An attempt was made

nixos/middleman: Add hack for working Gitea Docker image pull
nixos/middleman: Fix HedgeDoc websockets
2024-01-09 21:56:10 +00:00 · 2024-01-09 18:50:11 +00:00 · 2024-01-09 17:35:34 +00:00 · 2024-01-09 17:19:13 +00:00 · 2024-01-09 13:33:00 +00:00 · 2024-01-09 00:22:17 +00:00
108 changed files with 8841 additions and 1066 deletions
--- a/.envrc
+++ b/.envrc
@@ -1,2 +1,2 @@
-nix_direnv_watch_file devshell/{default,commands,install,vm-tasks}.nix
+watch_file devshell/{default,commands,install,vm-tasks}.nix
 use flake
--- a/.gitea/workflows/installer.yaml
+++ b/.gitea/workflows/installer.yaml
@@ -33,18 +33,18 @@ jobs:
      - name: Build installer ISO
        run: |
          nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.iso
-          ln -s "$(readlink result)"/iso/nixos-installer-devplayer0.iso \
-            nixos-installer-devplayer0-${{ steps.setup.outputs.short_rev }}.iso
+          ln -s "$(readlink result)"/iso/jackos-installer.iso \
+            jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
      - name: Build installer netboot archive
        run: |
          nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.netbootArchive
          ln -s "$(readlink result)" \
-            nixos-installer-devplayer0-netboot-${{ steps.setup.outputs.short_rev }}.tar
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar

      - name: Create release
        uses: https://gitea.com/actions/release-action@main
        with:
          title: Latest installer
          files: |
-            nixos-installer-devplayer0-${{ steps.setup.outputs.short_rev }}.iso
-            nixos-installer-devplayer0-netboot-${{ steps.setup.outputs.short_rev }}.tar
+            jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar
--- a/flake.lock
+++ b/flake.lock
@@ -35,11 +35,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1698258239,
-        "narHash": "sha256-qnhoYYIJ0L/P7H/f56lQUEvpzNlXh4sxuHpRERV+B44=",
+        "lastModified": 1702969472,
+        "narHash": "sha256-IJP9sC+/gLUdWhm6TsnWpw6A1zQWUfn53ym63KeLXvU=",
        "owner": "zhaofengli",
        "repo": "attic",
-        "rev": "e9918bc6be268da6fa97af6ced15193d8a0421c0",
+        "rev": "bdafd64910bb2b861cf90fa15f1fc93318b6fbf6",
        "type": "github"
      },
      "original": {
@@ -95,26 +95,17 @@
    },
    "crane": {
      "inputs": {
-        "flake-compat": [
-          "attic",
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "attic",
-          "flake-utils"
-        ],
        "nixpkgs": [
          "attic",
          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
+        ]
      },
      "locked": {
-        "lastModified": 1677892403,
-        "narHash": "sha256-/Wi0L1spSWLFj+UQxN3j0mPYMoc7ZoAujpUF/juFVII=",
+        "lastModified": 1702918879,
+        "narHash": "sha256-tWJqzajIvYcaRWxn+cLUB9L9Pv4dQ3Bfit/YjU5ze3g=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "105e27adb70a9890986b6d543a67761cbc1964a2",
+        "rev": "7195c00c272fdd92fc74e7d5a0a2844b9fadb2fb",
        "type": "github"
      },
      "original": {
@@ -185,11 +176,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1698921442,
-        "narHash": "sha256-7KmvhQ7FuXlT/wG4zjTssap6maVqeAMBdtel+VjClSM=",
+        "lastModified": 1703087360,
+        "narHash": "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "660180bbbeae7d60dad5a92b30858306945fd427",
+        "rev": "b709d63debafce9f5645a5ba550c9e0983b3d1f7",
        "type": "github"
      },
      "original": {
@@ -241,14 +232,14 @@
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
-        "systems": "systems_3"
+        "systems": "systems_4"
      },
      "locked": {
-        "lastModified": 1698410321,
-        "narHash": "sha256-MphuSlgpmKwtJncGMohryHiK55J1n6WzVQ/OAfmfoMc=",
+        "lastModified": 1701787589,
+        "narHash": "sha256-ce+oQR4Zq9VOsLoh9bZT8Ip9PaMLcjjBUHVPzW5d7Cw=",
        "owner": "numtide",
        "repo": "devshell",
-        "rev": "1aed986e3c81a4f6698e85a7452cbfcc4b31a36e",
+        "rev": "44ddedcbcfc2d52a76b64fb6122f209881bd3e1e",
        "type": "github"
      },
      "original": {
@@ -276,11 +267,11 @@
    "flake-compat_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1668681692,
-        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
        "type": "github"
      },
      "original": {
@@ -418,14 +409,14 @@
    },
    "flake-utils_7": {
      "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_5"
      },
      "locked": {
-        "lastModified": 1694529238,
-        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
        "type": "github"
      },
      "original": {
@@ -451,7 +442,7 @@
    },
    "flake-utils_9": {
      "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_6"
      },
      "locked": {
        "lastModified": 1681202837,
@@ -474,11 +465,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1700814205,
-        "narHash": "sha256-lWqDPKHRbQfi+zNIivf031BUeyciVOtwCwTjyrhDB5g=",
+        "lastModified": 1703367386,
+        "narHash": "sha256-FMbm48UGrBfOWGt8+opuS+uLBLQlRfhiYXhHNcYMS5k=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "aeb2232d7a32530d3448318790534d196bf9427a",
+        "rev": "d5824a76bc6bb93d1dce9ebbbcb09a9b6abcc224",
        "type": "github"
      },
      "original": {
@@ -494,11 +485,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1701433070,
-        "narHash": "sha256-Gf9JStfENaUQ7YWFz3V7x/srIwr4nlnVteqaAxtwpgM=",
+        "lastModified": 1703754036,
+        "narHash": "sha256-JpJdcj9Tg4lMuYikXDpajA8wOp+rHyn9RD2rKBEM4cQ=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "4a8545f5e737a6338814a4676dc8e18c7f43fc57",
+        "rev": "c24c298562fe41b39909f632c5a7151bbf6b4628",
        "type": "github"
      },
      "original": {
@@ -508,11 +499,11 @@
    },
    "impermanence": {
      "locked": {
-        "lastModified": 1697303681,
-        "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
+        "lastModified": 1703656108,
+        "narHash": "sha256-hCSUqdFJKHHbER8Cenf5JRzjMlBjIdwdftGQsO0xoJs=",
        "owner": "nix-community",
        "repo": "impermanence",
-        "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
+        "rev": "033643a45a4a920660ef91caa391fbffb14da466",
        "type": "github"
      },
      "original": {
@@ -531,13 +522,13 @@
      "locked": {
        "lastModified": 1685908677,
        "narHash": "sha256-E4zUPEUFyVWjVm45zICaHRpfGepfkE9Z2OECV9HXfA4=",
-        "owner": "guibou",
+        "owner": "nix-community",
        "repo": "nixGL",
        "rev": "489d6b095ab9d289fe11af0219a9ff00fe87c7c5",
        "type": "github"
      },
      "original": {
-        "owner": "guibou",
+        "owner": "nix-community",
        "repo": "nixGL",
        "type": "github"
      }
@@ -560,11 +551,11 @@
    },
    "nixpkgs-mine": {
      "locked": {
-        "lastModified": 1701607327,
-        "narHash": "sha256-pHX6S1mrUSFVq6v0HiZuShfXLL01wiWvgivCabX2x+M=",
+        "lastModified": 1703756459,
+        "narHash": "sha256-ztEMyPQZh3Pb+LOoWl5lbIK2LenP59sOUBC86CDmLio=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "c8af66cb9046a65cbab33563f804b7bad46173af",
+        "rev": "e80160eb2ac3a7111d07cc43a15c16b9edca01ea",
        "type": "github"
      },
      "original": {
@@ -576,11 +567,11 @@
    },
    "nixpkgs-mine-stable": {
      "locked": {
-        "lastModified": 1701607437,
-        "narHash": "sha256-ozMDOyJtxr/CznI6lrwtt9JkU32Y2cLr2B4vlW85Tfw=",
+        "lastModified": 1703756491,
+        "narHash": "sha256-9VL34e0gzomwqRnryRn23V2ImYcaZIQdp7CsWg5TmlE=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "67ef05e2dd98d1fd856028eba1bb4edb847f6c6e",
+        "rev": "36611f5f7cfd401f51ad4ca76fd6ee85a714bb74",
        "type": "github"
      },
      "original": {
@@ -592,11 +583,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1701389149,
-        "narHash": "sha256-rU1suTIEd5DGCaAXKW6yHoCfR1mnYjOXQFOaH7M23js=",
+        "lastModified": 1703467016,
+        "narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5de0b32be6e85dc1a9404c75131316e4ffbc634c",
+        "rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
        "type": "github"
      },
      "original": {
@@ -607,11 +598,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1701253981,
-        "narHash": "sha256-ztaDIyZ7HrTAfEEUt9AtTDNoCYxUdSd6NrRHaYOIxtk=",
+        "lastModified": 1703438236,
+        "narHash": "sha256-aqVBq1u09yFhL7bj1/xyUeJjzr92fXVvQSSEx6AdB1M=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e92039b55bcd58469325ded85d4f58dd5a4eaf58",
+        "rev": "5f64a12a728902226210bf01d25ec6cbb9d9265b",
        "type": "github"
      },
      "original": {
@@ -678,7 +669,7 @@
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay"
      },
      "locked": {
        "lastModified": 1682237245,
@@ -715,33 +706,6 @@
      }
    },
    "rust-overlay": {
-      "inputs": {
-        "flake-utils": [
-          "attic",
-          "crane",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "attic",
-          "crane",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1675391458,
-        "narHash": "sha256-ukDKZw922BnK5ohL9LhwtaDAdCsJL7L6ScNEyF1lO9w=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "383a4acfd11d778d5c2efcf28376cbd845eeaedf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
      "inputs": {
        "flake-utils": [
          "ragenix",
@@ -862,13 +826,31 @@
        "type": "github"
      }
    },
-    "utils": {
+    "systems_6": {
      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -26,7 +26,7 @@
    impermanence.url = "github:nix-community/impermanence";
    boardie.url = "github:devplayer0/boardie";
    boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    nixGL.url = "github:guibou/nixGL";
+    nixGL.url = "github:nix-community/nixGL";
    nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";

    # Packages not in nixpkgs
@@ -63,7 +63,7 @@
        flake = flake-utils.lib;
      };
      pkgsLibOverlay = final: prev: { lib = prev.lib.extend libOverlay; };
-      myPkgsOverlay = final: prev: import ./pkgs { lib = prev.lib; pkgs = prev; };
+      myPkgsOverlay = final: prev: import ./pkgs { lib = final.lib; pkgs = prev; };

      # Override the flake-level lib since we're going to use it for non-config specific stuff
      pkgsFlakes = mapAttrs (_: pkgsFlake: pkgsFlake // { lib = pkgsFlake.lib.extend libOverlay; }) {
@@ -129,7 +129,7 @@
        modules = [
          {
            _module.args = {
-              inherit lib pkgsFlakes hmFlakes inputs;
+              inherit lib pkgsFlakes hmFlakes self inputs;
              pkgs' = configPkgs';
            };

--- a/home-manager/modules/common.nix
+++ b/home-manager/modules/common.nix
@@ -80,6 +80,7 @@ in

        tmux = {
          enable = true;
+          keyMode = "vi";
        };

        bash = {
--- a/lib/constants.nix
+++ b/lib/constants.nix
@@ -169,6 +169,18 @@ rec {
        port = 8448;
        dst = aa.middleman.internal.ipv4.address;
      }
+      {
+        port = 25565;
+        dst = aa.simpcraft-oci.internal.ipv4.address;
+      }
+      {
+        port = 25566;
+        dst = aa.simpcraft-staging-oci.internal.ipv4.address;
+      }
+      {
+        port = 25575;
+        dst = aa.simpcraft-oci.internal.ipv4.address;
+      }

      {
        port = 2456;
@@ -180,6 +192,18 @@ rec {
        dst = aa.valheim-oci.internal.ipv4.address;
        proto = "udp";
      }
+
+      {
+        port = 41641;
+        dst = aa.waffletail.internal.ipv4.address;
+        proto = "udp";
+      }
+
+      {
+        port = 25565;
+        dst = aa.simpcraft-oci.internal.ipv4.address;
+        proto = "udp";
+      }
    ];

    fstrimConfig = {
@@ -203,7 +227,7 @@ rec {
      "stream"
    ];
    routersPubV4 = [
-      "109.255.31.25"
+      "109.255.1.246"
      "109.255.252.63"
    ];

@@ -275,6 +299,27 @@ rec {
    };
  };

+  as211024 = rec {
+    trusted = {
+      v4 = [
+        colony.prefixes.as211024.v4
+        colony.prefixes.all.v4
+        home.prefixes.all.v4
+        tailscale.prefix.v4
+      ];
+      v6 = [
+        colony.prefixes.as211024.v6
+        colony.prefixes.all.v6
+        home.prefixes.all.v6
+        tailscale.prefix.v6
+      ];
+    };
+    nftTrust = ''
+      iifname as211024 ip saddr { ${concatStringsSep ", " trusted.v4} } accept
+      iifname as211024 ip6 saddr { ${concatStringsSep ", " trusted.v6} } accept
+    '';
+  };
+
  kelder = {
    groups = {
      storage = 2000;
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -1,10 +1,11 @@
 { lib }:
 let
-  inherit (builtins) length match elemAt filter replaceStrings;
+  inherit (builtins) length match elemAt filter replaceStrings substring;
  inherit (lib)
    genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
    mkOption mkOverride mkForce mkIf mergeEqualOption optional
-    showWarnings concatStringsSep flatten unique optionalAttrs;
+    showWarnings concatStringsSep flatten unique optionalAttrs
+    mkBefore;
  inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -166,7 +167,7 @@ rec {

  systemdAwaitPostgres = pkg: host: {
    after = [ "systemd-networkd-wait-online.service" ];
-    preStart = ''
+    preStart = mkBefore ''
      until ${pkg}/bin/pg_isready -h ${host}; do
        sleep 0.5
      done
@@ -239,4 +240,18 @@ rec {

    filterOpts = filterAttrsRecursive (_: v: v != null);
  };
+
+  versionOverlay = { self, pkgsFlake }: final: prev:
+  let
+    date = substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101");
+    revCode = flake: flake.shortRev or "dirty";
+  in
+  {
+    trivial = prev.trivial // {
+      release = "23.12:u-${prev.trivial.release}";
+      codeName = "Amogus";
+      revisionWithDefault = default: self.rev or default;
+      versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
+    };
+  };
 }
--- a/nixos/boxes/britway/default.nix
+++ b/nixos/boxes/britway/default.nix
@@ -150,8 +150,14 @@ in
              };

              firewall = {
-                trustedInterfaces = [ "as211024" "tailscale0" ];
+                trustedInterfaces = [ "tailscale0" ];
                extraRules = ''
+                  table inet filter {
+                    chain forward {
+                      ${lib.my.c.as211024.nftTrust}
+                      oifname as211024 accept
+                    }
+                  }
                  table inet nat {
                    chain postrouting {
                      iifname tailscale0 oifname veth0 snat ip to ${assignments.vultr.ipv4.address}
--- a/nixos/boxes/britway/tailscale.nix
+++ b/nixos/boxes/britway/tailscale.nix
@@ -19,8 +19,6 @@ let
  };

  advRoutes = concatStringsSep "," [
-    lib.my.c.colony.prefixes.all.v4
-    lib.my.c.colony.prefixes.all.v6
    lib.my.c.home.prefixes.all.v4
    lib.my.c.home.prefixes.all.v6
  ];
@@ -51,15 +49,19 @@ in
          noise.private_key_path = "/var/lib/headscale/noise_private.key";
          ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ];
          dns_config = {
+            # Use IPs that will route inside the VPN to prevent interception
+            # (e.g. DNS rebinding filtering)
            restricted_nameservers = {
              "${domain}" = pubNameservers;
-              "${lib.my.c.colony.domain}" = with allAssignments.estuary.internal; [
+              "${lib.my.c.colony.domain}" = with allAssignments.estuary.base; [
                ipv4.address ipv6.address
              ];
-              "${lib.my.c.home.domain}" = lib.my.c.home.routersPubV4 ++ ([
-                allAssignments.river.as211024.ipv6.address
-                allAssignments.stream.as211024.ipv6.address
-              ]);
+              "${lib.my.c.home.domain}" = with allAssignments; [
+                river.hi.ipv4.address
+                river.hi.ipv6.address
+                stream.hi.ipv4.address
+                stream.hi.ipv6.address
+              ];
            };
            magic_dns = true;
            base_domain = "ts.${pubDomain}";
@@ -87,6 +89,7 @@ in
          "--netfilter-mode=off"
          "--advertise-exit-node"
          "--advertise-routes=${advRoutes}"
+          "--accept-routes=false"
        ];
      };
    };
--- a/nixos/boxes/colony/default.nix
+++ b/nixos/boxes/colony/default.nix
@@ -66,10 +66,21 @@ in
            };
          });
          kernelModules = [ "kvm-amd" ];
-          kernelParams = [ "amd_iommu=on" "console=ttyS0,115200n8" "console=ttyS1,115200n8" "console=tty0" ];
+          kernelParams = [
+            "amd_iommu=on"
+            "console=ttyS0,115200n8" "console=ttyS1,115200n8" "console=tty0"
+            "systemd.setenv=SYSTEMD_SULOGIN_FORCE=1"
+          ];
          initrd = {
            kernelModules = [ "dm-raid" ];
            availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+            systemd = {
+              enable = true;
+              # Onlu activate volumes needed for boot to prevent thin check from getting killed while switching root
+              contents."/etc/lvm/lvm.conf".text = ''
+                activation/auto_activation_volume_list = [ "main/colony-nix" "main/colony-persist" ]
+              '';
+            };
          };
        };

@@ -137,6 +148,15 @@ in
          services = {
            "serial-getty@ttyS0".enable = true;
            "serial-getty@ttyS1".enable = true;
+            lvm-activate-main = {
+              description = "Activate remaining LVs";
+              before = [ "local-fs-pre.target" ];
+              serviceConfig = {
+                Type = "oneshot";
+                ExecStart = "${pkgs.lvm2.bin}/bin/vgchange -aay main";
+              };
+              wantedBy = [ "sysinit.target" ];
+            };

            rsync-lvm-meta = {
              description = "rsync lvm metadata backups / archives to rsync.net";
@@ -248,6 +268,14 @@ in
                      Destination = allAssignments.shill.internal.ipv4.address;
                      Gateway = allAssignments.shill.routing.ipv4.address;
                    }
+                    {
+                      Destination = lib.my.c.tailscale.prefix.v4;
+                      Gateway = allAssignments.shill.routing.ipv4.address;
+                    }
+                    {
+                      Destination = lib.my.c.tailscale.prefix.v6;
+                      Gateway = allAssignments.shill.internal.ipv6.address;
+                    }

                    {
                      Destination = prefixes.oci.v4;
--- a/nixos/boxes/colony/vms/default.nix
+++ b/nixos/boxes/colony/vms/default.nix
@@ -120,7 +120,7 @@
              cpus = 12;
              threads = 2;
            };
-            memory = 49152;
+            memory = 40960;
            networks.vms.mac = "52:54:00:27:3d:5c";
            cleanShutdown.timeout = 120;
            drives = [ ] ++ (optionals (!config.my.build.isDevVM) [
@@ -160,7 +160,7 @@
              cpus = 12;
              threads = 2;
            };
-            memory = 32768;
+            memory = 40960;
            networks.vms.mac = "52:54:00:75:78:a8";
            cleanShutdown.timeout = 120;
            drives = [
@@ -181,7 +181,7 @@
              cpus = 3;
              threads = 2;
            };
-            memory = 8192;
+            memory = 6144;
            networks.public = {
              bridge = null;
              mac = "52:54:00:a8:d1:03";
--- a/nixos/boxes/colony/vms/estuary/bgp.nix
+++ b/nixos/boxes/colony/vms/estuary/bgp.nix
@@ -27,7 +27,9 @@ in
          define HOMENET6 = ${homenet6};

          define OWNIP6 = ${assignments.base.ipv6.address};
-          define OWNNETSET6 = [ ${intnet6}, ${amsnet6}, ${homenet6} ];
+          # we have issues with sending ICMPv6 too big back on the wrong interface right now...
+          define OWNNETSET6 = [ ${intnet6}, ${amsnet6} ];
+          define CCNETSET6 = [ ];
          #define TRANSSET6 = [ ::1/128 ];

          define DUB1IP6 = ${lib.my.c.home.vips.as211024.v6};
@@ -42,7 +44,7 @@ in
            if net ~ OWNNETSET4 || net ~ OWNNETSET6 then accept; else reject;
          }
          filter bgp_export_cc {
-            if net ~ OWNNETSET4 || net ~ OWNNETSET6 || net ~ CCNETSET4 then accept; else reject;
+            if net ~ OWNNETSET4 || net ~ OWNNETSET6 || net ~ CCNETSET4 || net ~ CCNETSET6 then accept; else reject;
          }

          router id from "wan";
@@ -188,10 +190,12 @@ in
          protocol bgp upstream6_coloclue_eun2 from upstream_bgp6 {
            description "ColoClue euNetworks 2 (IPv6)";
            neighbor 2a02:898:0:20::e2 as 8283;
+            ipv6 { export filter bgp_export_cc; };
          }
          protocol bgp upstream6_coloclue_eun3 from upstream_bgp6 {
            description "ColoClue euNetworks 3 (IPv6)";
            neighbor 2a02:898:0:20::e1 as 8283;
+            ipv6 { export filter bgp_export_cc; };
          }

          protocol bgp upstream6_ifog from upstream_bgp6 {
--- a/nixos/boxes/colony/vms/estuary/default.nix
+++ b/nixos/boxes/colony/vms/estuary/default.nix
@@ -298,6 +298,15 @@ in
                          Destination = prefixes.cust.v6;
                          Gateway = allAssignments.colony.internal.ipv6.address;
                        }
+
+                        {
+                          Destination = lib.my.c.tailscale.prefix.v4;
+                          Gateway = allAssignments.colony.routing.ipv4.address;
+                        }
+                        {
+                          Destination = lib.my.c.tailscale.prefix.v6;
+                          Gateway = allAssignments.colony.internal.ipv6.address;
+                        }
                      ] ++
                      (map (pName: [
                        {
@@ -322,15 +331,6 @@ in
                        Destination = lib.my.c.home.prefixes.all.v4;
                        Gateway = lib.my.c.home.vips.as211024.v4;
                      }
-
-                      {
-                        Destination = lib.my.c.tailscale.prefix.v4;
-                        Gateway = allAssignments.britway.as211024.ipv4.address;
-                      }
-                      {
-                        Destination = lib.my.c.tailscale.prefix.v6;
-                        Gateway = allAssignments.britway.as211024.ipv6.address;
-                      }
                    ];
                  }
                ];
@@ -366,7 +366,6 @@ in
                };
              };
              firewall = {
-                trustedInterfaces = [ "as211024" ];
                udp.allowed = [ 5353 lib.my.c.kelder.vpn.port ];
                tcp.allowed = [ 5353 "bgp" ];
                nat = {
@@ -394,12 +393,16 @@ in
                      # Safe enough to allow all SSH
                      tcp dport ssh accept

-                      ${matchInet "tcp dport { http, https, 8448 } accept" "middleman"}
-                      ${matchInet "udp dport { 2456-2457 } accept" "valheim-oci"}
-
+                      ip6 daddr ${aa.middleman.internal.ipv6.address} tcp dport { http, https, 8448 } accept
+                      ${matchInet "tcp dport { http, https } accept" "git"}
+                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport { 25565, 25575 } accept
+                      ip6 daddr ${aa.simpcraft-staging-oci.internal.ipv6.address} tcp dport 25565 accept
                      return
                    }
                    chain routing-udp {
+                      ip6 daddr ${aa.valheim-oci.internal.ipv6.address} udp dport { 2456-2457 } accept
+                      ip6 daddr ${aa.waffletail.internal.ipv6.address} udp dport 41641 accept
+                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} udp dport 25565 accept
                      return
                    }
                    chain filter-routing {
@@ -416,7 +419,8 @@ in
                    }

                    chain forward {
-                      iifname { wan, $ixps } oifname base jump filter-routing
+                      ${lib.my.c.as211024.nftTrust}
+                      iifname { wan, as211024, $ixps } oifname base jump filter-routing
                      oifname $ixps jump ixp
                      iifname base oifname { base, wan, $ixps } accept
                      oifname { as211024, kelder } accept
@@ -429,8 +433,6 @@ in
                  table inet nat {
                    chain prerouting {
                      ${matchInet "meta l4proto { udp, tcp } th dport domain redirect to :5353" "estuary"}
-                      ip daddr ${aa.git.internal.ipv4.address} tcp dport { http, https } dnat to ${aa.middleman.internal.ipv4.address}
-                      ip6 daddr ${aa.git.internal.ipv6.address} tcp dport { http, https } dnat to ${aa.middleman.internal.ipv6.address}
                    }
                    chain postrouting {
                      ip saddr ${prefixes.all.v4} oifname != as211024 snat to ${assignments.internal.ipv4.address}
--- a/nixos/boxes/colony/vms/estuary/dns.nix
+++ b/nixos/boxes/colony/vms/estuary/dns.nix
@@ -52,7 +52,7 @@ in
          allowFrom = [
            "127.0.0.0/8" "::1/128"
            prefixes.all.v4 prefixes.all.v6
-          ];
+          ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
        };

        settings = {
@@ -145,9 +145,14 @@ in

            http IN A ${assignments.internal.ipv4.address}
            http IN AAAA ${allAssignments.middleman.internal.ipv6.address}
+            librespeed IN CNAME http.${config.networking.domain}.

            valheim IN A ${assignments.internal.ipv4.address}
            valheim IN AAAA ${allAssignments.valheim-oci.internal.ipv6.address}
+            simpcraft IN A ${assignments.internal.ipv4.address}
+            simpcraft IN AAAA ${allAssignments.simpcraft-oci.internal.ipv6.address}
+            simpcraft-staging IN A ${assignments.internal.ipv4.address}
+            simpcraft-staging IN AAAA ${allAssignments.simpcraft-staging-oci.internal.ipv6.address}

            mail-vm IN A ${net.cidr.host 0 prefixes.mail.v4}
            mail-vm IN AAAA ${net.cidr.host 1 prefixes.mail.v6}
--- a/nixos/boxes/colony/vms/git/default.nix
+++ b/nixos/boxes/colony/vms/git/default.nix
@@ -1,8 +1,11 @@
 { lib, ... }:
 let
+  inherit (builtins) mapAttrs;
+  inherit (lib) mkMerge mkDefault;
  inherit (lib.my) net;
  inherit (lib.my.c) pubDomain;
  inherit (lib.my.c.colony) domain prefixes;
+  inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
 in
 {
  nixos.systems.git = {
@@ -72,9 +75,109 @@ in
              };
            };

+            users = {
+              users = {
+                nginx.extraGroups = [ "acme" ];
+              };
+            };
+
+            security.acme = {
+              acceptTerms = true;
+              defaults = {
+                email = "dev@nul.ie";
+                server = "https://acme-v02.api.letsencrypt.org/directory";
+                reloadServices = [ "nginx" ];
+                dnsResolver = "8.8.8.8";
+              };
+              certs = {
+                "${pubDomain}" = {
+                  extraDomainNames = [
+                    "*.${pubDomain}"
+                  ];
+                  dnsProvider = "cloudflare";
+                  credentialsFile = config.age.secrets."middleman/cloudflare-credentials.conf".path;
+                };
+              };
+            };
+
            services = {
              fstrim = lib.my.c.colony.fstrimConfig;
+              # Hacks for Jsch (Minecraft FastBack) to work
+              openssh = {
+                hostKeys = [
+                  {
+                    bits = 4096;
+                    path = "/etc/ssh/ssh_host_rsa_key";
+                    type = "rsa";
+                  }
+                  {
+                    path = "/etc/ssh/ssh_host_ed25519_key";
+                    type = "ed25519";
+                  }
+
+                  {
+                    type = "ecdsa-sha2-nistp256";
+                    path = "/etc/ssh/ssh_host_ecdsa_key";
+                  }
+                ];
+                settings = {
+                  Macs = [
+                    "hmac-sha2-512-etm@openssh.com"
+                    "hmac-sha2-256-etm@openssh.com"
+                    "umac-128-etm@openssh.com"
+
+                    "hmac-sha2-256"
+                  ];
+                };
+              };
              netdata.enable = true;
+              nginx = {
+                enable = true;
+                enableReload = true;
+
+                logError = "stderr info";
+                recommendedTlsSettings = true;
+                clientMaxBodySize = "0";
+                serverTokens = true;
+                sslDhparam = config.age.secrets."dhparams.pem".path;
+
+                # Based on recommended*Settings, but probably better to be explicit about these
+                appendHttpConfig = ''
+                  ${baseHttpConfig}
+
+                  # caching
+                  proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=512m;
+                '';
+
+                virtualHosts =
+                let
+                  hosts = {
+                    "_" = {
+                      default = true;
+                      forceSSL = true;
+                      onlySSL = false;
+                      locations = {
+                        "/".root = "${pkgs.nginx}/html";
+                      };
+                    };
+
+                    "git.${pubDomain}" = {
+                      locations."/".proxyPass = "http://localhost:3000";
+                    };
+                  };
+
+                  defaultsFor = mapAttrs (n: _: {
+                    onlySSL = mkDefault true;
+                    useACMEHost = mkDefault pubDomain;
+                    kTLS = mkDefault true;
+                    http2 = mkDefault true;
+                  });
+                in
+                mkMerge [
+                  hosts
+                  (defaultsFor hosts)
+                ];
+              };
            };

            virtualisation = {
@@ -104,11 +207,24 @@ in
            };

            my = {
-              secrets.key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+KINpHLMduBuW96JzfSRDLUzkI+XaCBghu5/wHiW5R";
+              secrets = {
+                key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+KINpHLMduBuW96JzfSRDLUzkI+XaCBghu5/wHiW5R";
+                files = {
+                  "dhparams.pem" = {
+                    owner = "acme";
+                    group = "acme";
+                    mode = "440";
+                  };
+                  "middleman/cloudflare-credentials.conf" = {
+                    owner = "acme";
+                    group = "acme";
+                  };
+                };
+              };
              server.enable = true;

              firewall = {
-                tcp.allowed = [ 19999 ];
+                tcp.allowed = [ 19999 "http" "https" ];
                extraRules = ''
                  table inet filter {
                    chain forward {
--- a/nixos/boxes/colony/vms/git/gitea.nix
+++ b/nixos/boxes/colony/vms/git/gitea.nix
@@ -26,18 +26,6 @@ in

    systemd = {
      services = {
-        # TODO: Figure out a way to do this properly... redirecting localhost is awkward...
-        local-http-forward = {
-          description = "Forward local HTTP connections";
-          serviceConfig.ExecStart = "${pkgs.socat}/bin/socat tcp-listen:80,fork tcp:${allAssignments.middleman.internal.ipv4.address}:80";
-          wantedBy = [ "multi-user.target" ];
-        };
-        local-https-forward = {
-          description = "Forward local HTTPS connections";
-          serviceConfig.ExecStart = "${pkgs.socat}/bin/socat tcp-listen:443,fork tcp:${allAssignments.middleman.internal.ipv4.address}:443";
-          wantedBy = [ "multi-user.target" ];
-        };
-
        gitea = mkMerge [
          (lib.my.systemdAwaitPostgres pkgs.postgresql "colony-psql")
          {
@@ -141,21 +129,6 @@ in
          "gitea/minio.txt" = ownedByGit;
        };
      };
-
-      firewall.extraRules = ''
-        table inet filter {
-          chain input {
-            ip saddr ${prefixes.all.v4} tcp dport 3000 accept
-            ip6 saddr ${prefixes.all.v6} tcp dport 3000 accept
-          }
-        }
-        table inet nat {
-          chain prerouting {
-            ip daddr ${assignments.internal.ipv4.address} tcp dport { http, https } dnat to ${allAssignments.middleman.internal.ipv4.address}
-            ip6 daddr ${assignments.internal.ipv6.address} tcp dport { http, https } dnat to ${allAssignments.middleman.internal.ipv6.address}
-          }
-        }
-      '';
    };
  };
 }
--- a/nixos/boxes/colony/vms/shill/containers/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/default.nix
@@ -7,5 +7,6 @@
    ./jackflix
    ./object.nix
    ./toot.nix
+    ./waffletail.nix
  ];
 }
--- a/nixos/boxes/colony/vms/shill/containers/middleman/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/default.nix
@@ -66,6 +66,7 @@ in
                  owner = "nginx";
                  group = "nginx";
                };
+                "librespeed.toml" = { };
              };
            };

@@ -122,6 +123,19 @@ in
                baseURL = "https://sso.${pubDomain}";
              };
            };
+
+            librespeed = {
+              frontend.servers = [
+                {
+                  name = "Amsterdam, Netherlands";
+                  server = "//librespeed.${domain}";
+                }
+              ];
+              backend = {
+                enable = true;
+                extraSettingsFile = config.age.secrets."librespeed.toml".path;
+              };
+            };
          };

          users = {
@@ -132,6 +146,10 @@ in

          systemd = {
            network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
+            services = {
+              # HACK: nginx seems to get stuck not being able to DNS early...
+              nginx = lib.my.systemdAwaitPostgres pkgs.postgresql "colony-psql";
+            };
          };

          security = {
@@ -234,6 +252,8 @@ in
              appendHttpConfig = ''
                ${baseHttpConfig}

+                resolver_timeout 5s;
+
                # caching
                proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=4g;

--- a/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
@@ -347,9 +347,41 @@ in
        };
        useACMEHost = pubDomain;
      };
+      "public.${pubDomain}" = {
+        serverAliases = [ "p.${pubDomain}" ];
+        locations."/" = {
+          root = "/mnt/media/public";
+          extraConfig = ''
+            fancyindex on;
+            fancyindex_show_dotfiles on;
+          '';
+        };
+        useACMEHost = pubDomain;
+      };

-      "git.${pubDomain}" = {
-        locations."/".proxyPass = "http://git-vm.${domain}:3000";
+      "mc-map.${pubDomain}" = {
+        locations."/".proxyPass = "http://simpcraft-oci.${domain}:8100";
+        useACMEHost = pubDomain;
+      };
+      "mc-rail.${pubDomain}" = {
+        locations."/".proxyPass = "http://simpcraft-staging-oci.${domain}:3876";
+        useACMEHost = pubDomain;
+      };
+
+      "librespeed.${domain}" = {
+        locations."/".proxyPass = "http://localhost:8989";
+      };
+      "speed.${pubDomain}" = {
+        locations."/".proxyPass = "http://localhost:8989";
+        useACMEHost = pubDomain;
+      };
+
+      "md.${pubDomain}" = {
+        locations."/" = {
+          proxyPass = "http://object-ctr.${domain}:3000";
+          proxyWebsockets = true;
+          extraConfig = proxyHeaders;
+        };
        useACMEHost = pubDomain;
      };
    };
@@ -387,7 +419,22 @@ in
      "s3.${pubDomain}" = {
        serverAliases = [ "*.s3.${pubDomain}" ];
        inherit extraConfig;
-        locations."/".proxyPass = s3Upstream;
+        locations = {
+          "/".proxyPass = s3Upstream;
+          "/gitea/packages/" = {
+            proxyPass = s3Upstream;
+            # HACK: Docker images need the MIME type to be correct for the manifest but Gitea
+            # doesn't tell S3... By hiding the header we can use add_header to set Content-Type
+            # (normally can't be set directly)
+            extraConfig = ''
+              proxy_hide_header Content-Type;
+              add_header Content-Type $upstream_http_content_type always;
+              if ($args ~ "response-content-disposition=.+filename%3D%22manifest\.json%22") {
+                add_header Content-Type "application/vnd.docker.distribution.manifest.v2+json";
+              }
+            '';
+          };
+        };
        useACMEHost = pubDomain;
      };

--- a/nixos/boxes/colony/vms/shill/containers/object.nix
+++ b/nixos/boxes/colony/vms/shill/containers/object.nix
@@ -48,11 +48,17 @@ in
                  group = config.my.user.config.group;
                };
                "object/atticd.env" = {};
+                "object/hedgedoc.env" = {};
              };
            };

            firewall = {
-              tcp.allowed = [ 9000 9001 config.services.sharry.config.bind.port 8069 ];
+              tcp.allowed = [
+                9000 9001
+                config.services.sharry.config.bind.port
+                8069
+                config.services.hedgedoc.settings.port
+              ];
            };

            user.homeConfig = {
@@ -194,6 +200,26 @@ in
                };
              };
            };
+
+            hedgedoc = {
+              enable = true;
+              environmentFile = config.age.secrets."object/hedgedoc.env".path;
+              settings = {
+                domain = "md.${pubDomain}";
+                protocolUseSSL = true;
+                db = {
+                  dialect = "postgresql";
+                  username = "hedgedoc";
+                  database = "hedgedoc";
+                  host = "colony-psql";
+                };
+                host = "::";
+                allowAnonymous = false;
+                allowAnonymousEdits = true;
+                email = true;
+                allowEmailRegister = false;
+              };
+            };
          };
        }
        (mkIf config.my.build.isDevVM {
--- a/nixos/boxes/colony/vms/shill/containers/waffletail.nix
+++ b/nixos/boxes/colony/vms/shill/containers/waffletail.nix
@@ -0,0 +1,100 @@
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c.colony) domain prefixes;
+in
+{
+  nixos.systems.waffletail = { config, ... }: {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+    rendered = config.configuration.config.my.asContainer;
+
+    assignments = {
+      internal = {
+        name = "waffletail-ctr";
+        inherit domain;
+        ipv4.address = net.cidr.host 9 prefixes.ctrs.v4;
+        ipv6 = {
+          iid = "::9";
+          address = net.cidr.host 9 prefixes.ctrs.v6;
+        };
+      };
+      tailscale = with lib.my.c.tailscale; {
+        ipv4 = {
+          address = net.cidr.host 5 prefix.v4;
+          mask = 32;
+          gateway = null;
+        };
+        ipv6 = {
+          address = net.cidr.host 5 prefix.v6;
+          mask = 128;
+        };
+      };
+    };
+
+    configuration = { lib, config, assignments, ... }:
+    let
+      inherit (lib) concatStringsSep mkMerge mkIf mkForce;
+      inherit (lib.my) networkdAssignment;
+    in
+    {
+      config = {
+        my = {
+          deploy.enable = false;
+          server.enable = true;
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICZc88lcSQ9zzQzDITdE/T5ty++TxFQUAED7p9YfFBiR";
+            files = {
+              "tailscale-auth.key" = {};
+            };
+          };
+
+          firewall = {
+            trustedInterfaces = [ "tailscale0" ];
+            extraRules = ''
+              table inet filter {
+                chain forward {
+                  iifname host0 oifname tailscale0 ip saddr ${prefixes.all.v4} accept
+                  iifname host0 oifname tailscale0 ip6 saddr ${prefixes.all.v6} accept
+                }
+              }
+              table inet nat {
+                chain postrouting {
+                  iifname tailscale0 ip daddr != ${prefixes.all.v4} snat to ${assignments.internal.ipv4.address}
+                  iifname tailscale0 ip6 daddr != ${prefixes.all.v6} snat ip6 to ${assignments.internal.ipv6.address}
+                }
+              }
+            '';
+          };
+        };
+
+        systemd = {
+          network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
+        };
+
+        services = {
+          tailscale =
+          let
+            advRoutes = concatStringsSep "," (with prefixes.all; [ v4 v6 ]);
+          in
+          {
+            enable = true;
+            authKeyFile = config.age.secrets."tailscale-auth.key".path;
+            port = 41641;
+            openFirewall = true;
+            interfaceName = "tailscale0";
+            extraUpFlags = [
+              "--operator=${config.my.user.config.name}"
+              "--login-server=https://ts.nul.ie"
+              "--netfilter-mode=off"
+              "--advertise-exit-node"
+              "--advertise-routes=${advRoutes}"
+              "--accept-routes=false"
+            ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/nixos/boxes/colony/vms/shill/default.nix
+++ b/nixos/boxes/colony/vms/shill/default.nix
@@ -139,6 +139,16 @@ in
                        ipv6PrefixConfig.Prefix = prefixes.ctrs.v6;
                      }
                    ];
+                    routes = map (r: { routeConfig = r; }) [
+                      {
+                        Destination = lib.my.c.tailscale.prefix.v4;
+                        Gateway = allAssignments.waffletail.internal.ipv4.address;
+                      }
+                      {
+                        Destination = lib.my.c.tailscale.prefix.v6;
+                        Gateway = allAssignments.waffletail.internal.ipv6.address;
+                      }
+                    ];
                  }
                ];
              };
@@ -196,6 +206,7 @@ in
                    };
                  };
                  toot = {};
+                  waffletail = {};
                };
              in
              mkMerge [
--- a/nixos/boxes/colony/vms/whale2/default.nix
+++ b/nixos/boxes/colony/vms/whale2/default.nix
@@ -50,6 +50,8 @@ in
      };
    }) {
      valheim-oci = 2;
+      simpcraft-oci = 3;
+      simpcraft-staging-oci = 4;
    };

    configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -63,6 +65,7 @@ in
          "${modulesPath}/profiles/qemu-guest.nix"

          ./valheim.nix
+          ./minecraft
        ];

        config = mkMerge [
--- a/nixos/boxes/colony/vms/whale2/minecraft/default.nix
+++ b/nixos/boxes/colony/vms/whale2/minecraft/default.nix
@@ -0,0 +1,121 @@
+{ lib, pkgs, config, allAssignments, ... }:
+let
+  inherit (lib) concatStringsSep;
+  inherit (lib.my) dockerNetAssignment;
+
+  # devplayer0
+  op = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
+  whitelist = concatStringsSep "," [
+    op
+    "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56" # Elderlypug
+    "fcb26db2-c3ce-41aa-b588-efec79d37a8a" # Jesthral_
+    "1d366062-12c0-4e29-aba7-6ab5d8c6bb05" # shr3kas0ras
+    "703b378a-09f9-4c1d-9876-1c9305728c49" # OROURKEIRE
+    "f105bbe6-eda6-4a13-a8cf-894e77cab77b" # Adzerq
+    "1fc94979-41fb-497a-81e9-34ae24ca537a" # johnnyscrims
+    "d53c91df-b6e6-4463-b106-e8427d7a8d01" # BossLonus
+    "f439f64d-91c9-4c74-9ce5-df4d24cd8e05" # hynge_
+    "d6ec4c91-5da2-44eb-b89d-71dc8fe017a0" # Eefah98
+    "096a7348-fabe-4b2d-93fc-fd1fd5608fb0" # ToTheMoonStar
+  ];
+
+  fastback = {
+    gitConfig = pkgs.writeText "git-config" ''
+      [user]
+      	email = "simpcraft@nul.ie"
+      	name = "Simpcraft bot"
+    '';
+    knownHosts = pkgs.writeText "known_hosts" ''
+      git.nul.ie ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBD023ECzYmLeXIpcGVaciPjq6UN/Sjmsys5HP/Nei5GkrUZqPa3OJ2uSXKLUSKGYdeNhxaFTPJe8Yx3TsZxMme8=
+    '';
+  };
+in
+{
+  config = {
+    virtualisation.oci-containers.containers = {
+      simpcraft = {
+        image = "ghcr.io/itzg/minecraft-server:2023.12.2-java17-alpine";
+
+        environment = {
+          TYPE = "MODRINTH";
+
+          EULA = "true";
+          ENABLE_QUERY = "true";
+          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t §4§k-----";
+          ICON = "/ext/icon.png";
+
+          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
+          WHITELIST = whitelist;
+          EXISTING_OPS_FILE = "SYNCHRONIZE";
+          OPS = op;
+          DIFFICULTY = "normal";
+          SPAWN_PROTECTION = "0";
+          VIEW_DISTANCE = "20";
+
+          MAX_MEMORY = "6G";
+          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/cdj2bSKg/Simpcraft-0.1.2.mrpack";
+
+          TZ = "Europe/Dublin";
+        };
+
+        volumes = [
+          "minecraft_data:/data"
+          "${./icon.png}:/ext/icon.png:ro"
+        ];
+
+        extraOptions = [
+          ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-oci"}''
+        ];
+      };
+
+      simpcraft-staging = {
+        image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";
+
+        environment = {
+          TYPE = "MODRINTH";
+
+          EULA = "true";
+          ENABLE_QUERY = "true";
+          ENABLE_RCON = "true";
+          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t [staging] §4§k-----";
+          ICON = "/ext/icon.png";
+
+          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
+          WHITELIST = whitelist;
+          EXISTING_OPS_FILE = "SYNCHRONIZE";
+          OPS = op;
+          DIFFICULTY = "normal";
+          SPAWN_PROTECTION = "0";
+          VIEW_DISTANCE = "20";
+
+          MAX_MEMORY = "4G";
+          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/Ym3sIi6H/Simpcraft-0.2.0.mrpack";
+
+          TZ = "Europe/Dublin";
+        };
+        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
+
+        volumes = [
+          "minecraft_staging_data:/data"
+          "${./icon.png}:/ext/icon.png:ro"
+          "${fastback.gitConfig}:/data/.config/git/config:ro"
+          "${fastback.knownHosts}:/data/.ssh/known_hosts:ro"
+          "${config.age.secrets."whale2/simpcraft-git.key".path}:/data/.ssh/id_rsa"
+        ];
+
+        extraOptions = [
+          ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
+        ];
+      };
+    };
+
+    my = {
+      secrets.files = {
+        "whale2/simpcraft.env" = {};
+        "whale2/simpcraft-git.key" = {
+          owner = "1000";
+        };
+      };
+    };
+  };
+}
--- a/nixos/boxes/colony/vms/whale2/minecraft/icon.png
+++ b/nixos/boxes/colony/vms/whale2/minecraft/icon.png
--- a/nixos/boxes/home/palace/default.nix
+++ b/nixos/boxes/home/palace/default.nix
@@ -94,7 +94,7 @@ in
            extraOptions = [ "-A /var/log/smartd/" "--interval=600" ];
          };
          udev.extraRules = ''
-            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="2"
+            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="3"
          '';
        };

@@ -110,7 +110,7 @@ in
          hwloc
        ];

-        networking.domain = "h.${pubDomain}";
+        networking = { inherit domain; };

        systemd = {
          tmpfiles.rules = [
@@ -144,6 +144,13 @@ in

            netdevs = mkMerge [
              (mkVLAN "lan-hi" vlans.hi)
+              (mkVLAN "lan-lo-phy" vlans.lo)
+              {
+                "25-lan-lo".netdevConfig = {
+                  Name = "lan-lo";
+                  Kind = "bridge";
+                };
+              }
            ];

            networks = {
@@ -151,6 +158,7 @@ in
                (networkdAssignment "lan-core" assignments.core)
                {
                  matchConfig.Name = "lan-core";
+                  vlan = [ "lan-lo-phy" ];
                  networkConfig.IPv6AcceptRA = mkForce false;
                }
              ];
@@ -173,9 +181,28 @@ in
                  VirtualFunction=1
                  LinkState=yes
                  MACAddress=52:54:00:8a:8a:f2
+
+                  # sfh
+                  [SR-IOV]
+                  VirtualFunction=2
+                  VLANId=${toString vlans.hi}
+                  LinkState=yes
+                  MACAddress=52:54:00:ac:15:a9
                '';
              };
              "60-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
+
+              "50-lan-lo-phy" = {
+                matchConfig.Name = "lan-lo-phy";
+                networkConfig = {
+                  Bridge = "lan-lo";
+                } // networkd.noL3;
+              };
+              "60-lan-lo" = {
+                matchConfig.Name = "lan-lo";
+                linkConfig.RequiredForOnline = "no";
+                networkConfig = networkd.noL3;
+              };
            };
          };
        };
--- a/nixos/boxes/home/palace/vms/cellar/default.nix
+++ b/nixos/boxes/home/palace/vms/cellar/default.nix
@@ -58,6 +58,8 @@ in
              };
            };

+            networking = { inherit domain; };
+
            environment.systemPackages = with pkgs; [
              pciutils
              partclone
--- a/nixos/boxes/home/palace/vms/default.nix
+++ b/nixos/boxes/home/palace/vms/default.nix
@@ -55,21 +55,10 @@
      };
    };

-    systemd.services = {
-      "vm@cellar" = {
-        serviceConfig = {
-          CPUAffinity = "numa";
-          NUMAPolicy = "bind";
-          NUMAMask = "1";
-        };
-      };
-      "vm@river" =
-      let
-        vtapUnit = "sys-subsystem-net-devices-vm\\x2det1g0.device";
-      in
-      {
-        requires = [ vtapUnit ];
-        after = [ vtapUnit "vm@cellar.service" ];
+    systemd.services =
+    let
+      awaitCellar = {
+        after = [ "vm@cellar.service" ];
        bindsTo = [ "vm@cellar.service" ];
        preStart = ''
          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.cellar.hi.ipv4.address} 22; do
@@ -77,6 +66,28 @@
          done
        '';
      };
+    in
+    {
+      "vm@cellar" = {
+        serviceConfig = {
+          CPUAffinity = "numa";
+          NUMAPolicy = "bind";
+          NUMAMask = "1";
+        };
+      };
+
+      "vm@river" =
+      let
+        vtapUnit = "sys-subsystem-net-devices-vm\\x2det1g0.device";
+      in
+      mkMerge [
+        awaitCellar
+        {
+          requires = [ vtapUnit ];
+          after = [ vtapUnit ];
+        }
+      ];
+      "vm@sfh" = awaitCellar;
    };

    my = {
@@ -128,7 +139,7 @@
              threads = 2;
            };
            memory = 4096;
-            cleanShutdown.timeout = 120;
+            cleanShutdown.timeout = 60;
            networks = {
              et1g0 = {
                ifname = "vm-et1g0";
@@ -150,6 +161,29 @@
              };
            };
          };
+
+          sfh = {
+            uuid = "82ec149d-577c-421a-93e2-a9307c756cd8";
+            cpu = "host,topoext";
+            smp = {
+              cpus = 8;
+              threads = 2;
+            };
+            memory = 32768;
+            cleanShutdown.timeout = 120;
+            networks.netboot = {
+              bridge = "lan-lo";
+              waitOnline = "carrier";
+              mac = "52:54:00:a5:7e:93";
+              extraOptions.bootindex = 1;
+            };
+            hostDevices = {
+              et100g0vf2 = {
+                index = 0;
+                hostBDF = "44:00.3";
+              };
+            };
+          };
        };
      };
    };
--- a/nixos/boxes/home/routing-common/default.nix
+++ b/nixos/boxes/home/routing-common/default.nix
@@ -311,23 +311,36 @@ in
              };
            };
            firewall = {
-              trustedInterfaces = [ "lan-hi" "lan-lo" "as211024" ];
+              trustedInterfaces = [ "lan-hi" "lan-lo" ];
              udp.allowed = [ 5353 ];
              tcp.allowed = [ 5353 ];
              nat = {
                enable = true;
                externalInterface = "wan";
              };
-              extraRules = ''
+              extraRules =
+              let
+                aa = allAssignments;
+              in
+              ''
                table inet filter {
                  chain input {
+                    ${lib.my.c.as211024.nftTrust}
                    iifname base meta l4proto { udp, tcp } th dport domain accept
                    iifname lan-core meta l4proto vrrp accept
                  }

                  chain routing-tcp {
-                    # Safe enough to allow all SSH
-                    tcp dport ssh accept
+                    ip daddr {
+                      ${aa.castle.hi.ipv4.address},
+                      ${aa.cellar.hi.ipv4.address},
+                      ${aa.palace.hi.ipv4.address}
+                    } tcp dport ssh accept
+                    ip6 daddr {
+                      ${aa.castle.hi.ipv6.address},
+                      ${aa.cellar.hi.ipv6.address},
+                      ${aa.palace.hi.ipv6.address}
+                    } tcp dport ssh accept

                    return
                  }
@@ -346,8 +359,10 @@ in
                  }

                  chain forward {
+                    ${lib.my.c.as211024.nftTrust}
                    iifname lan-untrusted jump filter-untrusted
-                    iifname { wan, lan-untrusted } oifname { lan-hi, lan-lo } jump filter-routing
+                    iifname { wan, as211024, lan-untrusted } oifname { lan-hi, lan-lo } jump filter-routing
+                    oifname as211024 accept
                  }
                  chain output { }
                }
--- a/nixos/boxes/home/routing-common/dns.nix
+++ b/nixos/boxes/home/routing-common/dns.nix
@@ -2,6 +2,7 @@ index: { lib, pkgs, config, assignments, allAssignments, ... }:
 let
  inherit (builtins) attrNames elemAt;
  inherit (lib.my) net;
+  inherit (lib.my.c) pubDomain;
  inherit (lib.my.c.home) prefixes vips routers;

  name = elemAt routers index;
@@ -22,6 +23,7 @@ in
          owner = "pdns-recursor";
          group = "pdns-recursor";
        };
+        "home/ddclient-cloudflare.key" = {};
      };

      pdns.recursor = {
@@ -42,7 +44,7 @@ in
            "127.0.0.0/8" "::1/128"
            prefixes.hi.v4 prefixes.hi.v6
            prefixes.lo.v4 prefixes.lo.v6
-          ];
+          ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
        };

        settings = {
@@ -63,9 +65,36 @@ in
      };
    };

-    systemd.services = {
-      # Add AF_NETLINK to allow pulling IP from network interfaces
-      pdns.serviceConfig.RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+    systemd = {
+      services = {
+        # Add AF_NETLINK to allow pulling IP from network interfaces
+        pdns.serviceConfig.RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+        ddns-update = {
+          description = "DNS update script";
+          after = [ "network.target" ];
+          path = [
+            (pkgs.python3.withPackages (ps: [ ps.cloudflare ]))
+            pkgs.ldns
+          ];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart =
+              ''${./dns_update.py} -k ${config.age.secrets."home/ddclient-cloudflare.key".path} '' +
+              ''${pubDomain} ns${toString (index + 1)}.${config.networking.domain}'';
+          };
+          wantedBy = [ "multi-user.target" ];
+        };
+      };
+      timers = {
+        ddns-update = {
+          description = "Periodically update DNS";
+          wantedBy = [ "timers.target" ];
+          timerConfig = {
+            OnBootSec = "5min";
+            OnUnitInactiveSec = "5min";
+          };
+        };
+      };
    };

    environment.systemPackages = with pkgs; [
@@ -153,6 +182,11 @@ in
            dave-lo IN A ${net.cidr.host 11 prefixes.lo.v4}
            dave-lo IN AAAA ${net.cidr.host (65536+2) prefixes.lo.v6}

+            ;ap0 IN A ${net.cidr.host 12 prefixes.hi.v4}
+            ;ap0 IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
+            vibe IN A ${net.cidr.host 13 prefixes.hi.v4}
+            vibe IN AAAA ${net.cidr.host (65536+4) prefixes.hi.v6}
+
            ups IN A ${net.cidr.host 20 prefixes.lo.v4}
            palace-kvm IN A ${net.cidr.host 21 prefixes.lo.v4}

--- a/nixos/boxes/home/routing-common/dns_update.py
+++ b/nixos/boxes/home/routing-common/dns_update.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+import argparse
+import subprocess
+
+import CloudFlare
+
+def main():
+    parser = argparse.ArgumentParser(description='Cloudflare DNS update script')
+    parser.add_argument('-k', '--api-token-file', help='Cloudflare API token file')
+    parser.add_argument('zone', help='Cloudflare Zone')
+    parser.add_argument('record', help='Cloudflare record name')
+    args = parser.parse_args()
+
+    address = subprocess.check_output(
+        ['drill', '-Q', '-p5353', '@127.0.0.1', args.record, 'A'],
+        encoding='utf8').strip()
+
+    cf_token = None
+    if args.api_token_file:
+        with open(args.api_token_file) as f:
+            cf_token = f.readline().strip()
+
+    cf = CloudFlare.CloudFlare(token=cf_token)
+    zones = cf.zones.get(params={'name': args.zone})
+    assert zones, f'Zone {args.zone} not found'
+    records = cf.zones.dns_records.get(zones[0]['id'], params={'name': args.record})
+    assert records, f'Record {args.record} not found in zone {args.zone}'
+
+    print(f'Updating {args.record} -> {address}')
+    cf.zones.dns_records.patch(
+        zones[0]['id'], records[0]['id'],
+        data={'type': 'A', 'name': args.record, 'content': address})
+
+if __name__ == '__main__':
+    main()
--- a/nixos/boxes/home/routing-common/kea.nix
+++ b/nixos/boxes/home/routing-common/kea.nix
@@ -55,7 +55,7 @@ in
            }
            {
              name = "domain-search";
-              data = "${domain}, dyn.${domain}";
+              data = "${domain}, dyn.${domain}, ${lib.my.c.colony.domain}, ${lib.my.c.britway.domain}";
              always-send = true;
            }
          ];
--- a/nixos/boxes/home/routing-common/radvd.nix
+++ b/nixos/boxes/home/routing-common/radvd.nix
@@ -11,7 +11,7 @@ let
      AdvLinkMTU ${toString prefixes."${name}".mtu};
      prefix ${prefixes."${name}".v6} {};
      RDNSS ${net.cidr.host 1 prefixes."${name}".v6} ${net.cidr.host 2 prefixes."${name}".v6} {};
-      DNSSL ${domain} dyn.${domain} {};
+      DNSSL ${domain} dyn.${domain} ${lib.my.c.colony.domain} ${lib.my.c.britway.domain} {};
     };
  '';
 in
--- a/nixos/boxes/kelder/containers/spoder/default.nix
+++ b/nixos/boxes/kelder/containers/spoder/default.nix
@@ -92,7 +92,7 @@ in

          nextcloud = {
            enable = true;
-            package = pkgs.nextcloud27;
+            package = pkgs.nextcloud28;
            datadir = "/mnt/storage/nextcloud";
            hostName = "cloud.${domain}";
            https = true;
--- a/nixos/boxes/kelder/default.nix
+++ b/nixos/boxes/kelder/default.nix
@@ -135,12 +135,14 @@ in
            samba-wsdd.enable = true;

            minecraft-server = {
-              enable = true;
-              package = pkgs.minecraftServers.vanilla-1-19;
+              enable = false;
+              package = pkgs.minecraftServers.vanilla-1-20;
              declarative = true;
              eula = true;
              whitelist = {
                devplayer0 = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
+                Elderlypug = "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56";
+                shr3kas0ras = "1d366062-12c0-4e29-aba7-6ab5d8c6bb05";
              };
              serverProperties = {
                motd = "Simpcraft";
--- a/nixos/boxes/tower/default.nix
+++ b/nixos/boxes/tower/default.nix
@@ -116,6 +116,10 @@

        programs = {
          steam.enable = true;
+          wireshark = {
+            enable = true;
+            package = pkgs.wireshark-qt;
+          };
        };

        networking = {
@@ -171,6 +175,14 @@
                packages = with pkgs; [ ];
              };

+              programs = {
+                fish = {
+                  shellAbbrs = {
+                    tsup = "doas tailscale up --login-server=https://ts.nul.ie --accept-routes";
+                  };
+                };
+              };
+
              services = {
                blueman-applet.enable = true;
              };
--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -1,4 +1,4 @@
-{ lib, pkgsFlakes, hmFlakes, inputs, pkgs', config, ... }:
+{ self, lib, pkgsFlakes, hmFlakes, inputs, pkgs', config, ... }:
 let
  inherit (builtins) attrValues mapAttrs;
  inherit (lib)
@@ -25,10 +25,14 @@ let

      modules' = [ hmFlakes.${config'.home-manager}.nixosModule ] ++ (attrValues cfg.modules);
    in
-    pkgsFlake.lib.nixosSystem {
+    # Import eval-config ourselves since the flake now force-sets lib
+    import "${pkgsFlake}/nixos/lib/eval-config.nix" {
      # Gotta override lib here unforunately, eval-config.nix likes to import its own (unextended) lib. We explicitly
      # don't pass pkgs so that it'll be imported with modularly applied config and overlays.
-      lib = pkgs.lib;
+      lib = pkgs.lib.extend (lib.my.versionOverlay { inherit self pkgsFlake; });
+
+      # Set to null since we pass modularly
+      system = null;

      # Put the inputs in specialArgs to avoid infinite recursion when modules try to do imports
      specialArgs = { inherit inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
@@ -51,7 +55,7 @@ let
            pkgs' = allPkgs;
          };

-          system.name = name;
+          system = { inherit name; };
          networking = {
            domain = let d = config'.assignments.internal.domain or null; in mkIf (d != null) (mkDefault' d);
            hostName = mkDefault (config'.assignments.internal.name or name);
@@ -86,6 +90,8 @@ let
                  pkgsPath = toString pkgsFlakes.${config'.hmNixpkgs};
                  pkgs' = allPkgs;
                };
+
+                home.enableNixpkgsReleaseCheck = false;
              }
              (homeStateVersion config'.home-manager)
            ];
--- a/nixos/installer.nix
+++ b/nixos/installer.nix
@@ -32,7 +32,8 @@
          };

          isoImage = {
-            isoBaseName = "nixos-installer-devplayer0";
+            isoBaseName = "jackos-installer";
+            volumeID = "jackos-${config.system.nixos.release}-${pkgs.stdenv.hostPlatform.uname.processor}";
            edition = "devplayer0";
            appendToMenuLabel = " /dev/player0 Installer";
          };
--- a/nixos/modules/_list.nix
+++ b/nixos/modules/_list.nix
@@ -19,5 +19,6 @@
    borgthin = ./borgthin.nix;
    nvme = ./nvme;
    spdk = ./spdk.nix;
+    librespeed = ./librespeed;
  };
 }
--- a/nixos/modules/build.nix
+++ b/nixos/modules/build.nix
@@ -92,6 +92,7 @@ in
    };
    isoImage = {
      isoBaseName = dummyOption;
+      volumeID = dummyOption;
      edition = dummyOption;
      appendToMenuLabel = dummyOption;
    };
--- a/nixos/modules/common.nix
+++ b/nixos/modules/common.nix
@@ -1,7 +1,7 @@
 { lib, pkgs, pkgs', inputs, config, ... }:
 let
  inherit (lib) mkIf mkDefault mkMerge;
-  inherit (lib.my) mkBoolOpt' dummyOption;
+  inherit (lib.my) mkDefault';
 in
 {
  options = with lib.types; {
@@ -121,6 +121,11 @@ in
          services.lvm.enable = mkDefault true;
        };
      };
+      system = {
+        nixos = {
+          distroName = mkDefault' "JackOS";
+        };
+      };

      environment.systemPackages = with pkgs; mkMerge [
        [
@@ -151,6 +156,7 @@ in
              font-name=SauceCodePro Nerd Font Mono
            '';
        };
+        getty.greetingLine = mkDefault' ''<<< Welcome to ${config.system.nixos.distroName} ${config.system.nixos.label} (\m) - \l >>>'';

        openssh = {
          enable = mkDefault true;
--- a/nixos/modules/containers.nix
+++ b/nixos/modules/containers.nix
@@ -209,12 +209,16 @@ in
            mkdir -p -m 0755 "$root"/sbin "$root"/etc
            touch "$root"/etc/os-release

-            if [ -e "${containerSystem}"/prepare-root ]; then
-              initSource="${containerSystem}"/prepare-root
-            else
-              initSource="${containerSystem}"/init
-            fi
-            ln -sf "$initSource" "$root"/sbin/init
+            ${if system == sysProfile then ''
+              if [ -e "${sysProfile}"/prepare-root ]; then
+                initSource="${containerSystem}"/prepare-root
+              else
+                initSource="${containerSystem}"/init
+              fi
+              ln -sf "$initSource" "$root"/sbin/init
+            '' else ''
+              ln -sf "${containerSystem}/prepare-root" "$root"/sbin/init
+            ''}
          '';
          postStop =
          ''
--- a/nixos/modules/deploy-rs.nix
+++ b/nixos/modules/deploy-rs.nix
@@ -15,16 +15,20 @@ let
  # Based on https://github.com/serokell/deploy-rs/blob/master/flake.nix
  nixosActivate = cfg': base: (pkgs.deploy-rs.lib.activate.custom // {
    dryActivate = "$PROFILE/bin/switch-to-configuration dry-activate";
-    boot = "$PROFILE/bin/switch-to-configuration boot";
+    boot = ''
+      $PROFILE/bin/switch-to-configuration boot
+
+      ${keepGensSnippet "$PROFILE" cfg'.keepGenerations}
+    '';
  }) base.config.system.build.toplevel ''
    # work around https://github.com/NixOS/nixpkgs/issues/73404
    cd /tmp

-    "$PROFILE"/bin/switch-to-configuration ${cfg'.mode}
+    "$PROFILE"/bin/switch-to-configuration switch

    # https://github.com/serokell/deploy-rs/issues/31
    ${with base.config.boot.loader;
-    optionalString ((cfg'.mode == "switch" || cfg'.mode == "boot") && systemd-boot.enable)
+    optionalString systemd-boot.enable
    "sed -i '/^default /d' ${efi.efiSysMountPoint}/loader/loader.conf"}

    ${keepGensSnippet "$PROFILE" cfg'.keepGenerations}
@@ -59,7 +63,11 @@ let
  {
    name = "container-${n}";
    value = {
-      path = pkgs.deploy-rs.lib.activate.custom ctrConfig.my.buildAs.container ''
+      path = (pkgs.deploy-rs.lib.activate.custom // {
+        boot = ''
+          echo "Next systemd-nspawn@${n}.service restart / reload will load config"
+        '';
+      }) ctrConfig.my.buildAs.container ''
        source ${systemdUtil}/bin/systemd-util.sh
        ${if c.hotReload then ''
          if (! systemctl show -p ActiveState systemd-nspawn@${n} | grep -q "ActiveState=active") || \
--- a/nixos/modules/firewall.nix
+++ b/nixos/modules/firewall.nix
@@ -222,7 +222,7 @@ in
                "iifname ${cfg.nat.externalInterface} jump filter-iif-port-forwards"}
              ${optionalString
                dipForward
-                (concatMapStringsSep "\n    " (ip: "${ipK ip} daddr ${ip} jump ${natFilterChain ip}") (attrNames cfg.nat.forwardPorts))}
+                (concatMapStringsSep "\n    " (ip: "jump ${natFilterChain ip}") (attrNames cfg.nat.forwardPorts))}
            }
          }

--- a/nixos/modules/librespeed/default.nix
+++ b/nixos/modules/librespeed/default.nix
@@ -0,0 +1,76 @@
+{ lib, pkgs, config, ... }:
+let
+  inherit (builtins) toJSON;
+  inherit (lib) mkOption mkMerge mkIf mkDefault;
+  inherit (lib.my) mkOpt' mkBoolOpt';
+
+  cfg = config.my.librespeed;
+
+  serversConf = map (s: s // {
+    dlURL = "backend/garbage";
+    ulURL = "backend/empty";
+    pingURL = "backend/empty";
+    getIpURL = "backend/getIP";
+  }) cfg.frontend.servers;
+  frontendTree = pkgs.runCommand "librespeed-frontend" {
+    speedtestServers = toJSON serversConf;
+  } ''
+    mkdir "$out"
+    cp "${pkgs.librespeed-go}"/assets/* "$out"/
+    substitute ${./index.html} "$out"/index.html --subst-var speedtestServers
+  '';
+
+  backendConf = pkgs.writers.writeTOML "librespeed.toml" cfg.backend.settings;
+  generateBackendSettings = base: dst: if (cfg.backend.extraSettingsFile != null) then ''
+    oldUmask="$(umask)"
+    umask 006
+    cat "${base}" "${cfg.backend.extraSettingsFile}" > "${dst}"
+    umask "$oldUmask"
+  '' else ''
+    cp "${base}" "${dst}"
+  '';
+in
+{
+  options.my.librespeed = with lib.types; {
+    frontend = {
+      servers = mkOpt' (listOf (attrsOf unspecified)) { } "Server configs.";
+      webroot = mkOption {
+        description = "Frontend webroot.";
+        type = package;
+        readOnly = true;
+      };
+    };
+    backend = {
+      enable = mkBoolOpt' false "Whether to enable librespeed backend.";
+      settings = mkOpt' (attrsOf unspecified) { } "Backend settings.";
+      extraSettingsFile = mkOpt' (nullOr str) null "Extra settings file.";
+    };
+  };
+
+  config = mkMerge [
+    (mkIf (cfg.frontend.servers != { }) {
+      my.librespeed.frontend.webroot = frontendTree;
+    })
+    (mkIf cfg.backend.enable {
+      my.librespeed.backend.settings = {
+        assets_path = frontendTree;
+        database_type = mkDefault "bolt";
+        database_file = mkDefault "/var/lib/librespeed-go/speedtest.db";
+      };
+
+      systemd.services.librespeed = {
+        description = "LibreSpeed Go backend";
+        wants = [ "network-online.target" ];
+        after = [ "network-online.target" ];
+
+        preStart = generateBackendSettings backendConf "/run/librespeed-go/settings.toml";
+        serviceConfig = {
+          ExecStart = "${pkgs.librespeed-go}/bin/speedtest -c /run/librespeed-go/settings.toml";
+          RuntimeDirectory = "librespeed-go";
+          StateDirectory = "librespeed-go";
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+    })
+  ];
+}
--- a/nixos/modules/librespeed/index.html
+++ b/nixos/modules/librespeed/index.html
@@ -0,0 +1,491 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="shortcut icon" href="favicon.ico">
+<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no, user-scalable=no" />
+<meta charset="UTF-8" />
+<script type="text/javascript" src="speedtest.js"></script>
+<script type="text/javascript">
+function I(i){return document.getElementById(i);}
+
+//LIST OF TEST SERVERS. See documentation for details if needed
+var SPEEDTEST_SERVERS=@speedtestServers@;
+// var SPEEDTEST_SERVERS=[
+// 	{	//this server doesn't actually exist, remove it
+// 		name:"Example Server 1", //user friendly name for the server
+// 		server:"//test1.mydomain.com/", //URL to the server. // at the beginning will be replaced with http:// or https:// automatically
+// 		dlURL:"backend/garbage.php",  //path to download test on this server (garbage.php or replacement)
+// 		ulURL:"backend/empty.php",  //path to upload test on this server (empty.php or replacement)
+// 		pingURL:"backend/empty.php",  //path to ping/jitter test on this server (empty.php or replacement)
+// 		getIpURL:"backend/getIP.php"  //path to getIP on this server (getIP.php or replacement)
+// 	},
+// 	{	//this server doesn't actually exist, remove it
+// 		name:"Example Server 2", //user friendly name for the server
+// 		server:"//test2.example.com/", //URL to the server. // at the beginning will be replaced with http:// or https:// automatically
+// 		dlURL:"garbage.php",  //path to download test on this server (garbage.php or replacement)
+// 		ulURL:"empty.php",  //path to upload test on this server (empty.php or replacement)
+// 		pingURL:"empty.php",  //path to ping/jitter test on this server (empty.php or replacement)
+// 		getIpURL:"getIP.php"  //path to getIP on this server (getIP.php or replacement)
+// 	}
+// 	//add other servers here, comma separated
+// ];
+
+//INITIALIZE SPEEDTEST
+var s=new Speedtest(); //create speed test object
+s.setParameter("telemetry_level","basic"); //enable telemetry
+
+//SERVER AUTO SELECTION
+function initServers(){
+    var noServersAvailable=function(){
+        I("message").innerHTML="No servers available";
+    }
+    var runServerSelect=function(){
+        s.selectServer(function(server){
+            if(server!=null){ //at least 1 server is available
+                I("loading").className="hidden"; //hide loading message
+                //populate server list for manual selection
+                for(var i=0;i<SPEEDTEST_SERVERS.length;i++){
+                    if(SPEEDTEST_SERVERS[i].pingT==-1) continue;
+                    var option=document.createElement("option");
+                    option.value=i;
+                    option.textContent=SPEEDTEST_SERVERS[i].name;
+                    if(SPEEDTEST_SERVERS[i]===server) option.selected=true;
+                    I("server").appendChild(option);
+                }
+                //show test UI
+                I("testWrapper").className="visible";
+                initUI();
+            }else{ //no servers are available, the test cannot proceed
+                noServersAvailable();
+            }
+        });
+    }
+    if(typeof SPEEDTEST_SERVERS === "string"){
+        //need to fetch list of servers from specified URL
+        s.loadServerList(SPEEDTEST_SERVERS,function(servers){
+            if(servers==null){ //failed to load server list
+                noServersAvailable();
+            }else{ //server list loaded
+                SPEEDTEST_SERVERS=servers;
+                runServerSelect();
+            }
+        });
+    }else{
+        //hardcoded server list
+        s.addTestPoints(SPEEDTEST_SERVERS);
+        runServerSelect();
+    }
+}
+
+var meterBk=/Trident.*rv:(\d+\.\d+)/i.test(navigator.userAgent)?"#EAEAEA":"#80808040";
+var dlColor="#6060AA",
+	ulColor="#616161";
+var progColor=meterBk;
+
+//CODE FOR GAUGES
+function drawMeter(c,amount,bk,fg,progress,prog){
+	var ctx=c.getContext("2d");
+	var dp=window.devicePixelRatio||1;
+	var cw=c.clientWidth*dp, ch=c.clientHeight*dp;
+	var sizScale=ch*0.0055;
+	if(c.width==cw&&c.height==ch){
+		ctx.clearRect(0,0,cw,ch);
+	}else{
+		c.width=cw;
+		c.height=ch;
+	}
+	ctx.beginPath();
+	ctx.strokeStyle=bk;
+	ctx.lineWidth=12*sizScale;
+	ctx.arc(c.width/2,c.height-58*sizScale,c.height/1.8-ctx.lineWidth,-Math.PI*1.1,Math.PI*0.1);
+	ctx.stroke();
+	ctx.beginPath();
+	ctx.strokeStyle=fg;
+	ctx.lineWidth=12*sizScale;
+	ctx.arc(c.width/2,c.height-58*sizScale,c.height/1.8-ctx.lineWidth,-Math.PI*1.1,amount*Math.PI*1.2-Math.PI*1.1);
+	ctx.stroke();
+	if(typeof progress !== "undefined"){
+		ctx.fillStyle=prog;
+		ctx.fillRect(c.width*0.3,c.height-16*sizScale,c.width*0.4*progress,4*sizScale);
+	}
+}
+function mbpsToAmount(s){
+	return 1-(1/(Math.pow(1.3,Math.sqrt(s))));
+}
+function format(d){
+    d=Number(d);
+    if(d<10) return d.toFixed(2);
+    if(d<100) return d.toFixed(1);
+    return d.toFixed(0);
+}
+
+//UI CODE
+var uiData=null;
+function startStop(){
+    if(s.getState()==3){
+		//speed test is running, abort
+		s.abort();
+		data=null;
+		I("startStopBtn").className="";
+		I("server").disabled=false;
+		initUI();
+	}else{
+		//test is not running, begin
+		I("startStopBtn").className="running";
+		I("shareArea").style.display="none";
+		I("server").disabled=true;
+		s.onupdate=function(data){
+            uiData=data;
+		};
+		s.onend=function(aborted){
+            I("startStopBtn").className="";
+            I("server").disabled=false;
+            updateUI(true);
+            if(!aborted){
+                //if testId is present, show sharing panel, otherwise do nothing
+                try{
+                    var testId=uiData.testId;
+                    if(testId!=null){
+                        var shareURL=window.location.href.substring(0,window.location.href.lastIndexOf("/"))+"/results/?id="+testId;
+                        I("resultsImg").src=shareURL;
+                        I("resultsURL").value=shareURL;
+                        I("testId").innerHTML=testId;
+                        I("shareArea").style.display="";
+                    }
+                }catch(e){}
+            }
+		};
+		s.start();
+	}
+}
+//this function reads the data sent back by the test and updates the UI
+function updateUI(forced){
+	if(!forced&&s.getState()!=3) return;
+	if(uiData==null) return;
+	var status=uiData.testState;
+	I("ip").textContent=uiData.clientIp;
+	I("dlText").textContent=(status==1&&uiData.dlStatus==0)?"...":format(uiData.dlStatus);
+	drawMeter(I("dlMeter"),mbpsToAmount(Number(uiData.dlStatus*(status==1?oscillate():1))),meterBk,dlColor,Number(uiData.dlProgress),progColor);
+	I("ulText").textContent=(status==3&&uiData.ulStatus==0)?"...":format(uiData.ulStatus);
+	drawMeter(I("ulMeter"),mbpsToAmount(Number(uiData.ulStatus*(status==3?oscillate():1))),meterBk,ulColor,Number(uiData.ulProgress),progColor);
+	I("pingText").textContent=format(uiData.pingStatus);
+	I("jitText").textContent=format(uiData.jitterStatus);
+}
+function oscillate(){
+	return 1+0.02*Math.sin(Date.now()/100);
+}
+//update the UI every frame
+window.requestAnimationFrame=window.requestAnimationFrame||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||window.msRequestAnimationFrame||(function(callback,element){setTimeout(callback,1000/60);});
+function frame(){
+	requestAnimationFrame(frame);
+	updateUI();
+}
+frame(); //start frame loop
+//function to (re)initialize UI
+function initUI(){
+	drawMeter(I("dlMeter"),0,meterBk,dlColor,0);
+	drawMeter(I("ulMeter"),0,meterBk,ulColor,0);
+	I("dlText").textContent="";
+	I("ulText").textContent="";
+	I("pingText").textContent="";
+	I("jitText").textContent="";
+	I("ip").textContent="";
+}
+</script>
+<style type="text/css">
+	html,body{
+		border:none; padding:0; margin:0;
+		background:#FFFFFF;
+		color:#202020;
+	}
+	body{
+		text-align:center;
+		font-family:"Roboto",sans-serif;
+	}
+	h1{
+		color:#404040;
+	}
+	#loading{
+		background-color:#FFFFFF;
+		color:#404040;
+		text-align:center;
+	}
+	span.loadCircle{
+		display:inline-block;
+		width:2em;
+		height:2em;
+		vertical-align:middle;
+		background:url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMAAAD04JH5AAAAP1BMVEUAAAB2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZyFzwnAAAAFHRSTlMAEvRFvX406baecwbf0casimhSHyiwmqgAAADpSURBVHja7dbJbQMxAENRahnN5lkc//5rDRAkDeRgHszXgACJoKiIiIiIiIiIiIiIiIiIiIj4HHspsrpAVhdVVguzrA4OWc10WcEqpwKbnBo0OU1Q5NSpsoJFTgOecrrdEag85DRgktNqfoEdTjnd7hrEHMEJvmRUYJbTYk5Agy6nau6Abp5Cm7mDBtRdPi9gyKdU7w4p1fsLvyqs8hl4z9/w3n/Hmr9WoQ65lAU4d7lMYOz//QboRR5jBZibLMZdAR6O/Vfa1PlxNr3XdS3HzK/HVPRu/KnLs8iAOh993VpRRERERMT/fAN60wwWaVyWwAAAAABJRU5ErkJggg==');
+		background-size:2em 2em;
+		margin-right:0.5em;
+		animation: spin 0.6s linear infinite;
+	}
+	@keyframes spin{
+		0%{transform:rotate(0deg);}
+		100%{transform:rotate(359deg);}
+	}
+	#startStopBtn{
+		display:inline-block;
+		margin:0 auto;
+		color:#6060AA;
+		background-color:rgba(0,0,0,0);
+		border:0.15em solid #6060FF;
+		border-radius:0.3em;
+		transition:all 0.3s;
+		box-sizing:border-box;
+		width:8em; height:3em;
+		line-height:2.7em;
+		cursor:pointer;
+		box-shadow: 0 0 0 rgba(0,0,0,0.1), inset 0 0 0 rgba(0,0,0,0.1);
+	}
+	#startStopBtn:hover{
+		box-shadow: 0 0 2em rgba(0,0,0,0.1), inset 0 0 1em rgba(0,0,0,0.1);
+	}
+	#startStopBtn.running{
+		background-color:#FF3030;
+		border-color:#FF6060;
+		color:#FFFFFF;
+	}
+	#startStopBtn:before{
+		content:"Start";
+	}
+	#startStopBtn.running:before{
+		content:"Abort";
+	}
+	#serverArea{
+		margin-top:1em;
+	}
+	#server{
+		font-size:1em;
+		padding:0.2em;
+	}
+	#test{
+		margin-top:2em;
+		margin-bottom:12em;
+	}
+	div.testArea{
+		display:inline-block;
+		width:16em;
+		height:12.5em;
+		position:relative;
+		box-sizing:border-box;
+	}
+	div.testArea2{
+		display:inline-block;
+		width:14em;
+		height:7em;
+		position:relative;
+		box-sizing:border-box;
+		text-align:center;
+	}
+	div.testArea div.testName{
+		position:absolute;
+		top:0.1em; left:0;
+		width:100%;
+		font-size:1.4em;
+		z-index:9;
+	}
+	div.testArea2 div.testName{
+        display:block;
+        text-align:center;
+        font-size:1.4em;
+	}
+	div.testArea div.meterText{
+		position:absolute;
+		bottom:1.55em; left:0;
+		width:100%;
+		font-size:2.5em;
+		z-index:9;
+	}
+	div.testArea2 div.meterText{
+        display:inline-block;
+        font-size:2.5em;
+	}
+	div.meterText:empty:before{
+		content:"0.00";
+	}
+	div.testArea div.unit{
+		position:absolute;
+		bottom:2em; left:0;
+		width:100%;
+		z-index:9;
+	}
+	div.testArea2 div.unit{
+		display:inline-block;
+	}
+	div.testArea canvas{
+		position:absolute;
+		top:0; left:0; width:100%; height:100%;
+		z-index:1;
+	}
+	div.testGroup{
+		display:block;
+        margin: 0 auto;
+	}
+	#shareArea{
+		width:95%;
+		max-width:40em;
+		margin:0 auto;
+		margin-top:2em;
+	}
+	#shareArea > *{
+		display:block;
+		width:100%;
+		height:auto;
+		margin: 0.25em 0;
+	}
+	#privacyPolicy{
+        position:fixed;
+        top:2em;
+        bottom:2em;
+        left:2em;
+        right:2em;
+        overflow-y:auto;
+        width:auto;
+        height:auto;
+        box-shadow:0 0 3em 1em #000000;
+        z-index:999999;
+        text-align:left;
+        background-color:#FFFFFF;
+        padding:1em;
+	}
+	a.privacy{
+        text-align:center;
+        font-size:0.8em;
+        color:#808080;
+        padding: 0 3em;
+	}
+    div.closePrivacyPolicy {
+        width: 100%;
+        text-align: center;
+    }
+    div.closePrivacyPolicy a.privacy {
+        padding: 1em 3em;
+    }
+	@media all and (max-width:40em){
+		body{
+			font-size:0.8em;
+		}
+	}
+	div.visible{
+		animation: fadeIn 0.4s;
+		display:block;
+	}
+	div.hidden{
+		animation: fadeOut 0.4s;
+		display:none;
+	}
+	@keyframes fadeIn{
+		0%{
+			opacity:0;
+		}
+		100%{
+			opacity:1;
+		}
+	}
+	@keyframes fadeOut{
+		0%{
+			display:block;
+			opacity:1;
+		}
+		100%{
+			display:block;
+			opacity:0;
+		}
+	}
+</style>
+<title>/dev/player0's speedtest</title>
+</head>
+<body onload="initServers()">
+<h1>/dev/player0's speedtest</h1>
+<div id="loading" class="visible">
+	<p id="message"><span class="loadCircle"></span>Selecting a server...</p>
+</div>
+<div id="testWrapper" class="hidden">
+	<div id="startStopBtn" onclick="startStop()"></div><br/>
+	<a class="privacy" href="#" onclick="I('privacyPolicy').style.display=''">Privacy</a>
+	<div id="serverArea">
+		Server: <select id="server" onchange="s.setSelectedServer(SPEEDTEST_SERVERS[this.value])"></select>
+	</div>
+	<div id="test">
+		<div class="testGroup">
+            <div class="testArea2">
+				<div class="testName">Ping</div>
+				<div id="pingText" class="meterText" style="color:#AA6060"></div>
+				<div class="unit">ms</div>
+			</div>
+			<div class="testArea2">
+				<div class="testName">Jitter</div>
+				<div id="jitText" class="meterText" style="color:#AA6060"></div>
+				<div class="unit">ms</div>
+			</div>
+		</div>
+		<div class="testGroup">
+			<div class="testArea">
+				<div class="testName">Download</div>
+				<canvas id="dlMeter" class="meter"></canvas>
+				<div id="dlText" class="meterText"></div>
+				<div class="unit">Mbit/s</div>
+			</div>
+			<div class="testArea">
+				<div class="testName">Upload</div>
+				<canvas id="ulMeter" class="meter"></canvas>
+				<div id="ulText" class="meterText"></div>
+				<div class="unit">Mbit/s</div>
+			</div>
+		</div>
+		<div id="ipArea">
+			<span id="ip"></span>
+		</div>
+		<div id="shareArea" style="display:none">
+			<h3>Share results</h3>
+			<p>Test ID: <span id="testId"></span></p>
+			<input type="text" value="" id="resultsURL" readonly="readonly" onclick="this.select();this.focus();this.select();document.execCommand('copy');alert('Link copied')"/>
+			<img src="" id="resultsImg" />
+		</div>
+	</div>
+	<a href="https://github.com/librespeed/speedtest">Source code</a>
+</div>
+<div id="privacyPolicy" style="display:none">
+    <h2>Privacy Policy</h2>
+    <p>This HTML5 speed test server is configured with telemetry enabled.</p>
+    <h4>What data we collect</h4>
+    <p>
+        At the end of the test, the following data is collected and stored:
+        <ul>
+            <li>Test ID</li>
+            <li>Time of testing</li>
+            <li>Test results (download and upload speed, ping and jitter)</li>
+            <li>IP address</li>
+            <li>ISP information</li>
+            <li>Approximate location (inferred from IP address, not GPS)</li>
+            <li>User agent and browser locale</li>
+            <li>Test log (contains no personal information)</li>
+        </ul>
+    </p>
+    <h4>How we use the data</h4>
+    <p>
+        Data collected through this service is used to:
+        <ul>
+            <li>Allow sharing of test results (sharable image for forums, etc.)</li>
+            <li>To improve the service offered to you (for instance, to detect problems on our side)</li>
+        </ul>
+        No personal information is disclosed to third parties.
+    </p>
+    <h4>Your consent</h4>
+    <p>
+        By starting the test, you consent to the terms of this privacy policy.
+    </p>
+    <h4>Data removal</h4>
+    <p>
+        If you want to have your information deleted, you need to provide either the ID of the test or your IP address. This is the only way to identify your data, without this information we won't be able to comply with your request.<br/><br/>
+        Contact this email address for all deletion requests: <a href="mailto:dev@nul.ie">dev@nul.ie</a>.
+    </p>
+    <br/><br/>
+    <div class="closePrivacyPolicy">
+        <a class="privacy" href="#" onclick="I('privacyPolicy').style.display='none'">Close</a>
+    </div>
+    <br/>
+</div>
+</body>
+</html>
--- a/nixos/modules/tmproot.nix
+++ b/nixos/modules/tmproot.nix
@@ -480,6 +480,18 @@ in
      (mkIf config.services.tailscale.enable {
        my.tmproot.persistence.config.directories = [ "/var/lib/tailscale" ];
      })
+      (mkIf config.my.librespeed.backend.enable {
+        my.tmproot.persistence.config.directories = [ "/var/lib/librespeed-go" ];
+      })
+      (mkIf config.services.hedgedoc.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/hedgedoc";
+            user = "hedgedoc";
+            group = "hedgedoc";
+          }
+        ];
+      })
    ]))
  ]);

--- a/nixos/modules/vms.nix
+++ b/nixos/modules/vms.nix
@@ -116,7 +116,7 @@ let
        });
        default = { };
      };
-      drives = mkOpt' (listOf (submodule driveOpts)) { } "Drives to attach to VM.";
+      drives = mkOpt' (listOf (submodule driveOpts)) [ ] "Drives to attach to VM.";
      hostDevices = mkOpt' (attrsOf (submodule hostDevOpts)) { } "Host PCI devices to pass to the VM.";
    };
  };
@@ -126,8 +126,8 @@ let
      (map
        (i: mapAttrsToList (name: c: c // { inherit name; }) i.hostDevices)
        (attrValues cfg.instances));
-  anyVfioDevs = any (d: d.bindVFIO) allHostDevs;
-  vfioHostDevs = filter (d: d.bindVFIO) allHostDevs;
+  anyVfioDevs = any (d: d.bindVFIO);
+  vfioHostDevs = filter (d: d.bindVFIO);

  mkQemuScript = n: i:
  let
@@ -204,7 +204,7 @@ in
    services.udev = {
      packages =
        optionals
-          anyVfioDevs
+          (anyVfioDevs allHostDevs)
          [
            pkgs.vfio-pci-bind
            (pkgs.writeTextDir
@@ -212,7 +212,7 @@ in
              (concatMapStringsSep
                "\n"
                (d: ''ACTION=="add", SUBSYSTEM=="pci", KERNEL=="0000:${d.hostBDF}", TAG="vfio-pci-bind"'')
-                vfioHostDevs))
+                (vfioHostDevs allHostDevs)))
          ];
    };

@@ -261,12 +261,15 @@ in
          };

          preStart =
+          let
+            hostDevs = attrValues i.hostDevices;
+          in
            ''
              if [ ! -e "$STATE_DIRECTORY"/ovmf_vars.bin ]; then
                cp "${cfg.ovmfPackage.fd}"/FV/OVMF_VARS.fd "$STATE_DIRECTORY"/ovmf_vars.bin
              fi

-              ${optionalString anyVfioDevs ''
+              ${optionalString (anyVfioDevs hostDevs) ''
                iommu_group() {
                  g=/sys/bus/pci/devices/0000:$1/iommu_group
                  until [ -e $g ]; do
@@ -280,7 +283,7 @@ in
                  done
                }

-                ${concatMapStringsSep "\n" (d: "wait_vfio ${d.hostBDF}") vfioHostDevs}
+                ${concatMapStringsSep "\n" (d: "wait_vfio ${d.hostBDF}") (vfioHostDevs hostDevs) }
              ''}
            '';
          script = mkQemuScript n i;
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -6,4 +6,6 @@ in
  # yeah turns out this is in nixpkgs now... we'll leave it as a sample i guess lol
  monocraft' = callPackage ./monocraft.nix { };
  vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
+  librespeed-go = callPackage ./librespeed-go.nix { };
+  modrinth-app = callPackage ./modrinth-app { };
 }
--- a/pkgs/librespeed-go.nix
+++ b/pkgs/librespeed-go.nix
@@ -0,0 +1,26 @@
+{ lib, fetchFromGitHub, buildGoModule, ... }:
+let
+  webSrc = fetchFromGitHub {
+    owner = "librespeed";
+    repo = "speedtest";
+    rev = "5.3.0";
+    hash = "sha256-OgKGLQcfWX/sBLzaHI6TcJHxX1Wol6K7obLf0+CHrC8=";
+  };
+in
+buildGoModule rec {
+  pname = "librespeed-go";
+  version = "1.1.5";
+
+  src = fetchFromGitHub {
+    owner = "librespeed";
+    repo = "speedtest-go";
+    rev = "v${version}";
+    hash = "sha256-ywGrodl/mj/WB25F0TKVvaV0PV4lgc+KEj0x/ix9HT8=";
+  };
+  vendorHash = "sha256-ev5TEv8u+tx7xIvNaK8b5iq2XXF6I37Fnrr8mb+N2WM=";
+
+  postInstall = ''
+    mkdir -p "$out"/assets
+    cp "${webSrc}"/{speedtest.js,speedtest_worker.js,favicon.ico} "$out"/assets/
+  '';
+}
--- a/pkgs/modrinth-app/Cargo.lock
+++ b/pkgs/modrinth-app/Cargo.lock
--- a/pkgs/modrinth-app/default.nix
+++ b/pkgs/modrinth-app/default.nix
@@ -0,0 +1,97 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, openssl
+, libsoup
+, dbus
+, glib
+, glib-networking
+, gtk3
+, webkitgtk
+, libayatana-appindicator
+, librsvg
+, wrapGAppsHook
+, stdenvNoCC
+, jq
+, moreutils
+, nodePackages
+, cacert
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "modrinth-app";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "modrinth";
+    repo = "theseus";
+    rev = "v${version}";
+    hash = "sha256-gFQXcTqHgSKfne6+v837ENXYYiEYu/Yks9TpnfBCPnA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "tauri-plugin-single-instance-0.0.0" = "sha256-G4h2OXKPpZMmradutdUWxGG5axL9XMz2ACAe8AQ40eg=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    nodePackages.pnpm
+    wrapGAppsHook
+  ];
+  buildInputs = [
+    openssl
+    libsoup
+    dbus
+    glib
+    glib-networking
+    gtk3
+    webkitgtk
+    libayatana-appindicator
+    librsvg
+  ];
+
+  pnpm-deps = stdenvNoCC.mkDerivation {
+    pname = "${pname}-pnpm-deps";
+    inherit src version;
+
+    sourceRoot = "${src.name}/theseus_gui";
+
+    nativeBuildInputs = [
+      jq
+      moreutils
+      nodePackages.pnpm
+      cacert
+    ];
+
+    installPhase = ''
+      export HOME=$(mktemp -d)
+      pnpm config set store-dir $out
+      pnpm install --ignore-scripts
+
+      # Remove timestamp and sort the json files
+      rm -rf $out/v3/tmp
+      for f in $(find $out -name "*.json"); do
+        sed -i -E -e 's/"checkedAt":[0-9]+,//g' $f
+        jq --sort-keys . $f | sponge $f
+      done
+    '';
+
+    dontFixup = true;
+    outputHashMode = "recursive";
+    outputHash = "sha256-9HtTdIotG3sNIlWhd76v7Ia6P69ufp/FFqZfINXSkVc=";
+  };
+
+  preBuild = ''
+    cd theseus_gui
+    export HOME=$(mktemp -d)
+    pnpm config set store-dir ${pnpm-deps}
+    pnpm install --ignore-scripts --offline
+    chmod -R +w node_modules
+    pnpm rebuild
+    pnpm build
+    cd ..
+  '';
+}
--- a/secrets/britway/bgp-password-vultr.conf.age
+++ b/secrets/britway/bgp-password-vultr.conf.age
@@ -1,12 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyB0NVZU
-L1Q2VGhoemx5VEV2OTNSMXdGeWRJWDZoOURTN1c3Y21WQlp2UjI4ClVGSUtSZU0y
-azQxMHFIOCtMRkx4c3pwdmFFN0dUWW13TU1kazAyVldkWVEKLT4gWDI1NTE5IHp4
-c1VWTGNIZGZQeUFXQkJLZkt0UjE3RUpqK2pTaUlmZUtpMWJVOTVaa1kKdmZ6MEx0
-bVQrRFk0b1VsUWYzMjNxTjlpTHNsTW9hRXlnVWdMOXp5T2ExOAotPiBALWdyZWFz
-ZSBafCVXUyBCUkdhKgpNcndIWHlSZ28vMTJYaEV0aE1kN3I4UVZaSitBcTRCaHRa
-cS9LdDBLdWV6TmJuTW5ZZjF3V1N4MEVIRDYvbWR3CmlzY2ZBdk90UGhSSlJnCi0t
-LSBBeVNxZTFTMEppQ0pzUGxPdFpsSHNGYjMxSFRab2I4bjhxMFlsaFAxU2c0CnX1
-ZtpdilXnmp5QlmptYO6BxLO+sK5CiuwofsKwo+rpMxK6Qqk/cFOuPQaDIK9AfEir
-Ug==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBJYzdr
+b1d2aEtVd3lVb3NBamRwVFpTaTRjZFlCczk4MVIwQUoxWklwN0NrCmFFekpPYUlO
+YlgvVlQ2WDR6amZDN0ZSY0Q3WWtTME5pUmhQeks1c3dGOVUKLT4gWDI1NTE5IHVK
+bUZvUVAvL0NmQzFkY3BuYm1wMjcwbFpLRUNpZjJCaW15SEVDUDV0REkKRXFMQ2d1
+NlFBejBvTlJrcUtCYWZxSDBkbmxIdExBNTU0aC8zRW5OVWllVQotPiBDLWdyZWFz
+ZSBkeC4oTFUgO0FtJG9+RyB2IF1QXGhxVwpJS213MXBRMWY1cXlHZwotLS0gRUF2
+ZkswNlhvcDhTc2tybCs1dldwa2l6SDZZVmNkNUNjNGlkV1ZVa09pOAp88dxHGxVU
+vuFQO6JcroY9MF5Te/YV+wMc3hVxksibMnH1TWGh207prwcOWNOEz2iEkZY=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/britway/cloudflare-credentials.conf.age
+++ b/secrets/britway/cloudflare-credentials.conf.age
@@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBWQ2Iy
-UFo2dzVVdzBFbElLbitVT1Z3cUFFRFdpTHkwWENQMUxzdm5mMlNNCmpqUW90M3Zz
-amZXS3JyUlVrVjBCMVB5SE1HYk1FS3VwU1hvdExzS1JZT0UKLT4gWDI1NTE5IGFG
-YVVUR2pCOFp5WWdiY2Q0dlFyRXJadEJDN0V5ZWt1cU1MY2lHaEl2eG8KZSs0L0F4
-NHMvRXpDdEFnUlowMzQyNndiWWRjSjdFdHNxU3Zsck9LNGwrawotPiBEVC1ncmVh
-c2UgRXl1Uj93IUkKeUZLQnBQdDduOEtRME1VdEJvWWRBcUlCWE1iazUrSUQrZENR
-K0JJdzBBCi0tLSBwOHVCd3FuWE80amtVYUxMbGJMak1iemlpd1YyRFMvdm9YYTY2
-d2J4WDNzCkBAMUebYSOLa3BC3Jqcg+Z9FpZ5fdTrmYnoSDwe/OrCHNAY6Hb815IV
-UJrruBfak4TUnWnTMM//elXHO3r45QuFvQ/PKg2MvaIB32vlF+AUKzq0V49blJkp
-bdkPAt4ZiQ4ALnlrX9iaoseOa/MyZ4sv8EVcMfhRkBXurUkiGpf9GsbAntzkMZ5I
-J+ovcxN7EfvsBlB01FADEji9JSqDcNmQoGf5JGJVA9qZqf3JpLzAw65+Kr+klTEv
-eQGlyK9ofbMWpyWSa7dP+dt0Hn20kGRvnfTxhhIRwqFeGr7jrNAgCGsFhnC0nIx2
-Ng==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBLVlg2
+ZUdtUlFUQXBLT3B5YmkycWJnMXJyKzltbyt6K2dJK1RBUm5ydWwwCmRUdjJFSEYz
+Wnp4cGtzTXZwc0s0SUJQUjRlOUJlQUoyQ3BETXZmY0ppWG8KLT4gWDI1NTE5IGR5
+QUJzeG1DQTRLUmRwNnNSRUJRSFFtUDl5VjB0clVLYUp3R1g4TEVKaTgKb09tVlhF
+R0tmcmIxMHVHcG80RGxRTEhBcngvT3MrdnNPbmpCTlRyZW5xQQotPiA6RzEtZ3Jl
+YXNlCldSUlN2ejB0MGpyUHYzNS9OQmJTK3MvcXRDakdBVlhuUEt6SFE4QmhnWVN0
+V1JMOE1oaEp5QQotLS0gYW1OMTcxNWJrUndmR2h0ZmRDWk5CYnJjc29pSERUMnNk
+d2VhTGdpOW4yUQrEeH2E9m0YycuW60QrdlRetO1kNU5FaKXRQt46iA9lACIWD4rC
+Cx6WxhCBgz3hvm9x6iuYiiQxZzgJNK7qXcV2MBeQdivazeEbC7blAKVPhwD/dl+b
+PzBDXRXG3c3jMjeZFT69fIBGJfZrrLGKpTALVE4dTVXmQmVVQDTp19IC+jUXHBti
+Pj6Dpc7452s8zPkzZyRbasO9b4PYTwq8IHT6X7ITwbzZZm8gexDYe2SzRZ5VcPz3
+El+yoULZ92WbXPSQIP/Slx4BEZjmsQS+sm0N8AnBRNZkWVbHPF9IZRg3VjDAn2i8
+F3un5js=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/britway/oidc-secret.txt.age
+++ b/secrets/britway/oidc-secret.txt.age
@@ -1,10 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBKTVNl
-SlJQRkNqTnBjcUlXTVJSWTRaMlJTR1ViVzJLenBweFAweEY3WmpjClZSWVBibzNQ
-MUl0c3VheVZzV3phTkwxZTR3ejN6djVkMjRoUXVKekcveW8KLT4gWDI1NTE5IEM4
-cFFCM0ZjWkxFOVJ0QTFWcnVpVUFzSWF3WmhKdURCYzdBeDNyc3FUUkkKTFhzc1Bv
-WXBYRjNiRTZvMmI3Qllwd3I1N3hoMitxNmRJeHhjYm04T1piUQotPiA4R0NiQnJN
-Xy1ncmVhc2UgbUgyCnBsdVZoRFNHNm1CM1p3Ci0tLSBlZE1kdTUrM2xKQlpiRldK
-U1hvOXowVldLU3dibk5OcmVWOWlycmpMTGh3CugYtkmSIjhT3wjoKm+YxFNFzQ5n
-pUYfHJCdliy+KsutFEHl10pKZhCpHTAxVcMMq2H2sL5mEePyugW6q0+AofKzIQI=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAyMWox
+cEFDWWUrVzJSM1o2azJqei9HV2xFY25oQXV5SzM3akxEaUJiN1J3CjkrQVhjWHY5
+Uk01eGp5Q0RKNVREVXJVZytndTM0SXNZSGIvUVp1TnRiNXMKLT4gWDI1NTE5IFZn
+WjAyR1RMajEyMnFSYnNGT2EyekROVWNoakFJQVZxaFc0YThOMHVyanMKWldrdlAv
+cVg0OTFHL2loeGJ3RHA0MnlnckN3czF4RUgyc1NjYXVOSXF5cwotPiBvTFQtZ3Jl
+YXNlIDRsSDp6eikgT1ojIGEzOFZMIFc3MUZGCkttZ3ZLNGxucnlJc01kRXFZTGpC
+eCsvRzl5WnFUMUIyTWNVWGk4SjQyN3V0bXQ4VzFuM1RjSzVMcDJkaW1JYXMKQkE4
+YWI1Mmg3MkpjdVpVYWJkczJQMnM1SVMvNkZhOXBDVEZPCi0tLSB3SVIyU3M5RHBE
+VFRtMFU4OUFLbkNjbkJmVmhlc2VsYzdsd0pFaFkrUmkwCs+h2KlXoyZ8U++A9wmV
+kh4N2YyI/a84yPGDNoFdSlXaU8jxUzolnadImXSXyB4CroqQLvGEbkZZlWqPLVfh
+Iav7Ja8=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/nul.ie.signing.key.age
+++ b/secrets/chatterbox/nul.ie.signing.key.age
@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USArNWJI
-WWpNZ2RuemtOSTd1U2swVTFZUmZMQ3I1VTFiM1JsMitoSFVyckFzCktiWHhHQWJG
-OVV1QVluRi8yUk9vSjRheGxZaDVaaGtUSGRqeDhaS0lqQTQKLT4gWDI1NTE5IDhi
-d2lZMVkrQUtJRi9UdEw0dTRoQ2pRSjc0bVBWc0xHK045bGk3MEgzQWMKcFc1LzNI
-UHl6dnFsSDlyeXYwYmh2QWRFSmJFOHJRSjl6cGJJWG1FRVJDYwotPiAwTXNKYi1n
-cmVhc2UgIylcYV9HfSBDU1UgWCN1QF1lKSBAfDMKdDNaN0hKT0pLWkV3UGVZMFcx
-ZGxjS0lOTk5PdThlVVoyODJRYkRlS1M5YlNOaENEcTBIVWdRCi0tLSBla0NHY0d3
-TlZqUmRuendMRjl3TDlFWVBJWjRTbVgzV1hvWTFzU3dXdzBvCmSJpkzCXd6GZ5Is
-IFnOoJHc3ZcKEgedO7s4lDi2csn/ctgRN/IV0RQXZaTgTSAdVmsURgjvepd5w0F7
-3M63Y7m5FrhXMzLvAAGvhe+a9v+3R4pSjGjWz/xVNfc=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB2WFY2
+MzFnVFYvb0wzc3grRDBrUi9teW1tNmx5dVBIRVc5OUdlcjdvTDJFCmpJL2tlYXND
+bVJKbzd2S3JkSFVMdG40MS84V0lPTVJSNHVBQlNXSkN1eTAKLT4gWDI1NTE5IFBM
+ZGo3L2VlNUZqOEE1UHBuMHdqc1pyYlQ3R29ucE9pajU0bHMzamlXRDAKcG1Qdmw2
+cUlncDFWNXBOWnpIeDNZSFA3d1E1bjNaVVpKU3lMRjRaSHNtMAotPiB2XUh8eF4t
+Z3JlYXNlICUrO0cxIH4gaTRoIF81SEpTN0Q5CnpWdEZpb1hZa2t5YkE5RnJFMHVZ
+WkhkQ2o0eWtyOE9ueDJkeGd2aUhmLzRUUGs1aUc1NURIOTYxczZhOEVmT0EKd2xk
+TXFHN051d25PQmtNUVZkVEFGUVliZjdmZDF3RWFkaEhNTzd3ZVd5N3dlNzQKLS0t
+IGZDR1Mxd24zOW05bitzQnN5WWVOOGtCNEc5aXIraEF4eXFUQm5CZUdCV2MKd44C
+/Trgg0OEZ89/jqbj56z/Hia1Ka3ZsEv6bXPI/kcRvFDBFTgtvG3KWCgMBtTUHXzY
+TKBPoQqrUf7plH7a/mTx3KR+4Y+yF+1i86s7TzYjD8d1xfFH3BsVtg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/synapse.yaml.age
+++ b/secrets/chatterbox/synapse.yaml.age
@@ -1,30 +1,30 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBQL3lx
-TmpBdFo1aCtDVTZyc0JpdVZMbHk3aHBZYlUxSldQUkhkZjVnZVVVCml3TUQ1WVdJ
-TjhLaWxtN0RHdDRoQUZpT1FDdFp0d3FTZ09KOWRLNmNCNkkKLT4gWDI1NTE5IGVO
-L3V2cVMxL3BTQllQVnE0eWVud1oyU2lNT2RubW9JalROODliRU5RRDQKSHVrSHRT
-RlNOZnloVXZQaUtTVlAveEFKN21MR0FjYSt1b2NqcERWVGNHcwotPiBWTT5tLWdy
-ZWFzZSBZSlMzbiBZIHxEU1BvbDkxCmFUNzV0MVZXUi96M0xUbm4rR0ttT2NrWHRa
-anJ1NW5GSzJ3LzVNbUliaVNDRElwS0dVcXh3aWNZOEt6Q28yMzQKdjFjdC9WUE13
-SUdkdTVzOVY4ZmhJMjQ0V1N3Z0J4UHQva1dJWExQakhGY2VjK0NMdExoMFBQZllt
-ajRuUncKLS0tIExudTFlMFNsWmx6NERkbkdIc1J3OUwzK3MrWUpHUElCaU9aQWxI
-bjV6STAKj7J1KMingidOobIjZvEbIm9PMlfjuJ8mTO1uVMke8YpcBwqOf9Ydj39b
-lixepIKpnt5BDjI7f6YjDT1GZsRxj7Q0/EEvMwFtrgDrW9iU3hYf2VqPxFGZCvWL
-N4XG6DkyqpxdCNJNhpt6cCfnOX/oKesuMiraEFPzyVAyqWgOhQXYcQiF+g6yE1p5
-o3FtSTPBeBkNk5N4mIyO9f1S/OrheHIrVkyTa7mClIOqnzjBmPv+VMfEfcV90ONd
-4SwueTgU3s647DtKJkW25gteB3UXWGArjLVOvmaBOCFmAr6zPlsSJDLkfGxmL7K1
-Ojs0mRmybpKIRA6iDMs4l7G+cjVwJZSRx4LTsa4rPpppgMJrkJKN9jSHcH4P3HeG
-dR7Bmi5ovj5D2i8K2PWs8MSp33H27gTc1sl6FAfJUeNJw/YZyE6uvPKK9VGobNOS
-n8P2r++ffnksDOKPOyKvD7VpfUP4uaMXtSuCVydrs13HY/gmGM+WTYJAvq7BxYZl
-OOZubwSoQq70S2Qg9dQoaJg8KkFgWD2JltWt20+g0ODWgD9ifpmzxg5osnZWDDWQ
-nMnMbXwV482LuIJjoPGJxDLZTy152ofO6feEor922mQ696vPIiac+t3ZIOqdpQvo
-P/UUdusi5f5IPVDiN1S89YtF0Ea0DRLC3Ye2KKY+b+pQdVIxM7N2/+giV0B4sFqV
-lRRJgNBDTf+/4Y04B9Gyk4MDgwTRRxw/5qSbS1i0SuScwU7XEkrzOLIZT3j+8joT
-1v1Z17CPriFvlN2ZGksriRySDlh51NDL+QGf4YfoCT9PXisx+X9hI3Y48NtIJCgo
-ikjhdKxo9rg2USuL40hi83sHK7a2aRJaACPJtc6QgkrBnHClzLhrB8mLxtAp6RPF
-zKrPKp/WORvtNxSu+LrVFEYTbbgGGoFj0JI3z0b/GX32LulQn5BH6Z0UVMOJV1o8
-2npSNl5+ZQer1xBJiPSEhLZFmc8N1LclXUVxPCX23vu/23tVa+JiCviGqrUBexGU
-hdEYNIXiAi0iEC3QJVswu6G+a4Mo9jhwK8GVKBFXQqlm6d0R7amJfxxz619SgAtv
-8mRrBcYi/yNAkIR7O577n3POaXuzn3QAZ+yaqbzWdKvk26E2laMVoKgidl94pcvE
-FKPIeFT5M22WhACzeOAwAI+UzCjubPP+FB++UlA=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBuQjBY
+K1ZTUzR0SmFoYUZLdzUzNUt2M1B4RFdPZzFkcW8rMWJLUjVHOUN3Cjd3ZHdMSzdp
+OWswditVWUhYNjZCdjV6M1d6U3pNak5hUlZjTHNqSkZPSk0KLT4gWDI1NTE5IGNG
+ZytHazJQWTExMjNkZWV2aDUwcnZjUGcwcXRkZWl0M0F2R2JpUVlJekUKWTFlbkEz
+YlN6dkgrMmFFcmlZMjQ0b2oySjlEMC85cUF5QlA4NGF3blBKRQotPiA8M1hbWS1n
+cmVhc2UgOmlZJFYmJgo3UExzUHhSVi9lbVRjNW4xTnVaUTVGSGVDNzRUNlJ2TnVu
+U0wrWU5kd3dyR2phcUNVUHJCYjdzeWhjNVFOV011CmZMOVN0WDk5eUg3ajhwbStQ
+aHExT0EwblpreTBXVHh6Zk1HRkhzcmFQNnoyVUlaeStMUkgKLS0tIG1aY3Zadko3
+V3pDMGswSDZCeit4SVhSRCsrZVRVZVkvQkNsQWN1MXFMUGcKcK74YULWqWw9VvkI
+NH38VHfDPW5ueSiyHHKn8MI9YosPr/TmkwgKd/DOIMVB74ahPalo1QUeg+eaBVnq
+Uncsbx5ecW3JswthkAhiktWHcdHmioGD6hCcgbWtfA3VvbAYc2gtAF2plfDVH6BD
+c8veai3B15ZmDmq3b62sgVA9JUgbFaB1eRqcaPXmNgQJR4c8J+CZWXGQ/TKMqtAg
+chCDuczjLX8IxhMPF1gdCggSt5GtMhY47fpZJRbBUw01l8koqjm63KvEeg2ejFGU
+tXonI4jm2JUxlDTqmNSrVpmAgtPoEPszHc+GsnyNjAz4IXMm5UrQAZyDPgxtwQW
+ZAn0IdOB8rSL/AnRGUpPrecuauINQjONe8CapijjJPQK7g1AHscfxr+OJD1j2eV3
+O6TNlz8vKW4t/V7CUf46ykxxExhA0mKJ53ksaXy2+HWoro2+c4nao/bEld5gt08U
+uCpJtjPKB64X6vdzbY21/l87VRDyxbb3poENfrXlawqS0Z7i2gAbHN5EuiMv+35o
+sBaR0BfcbTn6VagC3i8HEEOO964FrW65pkqmGJcJMgUdcZSl+Y7gHMjWyodqGPOY
+evT6xj4iyeM49vXynV2vrJRu5rr02hOS/8rPphV9c9q9ju5n8xbhS6IiybAelPwt
+sa+xM+w0n+fxVksiXeFj7qD1LDN4+kwqhYP9SlzbA4fT3AkYYrxthTww4IFAweyQ
+IJkpVL0/IZEIEfRzpr0lWLprAaoyPc64pecl0z/gBJDgz1kSG6iEh6K4qx7ahGde
+kBBpS2I2ZsdBkvmQxDSM7tYYBzPxcUNZlSFOIeUy3Xl+OGPlKgtMofbnjV8AFqUf
+tOpgKpLUEkTgXbGUKBxHLj+8pbw7zOFp4sJ00i48ZzLP5D9jom+jS19wGshRc7cH
+dK92CctvrfndQ85yO0vqlyOdMTqjh/z3P2KmhL5SW6P51q5mseTvj7FNM7331DTs
+rq7XWaBLE61eWWQ/dZKnqh5YbkSlU1+08Rl6H/vCU5hTC8fht3KTQSWPofkrP+5f
+We/Pe62LyhV/MbLRA0nmU7Sf4IAnpHfa4kLtlYeB3xiqKd0McM//qzjuk5NoIgE4
+nL0T8YXdGt8K01w+nt+j5bo5gFoRz5+1/ZZ9BgN2DOo4SClYnJWQ/x80X061yJ33
+0SGv4eAC3vFi6xE=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/syncv3.env.age
+++ b/secrets/chatterbox/syncv3.env.age
@@ -1,15 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBzdmJQ
-alVVYjBoWW0xZGZwcmk3RlI4TFRRZWQ5QXdFZlR0Q0RnWXM0ODFvClBsRnVpSHZW
-TDV5QXM5OUYraG41UDZNbk03UWdpYU81MjVsR1pCbHY0QlUKLT4gWDI1NTE5IEY3
-ZDlJS1lwcGVuOGx2dXp5L084cm5PcG1TYVpXcTFhRGliZjBSM0FZd1UKNFhFYmti
-T0pmTkxsY3dqY0E3ckpKTmt0SFFXYkRNUVlpRFNkZlhiaFdoRQotPiBILWdyZWFz
-ZSBBKExuIEFbPTUgVQpabmp4RGlaSE9BY09MSXRDYkRhN25pOVJ2eHlrMHVLZ1FO
-NWxkMUx1RVBOc3NHVzQ4UW9ZdFpiRk1MeUFna1ptClg4V2RJRU9Vendwb042YUVB
-Njg5dFVIYkRUTWEvZEZFUHZNCi0tLSA5Vm15K3VIeERwMUFYOUFJbjVQamEyQTQy
-dHpUS2l0Nm1wSlI1N3JpSEMwCigD8M5RZ4K5t/PB03kYll4fCBBzmTtwgAnxCm+z
-wkdPMrqtZscDY58/UJuqQ4eXk+3w/lOCbhKQvbK4sYSmwlheweHJn0B0Qg+DL/PV
-CM1c58B4t+fu5G/Dh3OEUPy4l1xIa9/rodDX0nlkABBrYQAKgQAQVEFcgqrbKNOz
-5/18ZIRhE+cPnPeKS+lRRzhZGIWSvPzbhJPh90CjEFk7wNvQqnvROOqZu+Fxiv2I
-YJNiCSuSMKBeso0dpRaQzVl1nyFsCjoe9qwYjc/Ox+r3J7yaDGNKCHfqVnCk0kU=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USA3MEFh
+YURySHY5RjVQa1c0QmMvTkZtZElNd1BIeDFpR1U1YXZ5dndnclUwClA2M0ZYMk90
+RmlCZHVISkxZQTZXeEhZVUROSVRGRVg4TmZKZytSL05FcTgKLT4gWDI1NTE5IFY2
+V2k3S0VQdGlQZ0hkU2ZoSWdOUG9rQ0p5Ukg3ZHU3MXVvNHlWYVN5VVUKcWtoWDJh
+LzRwcktWUGQ1bnJvRzVBVlpHU3NhdzYwUDBPTmx3MFNrdWNQYwotPiBKQil6Km0t
+Z3JlYXNlIFdlRTlUU2cgVlxLIzUgJlVyQiJ8Cng3NzF2b3d6MnlEdURQWHgrSFJv
+Y1BMUkZyelJSdDJvUUUwY1k5R3ZBMnJaa1R4NWxlUll2azNseW5MQlpvVWUKYUdN
+d1ZscXVxd1dxSGpzMjBYeWhhYyt5ZlNkSjhmV1ZTTDBTCi0tLSBBTG45VUJOSXZv
+N3lYNVlyZldMVkpZdUMvS21NdSswVmU3VThZK2M2eis4CjwfWWJVR9Ty5dBXEr5s
+U+QrifXvyMJJvqOKEfMYYomFLpt/VtbDAUwNlqLnFIk1VZ2xPUBisXPtReiCK3gq
+P+i6bUONSmPYvmF82VgiuKDuz/kmWqVGg2iSBPIXAGLNIEojndQwmhnrsN9ex4Xy
+lBHkvVsN8EamUJwZ+FEZe4+PjA5yEnANWpeTELOt2gA92/jwwnNIsr07eVTlkh8X
+UmQ2owGwktXP7it6//NV3C7sAdazs2bX65WSnog2E8WPNAorKWI8RCYs33CshVFt
+zzclZ4hRmlAmqMHYqFY=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/colony/borg-pass.txt.age
+++ b/secrets/colony/borg-pass.txt.age
@@ -1,13 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBQY0Nl
-QndXZVJaZTNoMWlWYXgvNDdyMDZBd2pWMFJnWFZvTzdNcHNWZVg0CklBVlNHaE1V
-akZyWDd2S0Q4L0ozclEwWG9BeWNBWkRQNkhiUmxtUHBBZE0KLT4gWDI1NTE5IGVV
-UURXbXpuam9WS1lEYmtwSVhuL2JNMzJzaUIvVVhKSUptVHVkT2FSRVUKSk5tUWEr
-N3A0MXMrWGtqKzc5NlA1YWtXRWQyZWlpMEx3Q0RwQnRJNHdtdwotPiBPUWctZ3Jl
-YXNlCkl6NFZSN2Z4Z0g4Uzh3cGR4Uyt4U1c5cVppdGl6Yk9yT0swY2Q1NTFpcEUv
-RmF0a0xFb0RjUXNrdFMxZk5vLzQKK3R3dDZjWk1iTGo0Y2lveGZtTnVvNU5wM2Y4
-Ci0tLSBva015cE1tMmJxbXBDWkdXVkFjQ0tpMjd1dERDWlF4aFNXVnJyVnZtUk9B
-CjPYBgLg2EGXWtSNK2tAcTiEqLpA5+gtqnemyl8elh6gsBtiiNJ2+HSScSJav2mQ
-0EUhKtRoUiSzk0zYSetOjZuHC3hA/5gHip9YwzGrtxqZUlq6q0Hvmb1CdHLcEJ2t
-NKU=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBoYlRq
+ckk2c21uMVZSR05SdlJpck5MT0FZeUpLTmpTRVN2WDkxWWxmVTBvCjlHZWtEQ2Jh
+YUdybjJLWkNsZkxabTVIR0JnMno5YlMvVmhodDU1bktrSzgKLT4gWDI1NTE5IFZT
+Um9lWXhqRFFLTWdNaTR3Sm1acmY4N0l6WE1FSW54ZEtQcEE5RHBRRHcKcE5KYmp1
+WVdCVk0wMHZ2SCtUR0xKWU10N0xETXlXZmgxcmZZOFBXYWtBawotPiBlRm1gKGxU
+LWdyZWFzZSAqXF8gOkU8Tm96IGA4IC1TCjY3NUgKLS0tIDhjaTNrbG1iQ05iTWRS
+UzIvNzA5TmVGS2ozZmYrYjlBY3J4Z1RRUGRNeWcKUTIEhWqr0fOODu86MDll7k3U
+ThgmS9nlcUY3fMgXzZLtpHIJ/4ZSI+miu8RmLMaeC61qv6xNThGdx+MvU4tMBWKA
+Hv3XGi2MYL1jdHh2KYg5PgdqchYuHrFuBPS7c/tQow==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/colony/rsync.key.age
+++ b/secrets/colony/rsync.key.age
@@ -1,80 +1,82 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBTUTRO
-QW4yUmw4TmUyNStGZTF0d2NvQjZYbUN3NGZCTXZCMHhSZFV0Z0M4CkJUbitNdEZG
-enpZRnlEZFBRbEJXZkNCUG12YUQ5VmJ4Q3hhQ2tJWmtZQWsKLT4gWDI1NTE5IEtE
-MkhEV2NTZE9scEJpbXpnY3dkZXRqeXFNU2s2ZXgxRVpzbEpteWE2dzgKVHREaHFl
-RERiL2J4d1pMSGdvdEp0YWd3RE5zaGhBQmNOdTlEaGxSdTB5TQotPiAyKipDLWdy
-ZWFzZSBpIFR+NltJLSAidkVXbEsgdGdHfn1oLQpFd2J4ZHRDWFZ0WklKQQotLS0g
-cDBJb3NrVDBjTTFCQ0tFK2VBKzZkZlNQODZ5R2xKaVgveEQydDZoZGFyawr8V+oQ
-YCqiSvwgXvFhpgPbCl96mPoOUL248OxwZ07O105Izcv4RulBoJ2/tnBzlsMS1lMJ
-Sgoktgt+p5yiOzYGkZmwD3zVaoqfMbDtkfJwVT/QCszpzj9lkckIBUzcimlkLAq/
-/NkjkhUuj21aJz3DjCSihdpm+Ww4W1zW2K+WZjkAD5pKkbXPQfEADwLTEPaMgYPk
-KqMFHo0Al4ZPUR+L1CeP1Y2Ref7Wf0x1U+JL3r1/iS4XKgLs71jVoAK7bxTiiWYo
-qae9dmk+DbhchaR6RHe1X1ckI0SujwVQ5JbNbRXxcGeyVZLNkc1NzKcvwYb1A1AR
-q3PkEdByoScPxT4DZgx/tiv5dRaPau6OD77r8l3w+KwoWSwFfSOecayUtw8DiJWP
-+56ceKpmR3J2ALCRNTYAa2+tUJ2EXKQk54MwL7Vd3MmXM9t/Tmg+VF6lL2KnSiys
-u/YkmUoaBEYVUM5K5mHvw/nMlKZr5cXUWhdONUuJGFn9zKaG34zDHMgvfvu2KrDU
-ahBlWXEmMKDgNei5+UGsojoYVx30pDNGpUx2s04i+HsUp1t+CTN6QkMN2x9Coudt
-34+weZHa5kpaECEIooflx6coDRASDghEuTZVPI2Z+jfL62V9mIomHbR9dyfWMAis
-b+PJnNWcWMypqOO5uQIUbCPU0JbCpUK1m2i3oSdMyI4sFw+v00XGneRn1aMusfzY
-36wGx359X2o243thd2+vbAYW+2s4jYVEI/zsvL9WGYwFH0RnnkmzhYmCTE6IbtFj
-AXPQm/jf7zlivw0xRxQUL9HyMcgciph4kXc0FP3g3yrCuEnP9z3KUkO73o3YEOGI
-8IdaFv/FisFMiPSb+WEo0w8DTWpTj9W7VRfimWdL2BGVBSBLAcbJO7VhKWElM7GX
-KtdJoDhHDUxVSDKlqEPawMtUAtSNja19dEEFb3CB+ddHuUJ66A/gC6ctSb/AIC/r
-cICY7Y0GTm4GNsyo6mqX4kXHMtfzXaoNOgfBzDID7AiQ4qTclCP28dktGVJ4+wgL
-9GGks4R1B9CQ2SSnOo4Xm6ZCgSi6yFd87S8ANK+yl5YedRzaRalBAVu4hzqgrl12
-BJQIMVIsiAPQB2qR1dc2BKvh4lXAx5RIleSSZLXJbXyL5Ao0ISIU26UfgwwMMrcu
-+Dt2ar9BhEtYlakVHJPHX6LvQ/xfH8QbryIZqPKSK5Iy9VGQohEd8+FyL68xJN5v
-J5Y3Vx8XDHScHAynU87e0sTHwJBonsx4UWV9seADVy9gsbd1M4A97F3qgMpUJvJk
-elx+0o+pkpV96x0P1M7qZNzZtMzCWapaI3Q/4CJvrxaURj9iExAP3VT+gWCNCwJI
-yEEXLw7Klrtm+AsaHVxOciijA5cFscz2MhEWwwUifoHeEO1+O0Iu7n9v9A5r94TH
-C44PfwkL6NvAWCs4xEfIVG33zPvOn3JKqC6Qg6nPbk6wl9hTz2Jh0bxc0BKJyl61
-Psv6HKbsI9wbXeFKpe2g48nNjemknCpaWjGgRZSylS9vyCu6upMJGKoyOiBUoqZt
-h+0WzlKrpbDlBWmp15xdv7+Gwfg+Zwi8w0nJ/bMFN7U+TLhos7502YtKe74mRQiW
-EbFm5WWtNXI8UrhS9DQ8vo3siyvAoi6iOfyzFhAlK7dn1MCXueiSztGdS/ujPvhZ
-nErLBFAeYjh+Sp/WNIrczGpSUUE6ML/pOEULOLKcqzo2f3x7MjT/+MSdJwOlzQzD
-Sfz9qc+4RYzsC//MkfRX9fRRWedzqJppJvb3bKKnxRfjWFZqbSTVRcUlKuCUpSwG
-KK/rskC45m9NSCbCMkqybnKl4viBSIeB93NxaBCl1LHEsyOCfRYaMWShFbXfR9A9
-Z7hAPg9fwMdIVm9Dp09ziJKNeNic7eLCP+qQMpcupNvFEwaGpuEd7//Cbc+0PZ9x
-sMqRQ6y27k1EEOFPtAZaNd3Tkms+s0+oTPw4xGBfyho6HmlAzPRZlqet2cZ9ZxDt
-kUPn1DGXImCgz8ZDhxfk9BXGDv6zv0j1dgen3e+KbuBzCfVULQjNwQk2olVh/9mg
-ubJKc/gHsgIVk/y5rtZV4mXiOHQq1Ctxmc4Br4GsnRCbDzSbf/+CtewFcOguVrsU
-iyBx5k83SluMcHLrur65Bcq0KHkjF/tPr5NgkEmlQusXh/Zo9+i4ZLHQpQETAIz4
-R4lVnmH43U657rXpoOYIqqR/7TeYknQE5ZoawFP8IapeSgsxXpVK/cVm6i89P9qr
-NWaFJT0IXHDB58yJbiE3X6/Cy73JCZ5WfVYo2in3IkEjgUcvanjgzfV+M5QsiJpW
-/Z3lbILKYZK4zgEZfj+zkXpqSbItwKE/VGAPX9gceqKfT5fkoXgHEjffpcNyzt/x
-xH0nkufH3dulGPQWjtESOCo94W4FF1t/ZCdhhMD3Rz6HApGZfurosZiHIrtFVFad
-7ivrnWas8QExEAXX7JOZqG51xHGUCCiRzvxKnANp52NXxDvDNHPx4C9wPe8cKnhS
-EI15sfAMv1tfguesU374b6RuPTkXdEjErmkx/6n9h0PD+BAgQZ7B4kazBhxAimLB
-na7GpjngZAYxSwVN534twFpFDvlQSe35+kVzgfrlZwy7+zo7gLLtGdCxzCSniDKl
-j7yLXqnG9U8tMMOoDyakSAFiK7EF2g1GiQI7c/AWxLttohUXoFuhVKCKx4U8yU2g
-M9l9VFVyV5yLxxdNC73wccS9l8vezICPE7HWQT6eAXNvbAk3bMc5nc1Vs0/xH1/h
-c8jKtQw67dVGCMN6Py71IZ+6txpwzAWbQ531Q5qGA019AdTZPnsP5/hpdXRRqWL5
-Y+YpC6EUYZTHajnAhjGpR1E8KTjESJ/I3iEc3jjI34WfuyssFNK8r4l95cnWL29K
-RK6YLwuuzme1E27pfUvoDBeNZdx4Loyq7AjMp3cir53X+3w6bQC/Ya9+XtJ+ZHjK
-bB2w1vy6wFSbgihjwtjlFJM/LpnCd8Oczta25DtsyVRkRp2AsQ+UpJEoQwmQvCP+
-OVRfPixGJ0bs3uhwVlqo3qCZKvN45zF/ml4Sg70yx2NaVXM9efRYv0od+Vz23ehq
-HG1tfVDUVkXYtOeTcGa0b7G34VmPMnUxst0CcnZ/OjiXh/FLVRUgrxV8FYzBvhiM
-kRbKg2NEe/BmqlJUYQVkVv5t+wQik8irEcnqo7gs21ztEuhaQ3PMdrKPgyf7OYrS
-m/txAr8xLada1xnTTeSUgLhEvdWQ3CNYCaIgSWrKKeiyzCMAwyFsxeROvaOImYeY
-CjyrnYi1CJkhMa4YC9AFngvwbUQ4IFmcPHUmR8RAM//Zh5RdadU2d0VcAD0M6+p7
-StcgsMrOcVCkhFsLmJYrqa9cBrAltLNscUSVbGvUv6b0Ez2u+pVCtcew3n/uLZ3g
-X7ahRzHrAuErEXGmUO+3v9FK+8gczadxrFedcIbgfZ+efU5whiuq23QqzFrKGS9u
-3RPfArtFYuj2MHq5OGy0AmYTfztJIe7DbG+LGkf7xHx52PabLezl1zYjl71hpEvO
-McMcsCQPDZZlMZEEgthTg3ZrCEHln1JNGoa2YWT4lZKpRlkvFlX4JPYTyjsdMkFM
-E8sQnxjGSKTZHG89rOn6u5eyw5sNoY516ELWtAWluOLOCt6kjcsFpkg1reuJgugY
-/UdoML78QUz8Bp0kyL6ZE4uMvJ6T7U656dFumA4Oz3oJuWBPVp9+bn6WI67vwgPD
-/Bnp0KFaNmQF9xf10cavM/cUg2cdYYEp70jmxpvGO5bNuLwX+d3PbyKHIO7O5U/9
-+yBUkfFFVD3rNuQazrRuJYJ2PNmR9EsGfAVlePRFoL+lt4mJ9HJS/AoNRxl1nHHf
-DMYkx1/Gxcb3VAsmhEvULfnDLDjM4oRLO8QuHeDlEmeam/6fwZ8VGecBij8ZADG4
-/YJkSLy+zaDxoNZ8QeykSAlPLFMwli+ejylVNquXVJ41TO6jecAK0I/JjgRo3jKj
-dbJP+2gSH+OR9Ka3j0kBSjPhXx0b223ZTVrUgnLGhbfzvw1esWZKvySQmZIc5Gs/
-eJ9fndm35n5X1Ui34BJWKu/DnnN6CmIpNK6fpCv6QcHqH42pZ666bSv0BfGnsEeU
-4tiSCNkVPgcXnar/Tn+MPnRL7MooK6s4KdKvxnuRVwgl4TfBai/jnMNlPlIxwH2w
-kJHy0+45JpJTAUVscS/ngKPu9hpPXd0QJ579Uf9zmrUlA8lngTXyX4U2WkwAp+hG
-a3Ziq+aIFxj4p3rW2rqm/zDu9haOCSwKtJjW1kDnx6yT57sitcDWnE7HfopiorQc
-5egL/+Ck1xER/Ak1DLnsUFA5IpO5Qc4XgBv7RPqQFmxSZQoAncQQpT9MAEXfuMRK
-BbpjcVZbMgtwShfHWS8ZbiZNyTv0E/bRcP9lfNZqJrfzXQ6dE6g8bycGThVHtdp7
-Mz2j4uV4Z6I47Rgmk9eOcpDjHqqGDrPWz1qt29Zq4fFuobli8vkDWMtLGE2hYj3Z
-dhipSPqPB+Fw7M/UTSqyydS6I0uYJNDwx8z7ST0uftWVmRGP4A==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBZVkFh
+RDNNZCtySlNQTTZFbzJvZmF2TEZKVUM5VjFjQWNSeHlNc1JNZ2hNClVac2pEdWdw
+OVpOTmhWWklVRDA3UzZWWk9QVG1ySUFmTzRSVlFReVdFVFEKLT4gWDI1NTE5IDVD
+eWN2S29aWVNVTTdldXFxZG1vWUNYK2RrajI0OGNGaklzdFByTzlPUkUKTmsvdTE3
+ZFBvalZsdENxR0VnV3FVSnFxTitBRlFWR1BzcjJWd1h0U3hpYwotPiAyOkUlJC1n
+cmVhc2UgIWFOMiogVDc8IFZETk9BSDVTIHEKQ01rc1ZoNXQxUDdtWGRQUlRCV3k1
+djNZeEtOaUl6Tkl5TDA1S2ZXWTFQZEFiV2pWMDJpZ2dkYXdBOGhSTVA2ego4UnBz
+ZGhXcklMd0NVWlhsc0Voem1wUzMyREViUllCRAotLS0gMU5GQjdJaVdlUFJGMG82
+YnZCUm05ak9qcmVyUVJSS0tHaWRRTld3ZkNPMArRgojrBQvlyjMhChn8jgUNDysj
+9Nh3BVqf44fiUNMKARTrFTz3wVMlioo6MmKRzJ/yj0fWkZ2h80X68Nq3rQvy+0UK
+4PNPRbwY5ib0nf7n3itFKjehrYr8HnOjreQps4it52bT5re2TWIC9ogZhNKBLRvB
+qv14HjcF5bGnia8TgSU/8nUZJuIaLwHvS5sc9GOtmV4lDwiSTEJQEtGh716Jzuvs
+XxQLPEVVufAjZUKLp+jWUhXGkvUEeY5bxE2aOLuB8kLfHPC/5p2rl/n2sW3oEDFn
+Fw+XcNnCHWBzk3DlzKZFXwIaZL6Ocqrt+p8CBpWoNhbssuKyOtEbWQOmJxX3UPMt
+sBFNdKSKFhoBQ4ukqkKDhgcm0i+8wG4eBbNIMIDwzPBxK0QiVriwlPQHl7RS2M/J
+LgGeS7qrKC3SgmLu57CdUVUlnogJ4oOg7FPh6x+jQBIIv7gtYCzJb040TUZWZWvi
+cfKWBBwLqLa+7Y6kEhcosLUgw2c9Et5P4rvNjU598q7qrZq7uK6Mr+PMwD3Pd66O
+SQyT4nYhhXBnaIsLXZfima2nRzPocaBmfsuXQwlnLJC8JB6yzqEViK0xYKfl0fIi
+jxuYBw/8Y+MWQhIkF1pP8z+Kw51QdK4CIV33mlLBJnGjlizewsjj04EIgpzQ0+3I
+ZRyee/SzFmGBBk/pMGN0DizA8LS9yZ9DRGrc13rYVUTN6G5xT5AT1eEtFbQ6DH/n
+q13Tur4QJ8AqJmwv1cnX+faH61dXahfbinveXWqB5S95/HE3OGnZfAiS5bs1jW4U
+D3BLaBiFMYD+ccPedg5MLXRgEryVaOWlQ5wuXxqmaCG0KS6YLxl8o0bRR3lKXNZP
+B7Ye0Px69aYtOs58dTOq0Peu039Fi5iNC0beocdKOjig4tZ6p41uz0jPGMUoDebZ
+MYHax+a7Qpi5M6ZVGVpF1ieW2hqnm0lfb18cEYHuXjoI/YlgVhFPCGSzHJpuNiDU
+qJSfOuD8HUB2iXFeEgAi+V3EKTsyjlS+R1zWxkr2awqAk7Uf3svLGWZNINHNoJRe
+CPPANHzTSHlNPSelQ1CyOhl0W/eMCEJuJ9/6kZsmUC3zvzxEMGofG+Ub9RRBW/+/
+TkrVvMrQv7/Va/4dxMPCqrdOQ+3/LkVzGX7qg6tQR76Su0q7aqh38Ki9qWY47bTm
+lq5I2EcQApt/O1cGQJTFowdXVJXx/qQv436p/jL1mymQ8241iQ6XX3DUjbnqdI33
+4XcPa/B7naRkgSG1Z55Vv+IIBOzcjzUMzeQVP/WM3SFRNYT79mJnV0SsKvUFtUOM
+1OxMGEx+ZxfNIZqdp+qo0+uIU00ciokldh4URo9u8EIHjFVcV3Eyb7EbbCxzDiU9
+iwoAAaJjwBlyaRQFWYsKhY2J3NEay142WAyAiHmnNBNhZM9TKkCpjton4ehxeRUC
+hoXpzh4J2lMhdcmXXZ675C3MYiLDpajgLS1dwRp+mAUXwjvQG5rmJd7UWdgpbdpJ
+K6wABNkl601XgKv3/nV9touE0KQjHg1fzo9vzmf8zVEViTgXxH3NECZHctObwgoo
+SlbUOW8vihCi2HU9G3tqH7dwkUsgB2a22JFovgwwW8ePKJQpdvwAV/jyFMLL6jyj
+6Tf0Gsc/Iut6Mh5TYiTWJdCzvEBjcybOVnppj2zR32/A/vAXUrJQaq0kwKkCwG+e
+TL0hAQuA2Su27qTR9Xy2QKpQ5NppRH7V9YxCpjGfcLbcCh7XH7AEZaYfrrX8NoP5
+zPalFA+7E1IuDRtT29wFNRVb3lAet9t5q0LUHf3x+Qk23dQ7Mdq2JIf9RIo5xZ6X
+nsKa9eBQ0O5OAv1VGWVvbrVCMpmyiklYV2rcIT+dbrhrgiTu/BvODSvtmeANIkhC
+uF112/+QW1UNPCENioYq9OWPcEwby+s9JkQf5nTub2o/0lTFKJxNgXa1QBcKKVyC
+9aTCRhcxXsfuR7YzbCXRcK2hUW203iS8+UgAfZBVe5GhskOd0ZR0WSkse+jGzPqI
+tnH5F0yQgLn9emebpL6dNFUVvssjpiMlvkijXFJv1tWSKLb3TxJd2BE/w5Zj7Haz
+iv7Wz6o5+bY4v2YL2Ev7hGzfSaef+ip7/BYZ9TGuzSoZEHMYa7dNT8kRR18IhfXv
+Y3wa2xlOhB+WE3AjtYy1oTi2c6Vmd9UKASZy/Eb++j1MSPtxZQLNaj+svCmqqfvO
+/gElVfGlgkomYwc2EfJvR1lt9u9YGepxKrafPsgvjR6bYPwLF7eHKkKyEiqGCYnW
+mcNJz/B0egxhFjoGd0U17tNuZcYRD/Tsj9ugGF+4/q+IaEV2YzZTdGzupI3lW17o
+Q4H+EksxkWYDr0WRlYKn7VT1gTThuggEz77JskjNP4jK29EOIEO9IqGMh39tXsud
+mhL2Z6XMX6sgxSjSkYxLpFnS1mRZ6uQnSptxHTfnG6jYhq//MTjGX7xmYBj5EoTC
+duHuaCqjRXc3yHWoNm8jepkpbe1PPbwEbL6RDK16G3g0WVREjZopj+66C2xlY8Bq
+ZCmHhud22QHs+5r1LLSIynsUlGIOvq30DZ0F2/f9Gm7uayIYbp8gA4z7M7RjmHoZ
+XHYSPc4kH4a3T9MucQQGzJMl1k/bifBAWLbu9uPcDUe7Cglfz0wHnPemOu8HZXY
+6qS1n6PAHyyGlqX/pNWxR2vQrHJRksdTCvjl4g6256PhaMDop3QAHuQj9meYKIqP
+MiZexiuOW3KjPJ30Gx1Q7PnUc+w3SjjsKaZEvRgeWKa37rvj1ICTnBQUPq2HV6y8
+zaGnJcfd0ENAmFnRaCIbdU6TRonnIAAuSfE2gtLni/PJbmUpznuq82W//kxvH1tR
+oPx6LuM2+hRncMoyXUTWSUVO1DAUPXgZA+j7fkkwmosi14d/5xe3wO4U3dGZ6wAY
+D+zlzhq4d/4vIvLIL0NoBcp8yM+xWxPTtvj7HUJ7BOVV06ICnilUlv2wjR+dZLZK
+DyjWhMoqk8r2TDZbAQr8MNX+sSlp1JxQEgBijpqBvRdF/ulqraF/GFDFRLcEi7D+
+AkHPg4TrmaNB5ixsj72j0xruFJxgQJGj8fwQtemJGu8QcuJbCvJ74TI3vu0Pac/C
+MRov1TAVJB7+iVvVNEgCMlzimJCSCUYh1Zgk5Ci2CDFMFRAEcGoHywIW6v5V8j5o
+v30mJKZCVFc4Yibivjj1aGhQVO72vgiog4L++i7CeXHIu6Fe1Jmlve5iuxrQA2aM
+9vjCbFJIi8k5vQTVcKPRcsto7/qbyxvWvahKBBbHl53XnSb0WtLUyTEaXJ+0l5gy
+Epxfl6ZRNkt+YBYBqCZL9aK6TNpCR+zTC7OhrKcZntqFYCeRB25YEfc1z0lTH4SE
+TPymGSMOeUX8YEIr+XNYG0H/I7ZtEdNGBEXaUrC4YUNrvojpq3PS9bhfLhAf5D11
+wmI2tS9cqxAuS2zkaBr9Qo5xNEVsyGNFd1K0q0JJosiMnVZDzOA4wJTYhOw5gwcW
+T1Kh/LDvK4RE0CV0jRqN81YO8V6Jq+/c2kgtwTLzrx1GCcdHRsY2kPhCEWOTLKb8
+Jn5nyyvOOjMIkAEYYqoRRxl05UbNWNS9SuO2g9HF6JpNJmw0cmzT8erIIjVvaUs5
+dd0Bd5EgkkLq3RMPNTiidQCyIy8QtoElmxYfM11mbf+JMgxsB3sDcRGN4lauUhho
+JlayuFUfrQEwtHFwyULiJwUC55faVqOQzyvcQ8C9AJezDXS7//ku1kvEgbzK0nFm
+3bCCiuog7pG9XlldSReYvlJtnqTmp6E5+m9YaP+yB2E+swKBORHkbCfBu1CuX6R+
+aryBYIDeLaIiJs5GWJN//37TT0hVUCipY9QISfTiZ5tIy0aNKRu9syjWphcoTJuv
+YBaRxKNdZs81ppFTa3sXB824+QXwzRJJPjBndXOtyX/a2U68NK3dqau/A5190VAn
+bn7jnJ68rhcL9ewwydQRm72qwyxBbRHFXnEXpkJhzYRw6fosglqbOJMxFiy36HWD
+RkVluvTInw8Em/DhhWgn+UrxLlQN6JnVdpkT9hwrlFWooiM56UKAPO2a1FM2XKXe
+TqsolY07uWnA+ouiljqIpsaFlVDBcz/sGZWqy4aKKPBTcZlreW88PMsS0c9nixVi
+nKnmI00HuzeL85zVHGo0IKYfktVVjuZNPzJ6+w18XpKIi8TxHpxELC9M2kVOCnuy
+uwuntJlRty+GpXVvx2VLi1wBKyLpXUxhyg1tSi2sZyjIdVt4yEOKfajZYOp73JZx
+IcInD7Cby9olkMsa25YhloljY8YELfW8EWutF13m8tsjGP9c6aOuMIXhrrpwLgYy
+E27iFh9tHq0mjCMibwQnHld7Ccd4OqO4AKfPofHDxWoY9+ivArOBAXjsCxhxWWWp
+aLqLJz+JH+idcsVDlw8jJzFW6pQFbM3VxXObvCg9ou5+P+Pc5XYyALJzIlmoOrN+
+ns5Z+U/2XKGyySQASUyFXUNml6csSrTd+ejz1QvEX9POU1nLmvS1+aojgnptgdpn
+sAtksQHMt1Njo1oRug3+/0iC6XWEig==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/dhparams.pem.age
+++ b/secrets/dhparams.pem.age
@@ -1,32 +1,35 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyA4QkFP
-aHlOSFEyKy9NeWVBRFc3ZU0zbE42VmwybHh3L2xsOW1JeXBIZkV3Cm5uZDJRT1ZI
-cWY0YUNWWW9aVFY2T1RpOTlmSFVUQnV1Tnd2WUpnaDhXd1UKLT4gc3NoLWVkMjU1
-MTkgZ1N4UDBRIGdIL1g0Z09iTTZHWVpzSDEraU0rSGJWMjZoWVhZVEN3ZG9BODVt
-MHVKQ2sKOTNHQ2RBZElkdEhvYkNSSzc0K2owUnpMQ1llRzhZMnlkV2oxYVQwbWlN
-ZwotPiBzc2gtZWQyNTUxOSBWRmN3NWcgMEhOOHpaMnp5aHBDenVaKzJHU1FxUW1C
-M1YvOTBVOU5uRklkZGlVSzRSRQowWndkTkpLS0VNcHNjZGxoUklxQzZ1NHJmNDlC
-SWxiUHF5NEhjMllCREZVCi0+IFgyNTUxOSB1TW1DMUxvNDFHQ050b0lsSFZIbUNj
-ZEhXeW5yM09iS3ZYYmVncloyMzI4CkdSL3FhdTJ0SnFJZHlXREhJNktDNjlDT1JP
-QXdJNURRaXVUMm1HbWRIaUEKLT4gM0FfJSRHdy1ncmVhc2UgentfQm9EIENrfSB1
-SGw5IEQqeisKT0xFS2MyczRxc3hsdWtkNGpkWlN3K0pkUXZFY292Q2RXdDZDS2lG
-dHZKUkFyYTM2SGJkS2JBNAotLS0gTm9OeGxyei9pbVNMZVBSYmcrUzNIRTF2ZXBV
-QzI3NWlMRndMc1Z5Y21wUQokHw6XpK2XAPCelNyqKNXJw+uofwAOZz33jWPIa1ea
-372V9MYCmsbR9O/PFiD4JTrhNMsFOBsFcBLXlJjLK0fmsB/imCZjvhT3o5KyQ6J4
-b1BbRbj9Vy/nZxcEOvteTVriFikqZaCsIo1iv9bqf2SLaLhL9x2Cluz+quRsVpQJ
-cCyshjqaqyfrlx0T3zg5+60ydQvBFIvqHqcp1Utd0epgTQ6Un5TvVwh2C+Q6oBre
-xDi6B4v4HS0engMu9eObB72KSgZAHThm53GYZLuGE3H2wfdyPMC6KLejlSso2ZyT
-xUUgIKuDyr+4Lc7V2FMqm46JRk+cfCLoJwS7p4ZSaczbnzBFNdrvRE2OrMtzQWhf
-IUywS4c4BGdzJCuLBDyGH5+qWoLMm+QmQR4rs0+jJBOPInDxZCZHsm2YvUPyu9EY
-HXo3C7BMuKJJ7LLh/gGz0HI6W6UdVDmEC+txYj3/f4oRCJnVyxJV/5iSRbLhSE85
-uaxTl/mlgx3BJtbCWiVLOiytQmanpGgOvfANnRCiFHpgESixSX2r1Ui8S2GNATTs
-gU5srFtM60/663ThVoHevJXI2T9JcN9mKY8PW4BmixYUWEDTu2egNXmMjPnY7rOD
-BPOnNBB6ilczmfNOMHdQBhcg8SmpdgyxCIdh0nJRZLsW2YynECPYkMT7oW6gK3Vo
-hgC/mmuhbdZMAMNFO04V/hf7XPacgrCB+edyvnI15hJZBIxqjzDDynmOk2c+dt9Y
-Gq4zh3KoPQgz7kIQY3Q0fviw++Exg7gm6gjWdNfKLg1X5693gnnafASKfup8pi4/
-Xt2KiN12u1EbFguuBr7KPPlZqCwbFMZL2uqnEp2dblmtf3oF97rgHOn63t4XwfNx
-P+VRuNmp/UfrPI3dhbilcpvnoddd/qA0dO8l7pp3/0/EcF1vu22+echp1XXzK2me
-BmcjqD2XDV5TowBl+m8BGYeJqWLhJVAH3qs6d3KcHo/yZxxcCa+2KE9MiNOqvurA
-w/r1O9AzGDaIs4YaijfrOPAHzspmwyZizz1qNexnWVQDNPpBzwJH8ydctf8vhQdQ
-IBU=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyB3QTU1
+TEdvbFNaUmE4U1lCNzI1dlloVDBTNXdURjZ2akRMV0R6dm5ST0FNCk9YclRSakhT
+NlV2UVJwak9Fa3dQNTNBK0xKWGlkNXdwZTBEMm4xZzc3azQKLT4gc3NoLWVkMjU1
+MTkgakk4UkFnIGNBMHNrdG84cUQxd1lqQmJIczlScU1jNk52Y3BtR2tXeDNWdWRX
+cEFCR0UKVU5vem5MZUFPbGhoQzJTYnF4OTd3OW9jYTRkazdocVJkZ0pRRGNLek93
+cwotPiBzc2gtZWQyNTUxOSBnU3hQMFEgQ2RUaEUyV1ZGbGRtZnlIUEtTQXk5MUZF
+djYxZ0hBUThlV2tXTHNvdXpVSQpMdiswMy9QNUtCb1hkbGRqR0Nia3FXTzE1ajZL
+UXljSTZqM2YvbzVuWUFzCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBYL1NrRjRaRnFn
+RlNLdWJ3cThteDM3WmNaY210d3RmZzhCYmNpVXBwVGlVCjBkM0IzZC9zNjhmTTZV
+R25ySkVoQWxQQ252WWFlWWZFMlc5dWtUN3VvVTgKLT4gWDI1NTE5IE8yUU1pWGFr
+NzUvZVpwalB6aklkWmJGWUQzTnJiRjNzdzY2MUp6MkY5M1UKR1VIWDVyTFpxem5F
+TmRNWE9zZStLanRTdlU5d0NOSEJKdWhDUjBCdy9vOAotPiBTJCd2NyFYey1ncmVh
+c2UgfE4mYSBXfms0TC5FPiBiYmx8IGRFV35mciNoCjVZdHRiVUtMMWxEMlJ4b1F1
+TGgxY01XTlZpTEtndkg0T0hRVjlqVUJGMUpSaE5tVlZWR3VGenpkUXY2eXJtbmkK
+ZCtqRVN4dnZENXdoYkpjNHRWYXkvN2laY1p4YjV0WQotLS0gOHlEVTVOSmlNemNQ
+TW5ISk1DeDlEM1RoQ2JtUFlyTXRKQjdnT0hiend2VQqrUFvr+76sKn0ldBmZMlEW
+U2k85DLo2KU+/+GtbkZwVXxxIZHMLpoJgghHk9ptdalUgLGcl0X15x9jVaw8aeta
+hbeOHotRHY7bC3z0S74riTk3xDMR1eT0QGhDMWHjfo8SkCftOYBlFfhTftevdep3
+pKMZsuQMwH9JzxgUfcxIcWE975cZzrEJ85nfWMGvdSjcg51KNxP/UUPRxDlcbCEf
+9XX5apSzNsTI3ibGD1n6Qwq8bdVYDMHmy5pAhw4l8L+SdoU1tGdw7JOA16sMCJbx
+T4bV0ky/PGRonjJuCyDBj8oe9vMe1ZI1O/ITtktekS+wocxBs6QXlY7pIZMlGUn2
+6m59ZEEaf7R4/MdnmBDNDkQuyXaKc7SaTc6h5sKWzXdYScGUKvgUQ7U/WJ2ItUTC
+N/Xq07GkZZMt5MYBlyEr+/mKWlcy+ylJPGb7EswvQWaHoeM1QF0XLZ1v+W/Xsso0
+seIoz+geSu9a02kwfsa8WvWXdIAT5X2pNGPClVNzjQ23pfQfQuW8ZQrGmIFR4g5A
+58T1K+vGLdShqqVGyJFMVrSuOzqX5FVmZalu7/++1IQfiRGUlrHKoPlKWnCfFEOu
+AYjaPeEFX2ByxcqfMK1YVPvUufdISUQeaQOO7mXGE3FqB0oUqmRIUiWZATwhq3Pw
+p5QdcySTnmMpD/w05hvwski77kCdmYuHlMlLZez/kfhTnIGXris+Vwi/V19bsZ8G
+zwaZ/Xr6WNC+df5JqSfTGREnXZPFRDkaTt3ri5/eEm6BqliuYjGbuiKsDECi4+JX
+bHpH6LBBoKQ6ms7jCAn0Ls4cUKF37PcjGAOuWnzCSBU+REht1EDfHzx4C7hNiP8X
+87NjEqJbwE9lORho0hQJRTn8uriQcidlVoB3se2SYKbMy8UA4NNnxN9PTj0TuQjL
+OD3LtqHBElqNPbGNyyEAAJmMBmmkUvPPXlGQ0D99b1+jIdHzYSRtOLshBFykqWYQ
+LJD61duhGqcQqcLx4+JdQ+oVcfAI2nG7YINnHB0OmS2DOZvvwqQ7ASScSujUWIjA
+LNQxu3ruMz+bw/G0tYZBBiE=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/kelder-wg.key.age
+++ b/secrets/estuary/kelder-wg.key.age
@@ -1,13 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA0OGI3
-NjZiZDluTGgxbnREbmE4K1E5VU1JQjV2aGNsSm9rS0JPbHhURGtZCjRUcVdJMDJB
-MlZuNDVpb0Z6N0k5VVRjdkc4Mm4yRWY0L3IzZzI5SWNtMmcKLT4gWDI1NTE5IFp6
-emNFbHVWWDNIWkJjOFJRUUNiNFdEdGpHZHhKTmtiQkVPUkRVU01FMlEKallQeGdU
-TUZwcG5Zc2tZN0JUUUZDc29wblh2Q0VYeXMyT3ErUU1pUXRnawotPiBBWDB3LWdy
-ZWFzZSBbYXpHPmYgXyBbK0sKYlp3Vmd4N1hyTnA2RzhWOG9CYnlOeC9ialFaYjA5
-aHJRY1hxZlFLWEg0cTRNR2djM204RGNweG5qUGpha3lUVwptOS9ObEVnZzQzYjhW
-eUdxN1JJblZTN1Z4U2M1MG1waW1jTzlyY2UyS2tjOXJBCi0tLSBSck9XTUFveFU0
-UWQyV0JndWN4em05eVVkaFBXbnNvQmZuWSswUWxQblRNCrN/gA6sHNO9fGrMA4/y
-ojmd6nfn8EKcOfFzzkwEM9YVEi3khPcGeF0C5neTDgIQOVsmAtVoaf2nEqvCBAEa
-LnaQZSoJJA+C1S/fnh12
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBEcDNm
+ajc3a0gwYmVSdkowak1aakJ3VWZ1Rk50S1JIS0ExVktVSW9OVWljCjJqbUEySlNK
+a0xyT3NPK1BBMjZzN0RrLzhwVitvS0pzQ25iSnJSc3FmM0EKLT4gWDI1NTE5IHk0
+M2pkWHgyMHR1WHc5bE4xWTFDTndKdkhRdTg5bzZIWEU2cm02UDZBQjgKUUY3dS9p
+U3h1L1ZvTkFPdURLZ2tSYXJXOGNZZ21KVGdIbXdhSUJrd2puYwotPiAoL0RtO0lH
+OS1ncmVhc2UKVGthN0ZSU0ZFTTg5YW9UOXMwa3RnSzFlMjE2VTN3Ci0tLSBwMEMx
+Q0tQckd3SzBwUUE4SndMV01kUjVrOTdDWmxlcWs2Zy9TZk5yMzhvCrBXyLBZGuSD
+dJodNI13obTM3UvX6hSgQ8Su+J3fOKr5NibkhQ0Auvlr2tUXhhDm2WOUlHjqVTq+
+jWLSyhioDlIEyBgk8Zrl7KGeDzBi
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/netdata/powerdns.conf.age
+++ b/secrets/estuary/netdata/powerdns.conf.age
@@ -1,13 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyB6OFJh
-RCtXcHBQUDNqTk9vSVNpeXhYT21pMCthWWVVakxmenQ4dzhmR2tzClcraStzZnox
-YzcwNkdtajNMK1BhTHlRbjAyU1dtMFVYYzc2aVRWQ0xyWDQKLT4gWDI1NTE5IC9D
-TjUrWHo4bUc2Y3d1YTgvdlJmWHNKZUd1ak5ra09QeklwbHltbk5LWEUKTU95WGlq
-bEFSbE1YM1dEZk5NaWY4Uk5JRVA0YWs0WGtLY3B1TlA0UEZRTQotPiAsWlIuMy1n
-cmVhc2UKTUFGQnBDendLZHpQU3IyZFhQWGpySTQ2Rzc2TXNVK1R6TGlnWFV4bTZn
-Z1BwbHB3QU9zVVloZ1FiQnI5K0JPVgo4OG10OXFHT2w5WUxNem1aem9BCi0tLSA5
-UjF3c21oNkhzeG9jbU9ObUZDZVRwVk4zbG1veHduZVpjZStBZVozU29ZCi94S0F8
-3sZeBxzL4n7smOuP/OlVwCEKRelLVwIsOOh77DV/GmgijJVjP0G68dWB+zCqp5xA
-JnYVWb+9BLMjC0N1NkMVWbUUowladGcFQFUZftzqme2/KaaylRx+Llkwr+x0iy5/
-pKTi9rD2dpBrlxpkZLe9cmw8+pCbivaCqrUngGBknExA3XOsjpDeGcfZKGsLP8w=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBzaEo5
+RzNndHBLMUl3Z2txdVZoOVJBbWsrTVJwY01WeHQ0VTBaSm5VclY0CnJLYStYNEI5
+VTN3dEQ0ZjBKaU1PZSt3d0lldkE5VC9wNHdWazNWV2F6WWMKLT4gWDI1NTE5IEJ5
+amlzTDhCOFF0TllPd2RsME5Cb1lRQUZPTGNvOEZnL1J2Wlpnb29GblUKT2t1NFZy
+blNZSHdxZjlHTlZmaTFYT0laQ1IwOCtDZ21vTjhxM0owdTAvawotPiBLYS1ncmVh
+c2UgRX0nVGtpSCUgNVNDWCVwIDBuPjM3MwplK2cwc2htQ2RLcFhUZ0RSc21uQlFV
+Y1QwSStOK3lKYmVVQ0J5RXA3Zytaa0JoMWtlWU9qMHBLNktFZWxtbFpDCnJyS0JJ
+WEcwbndYbERreFhLZlRyQ3E0czB5NkREancxZk5BTGdWRkR6N2NrZmFrbnhSYlZZ
+NElHNEEKLS0tIGVLdXAxU0ZaZVkxaHV4dEZNNUVuc2J4N3VRMzZzTktSMDY3bDVB
+bWtmUVkKigIZ3J0s23vNzmbzJGjSMGBXK6o6xnsA9HXeQZ13VgKv5Qv+UHu+Z0g2
+TeKdQSrHbDB3ydIxaiXsi2ivULdrIMCyd96rEJFxrkVuVqSZE0ehG5j+o8lKk4OU
+PDe70slbZrVYDSu+OOUOCVRSopZreCURlYn2Pc4rjvrMAn5r1r+/AxjZMdkmmQZ0
+l0wMBTus5zZzKg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/netdata/powerdns_recursor.conf.age
+++ b/secrets/estuary/netdata/powerdns_recursor.conf.age
@@ -1,13 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBuMEJx
-OHpoVVgxK1pQMklBVWI3VFJLZEJ3Qjcxc1liUVVkWmNKZVhRSkY0CmtqV3ZXMTBv
-TVhZVTUweXhETjIrakxmaUpYZ0laVUcxNXhTYXBGbWQ3YTgKLT4gWDI1NTE5IG9S
-MS9XdGNpMWx0enByazZrbWZGM2Z0L2h6bE11V3RiTU0xbzV6elhMaFUKdmJRaTVX
-ZURiUnJ0TC9iTkFNLzQ0VFprME5pZmo1SFV0dmtlYUxUR2I2awotPiAve2ItZ3Jl
-YXNlICppZUVECkFsR3owQkp5NmNUamI5eVhBanQ1RnU2VHZXQk5RVDRYMTFPeFVF
-S3cKLS0tIE42c3YwNmJDdHczbVhkanBlbEIySzJ4RzN3UjQ0bVpNOVlzOEsvTm5o
-VUUKVElxVp4wowofNE2hM25QNN2/B4LrwPuPHKLQhZkXmUebT7J2dOSS4VuD3kNB
-uKxtnU6OLdSO8YkCwhxuiaWmh53e1LkKLbQ/lrDmX1aMjpan0a5RhPH7m3Xqoqsb
-D95iWnegkimfzaZTfqCZoOT28AIU97l/q/djXJCjL31BfrAAOywTYqedcR9Jp9m0
-BwB6lMwtZA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBoZUI4
+bEdWSW1pcDdMYVRJLzdQOWhsdTlZMmlyZjRVeEFwU3Z3NzVFa3lBCkxRZ1FYeU9D
+L2dramp4WFFlREZ3NTFnWUs3clVEcnBhLzExclVac1M2SG8KLT4gWDI1NTE5IHVZ
+bk9QYy94Tk50c1dVanNvNzhpYWNqeFMzVVR0eTQ5OXozMmp2VFlad2cKaEdvUnR5
+ZjhsQ1FRaittQXFkbnRZei85MmtWb3pXRVFsc0RzNzBPMXFMWQotPiAzSXJZb0RE
+LWdyZWFzZSBudCBGIDklTWIjVnwgM3YvCjRVYUd2TForc0gycnRBR05MbU90QmNu
+dXlmQVB2bnZyME5heXlyMUdGTmR6SVd5SHcrTThrZEJYRlpnUmdmWnkKU1lyNjQ3
+T0J6b3NPQ1FYZnhxTjFrYmN1UUJzMjEwcDBwSTJkTnlmeHl3WmFFTXB4eUVMWm9i
+NExUZzM2SHlLLwpiZjQKLS0tIHdqakpMSUNOdnlBcVA4RGJHR2d5QnJNT2dVclZN
+djd4WXBLSUhORktzZ2sKzMjxqL3UPrtGmXDijdfu0AwxLJooK7ZKauYvXWSuZUrR
+vl5i1QPMEEBYEl+NaZIFgxAFqWpAXHQ1VxSijMWxNjKUd1Chq0tbLrpbh9wXJflK
+SW19Wyqc9eTb8BnFoOSYWpDvAs2Lbyr2kJkOj2TNrwMv8nDJdOB8XIPlV5drCj1q
+Dx/1zWqm6NMYxsep6eZkv4AzxA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/auth.conf.age
+++ b/secrets/estuary/pdns/auth.conf.age
@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBYdnRJ
-alZRMEM0V0Y5eGlqSVpWc05uVTFJUlVST1RyRDU2NDdWUCtnZ1JFCjdRVko2Zktn
-Mnhna2tpQ2V4WWZKU0FtcVdyUyt3WFdEWUhCNGZIZ3R4MWcKLT4gWDI1NTE5IGU5
-OG9ESUN5QWEyVnFVaUh3ZHdPWlJtakd0eUYyWWNXYkNXT3ExRUY5WGMKYUtiMDJM
-Mk01di9nQUhaTWdUY3Rydnk0Z2Y1ck9RQWl0WG03TkE4RXpjWQotPiAlci57SS1n
-cmVhc2UgOiomIEYzQXwKOUdiQllucSswUHlWRFJEcS9PVUlDWURvK0p1R0JyVWpL
-Z01RZyt6VHBybmF3QnlhSDdKK0VjdzU0WTd2TDFsaQpMR2F1SjFmSk8yYWM2U3Qy
-b1BuckdFZjZoNWJwR0F5ZEYxOENJZFVRQ1ZoOW92OHlUZ09yCi0tLSB5YnZFY2c4
-UXpKdk1rZmVhakRCSUdGaFRoR1ZabFlLUlZJUlVwK1VaSXEwCuaC9kjQbT/I1zxH
-ek/KJ0oeg4k+stwckJIstwnmDAwtktqUpQS3a7E6XqrZ9b+BcseHku5Z/cGOGSr9
-oltSBpcxQH4I9ZWJsu5H4A==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrd0pM
+TGw1anJNaGoyQ3lMUis1cHVtRWFPcFFNZk9Cdm9TMEh1QTdKc25ZCm9VNzVQcUxE
+Njh2Wi80RWszSU5NczRNcHpVYXpRMzJNcDRsdGxyWVZsUDgKLT4gWDI1NTE5IFpT
+MEJVUkcycVFJaVFOUURoL29VT3R0MVJCWW04NXVRVEpKY3hlY1lWRkEKcENya1Jx
+VnBCMVBrZkc4VDkvMnZoTllCL09vQ0VOZytuMnRvYVQxL2FldwotPiAzLWdyZWFz
+ZSBCNX0gIiB7InIsfCAkOT9uM2UKUWpSYTZ1dUo3SHNaUlFibTl0UDhTaFh5Mk1n
+bFp2cjM5RGhqU0s0Qm50Zk1pUVZmT0R6ZjBoUG1EUGlKbHFzVwozQ2t1cWVDVVAv
+Q21QTjF3NW5UdTBZRldnL0RmSlV3QndHcDB0d0lvZ1RHTTByS1ZwNkNVQnU3WmVn
+ZwotLS0gb0Fxb2FsYzgwRjJwSUF3ei9hZVR2Vk1ORDlIMWoyZ2RTd09hUmtvMWpD
+cwrEjdaYfoGZ9i/S97xL9QvA/yii+sJLeuUzzv7a3DE661eQ5ezurV8Qz1tIhxWG
+RsOppaaj1podFx3U1x7QQbLO6zQbJA458RMjYgc=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/recursor.conf.age
+++ b/secrets/estuary/pdns/recursor.conf.age
@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBSQURq
-VDFXYVlhL3NUZnVTbEo5ZWk4ZlpKSTV1RE5admlSWkxCQkN1dXpBCmpITkkrWnJP
-MktsMlNleVFVdnRGaFZ0K0NOSEZodEo3R0tKb3RZcGRyekUKLT4gWDI1NTE5IDdW
-QVhLelpPTHJjWkprZmdMRmFJMTVwaGM3ZEk0RFV3b0YrRFN6djNNSEkKMHJUUzg3
-RURyajd4d2FJNmRBYytQK0lwMGFGWFcrVXhJdXE2K1ZHOHRCawotPiBrZUItZ3Jl
-YXNlICQ9TFF6UCBiJlcKK2wrajhtTytkbmdPL0xKRnFqOFNCM1hFSm5BVDhmbDQ2
-bm8rWDM0WE9uNmx0djdQcE9EYWJhVVVxM3RNbGxkQgoyRGxHU1pvblNQQ0NONnpG
-Um42RXRsQmcwSnd5Wk5zVDI0L3ZkL2MyUzNpVFJlbXAKLS0tIDVIaU1sNUtDRGJF
-VXpBL2xEbW9haXdUajZUMDEySFdhZ1JmYkVwWmo4TWcKI3w7VVrv0fVUUPeUc0Yi
-/b714CZVs/RT7v0UCG18A5zLcCXRoU9cSQIbSTnEvzQbtvrrYax4dC05OviK+AJ+
-w6IE3rN5lPeqnJ2F
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBHNWg0
+WGRGZnlTdEhsRm96T0ZMOWx4UUxkTitJa3hMWDE1dVkreEtEa0RVClpvR2I5NGpz
+aUF0N1VZU05oWXUzTEI1TVBLYlVVang3Zzgwbi9teDVlQlEKLT4gWDI1NTE5IG4v
+OXRIbzhaZEdXc1pjTnRRWHVxc2ZTcmozSlJkY3lyOGtvd1BVeGprVUkKdUNqSW94
+SUIyOWtsNU83cnVOTUxNR1BvWHJPczdzUWc4aGp1MjlpZm5ESQotPiA2KSV2PVx5
+LWdyZWFzZSBqezVxOHc9biA+aD4tP20mXwpwRCtMUDhmcVhGNXpCZlFmSllpdDVp
+SmFZelNhZnJlR25DS2l2MlQ3ZGFtdGxkZEdEWVNrRlk1VEZBRm9GMHBFCkVlQ1hp
+WnhOTGl2R2s5RDRKN0p5TmF6Y0cyN3ZlR2pDZlhMVjQ1c0FJN3hCbFEKLS0tIEFT
+bjFiRStXMmJueHdsRm1nU084dDRpS0tBT21ENzZFclJXbE11NWJETm8KyMHU+tZY
+QELtZCbXKWnP8QC6V84JIFAxoRslACwsIJZpogcZO/IFIV2RGunGjCJk6QBmhOPV
+kJXRcGO/ndYjWfuU0U3+9HtPocnO
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/actions-runner.env.age
+++ b/secrets/gitea/actions-runner.env.age
@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBBVDdE
-ZC9VZ0FFbmJ4QTJNWEZMU3ZyUGUyWmpNelBaTG5xN0V0MVFHclcwCk9rQy9DWE9Q
-dmdLVWdITnV6R2JFcGVyLzMzZUZoaEZqeVNvYW9uSjlrVE0KLT4gWDI1NTE5IDNI
-dlJ6U0FTQ2JJSHZ0R2hGbDJQREZQcHdUSkZDYnp2cVZudi9YckxlbkEKanVnNDNl
-bTNoNFowMkQ5bTd2VFdJSExkNzlaNEdnOHpjY3ZTdUdZWHNLOAotPiBZWS1ncmVh
-c2UKc1gxcW9ldDRDNGpZR0NJend0RHdNTWhhWXI4VkJwVWxaZWdmTkFUM0x3c0Fq
-c041LzN3RGdlWDRoTytFUVZNQgpBOW5HbUcvVlBmd1BHdUU1eTdIVjVUTkIxakRa
-Ci0tLSBKbDBncnYvT2NEbVVzTHNhZHlZNWR4UGhuN2pEMm12K0hCb0RQU1ErZnB3
-Ctce7CWP2iu8UOxp4WYJEVs46iOAOiYIjaoSt/N8FQheDkToRQjVaqbY146otFXN
-R3TF7Z3WgEIFWLmFUDpiC7t4i6vIHX6sRd5e7u26RaE=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBOZ1RV
+VVpOZ0Jhd2x4YklMOHdkNkd0MEM4ekZiYXFKMjRIdXlZVDFkOTFZCkRreDZlK3Bo
+WmJ1MDBxSU5UYzRuUDMvdnpVc0prNFF4MjM0M1FaZmg4V1EKLT4gWDI1NTE5IEkz
+THNsVDVCbU9KYWpXL010OVRmNjBVVmVyVzhRZW5McVFJcnA3ZWJvZzQKOE1lQnVX
+Nk1rWVAvS1lpbDEzb2ViUUE4RlB5NnJOZmNoUGdUMGNuMk1iMAotPiBuYVwtZ3Jl
+YXNlIHdYXzh3MSB0TyREIGpdTjheeQpJZ2pYUyt6UC9vVmRNZU1uaDdvR2ZUNG0K
+LS0tIHNCRno2V21tZU9XV1UwR2IvZDdkWEMzZDI4V25Yb0lvdmJadXNEZFV6TEEK
+81uT8S3QJNe+mVadi/VpXSPEP0Ygzm0/+1pB5qqYlSQEWTHqS55gCyFCwu+sjaDq
+DpYTSm1JAk5ql9NRj4fJvCS53lJZ4zo+5c0iJKmuRg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/db.txt.age
+++ b/secrets/gitea/db.txt.age
@@ -1,10 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBXcjlj
-RFphVWcremxrbDFOamg1WnJueGE4WXFxYmlSVDNnc0lORS9kN21FCml3M0FZancr
-Vk5hRTBkRFczVHJrbHBCOUtUVlR6dnFoMithMHdRYmRod2sKLT4gWDI1NTE5IG45
-NllmWFdCeHphQ1ZKdDhoK2lkOXZkVXl3dW5uYTdJelVMWml1NFJLVHMKM2Evb0RY
-cDF3ai93bDJqdllSUVZGVGhRUXIyeGtHd0tyVEVSZHlPeTZrawotPiBbfHA3ZDR0
-LWdyZWFzZSBiYn5PZnggNX1xcyVCUCggOTdnSSBRWwpnQQotLS0gbG5ieE1hWWRh
-UDJGOUszQXd0ajN0ZFZpV2tpSzBhM1BEd0F2WVhaSHRZRQrvoSH0Va5h3WQCqIsP
-tz1obFPmOIH/IHrHKYiMVm+X9tfW+B+/NJvxACPvIwxg+k7C
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBBOVJi
+SXdGVDlXWmVGZUM0OTJPUWFYem5qZzAwZWxhNzhpT2t1VjdZU0ZrCjYxWUE2VW5o
+cGFLZ3g3Y3BpUWlWOUtUYTg4MGZXVHZvdVV3eU9iZW0ybE0KLT4gWDI1NTE5IDIw
+QmxaWTY0WjJFZUd6TUxqaHhRelpRQ1hGZVBEcm43d3JYUVhpTWp4aGcKVzhJdFFu
+SEhUUUZVNVk1N2tzekpzUS9RazRCcFBhb2xxbkhRNEwzVys5cwotPiBkeE19PHEm
+LWdyZWFzZQpwR0xsb05JVlFXQTZZQkJSWHY0akNRdjh1eXFnbmFDWUlCM0xLWXBi
+QkVuanloRQotLS0gZTkrT212MXdsZy9Kb1AwMkFHU3VsTElweGNlYkZ2UWVXRzkr
+dnB0SHRnYwrveLSY6SdUDO+QH7WGniLIOPcECTQ7CiTj9lwD5Hm0rYLdvizolb33
+CsGX/kSEI2bD
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/mail.txt.age
+++ b/secrets/gitea/mail.txt.age
@@ -1,10 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBSYjVj
-cFhsdnRHanREOWFEaXZ0RlZsWG1RZXpnTWxsdm0rak9sMlptUXdjCngzMWQ1TjhV
-aUdtUU0zbjBKcElYckxhWEQzM2pFVzN0TGM1NWZwdG5LNzgKLT4gWDI1NTE5IGZl
-cDN6WVVqejI2bm1mOFU2cXJTeXU2djdDUnkySklzZUZmMWxjRjJ0Q0EKd3FvdW1R
-UTc2N1VvcWcrck5XNXJUbmY4VnFHamxoZWdHc21NOWh6cmF5cwotPiA9YlxKWSNH
-Iy1ncmVhc2UgcSVwNitVIFJcCmM1b1lRYmlYd2t6RmxRCi0tLSBwYUk1U3FNNGtn
-M1hJSHFqVFdJTjRwSUVuS2tNTmlvT0k4V3NCZmFNTy9nCk7ZzubJF70pgBmZG2JP
-Emd2le8mYZGSoNUDIzDIcyxUzqi52yG0w5IqTbuDGKPuJQU=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBrTW1E
+ZDFSRXIwbXZXUlNJbHZCVjFzMzRxTmdtbDQ5eWVOWWp3SEdSUERrClVMeFRLOGUx
+U0dmT2ZUUXlCSGhJdE5ibkZLMmZ2VmZFWU9PQXpGZFRPQkkKLT4gWDI1NTE5IDIw
+VXd5N2EwTVdhdkRYeVF3c201SnV3TmxnUGpOZWY5bFJaQWRWMWxQVmMKR2RNc2pE
+aUs4ZW1XSGU1RzM4bHZYQks2cHZWUkhZN1hob2d1QnM3cCtlMAotPiB0XENxMSct
+Z3JlYXNlIC5LIEIoJ1w6Ci93eE5lMUxDQjE3dWI4a05wUE5sV2dWN21ZN2lFRThv
+YVJGNXNWaEtmbjVMaXhnemVuTXhOMXFtNkQvbGNuS3oKalZ6bEtGdHcxYnZNb0Zy
+YnlGTDdoVVdyeTJpYjJjZkc3alUyV2ZGa0taeEFIYTdiRnZmYmRjR3BzNUp2Ci0t
+LSBROCtSMzFNR3hTK1p5NVhGcFpqM0U0L0MwbWpzNUNTUWUyNEVXbzFFMGpjCnot
+A6mYbp+jhpoyjZidXQfzLVcu6y34WqAfJZsfT6l5SJONVfSvSw+iP7XXW2T5OnE=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/minio.txt.age
+++ b/secrets/gitea/minio.txt.age
@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBOdHZB
-SVkwc0o1eU5lMzJaVTJPRDN6b0dmSEpsZ2twTWk4ZzN5d0o2MkVBCklZZnpkU3Mw
-TDVZdHNiMzIrd2QyMnhjbEtoejZubmRVTjNpS2E2TXR6UWcKLT4gWDI1NTE5IGZT
-VUM1aTkzYmFwczJ0MXNKUmdGY2Q5YlBvWXZidjB1aCtBNHZydEVhbnMKcjZYSWFK
-TDR0RC9mOG84eWFIK3pQZXZndktFVFh2OXpXNVlwNk5iaEpIUQotPiBbcWAtWFZM
-Xy1ncmVhc2UgRm1oCmpCL1ZWMnpRZFVRU3A3SzdwZjdTd2tnNVJTbGhzVDVsTUtB
-WXlaSnN6emRTY0MzbnFaYW5zN1VDTHkyY1UycmoKa1craitaWlIyOXJUcEZpVGNl
-M3FNM2ZkN2FJbC82UXFMV0xWWkF2dlNxMFc1QQotLS0gS1U0VFJxbFZKRW96dm1C
-bTIrV2Nrd0ZXWjVuMVRPMW9qbTlWc3BLZXVacwrWvrDBL5/ALHed0rXWxTYayn4p
-4JsexJwstJo+4tK5oUVmQyswiUfZKXLh03Jk+zdU
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA3dDEx
+SUw4QVh5T3QySHFFemo2N1JWTjNCSGRiS1lmRTkxVEQ3S1NKR2dNClZNM1Vwc3dF
+elB0Unk1OWpUb1RQMVpSTUpJUDNrZzFMWkhKK0l1dXVBYlkKLT4gWDI1NTE5IGRF
+TTZlMjdaamlwTUJzYlVkcVIxbmtybkFwakVtK2craXVBNVZraGZ1VlEKN2VvaU5r
+VjNRS2I5WE9kVDhES2dWTUV2cEVJaXZxNzRUcFo5blhGTDBaawotPiAxXCJQemxa
+dS1ncmVhc2UgcDphKHFVTGUgIUonYydBPgowQnc2Wk5yS0E1bVBCWmpOc25MWWs2
+UTR1dVlJbnNXYUVJSkx5bWFIcmtpT1lPSVE3b2Zpd0JaTGZWcEtjelFDCitQcy83
+bEVvM3FNTEhyWVVFS21tS0VQWG5OOHFza28KLS0tIEZZeUZwVGxUdEdtQTZuYk5K
+SHJaUDhHZ0JqbGNFSjJCaVlQTVo0OStkMWcKz/w0SnoHxnw71gr5DbXgMl59Kgjy
+SW4tzNGeRcX2j4YdRjr77TP5UAzpQE30tEcrtw==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/home/ddclient-cloudflare.key.age
+++ b/secrets/home/ddclient-cloudflare.key.age
@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBNalB5
+RUZRNE1CTUJsbW1kSkxBSWVIcG1RUnBKd1gvcnRQVkZCUXFOQmhvClJUN2ltbnNk
+T1grdVJSTzIyNTBTTGVEckVGQXdYNHdwOU5NbW1md3lGM0kKLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIHZ4bFZSS0huWFBDbUhNcTd2MFhvV0lOY1l3d3ZXNU4vT3dwMmlI
+emhoV0kKcDF4M0FPK0JpclI5Q3Q5WGxpZWVYbHVWbkNWdTArclZsN09XK3VJSXc1
+awotPiBYMjU1MTkgRjRCNVZmcXVnQnJ4KzZoM1ZkdWxYUkJTM1JuK3ZlRWJYdkFR
+WXpFSmR4NApTbU5qR3ZuN0ZmbzIvMTFsMkdNSGJXSVlrVmZPdnZvcHFiZW45SW9I
+endJCi0+IDEoIjlcJi1ncmVhc2UgJUE4IWl5ODkgfGVdLihEfT4gWCAreSduPS4K
+bkI2Wm9LRGJXdW11aDl2VgotLS0gTENqYjZEUUZaWVZEcWQvWW5yTzJEdHRLeDJm
+QUl5aytXdDE5QVMwVHZVSQo+aDbaGNOrz+hTSUQ4IAjDC9EfNwrlXDZtBqw8HkRv
+1/Rr737scjrM7Bgt9zuKn6CB0zdeHTW5u685V2hCW/3aTy1eppWMWj3r
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/home/pdns/auth.conf.age
+++ b/secrets/home/pdns/auth.conf.age
@@ -1,16 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBpZjlC
-aWU4RUQ2N1ZISmcxeTg3UFIxakVid29mZmo1YnlUVnp4UDVQUVdNCnRxVWVJQmhk
-bVNXRmQxV2N4TVFHQXUxNU1ydHovYkxEalMyYkdsYlZGT28KLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIHJ3UDRDUkZDZnZsTW1CdEZoOWZRay9reG5ON1pISjhQUjFSbEVF
-Smh2d1kKOVlxekNtY08rYnZvN1VhMlZvQlZYMkVvQ2hrQklZNy85ZFhPc3RjMlRR
-OAotPiBYMjU1MTkgQ1hLbHAraDRDTXpsSW0ybXlvaFQzRkF2VzhJZmRUbDk3c0dP
-N2F3VVhpMApUWXVCUVdReUV6TktiazhYYmJ5Vk51NUpocDk4Lzg2dUFqM1V0TDNq
-WEx3Ci0+IDl9cmxtLWdyZWFzZSBxRidDOSA4V3p8IDI0WXwgT0lBSwpQSUJJMkgz
-Vk9IOFpkTXIrSXlSWVJqbGJ2TEQ2NnV0M2FUYnNvMVlLdkFVdC96eXNvcnN4clVS
-bG1ONDdrT0FKCk1OMVJVZFhzR2ZPNTQyTzRZS1ZhSnhMWWFyQnRxVGdQNUNMZlVk
-ZEc2SXI0MkVtTEpXSVViY0tiRWxiR2pOY1AKVjU4Ci0tLSB6YVlpVDVhZEUxTUdY
-RmxGRTIvS3JUZ0lLdFQ5SDM3aFpJcEc1eXA4MVpFChSmieh7rSxTtwtCL9sn9kBW
-jmRCPLuLrC7ehcYw0p2Z7lhQfywFXU+TDCavlJSjJRbSF+sYlMvw2Txf5zAwqyQY
-QkirLJQ3phYwEA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBFb2hL
+MCt6c0I4Nm5SMFhEaWNZRTRtNkpYeVQvVGFVZzVqd0E3L2dZdzFBCiszUXZSVENo
+cmxqdVFwMFA0elpFOGZoM3B6SW80MEhCNlJoRXV0WXpUeG8KLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIHQxR2MrakZmRFJMcjhabGFON2xQU2RBSDNvRCtuV3NwNGJ2bjZF
+b2lCQVUKcFNzM3paS1ZnWk8xY1VzVmdTWndMK0JCTU14bUJvM3E2bjR2TmlTY2tF
+NAotPiBYMjU1MTkgY1MrT3ZkN1pUd0JVb0JWSDByNUNRd1NUd2ZiNVJrc0JCb0J5
+NENrU0MySQp0bFpwRXRZcHRVdnN3eitkNHlWc0c0a0NmUjVYSVFXSVNFVHI0b0ZB
+U3kwCi0+IHQmKm9ERFdfLWdyZWFzZSBJIFkvRG5JIC9ZI002bmkgNX1hQHcKc2l4
+S0N4YzgvK2xqZm1YVkl4ZlF1REVOTGRWOVZRQm80R2NnczlsdFlhTEd1RmVoNjZa
+KzlkVXNpbGZsNTRybAp4RDlIWmRqR0t3VjF6WVlSeTJ4aGZBd1dDNEpMTUhZenZS
+WjZCK0FZcXJORkJwc1piS1FvSlkzc3R5T2s3Vk0KLS0tIDFPODlkZ1BSWEhHUHJK
+QjdZOE1KcFNvcUYxYlFkL1FLNVJETTkySVNYRTgKOipmWGTV9SvGE4KVqgQqGw4e
+CLP4PYlgdSmOATTIg32G/GVTM8NlvaII3q2GNS0Enx7Y8YwnwS2dGkYKVN3Da3b2
+WJwMiBZRu/PC
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/home/pdns/recursor.conf.age
+++ b/secrets/home/pdns/recursor.conf.age
@@ -1,14 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBoWGds
-VXVGdzJuNXZrZjhYbjQwdEkvNlJMSTRURlZHZ0drUEp0T0pRWlFnCmdKVStlRUo5
-ai9mY3dGSmk2SDdKaDdHQ1VXWkJIVXFrYlNSdllrclMzVzgKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIGFsb3VaaGVkdGpvWUdvbmZ6cGNjR0VCWXZpeTI4WW9xMXlBbWM5
-WjIreXMKYks0cW5NZW5yMnJSd1RKZkdhcko5c2d0K3N5L0Q2V0NIOG5QVkJ5Y1pi
-WQotPiBYMjU1MTkgVVJsQzFGZU01RTQ4VGhBanJYWTZiTzl0Q2JPOWExcmQyTmxU
-UFVrQWR3VQpQNEIxT1VUcDZmbnlJcEJpVGdyaWZHQ2hNQTYvQ1NGbUhrSVVuNEp4
-VVNzCi0+IEZdOnZxRkNtLWdyZWFzZSBBNldaayBUQCgKU05PLzZZck9ONXJxd2Yw
-WGx6bTRaTm9SMG0yMFNuci9SSitTZStHcExKYUdsWG83QXVBR3NtQm9IQ0V4VzdZ
-OAo2QQotLS0gbUhFRnJSNFhhYS85bmpwZGpNM0plSDVmcHhPWk9NNm5ROURXWlBW
-NXNrbwqY4EDnwstMva8LILVtlwAOrSOSMOGOY0yuZusOpJhGNjjpAKyeZnb4Tyv6
-2bfcwwuFvdVan/FdlTJZymVxsLO96lzSV5rz7fYpckk=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBjbUF2
+VXYyVkRud3JFU0tDQThjQlVMTTFaaW5uTkt3K2dmd1pleTFOQm5jCkNUeEVqSXVX
+RGUxcU14Z04zMlRubVIxV0VwazhlZlFtTCtXT2dVS3l4b2MKLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIG5SRTFOWWVIMU5yK3VTdkVtc0VYNnFkRXFrdEpiNTJIRHBvVnky
+OHRyWEUKVXVvZlBBR0dsUXFMa2dSZ1FWVWpvZGlwcHJ3YXRscnBoaU1FWlVFYTdt
+dwotPiBYMjU1MTkgMWlBWCtSU0I4Q1I0T0JrZ1ErYzlHRTZsUHhZQkpYQVJGNnFy
+U3ZPeU9RTQoxaGZDYnRaNjBRRGQzMGNsTmZwcjhBRXdLeEFqVWxoT3hNNHk5cU9C
+Qk00Ci0+ICF8Q0EuPSIhLWdyZWFzZSBKcCp6MgpaTXQwdEllbmhRVDhOQTdpb0RU
+T1VGZmdZK1VEMWdPUXduYWQ2YWx5aDFTQ3ZzRnRWbFRGN0lWUU5iQWdPakpZCnl6
+MnI0SE5sS0x2MUZibW96SllDQVVOK2grRldPOWo0VSs3SkFUN1dqS3RqTTdPZG1M
+eHI0T1BHK1F1cWlINAotLS0gckFnWkoydklhWHZhZHBkSkN5ZmdadVdiMU1QOUZW
+VkJENWlHVWNXcEVsWQqYscIBmSi//ev3IN2ax0Ei7p8Atu4nYQui7yoY/1fiyGQL
+DB5+R9Dm4YUNHt3bjrBYclLohDGdLUnOB00BXUqNmlLm4psL4Ey5Go8=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/airvpn-privkey.age
+++ b/secrets/jackflix/airvpn-privkey.age
@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBVcnoy
-K3Z2YkNaMFg0eXZSWjQrRm9ZSDRjM09qZUZJL3JDaFRvY29sOUgwCm9IZHNUTytH
-RzZkTFd0eUc5TlkxbEViL2pwcittVnZ4dC9CNTV0RVdQaGcKLT4gWDI1NTE5IEl3
-TTdJckhCV09zNVR3ODU2L0NFK3h6c3NITGFXQkdsSHFqeE9kdzhNeTQKN0tyK3V4
-UWk4dnllcW1CZkdyWklRZ0Y0MWpzV1Rramp0RFZGMWtDWnFXbwotPiBuMGl3LWdy
-ZWFzZQpxNUI5ZVB5ZFcvZ2x6MlhvUmdhQVgvajk5UjA3NVN3MkRlTEFnWFNRYWQ1
-RlB4Y0JzWlJnK3A2TElKa2pvYmx0CitDbzVuN3lnRXJvCi0tLSBGbkN4d2VmQWtH
-U3RIZlBEbWpHclRSK1Q3SlBadU52cU5WbUtkVTYycHFBChQkgyRSaS7Ngbn3hPJj
-jqLtvKyip0RzAx2Ug+cbHQfOcwzMMdGrde+c4Jv/J/yysbtJJzKyTcWmiIrGfrJO
-wRrN3Adb7b2KavNJgq7B
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB1N0V0
+UW5ZKzQrSlFUMnR5QUE5N2Mzd0FvK3JCeFM2RVRtUklVQkNkU0dNCnJuUUxjQjcw
+NURFOFRWRG5WSnBPT1dOVjFNQWZVUjJUSU9WVTExeS9XZkEKLT4gWDI1NTE5IHdq
+eDhJSTZKN1lQRXNaZzNIWEx4NTZINzZpdFRPZWJGcys5SUV6bmc0Q1EKeGlqTjF6
+b3Y3ZWNhcjF4WlpOcXh1OHBucmNCZmp6VTI1MXRjN1FlNlA3VQotPiBtQ01Dey8t
+Z3JlYXNlCnFKKys4Y0I3RkE3bzl2NDJ2aDNMeTRTUUU4dFFwelV3SjVReExnCi0t
+LSA1QSthdHR0cVE4bXhiczZqUTNJdzkzdnZ2TEpESWwwQ3BWNnoyNmp4ZXdrCl1g
+oNwCvlTrPx5b5l0OUymxMo1HMCV9fsQ9zyaoJoPFN1hv7l4hjjX5oVoj/IdTJbbe
+ZMs1yqa7YbR4+HG9GG8nPhU36hchSN2whoz8
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/airvpn-psk.age
+++ b/secrets/jackflix/airvpn-psk.age
@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyA5V0tB
-dkZYd1l4V3krSXBoekJpemxDWlZmdWM4UElxOW1GR0NXdHdIYzJnCmNkWG5rdUxM
-Rm02b01ncE4wNkhLWWZ6dVFYZ3l0d1BLVTJnQUQ3RzhaUEEKLT4gWDI1NTE5IHJs
-YnlTSE5Gdi9sZFZ3cmloNGVpN3I2UmVCSHJuUWNwS29Md0lGQTI5QTgKWnRhdVhE
-ajdHSTlkTHZ6L0RHYy9sTzBmamt5L25xMGpzdG1FRXd6R1hTVQotPiAqZS1ncmVh
-c2UgXWA8Py1jVSA1cCg2fgo0czZycnlPQnhtOE9HOVV5MTFwUXlPV285Y3lxUkdT
-dFJyWXNJRXZQaXVpdkRpTEpINkp1NVBtcklrK3JabDJYCmFXYzZ4MnczRkpsNGda
-VQotLS0gZUFZN0dhakRyT0JqZGRYd2NBdXE0U1R6MGJMeWdsZXlLNkt4Ly9pWkxY
-WQpMYppFKszJEp3U0z4Pthz/GouwvkjWbRgxABRfWxoLR+LCab2QjAt6uiCLaI7n
-MzQ6W/vblz7AsknZYiQyvHBJ8TteaUmUPwXhLE/E+g==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB6dGZN
+VDF3ME9IWWJMQUVrbmlKeXhZbzE1THUwVWhBc2ZBQXdUUkpod0FzCkVncGlyTXVv
+bmxPN0F3ODdvUmw3Sit1cERNTXN6YWZlU2IvYUhoUThER3cKLT4gWDI1NTE5IGQ2
+RzdCWUw2N1BHWVhiOGhvNEdzQVlUanR3emdDV3FUTFRXUDB3RDdrMmsKZDkvWWgv
+MFZhbHZtVDVQSWVEQ2NxQUZrOXFMVmYxbEU0STFJTVBzZm16ZwotPiB+Ty1ncmVh
+c2UgMnpCPlV9ClY2TzJGcnBrbUJTU3lyNVlrNDdwYTd3Ci0tLSBHaU9ZVnZoUkx5
+QnE4UXhMdEg1elE1dDRoQWx4bDhBMHNwS1BlQkRaUm93CspT9YnuzfpKxC9y6SWJ
+JRyT8aFEJTjoDEqN2I/DBwRikSxKyspHi7grCwFaoofylqJzsP/In7Xlf91xbMXz
+njjXbBQQP9PG3Z2c0OHk
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/acquisition/airvpn-privkey.age
+++ b/secrets/kelder/acquisition/airvpn-privkey.age
@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBjNTlt
-d253Y252TDhkSjBtRGlDTEV4bTdOWVFlQU5ZTW9GN3E3SkdRSEM0CkYxS3RqRmhV
-NkVPTVNkS3hWQXZIRE9ZeFU5T25PYktUbDFyaTdXWGEvZ0kKLT4gWDI1NTE5IFln
-aUxIZSs4RzluZ0k1M0xSSjVwWFZaaHUwQnllK3RtS3oxaFZMcDZsVncKK09YT0pE
-T1NMeENhcml4SGtYMmNqenB1czdVREVwdGpuVEFWNGtGTzFlZwotPiBbbllDUlYt
-Z3JlYXNlClpsdmRhT21jbGt4aGhFaWlJcHc5Ci0tLSBKelNaeEJlRVc3dmhJMVBU
-VEpYR1ZRbmVsUU1SZzhOektJUWE0RVpKWkprCvhtrEFQAulX9qKTYkzXQlrExPqh
-X61y6XxewdticnE/CWy0l8ijM/6y+98CfniUb5KesTn7LZ7mCyLUdKVrt6+qrJ6Y
-CNTO1J1VGgK2
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBaUm1C
+WGJDSUNtTUYxbHVnWU44VkRnY3F6cTR0Tm1EUEdDYmltWHBrL1dvCnMzSEFqZTdS
+K25tMkdkNEZ1dGhBMVhSUkR2M21EY0NtbnJjb0R5RVoyTDAKLT4gWDI1NTE5IHhv
+RlJOd3dCa3ZaeE5JS0ovV3ZiY0N5QThNSi9LaXQ5d1JIa1UyeVFJekUKd216RGw2
+Szg3VG1PWUVweE9udFpta0gxdWx1NEU5ZmNwK3hMdHdZNlB6SQotPiB3dlxKIXxG
+LWdyZWFzZSBCLGsgWCU+UWwKWXVYQTBqVkRMKzNsU3JuWmlQdVpzdWJWcVdwVUM5
+aHpmZFVPbWlidHJEYlN2M3NvUWNqVgotLS0gZHhwUlE3YXJSdHFkdFpkTnh0bC9a
+TytZcmtxd0pldUg2YUEzMFJ4QjR5dwqaUnjT3oaUunudOqNfh9twKyaRttf4sk9G
+uiiKoEa314HbI1vgS4iCNX4vG+468SECiF9llZL9U1w+1MSF1y1BKy7XrDCsp7Xs
+HiA2aA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/acquisition/airvpn-psk.age
+++ b/secrets/kelder/acquisition/airvpn-psk.age
@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSB3eGZP
-OUpHVWdTRk5EVUZpT3U5ZjF2dzRJazI3STZpMVlpdERzYllxU0dzCkxKb3RHWWkw
-NFdYS09HbTlXM2d6ZFBsNkpNT2E1azRDbFl1S0xnL2xkbXMKLT4gWDI1NTE5IDBv
-NmhRRGJPTG5pbi9Zb3d3S0Q0SmdIakoxQTM4M3NQR2xOQWIvMHo2eUkKMDF3TEEr
-OHZrRFZvMjhRMVQwVFF5dER5WnJkRFpaTHIwNGhDR0xicUlpVQotPiBlLWdyZWFz
-ZSBAIHNeXiBJIHY5YAp3b2oxNUZtQ09MUDQ2Rk9BYjA1Q2ZBNXJQNzdJNktKanA0
-QnE1bnIrQ1IrUmFEMEp5aG5sQksvMzlFSFNZK2JkCklNa3YzL243ZGNPOFRIcWsK
-LS0tIEFkVlk3NlAwRGhhYndzVVI5SmpxTzVCZzVNaFFubDBQaGhZWTNGaElTSm8K
-CtuCoM3AiAliZVPaSRXSwBUUU5wfGTqVYelCN2hLLfbYEJRTn6zs+CypCs3qmYkr
-W+zEDlZPaMFUo7idMoMEtoO0+mtrM0afa9+rbHw=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBIdGI1
+UVl5bVN5TDUvMTRuVFdpdG9lSkRjL2hOTHo3OVFxQ25IMDRlRGdJCm1oOEM5Rzlv
+cUljejB0aUNCS0x5Qjh1Y1JWQTNmWE9kcjF1ZktJVUxLSUEKLT4gWDI1NTE5IHBN
+Vm4vbC9GcUdaYjNlWEg0UUVTVVVHWG5VTnVPRFBkUXk1dm8wWlF1QU0KZEU3dXFR
+YU5GalhSakF3OEduSlhuYTN3SVdFU0NrWmJBZThvN1BGU21TUQotPiBdLVQtZ3Jl
+YXNlIElWPzRFcicgYVoldUFzClA3M2JUNFU4T2xSRmpyeStMQjZNa1I0bmxLSUdj
+NGN6NkFvbmJEVWJXSEhCMjhkWjhyZkZPRyt5N2diZDI5SGwKczFsaEZXbDljVGQz
+cnpMcHpPdTBPL0hwb0t3dE1XNURWckVEOFZmQwotLS0gbmQrNm9QQkpxTnYzTTFt
+bHU3WWVDai9BY3VSaTB3NDN5bk1IdUNiMWk4NAqyrvPkq+FP+fSs9mZMgxLTJICD
+5l8Ii5h9fl2APzedygOLFGQLq0qW7pjBygfmQWgG4gqsO4iKIwEjUiv30/QCUhKL
+CGZJpN8AfZAcow==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/cloudflare-credentials.conf.age
+++ b/secrets/kelder/cloudflare-credentials.conf.age
@@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSA4L0sw
-bUx2NzVkVzJObXhIUW9nLzFCYUc4UWpKN3hobE1kVDhOL29Bem44CmNqTHFOZnFm
-Z0pEL0ZNSnQ2RFlyd1ljamNCTWIzSzc1Z3NDd3pReVJvdGcKLT4gWDI1NTE5IDRN
-emsvYTZYY0x2M0RCdjByLzA2aWVQdVo1MkViaVRTTXRaOFlGNHplbW8KZGppdmhV
-YmZKYUY2TW9GR0hhK29yc3h1aElmT3pVYlQrYlBKL1NiamM5MAotPiBELWdyZWFz
-ZSBhfEVcYQpHRk1CTkpTbkJTTVZVeEJySUtSZG5IeUdicWsxelF3TVhmUVB5M3pl
-ZFpQWWFJdTF6SGR2eFo0QVYvWG9HMEtuClprK3QKLS0tIFp2QVNuak0xcStYRFFN
-MXhrMWRXdXhianAxU1NWN1UvcFdrRUptSHZNU2cK6MCzIW2cM5dxOv7mOQXYHqjT
-OCmIx6NroaCJIOt1rwbgO5rVA2HMbl6iE6DRLO3vfi9GqjIDTNoJQbSt9GbLQ03X
-22QUaKsBzzv4o+cCmWb8ZnhxsUhNXSJvni+T2YYd9VDP7Qm7ApKD4ymT5aIty6Uf
-88W2oqWoUllcEwDCQOge5zI783OK4JzzyLQZ4+47IDKVDYTjySzZTMNy2LnI4wNW
-sJ5/OKpV9wsV2MT7idUizURF56myUNUKiONlPzerfGMe8aYu1saH8faF93jjLzJg
-hPBhxkDdpQff8V1rWwBVK0R4UftKIHQU
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBSdmly
+aEtUTHh3Uy95ZGhEcno5VktOcmlWYzVqUTE1MUs4NDg4WnZBT0Y4CjY2QndadEF2
+TzF6TlJxall2cW4zeGltQVNabUJkcWNCUDRwZXpjYXJubVUKLT4gWDI1NTE5IGVL
+N3dkVDFuSXdXZTFCVStzSCtCRUJGWUd0bnNGdnBhUlIzMExSNjBqWEEKOUdvZTlK
+dzhyYWUzTmFzbnVxRTZRNHZ1NGFXSkJ3ejM0S0JCTGNpcHVzcwotPiB1dS1ncmVh
+c2UgY0NxK2VxdyBdRE8vQSV1cSBcIFw/TG8jQwplZk1ZeTAzUnZJUm1qQ0VxUGpU
+NU1waVZ6OXF3NXQvS08vblYvRDl6TzF4RUhvdW16anZWcXdORTVnCi0tLSB6ayth
+aWRVUGgwazBMSUk0MEdETkhnbURkbEZXUGNCNnN4OUdPMXpkelcwCoil0uw2yDNc
+mOUMhVzALll4DgCX/MskwCdYohSBnMpSzqtltAhkW1aqdbuU3PC9LHQElpuHqpl9
+leNTu6n5nU5BHQ5qWShedL1G11SRzcblImwUcyg10d6Z0nUoCUjmw3BnGQ2wwvhC
+M+GGeb9X1ORRciqprtTq1WXWGG3tYgL9SjTAEtyMhAZ3CFjh3p4BdC9pVhCAJ9TA
+tbRAtqIz8VTzG86G4zPJYzBwtAse8tJDEO40GUqcOsmXhmPPpd7je1k381+GVrMj
+q2g2gTCUOrMryVRX/7+H2iRxtIxmhqESXIWgY5SIUv9uRA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/ddclient-cloudflare.key.age
+++ b/secrets/kelder/ddclient-cloudflare.key.age
@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyAxYXBX
-OVRONkpEU0hqc0J1NitYTDdMeHVsRDZ0bjNFWWJ6YnBjbHR3bVJBCk9RS2d2ZlpZ
-S2xMUnJ6Z2xZN2dSV0oxZlRPODBGNUZMeGZYTTdhSWt0UGMKLT4gWDI1NTE5IEEw
-WVlqclAwR053UTAxN2ZKN2tzMXJVTXQ4REQ5THVsVW16dFJjQzIvVlUKOS9xazZ2
-VlN6QUhBczAxS3VHQ0E0eitVSytFd0ZRcFFDNExRaDUzem1WSQotPiB4W3EtZ3Jl
-YXNlCnFNakFEMnhlS3ZrRFNzd3ZrckFDYStwVXRvNjlpaFVCQVdBWmludFJ5ejdi
-alEzMkJnRUpKbzg3RW9EOGNqQTAKbUhoWkJJOGhxaXMxYTNZWThZQTc3SUdXT3Rz
-dkJUckowTVB3dkpMc045M2lWZwotLS0gYkhpRXl5YWZzS1kzMnVuL3ZYZ2ZDcVV6
-Nm1YK1RnSTVGQmJHYlJKamk0cwrh1INhiHlbV8Elblc3k/gURDuxXVYMG8u3XXRl
-KkMWF7ax9C1YfIH0Na2cpWb1Hm4Gt8/nQpRu8iYhxG1/d9n54LKnN7lzDZZ/
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyB0blBa
+Nlo2VGUzZzdTNW9heXhuUTJWYi9lWkl5WEp2VXcycExWd3FsLzNzCnpoZVVHaUxK
+aHAxVmxQSkJ6a0JnSFpkdmRzLzl3ZktwYy9yckFSNGxzRWsKLT4gWDI1NTE5IFhl
+RlR5TjJoUVdScjRKN3hDQmg4aDJpSllnd25WNmlVVTU4SzZRZEdnQ28KVGsyVHN6
+TmZyV1hSbWZqWUtYNFdEQ0FLMjczRW5HSWVEaHJidHBjZzBZTQotPiA/by1ncmVh
+c2UKUlJ1V2Y1eW1aNG1CTkx5VjZlREt5VkJjOVZoUno1T3p4WldSUTFpNDBXb21m
+Z0l6eGZKaTBqbjRiTTRybnEyagpxQlRIZldEVGdNblRrZkMycFljdkwxSjl4VHcK
+LS0tIDV2Q0NHeGRUblhCc3JUenl2bGhueER0UnFkcUZNWXR1c09QWDI0R2FkdXcK
+8DfpILM67mlC23bKjt2hWfpI51JvTa2YBEvHwHDuaaZBw8FIU6E8s77iyjTysmsw
+vmQwTrdoUPhfLHXspjHH1GGObwOxvdw/Mg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/estuary-wg.key.age
+++ b/secrets/kelder/estuary-wg.key.age
@@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyB0Z0dB
-VTVGcWJYVlFuTlZTWHRYV3YyRWhOK0U5cmpsaTlhT0ZxcTNLTFdnCkp4OFBIeXds
-Y0k3TzJkb1ovNHBpV2JrZ3UrdkxOd0dLQ0RVZThwMmZCaW8KLT4gWDI1NTE5IFc0
-b083Q0JFQUNMdTdHTWpmVW1Oc2JrOEJuZHNuc2V3TXR2THo5SDRkQlkKVGVFTWFV
-bTlUaW5oRFR0S3J3NjBZdlI3R1JnOGpGTGRNR3RnTlduWW5QdwotPiA2PTZHLDpG
-Pi1ncmVhc2UgTVRIMV4gemBSTC5tIGliXFJ4Z0AgbFBaMTFncDcKZjNHaFpwVFU4
-dEtXcitLR0g0Nm5tcG9yQTNsTW5uVlEvK1lJM3hCV2JkY1JOL29MWVVSYWpVUWNB
-OVNBdVc4MgpTa2R6bmQ3bVVzNEQ1eTZGNE1KN1Z5dWVFRUEKLS0tIHdwRTBGN2N6
-NVpXWUs3bGZYT251OVdpeW53elpZMi9wTEkvYWEyRWl3azgKww1rw2eHJnGZI1cp
-C2zVSUF+i70KE3mISNqzeA3hwtsZPoAVdvL8RMVAYmV1LMICF2wviPQPsKCQXKc8
-/Hr2qMlmSe1rDkDWpA2f9qc=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyAxUzdG
+dG9ZNkpPNGlreWxRMFlPQUdFTk9FZ0kvVjNhbUNvMWU4a2krcmcwCnl1Vk1PUS8r
+S0lveDV3OVphc3d6UDdLKzR4ZjB3RUloRzE2Zis3bjhsL00KLT4gWDI1NTE5IGVx
+TEMzdDRDbFBuT0c0V1Y1d1diSUVYMEw0dmJwcG9WaWQwcUdMMEVtZ3cKZ0x0OExq
+REFEdlJPU3o2WTlUQWU3b1NxcnJ1ajRRNkhxR1lxUmNpM1BLZwotPiBrMTREQ0lb
+LWdyZWFzZSB6TSp5Y0knClQ3V1VFY0dzSy9iNVdkRVZYU09yWjhONXkzck9VZVpC
+THh5amMvTlNLRDN2YUh1Mk1ncFcvZTZJZTRIRUlON1QKUzVDTDJJVk8KLS0tIENE
+N0ZzdjNnTER6ejRqZ0Y2WTd6dUJOaHJqTk1HT2U2TlkyUnBPTFc5WmsKYcIKEURp
+YcoFwU+gxq7BQlXo5LJDIcB73HPeerPnKYpfdyXFlsdm8mv3IXPEabSPwSNHXGIx
+BdinoqfHgAjMwptksMA3iIOWqp1cF6E=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/htpasswd.age
+++ b/secrets/kelder/htpasswd.age
@@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSA2clZw
-VFBPRDJQSkxmaFVnRWljSXNOaTlDVjdvM2o2TS8zY0VnczNndkhRCnJybSswZG9I
-Nml6RzBvUE1pOFZEVG1RWFMySElJYmhjWDhRWkxGejd2K2MKLT4gWDI1NTE5IEZ1
-MTdFTTJvM3JIMmJSTjc5cGMzZnU3bkNMNURoM0RQRnZGUFFZejBVQ2sKK0VlUFR1
-NlFsVmVyWjNOUFlSVGVYMnluR0tBNlZJaUNFNmI3b3RvbDZUbwotPiBdbixALWdy
-ZWFzZSBLJUYuIHUiIDg8aVYnTwo5eTJzVmozcEJtRXJsRkJKTHUzN0VEUFM1SzBz
-dFEzSy9rMVN1SWx1WDV0N1BMNGJwU3p1M2VsbytjcGo2Nm01CnR4UWEyV1UKLS0t
-IGxZZVZyeUVIeUpxNW9ndHk5ZWlRS1luZkExRjVQVURPMlBpMnR0dmRRVTAK27Zj
-wfNM9xB10qk98JQouSzKdgMh04N3FlRorQEIjLh5StEGSbejCNES/0JtYpXbk8TR
-/gKZmHhS63guIlpV+yzGqnYm8DP09D9+gknunOhCF7Kt2jHNYx2Sh7JIltVLL9m0
-s0i7VuA8laoiEy7w6OMRIiGFqN2Y
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBvRWE1
+Z1ZpNTFjTnluOUlPMldCQ3BzQzdVaEw4dlZjc2xuMkhGWlNDU1ZZCjVGNk9PNjNS
+elNlSzMzYUNOQ0dzYkNFUDlxNlg4S3BGbXNldGN5eWYwZTgKLT4gWDI1NTE5IHp2
+eDFPZ0VadjFVZFdVMXlYd3ZFRXIyeDRQU1dMV3ZEWHJEaGxOSzgxRE0KVVpvVnFQ
+WHhpWjN2Mm9TV0EwajlyRTg4TVIvbm0zZGFBVkJqbkJTZEh5RQotPiB6QS1ncmVh
+c2UgdycgQmJMCnVhd01JSEpUQ1U1Q3o2Wnh5UQotLS0gSkZwd0tNTGs0NkFiY250
+eGR1WXRLTWhzWlZOaHlGaHQvNUh2MjNDUm8yWQpH1cWbszmSTjpqz8Wyrt6g2TNP
+rtCRSnfw7UcoMh2oW3kyYcQrwf/sAFAHLNMh8oOWoxrKG1vtPxpOz251hlnee8JV
+dIZ/2Gj/lPXDFTkhmX0TfABAe4wPJlM2wu9pj70UvGnI1osR6avrpYr9mMau3Ypm
+Ucix6cE=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/nextcloud-root.txt.age
+++ b/secrets/kelder/nextcloud-root.txt.age
@@ -1,13 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBYUmUy
-YUNHMlJZOTZRTWd5cW4wdTVSUDVwdnhkUzNzRnlLcFc4R1lGWWpjCmt1RkJXcHJl
-cDZSam50Tit6bW4rUGxERUZ1bHFoUzM0QlM1NEx6dTIzRDAKLT4gWDI1NTE5IHlF
-UGt0MUd5ZEFsTEQzekxmLzJvQU9WcGN6SjFIRzVLK1g1ZGk0V1Y1aE0KdHdwQkdv
-TTZ1OXBiM0t3akE4Rm9COVJtamlCUmMvV056V0ZpTnR4Z1Q5SQotPiBiTmBfLWdy
-ZWFzZSAmYmluCjI5aWpDRUphY3Z0MWg2Vmp5Z0dnZzJhb0J2TGpOeGdMNFNHbzJn
-Tm1RWlU1bDlsbzVheHpCaW96RmJ1Z01QbksKU1BEWmUxSHBGT2d4RmhDeTIrS0pU
-SUIwTHZudUg4alhCZ2duZHVNZXVqQTl5c3hjNzZKWE9lWkZWTVVYWnF6MQoKLS0t
-IDdmVFlDZ1g2ZU1Ya0x6Mmh2cVh3WkNGMGkyR0M3MUloelVTUTB1MGQ5NHcKwdy2
-0koJd8qUJy3RI1j4+ghburrbWmzewDTAVRa0zymC6xESVZswBwgJy/U1zrHjLmq8
-Mnw=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSArMzRH
+YnRFQUNJd0dRZDBEMGJZeitaS3Zaa214c2FnakxMYVVxOW1xMkh3ClpSeEprOTBW
+dk1tRWhmUXRzeWpLUm13Z05pTnhsV0hCRk1YUjJQMTdDQ28KLT4gWDI1NTE5IGQ4
+OXBuVkRiS0lRQitweU1TRURzK1VhY0lnWFpZRGQ0aG9yOGhsa1JnUlEKUkU2VUhr
+MTc5N2tkdFYxd1RUemk3MFEvb3d4eHFaVU9ycEhBWHk3QVRwZwotPiBbXGVcI3J6
+LWdyZWFzZQptTGx5SmVNM0FPMHdGY0NQK3AwCi0tLSBwbUxtKzMxYTNpdUlPc3BZ
+V1N2cFlyTkZvYThES2wrZTdHTy82cXVoeStJCk0ed1c9gQUw93efGmqJDQ608cwj
+PDVTyJ7erVlArctJkTKOx57QMqWzMSEGh7O196SceZEv
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/l2mesh/as211024.key.age
+++ b/secrets/l2mesh/as211024.key.age
@@ -1,18 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBoekEr
-NTdvcGd0eDB3TEVPTTY0ZUZCVTQ2MGRVa2V4NjRzeXZ1eDkvQTE4CnVJcUxMMjYr
-SDAyS2gyWFg5VGZoUFRnUjl4YldZbm13N0RtSENzRVdLVnMKLT4gc3NoLWVkMjU1
-MTkgbjhDcFV3IHBNdXkzdlp0RVlBN0tqNUVZdlhxRnVSUG5jM3B1cysxbnZ1Qmdi
-UWw4M2MKM0xJdk1XbnVIa0xHeGU3Z1V6MFZ4QjEzcnR4WWplVnZXZ3JBK0hNTXJp
-cwotPiBzc2gtZWQyNTUxOSBaTnFJb2cgSDVISmNLSFIwK1ZXRmdVeThlZzAzL0wx
-Q1FHWC9YSit4NkR3YUwzSWJpOApiREtVanZPaXRjVDVhdVFVUHgwQ1h6aHZjT1NW
-Qk9nV0FWd2l1OFNWTEVJCi0+IHNzaC1lZDI1NTE5IHMrcVJmZyBpRXZzaTR0Znh4
-RUE5eW8zc01UazFxMEp0Ymh5SDhrc3dFSTRFd1hVUjBNCjhpTlRYQ3JMZExQS3lC
-ZHZqS0t3eXVrYUVZRE1aWExBdVQrbStZUEZMRFUKLT4gWDI1NTE5IG8zSUQyWHlT
-QldDeTFUcUxNNVFHaGQ5bkMrbzYxM1pacTlKdkRkWEM5UWsKZkpqTklrSDNTK0ds
-aXhqLzdVZEkxTHlGOTFjU0lKU2ord2ZLZ1F6dG1kcwotPiB8YCZuKC1ncmVhc2UK
-eWVoZ0lpZ2tEODFvRC9OZnN3RlVtd3BMb1hRM3l3ZWI3Mm5KCi0tLSBUcHZ3dzlV
-YmNqd3F6ZkczQnhIY25wT2hwV3FwSWpJVk5aN2lmZmpyOUV3CkV+oAJmHkz5PxCR
-463RXW0hhFhgKtgg+OHwikiRqYII/NP6gZqBZLmllj4892OyG5YoOPpQKn17qUkD
-q+vIa+ISSGksPg4dUXNNJa5D
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBUUmlu
+VkJMYVltVTZyUnh0aXdZZzduSEl0ZFAxb2lIb2F2ck4zdlBjdFZNCm51RnV0M0pi
+VkVaZVdOMWpKOW43ZjhFODgzZTJ2c1F1eXc5WnJvMHVZUGMKLT4gc3NoLWVkMjU1
+MTkgbjhDcFV3IDdhNjB5U1h3ellMRDRRQWVkQ3hNcVQxUnQrbkQ0V2doR3pFWFRI
+RE9xMDQKTUh2bXV0eTdvRmhmTVVaRllRcEpiRStnSnpMeGFpeGt0eEhvQlZETXhi
+awotPiBzc2gtZWQyNTUxOSBaTnFJb2cgUW03aXgrM3FWbURXR3o0ZkZsUE83YVk1
+ZzkwZm1JdC81aHI4YVJOdWQzTQpzS1dHRFZYeHV2djVFN1Q3MHdhWVl5WVc5NExy
+M2xEckFMTjFvTWI1Y3BrCi0+IHNzaC1lZDI1NTE5IHMrcVJmZyAwQ0Z0a1FHU0lV
+VEFmMFpsNXF3Z0l3eTkrdzRZQ3lSQUg4MFhPaUNEbGdVCnFuVEhXWDdndnhxdUtV
+TkdRZnpFTGpaZDNJalI3b1NHUld2NEV0TlphK2MKLT4gWDI1NTE5IExObHUwOEFT
+bGl4S2F0YVdHaGFnRjdIQ3VDeVFDbjh5SFpkczN3d0ZuQUUKSEFvdTIwSUhvd0dz
+dDdBSUxDOHZaNkNLL0x0aDRCS1ZORUsrdWpJS3EwVQotPiApcDQxLWdyZWFzZSA5
+ZSA9YD4gbWMgRH18eXd0YnkKbmcKLS0tIElQa3pEcVhtN0N1bW4rSTZ5VnB3N256
+bnM0OXpSc1BuNmJwZnBremRIZnMKhN29J3s+Cif3jvx63Xay77CdC6uVhjsojdbF
+zhWad9vPolrrbEiNkhcdrutyTRniFBUEwxQVGmAxcEySNTr3lnWnWQFagphu3F27
+zLs=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/librespeed.toml.age
+++ b/secrets/librespeed.toml.age
@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyA4N0Qw
+bFd4Q01yb3M3M05Ua1BPZjNsK2cwYlBuSUM3TXRaa2hPU2wxb1hzCnhoTzNMYVNT
+bjRUTzFJdjdZVG1IVWJNa29PNjVVQ2NWbFdnNWNjcDk1bk0KLT4gWDI1NTE5IGVu
+d2x5N21ZaW5MeHBzWkw5QnV0SUNiZTJBVlhXOFZacUFJVktNQXI4MTgKYmxQYmlC
+YXJvYjhKbWVZWGRPWWh0eTlIZTJPSFZTZmt4UHJ1M2thNHRCMAotPiBvPls2N3ct
+Z3JlYXNlIGowLGEgUFNKKWljTX4gInUKMkFwNGRiZUJCbUZhN2Z3YnZnZ3Nna0tD
+UCtrODlldWZ0Rk5INmxTd0tmTGx1NS8rQUtTdVFwSVROcjVqeUJaWAplNWd3SUR5
+MjRzeXlyemtka2EwdVZDTkowTk5NMk1rdUxCdkR5ZUJOCi0tLSA4bWVKMXFTalg4
+ODFIN0hsTS9lekdWZVI2VTNKYlE3UzhXNk5nM1ZCMlowCn3ZLml2b8qDs+A2W8Nn
+YGCfDV+aes39ef/2wu6EMISradXZQrzhSj8JHn7HqsarqSQmOhYP5juawEFxAuZJ
+kUc=
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/middleman/cloudflare-credentials.conf.age
+++ b/secrets/middleman/cloudflare-credentials.conf.age
@@ -1,16 +1,19 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBKeWNp
-MzJ1MWFrMzFoamZ3SDRna09ROG9vSUp0dSs0TnhoNEhOdDBBOGxFCkE5L2t3Q0I0
-c00rZWtJVUUrMU4xSDlCSHFqMFQySDhPNkhUZDd0d0lrTmMKLT4gWDI1NTE5IG5T
-bGFiQ1ZFZnc1SnBvQysyWnYybTJjNThaQndDSkpKVDM5K3AvaVllancKL3R3QnJW
-MVpCQlJZOEZNMURLKzRNbFRnT1NSeTF1OThLOUFQcjNtbGZMVQotPiApJC4yWCRx
-LWdyZWFzZSBAXiUmCnVSdUNLV2pkZnlVV1RyclVnTlhtaElPSHVYNG5IK0lLRm9l
-ei84RlRjY3ZPZGJ6b05zditqaGZRcUZYUG93ZUkKMnEzUDlRCi0tLSA5MEdXYVZD
-ZTNNTFNKZG5CM1V4eDM2MWtscUNTVkNUQW9PUDk1NGdrYjVNCnIS3JAGBgLwb+6u
-2aZSW2J+576VjkNppW4V5iYN3DiUoHiroA0rRTPyCowVYuo9qtuLt2YC9k/fJpmO
-BGxRkAdc48XofxiTbJtoDnsP35F6w7x/i70UpXXbe+98rhJMq1uh0EDu03fXYndT
-Pr+JGsR+SHa/QCtb4A4kJ5CCNVLtwf7iNw1+/A9uGcTwBlidlCfJqfrppsfItnoI
-YqRMX207HA6WJZbMt9MFYQxK1n6lUcKU+k69yk4eGV+jLNvLsz4hCXHTrY9lpmHo
-KipMr3Knqz318gIG2RAOectFy0Cqg8b+u+Uy/1/0OJh27RSzaZqiaJPAGU0ImqYR
-N9kWmsp4nmd9+I7v4Ba4S1R4C9Y=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA2NGhR
+aGJ3RjRaTjlFeUtWa1FZbmdQcGJmbVdxNVkveURqbmdwL2x1RGpVCnY5eTFZRjV3
+QVNMZ2xGMHVBek1BaklxUUtiRU5pTU9kWFk1VHhGNE81SFUKLT4gc3NoLWVkMjU1
+MTkgVkZjdzVnIElYUmkwbUFPeEExZnJGVWwvUFZsRTdhYkJsSC9CM3hMbGtuSVFs
+UGJXQkUKQnc4MGNMM0JZcC9FeG5HeHpLUVFlNE9xelo4Qk1mam5WNlBITnF3WnJs
+WQotPiBYMjU1MTkgVkpmUVdBY1p2UDdLcFpXVnJOZGUyZ1VXNVYrUmxkZlpqazRn
+cVlLYkt5YwpZSUtIN0RwSEdOSUFYQ0Zsc1NzeUhiQ2Q0T296dmZ3UW5hY1Y1MEJn
+MzF3Ci0+ICV5Qy1ncmVhc2UgXSggRWprMCBuCkdKVldUMHozVXlqTVNrUVdyUVd0
+MFdSN0dPSVdnT3hMN2NNYVBRSGZnV2k2cVp4NGdjMHBHS0xadC96YmNObEIKUWVH
+YWk1Q2tuQUpsV01JWVozbG4rd0ZiN1JHOHRFYVFIenVxOFhXRndrN09lODkvaVhB
+eDBoVmxvbU1FbWJrCi0tLSBSeU5TaVZUbmdwdmh1TDVzb0s1eDFvNkVrK1dqTmZG
+cDJobU1DZkdHRWhnCvEtMAlEC+BPPYX1YvvcmvRjeOgbuuxzjkGjuB+tT1pBKfYR
+9gsHtkPWibhCk546Q1w+fY4StxKmaoxPddBjeQNXh9W6cCQ/vSmxAFya3w5SEtPd
+QjozqEVsiwBmBrZgt0UJ96e5hmhmD6zU7fp/RhpFpZv1JrEkhYEz8+jk5Ai96mSg
+0pKDAU8xtCnyBBaPiaj2jU/6kiKoGaVXCEuIv0uayRhRp0wap/kf+ToHA/oXVXbl
+TZsalOEKH38udhBJiMjRgemqyHQEEpjmYIMWdiTvH6PGZ0yp/09iiEyBCMwzcJAk
+nr8HyZKcuzswBcVjRak/raM9lAbpdWWktHxAZa67wsCH017FDrN9e15B2MI8
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/middleman/htpasswd.age
+++ b/secrets/middleman/htpasswd.age
@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBsWU1S
-TXF4Q3kyaWtGUkZOamM2cGNqcVI1a0NQSXk0THh1akxkTmJFNEJzClBSWW1LVEVZ
-WXg1cmRRZ1NPOVJqYjNKWWN4TFlsQ2pYbWFBS3ZTRWNZY0UKLT4gWDI1NTE5IFUx
-T2QxWEVBaXdObjU2U2l6UjhMNUovdDlhU010bGUrQmUvcjhNV0FNeE0KenRDUXEw
-bjFZRmh5QTNES0RZZFQrZkdObUlLT0g4L0FzVWVzd1J4ck5LVQotPiAiaUJ4OHwt
-Z3JlYXNlIGgKVVplTTRQd0lHU2NrZ09sRzQ3RHJPdHJRdzd3SitVawotLS0gZzc4
-VEJ2Q3BwRGdCSy9xdWxIeGl5N3FkZ1l0TzZHQnBYc1ZjMHVNS3F6MArZ0OwtHR4z
-iK2pEywZjSh/wsaflIvwwZFV1ornJ8VNSs7CiA7+L/zxbg16+oJAeMZrL+NxNnhA
-P1Czk6x4spIbvl0a+0BC/RKGpKjuxMGkg6b86UfLZRtC9NMJNoZiUGVTjRwDwTYK
-TMYbf/P/3HcyuSIavAVR
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyAzb1cy
+bHBVd3ZEQTI2R0tyaStqei9KWnZkNklSYnc2NWlwa3NNM3hXNEVrCnV6anpBUEVG
+RU16RksrWWpkS2Jwd242dVQrbWFjaHUyQjl4NU5EVFZRc2MKLT4gWDI1NTE5IGdS
+ejBneU92c1BXVVZyS1BBd3BYd3lHMXNWTW95UCt3MzNEQnQvc0RFMmsKRTE2bVFH
+TUpWUzNoWmx5SnJhMkw0NVRwNFAzYUEvdm03UmJvdm1iNlB5dwotPiBRaWBxXS1n
+cmVhc2UgUiogYk1BYG9RIDtQIC9yO1A2Ugp5SkVsSHdFeXlUOVJqWWludTBOa2lo
+WnFwVFlzTTczMDd6QTV3bjh4WXFGczdFa2VPREVQYk5Id3gwQy9TODVVCjcvbwot
+LS0gckpMRnk1ZzNqK0dwTUpTM08rNzJXTy9pYSt4Yms4bDJKRTJNdEZiempaOAqM
+fEEZwzb9VpBOCyxctqnyXmhVnOKB38DoE0yvUup9nVgu2ncwXVrPh3tMmbCq7GpX
+MqpicRitNIlGhP02YyXpb/LMUU1nV4V7kN5dCIzM3mve03Y0SZG1zw+eAkDDgs75
+Lr7rI/blUgbbo19v1swXKZzxykIQ
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/middleman/mailcow-ssh.key.age
+++ b/secrets/middleman/mailcow-ssh.key.age
@@ -1,65 +1,64 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyB1bHE2
-TWlSTTFrYlFLNUNwYmpRR0VqaGowWnBuc0VBaEZneWNZM3VZZ0dNCnJKMERERXpt
-RW5rcVQrQnY2cDU5cTlmb2c3Ti80UmZlQndXVklNUzBoL1kKLT4gWDI1NTE5IHA5
-N05FN0lmN1A2YlByVmgyd1lRRU9qbTVRZXF0V1E3c3Y0c2ZnU1lpWFUKbEs3WkxQ
-Y0tjbGFRQXU4Z1Q2L2pKNTJweTNVK3NadS9tVlBaTVpieExHbwotPiAvfDEtZ3Jl
-YXNlIHAgcGhOazQoXHsKbnRQdzJ0aXFzOG82aE1ta2FGZzFvVUZyWTg0TGIzWEdB
-ZnNDV0VMQjN6cTVXV2cyTXc5MWtreUhTVEtpCi0tLSBoMDRFaC9HMDRYeGhTSjNR
-TjY0dE8vMzQ0ZWxVSFNMdHZDOTY0UjN4U0pFCpc/aAVmRhASHj6mVTU9k+RIgj7i
-peZwKccrQeTfcQP5SbDNJrjSvP5vyYdrqJwZe+xCoNm8atozifRjUoniwF1sxOef
-t50Y53cj7i18+HcOiD+AmLn7XhuzsBxPh4fhfW/2UQ9dIk1SdQ+jdY+Pcd2/YuT3
-RNLQmw+UmPU3MUWs2dYcpuf61nxu1vQM97wtxNmNm7yXKnGRvO+ermMA97eXVKs8
-KhenUI1o6ZPrpogE/wcMxucXSIoLlj0yfqDu1MrZJ9W7fN2qUutXM4LpjLxbCZ75
-ye59cFw3mChc39iNOqvQ6f2lfQnfq1VfpHgMTe4h8r1g7JK+BBzYxOOfM9hW6uvj
-xymkpUlsKr9X9ALyNzig4trk0YTuPrsIAOWd9MvthFvSD42baBRC3jssPQItkz5p
-oD4OT2jDvPeSufPx70CAXv32fbz7YkgIugzIxzsaW5zxZg8PB7jrFT2Nq1tugG2W
-bYNwdFyJaaU0XMv6BlLVWKM01uy19N5xMA1gOfN/U+Xh0hoCh5+cevhH8Dm3l1wN
-rfolmOuaVvyukt1ulbpowfrpRVbRZYqvE1CPS0qgP7h1K8B2qwhJJysxJM1tH4tE
-wSlGdVT2r/7NLQwYL/+GqH+hW4SDGuswtWwMI9pIQlNC/4PN/Crwq45vMpRnAcIR
-WDOsbCAIx9cAnqHl5brQIlIgGPTWIORjuzsGaaLlJ3rp8DC/px52MZR+MI5xy+2d
-PzTptUgTT7pc1ldabFGwOdE1Z6CBs16hO63us4xHluDkMFBwFmrcuCqKwcz54KEY
-r8dou6o54lU0YlStXaIB16fDxdpvlVKMxXrqMBBk2uwajbvnysYoGDirZ3u1J2L7
-/Kj9L0sFnZyE3Yg8QVsaJg4PwBytN46+T4MpTX8kCaAeiw7QTUkH1y/HWP3j2b+d
-+V4oHF5Jxsl0jd52nGYCwV+YL58zZt79AOHdiUrzm/SqvHgzWtrEBr75YEUKhxdY
-Fu++CzdkSEtpGh6h6n6K/K6Nf1rFa/DxcgP5XBgit1h8kstaxesirN0Fs4+G9ugc
-iif+TonX6V2wrFQx48UZBVF86aYtzc97BNpisJAWft2HrZXlFa4Cd6DH16oWDBiM
-Kt2j4VM/mIJNs+m7vJOE+emInemFZyesprf5dhqSetAWceTC1HJ42smvk1RbaCYo
-J8wxW5UBzm7A93UBhdhgijIC/WhbFWSTwVmIYV/2VTLroFCyTgPq2K1HPm3Hq6Fx
-dI1CCzVyRAafiMQk4Wnp/r1V14uDVYrixuTyVTWVSvujiouz34X3Ii2jqdm4/bH0
-uxZ4o1D1AiInUMWZ9E8jg9sTxTwI3SUba0GeS4NW4WLC7hKghKz102vtuh3SFp/p
-JixvEfHapnydiYOmeRu82kh/SKQcuutsTr15knvxQ3PgLjC65dpqPnjJxV7QQq5V
-YTzto8wUcaP0uBr8nVAtx2R34PpJWpYzOoL5JmL50uH3eFWvrGcO9ESmYxEO5UWM
-zOpgDWpEWr8Nd6I3VDiR16VMULMIXNg6I1oalpBW/zlIZFaLhCMafxDDgTfVtRy2
-gH/3bMZEoYjRSI6LnskTu5S9acvMUqzHkZTXa6nib9T64QkvRh730EDv3RHcl/GB
-uToPm1uF20muw6n5Ko5r0ebyxGb3r6CyJe/539Oh55IoWF7qsF0oqxQimR5IPED/
-hcizgt9y2MBLQB+nvm7Z3b2XB98BozDfHX0ADyI27pV6t+jbkXciPJfJIgCnFIvk
-oOtosKjZI47N4RtFb7aeuQ4FTiNHgmSYBmJXkj29FQ11x2SHYTqeDngWqiDLO8BD
-UztpCrUWLPbaTR8pxDrc/0FpIPF8Cx4PU3PSGw8DQ7DzjDaSfqzeP1WBYpYeVv29
-s6rCUjBzsfFUxPTc8CMJAWZAWEoHFJno1boEjmDcOQqqQgx1iZZAMYp7z9tLTWjc
-cW9nv0SxToK6m+74FiL09cuuI2HgM/gE4ZDGSH7nxOaKrYnpG3lElFj3eOTkW8KP
-rDkDNv7J7Aw5iYS2ui6dHpyXhSGe6fFlvBBxgXtY6jGCvotIPGqCao99rlMWJP4i
-73eQ4PVGf8rJZ5/vL6c2phh+qEY3exf43VhzZlXt1SaMz9xUMwJWENI+69PjPwJJ
-/k09IFh+ANgHhfsjETa8cJRsgTPnTJRfym3DBAAxZlVZ2YcM43n71fXbs+3K2rqO
-qTf2nfFXhf3sp1mVCaI+S09NOPMxV1GFathpzukCEFqI/Zm3HlSuY3sJdRZoS5g1
-PIDwswhDTz/R28c74Urgqosv5eygejM5CktaQRsSKr1mMpWGfGtUIxaONZteUxPM
-BdmTsDRn6dzz1fQssGIE7Y4uNrB2pmPRjEaYhNcRZsX+Wcz6rtfXU8S24DNCR1YI
-u8w7WP8UWPlcKgdCueaKzujLnvsBM5TutOO3AWKNhcxyFH8Iiae79XmLuyKaAlR3
-VXwjPEA1x9oXVER82pYqYV8nvK1h8BSax6oS1MMH4PPPzANfODEKE7kdicBKBqyq
-JvCF1krJiXMc6ZTO/V8y1JDnlkqznruARyoeYgjbSYwTDCHUKmLmAA5cVRr3Excq
-HvlpbEpZqK4DtLFqMPP+r1AlR6Rr+BsdhCjpXXFj+Ao9rA/dHxYNE0gH2J/9Cp+x
-6DXb+/r6Hm7pkC0sRhBjkn0hiNmRiU+ukvor3idFMG82UxMpvPc6w5+QixpOXfbw
-XiW/nzgKneF5iU0g8lu9HFTuMOv91bj3DJNWfeXEb4uVT618F372IIAlzFtjsxuQ
-efV0s0ThtKM1hqxZXOoA4IpH35ihImBGtl+pxZykeqvyZoacLH44MVPD1ONcw9Jq
-ZOsndUX7y1C8vi+WkED8tZKCi+Vc18fQTi8MLxYiH6qk87+lLn/00WuZxWF/FX9f
-ltJLjPx6BJLsMNWNIjS4LbFG5Y6xsL0gUlPKHEvKsipzebnNLX+TckxTETlB5VR9
-pfE0p6jonpzjqB5Z2llRnARzlteh167Vj0/oHDqf3OyhMckkqIXJkRAOORA/Gerz
-QLTy+WPbcEykO6DOZ/cmvfd4rVALM6HXcXc4p7CiCgurFm72x6KBQXHg76NsGIeS
-VsBqnUbwF2mFHW54rT8uF5VH1Omd9X4UYEKEGqPVmOq6FmYYFGf8N5wUzbPS4Q5a
-U4nU4fVedpebMQRuKjouOV9Iur++tfjlJTthxOcL4VbttCaVQwKMhSZaBMtYECsD
-NI/LjzYCBQmRmC5+Pv20gBbV20ns9h3789GLX7dnyQLyLXW7SgXSCQ0+x00MGR2D
-tDQbhc74VqIPKPU9AgkBWoke80A3rsf/Gupwb6EFx+gEomH8ZDNvBTq4YOz2MI6u
-/64MEuSVdXrLtlQEzi6gsoD4dcsPcK9pWZV79ud80kgW5shBCqrusWZckT4znyXW
-e8eU8uLiGifrZgvKdHu9TtdDFRqmdnxTqyMyeu0wgZf/6tYrTCr5l468VGDQc1M9
-2amoOarISOa+oQ==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBzeE55
+R05zRTBpMFIvRlpseVdjMjI0UVJ2WDBxRmlJdUlVejdXdU4xQVMwCkR2d0RsYk5D
+cStTUVN0K3IzY1RYZE43S2d0WktZV0JCNFR2ZWVydUpMZm8KLT4gWDI1NTE5IGpy
+U2c2T1lFbC9iRnlEdXhidVgrVmZzcmxpRmdkTTNScmY5eDZMZE1LV28KZE5WQVNX
+d01pYlNsc01Ja0wyY1VNeTBDZWREN0FQb21kd3VTT1Rjc1NtOAotPiByPTQmJi1n
+cmVhc2UKSWxoSHUzT09uWXRqNG9BdwotLS0gTTJ2NVFjQ0Q1NkZmb0dTZE1Xc1F3
+K1o4SWMwaVB1WDFkZTBMWUNxQnBPNArt2aY0Lb0ey64r80mWia4oYkczRtqs6XJy
+34qL66Fx5OCxbq0q5klZz3S3CPMV4cqglODpsAOf4vq/3uZIbbVXOe1T4jwZ4TAN
+9Wx8nA6LOGNO+NB7RakJUDDjZ0u+PsVH1ohEUGrpu26+oHFRRigyB4r7Cr4LZ/Pb
+6T8S4vDCCl8gMgxKkapCC74eghSyulx9d1uEFmlbdureAuig0iUUFCktSECtPOT3
+7bw/dHi2KiSVoT1ujWW0cJUThqyuS2ugrbXqU2Op9FjM0mkoccRkwbjbMMZz2DVY
+i9KYOIFW3MC6kARgNfIjiggkJlZT15JorbGB88ScPpePrybRv4AX4hLlygK5mHEv
+9VlnSqW0XARkS/JUdcnxfJUSIgh4xN6papiO9ArKRvqTcUkcRagQfWwDkwWR2lBi
+7oAfPNkB0UjczlZqWPbnDhLNzh6xDHjVBYg2ZBwaqpyFRSjzn9Yaj2S18EzvuWU6
+RqjLrLZQv13UPG1dyBvKSWf+wSnVJ5dLsjVl7H1SFYhOU0hrdELORPq/Kw05jpTw
+EKOB+rC4wyKUGJo3MYlKiUFhTUSMlyhY6RX4hfivLYeU7NCV50UDy/JAQHssQcfX
+LLAAg7bYbYCmRay0gGD19lO6OpWXWCI9JvdkFw6UU0btc+aaT4l24+pb3uHLun2a
+V+O3RFLgKmhdtCx3e2dV5x8XjzIqKHWw0mio4dFOyEhgeUXxsoulOivOFXDEBfkq
+Ds/kBl7B7mDvtKUmaVgmi3XGhT1TMucXii7JL8w9MBWgdrBbl0rewpvafp34W0n3
+wQh+oqUqf/0E+5LGAuQQ623MeCaXmYEyypJSctZbmf0zCKFFzTU1/HVjZgYbP4AM
+pI9H0mqxHyk/V6BxmvvZXw48kVoV8fOMseE+Q8TNp/NnM/TOgBGQQBEwGeiKDZnr
+Wk/GJBYNeGYMOJMYYkRToBeQowqBQ+NtNpersUda1RoJhH7EdxYzLBK0jN51kYBS
+7pHU5M1ZCnmF59RtEezq6TNRwQAO3tnp3+qbUxim6U3V8MTOpumL4sapuqv4fR/S
+UoTgcnJIyKBif9e7XR82da75YXeBYWq8tj8d17+FPolJivdwiyB6ZTvkzfXo6Y6S
+veNv7F6bRf1hukTviMUQnsc8XC3oDYyqKrwMXRzgq7oaim45zx+8MHVPqw9t4NSE
+0FA5VqEqRRdQWL59zuey88Uh3GtW9W4z32NYWYlC67fLZUqBqckbYmqqwqcS7XkS
+Egswa1KHHW9bGAkJvLdxryT65EKnZWlVj/oTild/JmAeMLi4lR4d9DQ3N+ko6Zcc
+DFQD+00pncDCFNtk5BeAG8j1Vp+qpZ/5PvqNAWsnoy/yR7UZ9i/AUsW5ZtQHJTnV
+tuQYvYQilnKr+yNjHX+mvnee3ZmlParbWh1FqcVPEZ8dM7F0x5zGUPAPdScyzYtC
+P46vhCRLKjzXXBxFK/qLtzqLmGiCumk5FFEelyhoJmZO1OoVZOrdUOi891OCUyKy
+m3zsh4IJ//QqGg5+sza4Q+z4bjwg2wIAH6vy4ULtdIF+vij+j8dCH4FR1TbQ2Q1V
+/urgMGj6N2sjxjBmAwxtcGgwc5HI23SxtBQh1msSbJQKChSvbI6CvkFdwfzGuWZy
+c8jWNbrv6Xf6HW2pUrnvtdUdH7+Jfx3O6N8t+yNKbxCC53GwHnqclkrhvXcwQCH8
+sMq7GFzS7xZ8n8qMVhITh9CrKuFYmrh5gOrFwLlQArwuKo3fK2/CSOgGzqVgg08r
+ddyeFzvDlWXg62uinUQhni1w9Ou6Psy5Azw/yBRG4wnBw/n7WgRZ7ncVCD7ws/c5
+FHAvkKdd95F6EwSfK2gNGmPO09D+srmbdHUJbGN4VgN7qQ2ZyfA/rceLDOrPyt9r
+ipkhhcgg50eMWEZr72JT9feKDwAzQ4drx5+9VFH0T7vWCyCBEMrATctnE2gRzS6a
+JQD/cn5FHbrXXs68gAhyL10bktnkcCp1I3TTYgy/guC1NFhK7/Ja4VmP0JEyuSv+
+ZNzXtjx7T+/HDxXo8pXC1hm5Q1GHmkwfpzPpd4nRZZEgtcfdat1VxBii67XaB6VD
+oWZgd3WocxWtTQHFKMStKeM835RnA220jmyXKQM6q7NF06dqx+grtFkoK54uqbd
+7PPnn6M1WvzC0xadBmO58Z8uNzo0cOipaxLACcyC/GYb7M1wGWbC3iKcNbw0asxU
+ybslcEc2M8002nFU47CzqAppN2KfcGJLj5cjLcHHNrwsVf/Z7QdS/vXaGbuV6rtl
+xo+euN25R9uLsEzAtRl3JeofcZRNtA2itROxxxS4MCivqz2rexTg94xyipFNqFzd
+63bA3nRIBbrUWgekjgqcRPlQ6m5cOq7zOd5aelhUZu0xiQJaUtj9A92iJ/9EkUVT
+ZpF6PliFg9Tx1EOGMIHwHyiCfwn8fR7QkvKihId5gpKT59kr9JDLw94r9iGdpXN0
+r2ozitfGWiNX9g2FvskG8bs4mqxv5lgyw1JexJf9+SiuDQgsRc1qYIpM71phLtI6
+eF3t8xI9E5ALFk5lTh4TFuv1vs97fmXnZ1TUO7DDA7C7xMhF/9SgBjS8bs/anZgt
+BBfCQCPezIXxtE+oVELHGAyoK5q3kQRJrlxqMnK13/Ugzn/3DsHXimAneqCZR+B3
+T9NYtNgxWHubF+XW4sBa9cBXPQyjY5BWUQYiBk51zdxVkPcqt4ezeSPn7EHQKGDO
+6Cpc3E4T6C65TsXuUgFROXIRjft9Hwt59UwcXHGUqb6eeX9I5uSMuhfPZe1Iv7mM
+ZvYPan0zY5kZ1PMHrApgx+10pmonxIoqj063WP1jT/4JC2TJxGncl38mDCZ9cynl
+FA8ShMdZcdSgYDZZ3BrF3MFJFTUKL81N63ER+n00xPf9+ZqTTqIZgLInO2B9kVo6
+pAp3Azh5d3yfSoh8i0r2VCKIZXpreQvts4/mdrJXEZLmRcGZKmeg3wCxQ7mTq3gm
+m7zdvsDxh0AK/HEd+fd4wCkFqtHOGb0mzuTLoDZ53cmf72uhT+npw/K83kIr9wQZ
+h87QRVEefXbEMzbxu95nLZBpgf/xS4VaUOdzBbHfV2LE92309VEO/GOWANz+kTew
+G7lRhTP17nzmuLVn5VZNGulSqvfxZghl9CUHYlH8aqEju8Yhod6IGl/86feHs99I
+MRpWs8qgIFtiVTxbCSma/pa0nC8z0p8YeFVCdzBHXipdszXNV2iAc7UIxVjwejMV
+typEIZM4JFjqpuSrN9s8hRzd/mwxPcOlboje0BrndbZiRQ9+itefGIX92jLqpNM1
+avEHk+R9yxxcvoP724ZPzaRg6K8ZNjPOavJ7afh6ewnO9/j+SdJVozYGpupsBy9i
+3OaJYY1+/DsTodCYF/mu6+P3S20k2SwesutT+5KPrKhQ3fASfmDwslHnUS8/zuhU
+OPDzGySCQsPzVOW76k7BsaE5zGgNToq8lnhYlE017yg1BVyDlTdBPWn8IILz/ZEc
+L2QMeVI=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/middleman/nginx-sso.yaml.age
+++ b/secrets/middleman/nginx-sso.yaml.age
@@ -1,20 +1,22 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBGekFB
-MlF4eGoxWnJzcDgwSCs4Z3hPWWIwUk1FVXhHUHFkdTBCa0tXQjB3CnNjNi9ZYWk0
-Y2s4ZU9LcXFETzhoR0I4R25CYkFHbG9OWU9JbStNZUgzZ0EKLT4gWDI1NTE5IFNi
-M05uQTFFYkhjZVVRZ2JwaVN3WUIwV2dWRTQ4V1RNRmRDL0RvRjNvazQKQStNWEJP
-NzFYYXRDYnpsa2lSNnV0cGJFbThqZGc2b3B4Y0FxK0crSHVuMAotPiA/UV1ALWdy
-ZWFzZQpaWUZka3oyNmtTZHJuaUpHaWd3N1NjMU1Od1FCTlFkK1dsLzFVdnJuTG9I
-MFJRNmxkS1FYY2F3QQotLS0gSTQ4QkN2NE01aFZPWmRTTE5IUkVJM0NES3dmQ0wv
-OTZLQytZaURFUkZ1awryHKxMJWhLC1+KZBW/GsqtYfX2H2BAhV3+BgO55/pC02kt
-0144k68Zt3SzUHPOQEyJTRnSkuBYmwOqkZ75lse20gKdOH06wwCYdeP52sI8ndXJ
-s8d2PWgYxj16f8+SeQJQIIL6HBX/uAo/P8N6Wi6fXdJHRLR/n5REic1FGnrXxYhR
-Mz+lA5OmFICRi7EJq0nFbpXtP58/olMmiBU/VaKxbpZlv8gkocDE1oP1Hwo2fbB0
-ZWI/xhkHq9fvb/fs4guZwEHALr+AX3/nWnwgEuzZ+lLex2bxsDtum4QUPAgqKzct
-Kj/wRt4wc9P/mWCa8eBxkGNi4nkm915c5yYQGemiWEZ29o6q2XJghr3kTLBRkIIR
-z6BZrqcYUTiTRQz5uOYFdCttsRQ8QXwj3EigWa21O65TaBUuxQyh5OUlrW9Yk9/h
-KHT2+Va+oODGL7GJMUQSepxv5yo5cG7XjMzE2ErG02CzczAmQIe96khGmuGW6YhL
-V3nNPSW+SCI1y48kZ77PNYoP0dRMeO3L6cei3H5VHCRmgDCAB3A8pG5evkX7GzIj
-y9TRGf+rT5NRI5GbaZVb5dj7VhF/0k69FlPO2xcVkvFL5NHsnsEf8FZYRKLG6+bU
-CWFWXrtuaPL4YXuNMO/4kgqtJxsZcKkm5A02tYYKES0RJH6HvqM=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyB0Zk5z
+dzVqSGJxNlVnTi9KN3dvelh0cFpTdXR1UldsQWkrTmVrOW9SaERJClI2djdMQTQr
+U2hMeGxZOWpWVG5SWUtnVXNZazlXK0F4bUtkRW5hZVk2bncKLT4gWDI1NTE5IG10
+aWhlaXNFMy9ONllrYVRwazF5MmFNOGJJOWVxRnNqQnNocmVTTExKVlEKWW44d1BU
+ZHJXTkJJTEdSdFU4dzlJc3NaNlI4WlVEVVhFUWV4UWI3Rzd1bwotPiA4SS0jZi1n
+cmVhc2UgVD0gRXIleGAqUXogYgpTbVdueWxHN0NNQ3Jqa2hsSWUwYXpTVmRwQVFW
+UTgwd3Q3eWY1ZFZDRWxjditRdEdUNFVZV2UwTGpQZUZFYjhNCkZuZnA4WUNVeWht
+SWtHam00NWNjSHhBM3RTTmdjaFRTKytzRFpJTm02TXF5Q1BGdWkxN3lMRmk4Ylk3
+ci9BCi0tLSAvcVExWEh5Tkx6TDNJRkJuZUVmS1UrK1ZtQ3hSVnV5OGtmRVp2WU8v
+NkY4CpSGlODuKDBde83bkqU20xgamzp5o1px5VcyDFhm/q6/QkGTrqPZFqp4Ho96
+Om8Jk3RkOBTSbdYlRXlNOjq7SB9t83bf4nwKU/RH9bKBOXlOtuU6vgDdtZnct+L4
+S6P93brPGYhV41IkjNxg+HemIToZxZwO4lUqlICmkJDQhuk6F9SWYfiNQd8l+lXa
+e4WbldWMpwlOtJVplen2F8itZWAIGPNRq5UTmzKA40Zk6eW+YWqB2mhvbZ7b4Nto
+gruh/4URaWqjOGLGjCfw8zJIU3qf5wWntd5BnLkFYjFZMYLWQHnF/SCKxxLVlzsE
+9t4vu2lCwjGKj7uEoPUcF9bTSNZjynNFLZsshGjwi5L3dvnUJzUc+JXKxMqBaVYF
+DrBDBtUnjae9jj+/YPLoO+6BnbezJLhvfIyT0Fw82CGa9Utlt/VltWp7gUep6YyK
+ArhZam2c45rzlwV1tnsxjZFK9EuRYJeN1VRYr+tR2wShUGKP1CEz1CFmkTa+r91V
+/8eUvOAgEtP41y2vxmpFu4kjNQEAiRs9Chbg+Ap0zUSxDZqkaQXSXE4PWEgks6VL
+I8ss2HfQDtcnEoNOwuESawI+i2oDclvkmGD+UDYz/BmxkDrjWjL0CxKQHDv3GHgx
+URR5TtwKc/YoiSkJTYpBYB1VLhgHCnsQ175p3w==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/object/atticd.env.age
+++ b/secrets/object/atticd.env.age
@@ -1,15 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBvVUh1
-UVh1a1FUOHFWMFB1S0t6L3pkTHJlQ1hpVlBjQjRCSTJxclI4VUFvCjE4aTNlRVoz
-OW5UWk53MTBEN3ZzWGFiZ1NjR21maWp4WUgrN2UvNzZmc2cKLT4gWDI1NTE5IFRr
-ejRTYlBzRlRUbXllcEFsMVhDblZYM2Q1S1pCMW53aU5vRlBmU3RVMTQKeTJTSmxJ
-MmFVZTFGV01kMFpVTnpwZzNybTZHc09GejVOUU9ZZkxrK2t6SQotPiBhcTMyQS9U
-KC1ncmVhc2UgSnAmblMgNndoICFwCnVFSDM4UnVkZTZieUo3YXhLaUROTWdwcURl
-dXJYdDdsZ1lONEtTUDlyeDlpUkptNkl3Ci0tLSBmVkthZ2FiWnZ0OGJFZG1rWWcr
-NGZ1LzNTVUZabDhTaGkyNFU2VCtVZ0Q0CsUEBwCQfyjz1ZytVvVE2ckeh+5QbcLs
-+LxSgh0RUaFvQRKi5R3TJh6L3KO5buhv71myW88K3d8W30vqnfrz7NFRHJvQCamz
-ChdwfwoLuNvV5jgyewvBCeyebk4EZi658XfKkZaRSxiOi6PyoqO8P+Xqi5VOMEwf
-fvpbVIW3LAnZIlicxrhp2Dsj6lxwHPPVWdz8Cm38jdfBBVjHun0xCTSkOzEPmGUi
-I17Huqm3JfQyyg/W+DJO/yhmyDGp83a5n+RFjL+H67QJ0HSqKwza63biWdXs9p0j
-g0LBb1g8rmtQFlkFkDKZAimxyo+L4W1X7Bz4Hmmtp8Vx87R8AA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBKM1VC
+TGJOMU4xVkVnMjlTRlpmY1BKT3h6WTJEcEJFWnZyYThqczZPUms4CitRUStIdlhY
+MHdEV0gwZ2hBbE9pM3VkSTVOL2ZBZFBKekFqMmErTzZ4VTQKLT4gWDI1NTE5IHBt
+czNzeldEVnh0L1RDa241U0dWcGs4emJ6ZjNyZzV0R29nQnpkdmhUMlUKa2RCUzlJ
+VXNRZnEzV3BwQWFJc28vWk9obHMyem8yWmhDZzlvUmduSWJRdwotPiB1clEtZ3Jl
+YXNlICh8NkYgPC57OiAwdixSfDEjIEl0MWoKcnRQNWVKSTJqM1U0YytFYThuVm1B
+S01MOFQweG5zcmhBbkQ1elJOOFJ3SXdoNXNBaTB3VW1YUjJxdkxGZU5PMgoydwot
+LS0gMTFBNmtWUXRKWFVWNi9aaGZVZVkzUzVUeGg1ZkplUW13b0l5UE12c3VvUQpV
+KCGAO6MlgPP0wVcDfMnJWEMSpqIs3X9wkkIoo5yw6NAeUhlxe2emWwk663PPUkXt
+NfiLA2jUTu8B7I2BNQKi8PMmnrydfjV5sGH8ACeP9QDWPHb6Hlri2R7IK8juEpl6
+0sDrh5ktb2+vNqoz9lNm1hk0S1l+InjctP7HUM8hhNjXVASBUhUX37NJEtH1DQdB
+7AlebX6bd1VDGwsfCyEzdg4N2nd/73J4fcjvtqoEz7fdfkGisNjjJ42iFNitLNZw
+WnhcUByV7msJq9QuYI2dozDn8qJPFyva6sfmeuZTgqclBOMsDTsBzWlXgK11k1Pz
+got2TcUCfPIVqWQ=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/object/hedgedoc.env.age
+++ b/secrets/object/hedgedoc.env.age
@@ -0,0 +1,14 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyA3MjM3
+dytZeGQ1VmFtdmtEdFlQWG9zMzZLY3psY1NBaVloeUh2VG4xbVVrCjdua1BHajdT
+WEpvdTRoTVdTUGpqTzhQWXpEMkxEVzBwQkwwZ21qNkdMVkEKLT4gWDI1NTE5IG9x
+d0ViazRzcG1qSDNFR29GcFJtMWxabWRqdnBjQUZBWklyNUZvdjBmMlkKcWhDUGxu
+YTZUbEhtMW5pajdpQXYrdEp4NllXRkQ0NWRhc2p5Y1Vub2VjTQotPiBMSTgtZ3Jl
+YXNlIHQ3Ngo3enhCRVhiV3N0TlkzdHNMMHJTZ3F5ckc0UUlUa3hCVEZQdTUxaW9p
+R2hJRmlxWTZPU2VVbEpvZDZpKzN2NXh0CndxRVM4ZkEKLS0tIHMyTEZJUVRGWlB0
+bS9hbjduWWJuVW5KVXpnYlRkMFdCK052RkUvSEdMV1kK4fjaE0yBZXu55Kn1j/yG
+PRwEhA9QyNbas21qCikGh8RxCUfoobhlKHpYxyvOMenhv0+8gb3ceXzSUR/3a98Y
+orARTVFlOvVZolCwoyC86kUExIBubJxO3EpH2UxrvQoCOrAf5XdD+qzt/G71wpYk
+jGUknUWUyPbj9HWoVo2aRmC//bCnena9DUVicAXbDwqr5/KCHHFlkT9UI5Vqvgfw
+rPpyZ+De
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/object/minio-client-config.json.age
+++ b/secrets/object/minio-client-config.json.age
@@ -1,17 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyA1bncw
-a3RSM0pEeENHUC9lQWNodjN2eTFrUGtJaGtZbDJ0enIrR3BhUUcwCnJCWTdydXpF
-aldiVi9yYTArUE5HUWIydS9hSXlJVG5maDZuSG53ZXkvRFkKLT4gWDI1NTE5IHZP
-bzVEK2x5dVk2ckJGaGpNSTlPWmQra3BVMS9ud1ljR0ZaMm0xcnh0QncKQ1EzOXF4
-WHZPMktydXlERUZaL2hKcm8vTitLMnFIS1Y2VWQzamxYQ1VFcwotPiBmOUsjLWdy
-ZWFzZSBhICVUMjBCIHBtcDl0IHNjInAnYkQrCnJzSFMzcE5uRmhUeW03N0dXcm1M
-Y0dLeUJDYlJGQkozdDhvSkVqQjdqS3JRTGpBZzFzTW5CRnBSQm1hSHJyUlcKQ3lD
-RQotLS0gOVNkSXErdVFQWWRNc0pzKy85eEZWSVpLaTVuK0g1NHlmVGFyMitQL0tr
-bwoiPaPl0PqMq8yFrgYpKqDK/pnZ3jBp+94CqxdT4YDzQ0WlmVVIkSnjbYWDq/1l
-+qeORZzGV55Ewhnxqs3/lJLDi88oe2YPcMqktbzEdxGKCA3adEE+LxNkzCFZ+ZUS
-EPVWVtU2UmuylZBFhieA8H4xXykS8mRQrpLDUzKOOfcqC+WmjQMGi/AXXJrcxSOQ
-/P8dJfICjtJ3+AzWO9stljgEVUyp2hXw7osN0zChVZAn/1WrVJxVsTEPxiFmtgPQ
-s8fCpQgMrV8urO9p00+vxCF1XIPZP/LqIpuirKhaiAWr6PpTY6Zg2DeMjNenCkB+
-oSqTopQoVRjuIXtmvJC+UiDaMOT9x2AmBDp6yZ/B73GnoqKDxjmV3YasjOQJ5l1e
-cbIGHxqvVQYaVppgKfprysj1i2sSvBndIOH3Jw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBjdm8z
+TzNmSFBzTEdVT2Y0cW81azFsM1MycWF4MlBCNWNEamNXeklVVEZvClAwbUd3dmVH
+dWsxZWh3eG9ianA4M1JET1RDSkpHU2NLcGgwRlJ6eURsQm8KLT4gWDI1NTE5IEQr
+em40K0ZFejlrMW1yQ2p5UUcraWd4RmpseVZsbjFwTndRYmMyUzhyemMKZ3U4c3NH
+bk1CV2hZNjRNaXJHQy9PN25Fc2cxekpNNnlyTktOcHh4eFlFSQotPiBLeTdiXHct
+Z3JlYXNlCmdRCi0tLSBraGk5eTQ0K2k0bTVBdFdsY3JqZW0vL1N5V2FFSjNsbmdE
+Nmw1OGwrWW1JCvuxFmnBfZEpLHNyN3Uyygvf7MfsG8PJg7Rr2tA3a+SrBrRijJi9
+XVsDzB3HWYGHTRegf9pz8KruyedFNu0volXDSjT0uC7Mofj50nF30+d/2Z25Vem3
+2KEpvrQ4o0C89il4L6ptRndmbn3uEe6+eFPBGLeDeuUaXUcuz811145ZNz7kalJL
+TJfeG2gOV53lu0NxK3wQ7bW+xtrwOHToIssGN0TlVVi8qapSXLYwxTkglYCD8jwE
+6fVpGA81JQy6EcKtVZ13xfFwF5pzrqeZQWSrW9b8Mk5SkIKC3MxTTWdlI9Gobqx5
+RsiphGvQ4ra+GraZNXDn80w5phXXv9jNX0VUGe7hi1/G+KYl1m1OOsdyD/QluG8P
+dqwfbXTo0F4zqWagP9dGhMkjA+lC0jmmFhZDQrS1RabVMCsK
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/object/minio.env.age
+++ b/secrets/object/minio.env.age
@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBRWW1W
-My9qazNoT1N1MCtGVVhoYVlhSVBKQlJMVVYzYjdqWVBlWjZ5Ump3Ci9LaFN6cVhv
-UHA3eVo0Sm9LcWtvcHFvdUhvVk44WXBHU3VJR3ZFK05WZjAKLT4gWDI1NTE5IHpt
-RXJ2VGE2RlpsWU55TzY3d3o4Y0p3YWRPckVwMFJuVW9XdGdSdyt2SHcKdmdYdHFh
-bmRyWm9YcEJ0SjBSVmpzVnJjUkdNUUJRZzdUVlJpQzVsNkJVMAotPiBhO2stZ3Jl
-YXNlIEVRdGVyei92IFZRVQpLRGR3YlVYaWxaSzYrMHU3eDVITDN4UzFrS3lyeStF
-elhRCi0tLSAvQWVQQWNQdUJuSG5BMXlaaU1EcTRxSVJPamtuMW8wSjhyTXN3Rm5U
-aUd3CjJiIrsYwUymiTZeG2+iOeGkjMumUJg9/q1eJo2jppwIG8huyMSR7BKWz6nD
-5rmqqDCHzPra7LlJZe+0GyXjzsoUpBDK+slKbFRkwltgH/6jAZK9Y9+/vrT7qT25
-sA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBrU1FR
+VUZoVjNFUmxNSFZIYzY3TDRpZ2drbklvemZBKzQveFRGUnJDUmlJCkFpZ3F5VkVB
+ZWhKTDB5UGJkTVZrNHp3YnBxYzdwa3NDN3dTSXg3YVl1dGcKLT4gWDI1NTE5IEwv
+KzhUWXh2ZFE1YTZUMzdKRnZKMU5tVEppV0tvem1lQkFxb25TZExYbEEKWWVsdHFD
+dXFSRWNIa0UwdzZlc1lzejRSdmp2N2lHSitDSWhCeVpwWFdncwotPiAiSzhzZi1n
+cmVhc2UgQi5TMyg1aSBUdCApZXYoclcyZCAnW14KLzNjbXJNOHdOcEJMZE8ydW41
+ZDdpWmRSCi0tLSB3b25sbnhBMDZrZXduNCtqd0RoOWZSdXF6L1pSbEF1K0ZVZ2tB
+TE15WFUwClKgHieoFUU9aDCR5P3RtjWMYDHqJ3BGHawqgJFySxUw6ZaiBKe5eFjD
+4/gtY9hIVVYvGgaULCLaM6pSE1wm85EsvqMXMU9S7TbxL7gplOugbtnYSggCF9Qz
+pl2FTQ==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/object/sharry.conf.age
+++ b/secrets/object/sharry.conf.age
@@ -1,18 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBISXE0
-YURkakhPYmxlRFducTdsMzZXY0k1S0tZR1lKdGRNdno3NTZDZVR3CmlIUFNZa1hv
-anNvZndHdXVVU2phRUNWZTE5QjlhbVFJUUx0emI0UDVnQmsKLT4gWDI1NTE5IFBE
-WTZiOFlzS08rMEdpRi9ETUZ5dlBvVldDWktXcFhkSXh0ZHNLTi8xeXMKQUlTQzha
-M2tLSXovUjlkOXRPZGlDeTdBRUNGSHF0WmtHeTc3UzNkZ2hqOAotPiAtODxeXS1n
-cmVhc2UgWWhdKiB5fSBWXUkmL08KSUd2L1dES0E2dnUyK2hJS0p5YnlHWTNtMVZ0
-anAvMmR4eUMvOUpabFJDb3VTazZjNnNlZEFvcUwrMTk5WGpxeQpMSnVRUWxnd09r
-Wld0UDBXM0hHZUJDWHRVbERzSGpYa3NvOWdxQQotLS0gRy84TDFZOFRsVS9SN1V6
-by9heHRGR2oyTlFjUHBTOHBTR2ZMSFdkb0ZDOAqC2uCz+0/AxgKDxjfKD69HEy5q
-H2hBN8SGw3oDUuWIic4LZmKQBWivikzBjoPdlfk/eEuzDIVFiDDDanXI3f+wd3dg
-89h5ljvpklGWpAzupbdPuV2/j1t+P+3Da4NTPv/NH5E29kBQLH7o135eBteEjVs9
-BmPowJHZ7TCA5WSGj1HdzbFzYe4PJh7+/C9w6f+KAJOqx8z9t+wdn+32w73/0ee9
-ZF5FOAvtg9YEJJop2XwHck4dfP2JI5i78pyCA0R50Yt9IYef06NSDxA2zz93qeEz
-MyAdo49A1t/OYRMLo8VD5vcBooYoaLb2wM1VHJbSHjfDAyqdDsZCfBi/xwPsX5Ke
-t8pE0zAMWntcBI2G3Cq4OEuRUQX3+lI1n51M3SJZQ11BGDJTKOzjVvNnwHiIewY+
-Kd5dINcdMP0wAqcT1Lc1NeM3kBnRv5thJNBf3oRwiCew3UvERViQ
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBQcmhx
+UW5zUXljNzdPTHNLZmZrbnNEQlZqY2pWODJsSDlROStwamRLeFQwClM5UVdmVFpa
+dGd6WkwyNkJicVplUFRHbGtVaE81clFRV0tQSzMyUlFvQjgKLT4gWDI1NTE5IEVE
+eTJDNFpnMTJJc2pXZUU4UXp5SXhaYm9SV0Fuc1BFR0lVYStGeTFORUUKR2x5SkJR
+VUxSVTA5VGliTlhseHhjcTEzVVp0aDMvRmIrVitTSFdaYWpEMAotPiBRTmgieS1n
+cmVhc2UgKFFzbEo1SSBiLmt9Zm8KWDd4MkV1M1pKaG0rdzFMTDU0NDJ1cWVMOHdu
+NkhwMkNwaG8zZkJ2R283bk02b3ZsSTd4N2FGdTJabHFYMjFRYgp4S2lOU0l0L0Nn
+bklhSHFEdkRxcTdDTUlrcGJxSGVZCi0tLSBFaTJNTCtCUTYyTEtUdWJkamVBZXRL
+Z1ZyRk5TemJPNThkeStBRDd4SDMwCqHkFPwwIwQyNRKz+qiaTlEg+wae9/zBVEso
+lvsNmDQmShacPxNMX8gRJdDeZwPgVVj6vbzuvsZsaeqS0tz8Mky1t0lGtMlVWkBn
+bKzlrpMMmc4myREz3a8GgSK7Q3fEM9iy0lnKXsOrjXmO2J6Ebc+Uzp85Mn8cWT5q
+BHN18Vt4BjJXs+0XUwPxVEy6vnw7yXVeKEpFLtzjRXRVKpp3VwimDvgfE6XewR3y
+qv7B36u7xU4iTZam1N0ZwbdunVKWeqRfMv0auWpkGgU/gLjM0E+5qFZ6ENEBN9iP
+8wHddrpap1fYNYgrMGM37x96+J4NYomcUlcZ4M79vLUJHyXLWrhRhIfh6HZPjYra
+i5q8jB8oSE6UpAxkCkbcdmdmaRgMm3aNMZTfLcRCqOt33ScintJWeMZaybUGWzzg
+gnVSbp5C3On33EKOqPgR677CkB+TW4ME2/myGGW5/1w=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/pdns-file-records.key.age
+++ b/secrets/pdns-file-records.key.age
@@ -1,18 +1,20 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBmb2ly
-bjhSZGJITVV3Njk3dnhrcnNEOGRPbkJZWGRzbDVIOTB1WTRDN2tvCmhXRFJzZHhX
-RlQ5eCtwSHhxaTJPTGgwTUhGQndTaUZHQTJvM2cvVVBUTTgKLT4gWDI1NTE5IGNp
-aVFaWjhvRFhNazJZcE1OYklHNUdvZWhMVEdCQnJWRkxTK0ttUUN4bnMKODNrQ3hI
-TGYzL1YyZXRYZnpJT1VLb2l1Q1kxUG9HVTl5VnV1Uk1vdzZFbwotPiBgLWdyZWFz
-ZQpIZwotLS0gM1hrdy9LWjBadjhvTS90QWlhWWNyVHE3VldKL3pDaFpPZ0tXaEhU
-SlRKWQo9dADdiA7QJy+RgpUCOMljIdNL2xmV7la1UCEsfyU/SkXvVs3aIueBmcAt
-+eCESQmvZHpfiu9beU8bChvVhn7wLrdNwvnySL0XV7MI3qsZBTXpfIOzo3aM29e2
-/hPxMsB0N6nAQt/3fx+jJ2YHtzAxM5Pb091kSp5wgWzGjebdAjN34k7eAy5OMkoP
-Yz4Mp+dnp1qbcVpBSm97H8Mln+opcGqafMi8K0yGO5V9nnGJ0spaBGGSqiD2ATcZ
-hXV9WSED3N4YqXvQl9otFRor4LYTlR1ZhKR9brRZpcBbSZq16jj2a2XMpmMzH7t4
-mEA5juv1igOhn0mgXmXsWrLANGUECfAITpNa+Wv6J/k6JVr3dWeNjzfEAV8JXxYg
-hU0dV5j0vZeUSa8MN8cSvWIJwGPtJbq3Hul/03JZQ71gf1LKtRECBX7pV+NLeoR9
-WFqBaahwNZ9MSkN1cCfx5KnFSK/tHwRLgym+T5317vGFsFTqh9c0zgpMcybTVUC7
-jeO4SYb/lboxgjJEcl7GN9Smx3egD/lPY0E5s/ZQvD1p3ny83E68ZW5kTXQxrTaT
-mKXZEW8Lbb+Xqo3qZHyhElE=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBEZXdm
+NEtBZ0x5OEFURXBhMlZtck1qYUc1bEd4dHpsQzdKdzBpejh3dFJVClIxdWtwbnhp
+Mk5hT1lhdEtuTjd6b2p0dlU4SmhIK283L21YZWJEVHNjdnMKLT4gWDI1NTE5IEk5
+MGZuelB4SUhpMU5DTStNN293STQzeHhMdys2N1FNS1dnREMxenBkUnMKalpPQWVr
+NHRDcnQydVk4ZHNXQTZpaENmTHVMWEZ1Um9DakJoUUx1TGRSUQotPiBjcS1ncmVh
+c2UgckEgdyZSbzkrXiBjOUtnfiB8UVUiCml0K3hnMlcxS1B5dFpRYjczVzE1ZWtz
+NkUrYUVTcFJiekZ0aEFodWk4NXFNUnZJRjEzRFd4djhUZXFPUitwWTYKV1RMbHFn
+Ci0tLSBlUzUvSTYvK2V5TFVnYjZGNWtmenFXOFNVNE9MOHBZcGZyamdIUmxtWFZr
+CmswM8RLtrvvhmuy/efwx+ARv9Fmam6XTe0khQ2NoPa5K2EGI/ZJVoQr0h9p48u8
+Qsi/1tALMjYh52SGaQd8m6pj2q0M+bnpld2xtrP3vPA20lrJbH1K1LadbZEt9Urj
+oX8oP486qBkRk9mxNv/+ngwFT2hcbeobQUUu70+iwTChPpFtfP4THPRFQA1Nth7p
+A+HWsLlWyWk8QaW2QIa80Gq1BBstDMNjiIvgTMTWZeEO0GEAlE+07sXOwz/fnpTd
+7llNvmaZACQXP74aNA5xZXzirq65e1alFCC25tPedggMuCFKWoTwlAla8UvThqlD
+VI60ARkRJ2GfKJ2RVblS380RotNiWTG1GiOdzJ3OngYceAvdEcCcYdfjoCTJoQTj
+IXW6NLI6GR2n/daInVrh9cwEAd0kNsOvjpZTkEgEeZzmLvZi1Z1H2a8ZyJq6A4L7
+jxqynZa3TKzcS3bhQG3iLJHEnQhhxUyf+S2d+3EZi03uWEvwGWX4aOKEpCEIUCVY
+mj0o3p5JPDaNIQPf3Bz0ByHYOu4LpRcCkYqphHVutG5K0P7Lw/Vs29oE7pSgm9uZ
+tj1CHRDoKXuRSk5koQ==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/tailscale-auth.key.age
+++ b/secrets/tailscale-auth.key.age
@@ -1,12 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBrVTJ0
-VUhnWE5CMU15UWRvRk01REc2WHRJWHBjUkp3ZGU4eWRUcDB0OWxzCklldVRqa2F6
-ZVBFOEx5cUNiUkc1NmFIRVdaT2dUWXliY1FHTHhiSkxMR1UKLT4gWDI1NTE5IEwz
-OHVaZnV5OXdIbWNyWVh0TDJzdFh1aEV0NzFZUCtva2VTd1A4ZUlBaVUKUFltdHNm
-U3V6QlJFbzZyeUk5QlJDT3J5eEE3VnNjNzRDYUJKcWVndnRGYwotPiAzdmkmLWdy
-ZWFzZSBGMSkgKz8qMVcKa2VuTjhhZmhLRFB5RU1BRG8zaWE2NFBoZ2tKM3NmNjly
-RDk3NzlwNE5CK3VQaE1XRWJEK2NJV3hraXJiaGtwNApkcVQwaDkyd3hOcXJBMFY1
-MEMyRzJBRmkvdVlqTVEKLS0tIFlZNWZUSkU1UVNCb1gvZXpKcjR2d0hZUkNiZ05n
-M1BScjNNK1diaWEwZVEKQ9FxixeAUhGgPZLgxPK4lnkMFQ6m84K9VSrDvIfPhjwN
-bX52anx1xQhyJ44WD7vuEBeROhn+3J22ji7Bjjk7t+1+XCZsxz96MDbNxbmQVYR8
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBySGJi
+WVFhRmdaRDNMVlhmcm1URW5FSzNmNVZleStBL1lOcWVNcVJoQ2s0Cmx2U08wVmRx
+YysxREo3eG1tWTlYL1BrVWk2WTByZnREWHNlVHluMHVac0EKLT4gc3NoLWVkMjU1
+MTkgT0VxTXNnIGlENXpQVVhNSm9lWVoxUVhjaE40OXRSSlA3TVlRYjVESHVVWGVS
+bVZkQkUKK3ZyRmVPNmRXTW1pbDVwTlFXRGxWcFhNMWNqbDZFREw4VkFzYStMd1J1
+cwotPiBYMjU1MTkgcU4xSnVKbmNPbFZORlRWdnEvdnhvZnhPanE0SmtSYTZFUFQ4
+ejVOYWMySQppYUhCNHFuam9UVUllMFZSWHh6Q1ZmbFNhZ1dMckNJWEl2alBkZGdl
+ZzhRCi0+IG80N0p0Mi1ncmVhc2UKTXZnK3NOdnc2Mk85VFU4NTFCVXhlQ0RuMURi
+UE9tdk1TTWE0WlJDaktrVnlxVWJtRm9Ha1JYclRuc1VRZ2VhbAp2OUl0a09mYUFL
+MUtPYnJZUEJ0OU96ODVEQ1JGOWNvRzBsMkh2QWFYQS9rdTEyNjlXRDE4RldvCi0t
+LSBrQ2k0UDdjc3V1ZkVwOXdOa1p1dGU1WVN5amIvWnpKam5uYlUwR3RZVjRJCpS8
+TNqU8U4bRRS7bISPugIUpx+VSGNg+sIj6sbiQJk84mpQwfcfLYTiPjq0KizhtBco
+DiyHW7BsPntLiRem/PRMquzMy1sl1QelbeZaF1EAYA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/otp-secret.txt.age
+++ b/secrets/toot/otp-secret.txt.age
@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBUdVBK
-ZjJEUXgxL1MrR3poOEJZM01CWHFKZzhRVklqZUtMMC9RMEliZXlzCkVGeUtjV1BC
-Y2NvRUFZaG9MMHVCczlHSmllc2VBR21GZmQrN3U1NmJETWMKLT4gWDI1NTE5IFo0
-cHRsRGNPaHFER0xCV0NjUzk5ck1QVUNVbUNiMERtNWlhZENJRTNpdzAKRHRzMjF2
-bzZwU1U0eVI5ZDdKS2VBU0oxR2dJK0pCRFpDOXk0ckgxZU0zQQotPiAlLWdyZWFz
-ZQpYczI1Z1VteW5nZGZ6Ly91RXN1b1pkWmI5VVZOV0pvaFVBCi0tLSBSY2J6UTcy
-NXpXQk1vVHJKWnZzeGx1emFYdDUvZFcxSThvVHk0TitLcTdzCsSWzt2n36x6blgX
-udSTjMfEvQ64yNTFK2ikhvIWQZ8AJwz3T9bqxEhbdg0WbwYbRvTouYZvey1soPM+
-Pntd+Eskjfw85edFzQFgTlpFh7WG9+4VNSd4aNzPz8aWJeOG05RSKfDVwzVzk/Ux
-d7T9xYUMBCqxpjotZlz9af1dinNS7AKUEQFcFiibYFqWGZ2Td6HHBNL3d/pheJVp
-fuTCfLe0
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSArcDVp
+TnB1QStoMWJzUWhMWnVtb1JSYTFublZKL25nL3JvU3B5M09TcXdBCmVHRk13R2cy
+UmlXU0V5VlFCUUFHZ0ZiMUxFV294MW9tOTRKS0xNUDFGN28KLT4gWDI1NTE5IE9i
+SUtBVElCa2tWdGlKZzJLWnBmeEw2UG8xSGdWYXNLdk1IejFNNG9YZ1UKSVRJNnhw
+WEV4dkFUYVpuMmFaWFFYc0dLM3BMWlpSN3RzR0hYaVE2OU8rQQotPiB4LWdyZWFz
+ZSB+XyB2ZFU1SQpUVVZpVWRLVVZqTmNTU2d1S2Z1L2x3NHY3UTZCbHZVRHZlZXhq
+d2RFN3lURmlYU2ZTQzJ0bEdtRUNvNll1V2llCgotLS0gbXNpSWpPaEZIQTBybUtR
+eW5MT0RBdW9xZDFCbmVoajRjM2JhcEpmY2tUUQo8LhWOKi2MNQsYiRtYoIsmvPaQ
+DWH3JkE2kZvy8Y5vSxSEWDuXY8Wj0sOj35wu5Ox5Ti6+XwG1VlEBYwKYwqU6homd
+h2TWE5f1kb0M4aQEA9+PZat3XJqnLKsG+NmLGQAbn8+LqyXYfEdqm8VF3jc0lZmJ
+kdLsXZEsHy4PzAQgQmxBD73dUOOaggQfeSKSbLODku+Tn0YODojv22/DqfN79A==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/postgres-password.txt.age
+++ b/secrets/toot/postgres-password.txt.age
@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBzajdi
-ckl1Q2d5UmFMQ05xTlIwNTBxbUNvZW1kTkg0V004WjJDeXlzYTM4Cis0MzFCV3Vv
-NC9nZDFIYVJVT0I0Yk5qL1MxcXcxUkJXS3g1YUFTcmFJSm8KLT4gWDI1NTE5IEJH
-RGlGa1U0VHFpbFU4TEc2T1hsdzAzUVNBMHZES3dYMXdPM1JjdEZ4VncKSkMrRkI0
-VWRUQTRqaFRmSjFUNHBCK0NldTRqdGxCRi9WeWpodlRYZjBEMAotPiBSYEExN1xP
-Ky1ncmVhc2UgW3ZGICwKNEZ4RDZqRy8yZnp5U1lkL3VweW5zQU42S1V2Tm1WVHdG
-UUhHRG5obVNxZEZZeFgzNzhFUkZmZEprbitqTGpZNQpNT3FzeVpNaFp3Ci0tLSBF
-TWh6U2dCdHp1Y0w2bjU3YjMyU1g1SkVLRFVCY3NvUHMrOS91c25tTkhRCr0+V3ER
-DJMRx1CWyAL0idqlnSHdaCMhks8MgxKY6q/hV9dyX7Gv1uexEEFkwCfB6Cc=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSB3K0x6
+bUlBUzhZUzVRSDUxZFVKSkYrcmNuRzVjSEpBNkZkRTVCWTVuREIwClpEbm8xVDlV
+ZnZ1UHJxMWwrUlFSanBiTGlSaU9FTEdBdnA4ZmxrNUVYWGcKLT4gWDI1NTE5ICs3
+Q3VadkhJZW5EUGJkQmdwYU1waUQzRzh3VGpMOUVKbDM4cG0xNHQwVEUKdVhKeWZx
+SVQvdjdKeCtjOXlDWjBaOGdvOTQ3TXViMk5GeGZJU0tBK0tIcwotPiB4aVYtZ3Jl
+YXNlIDogLyMgZ1MKVHFNeUZqNDlVTEtIendDanhZUktqYzljNUhsL1lqVGZyanJX
+Y1FYTTA0TWxZdGxhRkRaY2FsYjU3Zk05dFArNQplbG9hUEM1V1ozY3dkc3E4dzc4
+ME5mS3lncjZaSFQ1RTFSSkdmUU5VVjlwc1NUTGMxK2k2U0xBcE8rUQotLS0gd1Fq
+cDQvYUxiWEtsaytYTXBSR1F6R3hVVUtCSk1YNHJiV3dOeDA4VEc0RQrBQ1JzW3sx
+okv/DsRX7tlhkWrH0gvPmMvdd5KUL4QgPEA4g3V8uxnZktALIPa9X6nx
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/s3-secret-key.txt.age
+++ b/secrets/toot/s3-secret-key.txt.age
@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSB6RzBi
-SDV3WkJnS1grOHJEUU1PaFp0TXRlQnhxdjVHeGkyRDhoclQzM0M0CmJENUkyNlc0
-SlNNcm1IUGZsTVpqRlRlblpxUGFscG1sb2Fvbi9idkNLaW8KLT4gWDI1NTE5IDNU
-WU5VMy9jcVp0R2U3ZVNjQ2pUT0EyNE5XaktndEFxQkVROFRtMWVoVkEKZ2pMam1T
-R21INnZ3YXZHeEVEcml5REZnTHZ3dE1hZ3lOZzZEVmdFZUFoOAotPiB7LWdyZWFz
-ZSBZClpuSlZmclVDakp4QWc2c0VCT2FGVjRvVzV6elpLRFQ3RjF5cU1TY1ZjZVpY
-YlZTblE4enBHWlEvRkJLN3FRCi0tLSAvVTRUUm9sZjd4YU1mdXplL1VzZDlYRlJ0
-MmljQllkUWxsbngzWkJYSkY4Cgg8wP/rkcGBYkfvow5N51240K6AxdHmI6aDjFjH
-xByX6Lufh+XqjJksSGoSBop49no=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSB2bDdl
+TWJESHM1SkVsSnJoUjA5SjgxQm9jc0RRcXh1dGNoa1hWTWc2TmlVCjAxVzFKOGc1
+YzU3dDRrTnV6eEFFdGpLelE2WWU3bFJVcHpXVWg5REd5LzAKLT4gWDI1NTE5IHRQ
+eGhMdkNpNjYya1pDTHdHTTdjaURodjh5Wm05bFpFcXN0bUxtN0FranMKYi9kYURX
+NjJveUFQTVdtUGcvaFRiWkw3WmNtZmZvSUlYUUNvSnBCdEtaVQotPiBOXmItZ3Jl
+YXNlCmN2OUZFWUh5c09kMU0zNUt4eDU5QmdvTTM2R2tzci9FQTlJK3ZhNEt0TzVH
+UWx2cUFMekJsaUJIaHVxNEt2SQotLS0ga0FOSGhKL2loRE9HYytMRXVyV0ZnWVpu
+WlY2cExRN3dPenIxWVBEckZKdwpEExBab65A+Lgid7DEX3wclFBQ3e9BQRwkQHjh
+bSmXPAmNf38OsQo6kdP34c458uAZ
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/secret-key.txt.age
+++ b/secrets/toot/secret-key.txt.age
@@ -1,13 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBMdnR6
-dVRQanlnVjBlT1kzd3pPZEdUTE03cGxpd1ZCNEVST2tIRjd1NEZRCkRmalllUTlk
-VGUwTGxzRVltVTQ1dm1SNmRSRGxFbkZkODlnSlExczdkTHMKLT4gWDI1NTE5IEZW
-NG9LcDRUSGNtbnVtZ2IrTFdGR2pBT3hSNHVMczMyYjJuelYxVXdHVGMKZHpKOURk
-dUF1NXd1VmlCVGRBZVVwMXAvbnRJcG5DTXN2aWwvZU9IRVR1OAotPiAoWWJ4USJK
-ay1ncmVhc2UgcEdvfSIKcUg2M2NsYTVidytBbG84OXp0VytEVXQyUWVSR09Mdllj
-b0hqU1h2TUNSTGxIeWJZQzlxanZaaVIKLS0tIFFSZnFHdkR3aUk5b2p3bG1KcFNR
-MGpIWi9KN1VEZEZzRFB2TWxPbUZ4UGMKiLldexMJptsWZ4EU1A/2e7BZ4Y7etlko
-mml3mILYJegIVI3SVLFE92wKuELbc9k1PQpcBJ1wg5NKKPSutGPM6BZ0ocpo5rQu
-J9uF3IXaCwfyCazEgk9Lo3eD7yjCw1wIKFzE+3HZ1JBRknMB7XhdU/aqAdDkqlUd
-eP2IERgEIEyHeHqkaxj8Sy6F5ZWMXiDWeS9Rm4gHmMFawhEOTzNlBSw=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSB1TW5H
+VlV1VDRvVlJvRGVUTy93K2pDSTlVd1Bnd0p1QWU0Q242VWdFb1hnCk43YWJNSlEz
+ODhzM0ZVSFJNNUJJN1R4TW1wYlptQTlXVWZTZjNpNVRBTUkKLT4gWDI1NTE5IEZy
+ZkE4dXQwV2Y3MXg5Vm1mUkFBeFJnczNxdElXK2dhbjZDOWtEZk9LbncKRkc1U2k4
+SWxodUJpb1hBSDNWb0wzNHpTZi9paGRaSXYzWkliN0g3ckZjOAotPiA6LS1ncmVh
+c2UgTndiRlZVUi4gVUNSTlFIIHU1SFJIJXxvCmhYVzEyTHBDWnZrSUFOVEI4Rmpo
+dlA2ZWZOUWpiaFZtNVdlaDhzdkNBTTJKbGI3WlMwUzA4K2c5UVRWV2tMU28KTlEK
+LS0tIER3YnNCUUxzTTZtc2ZIU3VpamhxUlVqRTZndUdKSEpkYURpNmtGaU9mT2MK
+ydZSdgnTnOeJHXRQt0dx7zpvIRpmliW9s16xqbev1QVn7NO/WRx0x8bBzoUWr44V
+R5n7KZUB7dnIMEFx4PAszHMwaEV6/n7hXLofxJUsCNBBTK1qiCF0mJ4fv8LPX3bO
+wHGwx3FLp09OiAMIrlLuLssLa+9M4jpxGAF4JdL7ssSRry1mcXqcB5HIUfgIgqgU
+tSa1psa4593cA8/VSkShndw=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/smtp-password.txt.age
+++ b/secrets/toot/smtp-password.txt.age
@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSArekdj
-OVZxYjJwcnhpV3lhU0pRWGEwVjhtT2RSMkpoSkdLYldRSlRHNmtFCi9URkM0NGdC
-N2RINmJ5bXd5cW9Bb2l1UXNabFpGVjBOclM2d3NCV2t3dm8KLT4gWDI1NTE5IHRQ
-SmlwRnUzSXUvbkxFSzJWTGJiaUloQjNjTjMraHB1bEtUQkxtVTk4aHMKQlgzLzJQ
-MlpOMVV0cmJsQVFNcmQ0eEpKU2NEaW9DOHhLUlR0ZDEwbnlFVQotPiBDTGloLWdy
-ZWFzZSBvbWomCmMvYlAvRkNCTXdKUkxzR3pIZ2xNVnAyVG5TMmdSRHpKZnVDRmxE
-SmJrdURuWUtraDJnRkx3SG44Ci0tLSAwYWpnYzZUVnR3Ym5yblBGOVl3VXMwWU1T
-eEMwMTIrcDlyTE5vRUIzZ3g0Cg8h2isfrf4vyY6xD/jLbdIEI5nQgWfPj7Ge8A2E
-bl385dK6PYbok3z6F9y6KBfQKOI=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBZaGx1
+QWtaUlFoWjFGaW8vQ1ErRTVOekxDclVac2tRVTd3YmxmUnRIL0ZVCnVsN29NejFL
+bUVXWkJWd0h5QXRRZzB3RmxETjh0MFJLZThQM2gzUkp6TkEKLT4gWDI1NTE5IGYz
+Y3VReVduN3pDdzVGYVdubFIybEUzUWhLU0p1UGw4aWxBM2lZSm9tbWcKYVJtRVVt
+cFFHT2tjVmJQTXBpNjZnN3dSVzRqYUREVi9MdTNpTDdkUDdzOAotPiA2ViEtZ3Jl
+YXNlIFEsYVpfTiBEeVdoTmE4IDc4MC4zCnF4RUlJMnFreFFFMElJYUhOTHNuOFM1
+YlVjOHl1VUNYaktKVmZjd3JXb3FXRTJNNHp5Z3R6azUzSjR5UHV4cFIKUlV4bUh4
+dncvMHVsaEFOYnkvSXFMWklyRy9nCi0tLSBNVmMvRzhZTW5lcW0zb0lNOUo3N0Jh
+R3ZGVW16Q21uL0J2YTMzYmFIRXdZCnYDb2yWshOHMpn7o31CmWl+95kx3d85kfUQ
+CRAPe/kFRHoPY5y+ySJMQpFSQPuLbiw=
 -----END AGE ENCRYPTED FILE-----
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jack O'Sullivan	ab25c07f69	An attempt was made	2024-01-09 21:56:10 +00:00
Jack O'Sullivan	aad8adf5da	nixos/middleman: Add hack for working Gitea Docker image pull All checks were successful CI / Check, build and cache Nix flake (push) Successful in 26m52s Details	2024-01-09 18:50:11 +00:00
Jack O'Sullivan	205a948486	nixos/middleman: Fix HedgeDoc websockets	2024-01-09 17:35:34 +00:00
Jack O'Sullivan	39e7c703ba	pkgs: Add modrinth-app All checks were successful CI / Check, build and cache Nix flake (push) Successful in 34m35s Details	2024-01-09 17:19:13 +00:00
Jack O'Sullivan	d07ef96d28	envrc: Use `watch_file` instead of `nix_direnv_watch_file`	2024-01-09 13:33:00 +00:00
Jack O'Sullivan	1a29a7d589	nixos/simpcraft: Staging server running All checks were successful CI / Check, build and cache Nix flake (push) Successful in 26m57s Details	2024-01-09 00:22:17 +00:00
Jack O'Sullivan	ca6fe534dc	nixos/git: Use separate nginx	2024-01-08 23:31:06 +00:00
Jack O'Sullivan	e277cce3bc	nixos/object: Add HedgeDoc Some checks failed CI / Check, build and cache Nix flake (push) Has been cancelled Details	2024-01-08 21:40:20 +00:00
Jack O'Sullivan	c9ce57e2c5	nixos/middleman: Add public directory All checks were successful CI / Check, build and cache Nix flake (push) Successful in 24m53s Details	2024-01-07 03:40:33 +00:00
Jack O'Sullivan	04dfc89f07	nixos/simpcraft: Add ToTheMoonStar to whitelist All checks were successful CI / Check, build and cache Nix flake (push) Successful in 24m53s Details	2024-01-06 14:59:57 +00:00
Jack O'Sullivan	cfbbed8285	nixos/simpcraft: Upgrade to 0.1.1	2024-01-05 20:07:48 +00:00
Jack O'Sullivan	066c87d3d6	nixos/simpcraft: Add mods All checks were successful CI / Check, build and cache Nix flake (push) Successful in 23m39s Details	2024-01-05 02:13:15 +00:00
Jack O'Sullivan	e24ac05bb2	nixos/home/routing-common: Add vibe DNS All checks were successful CI / Check, build and cache Nix flake (push) Successful in 23m7s Details	2024-01-03 03:10:44 +00:00
Jack O'Sullivan	a2b146e8ba	nixos: Add librespeed All checks were successful CI / Check, build and cache Nix flake (push) Successful in 22m56s Details	2024-01-03 01:07:12 +00:00
Jack O'Sullivan	a03fdbdbdd	nixos/simpcraft: Add Eefah98 to whitelist All checks were successful CI / Check, build and cache Nix flake (push) Successful in 23m44s Details	2024-01-02 22:13:06 +00:00
Jack O'Sullivan	5915f664cc	nixos/simpcraft: Add hynge_ to whitelist	2024-01-02 20:49:08 +00:00
Jack O'Sullivan	42111c530e	nixos/colony: Reduce memory for mail VM Some checks failed CI / Check, build and cache Nix flake (push) Failing after 35m28s Details	2024-01-01 21:45:54 +00:00
Jack O'Sullivan	a741e3eea2	nixos/whale2: Minecraft server updates Some checks failed CI / Check, build and cache Nix flake (push) Failing after 1h14m44s Details	2024-01-01 20:32:15 +00:00
Jack O'Sullivan	7a4372dfe7	nixos/whale2: Add Minecraft server All checks were successful CI / Check, build and cache Nix flake (push) Successful in 25m30s Details	2024-01-01 16:28:04 +00:00
Jack O'Sullivan	65917bad5c	nixos/kelder: Disable minecraft-server	2024-01-01 16:26:45 +00:00
Jack O'Sullivan	16c7fd7659	nixos/kelder: Update Minecraft and Nextcloud All checks were successful CI / Check, build and cache Nix flake (push) Successful in 23m55s Details	2023-12-31 20:21:02 +00:00
Jack O'Sullivan	2fffefd22d	Update river public IP All checks were successful CI / Check, build and cache Nix flake (push) Successful in 23m24s Details	2023-12-31 15:15:22 +00:00
Jack O'Sullivan	c14aebf4a3	nixos/colony: Only start needed LVs in initrd to prevent race All checks were successful CI / Check, build and cache Nix flake (push) Successful in 23m2s Details	2023-12-30 21:07:12 +00:00
Jack O'Sullivan	677f3f26ab	home-manager/common: Use vi bindings for tmux	2023-12-29 21:04:07 +00:00
Jack O'Sullivan	c55600c5af	lib: Make awaitPostgres code early in preStart	2023-12-29 19:05:28 +00:00
Jack O'Sullivan	64c3e2d720	nixos/colony: Give 8GiB more RAM to git All checks were successful CI / Check, build and cache Nix flake (push) Successful in 53m46s Details Installer / Build installer (push) Successful in 4m43s Details	2023-12-28 18:54:43 +00:00
Jack O'Sullivan	20d5fa29ae	nixos/deploy: Minor improvements	2023-12-28 18:33:55 +00:00
Jack O'Sullivan	046937de27	Update inputs and add custom NixOS branding Some checks failed CI / Check, build and cache Nix flake (push) Failing after 34m39s Details	2023-12-28 17:39:14 +00:00
Jack O'Sullivan	bba87ef73b	nixos/home/routing-common: Add trusted AS211024 to input chain All checks were successful CI / Check, build and cache Nix flake (push) Successful in 20m12s Details	2023-12-23 12:33:10 +00:00
Jack O'Sullivan	4e3ff0a466	nixos/home/routing-common: Add dynamic DNS update script All checks were successful CI / Check, build and cache Nix flake (push) Successful in 20m48s Details	2023-12-23 01:22:41 +00:00
Jack O'Sullivan	b1af3dbf18	nixos/tower: Add wireshark and Tailscale shell abbrev	2023-12-23 00:49:24 +00:00
Jack O'Sullivan	f58b71e8d3	nixos/britway: Use internal addresses for DNS	2023-12-23 00:49:02 +00:00
Jack O'Sullivan	0a86a649a6	nixos: Add SFH VM config All checks were successful CI / Check, build and cache Nix flake (push) Successful in 21m29s Details	2023-12-22 01:34:28 +00:00
Jack O'Sullivan	85189e74f8	Add missing trusted AS211024 prefixes All checks were successful CI / Check, build and cache Nix flake (push) Successful in 20m12s Details	2023-12-20 23:43:04 +00:00
Jack O'Sullivan	e760569b3e	Don't blindly trust as211024 All checks were successful CI / Check, build and cache Nix flake (push) Successful in 20m22s Details	2023-12-20 23:06:27 +00:00
Jack O'Sullivan	0fe863844f	nixos/estuary: Don't announce home prefix for now (MTU issues)	2023-12-20 22:51:01 +00:00
Jack O'Sullivan	d44fdcfe6a	nixos/home/routing-common: Restrict SSH access	2023-12-20 20:41:19 +00:00
Jack O'Sullivan	b48e7b1c33	nixos: Initial waffletail All checks were successful CI / Check, build and cache Nix flake (push) Successful in 20m52s Details	2023-12-20 19:21:31 +00:00
Jack O'Sullivan	d0b155d786	nixos/middleman: Wait for psql before starting nginx	2023-12-20 18:38:22 +00:00
Jack O'Sullivan	01cb95de6d	nixos/containers: Fix initial dummy deploy	2023-12-20 18:29:08 +00:00