29aWVNVTTdldXFxZG1vWUNYK2RrajI0OGNGaklzdFByTzlPUkUKTmsvdTE3
-Ui9EQlJzaENkU1V5UkxKMTZCYXpWQ2krNU5nS05IRXVWMVdVbwotPiBMLWdyZWFz
+ZFBvalZsdENxR0VnV3FVSnFxTitBRlFWR1BzcjJWd1h0U3hpYwotPiAyOkUlJC1n
-ZSA3ewpoL1lPY1ByTFplMTZJU1lBYXZvbQotLS0gV0djOWRtSXRNYnV6Z1FvTncx
+cmVhc2UgIWFOMiogVDc8IFZETk9BSDVTIHEKQ01rc1ZoNXQxUDdtWGRQUlRCV3k1
-MUhwdS9EN3NkKy83eWtLenBDWWdDY2xHcwoOV+/K2mP3QA6vSaa0MRRK4m1H2iia
+djNZeEtOaUl6Tkl5TDA1S2ZXWTFQZEFiV2pWMDJpZ2dkYXdBOGhSTVA2ego4UnBz
-dA5BmB37ZdJs/9bWexMVee9RY10xW5VmKoo6fctrIx9NdzPlBL38vGEwpmgAtA/W
+ZGhXcklMd0NVWlhsc0Voem1wUzMyREViUllCRAotLS0gMU5GQjdJaVdlUFJGMG82
-Gjp/eg31rZahxlQuOe0/xJme5khUuUK0knF65aO3pgE9LAAX7iibU8dJDCI676VR
+YnZCUm05ak9qcmVyUVJSS0tHaWRRTld3ZkNPMArRgojrBQvlyjMhChn8jgUNDysj
-5knVLrKEctvWfz+fZxod5eKIk3yKRmA/b76kGUjoM1iKP2ASYn0vOD6SFWOGcnDo
+9Nh3BVqf44fiUNMKARTrFTz3wVMlioo6MmKRzJ/yj0fWkZ2h80X68Nq3rQvy+0UK
-gHdkCaCt/0wqcu0JDKo4XQ51f654EFNR9zwxkefpkVU3ILm6Z66JqKElOpd1I6MI
+4PNPRbwY5ib0nf7n3itFKjehrYr8HnOjreQps4it52bT5re2TWIC9ogZhNKBLRvB
-luystPP/7+aqM0SY1CqWCzU1w8GMlnMAhSGyCj9Zjzntrgy5PbFMXuF7c4s/+Nt4
+qv14HjcF5bGnia8TgSU/8nUZJuIaLwHvS5sc9GOtmV4lDwiSTEJQEtGh716Jzuvs
-/AqNWkruXcck8YapbY2V9h71AK7GmgBCaeXVgTKKuywHz/jtyDySQdb54EaWySx3
+XxQLPEVVufAjZUKLp+jWUhXGkvUEeY5bxE2aOLuB8kLfHPC/5p2rl/n2sW3oEDFn
-R7PQrbYe7HFYX1ZO4SL94ENJhC+TaQDVX59B2KK1tHZLrcCJArxZgPMiK0Po32uG
+Fw+XcNnCHWBzk3DlzKZFXwIaZL6Ocqrt+p8CBpWoNhbssuKyOtEbWQOmJxX3UPMt
-DPgkgG2c6288fIl2ZkTVwI/uc5t/fjer2dssIAKBbKdpzIbu0W+g/QsMkIn+UamO
+sBFNdKSKFhoBQ4ukqkKDhgcm0i+8wG4eBbNIMIDwzPBxK0QiVriwlPQHl7RS2M/J
-Tjx0gCymDmVJh4OQhJP58JdPGSoYdY/ILRX5igm4ApGofxI2v7vi3pZHP6XjkSzO
+LgGeS7qrKC3SgmLu57CdUVUlnogJ4oOg7FPh6x+jQBIIv7gtYCzJb040TUZWZWvi
-Bu3g+rgSWIE4b0bQ1CxYhAMFlZr/qcPEBnvm5sLMaQ5WwzOf04ng3qyaG2kiKZba
+cfKWBBwLqLa+7Y6kEhcosLUgw2c9Et5P4rvNjU598q7qrZq7uK6Mr+PMwD3Pd66O
-8JqujYcpAr7mPrabBX5P1GMOI4dFw/RO1sA7gdpAbDSrk8skbyH6SuSUR9ywftqX
+SQyT4nYhhXBnaIsLXZfima2nRzPocaBmfsuXQwlnLJC8JB6yzqEViK0xYKfl0fIi
-ej4WWEWITs26Plmmh0WkWovV/ISV75Mxt/AhimfzT7KxX/2NBNWWhK0vd+QupaVG
+jxuYBw/8Y+MWQhIkF1pP8z+Kw51QdK4CIV33mlLBJnGjlizewsjj04EIgpzQ0+3I
-seKcQHPdkrqs/tqr+SDVii7tsFz7nsQj55HzNgQapLwPh3hQyzBR7pHJQkzeB4EA
+ZRyee/SzFmGBBk/pMGN0DizA8LS9yZ9DRGrc13rYVUTN6G5xT5AT1eEtFbQ6DH/n
-GKCDkUy0ANQMp+b9H2bIF+xnfK2jUuPhgs+oVOAEGmlXWVbQYDB92EhPOs2joEqV
+q13Tur4QJ8AqJmwv1cnX+faH61dXahfbinveXWqB5S95/HE3OGnZfAiS5bs1jW4U
-NkWW2J/AKOSs4NWfwvXBsFQ3iI7rAQLwh+wMgOGKbV4gfDUjeyLTU6t82GySQvLc
+D3BLaBiFMYD+ccPedg5MLXRgEryVaOWlQ5wuXxqmaCG0KS6YLxl8o0bRR3lKXNZP
-JwlFMrV9xs/KcdvlsrRXbXnMr/MScQbt7V/Ln1hAyrv94j8SKoMbnxkpO+pgO9ll
+B7Ye0Px69aYtOs58dTOq0Peu039Fi5iNC0beocdKOjig4tZ6p41uz0jPGMUoDebZ
-8oNZj414/5vVFwAlqE649Rdeynw1uh/Nm1Ejt2yq051ktAwDJZ0y44SISPhX5k2T
+MYHax+a7Qpi5M6ZVGVpF1ieW2hqnm0lfb18cEYHuXjoI/YlgVhFPCGSzHJpuNiDU
-64HVq8Nc53d5y4DXbAEdP7xZRZhtbPP5eXFS5ViRogc3AfXtJpeboFQrLaaqHiS/
+qJSfOuD8HUB2iXFeEgAi+V3EKTsyjlS+R1zWxkr2awqAk7Uf3svLGWZNINHNoJRe
-wtW1X3+VYyOXCfcDlpy1LJFJ7dG/ZoqmGsTXzfYIUdLM4Piv/KODfqWeZmN90DWZ
+CPPANHzTSHlNPSelQ1CyOhl0W/eMCEJuJ9/6kZsmUC3zvzxEMGofG+Ub9RRBW/+/
-yrA6cjpPbrGiUSF2e0Z5/w7sqDwKxFFQ69p7KZphRrDNhAD10+YvY+PrnjvKO35I
+TkrVvMrQv7/Va/4dxMPCqrdOQ+3/LkVzGX7qg6tQR76Su0q7aqh38Ki9qWY47bTm
-F0NaQIJsq0AZnwIRDpOfvJOSvmDYlpv2UjaI0UrSmMxzfPcur4QH9TwTJSAYhExa
+lq5I2EcQApt/O1cGQJTFowdXVJXx/qQv436p/jL1mymQ8241iQ6XX3DUjbnqdI33
-YYcdSPJfLKUwcnXA9RidXldSBahreIUM6e/p69i6JabBKI4kTVfl8njm/3hcts4C
+4XcPa/B7naRkgSG1Z55Vv+IIBOzcjzUMzeQVP/WM3SFRNYT79mJnV0SsKvUFtUOM
-9EoVdnZT54weoLQhOjdqTJCGuUwlZo8dpeiT1Nu6apD5tv/k147k0r68NiBRYAX2
+1OxMGEx+ZxfNIZqdp+qo0+uIU00ciokldh4URo9u8EIHjFVcV3Eyb7EbbCxzDiU9
-jPLWcWgt0+NtlGl3pASCwc8Dx3dSkkEmm41pFdV7eHI3y2rTBWT4ZaODBbwidi43
+iwoAAaJjwBlyaRQFWYsKhY2J3NEay142WAyAiHmnNBNhZM9TKkCpjton4ehxeRUC
-9dO5RUWqZcyV0b3zRHs/VTQfbgwhSc/ezuHaAwNbOOR7GMqMOSrG90D+4bGHJjiI
+hoXpzh4J2lMhdcmXXZ675C3MYiLDpajgLS1dwRp+mAUXwjvQG5rmJd7UWdgpbdpJ
-KKneintcaNJXx99E7HVapl1v4mw2r72Amin51UkATlucwmPFHiLOV073IZvAPZLa
+K6wABNkl601XgKv3/nV9touE0KQjHg1fzo9vzmf8zVEViTgXxH3NECZHctObwgoo
-DLGUYMF+d64cuUZtlH+P4jcALonFW7Dw7Nh2NzGBWCeddCRMHvm59sZfjn6htuZg
+SlbUOW8vihCi2HU9G3tqH7dwkUsgB2a22JFovgwwW8ePKJQpdvwAV/jyFMLL6jyj
-zHVUyc0EDY0oYQrCHuv4gNNdS4AyYBqVpbZ1gNlMY+TkIdwrYwBfCsT8qxif0Q74
+6Tf0Gsc/Iut6Mh5TYiTWJdCzvEBjcybOVnppj2zR32/A/vAXUrJQaq0kwKkCwG+e
-9cFuIK1Nqul6qeCxKbHwetzMeIr44iPtTNfZ5jM1TJGOv/xkQaRqHOSi9iF3CeQp
+TL0hAQuA2Su27qTR9Xy2QKpQ5NppRH7V9YxCpjGfcLbcCh7XH7AEZaYfrrX8NoP5
-pNKKUih8e+99WeoourcBDpkQzEdURz/hr2EUS6ROflwGWhoMEWz9+jEzKNokt6n7
+zPalFA+7E1IuDRtT29wFNRVb3lAet9t5q0LUHf3x+Qk23dQ7Mdq2JIf9RIo5xZ6X
-cE0aMgfWiQ1mIgvaUVyhAZeK8SUZanVsFppdv0Th/kZnbg7UXpBDMB591mpPjj2+
+nsKa9eBQ0O5OAv1VGWVvbrVCMpmyiklYV2rcIT+dbrhrgiTu/BvODSvtmeANIkhC
-LD0X8an88SrNL4GIu92CvXhdRRGbWptjjMPudEua+4do3GLYAzPFQiPlMBAkDcdL
+uF112/+QW1UNPCENioYq9OWPcEwby+s9JkQf5nTub2o/0lTFKJxNgXa1QBcKKVyC
-hv8Pds0n4qvfMmBWl04hXxP6MseYjdIKo6GguctsMM3vqMR+n8hiloPIQ9/7K4tj
+9aTCRhcxXsfuR7YzbCXRcK2hUW203iS8+UgAfZBVe5GhskOd0ZR0WSkse+jGzPqI
-6VIIFdDRsNueCbTbBe4snJZifx32FZE08hI5IMeFY66pFYVF4aEW7+6NlGUahVOs
+tnH5F0yQgLn9emebpL6dNFUVvssjpiMlvkijXFJv1tWSKLb3TxJd2BE/w5Zj7Haz
-8Js0WCnbbo6R6JAeZEsATWX2Zok4BXluhspPqynJFsuxg/TmCiNywMabpqld1QIJ
+iv7Wz6o5+bY4v2YL2Ev7hGzfSaef+ip7/BYZ9TGuzSoZEHMYa7dNT8kRR18IhfXv
-9mMdmxEba45TtEzqAU6zI+LRjUkURyR1C5+5zSEVaEo2O32KkCt+nhxaJo+2h68H
+Y3wa2xlOhB+WE3AjtYy1oTi2c6Vmd9UKASZy/Eb++j1MSPtxZQLNaj+svCmqqfvO
-qfulUjJfYr62w/cD1eVMohsK+kWAPNOsCp97quRtUOLBKDH16d5MmwvwYn/8C0PK
+/gElVfGlgkomYwc2EfJvR1lt9u9YGepxKrafPsgvjR6bYPwLF7eHKkKyEiqGCYnW
-RZuZULXPnFc/Lv6Vg8nm4wCkkN4ypwgd58JLwzYcMu/fVM2e5U5nXs6Sv03T6l9G
+mcNJz/B0egxhFjoGd0U17tNuZcYRD/Tsj9ugGF+4/q+IaEV2YzZTdGzupI3lW17o
-rZvNw1RmlAs19zHhkyH7hFC7kctJg/dELuPDpblqeBdFvVD18ENiTcEMk2IEVua/
+Q4H+EksxkWYDr0WRlYKn7VT1gTThuggEz77JskjNP4jK29EOIEO9IqGMh39tXsud
-GB3gmUdmojK47ekBjmjtomhl17MDcBoMvSf2iqy3m8VJZnByzwtZnFaTMGelxlna
+mhL2Z6XMX6sgxSjSkYxLpFnS1mRZ6uQnSptxHTfnG6jYhq//MTjGX7xmYBj5EoTC
-+++JrXzT7kjfqXmBCgrfefjbbT5liszi+/q69cLf5Q2GyWsiUnYgJOU9v+jwkvxU
+duHuaCqjRXc3yHWoNm8jepkpbe1PPbwEbL6RDK16G3g0WVREjZopj+66C2xlY8Bq
-5wAsFdfFPtOL8gQt82bBA9GZWNFrGoA5lnCjhtJNJkqcgCJJt13Ay8hwkYdHI6X9
+ZCmHhud22QHs+5r1LLSIynsUlGIOvq30DZ0F2/f9Gm7uayIYbp8gA4z7M7RjmHoZ
-2o5bEZEnDJpdws8wZ/NVRevIwSZcJReAkZ+ESTXDCV4XtJchJbbeAB66DcekfrIg
++XHYSPc4kH4a3T9MucQQGzJMl1k/bifBAWLbu9uPcDUe7Cglfz0wHnPemOu8HZXY
-uj/vlrPc4pB1Rwh6uVEekX/3dcgGeO4lgWFMKuuDs/u+MZLKFKa+N5nyjGaH5Pm4
+6qS1n6PAHyyGlqX/pNWxR2vQrHJRksdTCvjl4g6256PhaMDop3QAHuQj9meYKIqP
-ougNKjixaulv0ihQaV5NXzMM6whKHVVcE+NI6aNXMX2ewHwSwBgVzwzi1X2mdgyb
+MiZexiuOW3KjPJ30Gx1Q7PnUc+w3SjjsKaZEvRgeWKa37rvj1ICTnBQUPq2HV6y8
-mYZi1hNZT8HRb72hLNc6znt8xBx71lohTDgCE/UTrFDhZ5bO6yQIyCZmf95XYO9d
+zaGnJcfd0ENAmFnRaCIbdU6TRonnIAAuSfE2gtLni/PJbmUpznuq82W//kxvH1tR
-JDcKpYUpaKuJ2xkugOGk1Pe5gtMXQfX/JGEbLaH003D4x2Lv+QcLgVVyUj5gokp8
+oPx6LuM2+hRncMoyXUTWSUVO1DAUPXgZA+j7fkkwmosi14d/5xe3wO4U3dGZ6wAY
-y4372mUG6KzXfPpfdfW0gKgDFDFCEZ3k8eGb/QwxUfeFmr+Q82Try8Sqtm75YzLa
+D+zlzhq4d/4vIvLIL0NoBcp8yM+xWxPTtvj7HUJ7BOVV06ICnilUlv2wjR+dZLZK
-rccXlFHa59/BAiqqpMeO232MI4mCtSqVW9N8O8IGxUcurZiOR4sHsWZaq6eB4wkP
+DyjWhMoqk8r2TDZbAQr8MNX+sSlp1JxQEgBijpqBvRdF/ulqraF/GFDFRLcEi7D+
-GQhZOICdmkPBVhnZh00yQOLXjqwKjoYz3t3s+5ZVi2LCvrEQeix3K/TzUzYjMH2T
+AkHPg4TrmaNB5ixsj72j0xruFJxgQJGj8fwQtemJGu8QcuJbCvJ74TI3vu0Pac/C
-1c9ZkdmeaECREmlbpAOCsQMNilA4F61JQz454N8yzkorSIkhi3e7Ngfx8qVGUu6x
+MRov1TAVJB7+iVvVNEgCMlzimJCSCUYh1Zgk5Ci2CDFMFRAEcGoHywIW6v5V8j5o
-e89qJWF3U0DK3VEOyFb0PJFBzVUUumBasnr3fWh3TlpDqpRfjjZnsojnG4+1gz4+
+v30mJKZCVFc4Yibivjj1aGhQVO72vgiog4L++i7CeXHIu6Fe1Jmlve5iuxrQA2aM
-2opccfQmvBY4KApUoJN0Dudby5cEtHd4KMobhsZ09Kfw8lZw2Dk+1FSNdVW3VW8m
+9vjCbFJIi8k5vQTVcKPRcsto7/qbyxvWvahKBBbHl53XnSb0WtLUyTEaXJ+0l5gy
-eT6lBrZd0YvCycHWjWlYucYziV9+kcjYemGKXCyLGVsc8il57hsFepTLLOvpeAh9
+Epxfl6ZRNkt+YBYBqCZL9aK6TNpCR+zTC7OhrKcZntqFYCeRB25YEfc1z0lTH4SE
-PxZO8nBZd66ECN4FVJQBVcdvp2OrxB5pGa/6Qyhz4rH9MTCILea6jY0A8uep0WnW
+TPymGSMOeUX8YEIr+XNYG0H/I7ZtEdNGBEXaUrC4YUNrvojpq3PS9bhfLhAf5D11
-42FRb/XWyY99h7vv+j9qF/u+uAPz0NPq+RCD/Os+UG45QZ6bi8tZWKvDeJ9At/px
+wmI2tS9cqxAuS2zkaBr9Qo5xNEVsyGNFd1K0q0JJosiMnVZDzOA4wJTYhOw5gwcW
-Uyk9N0JYxjGUgEoEnxAYnrPVxqKV2uoNm6N78KrgjCvkYIivoF4tQ10kTU6zom/C
+T1Kh/LDvK4RE0CV0jRqN81YO8V6Jq+/c2kgtwTLzrx1GCcdHRsY2kPhCEWOTLKb8
-3IXtNlaBVdS7GXT7uRbbbeQ0guuSiIBCKu2a1+UXi7bJLVXEHM7Q7nYkh3tmCoT/
+Jn5nyyvOOjMIkAEYYqoRRxl05UbNWNS9SuO2g9HF6JpNJmw0cmzT8erIIjVvaUs5
-WbS2lERiYtie8TGNt+CmO0aJm6DsobtGbrx4T/iIBM9bDEeNMIpK58di5is5gFkS
+dd0Bd5EgkkLq3RMPNTiidQCyIy8QtoElmxYfM11mbf+JMgxsB3sDcRGN4lauUhho
-q3NEQqipAE5wYNb/RR9ptUY9NQhudn8SyPTgEdw8x4N5Gs06dRTpsgwn1WiyTgNa
+JlayuFUfrQEwtHFwyULiJwUC55faVqOQzyvcQ8C9AJezDXS7//ku1kvEgbzK0nFm
-RBE9zifptE4zkr4urHH1l9njWTRFGeZtJEvyb4BY8QHL+mid8/jdrstg4BSSqLuN
+3bCCiuog7pG9XlldSReYvlJtnqTmp6E5+m9YaP+yB2E+swKBORHkbCfBu1CuX6R+
-kqvIftgAxJmWkOlFGMwhLLrO/owaAo7Wsz4QdMJmM2VeQlEb3WGZhIebwsX3infc
+aryBYIDeLaIiJs5GWJN//37TT0hVUCipY9QISfTiZ5tIy0aNKRu9syjWphcoTJuv
-qqmuNIcacHt2Y0CjdY/EK/tV/mAVjyhIrmcpBFIxUQKaEA/s8uQmMCi250n+MvGY
+YBaRxKNdZs81ppFTa3sXB824+QXwzRJJPjBndXOtyX/a2U68NK3dqau/A5190VAn
-e3OCKTybmovv5J0e0a0jn14jeaPFlvbfl+SjWX8ycNsf81ggbtgGSZkogkYwJHM9
+bn7jnJ68rhcL9ewwydQRm72qwyxBbRHFXnEXpkJhzYRw6fosglqbOJMxFiy36HWD
-/c4udwPfE03i/ejnbl4A//MoShCvabTV22Qe7VrkrFytCY9Di8z7qjYQJxxlonnj
+RkVluvTInw8Em/DhhWgn+UrxLlQN6JnVdpkT9hwrlFWooiM56UKAPO2a1FM2XKXe
-Aznpv4W5dfggmRPhyPtlWCx3+IhohxVAvd7ub6p8aancb8RUiPN+uaFR6kNtVrB3
+TqsolY07uWnA+ouiljqIpsaFlVDBcz/sGZWqy4aKKPBTcZlreW88PMsS0c9nixVi
-MNwFLznhwFUW8pr/4BA08BD3WJqyJhUYhyeH70uwhIGSrQvEy0vQveB2LCELMMxr
+nKnmI00HuzeL85zVHGo0IKYfktVVjuZNPzJ6+w18XpKIi8TxHpxELC9M2kVOCnuy
-YJamSQ1eX6ebqrc+cPVKdbozNHql8k5WR4QUx+YJ5+xU95/ZJKTiVHKIbTLf+GMr
+uwuntJlRty+GpXVvx2VLi1wBKyLpXUxhyg1tSi2sZyjIdVt4yEOKfajZYOp73JZx
-lHJ76SNaCQpHXUaW5iTaMQvdgcu8kJ0u6HsY+yR8kFuIT7J3eKPTFudw3J9k7x+r
+IcInD7Cby9olkMsa25YhloljY8YELfW8EWutF13m8tsjGP9c6aOuMIXhrrpwLgYy
-FdipziSTGvWRK6uT2WeTxTtmoYPUa+/gO/2t+beh8Lsgf2WCxUrVekPYqcM2pUe4
+E27iFh9tHq0mjCMibwQnHld7Ccd4OqO4AKfPofHDxWoY9+ivArOBAXjsCxhxWWWp
-6kIbFRrusmu7+kpxx7T4pthmbQ==
+aLqLJz+JH+idcsVDlw8jJzFW6pQFbM3VxXObvCg9ou5+P+Pc5XYyALJzIlmoOrN+
+ns5Z+U/2XKGyySQASUyFXUNml6csSrTd+ejz1QvEX9POU1nLmvS1+aojgnptgdpn
+sAtksQHMt1Njo1oRug3+/0iC6XWEig==
 -----END AGE ENCRYPTED FILE-----

secrets/dhparams.pem.age

@@ -1,30 +1,35 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBsbFBF
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyB3QTU1
-QjNFYVhPc1dpbEJ4Z3hyNU5hRlg2dXBIdFRKK05yY09iRXh2WTFzCjVzbHRQVzZD
+TEdvbFNaUmE4U1lCNzI1dlloVDBTNXdURjZ2akRMV0R6dm5ST0FNCk9YclRSakhT
-dTBXRERjUXRNV0VRSEZWaFRJckh0QkpDdGpqSXJEUHI3ZlkKLT4gc3NoLWVkMjU1
+NlV2UVJwak9Fa3dQNTNBK0xKWGlkNXdwZTBEMm4xZzc3azQKLT4gc3NoLWVkMjU1
-MTkgVkZjdzVnIENwZG50ZUpoSzZ6L0NXaEI0OWhhVDBYVmpHV2YyNGVaNFBOWU5B
+MTkgakk4UkFnIGNBMHNrdG84cUQxd1lqQmJIczlScU1jNk52Y3BtR2tXeDNWdWRX
-SVZzZ0UKZmR3VGs1ZEY2N3R1elpReFFnUTFVd29pU2Vmbjl1ZWZ3aW93VSthb3Fv
+cEFCR0UKVU5vem5MZUFPbGhoQzJTYnF4OTd3OW9jYTRkazdocVJkZ0pRRGNLek93
-NAotPiBYMjU1MTkgYllNSUZ1RHUzZTFDVUt6U0paWmc1aHpDSkVKaXc2RVltR09q
+cwotPiBzc2gtZWQyNTUxOSBnU3hQMFEgQ2RUaEUyV1ZGbGRtZnlIUEtTQXk5MUZF
-NC91c1BoMApGNDFKQ1kwQm9Rc2U5RXlZQTYzNDJZRUZJOFNrekZMR3Y4Z3FKNTZy
+djYxZ0hBUThlV2tXTHNvdXpVSQpMdiswMy9QNUtCb1hkbGRqR0Nia3FXTzE1ajZL
-Um5VCi0+IDkyW3UtZ3JlYXNlIC5NcHonNnQKL3hydVFvYlo2UEdMTmJpTDJJajFp
+UXljSTZqM2YvbzVuWUFzCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBYL1NrRjRaRnFn
-RWFmQThXMnQveUkyeWorYVpFQ2Iwb1lGZUcrM1Z1amNCMlovL2tEa0ttcApYcENW
+RlNLdWJ3cThteDM3WmNaY210d3RmZzhCYmNpVXBwVGlVCjBkM0IzZC9zNjhmTTZV
-OWZ4RllkcGxJY25SOUVtd0FUbE1qemE2ekhzVjluawotLS0gVUV4V1ZWUGlNUWpj
+R25ySkVoQWxQQ252WWFlWWZFMlc5dWtUN3VvVTgKLT4gWDI1NTE5IE8yUU1pWGFr
-NVdhb2o1N2Q5ekcyUnVoVlJHTGl4K1B2dktwcldPYwrl33tLDV/04TuFXAuDyv0m
+NzUvZVpwalB6aklkWmJGWUQzTnJiRjNzdzY2MUp6MkY5M1UKR1VIWDVyTFpxem5F
-ibpgodAShcyjImHvhZecGtKFPG6GyYNZqVM2ACZAP2Rnkgs34ef4pIvBAP2F8dnA
+TmRNWE9zZStLanRTdlU5d0NOSEJKdWhDUjBCdy9vOAotPiBTJCd2NyFYey1ncmVh
-I4HVxLruWYiKwFnvTR+blidvcPbN9GEkeQECwGKNQCl18QehvTivxRtTvCqo4qc+
+c2UgfE4mYSBXfms0TC5FPiBiYmx8IGRFV35mciNoCjVZdHRiVUtMMWxEMlJ4b1F1
-aRGDXOfNu20IFEAaLE74ggEl/+EhYL76jOAJ1VL229rDKi2XPGY49HsRHykrhQjW
+TGgxY01XTlZpTEtndkg0T0hRVjlqVUJGMUpSaE5tVlZWR3VGenpkUXY2eXJtbmkK
-4nLfGJ4dXQmfWoVR5j1qTEyC88a+hrUNFiX1vjc5AXvezT2dgdsupwlUCkIUTQ8m
+ZCtqRVN4dnZENXdoYkpjNHRWYXkvN2laY1p4YjV0WQotLS0gOHlEVTVOSmlNemNQ
-VsCKghRA44XfepcoAcoO6Bzqj8xwOrBdKmlg2TWB+gBxlp1bQ67wAJggkd6o45+d
+TW5ISk1DeDlEM1RoQ2JtUFlyTXRKQjdnT0hiend2VQqrUFvr+76sKn0ldBmZMlEW
-H7GEinyw08mCr8wbbwz2Fk0snFMYdIs7E4dwNJQgF34dtsMEMOIZhxZGP46NKjkc
+U2k85DLo2KU+/+GtbkZwVXxxIZHMLpoJgghHk9ptdalUgLGcl0X15x9jVaw8aeta
-zztb9k9p/FWeJp+U4Z68llQZTp5amRMVYRYFCSqXmwdd89DJA1WCL3JEc9QKuje2
+hbeOHotRHY7bC3z0S74riTk3xDMR1eT0QGhDMWHjfo8SkCftOYBlFfhTftevdep3
-yfgpv9YnCXAIj+D47koCu5no62oFa142As9bIKhgLDwmMs+q9smvbGtcAku+5+vj
+pKMZsuQMwH9JzxgUfcxIcWE975cZzrEJ85nfWMGvdSjcg51KNxP/UUPRxDlcbCEf
-cbScdOVCZTG/1JBC9XfUzUT/MfeOvi1ACCE5958jNLR5oVDaLDxbzravddlqDTiF
+9XX5apSzNsTI3ibGD1n6Qwq8bdVYDMHmy5pAhw4l8L+SdoU1tGdw7JOA16sMCJbx
-bzjo37xQsIKA9uDOuZhrEDdNoXkxyIXNR5yC+6t7oG1o0O3a5zU4hj5Ch6huI0VM
+T4bV0ky/PGRonjJuCyDBj8oe9vMe1ZI1O/ITtktekS+wocxBs6QXlY7pIZMlGUn2
-5O/I12OY3P101+/FwjznUJ8OOC05UKGRLRGr4wFn5InYr18ZEgjkQsblVnNZdt0N
+6m59ZEEaf7R4/MdnmBDNDkQuyXaKc7SaTc6h5sKWzXdYScGUKvgUQ7U/WJ2ItUTC
-QR2rWvl8qxrwhACtlbJfPUVsjuLL/agSRi22yx7JB/A/UhAcryDrZn/v6Ldx1b/c
+N/Xq07GkZZMt5MYBlyEr+/mKWlcy+ylJPGb7EswvQWaHoeM1QF0XLZ1v+W/Xsso0
-6gN6+krCLUoCAE0vX55WoZOY6N32ZlnpUYk5nd2f3WB9PIRURPxzztF3wuOXdFgG
+seIoz+geSu9a02kwfsa8WvWXdIAT5X2pNGPClVNzjQ23pfQfQuW8ZQrGmIFR4g5A
-Iy+q/e2/KkPMH0wNcGShRNHoqHbn+YHJPwF8uNVr/r+aDukGfa2KLUEEs19EuAe8
+58T1K+vGLdShqqVGyJFMVrSuOzqX5FVmZalu7/++1IQfiRGUlrHKoPlKWnCfFEOu
-u49jBqzGlGI/x6OK2YAd8K7eMqjTNa90VckS0URHeosOt2NxvipSKBXZGKvqW4pY
+AYjaPeEFX2ByxcqfMK1YVPvUufdISUQeaQOO7mXGE3FqB0oUqmRIUiWZATwhq3Pw
-ND23owEH22mwOmuQse74a6ow6JDXqQuigfJ/l3Y+D9Xh3sEhXhf3tkyVta/2KZZ+
+p5QdcySTnmMpD/w05hvwski77kCdmYuHlMlLZez/kfhTnIGXris+Vwi/V19bsZ8G
-PeEsxCTRjfuYRTvMbzPJAw4=
+zwaZ/Xr6WNC+df5JqSfTGREnXZPFRDkaTt3ri5/eEm6BqliuYjGbuiKsDECi4+JX
+bHpH6LBBoKQ6ms7jCAn0Ls4cUKF37PcjGAOuWnzCSBU+REht1EDfHzx4C7hNiP8X
+87NjEqJbwE9lORho0hQJRTn8uriQcidlVoB3se2SYKbMy8UA4NNnxN9PTj0TuQjL
+OD3LtqHBElqNPbGNyyEAAJmMBmmkUvPPXlGQ0D99b1+jIdHzYSRtOLshBFykqWYQ
+LJD61duhGqcQqcLx4+JdQ+oVcfAI2nG7YINnHB0OmS2DOZvvwqQ7ASScSujUWIjA
+LNQxu3ruMz+bw/G0tYZBBiE=
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/kelder-wg.key.age

@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyAxbWJ5
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBEcDNm
-WFdqMHZURVg5TzlYZWpUK2hSRi9Ka2dsWXBOWUZCb21MekI1Snp3CnVaZmhKMUJa
+ajc3a0gwYmVSdkowak1aakJ3VWZ1Rk50S1JIS0ExVktVSW9OVWljCjJqbUEySlNK
-L2Ztek1VcXUzdXFGeXQ3aXVJS05RK3BmU1JlUmp6TVovTk0KLT4gWDI1NTE5IGVk
+a0xyT3NPK1BBMjZzN0RrLzhwVitvS0pzQ25iSnJSc3FmM0EKLT4gWDI1NTE5IHk0
-a3ptcWZpMjNldGpUVUpTaHEyanNFeFAyZWp2TzVYYVBiMDFoZzVVVncKbjc1K01H
+M2pkWHgyMHR1WHc5bE4xWTFDTndKdkhRdTg5bzZIWEU2cm02UDZBQjgKUUY3dS9p
-bGJQN2ZXaWRzUzFFak1CaDBvaWExbnJYZFdyRjhtdEdaMWQ4awotPiBhLWdyZWFz
+U3h1L1ZvTkFPdURLZ2tSYXJXOGNZZ21KVGdIbXdhSUJrd2puYwotPiAoL0RtO0lH
-ZSAiMyRCClVMRHI2UzN0dWUzRGRsMVBPcnBiNVpWL0RRCi0tLSByeVBkbm13QytH
+OS1ncmVhc2UKVGthN0ZSU0ZFTTg5YW9UOXMwa3RnSzFlMjE2VTN3Ci0tLSBwMEMx
-R0szRkRtcEZrKzR0Y1ZqQVh3MUYyZklNam9HWmVaazBzCuJaIOF+7vSwBjI1n4Hm
+Q0tQckd3SzBwUUE4SndMV01kUjVrOTdDWmxlcWs2Zy9TZk5yMzhvCrBXyLBZGuSD
-dEJF++O95dI8y3V9rw01zZBtg86jFrd2UZcJLszkEPFax0Y2iZNRLxpc6KMsaJeM
+dJodNI13obTM3UvX6hSgQ8Su+J3fOKr5NibkhQ0Auvlr2tUXhhDm2WOUlHjqVTq+
-XDdu8oeLCem6Ujx5qr1e
+jWLSyhioDlIEyBgk8Zrl7KGeDzBi
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/netdata/powerdns.conf.age

@@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBUVC9l
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBzaEo5
-QlpKSCtIQTlyam8vcDErRXFZdHp1N1FpelNpNllLSWtVYk5aMVVJCjVWRHBJWTZL
+RzNndHBLMUl3Z2txdVZoOVJBbWsrTVJwY01WeHQ0VTBaSm5VclY0CnJLYStYNEI5
-cEo2dnJrMWFydlYwZjd5alhaM3I5QlV4L1RnRDhRVEZxT3MKLT4gWDI1NTE5IE5t
+VTN3dEQ0ZjBKaU1PZSt3d0lldkE5VC9wNHdWazNWV2F6WWMKLT4gWDI1NTE5IEJ5
-bmZyK29WUzFIbTFXZEJnYnBFb3d6d3ZwMFFvbVVrMzhzT3lrL1h0RHcKZDJQbGRO
+amlzTDhCOFF0TllPd2RsME5Cb1lRQUZPTGNvOEZnL1J2Wlpnb29GblUKT2t1NFZy
-cTZ6WG9XbGt5bVZVV1hGeGVpdlcrZkNEOHhpKzJONTdZcWJ2WQotPiBzXSd1LWdy
+blNZSHdxZjlHTlZmaTFYT0laQ1IwOCtDZ21vTjhxM0owdTAvawotPiBLYS1ncmVh
-ZWFzZSBIOk48ICJ2ayFcVCZiIFRPWF0kIEczNgpMa0EzWWNRN0x1SW1CbU5HcEtq
+c2UgRX0nVGtpSCUgNVNDWCVwIDBuPjM3MwplK2cwc2htQ2RLcFhUZ0RSc21uQlFV
-cUpLNWJPeEp4cGM0L2pOVW1TbnEralhIS2xpVE8rL1p4SDFCWmZVMmhPRDE3CkFM
+Y1QwSStOK3lKYmVVQ0J5RXA3Zytaa0JoMWtlWU9qMHBLNktFZWxtbFpDCnJyS0JJ
-b002azZLdXVQQ3hQY3dxTjRaRnRTYjN4QTZwVExYTEYxZHlTS25BQ0h6a1IrRFlW
+WEcwbndYbERreFhLZlRyQ3E0czB5NkREancxZk5BTGdWRkR6N2NrZmFrbnhSYlZZ
-VQotLS0gZzFqRHZwRUtEMmllV3NHazg5cDJTdUdNKzdzdHFrWnZzL3M2bGtoSFRr
+NElHNEEKLS0tIGVLdXAxU0ZaZVkxaHV4dEZNNUVuc2J4N3VRMzZzTktSMDY3bDVB
-TQqYSD3b0k7/ejjg4S0git8y4saMsBU7iGZxUcO9ky6Rw40zgScOEe4F8rGtwVzq
+bWtmUVkKigIZ3J0s23vNzmbzJGjSMGBXK6o6xnsA9HXeQZ13VgKv5Qv+UHu+Z0g2
-/fjYJ23EaSdG7j41/Ohsp1LhvR0eEBPqlNDk22SmD5VB4C+F88qyq1kF6lzwmIUz
+TeKdQSrHbDB3ydIxaiXsi2ivULdrIMCyd96rEJFxrkVuVqSZE0ehG5j+o8lKk4OU
-F2oFwxWBmK8M43oCufHK5bANLY9vNRVvyNDlv8Wl5xyVlzorqmZQv64YIj31UnWX
+PDe70slbZrVYDSu+OOUOCVRSopZreCURlYn2Pc4rjvrMAn5r1r+/AxjZMdkmmQZ0
-RCL5fUU6
+l0wMBTus5zZzKg==
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/netdata/powerdns_recursor.conf.age

@@ -1,13 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA3QkFw
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBoZUI4
-QzNTNlFNcnhUSGNMRjRqRTR6Vi8zUm9SemhLOHpGZ0ZxUzdUVmtrCnFQa0hlSWFk
+bEdWSW1pcDdMYVRJLzdQOWhsdTlZMmlyZjRVeEFwU3Z3NzVFa3lBCkxRZ1FYeU9D
-QUtaMVBsdDhNclAvZFg3RUdINm4xYkZNM0VHZDk2K21Ia28KLT4gWDI1NTE5IGV6
+L2dramp4WFFlREZ3NTFnWUs3clVEcnBhLzExclVac1M2SG8KLT4gWDI1NTE5IHVZ
-aTVFZ0FDSkwvZFBkUHV0aEEvWkRaZ2d0M2czSjU1b1RTMFhYdDFhRUkKNEtLWUN6
+bk9QYy94Tk50c1dVanNvNzhpYWNqeFMzVVR0eTQ5OXozMmp2VFlad2cKaEdvUnR5
-M0J1eWw5MW5rTFZmNEpzOHZvU0g3cC9JVU4zMHZxMWZ4UFRQdwotPiBKLWdyZWFz
+ZjhsQ1FRaittQXFkbnRZei85MmtWb3pXRVFsc0RzNzBPMXFMWQotPiAzSXJZb0RE
-ZQpSL3hmdVJmazFyRXoxaFRyWFZGbEhDa1liL3llMjBlRmJaRERIL2lPTURBZ0t1
+LWdyZWFzZSBudCBGIDklTWIjVnwgM3YvCjRVYUd2TForc0gycnRBR05MbU90QmNu
-b21JTEs1U3diYzArcWtia1cyCkpFaEsrdmdWR25MZWEzQys5dwotLS0ga2xra0o2
+dXlmQVB2bnZyME5heXlyMUdGTmR6SVd5SHcrTThrZEJYRlpnUmdmWnkKU1lyNjQ3
-ODVSR0tCQWVXTVdrTC9vN2kwbk1oYXN2UEVZNUdVQWVrMWg5RQoAArdBMgVjihjx
+T0J6b3NPQ1FYZnhxTjFrYmN1UUJzMjEwcDBwSTJkTnlmeHl3WmFFTXB4eUVMWm9i
-KJljTgSqzyCtPw0OPAnkaaPHioqSlpHvFZcdZjjCo/nbpmq/uHYIK8dqTEC7Vz8j
+NExUZzM2SHlLLwpiZjQKLS0tIHdqakpMSUNOdnlBcVA4RGJHR2d5QnJNT2dVclZN
-eCniVkTQ7nEsBNGm6gwbsPkZNAa7wiAZYx07Rg0oOjmA+42sAZHl53BrK4c3fkhD
+djd4WXBLSUhORktzZ2sKzMjxqL3UPrtGmXDijdfu0AwxLJooK7ZKauYvXWSuZUrR
-yx+NepYqKGDGY0EVpe2xNbSczSeAc4KIrsfCzGDrKLI2DOIoA2da9F6n
+vl5i1QPMEEBYEl+NaZIFgxAFqWpAXHQ1VxSijMWxNjKUd1Chq0tbLrpbh9wXJflK
+SW19Wyqc9eTb8BnFoOSYWpDvAs2Lbyr2kJkOj2TNrwMv8nDJdOB8XIPlV5drCj1q
+Dx/1zWqm6NMYxsep6eZkv4AzxA==
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/pdns/auth.conf.age

@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBxK2FW
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrd0pM
-SUduNXZuSlA2Zjk0eWFodXI3OXNmWGFmQ3RRUDhrNlZXM0NMWDBZCkhJMDYwSVpJ
+TGw1anJNaGoyQ3lMUis1cHVtRWFPcFFNZk9Cdm9TMEh1QTdKc25ZCm9VNzVQcUxE
-OW9sOXNJQ2JZcXJvOG5DWnFRMkVtMzNaOWVxM1pFeHl4dGMKLT4gWDI1NTE5IG9q
+Njh2Wi80RWszSU5NczRNcHpVYXpRMzJNcDRsdGxyWVZsUDgKLT4gWDI1NTE5IFpT
-Y3pHL0lNMU1vejladis5ajNnYlFWRzVnQ0Q4bjR1VFdtS1hvQTJDSG8KemdScFJn
+MEJVUkcycVFJaVFOUURoL29VT3R0MVJCWW04NXVRVEpKY3hlY1lWRkEKcENya1Jx
-RHdldzNHYjRSODdERU4xcENTUWlsRVRhMkVScEQ4NGZOU2dXTQotPiB6ImBILWdy
+VnBCMVBrZkc4VDkvMnZoTllCL09vQ0VOZytuMnRvYVQxL2FldwotPiAzLWdyZWFz
-ZWFzZSBnMT4zdS9YOSA+OmA9RzQKY2w1VlJVMGNnbEZzZjlLMW53bkpmRU55c0hy
+ZSBCNX0gIiB7InIsfCAkOT9uM2UKUWpSYTZ1dUo3SHNaUlFibTl0UDhTaFh5Mk1n
-dWFLQ3RMTjV3ZlErdGpTLzE2L2Rna01UUCtMQzRkZ055SmxoMQpiYUFVWGZ6SFN3
+bFp2cjM5RGhqU0s0Qm50Zk1pUVZmT0R6ZjBoUG1EUGlKbHFzVwozQ2t1cWVDVVAv
-Ci0tLSBDS0hhOGZPOXAwSU45NkxXcU9RYjVqN0pTOHlNb3Y1UjM0dGdJdW9GeXpN
+Q21QTjF3NW5UdTBZRldnL0RmSlV3QndHcDB0d0lvZ1RHTTByS1ZwNkNVQnU3WmVn
-Cq7EH2IUvlwH4EGyQ6fC5yWSeUbeOnh/mORLR74ayx9+zh6mOpDCiMIVJrKLX7P0
+ZwotLS0gb0Fxb2FsYzgwRjJwSUF3ei9hZVR2Vk1ORDlIMWoyZ2RTd09hUmtvMWpD
-L8ZEF9DIlKrZDa7/hSRYDrR1PV4dIU24nFN00w==
+cwrEjdaYfoGZ9i/S97xL9QvA/yii+sJLeuUzzv7a3DE661eQ5ezurV8Qz1tIhxWG
+RsOppaaj1podFx3U1x7QQbLO6zQbJA458RMjYgc=
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/pdns/recursor.conf.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBiRDFJ
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBHNWg0
-UHRkRFN5U1BEK1ViNmgzWkNXSE1adjFJQmZHNDF2TVlUby82VTFvCmdEaTdmNEpV
+WGRGZnlTdEhsRm96T0ZMOWx4UUxkTitJa3hMWDE1dVkreEtEa0RVClpvR2I5NGpz
-R05UWVB2VlhGQlgxRUIzQ2tTWFBzWGRPTm1Zbng3TUlZVjgKLT4gWDI1NTE5IDlt
+aUF0N1VZU05oWXUzTEI1TVBLYlVVang3Zzgwbi9teDVlQlEKLT4gWDI1NTE5IG4v
-ZjRxOU84OG9hSUM3T3NPQ3BoWEtham5MN1B2TVhJTm9LWUxzdkVDaFEKQW5tUW1K
+OXRIbzhaZEdXc1pjTnRRWHVxc2ZTcmozSlJkY3lyOGtvd1BVeGprVUkKdUNqSW94
-U1M3ZFBkUWVCakJEMnY4NTdiWTl6Y3pQUW9aUzV4TVZHdkMxUQotPiB8cVYzdS1n
+SUIyOWtsNU83cnVOTUxNR1BvWHJPczdzUWc4aGp1MjlpZm5ESQotPiA2KSV2PVx5
-cmVhc2UgLi1KIFw+CmlReTdCZVU0eHVQNjY0c0VvdjdVYnA1ZEgwa3FuZHlJZWxQ
+LWdyZWFzZSBqezVxOHc9biA+aD4tP20mXwpwRCtMUDhmcVhGNXpCZlFmSllpdDVp
-N2VMS2lVaTNPTXNhY3hUUURXeG5pRjV3YWFUeTMKcVlENU9Tdllqc3hpVFNudThq
+SmFZelNhZnJlR25DS2l2MlQ3ZGFtdGxkZEdEWVNrRlk1VEZBRm9GMHBFCkVlQ1hp
-QmZFczJJejRLMzh4RVRueGs4M1ZMOTBTTGdBSWZzSEgwCi0tLSB6WkdtL1R0ZVRp
+WnhOTGl2R2s5RDRKN0p5TmF6Y0cyN3ZlR2pDZlhMVjQ1c0FJN3hCbFEKLS0tIEFT
-aURPRWxqUXZMZXlvakxJRXRvMVBuVlMvVTBPd1BGOTU4CtOTFMgQU2p+HHeJTtXJ
+bjFiRStXMmJueHdsRm1nU084dDRpS0tBT21ENzZFclJXbE11NWJETm8KyMHU+tZY
-EwdhBqKTMc6fZPbSuVSFlsRUgd6WkpkD/b4xMhfnzPOJZDI29/+TlpY3tZAh+e1h
+QELtZCbXKWnP8QC6V84JIFAxoRslACwsIJZpogcZO/IFIV2RGunGjCJk6QBmhOPV
-VoSJZCPFc700M2ZxKw==
+kJXRcGO/ndYjWfuU0U3+9HtPocnO
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/actions-runner.env.age

@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyB3ZFlV
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBOZ1RV
-cEc2c2Z2VEY1UE5zeGt6ckF2ZVluVVJPaFpsOFZtM1Z4a1JZTHpjCk5ubHhORFNq
+VVpOZ0Jhd2x4YklMOHdkNkd0MEM4ekZiYXFKMjRIdXlZVDFkOTFZCkRreDZlK3Bo
-M3Z4TDM2NTdMMnJwNmlwaXhoSEFsTlZFYkdsbmZPR05CQ3cKLT4gWDI1NTE5IFlz
+WmJ1MDBxSU5UYzRuUDMvdnpVc0prNFF4MjM0M1FaZmg4V1EKLT4gWDI1NTE5IEkz
-K3ZFY2hiN2h5Z1FJL0NPOVJkc29rMG84SUM4UHcrT2lPeTJHd09reVUKdmRENjhX
+THNsVDVCbU9KYWpXL010OVRmNjBVVmVyVzhRZW5McVFJcnA3ZWJvZzQKOE1lQnVX
-U0RrZjNZZHIxVGVZVVdQdzgva05sb0ZIdW1qcVNrZ09iMzhwOAotPiBJdnFtNCJE
+Nk1rWVAvS1lpbDEzb2ViUUE4RlB5NnJOZmNoUGdUMGNuMk1iMAotPiBuYVwtZ3Jl
-LC1ncmVhc2UgOSQzQi4nJGEKbHlmTkNKQzIwbEVGUlYrdElUU0pzZ05HRStLT203
+YXNlIHdYXzh3MSB0TyREIGpdTjheeQpJZ2pYUyt6UC9vVmRNZU1uaDdvR2ZUNG0K
-dk5VKzRyeCtHQkMwTkp6ellxR3cKLS0tIEM3Z04zZnE1SG1hNWdoTVlZTWVLc2V5
+LS0tIHNCRno2V21tZU9XV1UwR2IvZDdkWEMzZDI4V25Yb0lvdmJadXNEZFV6TEEK
-ZXg0c3owMEk4YkdSMnFIckF3cW8KqQVIGynC5sNfRx+ZFm51UuQGHd5I9FmEUAVl
+81uT8S3QJNe+mVadi/VpXSPEP0Ygzm0/+1pB5qqYlSQEWTHqS55gCyFCwu+sjaDq
-2nEFz0UEIquvAqSZSdN+gaIcvDJyAmkYVelmRj75jd9qWK6kx27GajkumkXXjtCQ
+DpYTSm1JAk5ql9NRj4fJvCS53lJZ4zo+5c0iJKmuRg==
-ikRxLQ==
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/db.txt.age

@@ -1,10 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBDeXNM
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBBOVJi
-OTJKcmNkQVI3VENaL0x6eUljM29jL3gzZzBRN3doclFNaThFaFVvCnd1eU1jdUl4
+SXdGVDlXWmVGZUM0OTJPUWFYem5qZzAwZWxhNzhpT2t1VjdZU0ZrCjYxWUE2VW5o
-Tld2WkwreTBlT2k1b1piSU56SmF5Ym9hWWRnUWovZUlLalkKLT4gWDI1NTE5IHRN
+cGFLZ3g3Y3BpUWlWOUtUYTg4MGZXVHZvdVV3eU9iZW0ybE0KLT4gWDI1NTE5IDIw
-SzJtUWsvTnlENjk2V2hHS2xnMmpNS05aZEkrSTFMM3VHT2J3K2NHeGcKYVVsQUFX
+QmxaWTY0WjJFZUd6TUxqaHhRelpRQ1hGZVBEcm43d3JYUVhpTWp4aGcKVzhJdFFu
-N1BYRnduK0lFUityMDdLRTRlWE91VURUVmhIM0tQNURlWnJiRQotPiB3STgnUzk/
+SEhUUUZVNVk1N2tzekpzUS9RazRCcFBhb2xxbkhRNEwzVys5cwotPiBkeE19PHEm
-Ry1ncmVhc2UgVwo2YXdLVmcKLS0tIHFUKzVlTWRHV0ZYdzZuOGNlaXlaS0tPYXYx
+LWdyZWFzZQpwR0xsb05JVlFXQTZZQkJSWHY0akNRdjh1eXFnbmFDWUlCM0xLWXBi
-L0d0aE4weXJudy9BanJqbEUKwZ2dpZUxSX7ZnOHcUvNkpkKTrJb69lF8FzHFX8E9
+QkVuanloRQotLS0gZTkrT212MXdsZy9Kb1AwMkFHU3VsTElweGNlYkZ2UWVXRzkr
-sWDiO0bSlLWhGt/zpKBR1AHrQA==
+dnB0SHRnYwrveLSY6SdUDO+QH7WGniLIOPcECTQ7CiTj9lwD5Hm0rYLdvizolb33
+CsGX/kSEI2bD
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/mail.txt.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBRWUxw
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBrTW1E
-ZGtlb3pQdDcyUHNhayt6YkF2SU1tYzdaZERiaW45ZWw5bW5JUkYwCmFXUGcxSHNy
+ZDFSRXIwbXZXUlNJbHZCVjFzMzRxTmdtbDQ5eWVOWWp3SEdSUERrClVMeFRLOGUx
-UThvbUNLS2paR3Q3YUF5L29VOThpUTdidUk2Q1RzYUFWRlUKLT4gWDI1NTE5IFB5
+U0dmT2ZUUXlCSGhJdE5ibkZLMmZ2VmZFWU9PQXpGZFRPQkkKLT4gWDI1NTE5IDIw
-QXR4WlZYSTdXOU01Z01HTE5Ua21iSkg3dGlFZXhsUEV1WnNyTWQ3a0kKcHVRc3FW
+VXd5N2EwTVdhdkRYeVF3c201SnV3TmxnUGpOZWY5bFJaQWRWMWxQVmMKR2RNc2pE
-RFRiYXdrTm4zVDIvV2k3TGlraE9WTjJEQS9MM1lGeU9vRTlOTQotPiBYUi1ncmVh
+aUs4ZW1XSGU1RzM4bHZYQks2cHZWUkhZN1hob2d1QnM3cCtlMAotPiB0XENxMSct
-c2Ugb2UgVWAgcwpRSVR5RFlRVytGSVo0TXptOE4yakxvK3AvS0RSRWhsaEl6T0F2
+Z3JlYXNlIC5LIEIoJ1w6Ci93eE5lMUxDQjE3dWI4a05wUE5sV2dWN21ZN2lFRThv
-ZHJrRnVqTlJqdk5LdGMKLS0tIGsvbGMyeFBCL2NQTDBlUFE5MUdzdE8yU0cvRmhx
+YVJGNXNWaEtmbjVMaXhnemVuTXhOMXFtNkQvbGNuS3oKalZ6bEtGdHcxYnZNb0Zy
-VTJBTklXUkZtcWt3ZHcK2Eu8I1+np9oZIp+pTVrqS+LZ8hSrQVSCc4FrrcebJ6oK
+YnlGTDdoVVdyeTJpYjJjZkc3alUyV2ZGa0taeEFIYTdiRnZmYmRjR3BzNUp2Ci0t
-hw6wuH063XRxdxPJiGdY+Q==
+LSBROCtSMzFNR3hTK1p5NVhGcFpqM0U0L0MwbWpzNUNTUWUyNEVXbzFFMGpjCnot
+A6mYbp+jhpoyjZidXQfzLVcu6y34WqAfJZsfT6l5SJONVfSvSw+iP7XXW2T5OnE=
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/minio.txt.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBVVkVO
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA3dDEx
-ZzM5QVN2bmJEZ1dXQXlKUzR3MU82czJZVkRCS3p4cDNsM0RTUmw0CndXN3RIai9W
+SUw4QVh5T3QySHFFemo2N1JWTjNCSGRiS1lmRTkxVEQ3S1NKR2dNClZNM1Vwc3dF
-Q1lCUkxOa2dMVU5CTlh6OVFtbXhORDdQaHdwQVNIcmtkY28KLT4gWDI1NTE5IGdG
+elB0Unk1OWpUb1RQMVpSTUpJUDNrZzFMWkhKK0l1dXVBYlkKLT4gWDI1NTE5IGRF
-djY1VDNHMzdWV2NUR0UvN09VTDRpcGJxRFBnc2tQemNYOUNNQWpkUjAKam1kek45
+TTZlMjdaamlwTUJzYlVkcVIxbmtybkFwakVtK2craXVBNVZraGZ1VlEKN2VvaU5r
-d3JZeUxZVTVyc2xRVGErZis2aW11VWpjckFqQllyZFdWMHJpYwotPiBHS2stZ3Jl
+VjNRS2I5WE9kVDhES2dWTUV2cEVJaXZxNzRUcFo5blhGTDBaawotPiAxXCJQemxa
-YXNlIHFBXz4lJHZ5IHtNQCBORUZVT2pPIGBtSDMhRApKdktMK1creGVaZ1prM3Nm
+dS1ncmVhc2UgcDphKHFVTGUgIUonYydBPgowQnc2Wk5yS0E1bVBCWmpOc25MWWs2
-OTVPVmZ1UmpjRWp6dDlHM2dUREJGdHhIdWNtVXVTOWR6LytVdE81UzZrMVcrR2Jj
+UTR1dVlJbnNXYUVJSkx5bWFIcmtpT1lPSVE3b2Zpd0JaTGZWcEtjelFDCitQcy83
-CnozZVEvWHNwdGc3ekZubGJkQzEweUlmWHFRCi0tLSBjZHdrQkpSdnpqWWY0b2h3
+bEVvM3FNTEhyWVVFS21tS0VQWG5OOHFza28KLS0tIEZZeUZwVGxUdEdtQTZuYk5K
-bHRNM1Z3WllsbUk2b3VJaWR0ZGFmSFFIOFpnCsPgm3Mnbwg61Fm6tplC0vHvIsMO
+SHJaUDhHZ0JqbGNFSjJCaVlQTVo0OStkMWcKz/w0SnoHxnw71gr5DbXgMl59Kgjy
-6LGQOfFfg44Jr48Z/0tGJioORXOS44/2hAFQol8=
+SW4tzNGeRcX2j4YdRjr77TP5UAzpQE30tEcrtw==
 -----END AGE ENCRYPTED FILE-----

secrets/home/ddclient-cloudflare.key.age

@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBNalB5
+RUZRNE1CTUJsbW1kSkxBSWVIcG1RUnBKd1gvcnRQVkZCUXFOQmhvClJUN2ltbnNk
+T1grdVJSTzIyNTBTTGVEckVGQXdYNHdwOU5NbW1md3lGM0kKLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIHZ4bFZSS0huWFBDbUhNcTd2MFhvV0lOY1l3d3ZXNU4vT3dwMmlI
+emhoV0kKcDF4M0FPK0JpclI5Q3Q5WGxpZWVYbHVWbkNWdTArclZsN09XK3VJSXc1
+awotPiBYMjU1MTkgRjRCNVZmcXVnQnJ4KzZoM1ZkdWxYUkJTM1JuK3ZlRWJYdkFR
+WXpFSmR4NApTbU5qR3ZuN0ZmbzIvMTFsMkdNSGJXSVlrVmZPdnZvcHFiZW45SW9I
+endJCi0+IDEoIjlcJi1ncmVhc2UgJUE4IWl5ODkgfGVdLihEfT4gWCAreSduPS4K
+bkI2Wm9LRGJXdW11aDl2VgotLS0gTENqYjZEUUZaWVZEcWQvWW5yTzJEdHRLeDJm
+QUl5aytXdDE5QVMwVHZVSQo+aDbaGNOrz+hTSUQ4IAjDC9EfNwrlXDZtBqw8HkRv
+1/Rr737scjrM7Bgt9zuKn6CB0zdeHTW5u685V2hCW/3aTy1eppWMWj3r
+-----END AGE ENCRYPTED FILE-----

secrets/home/pdns/auth.conf.age

@@ -1,14 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBpZC84
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBFb2hL
-b3h5ZnpQTE1pZDhlaEt3OHh2akdncE92QkVOSmErSHlxdWlhZ2dzCkZyem9hVFlJ
+MCt6c0I4Nm5SMFhEaWNZRTRtNkpYeVQvVGFVZzVqd0E3L2dZdzFBCiszUXZSVENo
-OEpQT1lYSGUrMnYrT2ZweUtydW8vc3pzemQ2WnVUcUNoaTAKLT4gc3NoLWVkMjU1
+cmxqdVFwMFA0elpFOGZoM3B6SW80MEhCNlJoRXV0WXpUeG8KLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIEJlNVFLcnJoRGVuZUhSVnRFck9YSEpMNDlwUEFseGlSOW1lREJQ
+MTkgcytxUmZnIHQxR2MrakZmRFJMcjhabGFON2xQU2RBSDNvRCtuV3NwNGJ2bjZF
-RVJIUXMKWUY0dUcvaVRSSFBqWGhHVnpHbE9DRjRzL0dlRW9FTlVBd1grdEpHZ2lP
+b2lCQVUKcFNzM3paS1ZnWk8xY1VzVmdTWndMK0JCTU14bUJvM3E2bjR2TmlTY2tF
-awotPiBYMjU1MTkgUlUvOURUTUo3VHBxMGt4am8vOC9sVWJsekJLdWxsL1hDbEtm
+NAotPiBYMjU1MTkgY1MrT3ZkN1pUd0JVb0JWSDByNUNRd1NUd2ZiNVJrc0JCb0J5
-d0o0Z0lnTQp2MFNlbmpJdkxQUjVCZDdnN09RV3hVOUM4Smk1N3lHNGJZeXc2aWVY
+NENrU0MySQp0bFpwRXRZcHRVdnN3eitkNHlWc0c0a0NmUjVYSVFXSVNFVHI0b0ZB
-V1RzCi0+IElaQS1ncmVhc2UgUWZmQlgKWGQ1SjE3cHlyMTFFM1pWc2VmV29HalNH
+U3kwCi0+IHQmKm9ERFdfLWdyZWFzZSBJIFkvRG5JIC9ZI002bmkgNX1hQHcKc2l4
-eUFoL0ZGUEg3aStnM1hmNHppTDNiN25vTmkwWGI4M25lS1RObVF0VAo1MnZ3anJJ
+S0N4YzgvK2xqZm1YVkl4ZlF1REVOTGRWOVZRQm80R2NnczlsdFlhTEd1RmVoNjZa
-QnBOemFsWXBaCi0tLSBqWGV1aDR4aEF1VzVNMlFmMlJHSzBXdTRzcldiRFlqMEVs
+KzlkVXNpbGZsNTRybAp4RDlIWmRqR0t3VjF6WVlSeTJ4aGZBd1dDNEpMTUhZenZS
-a0F0Y2NRY1owChWi2e1FFuktf6AV/erIFrYjwSyeMNGfZf7tEC6C/KZJuNH6mjyr
+WjZCK0FZcXJORkJwc1piS1FvSlkzc3R5T2s3Vk0KLS0tIDFPODlkZ1BSWEhHUHJK
-KJu+jzJxdshomWcJ6HcI14/CVTCz/ZrCM1qKUv4PVZt4mXEE6g==
+QjdZOE1KcFNvcUYxYlFkL1FLNVJETTkySVNYRTgKOipmWGTV9SvGE4KVqgQqGw4e
+CLP4PYlgdSmOATTIg32G/GVTM8NlvaII3q2GNS0Enx7Y8YwnwS2dGkYKVN3Da3b2
+WJwMiBZRu/PC
 -----END AGE ENCRYPTED FILE-----

secrets/home/pdns/recursor.conf.age

@@ -1,12 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBwSHQ3
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBjbUF2
-WnoxMklza0c0N2VSTnFQMHgzNFkydmhBbTNSR3pzajNhZ2xZeTBZCjBsZ0JzQzVh
+VXYyVkRud3JFU0tDQThjQlVMTTFaaW5uTkt3K2dmd1pleTFOQm5jCkNUeEVqSXVX
-ZUwyU3lEbHNXeFNrbE1RVVNHR2xPaS9oaDRCd3dtSms1bWsKLT4gc3NoLWVkMjU1
+RGUxcU14Z04zMlRubVIxV0VwazhlZlFtTCtXT2dVS3l4b2MKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIE5XTGphQUMwUThaR1JucDNYN1dLb3JqMktvUTlsY3dxbyt2Ny9C
+MTkgcytxUmZnIG5SRTFOWWVIMU5yK3VTdkVtc0VYNnFkRXFrdEpiNTJIRHBvVnky
-QWFVRFUKclNVSC82SmJibjNNUlN4bmJjeWZNZVdDUVdxcHMxTytlbEJ2bUFtUU81
+OHRyWEUKVXVvZlBBR0dsUXFMa2dSZ1FWVWpvZGlwcHJ3YXRscnBoaU1FWlVFYTdt
-TQotPiBYMjU1MTkga1BvMHpVbytUVHBYYnJDQlgyNm54MmpBLzcxL2M1WWNjSC9i
+dwotPiBYMjU1MTkgMWlBWCtSU0I4Q1I0T0JrZ1ErYzlHRTZsUHhZQkpYQVJGNnFy
-cjRXVTUxZwpuTXozVnpMQUU1b3lGNTJoZVN3bHdEZ2oydWxyQyt5azlvWG9aQ1FT
+U3ZPeU9RTQoxaGZDYnRaNjBRRGQzMGNsTmZwcjhBRXdLeEFqVWxoT3hNNHk5cU9C
-eGxZCi0+IHstZ3JlYXNlCgotLS0gZWgva0w0YzJqMFhFT3pqTHFYQ3VoTmtSeG9m
+Qk00Ci0+ICF8Q0EuPSIhLWdyZWFzZSBKcCp6MgpaTXQwdEllbmhRVDhOQTdpb0RU
-aWp6djFtRnZaQWtaZXM5awppdFq/LERyuE3rZf9OqkPbxT12uHLwpva4n0pCdk+z
+T1VGZmdZK1VEMWdPUXduYWQ2YWx5aDFTQ3ZzRnRWbFRGN0lWUU5iQWdPakpZCnl6
-6eVO0JqtFqncOQgee/f1qXHQMcYSEc8M5EOkdYWwWuSnTw9d2g/Xn8GPqtk=
+MnI0SE5sS0x2MUZibW96SllDQVVOK2grRldPOWo0VSs3SkFUN1dqS3RqTTdPZG1M
+eHI0T1BHK1F1cWlINAotLS0gckFnWkoydklhWHZhZHBkSkN5ZmdadVdiMU1QOUZW
+VkJENWlHVWNXcEVsWQqYscIBmSi//ev3IN2ax0Ei7p8Atu4nYQui7yoY/1fiyGQL
+DB5+R9Dm4YUNHt3bjrBYclLohDGdLUnOB00BXUqNmlLm4psL4Ey5Go8=
 -----END AGE ENCRYPTED FILE-----

secrets/jackflix/airvpn-privkey.age

@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyA3OUtH
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB1N0V0
-M0N2ZVpiYkdqNm5Ma0JMZlJ0L0dNRjVETmZnaTJIaDhUZDlSeWtFCkVhL2tqZ1Vp
+UW5ZKzQrSlFUMnR5QUE5N2Mzd0FvK3JCeFM2RVRtUklVQkNkU0dNCnJuUUxjQjcw
-STVwVGNlNzZGS1NtdVpKZmtpWklmdEZDbDhvZkQ5RnREZFkKLT4gWDI1NTE5IEo3
+NURFOFRWRG5WSnBPT1dOVjFNQWZVUjJUSU9WVTExeS9XZkEKLT4gWDI1NTE5IHdq
-TXlOMkh6RnN2eDZ0U0R5QzFzU2hLNEtkL25oaEZKMWRXQlFNOU9oSDQKQ0dMRmJz
+eDhJSTZKN1lQRXNaZzNIWEx4NTZINzZpdFRPZWJGcys5SUV6bmc0Q1EKeGlqTjF6
-QkhlMi9ZTjVWT3lLZjBrR0p2NFRoZmFZUi95c2NrOTg5SFJ4QQotPiBTNHQwYS1n
+b3Y3ZWNhcjF4WlpOcXh1OHBucmNCZmp6VTI1MXRjN1FlNlA3VQotPiBtQ01Dey8t
-cmVhc2UgLmYnKwpMZFRKMHF0Yzg3Wmp5dFpsdmZzckxERjV0TlZBdWZ6OERvSVJl
+Z3JlYXNlCnFKKys4Y0I3RkE3bzl2NDJ2aDNMeTRTUUU4dFFwelV3SjVReExnCi0t
-a0JNZ08wSmh6b0RTdnNFME42dWcxZ2FJQ2RzCnBLcWpYVXdlb3gvd08wa3Z3ZE9U
+LSA1QSthdHR0cVE4bXhiczZqUTNJdzkzdnZ2TEpESWwwQ3BWNnoyNmp4ZXdrCl1g
-TCt5ZTZIdE4KLS0tIGx6d0tNTUhYRnVUYjdvSDBpNitSKzROQlNUVjhOeDVFS1A5
+oNwCvlTrPx5b5l0OUymxMo1HMCV9fsQ9zyaoJoPFN1hv7l4hjjX5oVoj/IdTJbbe
-WlJ1Skg1RUUKY7q1Ykb1Af3KznidRyohQ/aOW0zni/Gk2k37He3F9N3QEIoYq7k7
+ZMs1yqa7YbR4+HG9GG8nPhU36hchSN2whoz8
-TECxxJr92BAz1tyg+C+ofhBfd/Ufy8syGSDU16Me65+flhQ8eqM=
 -----END AGE ENCRYPTED FILE-----

secrets/jackflix/airvpn-psk.age

@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBrRzRo
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB6dGZN
-RWhZSWtLYi92emcvOHpqN01FT243cnFJWnJvN2pmdnB6a2h2bFF3CmZqdnBaYVl1
+VDF3ME9IWWJMQUVrbmlKeXhZbzE1THUwVWhBc2ZBQXdUUkpod0FzCkVncGlyTXVv
-MS9RTGg0MWR1UkdvRE84MlZuOUFBZmorZDB3VzBnS1lsMnMKLT4gWDI1NTE5IGIz
+bmxPN0F3ODdvUmw3Sit1cERNTXN6YWZlU2IvYUhoUThER3cKLT4gWDI1NTE5IGQ2
-YTQySm1DL3RhajhOS1FUZm52dGhxL3pjcklHRDBoQ0tvRjgxcW9pbEEKR0ZWZy9J
+RzdCWUw2N1BHWVhiOGhvNEdzQVlUanR3emdDV3FUTFRXUDB3RDdrMmsKZDkvWWgv
-QlBSSmdHRzRiU2srazRkVFVQazFTQ2F1WTZpOUtaOTNzWUtNbwotPiBvd1Yybjwt
+MFZhbHZtVDVQSWVEQ2NxQUZrOXFMVmYxbEU0STFJTVBzZm16ZwotPiB+Ty1ncmVh
-Z3JlYXNlICUKdGhmVXhzUGpWc1lIUUExckoxZ284aWdVTmpXQTdzQ2JKVkJCUklT
+c2UgMnpCPlV9ClY2TzJGcnBrbUJTU3lyNVlrNDdwYTd3Ci0tLSBHaU9ZVnZoUkx5
-bUFlRHJMZVRsdE9BRnd3d0ZNWTRUaVo2WQpmRStxaEl0QXgxRFVTb0FmZ25BOUlM
+QnE4UXhMdEg1elE1dDRoQWx4bDhBMHNwS1BlQkRaUm93CspT9YnuzfpKxC9y6SWJ
-NzRnTVB6aThRdjVDeS82elRjCi0tLSB5aTB1Z1ZjOXI1VjR3NUdGRStWZnl5YWs0
+JRyT8aFEJTjoDEqN2I/DBwRikSxKyspHi7grCwFaoofylqJzsP/In7Xlf91xbMXz
-MTJyNGl1MU9vcW1iWGpwNTZzCmOs35GGkv3z/c+hPo31jcWjmJ85P0NAjZUFtgpf
+njjXbBQQP9PG3Z2c0OHk
-bUdWe1IUE5ohCVgvK9SzCTTfSTBGe2ZipZivvxjJPM/CHr5o7mWBrKccyfZ4z+dI
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/acquisition/airvpn-privkey.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBNNHkw
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBaUm1C
-bFpjMkdSZ3ZJcjhlZGN6L2VIMGl3WENKUWVJWkIvK1RyZ25oRWwwCjlVQVpnazl2
+WGJDSUNtTUYxbHVnWU44VkRnY3F6cTR0Tm1EUEdDYmltWHBrL1dvCnMzSEFqZTdS
-d1g2dTYwRkNvSEdaTTJCd2s5MUhjcmtFSmUxazRqUFhBQUUKLT4gWDI1NTE5IFF2
+K25tMkdkNEZ1dGhBMVhSUkR2M21EY0NtbnJjb0R5RVoyTDAKLT4gWDI1NTE5IHhv
-VEZKNVMxMkI4VStySGRCbWQraXRxQTR2Rm5tbEU1WUN0VDVPM0JMQUEKNGd5L2NK
+RlJOd3dCa3ZaeE5JS0ovV3ZiY0N5QThNSi9LaXQ5d1JIa1UyeVFJekUKd216RGw2
-Z0hyaENOd0FsSDllNlNWKzZsOFVYV1hPMy9IRitXZ0hmaTgyTQotPiBjIXZ5RVFt
+Szg3VG1PWUVweE9udFpta0gxdWx1NEU5ZmNwK3hMdHdZNlB6SQotPiB3dlxKIXxG
-Oy1ncmVhc2UgLmA8YSA/OHpSMUVTWCBBXwp4dVFBcVA2UG04MGdKVngvUzgrMnU5
+LWdyZWFzZSBCLGsgWCU+UWwKWXVYQTBqVkRMKzNsU3JuWmlQdVpzdWJWcVdwVUM5
-NFlvQk5GNDRNYXgwU1U0a0lHMEZTSHNaRmgybTRkWENiM29QYWxQL2JUCm1Cd1Nq
+aHpmZFVPbWlidHJEYlN2M3NvUWNqVgotLS0gZHhwUlE3YXJSdHFkdFpkTnh0bC9a
-UlVIYzVvbWJlawotLS0gZ2VxdXBmTWZISnQwd290N1FzTDZkWWtYZExHYk13WDc4
+TytZcmtxd0pldUg2YUEzMFJ4QjR5dwqaUnjT3oaUunudOqNfh9twKyaRttf4sk9G
-QVk5ZmVPSDJjVQoVqTBaAcV4hz+2h3pK4Z/uVec78f32MWB3nbcBc5PrmWP0Fp/I
+uiiKoEa314HbI1vgS4iCNX4vG+468SECiF9llZL9U1w+1MSF1y1BKy7XrDCsp7Xs
-NZ/nJrfiTjR1fCOvoVjrYFk/e79kXQQXqxKcKh4olUGbSg4wlNltHA==
+HiA2aA==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/acquisition/airvpn-psk.age

@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBNcWZk
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBIdGI1
-Um1lWW44UmpVbTVFUldDaTZucFViRGhtR2hzenJ0Nm80Vmt6WkFjCmg2elBmRU1B
+UVl5bVN5TDUvMTRuVFdpdG9lSkRjL2hOTHo3OVFxQ25IMDRlRGdJCm1oOEM5Rzlv
-R3ZlRmdld3phMzlIUmQzek9sd0c5VnVRNkV2M0FzQkpCN2cKLT4gWDI1NTE5IGI1
+cUljejB0aUNCS0x5Qjh1Y1JWQTNmWE9kcjF1ZktJVUxLSUEKLT4gWDI1NTE5IHBN
-b2NOOU50Z1gxT1hqMTdZa3pqSVozeUYyY3VNNk5BQUtaNmRvdk1HMk0KQm5ZbndE
+Vm4vbC9GcUdaYjNlWEg0UUVTVVVHWG5VTnVPRFBkUXk1dm8wWlF1QU0KZEU3dXFR
-UlZ0UVRiZmVUVjVWNHlVaTRBbDdpbGI5Wks3OW00RXpHaXI1SQotPiBQai1ncmVh
+YU5GalhSakF3OEduSlhuYTN3SVdFU0NrWmJBZThvN1BGU21TUQotPiBdLVQtZ3Jl
-c2UgIWkgPE90NnwgMyBXal4+CnFIVUZqWGo5cmJZcjBKR29sdW5wV2VTYjZwTGxN
+YXNlIElWPzRFcicgYVoldUFzClA3M2JUNFU4T2xSRmpyeStMQjZNa1I0bmxLSUdj
-WFdqdmRMYU5uNXI4WXBwQkl5RTI3SWJSaGhJbis5SmxBakkKUFBtdmZRN1IKLS0t
+NGN6NkFvbmJEVWJXSEhCMjhkWjhyZkZPRyt5N2diZDI5SGwKczFsaEZXbDljVGQz
-IElFQjdmZG51QUowd1RFb3I4b0g5RmRCcnlERnEzUEg2RXRVVm1hK3ZtcncKu+1W
+cnpMcHpPdTBPL0hwb0t3dE1XNURWckVEOFZmQwotLS0gbmQrNm9QQkpxTnYzTTFt
-iOenvO8rorvZpzzt2OexjlYBQ01dBOf6DcNadqqOVQiS+jN6fK00N1gr7s+I7I+J
+bHU3WWVDai9BY3VSaTB3NDN5bk1IdUNiMWk4NAqyrvPkq+FP+fSs9mZMgxLTJICD
-VdkM/HZJ4X+XKCJ5JoU2Jqwi9pTkapMvmek=
+5l8Ii5h9fl2APzedygOLFGQLq0qW7pjBygfmQWgG4gqsO4iKIwEjUiv30/QCUhKL
+CGZJpN8AfZAcow==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/cloudflare-credentials.conf.age

@@ -1,14 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBJallz
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBSdmly
-VUJUMHlHL0E2MGpBWnhzTGRnTzlHdld2Ny9GdThaSHRNSjczQUZnClpoaFZBUWxR
+aEtUTHh3Uy95ZGhEcno5VktOcmlWYzVqUTE1MUs4NDg4WnZBT0Y4CjY2QndadEF2
-QzdvTytNaUdFSG5PTE82WWh4U1hTQlN2dWdhTEdiVTRqNW8KLT4gWDI1NTE5IGYv
+TzF6TlJxall2cW4zeGltQVNabUJkcWNCUDRwZXpjYXJubVUKLT4gWDI1NTE5IGVL
-QktmOGVlamw3dXM3ekwzUlA5Zkt6QzNja2NHb09VdDF0YzhjeWkreU0KcTRLVlM1
+N3dkVDFuSXdXZTFCVStzSCtCRUJGWUd0bnNGdnBhUlIzMExSNjBqWEEKOUdvZTlK
-ZnpjakRJZUJmUVFhU2VKbmxyd0N4WVEzeXZ2ek83eFBoWmhlMAotPiA7MzpGNWkv
+dzhyYWUzTmFzbnVxRTZRNHZ1NGFXSkJ3ejM0S0JCTGNpcHVzcwotPiB1dS1ncmVh
-ey1ncmVhc2UgXQpjNkUKLS0tIDBSaHo1dVk4alRpZFIzTUh6KzZxZWhJWlZ4Y0M3
+c2UgY0NxK2VxdyBdRE8vQSV1cSBcIFw/TG8jQwplZk1ZeTAzUnZJUm1qQ0VxUGpU
-RDVXaFpTRlN6VlVlVnMK82Dlt34Qvs4SSR+FcjVUAlCBKt0IFhr41a1Q8kxjaV60
+NU1waVZ6OXF3NXQvS08vblYvRDl6TzF4RUhvdW16anZWcXdORTVnCi0tLSB6ayth
-ijQdERUKcam3evBF0EDnJXCXgMGUWoZUYbnwowHUqfvs+zUTweSB/+y93VmFsUc5
+aWRVUGgwazBMSUk0MEdETkhnbURkbEZXUGNCNnN4OUdPMXpkelcwCoil0uw2yDNc
-516EIscUkDMSG+aC4BFUzB+Rub5chX5v90tHPU6GKbgvxppXHYeBMFt5r2gCZUs2
+mOUMhVzALll4DgCX/MskwCdYohSBnMpSzqtltAhkW1aqdbuU3PC9LHQElpuHqpl9
-Sic1dO11tviEvhetNPVvns5r6WnJjzQGdYQ2d6oS04hHUPZ1HV275fBqPlpoB5Qg
+leNTu6n5nU5BHQ5qWShedL1G11SRzcblImwUcyg10d6Z0nUoCUjmw3BnGQ2wwvhC
-gvRSf1+rdQcHGPifylLCOSbLCrJjOpQtcLVz2LmCLtzeDN0ebfBb/WyL2QBVziyB
+M+GGeb9X1ORRciqprtTq1WXWGG3tYgL9SjTAEtyMhAZ3CFjh3p4BdC9pVhCAJ9TA
-4pcFF0hrkJJg
+tbRAtqIz8VTzG86G4zPJYzBwtAse8tJDEO40GUqcOsmXhmPPpd7je1k381+GVrMj
+q2g2gTCUOrMryVRX/7+H2iRxtIxmhqESXIWgY5SIUv9uRA==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/ddclient-cloudflare.key.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyBwNHRZ
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyB0blBa
-ZGFhYTc0UTQ2OE0wZ09TeVFRNkVDTGQ3M2U5bUNib3Z6RG5IM0VnCloxWVVobUxr
+Nlo2VGUzZzdTNW9heXhuUTJWYi9lWkl5WEp2VXcycExWd3FsLzNzCnpoZVVHaUxK
-bVJ2a1ljVmErdVZVNS9MWjZpZnZtYStLSDJldnltZnlxeEEKLT4gWDI1NTE5IGVt
+aHAxVmxQSkJ6a0JnSFpkdmRzLzl3ZktwYy9yckFSNGxzRWsKLT4gWDI1NTE5IFhl
-MXlpYUpDVWdrZmdscTA1T2JRWThzdE1aeVh0OG5FMThwR1ZCVE9mRGsKZkMxUUJF
+RlR5TjJoUVdScjRKN3hDQmg4aDJpSllnd25WNmlVVTU4SzZRZEdnQ28KVGsyVHN6
-N3VOZlZSYlJ3SnBRa3NvYm9TOThIVzhqT1o1RTN2MzBPWUFNawotPiBnUVdBLWdy
+TmZyV1hSbWZqWUtYNFdEQ0FLMjczRW5HSWVEaHJidHBjZzBZTQotPiA/by1ncmVh
-ZWFzZQp3TmRSa0VoTjV0WHVXSTBGakcvZC9lYjJKeU8wSEpNa0hZK2grYStZSlhW
+c2UKUlJ1V2Y1eW1aNG1CTkx5VjZlREt5VkJjOVZoUno1T3p4WldSUTFpNDBXb21m
-TUNBUEFPUHp6VWV0ZWR3NzRpLzhSCm5wb2FMQXR3dmIxdzdMcmJPcTZTYXROUmFZ
+Z0l6eGZKaTBqbjRiTTRybnEyagpxQlRIZldEVGdNblRrZkMycFljdkwxSjl4VHcK
-Z0dYdzFpSCtvbVNJdGpRWWhQWFEKLS0tIGRBbjVBODU2T09lV2RZWTVob1pXTGxi
+LS0tIDV2Q0NHeGRUblhCc3JUenl2bGhueER0UnFkcUZNWXR1c09QWDI0R2FkdXcK
-bWtMR2VaK2RTWnhwaHMrRFhaSlEKLiG6Hi2Ff+YOHrX5lfbi7FbQmIK4ckWctSQ7
+8DfpILM67mlC23bKjt2hWfpI51JvTa2YBEvHwHDuaaZBw8FIU6E8s77iyjTysmsw
-hnZsM6n5vB7ha3DlusZ6foIUF23i1b3vsnJwWxBWYK3fl+wci3ut/qYU1V+FqA==
+vmQwTrdoUPhfLHXspjHH1GGObwOxvdw/Mg==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/estuary-wg.key.age

@@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyByK3Qv
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyAxUzdG
-dUp1OWdDNXFmWWFXbTlwKzF2MnJjK3lYd3Q2eFBWaXNmdTRIYTFRClJkMXNmWTU3
+dG9ZNkpPNGlreWxRMFlPQUdFTk9FZ0kvVjNhbUNvMWU4a2krcmcwCnl1Vk1PUS8r
-citQcUlYMktuK3pQK0poUm1TVHVQczZmY2kvYndIYjkvRmMKLT4gWDI1NTE5IDho
+S0lveDV3OVphc3d6UDdLKzR4ZjB3RUloRzE2Zis3bjhsL00KLT4gWDI1NTE5IGVx
-Wjl2b1FrVXNFa1poZm5oNG5PeUg1aDh1WWpZVEluOXhUcTlEYzBXaTQKQTJIT2Ew
+TEMzdDRDbFBuT0c0V1Y1d1diSUVYMEw0dmJwcG9WaWQwcUdMMEVtZ3cKZ0x0OExq
-NXdIZEJhMUNScVVaeE1OVFY0cm1SODJTOTB4ei9PYjZBMXRiWQotPiBJLWdyZWFz
+REFEdlJPU3o2WTlUQWU3b1NxcnJ1ajRRNkhxR1lxUmNpM1BLZwotPiBrMTREQ0lb
-ZQoxNGVvank3K2ZhTnoxeEVFVk5vY2FmYk43UUYrUkU5NmkrOCtZZTdKUHFRb1FK
+LWdyZWFzZSB6TSp5Y0knClQ3V1VFY0dzSy9iNVdkRVZYU09yWjhONXkzck9VZVpC
-SUZwbHZMZ0tPVG1DWjIzcXhxCk5IUmFrMXBVdkxjMWs5bzkvNWpiTFEyQS8zeGJC
+THh5amMvTlNLRDN2YUh1Mk1ncFcvZTZJZTRIRUlON1QKUzVDTDJJVk8KLS0tIENE
-M1NXMDBWa0V6U0V5NVZvL1FXMTNNU2tLMjhzNTNDR1FPLzcKcHZYcgotLS0gbTNN
+N0ZzdjNnTER6ejRqZ0Y2WTd6dUJOaHJqTk1HT2U2TlkyUnBPTFc5WmsKYcIKEURp
-YU1kUmQrMkdoK3R6dWExczZXd0wrc3dwcFBXT0RwK0hKb0Q2U2RKRQqwMOWR6wki
+YcoFwU+gxq7BQlXo5LJDIcB73HPeerPnKYpfdyXFlsdm8mv3IXPEabSPwSNHXGIx
-Qeqhvbxtr83B69YxK3lsbrIiUf3CxYBOY+avAdR7TQDS/0toJb7O1PN2O/XON43j
+BdinoqfHgAjMwptksMA3iIOWqp1cF6E=
-F33hdGtLjeVhnlnxLo5POMYJdbQcRw==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/htpasswd.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBWMU5p
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBvRWE1
-U1JvVkhyRkpBc0RhWDN6NzF0ZWJUQ0NwS0ptR2xldnBGS1U5d3cwCi9mMHpiVEJ1
+Z1ZpNTFjTnluOUlPMldCQ3BzQzdVaEw4dlZjc2xuMkhGWlNDU1ZZCjVGNk9PNjNS
-TTRtZVlEU2JnNjZnUm9wTitReGozb3FoUFVEK2ZpbjErTzAKLT4gWDI1NTE5IHJF
+elNlSzMzYUNOQ0dzYkNFUDlxNlg4S3BGbXNldGN5eWYwZTgKLT4gWDI1NTE5IHp2
-WXBtMVIvM2lqbG1kRjdEN3VUUU15ZnNDSWF4d1Q3QXVyeWZ1UlRBamMKT0JWWXdy
+eDFPZ0VadjFVZFdVMXlYd3ZFRXIyeDRQU1dMV3ZEWHJEaGxOSzgxRE0KVVpvVnFQ
-ZGl2TnNWYWlaUG9UUGk2STMwVHlNY2Q0S0xaenZhS2NGbGJnQQotPiBKIW5QQVJb
+WHhpWjN2Mm9TV0EwajlyRTg4TVIvbm0zZGFBVkJqbkJTZEh5RQotPiB6QS1ncmVh
-LWdyZWFzZSBvIHMgMUpxcmFdNSBBP3cjMzIlCktqQTRqTnRhTzUxSgotLS0gajBW
+c2UgdycgQmJMCnVhd01JSEpUQ1U1Q3o2Wnh5UQotLS0gSkZwd0tNTGs0NkFiY250
-TCtOTzZmdGY0WmZmank3MThNWU1OeGtRRWtKN050WmpRNk15OXRMZwoipi3sG3t9
+eGR1WXRLTWhzWlZOaHlGaHQvNUh2MjNDUm8yWQpH1cWbszmSTjpqz8Wyrt6g2TNP
-pHRARZjv4kUS8d/1EprnxVge4qA42cM77E26E5TpiJ0gvvxyPsDduozMRbv3T/pk
+rtCRSnfw7UcoMh2oW3kyYcQrwf/sAFAHLNMh8oOWoxrKG1vtPxpOz251hlnee8JV
-t/7webbOzGrcqixzFjiRjPdqBNBkvtgB5Y+aPzoiFsg4ynG/nnpEYh0iJcyYWnhs
+dIZ/2Gj/lPXDFTkhmX0TfABAe4wPJlM2wu9pj70UvGnI1osR6avrpYr9mMau3Ypm
-DmXYwwHXrfTLc+HKsItcfNA=
+Ucix6cE=
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/nextcloud-root.txt.age

@@ -1,11 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBuL2F5
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSArMzRH
-K3Z2bUFSalNiQldOWUNEbjRhZHFVNFR6bForbGtXWTRkOVF0TlhrCmo5NkVhTk9u
+YnRFQUNJd0dRZDBEMGJZeitaS3Zaa214c2FnakxMYVVxOW1xMkh3ClpSeEprOTBW
-YUFDak83Z3YxKzhDQzhxNndYZVRTNmMvR3VvS3FqbFIyb2MKLT4gWDI1NTE5IEZG
+dk1tRWhmUXRzeWpLUm13Z05pTnhsV0hCRk1YUjJQMTdDQ28KLT4gWDI1NTE5IGQ4
-aEsvVWc0Tm1GRGpPOXVhTGY5dVgySmdwT0hhT1luU2NEcmZRdnphWDQKTk40Z01M
+OXBuVkRiS0lRQitweU1TRURzK1VhY0lnWFpZRGQ0aG9yOGhsa1JnUlEKUkU2VUhr
-YUhUWnlaUS9CcTNueEwrYXltaVc0ejNxVDVqdys0U04vL1JMRQotPiBBNipuelMt
+MTc5N2tkdFYxd1RUemk3MFEvb3d4eHFaVU9ycEhBWHk3QVRwZwotPiBbXGVcI3J6
-Z3JlYXNlIDlhOXkzCjlCQWxncHcxdE5FMGZtWlEwRzNROXJ3ZzdQdWNEakxJQmFL
+LWdyZWFzZQptTGx5SmVNM0FPMHdGY0NQK3AwCi0tLSBwbUxtKzMxYTNpdUlPc3BZ
-Q215aTdkNThVVk9FMEpyemExUHNVdC9OU3JRdkkKWWdnYXdkWGpaUQotLS0gNmJT
+V1N2cFlyTkZvYThES2wrZTdHTy82cXVoeStJCk0ed1c9gQUw93efGmqJDQ608cwj
-TVVRWFNsU0VhaUw1amFLSVlEbzlJRU5xZVY1MjBRY3JJOHdMZTFGQQplcrNuYtlm
+PDVTyJ7erVlArctJkTKOx57QMqWzMSEGh7O196SceZEv
-a6lkQjiYWeAJfiy/xmXAx0NzXuREorP+8YieNsS474Paj1BYoeJxSwcSo+D7SQ==
 -----END AGE ENCRYPTED FILE-----

secrets/l2mesh/as211024.key.age

@@ -1,20 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBaM1JY
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBUUmlu
-dHR3NkZhVHZoRGllWjh2SW1HL2FoNkY5L0poUlloRHJqTm9RdW5NCkdtMCtSSWdk
+VkJMYVltVTZyUnh0aXdZZzduSEl0ZFAxb2lIb2F2ck4zdlBjdFZNCm51RnV0M0pi
-aDBUYXBNSHVRNFhlMFVyZnArWlRtdnl3UHRYcHRKUTVhQVUKLT4gc3NoLWVkMjU1
+VkVaZVdOMWpKOW43ZjhFODgzZTJ2c1F1eXc5WnJvMHVZUGMKLT4gc3NoLWVkMjU1
-MTkgbjhDcFV3IElKUkNDQitBM2tYKzBTWDdWVlYyWVgvQXk1RW9LbkxxYjh6eXFq
+MTkgbjhDcFV3IDdhNjB5U1h3ellMRDRRQWVkQ3hNcVQxUnQrbkQ0V2doR3pFWFRI
-OXVXWEUKYTgwaHRzQmVlZ2ltcG81dmorM2NRVUl0ZVNIUnNJTnlhTng2UEhtYlA0
+RE9xMDQKTUh2bXV0eTdvRmhmTVVaRllRcEpiRStnSnpMeGFpeGt0eEhvQlZETXhi
-YwotPiBzc2gtZWQyNTUxOSBaTnFJb2cgbmZvZmowUnNtZzE1cTVTbTMvdnZVdjdY
+awotPiBzc2gtZWQyNTUxOSBaTnFJb2cgUW03aXgrM3FWbURXR3o0ZkZsUE83YVk1
-OHZtbzZqdGZ1NXZJVlFFM1oycwpiUlBybFUvdU53UEFITGRiZ3poSyszS3VoZkJy
+ZzkwZm1JdC81aHI4YVJOdWQzTQpzS1dHRFZYeHV2djVFN1Q3MHdhWVl5WVc5NExy
-QStJeG1CRWFtZU1jdzhZCi0+IHNzaC1lZDI1NTE5IHMrcVJmZyBEaUZpRHl5MTlN
+M2xEckFMTjFvTWI1Y3BrCi0+IHNzaC1lZDI1NTE5IHMrcVJmZyAwQ0Z0a1FHU0lV
-VHFpWERRRmtrQ2ZEK1J0WmZvSjZRZjI1bE8wYXFqYjJzCmQ5bnd1SWYyVkxXZmhu
+VEFmMFpsNXF3Z0l3eTkrdzRZQ3lSQUg4MFhPaUNEbGdVCnFuVEhXWDdndnhxdUtV
-T3NpL25MSE1hdWkwUUE5SWJGNUtFN2RDcnZvcG8KLT4gWDI1NTE5IGpSWTcvdlZC
+TkdRZnpFTGpaZDNJalI3b1NHUld2NEV0TlphK2MKLT4gWDI1NTE5IExObHUwOEFT
-ODhPSjNCWmRVMW90ZUJTRmJnb2VBWTJwQmdaaW9icmhWekEKMlJZRkNHN3FMdkpo
+bGl4S2F0YVdHaGFnRjdIQ3VDeVFDbjh5SFpkczN3d0ZuQUUKSEFvdTIwSUhvd0dz
-NlJSYnV1TUFPUXR4ODZWSzFSUmpKSks3UUc5NmpDMAotPiAhLWdyZWFzZSBOIm5j
+dDdBSUxDOHZaNkNLL0x0aDRCS1ZORUsrdWpJS3EwVQotPiApcDQxLWdyZWFzZSA5
-W2ogIUdiczYKVEN4ZmVCMHJkcXBOU3pQYVd0L3cxemViWWVvUFVORmNxMTdZYzBS
+ZSA9YD4gbWMgRH18eXd0YnkKbmcKLS0tIElQa3pEcVhtN0N1bW4rSTZ5VnB3N256
-R2VpM0dTRXM3SEtIbzRhR2RSWmdYNzlTNgpvbGhua3VkMjQyQzBCUTlCa0pYV2dw
+bnM0OXpSc1BuNmJwZnBremRIZnMKhN29J3s+Cif3jvx63Xay77CdC6uVhjsojdbF
-Y0xlWmxpOUwwMlZPaTNPcjJqZG9SOVlxMWQ1QysveHYxWHlOU3RFYUxTCkdRCi0t
+zhWad9vPolrrbEiNkhcdrutyTRniFBUEwxQVGmAxcEySNTr3lnWnWQFagphu3F27
-LSBIaklHZlIyN2ZyM0c2RnF0OHVNRm1JajhrbGFQMC9DZHRpcVNDVDdlcmRNCvQT
+zLs=
-KD3SFU/FRfU4zVIQ5M9uVGtW1dQojM6gqVJLZnZ8k3Qmh2+kpZXwDgDLJClOBks5
-eC3xmQngE/8vMuGs2LP481hINbgFf1iJPYcZ
 -----END AGE ENCRYPTED FILE-----

secrets/librespeed.toml.age

@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyA4N0Qw
+bFd4Q01yb3M3M05Ua1BPZjNsK2cwYlBuSUM3TXRaa2hPU2wxb1hzCnhoTzNMYVNT
+bjRUTzFJdjdZVG1IVWJNa29PNjVVQ2NWbFdnNWNjcDk1bk0KLT4gWDI1NTE5IGVu
+d2x5N21ZaW5MeHBzWkw5QnV0SUNiZTJBVlhXOFZacUFJVktNQXI4MTgKYmxQYmlC
+YXJvYjhKbWVZWGRPWWh0eTlIZTJPSFZTZmt4UHJ1M2thNHRCMAotPiBvPls2N3ct
+Z3JlYXNlIGowLGEgUFNKKWljTX4gInUKMkFwNGRiZUJCbUZhN2Z3YnZnZ3Nna0tD
+UCtrODlldWZ0Rk5INmxTd0tmTGx1NS8rQUtTdVFwSVROcjVqeUJaWAplNWd3SUR5
+MjRzeXlyemtka2EwdVZDTkowTk5NMk1rdUxCdkR5ZUJOCi0tLSA4bWVKMXFTalg4
+ODFIN0hsTS9lekdWZVI2VTNKYlE3UzhXNk5nM1ZCMlowCn3ZLml2b8qDs+A2W8Nn
+YGCfDV+aes39ef/2wu6EMISradXZQrzhSj8JHn7HqsarqSQmOhYP5juawEFxAuZJ
+kUc=
+-----END AGE ENCRYPTED FILE-----

secrets/middleman/cloudflare-credentials.conf.age

@@ -1,16 +1,19 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyB1eC9Y
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA2NGhR
-NmdTT2pYbDhQenQwdER6Q1FrdE83eUI5ZGhzd3ZnSXUxTkR2T0IwCkVOQ0ZzU0x5
+aGJ3RjRaTjlFeUtWa1FZbmdQcGJmbVdxNVkveURqbmdwL2x1RGpVCnY5eTFZRjV3
-aXU2SjZFZGljd0F5MUNPVWtrLzczd0N6Y0JQVHlhZFNOOVkKLT4gWDI1NTE5IFhu
+QVNMZ2xGMHVBek1BaklxUUtiRU5pTU9kWFk1VHhGNE81SFUKLT4gc3NoLWVkMjU1
-SjQzSjRaZlZBTXA1T21nMExrQXc4cmU2NDAwWUh5QVhaN013S20zVjAKRVY4VStU
+MTkgVkZjdzVnIElYUmkwbUFPeEExZnJGVWwvUFZsRTdhYkJsSC9CM3hMbGtuSVFs
-aVNHUk1ucXo1dFJCOGVaNG1Nd1JSZDZURjBBaFhxYlg1ZE12MAotPiAsXS1ncmVh
+UGJXQkUKQnc4MGNMM0JZcC9FeG5HeHpLUVFlNE9xelo4Qk1mam5WNlBITnF3WnJs
-c2UgNyhYRi5TIGNKaj8gPSBAfn0nemsKdVB1UHFnamh6MmdnM2U5YWxIbExZcEQx
+WQotPiBYMjU1MTkgVkpmUVdBY1p2UDdLcFpXVnJOZGUyZ1VXNVYrUmxkZlpqazRn
-Z2dkcWhrYVk3ZXlBMnhqdlIwczRrdVZXeFFyR1RrdENWamNkT3JqWQo5d29QUXVH
+cVlLYkt5YwpZSUtIN0RwSEdOSUFYQ0Zsc1NzeUhiQ2Q0T296dmZ3UW5hY1Y1MEJn
-dWUyZktrQ0VRZzFBUQotLS0gOWZYWmdSUnF6ZVJWdDZ0bGNKb0pZbkpoM2VCOXNO
+MzF3Ci0+ICV5Qy1ncmVhc2UgXSggRWprMCBuCkdKVldUMHozVXlqTVNrUVdyUVd0
-Z2dpZ05iNVpFdkJHOApGn03fCDt7S2lhhOozgQpiFDSfe5vXmTzT3rv5mww4Ap8L
+MFdSN0dPSVdnT3hMN2NNYVBRSGZnV2k2cVp4NGdjMHBHS0xadC96YmNObEIKUWVH
-w5AI/PaJ3fNUDrEHUxmQgYboSJ+LvnJRe+6gUodLrivVR6rrnfFco9poyy8a4bLi
+YWk1Q2tuQUpsV01JWVozbG4rd0ZiN1JHOHRFYVFIenVxOFhXRndrN09lODkvaVhB
-2Glg82SWSgKvxQLkC2DU4sa/iaBjA3IDwrhAz9Gh/MfmGGcmu+UktPTDZ1/c7UDX
+eDBoVmxvbU1FbWJrCi0tLSBSeU5TaVZUbmdwdmh1TDVzb0s1eDFvNkVrK1dqTmZG
-HzU5kJ+lqCLsQfkmEvHAeuhTzwUXPccjkJAtS6mJ1ru1FP6Ib/YmsjGaXnpOanPo
+cDJobU1DZkdHRWhnCvEtMAlEC+BPPYX1YvvcmvRjeOgbuuxzjkGjuB+tT1pBKfYR
-Y8LrNQpT3HIA4AaAg19wYTUtJgOd+OCs7uhjHy01e+Ty50YOy1+TwRwSorHDB/Mr
+9gsHtkPWibhCk546Q1w+fY4StxKmaoxPddBjeQNXh9W6cCQ/vSmxAFya3w5SEtPd
-LZnV/4xk/jgNuQmBVHFyDJ1envYHrcdPVEJa1S9pN4JmtolNfEOOq4fIjlM5
+QjozqEVsiwBmBrZgt0UJ96e5hmhmD6zU7fp/RhpFpZv1JrEkhYEz8+jk5Ai96mSg
+0pKDAU8xtCnyBBaPiaj2jU/6kiKoGaVXCEuIv0uayRhRp0wap/kf+ToHA/oXVXbl
+TZsalOEKH38udhBJiMjRgemqyHQEEpjmYIMWdiTvH6PGZ0yp/09iiEyBCMwzcJAk
+nr8HyZKcuzswBcVjRak/raM9lAbpdWWktHxAZa67wsCH017FDrN9e15B2MI8
 -----END AGE ENCRYPTED FILE-----

secrets/middleman/htpasswd.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBNYzAz
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyAzb1cy
-d2NXUy9EMXMwZ2tEd3JXbDVWUHJUeSt3K1dlakpOLzV1bGhGMzBnCjVvdThzeGNP
+bHBVd3ZEQTI2R0tyaStqei9KWnZkNklSYnc2NWlwa3NNM3hXNEVrCnV6anpBUEVG
-MEo1UzBTSnZueUV4aG5DWHpNL0RWcWR6SGZZS0oxN0F2ZlUKLT4gWDI1NTE5IE9M
+RU16RksrWWpkS2Jwd242dVQrbWFjaHUyQjl4NU5EVFZRc2MKLT4gWDI1NTE5IGdS
-Yk9pVEZmWnNDM3B0NklqcFhldThsb3RVUGVnZCtzNW53R2RaUjNTM1UKaDg4ZjVr
+ejBneU92c1BXVVZyS1BBd3BYd3lHMXNWTW95UCt3MzNEQnQvc0RFMmsKRTE2bVFH
-SGdJTytEUElicFRQUUlsd0lJOEtzQURuY3RNaGtGWTFNN2M1VQotPiBlVG52ZTFY
+TUpWUzNoWmx5SnJhMkw0NVRwNFAzYUEvdm03UmJvdm1iNlB5dwotPiBRaWBxXS1n
-JC1ncmVhc2UgIiw0RT4KNnllQXNyaExqLzUwSEh5cTZ1ZmpxRlNMd3QrMWxoK0Ew
+cmVhc2UgUiogYk1BYG9RIDtQIC9yO1A2Ugp5SkVsSHdFeXlUOVJqWWludTBOa2lo
-NjFyS0c0SVJuOTVONmJXbjFKOFRSQWk2R0hvS3VqZgoKLS0tIFNtNWdBcll6Tm1q
+WnFwVFlzTTczMDd6QTV3bjh4WXFGczdFa2VPREVQYk5Id3gwQy9TODVVCjcvbwot
-RVVTYjJaV1FHU3hoREZhaC81ZDdQRGh1SlhVN2VjYkUKApmda8t2YPLP9ZxCqGAa
+LS0gckpMRnk1ZzNqK0dwTUpTM08rNzJXTy9pYSt4Yms4bDJKRTJNdEZiempaOAqM
-6436a4Wbe9b63Vq/h1Lz09/Xfbrstt3TGYu5gzCLQ0B8ZxTm4CLjq21yozlCP5i4
+fEEZwzb9VpBOCyxctqnyXmhVnOKB38DoE0yvUup9nVgu2ncwXVrPh3tMmbCq7GpX
-DKNvaT8aZUr3JB2xuugBLCnJAs7xXLIQqAlxCiRmIncH1gTn+PISeC9Lz0iKWl00
+MqpicRitNIlGhP02YyXpb/LMUU1nV4V7kN5dCIzM3mve03Y0SZG1zw+eAkDDgs75
-RQDS++0BNw==
+Lr7rI/blUgbbo19v1swXKZzxykIQ
 -----END AGE ENCRYPTED FILE-----

secrets/middleman/mailcow-ssh.key.age

@@ -1,65 +1,64 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBwb25N
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBzeE55
-TkJQZjBFZjdIK2J6SG5DWmk2YjhuK2FEYjlQOVFIcDN5NmZaMm5zCjR5R1Y4dlJ1
+R05zRTBpMFIvRlpseVdjMjI0UVJ2WDBxRmlJdUlVejdXdU4xQVMwCkR2d0RsYk5D
-SUpCWVZKeVI1bkVhTCs0YU43UXRQVHp3THRGTUg1eW5LR2MKLT4gWDI1NTE5IERD
+cStTUVN0K3IzY1RYZE43S2d0WktZV0JCNFR2ZWVydUpMZm8KLT4gWDI1NTE5IGpy
-WTFkNTRGTVE4MDcya1V2VDlOTTA3Qnl3RksyNlhBVGhVOWZWRG81MFUKcUJSOUYv
+U2c2T1lFbC9iRnlEdXhidVgrVmZzcmxpRmdkTTNScmY5eDZMZE1LV28KZE5WQVNX
-eGR2aWw5Ynd1Y0U1ZW5kZnI1dkRjTWJvK0IzckRMcVVWcEFRUQotPiBnbm0rOE1Q
+d01pYlNsc01Ja0wyY1VNeTBDZWREN0FQb21kd3VTT1Rjc1NtOAotPiByPTQmJi1n
-LWdyZWFzZQoyOFBmcnNnQ2F2R1l4dG5OWXIwTXpid0U1ZFlOOXZHZGowMzUxbkFm
+cmVhc2UKSWxoSHUzT09uWXRqNG9BdwotLS0gTTJ2NVFjQ0Q1NkZmb0dTZE1Xc1F3
-VFY2ODNwMjUrcjNvNFVjZUwvcndxZXcrCjUycwotLS0gSkR2Rk5ZeW1qVXFVMzlj
+K1o4SWMwaVB1WDFkZTBMWUNxQnBPNArt2aY0Lb0ey64r80mWia4oYkczRtqs6XJy
-QnZFSllQcnJsNW9zbFlaS29PdXNnL0l4RzRDZwrOdAucNSKhStcH7Xl7oGEb3V6a
+34qL66Fx5OCxbq0q5klZz3S3CPMV4cqglODpsAOf4vq/3uZIbbVXOe1T4jwZ4TAN
-WUBAPBGKyf3U90UC0BcaWZYBcwbKIYBmEuiX/PgtRpZMISdobcb/Pk2ZOKf77Ka/
+9Wx8nA6LOGNO+NB7RakJUDDjZ0u+PsVH1ohEUGrpu26+oHFRRigyB4r7Cr4LZ/Pb
-Y/9c84cj0bhZHL1pVrgTjVjqgA8v5D5TkTv3XjuTnphVi04npIXImI4qju9tOAg1
+6T8S4vDCCl8gMgxKkapCC74eghSyulx9d1uEFmlbdureAuig0iUUFCktSECtPOT3
-xdC1NFh6GmWVhbfhY8fF9q0z/2fx9uDhCnu+JvJQR1YEGq8z2wJhX6HEcrdmXPOC
+7bw/dHi2KiSVoT1ujWW0cJUThqyuS2ugrbXqU2Op9FjM0mkoccRkwbjbMMZz2DVY
-cChaJKQ1ceOJPeT2OfgHeNsmqlaTHlynVXmcsmEanLznY8fI/i4NWalArqqaE5V3
+i9KYOIFW3MC6kARgNfIjiggkJlZT15JorbGB88ScPpePrybRv4AX4hLlygK5mHEv
-unIaeRH78siQcG2ddi5fMyq6R1QO7qE32Y0zLs/k+i0+oxRdpXF8y8BLxT6LDcxK
+9VlnSqW0XARkS/JUdcnxfJUSIgh4xN6papiO9ArKRvqTcUkcRagQfWwDkwWR2lBi
-qmLwqEYt083TIJic/tcyR2pXpkwCXEds2rysrtNuf4v/alCYDA4uclU3TGSJIxhr
+7oAfPNkB0UjczlZqWPbnDhLNzh6xDHjVBYg2ZBwaqpyFRSjzn9Yaj2S18EzvuWU6
-DH9mshxn+np6+VSYX87ZJNJW6m+i40UHIwqGdTWZny6sqnEB4W+HxgPGqV+lvq2f
+RqjLrLZQv13UPG1dyBvKSWf+wSnVJ5dLsjVl7H1SFYhOU0hrdELORPq/Kw05jpTw
-iu9tkMGpcoz9ANGvOddX9LvEy5/IjE/Cxc66LYMj9BWTTco7kDwJ51rVbPb1xjS4
+EKOB+rC4wyKUGJo3MYlKiUFhTUSMlyhY6RX4hfivLYeU7NCV50UDy/JAQHssQcfX
-mNhXKfQLpTN3r2Rx+mnumhWldpV/9S3KcoV9JaWlbB/9Mw4zebYj/EdwoaOANrYN
+LLAAg7bYbYCmRay0gGD19lO6OpWXWCI9JvdkFw6UU0btc+aaT4l24+pb3uHLun2a
-ycFEP6/2g+6cIf7+9fR2yeVtJ43j1c5BgS5ioRoZKacjKRd5lhlMcooXjX+NkfH/
+V+O3RFLgKmhdtCx3e2dV5x8XjzIqKHWw0mio4dFOyEhgeUXxsoulOivOFXDEBfkq
-qTi2J8mde9Gwn2MeefyfYWyAKHFFnYPIeuPPTAIwXDWu7ezJqgLRmeQpbMtkpAse
+Ds/kBl7B7mDvtKUmaVgmi3XGhT1TMucXii7JL8w9MBWgdrBbl0rewpvafp34W0n3
-o83qXe5JRCM4QQkYg/honKMp601cy8lGpFSASw5qA9S/KpAY5bLBkXgVC61XI4I2
+wQh+oqUqf/0E+5LGAuQQ623MeCaXmYEyypJSctZbmf0zCKFFzTU1/HVjZgYbP4AM
-IP2+d7bLTipIFkD2jV4I91oIy2+BL231qh7lQ/NF3YUCb5OvRJTskk9MZEJh74Wm
+pI9H0mqxHyk/V6BxmvvZXw48kVoV8fOMseE+Q8TNp/NnM/TOgBGQQBEwGeiKDZnr
-HdScKjDbVXy1NJKrpa/UQsZdjnt30+iV1WgZ6f2x6GuigT0oPu51xybovxJFLzas
+Wk/GJBYNeGYMOJMYYkRToBeQowqBQ+NtNpersUda1RoJhH7EdxYzLBK0jN51kYBS
-eFKT8bjSElLhEwQkzsQsp0dqdxdR5SK8xxKxZ93Hetj5Dz1Kk0u42zjrfo4jViU8
+7pHU5M1ZCnmF59RtEezq6TNRwQAO3tnp3+qbUxim6U3V8MTOpumL4sapuqv4fR/S
-73Etdhqax+hcdyirtdICuBPv7U5H8SX38xgvsLocX/zqLcP07JiZcmBFax/C0GaR
+UoTgcnJIyKBif9e7XR82da75YXeBYWq8tj8d17+FPolJivdwiyB6ZTvkzfXo6Y6S
-Xfny27PcD8Vae1rNDlwry7oQtIynahlOb/YXUPvkZZBV5XkIYawNYqV33KCDCtzU
+veNv7F6bRf1hukTviMUQnsc8XC3oDYyqKrwMXRzgq7oaim45zx+8MHVPqw9t4NSE
-sfcqRFrON2x16FhBXwr/+HRggUce3BtF5kHpCP4X6/6/bwvtdwdyOjC6XZIQi4Os
+0FA5VqEqRRdQWL59zuey88Uh3GtW9W4z32NYWYlC67fLZUqBqckbYmqqwqcS7XkS
-DaWtsA65yZoIIwg4KfkaIRbLHqBiSMC8SpVuaqEDuULGMAx1S6cV7LfG01qezqI9
+Egswa1KHHW9bGAkJvLdxryT65EKnZWlVj/oTild/JmAeMLi4lR4d9DQ3N+ko6Zcc
-MmqSFQjELlS4qduf8rYstQzS+Og4woglVminF7T2YU4rJWkoNe00AYZzChVF0WRF
+DFQD+00pncDCFNtk5BeAG8j1Vp+qpZ/5PvqNAWsnoy/yR7UZ9i/AUsW5ZtQHJTnV
-i6XIW0Y61NGDosmMJar0Oq3jajR4WHB96U0DFCsyQJZRvnuLR2/55HjCvlM2fiQQ
+tuQYvYQilnKr+yNjHX+mvnee3ZmlParbWh1FqcVPEZ8dM7F0x5zGUPAPdScyzYtC
-Y8vpStjv7VJB46dGAwsOZ2DDJv9BPOtV+tKFIRmMtRKJOOTkXOQKM8Q5D2i7whxH
+P46vhCRLKjzXXBxFK/qLtzqLmGiCumk5FFEelyhoJmZO1OoVZOrdUOi891OCUyKy
-KDA5e9pQJ/G3Q1wMMiNvCgD2li/SXSS4RXXSMFSwYKbB6zHBpdKULysf1X3S+DEs
+m3zsh4IJ//QqGg5+sza4Q+z4bjwg2wIAH6vy4ULtdIF+vij+j8dCH4FR1TbQ2Q1V
-ymo2gyf5g0nULLBySVGERu+ZoJMnksCCNEqgy4fgqWbHuZ7vP+yz7Grk4MtnHN0J
+/urgMGj6N2sjxjBmAwxtcGgwc5HI23SxtBQh1msSbJQKChSvbI6CvkFdwfzGuWZy
-haY3HvAheheGo2bUKXnVJaYXIuNPr+Lpcv6GGMEIa8vemdAnWdhlRz2Jg08PcMEQ
+c8jWNbrv6Xf6HW2pUrnvtdUdH7+Jfx3O6N8t+yNKbxCC53GwHnqclkrhvXcwQCH8
-nKe+SxekvtB3xiNCEW4Kr8XfXJtjEfEEq1eOeQf9cKImYsu+MLowZqQnk8N4pVn6
+sMq7GFzS7xZ8n8qMVhITh9CrKuFYmrh5gOrFwLlQArwuKo3fK2/CSOgGzqVgg08r
-ikbEAgSWCb2gNo/958SOzcOGJH/AeXfI4z+wstrChwPbx+1VEBOrKIvXfWt0UNPX
+ddyeFzvDlWXg62uinUQhni1w9Ou6Psy5Azw/yBRG4wnBw/n7WgRZ7ncVCD7ws/c5
-g2veeHjommRx4Y+M0p1s3AHuxrvOQcQxSpeRmG8eoYi1umForPMQDDu0irnVO5hZ
+FHAvkKdd95F6EwSfK2gNGmPO09D+srmbdHUJbGN4VgN7qQ2ZyfA/rceLDOrPyt9r
-nlXJq0KKUURmCn2/CHBvaukV0HPJCyivnVv1QlIDQH3Y/gjRaSfiouhXPE+NsNSM
+ipkhhcgg50eMWEZr72JT9feKDwAzQ4drx5+9VFH0T7vWCyCBEMrATctnE2gRzS6a
-1LlIWuXlrftku/oSQvvwChN2aiMVCn/EX9KAczurRPn2/zPruGOYNX1+ZX0+SofW
+JQD/cn5FHbrXXs68gAhyL10bktnkcCp1I3TTYgy/guC1NFhK7/Ja4VmP0JEyuSv+
-36mn4kHIqDe8BcYXKrBJSlgtzotBGO61rVx9pwnAvdTfJzp+W4dhtpJemGQVF4a+
+ZNzXtjx7T+/HDxXo8pXC1hm5Q1GHmkwfpzPpd4nRZZEgtcfdat1VxBii67XaB6VD
-/moa1eQJDfSrsyuAXrMPENpdKcGrKNYixCb6sPJK+qfGPVEalI6QY35lsLXtNuwG
++oWZgd3WocxWtTQHFKMStKeM835RnA220jmyXKQM6q7NF06dqx+grtFkoK54uqbd
-ZYbDf1yt3FWyYrO+Myez7lV+r8qcEVxraJwkLnnmwkN5yZr6IulaP77hpnikkh4y
+7PPnn6M1WvzC0xadBmO58Z8uNzo0cOipaxLACcyC/GYb7M1wGWbC3iKcNbw0asxU
-ZkJkRGCXZevBNFKhYqtGOR6ptsEr7ZB65U5X6LWC/GsELV0Cmp8enPLTkI+ulF5+
+ybslcEc2M8002nFU47CzqAppN2KfcGJLj5cjLcHHNrwsVf/Z7QdS/vXaGbuV6rtl
-eFedObGvcTKYMbI5kit6N5BUkQyUxhv0CAl7mXhj6QJvDqo/WlVAytEIKArnw0Z4
+xo+euN25R9uLsEzAtRl3JeofcZRNtA2itROxxxS4MCivqz2rexTg94xyipFNqFzd
-HrzSxGdrI3d9gBqmT2prqiAtcRJe198s3UFevFWBAPYC8Jkb7sAHOC97xLISMZXB
+63bA3nRIBbrUWgekjgqcRPlQ6m5cOq7zOd5aelhUZu0xiQJaUtj9A92iJ/9EkUVT
-K1HxmXmXrhbW2QvdHzWvdKk6R+dwNoJaFNlSCEg4q6rkTL1f1TcBKSxPq5nO8cag
+ZpF6PliFg9Tx1EOGMIHwHyiCfwn8fR7QkvKihId5gpKT59kr9JDLw94r9iGdpXN0
-oqj7k3CVz3i7Oi1xwe5S+LWSttkvzGPep0YkuyeO9sb4+3qCR5m6AwCA140YcuVB
+r2ozitfGWiNX9g2FvskG8bs4mqxv5lgyw1JexJf9+SiuDQgsRc1qYIpM71phLtI6
-wrCXajJfneubgMR0bNtrJEXEC+fek6wShniegMaA9Byp3yShRTAepsP7vmppMjzG
+eF3t8xI9E5ALFk5lTh4TFuv1vs97fmXnZ1TUO7DDA7C7xMhF/9SgBjS8bs/anZgt
-ENXrnaz3S8gf4FKUu/hgncE+uNVcze1vfES1jpMUVyzM4N2Yess8I40tSocvO04h
+BBfCQCPezIXxtE+oVELHGAyoK5q3kQRJrlxqMnK13/Ugzn/3DsHXimAneqCZR+B3
-qFrbos3Qj9RD2G3TIkkp2SDKv9YlS+NaDHEofIfbI9pAscw85664PQxLnD9HH7cj
+T9NYtNgxWHubF+XW4sBa9cBXPQyjY5BWUQYiBk51zdxVkPcqt4ezeSPn7EHQKGDO
-uOfR2bqJs/oGnr09eTcAJDaY+2/PSo7fAd4sIPPQwLn310Prge/5pQKOlM67WIXX
+6Cpc3E4T6C65TsXuUgFROXIRjft9Hwt59UwcXHGUqb6eeX9I5uSMuhfPZe1Iv7mM
-qFXw/0fzgDeIA959BLirWvqUHk9af+UB8GMhxbQeISdu267bF4g951ibo7HFqXBl
+ZvYPan0zY5kZ1PMHrApgx+10pmonxIoqj063WP1jT/4JC2TJxGncl38mDCZ9cynl
-0O88WppNUoyGAjBnviV9KLBsxVlTtgG0lugRLeDUgULPeodeOrSf2wgdxF+j92Gb
+FA8ShMdZcdSgYDZZ3BrF3MFJFTUKL81N63ER+n00xPf9+ZqTTqIZgLInO2B9kVo6
-GGbGreRNWOJacq6Y9hg6ASZeehvlTULsxUacFi0MhMcciDaVUW8BlI+enclWdZo6
+pAp3Azh5d3yfSoh8i0r2VCKIZXpreQvts4/mdrJXEZLmRcGZKmeg3wCxQ7mTq3gm
-ueDjCMY4GHNs1C8z3FCaeJCWJjJrsEDrUNnF6VKYmmkgNMWS+vKYlXW4VWGfMpHh
+m7zdvsDxh0AK/HEd+fd4wCkFqtHOGb0mzuTLoDZ53cmf72uhT+npw/K83kIr9wQZ
-tBDvvcYcj6kCYwb0MdnMG0XUs6JLW8wnj1wwbK/ZG68p1ioUVh9PJWiF8Fpp97L7
+h87QRVEefXbEMzbxu95nLZBpgf/xS4VaUOdzBbHfV2LE92309VEO/GOWANz+kTew
-Axnjp0UNcpoT5i638nVHOQmOeEjH2bgvxmJXycWW2r/+o/jawrdt+kUDBqt4+HVJ
+G7lRhTP17nzmuLVn5VZNGulSqvfxZghl9CUHYlH8aqEju8Yhod6IGl/86feHs99I
-V5PtWZeY0yINhepGGNMSvM1l4DJB9abNGIwKlsIMfcKn/AHaKrs0vwqPxLASeMiV
+MRpWs8qgIFtiVTxbCSma/pa0nC8z0p8YeFVCdzBHXipdszXNV2iAc7UIxVjwejMV
-eHq55MObBGjYUfUG867O4flwyIy+VVS7scjXuOZ3dUSnxa8igf0srVOO3bgHIqLQ
+typEIZM4JFjqpuSrN9s8hRzd/mwxPcOlboje0BrndbZiRQ9+itefGIX92jLqpNM1
-yWUk1/xMpRldGFqPVtzfVQ7Y960bBBuq9gLDg7X6nhHMQ+T7pCC0cMeigUhxLjIN
+avEHk+R9yxxcvoP724ZPzaRg6K8ZNjPOavJ7afh6ewnO9/j+SdJVozYGpupsBy9i
-RteKOU6p1poUMaUosDjKX1V484jB0Sq7vWqIznRz1Y6T+VJGtqxHkjr5ADKS53cc
+3OaJYY1+/DsTodCYF/mu6+P3S20k2SwesutT+5KPrKhQ3fASfmDwslHnUS8/zuhU
-m8cbktsEDHDR8pNz3CLK9Yviz4P69eDgUVd8QLEk4VUZEmkIQtyu0AqBEHE48ADK
+OPDzGySCQsPzVOW76k7BsaE5zGgNToq8lnhYlE017yg1BVyDlTdBPWn8IILz/ZEc
-t5Nh6FxMpl3w7aUUNiugzxHB4cU69RfHYQVR+ZRaSBGJGsBeqgx8s2kQazx5BRlj
+L2QMeVI=
-Vg330npzjNUm8LU=
 -----END AGE ENCRYPTED FILE-----

secrets/middleman/nginx-sso.yaml.age

@@ -1,21 +1,22 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyAyci9o
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyB0Zk5z
-b1BJWlZXeXZNQ2k4NU42dWk2V21uajE3VlRBL1JQbDZDcllvbUVnCkMxTVJKc1Qy
+dzVqSGJxNlVnTi9KN3dvelh0cFpTdXR1UldsQWkrTmVrOW9SaERJClI2djdMQTQr
-cUkvTTRVVURHYUQ2UnhCcWF0dVNEZXB3d0R1R005VWxiSkkKLT4gWDI1NTE5IE9E
+U2hMeGxZOWpWVG5SWUtnVXNZazlXK0F4bUtkRW5hZVk2bncKLT4gWDI1NTE5IG10
-b3FITmZkOGRCZkg4S055cFYxSlQ4ekN5NDFVNnhlVHcwbjNWVkNvQWcKaHBURUNq
+aWhlaXNFMy9ONllrYVRwazF5MmFNOGJJOWVxRnNqQnNocmVTTExKVlEKWW44d1BU
-UmxLSDN1SzJwbTd5T0MyMHY1WXFRNkZJZ3AxK2ZjQ2x0UGlCcwotPiB8LWdyZWFz
+ZHJXTkJJTEdSdFU4dzlJc3NaNlI4WlVEVVhFUWV4UWI3Rzd1bwotPiA4SS0jZi1n
-ZSBrXyBZfmlyZ3ZLIEdFZmtsSUQgVmtye0NyCld6Z1pSZFBRWWdKU25xb3JBSnM2
+cmVhc2UgVD0gRXIleGAqUXogYgpTbVdueWxHN0NNQ3Jqa2hsSWUwYXpTVmRwQVFW
-VW9NUUlpRWNtdmtja2hzRms1RHYrbDUwVnBjTThhVHFkY0hzRGpJSWNBCi0tLSBi
+UTgwd3Q3eWY1ZFZDRWxjditRdEdUNFVZV2UwTGpQZUZFYjhNCkZuZnA4WUNVeWht
-UVhHS204ZDh3M2dZV1ErNTBjKzdPNHl5MVhVU1BHR0MyU2ZEUmFTM2xNChwz80ur
+SWtHam00NWNjSHhBM3RTTmdjaFRTKytzRFpJTm02TXF5Q1BGdWkxN3lMRmk4Ylk3
-ivjziyT73h59/jwY6WqLwtG7borfTKjpcQ0IA/kKuNOORJl1vooRNCI2dMC07mTZ
+ci9BCi0tLSAvcVExWEh5Tkx6TDNJRkJuZUVmS1UrK1ZtQ3hSVnV5OGtmRVp2WU8v
-MowSMLhB3sH2AUE3v0BQoXx0TA3T+GCmuMkXSOlKRR7TMioF7bHuWyPN4MhVqJts
+NkY4CpSGlODuKDBde83bkqU20xgamzp5o1px5VcyDFhm/q6/QkGTrqPZFqp4Ho96
-qbgw3TTr/yxf2BX2anG8SYFKeYdHBCsMvDCW08UxjUQVgeCvHSD6a3s0vWLkaP0x
+Om8Jk3RkOBTSbdYlRXlNOjq7SB9t83bf4nwKU/RH9bKBOXlOtuU6vgDdtZnct+L4
-BEf3pENVKDmovu6YZ+odp6zcoAXVTKsp6k/rZfhjdAPZdHQJvffpBIuj0+jnW/1D
+S6P93brPGYhV41IkjNxg+HemIToZxZwO4lUqlICmkJDQhuk6F9SWYfiNQd8l+lXa
-TA9YQjTI7HSaflb0wbrb1bUt5oiBV9N9+zXNkynMNw8/7f1tPeOst+R92BQa0JYc
+e4WbldWMpwlOtJVplen2F8itZWAIGPNRq5UTmzKA40Zk6eW+YWqB2mhvbZ7b4Nto
-7QXctLXA7hmd2AbKc19AJkyP1fg0RCW7Y+BESeFJhimX/Qt2MTZjk+3iN19rVQV7
+gruh/4URaWqjOGLGjCfw8zJIU3qf5wWntd5BnLkFYjFZMYLWQHnF/SCKxxLVlzsE
-qTG/52wh1/SyhJ1NPo11Gqp80o53Rb0rV5kXcj9MFZYi/yjozN8yJEHO+FSBzRlc
+9t4vu2lCwjGKj7uEoPUcF9bTSNZjynNFLZsshGjwi5L3dvnUJzUc+JXKxMqBaVYF
-qQ/IbT2gkxxeADPmGmUHcoPXOwl/4QZyRu/FQ5Z5r3H7VrB1INRWWxl92Z5XfpUe
+DrBDBtUnjae9jj+/YPLoO+6BnbezJLhvfIyT0Fw82CGa9Utlt/VltWp7gUep6YyK
-adgVd4gH9p8WFCAmOjDpUdKhm6pgW1Mki7HaII5JkD5KwZbIFPZ30NIVuHtmIKDp
+ArhZam2c45rzlwV1tnsxjZFK9EuRYJeN1VRYr+tR2wShUGKP1CEz1CFmkTa+r91V
-GpA1jBbbrhqKvC1nZcb+BOT3ahPCmWD9c9gXSVzbfexb2evahn4Cg3xbJ1F10ZPk
+/8eUvOAgEtP41y2vxmpFu4kjNQEAiRs9Chbg+Ap0zUSxDZqkaQXSXE4PWEgks6VL
-Lq9NJMoAn4aIkO7Z2u8VaJWruA==
+I8ss2HfQDtcnEoNOwuESawI+i2oDclvkmGD+UDYz/BmxkDrjWjL0CxKQHDv3GHgx
+URR5TtwKc/YoiSkJTYpBYB1VLhgHCnsQ175p3w==
 -----END AGE ENCRYPTED FILE-----

secrets/object/atticd.env.age

@@ -1,16 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBUZnpy
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBKM1VC
-YkJidlI5TzQ1aHNWRE83MFBzZVB5T1F6NkRmUE1oUzFkeEF5cGhVCmVpZDRsR1Zs
+TGJOMU4xVkVnMjlTRlpmY1BKT3h6WTJEcEJFWnZyYThqczZPUms4CitRUStIdlhY
-d1hocXN5N2NnQ3pMODMxL1hITmM1RHFjMmtVY1Rnb0ovVmcKLT4gWDI1NTE5IGVQ
+MHdEV0gwZ2hBbE9pM3VkSTVOL2ZBZFBKekFqMmErTzZ4VTQKLT4gWDI1NTE5IHBt
-Yyt1MjdCcHY4ZWVGL2Uyb1dwVm1MTnROQTE2Rm9kaWRIdUVrNEFVMFkKUGVBczZa
+czNzeldEVnh0L1RDa241U0dWcGs4emJ6ZjNyZzV0R29nQnpkdmhUMlUKa2RCUzlJ
-aUFoNlk0VUE4SGNiRTRlRnFGcXNKVEx3YTl1bENIemozZWFkawotPiBhKyc7e0ct
+VXNRZnEzV3BwQWFJc28vWk9obHMyem8yWmhDZzlvUmduSWJRdwotPiB1clEtZ3Jl
-Z3JlYXNlID8wZVhbVFpOIHAuIDxralkzTzsKUU1qdGV5b2pJS21yRS9kc3JWc3Fn
+YXNlICh8NkYgPC57OiAwdixSfDEjIEl0MWoKcnRQNWVKSTJqM1U0YytFYThuVm1B
-RjNVSEZsNmlBQVRPQmlpZ1N0TDlZMFliQVdidVVVdVl3Tk1vNXBCaDV2VwpqTXVD
+S01MOFQweG5zcmhBbkQ1elJOOFJ3SXdoNXNBaTB3VW1YUjJxdkxGZU5PMgoydwot
-TTZYZCtRCi0tLSB1NVd2UXRYRFQvS0lFYWlNaDhJMGdEV0NFL3d3WjBJbS9qNGhl
+LS0gMTFBNmtWUXRKWFVWNi9aaGZVZVkzUzVUeGg1ZkplUW13b0l5UE12c3VvUQpV
-SjUrT2dnCt2vCuYlbl0P6Aelg9ACKLcyjLAiyi39ikzZUKkW73GET8J5FE77ByAb
+KCGAO6MlgPP0wVcDfMnJWEMSpqIs3X9wkkIoo5yw6NAeUhlxe2emWwk663PPUkXt
-Gdl+SSsb3ByXG4dlLMD/DTJWpBx3wh2Jbo1w5XF84obsFybVKvvgXu7KFMSSGiV9
+NfiLA2jUTu8B7I2BNQKi8PMmnrydfjV5sGH8ACeP9QDWPHb6Hlri2R7IK8juEpl6
-NY0XCzAi9BmQFAidGhK/HpFGyRdfOTUYWEzpXQ307os8NqInZYRGxhQZ7PnEhT5q
+0sDrh5ktb2+vNqoz9lNm1hk0S1l+InjctP7HUM8hhNjXVASBUhUX37NJEtH1DQdB
-J7LRMpOgDpEbnwN2P9crJYb3rbRvr32hIn87QBWLaxkns8VgL67JG2DVQciNHJTo
+7AlebX6bd1VDGwsfCyEzdg4N2nd/73J4fcjvtqoEz7fdfkGisNjjJ42iFNitLNZw
-loPusXSC5iA7c8K11smrAmcy/IHs1Trek1JPYccnp3xnZVLVsSX2IqRxfxmzXfiL
+WnhcUByV7msJq9QuYI2dozDn8qJPFyva6sfmeuZTgqclBOMsDTsBzWlXgK11k1Pz
-MvCTRJHw7sczEBvNCBrFQ5zUYw==
+got2TcUCfPIVqWQ=
 -----END AGE ENCRYPTED FILE-----

secrets/object/hedgedoc.env.age

@@ -0,0 +1,14 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyA3MjM3
+dytZeGQ1VmFtdmtEdFlQWG9zMzZLY3psY1NBaVloeUh2VG4xbVVrCjdua1BHajdT
+WEpvdTRoTVdTUGpqTzhQWXpEMkxEVzBwQkwwZ21qNkdMVkEKLT4gWDI1NTE5IG9x
+d0ViazRzcG1qSDNFR29GcFJtMWxabWRqdnBjQUZBWklyNUZvdjBmMlkKcWhDUGxu
+YTZUbEhtMW5pajdpQXYrdEp4NllXRkQ0NWRhc2p5Y1Vub2VjTQotPiBMSTgtZ3Jl
+YXNlIHQ3Ngo3enhCRVhiV3N0TlkzdHNMMHJTZ3F5ckc0UUlUa3hCVEZQdTUxaW9p
+R2hJRmlxWTZPU2VVbEpvZDZpKzN2NXh0CndxRVM4ZkEKLS0tIHMyTEZJUVRGWlB0
+bS9hbjduWWJuVW5KVXpnYlRkMFdCK052RkUvSEdMV1kK4fjaE0yBZXu55Kn1j/yG
+PRwEhA9QyNbas21qCikGh8RxCUfoobhlKHpYxyvOMenhv0+8gb3ceXzSUR/3a98Y
+orARTVFlOvVZolCwoyC86kUExIBubJxO3EpH2UxrvQoCOrAf5XdD+qzt/G71wpYk
+jGUknUWUyPbj9HWoVo2aRmC//bCnena9DUVicAXbDwqr5/KCHHFlkT9UI5Vqvgfw
+rPpyZ+De
+-----END AGE ENCRYPTED FILE-----

secrets/object/minio-client-config.json.age

@@ -1,17 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyAzTFRk
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBjdm8z
-WEdTT1BXdjJmN1B5dWwxYVdIdlJQZFZzdHlpNUxIeFJUOFgxc1dFClpjdStsbzY2
+TzNmSFBzTEdVT2Y0cW81azFsM1MycWF4MlBCNWNEamNXeklVVEZvClAwbUd3dmVH
-VmtCTFN1d1NhK2duY1NwOVZFVGQ3dmNCamY3dzBlQlZibUEKLT4gWDI1NTE5IGth
+dWsxZWh3eG9ianA4M1JET1RDSkpHU2NLcGgwRlJ6eURsQm8KLT4gWDI1NTE5IEQr
-eHRBTEY0dERTbm1kVWlZaXdmMGlYekxZRk44MXNBalBnd1RMRUFIbkUKN2hNVzc5
+em40K0ZFejlrMW1yQ2p5UUcraWd4RmpseVZsbjFwTndRYmMyUzhyemMKZ3U4c3NH
-Sm1WUUxGUjZUQ3JvVEVKTEErRTFBOGdJSTdNQkxNQjNWMEc5bwotPiBEWCZ0Ly1n
+bk1CV2hZNjRNaXJHQy9PN25Fc2cxekpNNnlyTktOcHh4eFlFSQotPiBLeTdiXHct
-cmVhc2UgXDZOXCBZd0c2XwpiZG8zSWpZcFhkWG0yYS9pZTdYcG1Oai9McURrL0Nx
+Z3JlYXNlCmdRCi0tLSBraGk5eTQ0K2k0bTVBdFdsY3JqZW0vL1N5V2FFSjNsbmdE
-ZDFEU2svV1IwaHlEZU9vbVlYY2h4SG01dXpreE1NbEFNCjZqc2FIaTF5Ci0tLSA3
+Nmw1OGwrWW1JCvuxFmnBfZEpLHNyN3Uyygvf7MfsG8PJg7Rr2tA3a+SrBrRijJi9
-V0pIUzBmM0tNMWVuT1ZyVVFxcnYzeE9kZlhBMHF5eWRSWHVGNTl6NDI0CsImo1rh
+XVsDzB3HWYGHTRegf9pz8KruyedFNu0volXDSjT0uC7Mofj50nF30+d/2Z25Vem3
-D1qfyPjXv+F6aYYY8A/N735t1pteI2kzGByvwkQAUFb43ogW718/rm8Xb++u0O0y
+2KEpvrQ4o0C89il4L6ptRndmbn3uEe6+eFPBGLeDeuUaXUcuz811145ZNz7kalJL
-X/5OZwy5cUvo7iBSIotU6DuEQbx/pd2al/zXZNpYPmVl/xHAoALsLc2TiAE19J9U
+TJfeG2gOV53lu0NxK3wQ7bW+xtrwOHToIssGN0TlVVi8qapSXLYwxTkglYCD8jwE
-YrDu9zByntjCt9xeMQuinvSMr9eL3GXz1JdrwyCYJGr4jVzrr3CH5WnO3LmnfWrn
+6fVpGA81JQy6EcKtVZ13xfFwF5pzrqeZQWSrW9b8Mk5SkIKC3MxTTWdlI9Gobqx5
-zw8tZ5k4MyjAcYY18xlO5UItX/4bqKBt8T+6VpdLQFoyl//UF51NyX+HPWWvXrqX
+RsiphGvQ4ra+GraZNXDn80w5phXXv9jNX0VUGe7hi1/G+KYl1m1OOsdyD/QluG8P
-eE9IdPRbPedtmmXl9BvoLq5NgveI2siVy3tB6YDJKPDWG5qB0cl9YcyAKNFeiENd
+dqwfbXTo0F4zqWagP9dGhMkjA+lC0jmmFhZDQrS1RabVMCsK
-ctFsS4kZ23zGlcONBV/nk4uYeEIkzQAkOrAg/9YoMuVmUemn+ZntDAsaUOrFoeD7
-kBdbvn2s+RxoaurOsyGFxrTe8E9N
 -----END AGE ENCRYPTED FILE-----

secrets/object/minio.env.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyArVWtB
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBrU1FR
-WmwvODlDakFVbGJSb3IzRllkUkkyZnRDd3Q2am1KZ3ROaUdIV1g4CjQwQmlJc2xr
+VUZoVjNFUmxNSFZIYzY3TDRpZ2drbklvemZBKzQveFRGUnJDUmlJCkFpZ3F5VkVB
-NFF5MTlueHo5Z2dDejFwWTdHSi9WN1VIRzNrdEZtTVRJc1EKLT4gWDI1NTE5IDJR
+ZWhKTDB5UGJkTVZrNHp3YnBxYzdwa3NDN3dTSXg3YVl1dGcKLT4gWDI1NTE5IEwv
-Rit2WWRjNTZyNXd2TDcyL2lUaU5ILzlwbitIMjVWVHg2Nnd3R1BpR1kKYS9tWlZC
+KzhUWXh2ZFE1YTZUMzdKRnZKMU5tVEppV0tvem1lQkFxb25TZExYbEEKWWVsdHFD
-NHl1TXQ0dGd3dFNwTW9VVEN0UXJYbzl0NTNzU1FPQkVwZGsrUQotPiAkLWdyZWFz
+dXFSRWNIa0UwdzZlc1lzejRSdmp2N2lHSitDSWhCeVpwWFdncwotPiAiSzhzZi1n
-ZSAwJ15+djQgd0oyO0wvCjZXZ2syWE9zbGVSdVhwTU8xVjh2QVNqT0FnCi0tLSBY
+cmVhc2UgQi5TMyg1aSBUdCApZXYoclcyZCAnW14KLzNjbXJNOHdOcEJMZE8ydW41
-dGhaWWdtelB4UEtMUWNVZCtDK1NzdUtxRWtEY01CcjNibU1weUVGMGFJCmfsYbyf
+ZDdpWmRSCi0tLSB3b25sbnhBMDZrZXduNCtqd0RoOWZSdXF6L1pSbEF1K0ZVZ2tB
-n8w8qB5AtsZolcI/8gnmnP2beokW+IayFHBOGHyU/4S4ekjvKtM/ybEJvb25g08n
+TE15WFUwClKgHieoFUU9aDCR5P3RtjWMYDHqJ3BGHawqgJFySxUw6ZaiBKe5eFjD
-H3FzaxQbAtb9Lk0Q4ZBPuUoG1fXKd2iKU6FAkizSjAb6MtiIc2Vz4A==
+4/gtY9hIVVYvGgaULCLaM6pSE1wm85EsvqMXMU9S7TbxL7gplOugbtnYSggCF9Qz
+pl2FTQ==
 -----END AGE ENCRYPTED FILE-----

secrets/object/sharry.conf.age

@@ -1,19 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBPdUNr
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBQcmhx
-eFpiNlloZFpQTnNwS0swQnZHZ2ZoNk9sSG92Tjkxa1BGSllIaHpVClloS0N1ME55
+UW5zUXljNzdPTHNLZmZrbnNEQlZqY2pWODJsSDlROStwamRLeFQwClM5UVdmVFpa
-SVBOWEN1T1k3eExuUnpvRWdMUGVUdUZJU1padXZiL0hrbm8KLT4gWDI1NTE5IE9y
+dGd6WkwyNkJicVplUFRHbGtVaE81clFRV0tQSzMyUlFvQjgKLT4gWDI1NTE5IEVE
-dU13dGFMM2ZvRE42enQ2UlBKdW5FUUViamdHWmFKTTJ4Z1dMVnE1QzgKN1RXVWU0
+eTJDNFpnMTJJc2pXZUU4UXp5SXhaYm9SV0Fuc1BFR0lVYStGeTFORUUKR2x5SkJR
-VzZMT1hsZVZqM1gxMG1uVGowM1Z1anVPeEZXc3RnOWZSd0hycwotPiBFLWdyZWFz
+VUxSVTA5VGliTlhseHhjcTEzVVp0aDMvRmIrVitTSFdaYWpEMAotPiBRTmgieS1n
-ZQovRVhWMlhOUzZucGFRa0VlcmdxTm0xc2RRTWdzNmhQLzFld3dCZzdBY2MwVVk2
+cmVhc2UgKFFzbEo1SSBiLmt9Zm8KWDd4MkV1M1pKaG0rdzFMTDU0NDJ1cWVMOHdu
-UTFkNWQvdkN0Q1ZmTlJYRjlVCjlrSnpMaEdtL01Yb1doSVBMbTRrU0VZT1RyRXdL
+NkhwMkNwaG8zZkJ2R283bk02b3ZsSTd4N2FGdTJabHFYMjFRYgp4S2lOU0l0L0Nn
-VENZSVZGVU9VbnkxMThRb1h4cHQzZ2lIaHJDWjI2R2xrdDUKTm5zCi0tLSBZbXhl
+bklhSHFEdkRxcTdDTUlrcGJxSGVZCi0tLSBFaTJNTCtCUTYyTEtUdWJkamVBZXRL
-Q0RHc0d4SWxIekVwOVloSytrK0NwZ2tCejR6WlYxV3pxVlZpMGZJCg1hkc3nxW1C
+Z1ZyRk5TemJPNThkeStBRDd4SDMwCqHkFPwwIwQyNRKz+qiaTlEg+wae9/zBVEso
-MgGgfEm7OMkoU9oyKI5yPoCPGpO2HJSYFcKoCqi4Xz7xJj1cas+0LIHgxitWDbqm
+lvsNmDQmShacPxNMX8gRJdDeZwPgVVj6vbzuvsZsaeqS0tz8Mky1t0lGtMlVWkBn
-8cfF3IM6bcmjwxOroH6VSZGm4xj2SScyKE3viZk4NXJomvoE18Y1Jt+m3kfuDc1x
+bKzlrpMMmc4myREz3a8GgSK7Q3fEM9iy0lnKXsOrjXmO2J6Ebc+Uzp85Mn8cWT5q
-hNJdWj2S7GD3TCTCOZ3uimIst+wYMrLOV4dpx2D4t7mxSDqmJpw4fnGA8V15AXhB
+BHN18Vt4BjJXs+0XUwPxVEy6vnw7yXVeKEpFLtzjRXRVKpp3VwimDvgfE6XewR3y
-cBqg8Dydqaxxfw5dDofYcVQiPyw5sOzkPudZDZmftfoTpNk7KBpDXYnFpdqc3Jgx
+qv7B36u7xU4iTZam1N0ZwbdunVKWeqRfMv0auWpkGgU/gLjM0E+5qFZ6ENEBN9iP
-w/3cv8/PELuRGyRIS0jFNhOs9QEnYGPS7qPwLEcSX/1BndgxMBZOq6OqCuWTqa4+
+8wHddrpap1fYNYgrMGM37x96+J4NYomcUlcZ4M79vLUJHyXLWrhRhIfh6HZPjYra
-4yMqCdCIberAiSiwFxeEHqQqOH/I0lT8MNahyAxJ3pV+eYQU0YXo9bsi2SI/O3U9
+i5q8jB8oSE6UpAxkCkbcdmdmaRgMm3aNMZTfLcRCqOt33ScintJWeMZaybUGWzzg
-CUohVCU+54Q0WXqOSuucqAplnFqIbof0MtNqbBOph1f5sObTpe1Oetgr6R8VGyBB
+gnVSbp5C3On33EKOqPgR677CkB+TW4ME2/myGGW5/1w=
-1SE=
 -----END AGE ENCRYPTED FILE-----

secrets/pdns-file-records.key.age

@@ -1,20 +1,20 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBpeGU0
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBEZXdm
-ZU1kY1lEMS9NQkFoNmtScUpMdFVLajVwMHN3TVpzY25ZbFRJVFhJCjNrQ2p5emZD
+NEtBZ0x5OEFURXBhMlZtck1qYUc1bEd4dHpsQzdKdzBpejh3dFJVClIxdWtwbnhp
-NkxvNVM1bG1UTWU2QkNwK0x0T1JYMURWbW93Wnp5aWRDdTQKLT4gWDI1NTE5IDdT
+Mk5hT1lhdEtuTjd6b2p0dlU4SmhIK283L21YZWJEVHNjdnMKLT4gWDI1NTE5IEk5
-eVFkSDJqNUVaTzNpNTFjWTR2dG56bDBCemdObmtwVVFsTDZoY0tpeEUKaDRSM09m
+MGZuelB4SUhpMU5DTStNN293STQzeHhMdys2N1FNS1dnREMxenBkUnMKalpPQWVr
-RERSZXJndVZvVE9VeG5VVWg4Q2VOYkFlN1pKbWhqVFhOWE8yQQotPiBSey1ncmVh
+NHRDcnQydVk4ZHNXQTZpaENmTHVMWEZ1Um9DakJoUUx1TGRSUQotPiBjcS1ncmVh
-c2UKVGNYelNDRmx2WVhhYjBqeDFSUzIySllZZmc2dWlmVGhEM0c3UC9EQ2pKL2pk
+c2UgckEgdyZSbzkrXiBjOUtnfiB8UVUiCml0K3hnMlcxS1B5dFpRYjczVzE1ZWtz
-U3ZSakNIY2JuTjJVaEtaLy9mZgpVSHM2ekVlWGtMZVJhNjNwM3ArTkdLSXFGb1kr
+NkUrYUVTcFJiekZ0aEFodWk4NXFNUnZJRjEzRFd4djhUZXFPUitwWTYKV1RMbHFn
-STk1MDJvei9jTTJKaWs3OWdzRXE4b2dtcGMzVkdpawotLS0gUVUzZVk4YXFFTjds
+Ci0tLSBlUzUvSTYvK2V5TFVnYjZGNWtmenFXOFNVNE9MOHBZcGZyamdIUmxtWFZr
-bS9rclVydm9vMXduYXRyTnB4ZmhjeTNacDlZN1NxRQrP9p0+XVTUDwR0jdcqlDWt
+CmswM8RLtrvvhmuy/efwx+ARv9Fmam6XTe0khQ2NoPa5K2EGI/ZJVoQr0h9p48u8
-+DFB3jNLCzk2MpLu0k3SwwyApe0ikGxa83xSRFqUqira6QfTEvkt1fHgQx7KfY2M
+Qsi/1tALMjYh52SGaQd8m6pj2q0M+bnpld2xtrP3vPA20lrJbH1K1LadbZEt9Urj
-f8TWroYrFSmcrQILBjvjGxtemfUNOFkTndbAkIgxpvxr9urp57VO02x7HtR44oIM
+oX8oP486qBkRk9mxNv/+ngwFT2hcbeobQUUu70+iwTChPpFtfP4THPRFQA1Nth7p
-yrqnoV0R2nZ85+vwEpoIPk8m8jGwWI3kApy4FuzpejbWjMZcjp1a3XKiwBuTj+xI
+A+HWsLlWyWk8QaW2QIa80Gq1BBstDMNjiIvgTMTWZeEO0GEAlE+07sXOwz/fnpTd
-AhCfoAociwZ6GGF1cewoGc3A/wKbgcnUSZRkpjH0MOAFhiWzhivLoGDSqMQwwS+p
+7llNvmaZACQXP74aNA5xZXzirq65e1alFCC25tPedggMuCFKWoTwlAla8UvThqlD
-8EI8LLJ91VrSGmC5LUWYtzONbDWnEoNVnkrvpRk2uKyuP9zOxVrEbDmogK5yxzAl
+VI60ARkRJ2GfKJ2RVblS380RotNiWTG1GiOdzJ3OngYceAvdEcCcYdfjoCTJoQTj
-CxPgUCShB3p1V73cGBnfjsTZV5+VNkGYsC+Ae3TKv87iKqj8byLV3eO6TPmwmr31
+IXW6NLI6GR2n/daInVrh9cwEAd0kNsOvjpZTkEgEeZzmLvZi1Z1H2a8ZyJq6A4L7
-qA7xRPlpov+CePfK4Xh4rsx/7IgS6O6v7vptjADzxe+t+HtsASn6Yh6cn9wK6nbA
+jxqynZa3TKzcS3bhQG3iLJHEnQhhxUyf+S2d+3EZi03uWEvwGWX4aOKEpCEIUCVY
-qHpdCn/HMztEH8fsQ4k/VZomn24DubuK6EQ/8OT/L8RjR2AQ1E3MHbBJsPF0rsEI
+mj0o3p5JPDaNIQPf3Bz0ByHYOu4LpRcCkYqphHVutG5K0P7Lw/Vs29oE7pSgm9uZ
-G3iDk3M8JBPBmyv3JBJSdCI9IKLfFeXspQRpq30pvvBhFGy/F5dPVdjuvaY=
+tj1CHRDoKXuRSk5koQ==
 -----END AGE ENCRYPTED FILE-----

secrets/tailscale-auth.key.age

@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBySGJi
+WVFhRmdaRDNMVlhmcm1URW5FSzNmNVZleStBL1lOcWVNcVJoQ2s0Cmx2U08wVmRx
+YysxREo3eG1tWTlYL1BrVWk2WTByZnREWHNlVHluMHVac0EKLT4gc3NoLWVkMjU1
+MTkgT0VxTXNnIGlENXpQVVhNSm9lWVoxUVhjaE40OXRSSlA3TVlRYjVESHVVWGVS
+bVZkQkUKK3ZyRmVPNmRXTW1pbDVwTlFXRGxWcFhNMWNqbDZFREw4VkFzYStMd1J1
+cwotPiBYMjU1MTkgcU4xSnVKbmNPbFZORlRWdnEvdnhvZnhPanE0SmtSYTZFUFQ4
+ejVOYWMySQppYUhCNHFuam9UVUllMFZSWHh6Q1ZmbFNhZ1dMckNJWEl2alBkZGdl
+ZzhRCi0+IG80N0p0Mi1ncmVhc2UKTXZnK3NOdnc2Mk85VFU4NTFCVXhlQ0RuMURi
+UE9tdk1TTWE0WlJDaktrVnlxVWJtRm9Ha1JYclRuc1VRZ2VhbAp2OUl0a09mYUFL
+MUtPYnJZUEJ0OU96ODVEQ1JGOWNvRzBsMkh2QWFYQS9rdTEyNjlXRDE4RldvCi0t
+LSBrQ2k0UDdjc3V1ZkVwOXdOa1p1dGU1WVN5amIvWnpKam5uYlUwR3RZVjRJCpS8
+TNqU8U4bRRS7bISPugIUpx+VSGNg+sIj6sbiQJk84mpQwfcfLYTiPjq0KizhtBco
+DiyHW7BsPntLiRem/PRMquzMy1sl1QelbeZaF1EAYA==
+-----END AGE ENCRYPTED FILE-----

secrets/toot/otp-secret.txt.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBBandV
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSArcDVp
-UzhEYk9DSnpMeGNUa2txQ0g4L0c0MUxjQms5bnJKN1pNblFmMkdBCmFlQTBZN3Nr
+TnB1QStoMWJzUWhMWnVtb1JSYTFublZKL25nL3JvU3B5M09TcXdBCmVHRk13R2cy
-U093WnR4ZDUzTHY3TFcrSlZsYmcwc0xoWkdObFpocjh3TTQKLT4gWDI1NTE5IDBH
+UmlXU0V5VlFCUUFHZ0ZiMUxFV294MW9tOTRKS0xNUDFGN28KLT4gWDI1NTE5IE9i
-UmJVUTB0T05IRlVPRnFkcFRMU0krWXZkc2FSTUNVMDZRd1REQTgwbTQKL1JLZG9H
+SUtBVElCa2tWdGlKZzJLWnBmeEw2UG8xSGdWYXNLdk1IejFNNG9YZ1UKSVRJNnhw
-a1BDUTUrU0JubmpXWkpNY2hTWXBlUlA2d3h4azBlYjRhK0U4bwotPiBITTczPlZD
+WEV4dkFUYVpuMmFaWFFYc0dLM3BMWlpSN3RzR0hYaVE2OU8rQQotPiB4LWdyZWFz
-Iy1ncmVhc2UKdmpPRjFBcG1UdWJHdE53WXNPbkhvMmNpSkEKLS0tIHBEQVVSN3Aw
+ZSB+XyB2ZFU1SQpUVVZpVWRLVVZqTmNTU2d1S2Z1L2x3NHY3UTZCbHZVRHZlZXhq
-MFJMRlZZSE1Gb2dycVNUTXlTSDhaQjBWMkN6M1ZJNnVCcGcKeIcvhCNatg6wP45x
+d2RFN3lURmlYU2ZTQzJ0bEdtRUNvNll1V2llCgotLS0gbXNpSWpPaEZIQTBybUtR
-lfhNa61Mv8u40GptPVB18tNl7Oogyqc1UVqlCRM709lIjy/HP5AppXb3LM8nBIAB
+eW5MT0RBdW9xZDFCbmVoajRjM2JhcEpmY2tUUQo8LhWOKi2MNQsYiRtYoIsmvPaQ
-HzKaTGrWv5lXDOSwZ+/qhvl5g41XygKyB6ghf41FC1sC84qCQXnF7zCz7k7TEz3V
+DWH3JkE2kZvy8Y5vSxSEWDuXY8Wj0sOj35wu5Ox5Ti6+XwG1VlEBYwKYwqU6homd
-YOlXE9EVGff9pUeaNo9UlI8nSVF9yVtTh/PcGR4Dp3nndfiDMrxzv3FhP7jado59
+h2TWE5f1kb0M4aQEA9+PZat3XJqnLKsG+NmLGQAbn8+LqyXYfEdqm8VF3jc0lZmJ
-3FnHh8A=
+kdLsXZEsHy4PzAQgQmxBD73dUOOaggQfeSKSbLODku+Tn0YODojv22/DqfN79A==
 -----END AGE ENCRYPTED FILE-----

secrets/toot/postgres-password.txt.age

@@ -1,10 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSA4eU94
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSB3K0x6
-MkVBUzU5bWdkeUVjekVnbzhBY3FXdEw3RUxtNG5JTW1GK3Blb0hvCmpIdWFKM0VB
+bUlBUzhZUzVRSDUxZFVKSkYrcmNuRzVjSEpBNkZkRTVCWTVuREIwClpEbm8xVDlV
-UHVtNXdRcFN2ajNCNUc0c1pTVWJiOEIwMVkvNVRLOGp6Uk0KLT4gWDI1NTE5IFFC
+ZnZ1UHJxMWwrUlFSanBiTGlSaU9FTEdBdnA4ZmxrNUVYWGcKLT4gWDI1NTE5ICs3
-eFhrTWNvcGVqbXE3U010V0FiYTBQcGJ2cmF5YUFkTlI5TDc3ZXNybHcKdXE2NjRi
+Q3VadkhJZW5EUGJkQmdwYU1waUQzRzh3VGpMOUVKbDM4cG0xNHQwVEUKdVhKeWZx
-R1o3c0ppRTBWUm5tU1NVTmdJZERtQVBmeVZxS2JnemlyK1IwTQotPiB0LWdyZWFz
+SVQvdjdKeCtjOXlDWjBaOGdvOTQ3TXViMk5GeGZJU0tBK0tIcwotPiB4aVYtZ3Jl
-ZSBSbk0pRSQKODhYTWxTNFllNVlubGZjZ0NIOXMrVkgzS2xYQTVpVGxiSjAKLS0t
+YXNlIDogLyMgZ1MKVHFNeUZqNDlVTEtIendDanhZUktqYzljNUhsL1lqVGZyanJX
-IGpSKzdkNFUrcFpldkpjQjE3eHZoU1VhNGtBQWpEMXd5MGQvd0VIcS9YaFkKg6hq
+Y1FYTTA0TWxZdGxhRkRaY2FsYjU3Zk05dFArNQplbG9hUEM1V1ozY3dkc3E4dzc4
-srGryke1CNRegAfPYREyXaZMvo9iH0VHCG8ns6wN+/p9vEZhalPo724rGE6bhg==
+ME5mS3lncjZaSFQ1RTFSSkdmUU5VVjlwc1NUTGMxK2k2U0xBcE8rUQotLS0gd1Fq
+cDQvYUxiWEtsaytYTXBSR1F6R3hVVUtCSk1YNHJiV3dOeDA4VEc0RQrBQ1JzW3sx
+okv/DsRX7tlhkWrH0gvPmMvdd5KUL4QgPEA4g3V8uxnZktALIPa9X6nx
 -----END AGE ENCRYPTED FILE-----