nixos/whale2: Refresh Valheim server and world

Pin the community image and start simpland3 while retaining
simpland2. Correct the server-files volume name and reuse the
admin ID in both access lists.

.agents/skills/upgrade-nixpkgs/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: upgrade-nixpkgs
+description: >-
+  Upgrade all four nixpkgs channels (unstable, stable, mine, mine-stable) and home-manager for this
+  flake: check for a NixOS stable bump, rebase the devplayer0 nixpkgs fork, update kernel and
+  release metadata, refresh pins, sweep version-gated TODOs, and review other inputs. Use when the
+  user wants to update/bump nixpkgs, refresh the pins, or do the periodic nixpkgs/home-manager
+  upgrade.
+---
+
+# Upgrade nixpkgs
+
+Read [`docs/nixpkgs-upgrade.md`](../../../docs/nixpkgs-upgrade.md), the canonical procedure, and
+follow its phases in order.
+
+Key reminders (see the doc for the full steps):
+
+- It is **guided, not automated** — do the mechanical and investigative work but stop at the ⏸
+  points: pushing the fork, resolving rebase conflicts, applying a stable-channel bump, choosing a
+  new release codename, and deleting version guards. Report the findings and let the user decide.
+- **Check the current NixOS stable first** (Phase 1) — the fork's `devplayer0-stable` rebase target
+  and the `flake.nix` stable pins must agree on one release.
+- **Re-verify the patch stack against freshly fetched upstream**, not stale refs — enumerate it with
+  `git log`; don't assume a remembered list.
+- After pushing the rebased fork branches, **wait for the GitHub mirror to catch up** before
+  refreshing flake pins. The `nixpkgs-mine*` inputs fetch from GitHub, not the fork's primary
+  remote; verify both GitHub branch tips match the pushed local tips first.
+- After refreshing the pins, update `lib/constants.nix` to the current explicit LTS and latest
+  kernel package attributes, and update the `lib/default.nix` version overlay's `YY.MM` prefix to
+  the current month. Change its codename only when the stable channel advances.
+- After the cheap evaluations pass, build the actual devshell and one representative NixOS system
+  (prefer the local box). `nix flake check --no-build` does not expose dependency build failures;
+  this is especially important when updating build-tool inputs such as Determinate Nix.

.claude/skills/upgrade-nixpkgs

@@ -0,0 +1 @@
+../../.agents/skills/upgrade-nixpkgs

.claude/skills/upgrade-nixpkgs/SKILL.md

@@ -1,25 +0,0 @@
----
-name: upgrade-nixpkgs
-description: >-
-  Upgrade all four nixpkgs channels (unstable, stable, mine, mine-stable) and home-manager for this
-  flake: check for a NixOS stable bump, rebase the devplayer0 nixpkgs fork against upstream, run the
-  update commands, sweep version-gated TODOs, and review flake inputs. Use when the user wants to
-  update/bump nixpkgs, refresh the pins, or do the periodic nixpkgs/home-manager upgrade.
----
-
-# Upgrade nixpkgs
-
-The canonical, agent-agnostic procedure lives in the repo at
-[`docs/nixpkgs-upgrade.md`](../../../docs/nixpkgs-upgrade.md). Read it and follow the phases in
-order.
-
-Key reminders (see the doc for the full steps):
-
-- It is **guided, not automated** — do the mechanical/investigative work but stop at the ⏸ points:
-  pushing the fork, resolving rebase conflicts, editing the `flake.nix` stable pins, and deleting
-  version guards. Report and let the user decide.
-- **Check the current NixOS stable first** (Phase 1) — the fork's `devplayer0-stable` rebase target
-  and the `flake.nix` stable pins must agree on one release.
-- **Re-verify the patch stack against freshly fetched upstream**, not stale refs — enumerate it with
-  `git log`, don't assume a remembered list (stale `upstream/*` refs make already-upstreamed commits
-  masquerade as fork-only patches).

.gitea/workflows/ci.yaml

@@ -37,6 +37,10 @@ jobs:
         env:
           HARMONIA_SSH_KEY: ${{ secrets.HARMONIA_SSH_KEY }}
         run: |
+          echo "::group::Collect cache garbage"
+          ci/push-to-cache.sh --gc
+          echo "::endgroup::"
+
           nix eval --json --apply "builtins.attrNames" .#ci.x86_64-linux | jq -cr '.[]' | while read job; do
             echo "::group::Build $job"
             nix build --no-link .#ci.x86_64-linux."$job"

.gitea/workflows/update-docs.yaml

@@ -39,10 +39,10 @@ jobs:
       - name: Commit and push if changed
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          REPO_URL: ${{ gitea.repositoryUrl }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
+          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
           git remote set-url origin "${REPO_URL/https:\/\//https:\/\/oauth2:${GITEA_TOKEN}@}"
           git add docs/
           if ! git diff --cached --quiet; then

AGENTS.md

@@ -65,8 +65,9 @@ Common ones:
   `$INSTALLER`. For bringing up a new box end to end follow the guided procedure in
   [`docs/install-box.md`](docs/install-box.md).
 - `update-nixpkgs` / `update-home-manager` — bump pinned inputs. For the full periodic upgrade
-  (rebasing the `devplayer0` nixpkgs fork, stable-release bumps, version-gate sweep, input review)
+  (rebasing the `devplayer0` nixpkgs fork, stable-release bumps, kernel and release-metadata
-  follow the guided procedure in [`docs/nixpkgs-upgrade.md`](docs/nixpkgs-upgrade.md).
+  refreshes, version-gate sweep, input review) follow the guided procedure in
+  [`docs/nixpkgs-upgrade.md`](docs/nixpkgs-upgrade.md).
 
 Use the narrowest relevant evaluation while iterating: `check-system <host>` for a box config,
 `nix eval .#nixfiles.config.nixos.allAssignments --json` for assignment generation, or
@@ -211,10 +212,13 @@ in churn.
   command, option or upstream technical term such as QEMU's machine type.
 - Commit subjects follow `area/scope: Capitalized summary` (e.g. `nixos/home: ...`); keep logically
   distinct changes in separate commits. Aim for 50-character subjects and do not exceed 72
-  characters. Wrap commit bodies at 72 columns. A concise body describing the change and its
+  characters. Hard-wrap commit body lines at 72 characters; Git preserves an unwrapped `-m`
-  rationale is welcome when the subject alone does not provide enough context — keep it to the
+  argument as one long line, so include literal line breaks or use a commit-message file. Before
-  essentials rather than restating the diff. `Co-Authored-By` is the only trailer used here; do
+  reporting a commit, inspect `git show -s --format=%B HEAD` and amend it if any line exceeds 72
-  **not** add a `Claude-Session` link (or any other session/tooling trailer).
+  characters. A concise body describing the change and its rationale is welcome when the subject
+  alone does not provide enough context — keep it to the essentials rather than restating the diff.
+  `Co-Authored-By` is the only trailer used here; do **not** add a `Claude-Session` link (or any
+  other session/tooling trailer).
 - **"Logically distinct" means unrelated** — two different applications, two boxes that have nothing
   to do with each other, a drive-by fix that happens to sit in a file you were editing anyway. One
   piece of work stays in one commit even when it touches a config, several docs and a switch: if the

ci/push-to-cache.sh

@@ -10,6 +10,14 @@ remote_cmd() {
   ssh -i "$SSH_KEY" "$SSH_HOST" env HOME=/run/harmonia NIX_REMOTE="$REMOTE_STORE" "$@"
 }
 
+collect_garbage() {
+  echo "Collecting garbage..."
+  remote_cmd nix-env \
+    -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles \
+    --delete-generations 60d
+  remote_cmd nix-collect-garbage
+}
+
 umask_old=$(umask)
 umask 0066
 echo "$HARMONIA_SSH_KEY" | base64 -d > "$SSH_KEY"
@@ -17,6 +25,12 @@ umask $umask_old
 
 mkdir -p ~/.ssh
 cp ci/known_hosts ~/.ssh/
+
+if [ "${1-}" = "--gc" ]; then
+  collect_garbage
+  exit
+fi
+
 path="$1"
 
 echo "Pushing $path to cache..."
@@ -25,7 +39,4 @@ nix copy --no-check-sigs --to "$STORE_URI" "$path"
 if [ -n "$UPDATE_PROFILE" ]; then
   echo "Updating profile..."
   remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
-
-  echo "Collecting garbage..."
-  remote_cmd nix-collect-garbage --delete-older-than 60d
 fi

docs/README.md

@@ -47,7 +47,7 @@ colony (physical VM host, ams1)
 │                                     ├── colony-psql  (shared PostgreSQL)
 │                                     ├── chatterbox   (Matrix Synapse + bridges)
 │                                     ├── jackflix     (media stack)
-│                                     ├── object       (MinIO, Harmonia Nix cache, Sharry, HedgeDoc, wastebin)
+│                                     ├── object       (MinIO, Harmonia Nix cache, HedgeDoc, wastebin)
 │                                     ├── toot         (Bluesky PDS; Mastodon disabled)
 │                                     ├── waffletail   (Tailscale subnet router / exit node)
 │                                     ├── qclk         (WireGuard management appliance)

docs/architecture.md

@@ -175,7 +175,7 @@ descriptions) see [`reference/nixos-options.md`](reference/nixos-options.md).
 
 | Module | Provides |
 |---|---|
-| `common` | Baseline for all boxes: imports the impermanence, ragenix (age), sharry, copyparty and harmonia NixOS modules; pins `system.stateVersion`; `doas` instead of `sudo`; immutable users; nix settings (flakes, `ca-derivations`, the `nix-cache.nul.ie` substituter); declares the `my` option root. |
+| `common` | Baseline for all boxes: imports the impermanence, ragenix (age), copyparty and harmonia NixOS modules; pins `system.stateVersion`; `doas` instead of `sudo`; immutable users; nix settings (flakes, `ca-derivations`, the `nix-cache.nul.ie` substituter); declares the `my` option root. |
 | `user` | `my.user` — the primary user: `users.users` + matching `home-manager.users` entry, wheel/doas, SSH authorized key from `.keys/me.pub`, shell taken from the home config, home persistence under tmproot. |
 | `build` | `my.build` — alternate build targets via `extendModules`: `my.buildAs.devVM` (QEMU dev VM), `iso`, `container`, `kexecTree`, `netbootTree`/`netbootArchive`; `my.build.isDevVM` marker; `allHardware` profile toggle. |
 | `dynamic-motd` | `my.dynamic-motd` — runs a script via `pam_exec` to generate the MOTD on login/ssh. |

docs/deployment.md

@@ -202,11 +202,14 @@ point release. Building straight against it fails on hash mismatches and, worse,
 package list by import-from-derivation — which would drag *evaluation* of this flake onto the
 network and let an OpenWrt feed rebuild break `check-system` for unrelated boxes.
 
-The `openwrt-feeds` input exists to stop that. It holds expanded per-package hashes, so every `.apk`
+The `openwrt-feeds` input exists to stop that. It holds expanded per-package metadata and vendors
-is a plain pinned `fetchurl` and no import-from-derivation is involved. Its generated files run to
+the repository indexes themselves, so every `.apk` is a plain pinned `fetchurl`, image builds read
-hundreds of thousands of lines and are rewritten wholesale on each refresh, which is why they live
+the indexes from the flake rather than OpenWrt's mutable URLs, and no import-from-derivation is
-in their own repository rather than here. Refresh the pin with `nix flake update openwrt-feeds`;
+involved. Its generated files run to hundreds of thousands of lines and are rewritten wholesale on
-adding a release or target means adding it to that repo's `pins` and regenerating there first.
+each refresh, which is why they live in their own repository rather than here. Regenerate and push
+that repository with `nix run .#update`, then refresh this flake's pin with
+`nix flake update openwrt-feeds`; adding a release or target means adding it to that repository's
+`pins` first.
 
 ## CI
 
@@ -219,13 +222,14 @@ On pushes to `master`, this installs Determinate Nix on the runner (via
 Harmonia substituter as the boxes), runs `nix flake check --no-build`, then builds every attribute
 of `.#ci.x86_64-linux`: systems as `system-<name>`, homes as `home-<name>` (with `@` changed to
 `-at-`), packages as `package-<name>`, and the development `shell`. Each result is pushed to the
-Harmonia cache with [`ci/push-to-cache.sh`](../ci/push-to-cache.sh).
+Harmonia cache with [`ci/push-to-cache.sh`](../ci/push-to-cache.sh). Before the first push, the
+workflow deletes cache-profile generations older than its retention period, then collects
+unreachable paths so a full cache cannot prevent collection from being reached.
 
 It then builds `.#ciDrv.x86_64-linux`, a `linkFarm` of all CI attributes, and pushes it with
-`UPDATE_PROFILE=1`. That updates the `nixfiles` profile on the cache box and collects old paths
+`UPDATE_PROFILE=1`. That updates the `nixfiles` profile on the cache box. The SSH store uses
-according to the workflow's retention setting. The SSH store uses `/var/lib/harmonia`,
+`/var/lib/harmonia`, `HARMONIA_SSH_KEY`, and pinned `ci/known_hosts`; clients use
-`HARMONIA_SSH_KEY`, and pinned `ci/known_hosts`; clients use `https://nix-cache.nul.ie` through
+`https://nix-cache.nul.ie` through `lib.my.c.nix.cache`.
-`lib.my.c.nix.cache`.
 
 ### `installer.yaml`
 

docs/networking.md

@@ -159,6 +159,7 @@ edit prose there, never the other generated cells.
 | [`cellar`](sites/home/cellar.md) | `192.168.68.80/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::4:1/64` | h.nul.ie |  |
 | [`hass`](sites/home/sfh/containers/hass.md) | `192.168.68.103/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::5:3/64` | h.nul.ie |  |
 | [`palace`](sites/home/palace.md) | `192.168.68.22/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::2:1/64` | h.nul.ie |  |
+| [`portcullis`](sites/colony/portcullis.md) | `192.168.68.41/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::6:1/64` | h.nul.ie |  |
 | [`river`](sites/home/river.md) | `192.168.68.1/22` | `2a0e:97c0:4d0:1::1/64` | h.nul.ie |  |
 | `router-hi` | `192.168.71.254/22 gw 192.168.68.1` | `2a0e:97c0:4d0:1::ffff/64` | h.nul.ie | Floating VIP shared by [`river`](sites/home/river.md) and [`stream`](sites/home/stream.md) |
 | [`sfh`](sites/home/sfh/README.md) | `192.168.68.81/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::4:2/64` | h.nul.ie |  |

docs/nixpkgs-upgrade.md

@@ -2,13 +2,14 @@
 
 Procedure for the periodic upgrade of all four nixpkgs channels (`unstable`, `stable`, `mine`,
 `mine-stable`) and home-manager. Written to be followed by a person or any coding agent; a
-Claude Code entry point exists at `.claude/skills/upgrade-nixpkgs/` but the steps below are the
+shared agent-skill entry point exists at `.agents/skills/upgrade-nixpkgs/`, but the steps below are
-canonical source.
+the canonical source.
 
 The upgrade is **guided, not automated**: do the mechanical and investigative steps, but stop at
 the judgment points (marked ⏸) — pushing the fork, resolving rebase conflicts, editing the
-`flake.nix` stable pins, and deleting version guards. Report findings and let the maintainer
+stable-channel configuration, choosing a new release codename, and deleting version guards. Report
-decide. Keep a running summary and present it before any push or commit.
+findings and let the maintainer decide. Keep a running summary and present it before any push or
+commit.
 
 Work the phases in order; skip one only if explicitly scoped to a subset.
 
@@ -43,6 +44,7 @@ stable pins) has to agree on one NixOS stable release, so establish it up front.
    the pieces must all move to the same release together:
    - Rebase `devplayer0-stable` onto the new `upstream/release-YY.NN` (Phase 2 uses this target).
    - Edit `flake.nix`: `nixpkgs-stable.url` and `home-manager-stable.url` → the new release.
+   - Choose a new `lib/default.nix` `versionOverlay` codename (Phase 4 updates it).
    - Bump each system's `stateVersion` / `home.stateVersion` only if the maintainer explicitly
      wants to — that is a separate, deliberate decision; never auto-bump.
    Don't edit `flake.nix` here without confirmation.
@@ -70,6 +72,12 @@ For **both** branches — `devplayer0` onto `upstream/nixos-unstable`, and `devp
    conflicted.
 6. ⏸ **Push:** only after confirmation. `git push --force-with-lease origin devplayer0
    devplayer0-stable` (force needed — rebase rewrites history).
+7. Wait for the GitHub mirror used by the flake inputs to catch up with the primary fork remote.
+   Compare the local branch tips with
+   `git ls-remote https://github.com/devplayer0/nixpkgs.git refs/heads/devplayer0
+   refs/heads/devplayer0-stable` and do not continue until both match. Updating sooner can leave
+   `nixpkgs-mine` and `nixpkgs-mine-stable` pinned to the pre-rebase commits even though the push
+   succeeded.
 
 ## Phase 3 — Update the pinned inputs
 
@@ -83,7 +91,28 @@ update-home-manager
 Then show the `flake.lock` diff for the nixpkgs/home-manager entries so the old→new revisions are
 visible.
 
-## Phase 4 — Sweep version-gated behavior
+## Phase 4 — Refresh kernels and release metadata
+
+Update the repository values that deliberately move with nixpkgs upgrades:
+
+1. In `lib/constants.nix`, inspect the kernel attributes available from the refreshed nixpkgs pins
+   and update both explicit selections:
+   - `kernel.lts` → the newest upstream long-term-support kernel carried by nixpkgs.
+   - `kernel.latest` → the newest kernel series carried by nixpkgs.
+   Keep explicit `pkgs.linuxKernel.packages.linux_X_Y` attributes rather than replacing them with
+   moving aliases. Confirm both attributes exist in the unstable and stable package sets used by
+   the boxes; if the newest choice is unavailable on stable, report that instead of breaking the
+   shared constant.
+2. In `lib/default.nix`, update the `versionOverlay` values:
+   - Set the leading `YY.MM` in `trivial.release` to the current year and month. Preserve the
+     `:u-${prev.trivial.release}` suffix.
+   - If Phase 1 found a new NixOS stable release, ⏸ ask the maintainer to choose or approve a new
+     `trivial.codeName`, then update it as part of the coordinated stable bump. Otherwise retain the
+     existing codename.
+
+Show these edits alongside the input changes in the upgrade summary.
+
+## Phase 5 — Sweep version-gated behavior
 
 The repo carries branch-conditional logic and TODOs keyed to specific nixpkgs versions; some become
 removable after an upgrade, especially after a stable bump. Surface them:
@@ -97,29 +126,36 @@ Known example: `nixos/modules/common.nix` carries a `# TODO: Remove if-else when
 guard. For each hit, evaluate whether the now-current versions make the guard removable and list
 candidates. ⏸ Don't delete guards without confirmation — some protect the still-supported stable.
 
-## Phase 5 — Review remaining flake inputs
+## Phase 6 — Review remaining flake inputs
 
 Don't blanket-update. Walk the other inputs deliberately:
 
 1. List inputs and locked revisions from `flake.lock` (or `nix flake metadata`).
 2. For each meaningful input (`libnetRepo`, `devshell`, `determinate-nix`, `ragenix`, `deploy-rs`,
-   `impermanence`, and the packaged apps like `boardie`, `harmonia`, `copyparty`, `sharry`, …),
+   `impermanence`, and the packaged apps like `boardie`, `harmonia`, and `copyparty`),
    compare the locked revision to upstream and summarize notable changes (breaking changes,
    relevant fixes). Many inputs `follows` `nixpkgs-unstable` and already moved in Phase 3.
 3. Propose a per-input update list with reasons; update the approved ones with targeted
    `nix flake update <input>`, not a global update.
 
-## Phase 6 — Validate
+## Phase 7 — Validate
 
 1. `nix flake check --no-build` (broad eval; reproduces CI's cheap checks).
 2. `check-system <host>` on a representative box, and one exercising the stable channel if the
-   boxes mix channels.
+   boxes mix channels. This must exercise the refreshed kernel constants on both channels.
-3. Report eval/build results honestly. On failure, surface the error and stop rather than papering
+3. Build the actual devshell with
+   `nix build --no-link --print-out-paths .#devShells.x86_64-linux.default`. Evaluation does not
+   build its dependencies, so it cannot catch packaging conflicts introduced by inputs such as
+   Determinate Nix.
+4. After the evaluations pass, run `build-system <host>` for one representative NixOS box. Prefer
+   the local box when it is managed by this flake: its full closure is likely to exercise the most
+   relevant packages, home-manager configuration and upgraded kernel. Build only; do not switch.
+5. Report eval/build results honestly. On failure, surface the error and stop rather than papering
    over it.
 
 ## Wrap-up
 
 Present a final summary: fork rebase outcome (patches kept/dropped/conflicted), whether a stable
-bump is pending or was applied, the lock diff, version-gate cleanup candidates, inputs updated, and
+bump is pending or was applied, kernel and release-metadata changes, the lock diff, version-gate
-validation results. Leave committing to the maintainer unless asked; if committing, follow the
+cleanup candidates, inputs updated, and validation results. Leave committing to the maintainer
-repo's `area/scope: Capitalized summary` convention.
+unless asked; if committing, follow the repo's `area/scope: Capitalized summary` convention.

docs/reference/nixos-options.md

@@ -24,7 +24,7 @@
 | `my.borgthin.jobs.<name>.repo` | string | `null` | borg repository URL |
 | `my.borgthin.jobs.<name>.timer.at` | string or list of string | `"5:00"` | systemd calendar time(s) to run backup at |
 | `my.borgthin.jobs.<name>.timer.persistent` | boolean | `false` | Persistent systemd timer |
-| `my.borgthin.lvmPackage` | package | `<derivation lvm2-2.03.39>` | Packge containing LVM tools |
+| `my.borgthin.lvmPackage` | package | `<derivation lvm2-2.03.41>` | Packge containing LVM tools |
 | `my.borgthin.package` | package | `inputs.borgthin.packages.${system}.borgthin` | borgthin package |
 | `my.borgthin.thinToolsPackage` | package | `<derivation thin-provisioning-tools-1.3.2>` | Package containing thin-provisioning-tools |
 
@@ -167,7 +167,7 @@
 | `my.nginx-sso.includes.instances.<name>.auth.redirect` | string | `"$scheme://$http_host$request_uri"` | URL to redirect to upon successful login. |
 | `my.nginx-sso.includes.instances.<name>.logout.path` | string | `"/sso-logout"` | HTTP path for SSO logout. |
 | `my.nginx-sso.includes.instances.<name>.logout.redirect` | string | `"$scheme://$http_host/"` | URL to redirect to upon successful logout. |
-| `my.nginx-sso.package` | package | `<derivation nginx-sso-0.27.7>` | nginx-sso package to use. |
+| `my.nginx-sso.package` | package | `<derivation nginx-sso-0.27.8>` | nginx-sso package to use. |
 
 ## `nvme` — [`nixos/modules/nvme`](../../nixos/modules/nvme)
 
@@ -276,11 +276,11 @@
 | `my.vms.instances.<name>.networks.<name>.model` | string | `"virtio-net"` | Device type for network interface. |
 | `my.vms.instances.<name>.networks.<name>.tapFD` | null or (unsigned integer, meaning >=0) | `null` | FD to use to pass existing TAP device. |
 | `my.vms.instances.<name>.networks.<name>.waitOnline` | boolean or string | `true` | Whether to wait for networkd to consider the bridge / existing TAP device online. Pass a string to set the OPERSTATE will wait for. |
-| `my.vms.instances.<name>.qemuBin` | absolute path | `"/nix/store/w4yhckm5wyvml3pqw8ai5fl174j14nrb-qemu-host-cpu-only-11.0.0/bin/qemu-kvm"` | Path to QEMU executable. |
+| `my.vms.instances.<name>.qemuBin` | absolute path | `"/nix/store/2lkr0v29a67jybn8ckjawpg08y0yizfp-qemu-host-cpu-only-11.1.0/bin/qemu-kvm"` | Path to QEMU executable. |
 | `my.vms.instances.<name>.qemuFlags` | list of string | `[ ]` | Additional flags to pass to QEMU. |
 | `my.vms.instances.<name>.smp.cpus` | unsigned integer, meaning >=0 | `1` | Number of CPU cores. |
 | `my.vms.instances.<name>.smp.threads` | unsigned integer, meaning >=0 | `1` | Number of threads per core. |
 | `my.vms.instances.<name>.spice.enable` | boolean | `true` | Whether to enable SPICE. |
 | `my.vms.instances.<name>.uuid` | string | `null` | QEMU machine UUID. |
 | `my.vms.instances.<name>.vga` | string | `"virtio"` | VGA card type. |
-| `my.vms.ovmfPackage` | package | `<derivation OVMF-202602>` | OVMF package. |
+| `my.vms.ovmfPackage` | package | `<derivation OVMF-202605>` | OVMF package. |

docs/sites/colony/shill/README.md

@@ -53,7 +53,7 @@ their current addresses. Each container has its own page:
 | [`colony-psql`](containers/colony-psql.md) | Shared PostgreSQL (14) |
 | [`chatterbox`](containers/chatterbox.md) | Matrix Synapse + bridges |
 | [`jackflix`](containers/jackflix.md) | Media stack |
-| [`object`](containers/object.md) | MinIO, Harmonia Nix cache, Sharry, HedgeDoc, wastebin |
+| [`object`](containers/object.md) | MinIO, Harmonia Nix cache, HedgeDoc, wastebin |
 | [`toot`](containers/toot.md) | Bluesky PDS (Mastodon disabled) |
 | [`waffletail`](containers/waffletail.md) | Tailscale subnet router / exit node |
 | [`qclk`](containers/qclk.md) | WireGuard management appliance |

docs/sites/colony/shill/containers/colony-psql.md

@@ -15,7 +15,7 @@ database, the containers (and the `git` VM) connect here over the `ctrs` network
   the ident map.
 - **netdata** with the Python PostgreSQL collector.
 - Consumers wait for the database to accept connections with the `lib.my.systemdAwaitPostgres`
-  helper (e.g. `sharry`, `atticd`, `mastodon-init-db`, and `middleman`'s nginx as a DNS
+  helper (e.g. `atticd`, `mastodon-init-db`, and `middleman`'s nginx as a DNS
   bootstrap hack).
 
 ## Network assignments
@@ -27,7 +27,7 @@ use as the database hostname.
 
 ## Consumers
 
-- [object](object.md) — `sharry` and `hedgedoc` (and `atticd` when enabled) over
+- [object](object.md) — `hedgedoc` (and `atticd` when enabled) over
   `colony-psql:5432`
 - [toot](toot.md) — Mastodon's database (Mastodon currently disabled)
 - [chatterbox](chatterbox.md) — the mautrix bridges (WhatsApp, Messenger, Instagram) via

docs/sites/colony/shill/containers/middleman.md

@@ -71,7 +71,6 @@ all vhosts are `onlySSL`, kTLS and HTTP/2. "SSO" = gated behind nginx-sso (`gene
 | `jackflix.nul.ie` | `jackflix-ctr:8096` | Jellyfin; `/socket` websockets; `/` redirects to `/web/` |
 | `toot.nul.ie` | `toot-ctr:80` | Mastodon — **upstream currently disabled**, see [toot](toot.md) |
 | `pds.nul.ie` | `toot-ctr:3000` | Bluesky PDS ([toot](toot.md)); websockets |
-| `share.nul.ie` | `object-ctr:9090` | Sharry ([object](object.md)); websockets |
 | `stuff.nul.ie` | `jackflix-ctr:3923` | copyparty |
 | `public.nul.ie` (+ alias `p.nul.ie`) | static `/mnt/media/public` | fancyindex file listing; `addSSL` so plain HTTP also works |
 | `mc-map.nul.ie` | `simpcraft-oci:8100` | Minecraft map (OCI container on [`whale2`](../../whale2.md#game-servers)) |

docs/sites/colony/shill/containers/object.md

@@ -1,7 +1,6 @@
 # object
 
-Object storage and the Nix binary cache, plus a few small self-hosted web apps (Sharry,
+Object storage and the Nix binary cache, plus HedgeDoc and wastebin.
-HedgeDoc, wastebin).
 
 - **Source:** [`shill/containers/object.nix`](../../../../../nixos/boxes/colony/vms/shill/containers/object.nix)
 - **Host:** NixOS container on [`shill`](../README.md) (bind-mounts `/mnt/minio` and
@@ -14,7 +13,6 @@ HedgeDoc, wastebin).
 | --- | --- | --- |
 | MinIO | `9000` (S3) / `9001` (console) | S3-compatible object storage, `s3.nul.ie` + `*.s3.nul.ie` (virtual-host style via `MINIO_DOMAIN`), console at `minio.nul.ie`; region `eu-central-1`; data on the `/mnt/minio` XFS volume |
 | Harmonia | `5000` | Nix binary cache at `nix-cache.nul.ie` — `harmonia-dev` cache serves `shill`'s `/nix/store` out of a dedicated store view rooted at `/var/lib/harmonia` (bind-mounted from `/mnt/nix-cache`), signed with the `nix-cache.key` secret; a `harmonia` user with authorized keys exists for cache pushes |
-| Sharry | `9090` | file sharing at `share.nul.ie`; Postgres on [colony-psql](colony-psql.md), files stored in the `share` MinIO bucket; fixed `dev` account + invite signup; mail via `mail.nul.ie`; configured share-size limit |
 | HedgeDoc | `3000` | collaborative markdown notes at `md.nul.ie`; Postgres on [colony-psql](colony-psql.md); anonymous edits but no anonymous notes, email login, no open email registration |
 | wastebin | `8088` | pastebin at `pb.nul.ie` |
 | atticd | `8069` | **currently disabled** (`services.atticd.enable = false`) — an alternative Nix cache that would store locally and sit behind `nix-cache.nul.ie`; config (including the `object/atticd.env` secret) is kept around |
@@ -29,10 +27,10 @@ See the consolidated [network assignments](../../../../networking.md#box-assignm
 
 ## Backing services
 
-- [colony-psql](colony-psql.md) — Sharry and HedgeDoc databases (atticd too, when enabled).
+- [colony-psql](colony-psql.md) — HedgeDoc's database (atticd too, when enabled).
 - MinIO buckets back other boxes' services: Gitea LFS/packages (with the `middleman` MIME hack
   for Docker manifests), Mastodon's `mastodon` bucket and the Bluesky PDS `pds` bucket on
-  [toot](toot.md), and Sharry's `share` bucket.
+  [toot](toot.md).
 
 ## Notable config files
 

docs/sites/colony/whale2.md

@@ -48,7 +48,8 @@ forwarded by `estuary`.
 | `graeme` | `25569` tcp+udp | running |
 
 - **valheim** ([`valheim.nix`](../../../nixos/boxes/colony/vms/whale2/valheim.nix)) —
-  `lloesche/valheim-server`, public server "amogus sus", world `simpland2`,
+  `community-valheim-tools/valheim-server`, public server "amogus sus", world `simpland3`
+  (previous world `simpland2` retained in the `valheim_data` volume),
   allow-listed Steam IDs, password from agenix.
 - **simpcraft** ([`minecraft/`](../../../nixos/boxes/colony/vms/whale2/minecraft)) —
   `itzg/minecraft-server` (self-built `git.nul.ie/dev/craftblock` image),

flake.lock

@@ -75,11 +75,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781351267,
+        "lastModified": 1787524125,
-        "narHash": "sha256-86HFs1K+LRlx8t4AjaMdU5qlg4O7kLz1VlnNapKZIuY=",
+        "narHash": "sha256-P48TOQdIbB0PKMn4FTk6X0utbf0LemNlJ+bFcSbveGA=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "90639de9840d7dcc2d9000026fe547f666c1d550",
+        "rev": "9de090265f8d063056320f41d984830839017a2f",
         "type": "github"
       },
       "original": {
@@ -90,11 +90,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1780532242,
+        "lastModified": 1787326676,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
+        "narHash": "sha256-lWhBbBvC05/xwivKBBiM2YNizpmgqCgyOIzomvRuwxs=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
+        "rev": "692f7e9ef2ece8125b466f66f2af532b3edaed0d",
         "type": "github"
       },
       "original": {
@@ -150,11 +150,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1781023725,
+        "lastModified": 1786361680,
-        "narHash": "sha256-Gt+qFANcrDRjl3xzidLYrAUQCd3808iuAsLwZbYYAEU=",
+        "narHash": "sha256-IxaZkb9rCGEZ+yGndxKXONeIEcKMzoFUsvLTB5G/caw=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "2ce9051767ee4d1a3c43b52ba327431783bfd463",
+        "rev": "16901271e5b30b591e56f7a84f25f186fb20f3e1",
         "type": "github"
       },
       "original": {
@@ -167,19 +167,17 @@
       "inputs": {
         "flake-parts": "flake-parts",
         "git-hooks-nix": "git-hooks-nix",
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_4",
-          "nixpkgs-unstable"
-        ],
         "nixpkgs-23-11": "nixpkgs-23-11",
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1785428605,
+        "lastModified": 1787334067,
-        "narHash": "sha256-wfaiSRLM1wDb4MV+NEzbyheK9Y03/oe56NR2I84UF7E=",
+        "narHash": "sha256-wmwgSBcAGJe/e+FrLwJxlghYV12F7UkIodm0j6cosYg=",
-        "rev": "0ff46631f69584c9f76792cae595ea253bd482c3",
+        "rev": "c407745c8b9b616bebf7288697699c45794e31ac",
-        "revCount": 26288,
+        "revCount": 27248,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.9/019fb409-4d6e-7243-8a88-23ceee2520e9/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.22.2/01a02595-e77f-7e43-a616-5bbc77a2dc07/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -205,25 +203,6 @@
         "type": "github"
       }
     },
-    "devshell-tools": {
-      "inputs": {
-        "flake-utils": "flake-utils_10",
-        "nixpkgs": "nixpkgs_5"
-      },
-      "locked": {
-        "lastModified": 1710099997,
-        "narHash": "sha256-WmBKTLdth6I/D+0//9enbIXohGsBjepbjIAm9pCYj0U=",
-        "owner": "eikek",
-        "repo": "devshell-tools",
-        "rev": "e82faf976d318b3829f6f7f6785db6f3c7b65267",
-        "type": "github"
-      },
-      "original": {
-        "owner": "eikek",
-        "repo": "devshell-tools",
-        "type": "github"
-      }
-    },
     "devshell_2": {
       "inputs": {
         "flake-utils": "flake-utils_3",
@@ -282,15 +261,15 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1767039857,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -303,12 +282,12 @@
         ]
       },
       "locked": {
-        "lastModified": 1748821116,
+        "lastModified": 1782949081,
-        "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
-        "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
-        "revCount": 377,
+        "revCount": 480,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.480%2Brev-17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e/019f2195-dee5-7233-9747-eca0c27f7406/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -354,57 +333,6 @@
         "type": "github"
       }
     },
-    "flake-utils_10": {
-      "inputs": {
-        "systems": "systems_10"
-      },
-      "locked": {
-        "lastModified": 1709126324,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_11": {
-      "inputs": {
-        "systems": "systems_11"
-      },
-      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_12": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "flake-utils_2": {
       "inputs": {
         "systems": "systems_2"
@@ -543,21 +471,18 @@
     "git-hooks-nix": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "gitignore": [
-          "determinate-nix"
-        ],
         "nixpkgs": [
           "determinate-nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1747372754,
+        "lastModified": 1784288435,
-        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
-        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
-        "revCount": 1026,
+        "revCount": 1231,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1231%2Brev-43b3c1ab9d40fb1dbb008f451988a91e375825e9/019f7135-8fdf-76f0-b1a1-d2c67e91af8d/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -574,11 +499,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1781128165,
+        "lastModified": 1787502072,
-        "narHash": "sha256-97WpKZkaNAL5g7MtASLwqnrJrvrLpQRr6cXWiRNLiXQ=",
+        "narHash": "sha256-K5sKCAV3kPbUW0evsqpWrlQRsa2t0jfkduSZ+lRWAA8=",
         "owner": "nix-community",
         "repo": "harmonia",
-        "rev": "f0dd1094cdc8d72e038cf9347cacfa9272a8f72d",
+        "rev": "7c1ef262e324bbf61201fe92a73849eb3d6fd9e2",
         "type": "github"
       },
       "original": {
@@ -595,11 +520,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781402797,
+        "lastModified": 1781447016,
-        "narHash": "sha256-pBdDca7xv1nuP0kj+gC5g5AcR/DV+9Zy3CS6uDOMdJ4=",
+        "narHash": "sha256-bxZ8XTdUFQRWsh6rZn7fCui/SV4ox7dUAiSg4zYJuDg=",
         "owner": "devplayer0",
         "repo": "hass-west-wood",
-        "rev": "3e6ef7a9084e4053c82dea20127a775e7bcf77a5",
+        "rev": "fd43bede6e1175d9118c42507b737041b8923787",
         "type": "github"
       },
       "original": {
@@ -637,11 +562,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781319724,
+        "lastModified": 1787377438,
-        "narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
         "type": "github"
       },
       "original": {
@@ -657,11 +582,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781305496,
+        "lastModified": 1787487906,
-        "narHash": "sha256-g8Vv4Qfc7n+lgov97REu3X6BeJtvYY0hlSUZR1GrGQQ=",
+        "narHash": "sha256-zIdM+8teujHm5hc5MIPDnV7k2UeOOT/pFyFtWjOCwsY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c87a39aa979acc4848016d2220c6238390d84779",
+        "rev": "cfba7ad5886b342b8dd63ba74354b3853ea4cfc9",
         "type": "github"
       },
       "original": {
@@ -674,7 +599,7 @@
         "home-manager": [
           "home-manager-unstable"
         ],
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
         "lastModified": 1769548169,
@@ -693,11 +618,11 @@
     "libnetRepo": {
       "flake": false,
       "locked": {
-        "lastModified": 1776595118,
+        "lastModified": 1781446676,
-        "narHash": "sha256-6bIEi8q5hXCHU9nApTbQXvpljMWldg3QipCD+jkOGK8=",
+        "narHash": "sha256-b3rJDKxzsf7p4wI698iBi2PInDPRH3KwjdqOk/SahKk=",
         "owner": "oddlama",
         "repo": "nixos-extra-modules",
-        "rev": "84207afebb794be7b53cfc9768730f37c64f4a13",
+        "rev": "f097b474fcb5db7dfd52263c055c9e6caeb13d62",
         "type": "github"
       },
       "original": {
@@ -709,11 +634,11 @@
     "nix": {
       "flake": false,
       "locked": {
-        "lastModified": 1780652321,
+        "lastModified": 1787394889,
-        "narHash": "sha256-o/6YXRB6AbeL4SYtSHlJ9oEROl6Wmf7yheJNa3fAv2I=",
+        "narHash": "sha256-qtDusLx9yn0aME9D9Oe5QhFnmDUaARwMJo/vt4+DtIU=",
         "owner": "nixos",
         "repo": "nix",
-        "rev": "d1f04a798cf4276da59567c07a3bf4a628669288",
+        "rev": "88b09c64fbea076a0376830d98e5331f70ed31a3",
         "type": "github"
       },
       "original": {
@@ -777,11 +702,11 @@
     },
     "nixpkgs-mine": {
       "locked": {
-        "lastModified": 1781356656,
+        "lastModified": 1787612836,
-        "narHash": "sha256-Ygkl3ZBJ434/WhwdK1FyvPMeHvNPAopg3KE/1HtcJuk=",
+        "narHash": "sha256-25KxhEJHYVZXAwsHQbXpyaG9/WpWGo9EmGe7kzMc25Y=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "a15e20705db295f621cb5bb63613f03a9373323f",
+        "rev": "c92598bc3fd46ff4d23407045091eea206120979",
         "type": "github"
       },
       "original": {
@@ -793,11 +718,11 @@
     },
     "nixpkgs-mine-stable": {
       "locked": {
-        "lastModified": 1781356876,
+        "lastModified": 1787523195,
-        "narHash": "sha256-s8ed+zuk5wrbyhtDQpkxycAcLmhQH9umGRuVRBNKUbU=",
+        "narHash": "sha256-NI87OKi5hXSZlIgh5Gwjjca52MAJnwRaU/+Su99fMqg=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "2eb8bacf9f641d4510fc43ba7fc0eea7dfdf5b24",
+        "rev": "2a058ae98b603146eae51e6a268854ce0ad035a1",
         "type": "github"
       },
       "original": {
@@ -825,11 +750,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1780902259,
+        "lastModified": 1787414105,
-        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
+        "narHash": "sha256-WncT27+3BOkgTaJZLnCsf3LcYf9RXMuR9ONSN4rzQ7s=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
+        "rev": "a9e6d84f9c2f9012f5fe7d964a7851352300e61a",
         "type": "github"
       },
       "original": {
@@ -840,11 +765,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1781074563,
+        "lastModified": 1787360063,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "narHash": "sha256-dt4WdcvsA8/RCe+VZZwqU0X+XMM3wBbGCWA0/sFWzGo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "2c423e03bbafcff28bfadc6781a4a8257f205cb5",
         "type": "github"
       },
       "original": {
@@ -884,6 +809,22 @@
       }
     },
     "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1784160687,
+        "narHash": "sha256-iYL/bixrb6FlHFu/gIuBYzq6c6lM5AAXsXNSWXtIgQc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4382ed2b7a6839d4280a9b386db49cbc5907414d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4382ed2b7a6839d4280a9b386db49cbc5907414d",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1768564909,
         "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
@@ -899,38 +840,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1709309926,
-        "narHash": "sha256-VZFBtXGVD9LWTecGi6eXrE0hJ/mVB3zGUlHImUs2Qak=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "79baff8812a0d68e24a836df0a364c678089e2c7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-23.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_6": {
-      "locked": {
-        "lastModified": 1674990008,
-        "narHash": "sha256-4zOyp+hFW2Y7imxIpZqZGT8CEqKmDjwgfD6BzRUE0mQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d2bbcbe6c626d339b25a4995711f07625b508214",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "openwrt-feeds": {
       "inputs": {
         "nixpkgs": [
@@ -941,11 +850,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787353688,
+        "lastModified": 1787522666,
-        "narHash": "sha256-YDEm+ev3BpDS9Sq1ByVv0i5QQCE1yezpjWVhcNBBjCE=",
+        "narHash": "sha256-Ev4X1HCx6aV4L5GtMQX9DJRgWQ7K914rT11nL7mIkmw=",
         "owner": "devplayer0",
         "repo": "openwrt-feeds",
-        "rev": "a30b2b5f83c7d1fffca2146453e8d5866b882da4",
+        "rev": "53720becf1e89473660e25107ae5d23bf1465621",
         "type": "github"
       },
       "original": {
@@ -963,11 +872,11 @@
         "systems": "systems_7"
       },
       "locked": {
-        "lastModified": 1787302424,
+        "lastModified": 1787474509,
-        "narHash": "sha256-fg9pKzO6OeQhe/bY2CpHb6QnHq57P/icwQz35GF/R/8=",
+        "narHash": "sha256-jL5RS/TbKk7HxjsGyFWeceHveyRgM8btvfY9Z77P9jM=",
         "owner": "astro",
         "repo": "nix-openwrt-imagebuilder",
-        "rev": "276c1dd6346f50231392e97b3a9987c9dd57da28",
+        "rev": "4371439b1e4e582266fc38345d1a01db1f8db6d6",
         "type": "github"
       },
       "original": {
@@ -1044,8 +953,7 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "openwrt-feeds": "openwrt-feeds",
         "openwrt-imagebuilder": "openwrt-imagebuilder",
-        "ragenix": "ragenix",
+        "ragenix": "ragenix"
-        "sharry": "sharry"
       }
     },
     "rust-overlay": {
@@ -1056,11 +964,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761791894,
+        "lastModified": 1787454509,
-        "narHash": "sha256-myRIDh+PxaREz+z9LzbqBJF+SnTFJwkthKDX9zMyddY=",
+        "narHash": "sha256-r4LDUF+zmJnkftvCVkCrUhSJazsf6EVJF+V2l4/MYbI=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "59c45eb69d9222a4362673141e00ff77842cd219",
+        "rev": "f60c1b57ff805a46b5175c76fc981fb4f81efbcc",
         "type": "github"
       },
       "original": {
@@ -1069,48 +977,6 @@
         "type": "github"
       }
     },
-    "sbt": {
-      "inputs": {
-        "flake-utils": "flake-utils_12",
-        "nixpkgs": "nixpkgs_6"
-      },
-      "locked": {
-        "lastModified": 1698464090,
-        "narHash": "sha256-Pnej7WZIPomYWg8f/CZ65sfW85IfIUjYhphMMg7/LT0=",
-        "owner": "zaninime",
-        "repo": "sbt-derivation",
-        "rev": "6762cf2c31de50efd9ff905cbcc87239995a4ef9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zaninime",
-        "repo": "sbt-derivation",
-        "type": "github"
-      }
-    },
-    "sharry": {
-      "inputs": {
-        "devshell-tools": "devshell-tools",
-        "flake-utils": "flake-utils_11",
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
-        "sbt": "sbt"
-      },
-      "locked": {
-        "lastModified": 1741328331,
-        "narHash": "sha256-OtsHm9ykxfAOMRcgFDsqFBBy5Wu0ag7eq1qmTIluVcw=",
-        "owner": "eikek",
-        "repo": "sharry",
-        "rev": "6203b90f9a76357d75c108a27ad00f323d45c1d0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "eikek",
-        "repo": "sharry",
-        "type": "github"
-      }
-    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -1126,36 +992,6 @@
         "type": "github"
       }
     },
-    "systems_10": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_11": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "systems_2": {
       "locked": {
         "lastModified": 1681028828,
@@ -1284,11 +1120,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1786901030,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
         "type": "github"
       },
       "original": {

flake.nix

@@ -35,10 +35,11 @@
     home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";
 
     # Determinate Nix, used as the common Nix implementation across systems, homes, the devshell and
-    # CI (see lib.my.c.nix). We build it ourselves against our pinned nixpkgs (FlakeHub's cache needs
+    # CI (see lib.my.c.nix). We build it ourselves (FlakeHub's cache needs auth), so it flows through
-    # auth), so it flows through our own Harmonia cache like everything else.
+    # our own Harmonia cache like everything else. Keep its tested nixpkgs pin: its packaging carries
+    # compatibility patches that can conflict with newer nixpkgs patches.
     determinate-nix.url = "https://flakehub.com/f/DeterminateSystems/nix-src/*";
-    determinate-nix.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    determinate-nix.inputs.nixpkgs.url = "github:NixOS/nixpkgs/4382ed2b7a6839d4280a9b386db49cbc5907414d";
 
     # Stuff used by the flake for build / deployment
     # ragenix.url = "github:yaxitech/ragenix";
@@ -68,8 +69,6 @@
     openwrt-feeds.inputs.openwrt-imagebuilder.follows = "openwrt-imagebuilder";
 
     # Packages not in nixpkgs
-    sharry.url = "github:eikek/sharry";
-    sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
     borgthin.url = "github:devplayer0/borg";
     # TODO: Update borgthin so this works
     # borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";

home-manager/modules/gui/default.nix

@@ -423,12 +423,12 @@ in
         gtk = {
           enable = true;
           theme = {
-            name = "Numix";
+            name = "Adwaita";
-            package = pkgs.numix-gtk-theme;
+            package = pkgs.gnome-themes-extra;
           };
           gtk4.theme = {
-            name = "Numix";
+            name = "Adwaita";
-            package = pkgs.numix-gtk-theme;
+            package = pkgs.gnome-themes-extra;
           };
           iconTheme = {
             name = "Numix";

lib/constants.nix

@@ -30,7 +30,7 @@ rec {
 
   kernel = {
     lts = pkgs: pkgs.linuxKernel.packages.linux_6_18;
-    latest = pkgs: pkgs.linuxKernel.packages.linux_7_0;
+    latest = pkgs: pkgs.linuxKernel.packages.linux_7_2;
   };
 
   nginx = rec {

lib/default.nix

@@ -253,7 +253,7 @@ rec {
   in
   {
     trivial = prev.trivial // {
-      release = "26.06:u-${prev.trivial.release}";
+      release = "26.08:u-${prev.trivial.release}";
       codeName = "Irritating";
       revisionWithDefault = default: self.rev or default;
       versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";

nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix

@@ -336,15 +336,6 @@ in
         useACMEHost = pubDomain;
       };
 
-      "share.${pubDomain}" = {
-        locations."/" = {
-          proxyPass = "http://object-ctr.${domain}:9090";
-          proxyWebsockets = true;
-          extraConfig = proxyHeaders;
-        };
-        useACMEHost = pubDomain;
-      };
-
       "stuff.${pubDomain}" = {
         locations."/" = {
           proxyPass = "http://jackflix-ctr.${domain}:3923";

nixos/boxes/colony/vms/shill/containers/object.nix

@@ -47,10 +47,6 @@ in
               key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8";
               files = {
                 "object/minio.env" = {};
-                "object/sharry.conf" = {
-                  owner = "sharry";
-                  group = "sharry";
-                };
                 "object/minio-client-config.json" = {
                   owner = config.my.user.config.name;
                   group = config.my.user.config.group;
@@ -65,7 +61,6 @@ in
             firewall = {
               tcp.allowed = [
                 9000 9001
-                config.services.sharry.config.bind.port
                 8069
                 5000
                 config.services.hedgedoc.settings.port
@@ -122,8 +117,6 @@ in
                 };
               };
 
-              sharry = awaitPostgres;
-
               atticd = mkMerge [
                 awaitPostgres
                 {
@@ -175,66 +168,6 @@ in
               dataDir = [ "/mnt/minio" ];
             };
 
-            sharry = {
-              enable = true;
-              configOverridesFile = config.age.secrets."object/sharry.conf".path;
-
-              config = {
-                base-url = "https://share.${lib.my.c.pubDomain}";
-                bind.address = "::";
-                alias-member-enabled = true;
-                webapp = {
-                  chunk-size = "64M";
-                };
-                backend = {
-                  auth = {
-                    fixed = {
-                      enabled = true;
-                      user = "dev";
-                    };
-                    internal = {
-                      enabled = true;
-                      order = 50;
-                    };
-                  };
-                  jdbc = {
-                    url = "jdbc:postgresql://colony-psql:5432/sharry";
-                    user = "sharry";
-                  };
-                  files = {
-                    default-store = "minio";
-                    stores = {
-                      database.enabled = false;
-                      minio = {
-                        enabled = true;
-                        type = "s3";
-                        endpoint = "https://s3.nul.ie";
-                        access-key = "share";
-                        bucket = "share";
-                      };
-                    };
-                  };
-                  compute-checksum.parallel = 4;
-                  signup.mode = "invite";
-                  share = {
-                    max-size = "128G";
-                    max-validity = "3650 days";
-                  };
-                  mail = {
-                    enabled = true;
-                    smtp = {
-                      host = "mail.nul.ie";
-                      port = 587;
-                      user = "sharry@nul.ie";
-                      ssl-type = "starttls";
-                      default-from = "Sharry <sharry@nul.ie>";
-                      timeout = "30 seconds";
-                    };
-                  };
-                };
-              };
-            };
-
             atticd = {
               enable = false;
               environmentFile = config.age.secrets."object/atticd.env".path;
@@ -308,7 +241,6 @@ in
             forwardPorts = [
               { from = "host"; host.port = 9000; guest.port = 9000; }
               { from = "host"; host.port = 9001; guest.port = 9001; }
-              { from = "host"; guest.port = config.services.sharry.config.bind.port; }
             ];
           };
         })

nixos/boxes/colony/vms/whale2/valheim.nix

@@ -2,21 +2,24 @@
 let
   inherit (lib) concatStringsSep;
   inherit (lib.my) dockerNetAssignment;
+
+  admin = "76561198049818986"; # /dev/player0
 in
 {
   config = {
     virtualisation.oci-containers.containers = {
       valheim = {
-        image = "ghcr.io/lloesche/valheim-server@sha256:d977ccbeff02d2509646fb0157b5e353ebadb3105a3ed351b9c309a09a61701b";
+        image = "ghcr.io/community-valheim-tools/valheim-server@sha256:f3ccde9a4e292663cf5096d502ff33cc9617015f6d70b6a9ca0968543f165ef2";
 
         environment = {
           BACKUPS_IF_IDLE = "false";
           SERVER_NAME = "amogus sus";
           SERVER_PUBLIC = "true";
-          WORLD_NAME = "simpland2";
+          # Previous world: simpland2
-          ADMINLIST_IDS = "76561198049818986";
+          WORLD_NAME = "simpland3";
+          ADMINLIST_IDS = admin;
           PERMITTEDLIST_IDS = concatStringsSep " " [
-            "76561198049818986" # /dev/player0
+            admin
             "76561198044432445" # Nuda
             "76561198121606266" # El Pugador
             "76561198059894566" # hynge
@@ -27,7 +30,7 @@ in
 
         volumes = [
           "valheim_data:/config"
-          "valhem_server:/opt/valheim"
+          "valheim_server:/opt/valheim"
         ];
 
         extraOptions = [

nixos/boxes/home/palace/vms/sfh/containers/hass.nix

@@ -47,8 +47,9 @@ in
       inherit (lib) mkMerge mkIf mkForce;
       inherit (lib.my) networkdAssignment;
 
+      hassPort = 8123;
       hassCli = pkgs.writeShellScriptBin "hass-cli" ''
-        export HASS_SERVER="http://localhost:${toString config.services.home-assistant.config.http.server_port}"
+        export HASS_SERVER="http://localhost:${toString hassPort}"
         export HASS_TOKEN="$(< ${config.age.secrets."hass/cli-token.txt".path})"
         exec ${pkgs.home-assistant-cli}/bin/hass-cli "$@"
       '';
@@ -69,7 +70,7 @@ in
           };
 
           firewall = {
-            tcp.allowed = [ "http" 1883 ];
+            tcp.allowed = [ "http" hassPort 1883 ];
           };
         };
 
@@ -164,29 +165,7 @@ in
             };
           };
 
-          home-assistant =
+          home-assistant = {
-          let
-            cfg = config.services.home-assistant;
-
-            pyirishrail = ps: ps.buildPythonPackage rec {
-              pname = "pyirishrail";
-              version = "0.0.2";
-              src = pkgs.fetchFromGitHub {
-                owner = "ttroy50";
-                repo = "pyirishrail";
-                tag = version;
-                hash = "sha256-NgARqhcXP0lgGpgBRiNtQaSn9JcRNtCcZPljcL7t3Xc=";
-              };
-
-              dependencies = with ps; [
-                requests
-              ];
-
-              pyproject = true;
-              build-system = [ ps.setuptools ];
-            };
-          in
-          {
             enable = true;
 
             extraComponents = [
@@ -208,7 +187,6 @@ in
               isal
 
               gtts
-              (pyirishrail python3Packages)
             ];
             customComponents = with pkgs.home-assistant-custom-components; [
               alarmo
@@ -217,7 +195,6 @@ in
             ];
 
             configWritable = false;
-            openFirewall = true;
             config = {
               default_config = {};
               homeassistant = {
@@ -227,9 +204,10 @@ in
                 country = "IE";
                 time_zone = "Europe/Dublin";
                 external_url = "https://hass.${pubDomain}";
-                internal_url = "http://hass-ctr.${domain}:${toString cfg.config.http.server_port}";
+                internal_url = "http://hass-ctr.${domain}:${toString hassPort}";
               };
               http = {
+                server_port = hassPort;
                 use_x_forwarded_for = true;
                 trusted_proxies = with allAssignments.middleman.internal; [
                   ipv4.address

nixos/default.nix

@@ -191,7 +191,7 @@ let
       # Routes the custom modules into `baseModules` so the NixOS manual documents them. The old
       # infinite-recursion is gone, but enabling this makes every system build regenerate the
       # manual, and it documents everything the modules transitively import — including third-party
-      # modules that aren't doc-clean (e.g. `services.sharry`). Prefer the generated
+      # modules that aren't doc-clean. Prefer the generated
       # `nixos.optionsDoc` reference (`docs/reference/nixos-options.md`) instead.
       docCustom = mkBoolOpt' false "Whether to document nixfiles' custom NixOS modules.";
 

nixos/modules/common.nix

@@ -11,7 +11,6 @@ in
   imports = [
     inputs.impermanence.nixosModules.default
     inputs.ragenix.nixosModules.age
-    inputs.sharry.nixosModules.default
     inputs.copyparty.nixosModules.default
     inputs.harmonia.nixosModules.harmonia
   ];
@@ -77,7 +76,6 @@ in
       nixpkgs = {
         overlays = [
           inputs.deploy-rs.overlays.default
-          inputs.sharry.overlays.default
           # TODO: Re-enable when borgthin is updated
           # inputs.borgthin.overlays.default
           inputs.boardie.overlays.default
@@ -169,7 +167,7 @@ in
 
       services = {
         # TODO: Remove if-else when 26.11 releases
-        kmscon = if (config.system.nixos.release == "26.06:u-26.11") then {
+        kmscon = if (config.system.nixos.release == "26.08:u-26.11") then {
           enable = mkDefault false;
           config = {
             hwaccel = config.hardware.graphics.enable;

pkgs/firefox-memory-control/autoconfig.js

@@ -36,9 +36,9 @@
   // procfs files report a size of zero, so IOUtils reads /proc/meminfo as empty.
   // nsIScriptableInputStream also rejects reads larger than that reported size;
   // nsIConverterInputStream reads until EOF without relying on it.
-  function availableMemory() {
+  function readProcFile(path) {
     const file = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsIFile);
-    file.initWithPath("/proc/meminfo");
+    file.initWithPath(path);
     const fileStream = Cc["@mozilla.org/network/file-input-stream;1"].createInstance(
       Ci.nsIFileInputStream
     );
@@ -48,17 +48,38 @@
     );
     input.init(fileStream, "UTF-8", 0, 0);
     const chunk = {};
-    let meminfo = "";
+    let contents = "";
     while (input.readString(4096, chunk)) {
-      meminfo += chunk.value;
+      contents += chunk.value;
     }
     input.close();
+    return contents;
+  }
 
-    const match = /^MemAvailable:\s+(\d+)\s+kB$/m.exec(meminfo);
+  function memoryInfo() {
+    const meminfo = readProcFile("/proc/meminfo");
+
+    const readKiB = name => {
+      const match = new RegExp(`^${name}:\\s+(\\d+)\\s+kB$`, "m").exec(meminfo);
       if (!match) {
-      throw new Error("MemAvailable is absent from /proc/meminfo");
+        throw new Error(`${name} is absent from /proc/meminfo`);
       }
       return Number(match[1]) * 1024;
+    };
+
+    return {
+      available: readKiB("MemAvailable"),
+    };
+  }
+
+  const availableMemory = () => memoryInfo().available;
+
+  function swapOutPages() {
+    const match = /^pswpout\s+(\d+)$/m.exec(readProcFile("/proc/vmstat"));
+    if (!match) {
+      throw new Error("pswpout is absent from /proc/vmstat");
+    }
+    return Number(match[1]);
   }
 
   async function unloadOne(minInactiveMs) {
@@ -184,6 +205,7 @@
     underPressure: false,
     timer: null,
     paths: null,
+    previousSwapOutPages: null,
 
     async tick() {
       if (this.busy) {
@@ -203,19 +225,32 @@
           return;
         }
 
-        const available = await availableMemory();
+        const { available } = memoryInfo();
+        const currentSwapOutPages = swapOutPages();
+        // Swap usage persists after pressure passes, so react to new swap-outs instead.
+        const swappedOutPages =
+          this.previousSwapOutPages === null
+            ? 0
+            : Math.max(0, currentSwapOutPages - this.previousSwapOutPages);
+        this.previousSwapOutPages = currentSwapOutPages;
         const low = prefInt("lowAvailableMiB") * MiB;
         const high = prefInt("highAvailableMiB") * MiB;
         if (high <= low) {
           throw new Error("highAvailableMiB must be greater than lowAvailableMiB");
         }
 
-        if (!this.underPressure && available <= low) {
+        if (!this.underPressure && (available <= low || swappedOutPages > 0)) {
           this.underPressure = true;
-          log(`memory pressure entered at ${Math.round(available / MiB)} MiB available`);
+          log(
-        } else if (this.underPressure && available >= high) {
+            `memory pressure entered at ${Math.round(available / MiB)} MiB available, ` +
+              `${swappedOutPages} pages swapped out since the previous poll`
+          );
+        } else if (this.underPressure && available >= high && swappedOutPages === 0) {
           this.underPressure = false;
-          log(`memory pressure cleared at ${Math.round(available / MiB)} MiB available`);
+          log(
+            `memory pressure cleared at ${Math.round(available / MiB)} MiB available, ` +
+              "no pages swapped out since the previous poll"
+          );
         }
 
         if (this.underPressure) {

secrets/object/sharry.conf.age

@@ -1,18 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBCeHA4
-Y0hkSGZSNkMxNTY0SUVEQ3FXK0V5QUdVK2hXUFloVW1hVERHK2xFCm4xd1JJWXpH
-a1J2QTVvUyt4OXdzWWtMMEo4NFZ3ZkY0YXdydXpOVCtya1UKLT4gWDI1NTE5IHhI
-TW5FTHdpYjNwclVsajBUS3ZRSXpER0pKaEFiWFU3Q3cyT0RZT1VnQXcKZFNOODJu
-d3RiS0p0b3JmRlZ5M0JCRDB0MzNoUkRWamdkNXZQUzB1RHZoQQotPiAvR15OXkZR
-eS1ncmVhc2UKVjhxR0dVVHNWWHdxVFkyd1lPMnN5NXp6Ky9MOHlpNnpIeEExVUhO
-dEtXNG9DRFY2OWNlWnFIb1c3MjNLS2V6ZAppTEo3RmZHbzRPQVA3b2xkdmZZCi0t
-LSA4RmE0OVlPbUhqWDdwVHNvS0JRcm9XQXl6SFVEYXRnWS81SzNxV1NBWjY4CoYX
-xS977tMXj6AbcEZvzRgJfLFoFVRGajoa+QwQyLfkZ6wkI/BQQbgSDOR2s6JEB5Fy
-RIoJAB7iZoApj+Ctc4W23qif8gdMedp576VRaDSIo8CC+R6FQlf9s+1MHay8Z+ge
-TjWV3xO/70eVYjPc2u/NvejZruBQc52X/yWxnZOrOl2QRDe3dzn9PHiawXdun1bl
-qZlhaMaR449BPl3eadTrm4l6IybRSRqIgTWgkEOCUqdrVuBtb1HbqTf2FB9/rD41
-BblBV0q/UGx9kUxetgPiu8Wa1hjepSeSglJ9SeKAlH0PC3q+F9tYirphrxFrLGiK
-e7aV4Ukpqi0T5vpCkkwm7wF3uTZnmPDz7cWvYbIw1T12N3pV/pxrjigTpqB91svC
-jlMQCCtdyEojfUb+tlLlNjvkAbvwZHrc8nBCyuvTuzc2vaUnf6VTaJxGG97tUIyY
-brkp5b+mDaU=
------END AGE ENCRYPTED FILE-----