Add netboot archive (including to installer workflow)

.envrc

@@ -1,2 +1,2 @@
-watch_file devshell/{default,commands,install,vm-tasks}.nix
+nix_direnv_watch_file devshell/{default,commands,install,vm-tasks}.nix
 use flake

.gitea/workflows/installer.yaml

@@ -1,4 +1,4 @@
-name: Installer
+name: Installer ISO
 
 on:
   push:
@@ -6,7 +6,7 @@ on:
 
 jobs:
   installer:
-    name: Build installer
+    name: Build installer ISO
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -32,19 +32,19 @@ jobs:
 
       - name: Build installer ISO
         run: |
-          nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.iso
+          nix build .#nixosConfigurations.installer.config.my.buildAs.iso
-          ln -s "$(readlink result)"/iso/jackos-installer.iso \
+          ln -s "$(readlink result)"/iso/nixos-installer-devplayer0.iso \
-            jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
+            nixos-installer-devplayer0-${{ steps.setup.outputs.short_rev }}.iso
       - name: Build installer netboot archive
-        run: |
+        run:
-          nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.netbootArchive
+          nix build .#nixosConfigurations.installer.config.my.buildAs.netbootArchive
           ln -s "$(readlink result)" \
-            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar
+            nixos-installer-devplayer0-netboot-${{ steps.setup.outputs.short_rev }}.tar
 
       - name: Create release
         uses: https://gitea.com/actions/release-action@main
         with:
           title: Latest installer
           files: |
-            jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
+            nixos-installer-devplayer0-${{ steps.setup.outputs.short_rev }}.iso
-            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar
+            nixos-installer-devplayer0-netboot-${{ steps.setup.outputs.short_rev }}.tar

flake.lock

@@ -35,11 +35,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1702969472,
+        "lastModified": 1698258239,
-        "narHash": "sha256-IJP9sC+/gLUdWhm6TsnWpw6A1zQWUfn53ym63KeLXvU=",
+        "narHash": "sha256-qnhoYYIJ0L/P7H/f56lQUEvpzNlXh4sxuHpRERV+B44=",
         "owner": "zhaofengli",
         "repo": "attic",
-        "rev": "bdafd64910bb2b861cf90fa15f1fc93318b6fbf6",
+        "rev": "e9918bc6be268da6fa97af6ced15193d8a0421c0",
         "type": "github"
       },
       "original": {
@@ -95,17 +95,26 @@
     },
     "crane": {
       "inputs": {
+        "flake-compat": [
+          "attic",
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "attic",
+          "flake-utils"
+        ],
         "nixpkgs": [
           "attic",
           "nixpkgs"
-        ]
+        ],
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1702918879,
+        "lastModified": 1677892403,
-        "narHash": "sha256-tWJqzajIvYcaRWxn+cLUB9L9Pv4dQ3Bfit/YjU5ze3g=",
+        "narHash": "sha256-/Wi0L1spSWLFj+UQxN3j0mPYMoc7ZoAujpUF/juFVII=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "7195c00c272fdd92fc74e7d5a0a2844b9fadb2fb",
+        "rev": "105e27adb70a9890986b6d543a67761cbc1964a2",
         "type": "github"
       },
       "original": {
@@ -176,11 +185,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1703087360,
+        "lastModified": 1698921442,
-        "narHash": "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=",
+        "narHash": "sha256-7KmvhQ7FuXlT/wG4zjTssap6maVqeAMBdtel+VjClSM=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "b709d63debafce9f5645a5ba550c9e0983b3d1f7",
+        "rev": "660180bbbeae7d60dad5a92b30858306945fd427",
         "type": "github"
       },
       "original": {
@@ -232,14 +241,14 @@
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
-        "systems": "systems_4"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1701787589,
+        "lastModified": 1698410321,
-        "narHash": "sha256-ce+oQR4Zq9VOsLoh9bZT8Ip9PaMLcjjBUHVPzW5d7Cw=",
+        "narHash": "sha256-MphuSlgpmKwtJncGMohryHiK55J1n6WzVQ/OAfmfoMc=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "44ddedcbcfc2d52a76b64fb6122f209881bd3e1e",
+        "rev": "1aed986e3c81a4f6698e85a7452cbfcc4b31a36e",
         "type": "github"
       },
       "original": {
@@ -267,11 +276,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1668681692,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
         "type": "github"
       },
       "original": {
@@ -409,14 +418,14 @@
     },
     "flake-utils_7": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1701680307,
+        "lastModified": 1694529238,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
         "type": "github"
       },
       "original": {
@@ -442,7 +451,7 @@
     },
     "flake-utils_9": {
       "inputs": {
-        "systems": "systems_6"
+        "systems": "systems_5"
       },
       "locked": {
         "lastModified": 1681202837,
@@ -465,11 +474,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703367386,
+        "lastModified": 1700814205,
-        "narHash": "sha256-FMbm48UGrBfOWGt8+opuS+uLBLQlRfhiYXhHNcYMS5k=",
+        "narHash": "sha256-lWqDPKHRbQfi+zNIivf031BUeyciVOtwCwTjyrhDB5g=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d5824a76bc6bb93d1dce9ebbbcb09a9b6abcc224",
+        "rev": "aeb2232d7a32530d3448318790534d196bf9427a",
         "type": "github"
       },
       "original": {
@@ -485,11 +494,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703754036,
+        "lastModified": 1701433070,
-        "narHash": "sha256-JpJdcj9Tg4lMuYikXDpajA8wOp+rHyn9RD2rKBEM4cQ=",
+        "narHash": "sha256-Gf9JStfENaUQ7YWFz3V7x/srIwr4nlnVteqaAxtwpgM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c24c298562fe41b39909f632c5a7151bbf6b4628",
+        "rev": "4a8545f5e737a6338814a4676dc8e18c7f43fc57",
         "type": "github"
       },
       "original": {
@@ -499,11 +508,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1703656108,
+        "lastModified": 1697303681,
-        "narHash": "sha256-hCSUqdFJKHHbER8Cenf5JRzjMlBjIdwdftGQsO0xoJs=",
+        "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "033643a45a4a920660ef91caa391fbffb14da466",
+        "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
         "type": "github"
       },
       "original": {
@@ -522,13 +531,13 @@
       "locked": {
         "lastModified": 1685908677,
         "narHash": "sha256-E4zUPEUFyVWjVm45zICaHRpfGepfkE9Z2OECV9HXfA4=",
-        "owner": "nix-community",
+        "owner": "guibou",
         "repo": "nixGL",
         "rev": "489d6b095ab9d289fe11af0219a9ff00fe87c7c5",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "guibou",
         "repo": "nixGL",
         "type": "github"
       }
@@ -551,11 +560,11 @@
     },
     "nixpkgs-mine": {
       "locked": {
-        "lastModified": 1703756459,
+        "lastModified": 1701607327,
-        "narHash": "sha256-ztEMyPQZh3Pb+LOoWl5lbIK2LenP59sOUBC86CDmLio=",
+        "narHash": "sha256-pHX6S1mrUSFVq6v0HiZuShfXLL01wiWvgivCabX2x+M=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "e80160eb2ac3a7111d07cc43a15c16b9edca01ea",
+        "rev": "c8af66cb9046a65cbab33563f804b7bad46173af",
         "type": "github"
       },
       "original": {
@@ -567,11 +576,11 @@
     },
     "nixpkgs-mine-stable": {
       "locked": {
-        "lastModified": 1703756491,
+        "lastModified": 1701607437,
-        "narHash": "sha256-9VL34e0gzomwqRnryRn23V2ImYcaZIQdp7CsWg5TmlE=",
+        "narHash": "sha256-ozMDOyJtxr/CznI6lrwtt9JkU32Y2cLr2B4vlW85Tfw=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "36611f5f7cfd401f51ad4ca76fd6ee85a714bb74",
+        "rev": "67ef05e2dd98d1fd856028eba1bb4edb847f6c6e",
         "type": "github"
       },
       "original": {
@@ -583,11 +592,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1703467016,
+        "lastModified": 1701389149,
-        "narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
+        "narHash": "sha256-rU1suTIEd5DGCaAXKW6yHoCfR1mnYjOXQFOaH7M23js=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
+        "rev": "5de0b32be6e85dc1a9404c75131316e4ffbc634c",
         "type": "github"
       },
       "original": {
@@ -598,11 +607,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1703438236,
+        "lastModified": 1701253981,
-        "narHash": "sha256-aqVBq1u09yFhL7bj1/xyUeJjzr92fXVvQSSEx6AdB1M=",
+        "narHash": "sha256-ztaDIyZ7HrTAfEEUt9AtTDNoCYxUdSd6NrRHaYOIxtk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5f64a12a728902226210bf01d25ec6cbb9d9265b",
+        "rev": "e92039b55bcd58469325ded85d4f58dd5a4eaf58",
         "type": "github"
       },
       "original": {
@@ -669,7 +678,7 @@
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
         "lastModified": 1682237245,
@@ -706,6 +715,33 @@
       }
     },
     "rust-overlay": {
+      "inputs": {
+        "flake-utils": [
+          "attic",
+          "crane",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "attic",
+          "crane",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1675391458,
+        "narHash": "sha256-ukDKZw922BnK5ohL9LhwtaDAdCsJL7L6ScNEyF1lO9w=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "383a4acfd11d778d5c2efcf28376cbd845eeaedf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
       "inputs": {
         "flake-utils": [
           "ragenix",
@@ -826,31 +862,13 @@
         "type": "github"
       }
     },
-    "systems_6": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "utils": {
-      "inputs": {
-        "systems": "systems_3"
-      },
       "locked": {
-        "lastModified": 1701680307,
+        "lastModified": 1667395993,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -26,7 +26,7 @@
     impermanence.url = "github:nix-community/impermanence";
     boardie.url = "github:devplayer0/boardie";
     boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    nixGL.url = "github:nix-community/nixGL";
+    nixGL.url = "github:guibou/nixGL";
     nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
     # Packages not in nixpkgs
@@ -63,7 +63,7 @@
         flake = flake-utils.lib;
       };
       pkgsLibOverlay = final: prev: { lib = prev.lib.extend libOverlay; };
-      myPkgsOverlay = final: prev: import ./pkgs { lib = final.lib; pkgs = prev; };
+      myPkgsOverlay = final: prev: import ./pkgs { lib = prev.lib; pkgs = prev; };
 
       # Override the flake-level lib since we're going to use it for non-config specific stuff
       pkgsFlakes = mapAttrs (_: pkgsFlake: pkgsFlake // { lib = pkgsFlake.lib.extend libOverlay; }) {
@@ -118,7 +118,6 @@
         nixos/boxes/castle
         nixos/boxes/home/stream.nix
         nixos/boxes/home/palace
-        nixos/boxes/britway
         nixos/boxes/kelder
 
         # Homes
@@ -129,7 +128,7 @@
         modules = [
           {
             _module.args = {
-              inherit lib pkgsFlakes hmFlakes self inputs;
+              inherit lib pkgsFlakes hmFlakes inputs;
               pkgs' = configPkgs';
             };
 

home-manager/modules/common.nix

@@ -80,7 +80,6 @@ in
 
         tmux = {
           enable = true;
-          keyMode = "vi";
         };
 
         bash = {

lib/constants.nix

@@ -26,7 +26,7 @@ rec {
     latest = pkgs: pkgs.linuxKernel.packages.linux_6_6;
   };
 
-  nginx = rec {
+  nginx = {
     proxyHeaders = ''
       # Setting any proxy_header in a child (e.g. location) will nuke the parents...
       proxy_set_header X-Origin-URI $request_uri;
@@ -40,45 +40,6 @@ rec {
       proxy_set_header X-Forwarded-Protocol $scheme;
       proxy_set_header X-Scheme $scheme;
     '';
-    baseHttpConfig = ''
-      # NixOS provides a logrotate config that auto-compresses :)
-      log_format main
-        '$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
-      access_log /var/log/nginx/access.log main;
-
-      # optimisation
-      sendfile on;
-      tcp_nopush on;
-      tcp_nodelay on;
-      keepalive_timeout 65;
-
-      # gzip
-      gzip on;
-      gzip_proxied any;
-      gzip_comp_level 5;
-      gzip_types
-        application/atom+xml
-        application/javascript
-        application/json
-        application/xml
-        application/xml+rss
-        image/svg+xml
-        text/css
-        text/javascript
-        text/plain
-        text/xml;
-      gzip_vary on;
-
-      # proxying
-      proxy_buffering off;
-      proxy_redirect off;
-      proxy_connect_timeout 60s;
-      proxy_read_timeout 60s;
-      proxy_send_timeout 60s;
-      proxy_http_version 1.1;
-
-      ${proxyHeaders}
-    '';
   };
 
   networkd = {
@@ -169,18 +130,6 @@ rec {
         port = 8448;
         dst = aa.middleman.internal.ipv4.address;
       }
-      {
-        port = 25565;
-        dst = aa.simpcraft-oci.internal.ipv4.address;
-      }
-      {
-        port = 25566;
-        dst = aa.simpcraft-staging-oci.internal.ipv4.address;
-      }
-      {
-        port = 25575;
-        dst = aa.simpcraft-oci.internal.ipv4.address;
-      }
 
       {
         port = 2456;
@@ -192,18 +141,6 @@ rec {
         dst = aa.valheim-oci.internal.ipv4.address;
         proto = "udp";
       }
-
-      {
-        port = 41641;
-        dst = aa.waffletail.internal.ipv4.address;
-        proto = "udp";
-      }
-
-      {
-        port = 25565;
-        dst = aa.simpcraft-oci.internal.ipv4.address;
-        proto = "udp";
-      }
     ];
 
     fstrimConfig = {
@@ -227,7 +164,7 @@ rec {
       "stream"
     ];
     routersPubV4 = [
-      "109.255.1.246"
+      "109.255.31.25"
       "109.255.252.63"
     ];
 
@@ -279,47 +216,6 @@ rec {
     };
   };
 
-  britway = {
-    domain = "lon1.int.${pubDomain}";
-    pubV4 = "45.76.141.188";
-    prefixes = {
-      vultr = {
-        v6 = "2001:19f0:7402:128b::/64";
-      };
-      inherit (colony.prefixes) as211024;
-    };
-    # Need to use this IP as the source address for BGP
-    assignedV6 = "2001:19f0:7402:128b:5400:04ff:feac:6e06";
-  };
-
-  tailscale = {
-    prefix = {
-      v4 = "100.64.0.0/10";
-      v6 = "fd7a:115c:a1e0::/48";
-    };
-  };
-
-  as211024 = rec {
-    trusted = {
-      v4 = [
-        colony.prefixes.as211024.v4
-        colony.prefixes.all.v4
-        home.prefixes.all.v4
-        tailscale.prefix.v4
-      ];
-      v6 = [
-        colony.prefixes.as211024.v6
-        colony.prefixes.all.v6
-        home.prefixes.all.v6
-        tailscale.prefix.v6
-      ];
-    };
-    nftTrust = ''
-      iifname as211024 ip saddr { ${concatStringsSep ", " trusted.v4} } accept
-      iifname as211024 ip6 saddr { ${concatStringsSep ", " trusted.v6} } accept
-    '';
-  };
-
   kelder = {
     groups = {
       storage = 2000;

lib/default.nix

@@ -1,11 +1,10 @@
 { lib }:
 let
-  inherit (builtins) length match elemAt filter replaceStrings substring;
+  inherit (builtins) length match elemAt filter replaceStrings;
   inherit (lib)
     genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
     mkOption mkOverride mkForce mkIf mergeEqualOption optional
-    showWarnings concatStringsSep flatten unique optionalAttrs
+    showWarnings concatStringsSep flatten unique optionalAttrs;
-    mkBefore;
   inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -167,7 +166,7 @@ rec {
 
   systemdAwaitPostgres = pkg: host: {
     after = [ "systemd-networkd-wait-online.service" ];
-    preStart = mkBefore ''
+    preStart = ''
       until ${pkg}/bin/pg_isready -h ${host}; do
         sleep 0.5
       done
@@ -240,18 +239,4 @@ rec {
 
     filterOpts = filterAttrsRecursive (_: v: v != null);
   };
-
-  versionOverlay = { self, pkgsFlake }: final: prev:
-  let
-    date = substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101");
-    revCode = flake: flake.shortRev or "dirty";
-  in
-  {
-    trivial = prev.trivial // {
-      release = "23.12:u-${prev.trivial.release}";
-      codeName = "Amogus";
-      revisionWithDefault = default: self.rev or default;
-      versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
-    };
-  };
 }

nixos/boxes/britway/bgp.nix

@@ -1,197 +0,0 @@
-{ lib, pkgs, config, assignments, ... }:
-let
-  inherit (lib.my.c.britway) assignedV6;
-
-  securebitSpace = "2a0e:97c0:4d0::/44";
-  intnet6 = "2a0e:97c0:4df::/48";
-  amsnet6 = "2a0e:97c0:4d2::/48";
-  homenet6 = "2a0e:97c0:4d0::/48";
-in
-{
-  config = {
-    my = {
-      secrets.files."britway/bgp-password-vultr.conf" = {
-        owner = "bird2";
-        group = "bird2";
-      };
-    };
-
-    environment.etc."bird/vultr-password.conf".source = config.age.secrets."britway/bgp-password-vultr.conf".path;
-
-    systemd = {
-      services.bird2.after = [ "systemd-networkd-wait-online@veth0.service" ];
-      network = {
-        config.networkConfig.ManageForeignRoutes = false;
-      };
-    };
-
-    services = {
-      bird2 = {
-        enable = true;
-        preCheckConfig = ''
-          echo '"dummy"' > vultr-password.conf
-        '';
-        # TODO: Clean up and modularise
-        config = ''
-          define OWNAS = 211024;
-
-          define OWNIP4 = ${assignments.vultr.ipv4.address};
-          define OWNNETSET4 = [ ${assignments.vultr.ipv4.address}/32 ];
-
-          define INTNET6 = ${intnet6};
-          define AMSNET6 = ${amsnet6};
-          define HOMENET6 = ${homenet6};
-
-          define OWNIP6 = ${assignments.vultr.ipv6.address};
-          define OWNNETSET6 = [ ${intnet6}, ${amsnet6}, ${homenet6} ];
-          #define TRANSSET6 = [ ::1/128 ];
-
-          define DUB1IP6 = ${lib.my.c.home.vips.as211024.v6};
-
-          define PREFIXP = 110;
-          define PREFPEER = 120;
-
-          filter bgp_import {
-            if net !~ OWNNETSET4 && net !~ OWNNETSET6 then accept; else reject;
-          }
-          filter bgp_export {
-            if net ~ OWNNETSET4 || net ~ OWNNETSET6 then accept; else reject;
-          }
-
-          router id from "veth0";
-
-          protocol device {}
-          protocol direct {
-            interface "veth0";
-            ipv4;
-            ipv6;
-          }
-          protocol static static4 {
-            ipv4 {
-              import all;
-              export none;
-            };
-          }
-          protocol static static6 {
-            # Special case: We have to do the routing on behalf of this _internal_ next-hop
-            route INTNET6 via "as211024";
-            route HOMENET6 via DUB1IP6;
-
-            ipv6 {
-              import all;
-              export none;
-            };
-          }
-
-          protocol kernel kernel4 {
-            ipv4 {
-              import none;
-              export none;
-            };
-          }
-          protocol kernel kernel6 {
-            ipv6 {
-              import none;
-              export filter {
-                if net = HOMENET6 then accept;
-                reject;
-              };
-            };
-          }
-
-          protocol bgp bgptools {
-            local as OWNAS;
-            multihop;
-            description "bgp.tools monitoring";
-            neighbor 2a0c:2f07:9459::b11 as 212232;
-            source address OWNIP6;
-            ipv4 {
-              import none;
-              export all;
-              add paths tx;
-            };
-            ipv6 {
-              import none;
-              export all;
-              add paths tx;
-            };
-          }
-
-          template bgp base_bgp4 {
-            local as OWNAS;
-            direct;
-            allow local as;
-            ipv4 {
-              import keep filtered;
-              export none;
-            };
-          }
-
-          template bgp upstream_bgp4 from base_bgp4 {
-            ipv4 {
-              #import none;
-              import filter bgp_import;
-            };
-          }
-          template bgp peer_bgp4 from base_bgp4 {
-            ipv4 {
-              import filter bgp_import;
-              preference PREFPEER;
-            };
-          }
-          template bgp ixp_bgp4 from base_bgp4 {
-            ipv4 {
-              import filter bgp_import;
-              preference PREFIXP;
-            };
-          }
-
-          template bgp base_bgp6 {
-            local ${assignedV6} as OWNAS;
-            direct;
-            # So we can see routes we announce from other routers
-            allow local as;
-            ipv6 {
-              import keep filtered;
-              export filter bgp_export;
-            };
-          }
-
-          template bgp upstream_bgp6 from base_bgp6 {
-            ipv6 {
-              #import none;
-              import filter bgp_import;
-            };
-          }
-          template bgp peer_bgp6 from base_bgp6 {
-            ipv6 {
-              import filter bgp_import;
-              preference PREFPEER;
-            };
-          }
-          template bgp ixp_bgp6 from base_bgp6 {
-            ipv6 {
-              import filter bgp_import;
-              preference PREFIXP;
-            };
-          }
-
-          protocol bgp upstream4_vultr from upstream_bgp4 {
-            description "Vultr transit (IPv4)";
-            neighbor 169.254.169.254 as 64515;
-            multihop 2;
-            password
-            include "vultr-password.conf";;
-          }
-          protocol bgp upstream6_vultr from upstream_bgp6 {
-            description "Vultr transit (IPv6)";
-            neighbor 2001:19f0:ffff::1 as 64515;
-            multihop 2;
-            password
-            include "vultr-password.conf";;
-          }
-        '';
-      };
-    };
-  };
-}

nixos/boxes/britway/default.nix

@@ -1,174 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.britway) prefixes domain pubV4 assignedV6;
-in
-{
-  nixos.systems.britway = {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-
-    assignments = {
-      vultr = {
-        inherit domain;
-        ipv4 = {
-          address = pubV4;
-          mask = 23;
-          gateway = "45.76.140.1";
-        };
-        ipv6 = {
-          iid = "::1";
-          address = "2001:19f0:7402:128b::1";
-        };
-      };
-      as211024 = {
-        ipv4 = {
-          address = net.cidr.host 5 prefixes.as211024.v4;
-          gateway = null;
-        };
-        ipv6.address = net.cidr.host ((2*65536*65536*65536) + 1) prefixes.as211024.v6;
-      };
-    };
-
-    configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
-      let
-        inherit (lib) mkMerge mkForce;
-        inherit (lib.my) networkdAssignment;
-      in
-      {
-        imports = [
-          "${modulesPath}/profiles/qemu-guest.nix"
-          ./bgp.nix
-          ./nginx.nix
-          ./tailscale.nix
-        ];
-
-        config = mkMerge [
-          {
-            boot = {
-              initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "sr_mod" ];
-              loader = {
-                systemd-boot.enable = false;
-                grub = {
-                  enable = true;
-                  device = "/dev/vda";
-                };
-              };
-            };
-
-            fileSystems = {
-              "/boot" = {
-                device = "/dev/disk/by-partuuid/c557ef12-da44-41d1-84f5-d32a711feefd";
-                fsType = "ext4";
-              };
-              "/nix" = {
-                device = "/dev/disk/by-partuuid/d42d0853-b054-4104-8afd-6d36287c7ca3";
-                fsType = "ext4";
-              };
-              "/persist" = {
-                device = "/dev/disk/by-partuuid/f14fbcf4-5242-456b-a4db-ef15d053d62e";
-                fsType = "ext4";
-                neededForBoot = true;
-              };
-            };
-
-            services = {
-              iperf3 = {
-                enable = true;
-                openFirewall = true;
-              };
-            };
-
-            networking = { inherit domain; };
-
-            systemd.network = {
-              config = {
-                routeTables.ts-extra = 1337;
-              };
-
-              links = {
-                "10-veth0" = {
-                  matchConfig.PermanentMACAddress = "56:00:04:ac:6e:06";
-                  linkConfig.Name = "veth0";
-                };
-              };
-
-              networks = {
-                "20-veth0" = mkMerge [
-                  (networkdAssignment "veth0" assignments.vultr)
-                  {
-                    address = [ "${assignedV6}/64" ];
-                  }
-                ];
-                "90-l2mesh-as211024" = mkMerge [
-                  (networkdAssignment "as211024" assignments.as211024)
-                  {
-                    matchConfig.Name = "as211024";
-                    networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
-                      {
-                        Destination = lib.my.c.colony.prefixes.all.v4;
-                        Gateway = allAssignments.estuary.as211024.ipv4.address;
-                      }
-                      {
-                        Destination = lib.my.c.home.prefixes.all.v4;
-                        Gateway = lib.my.c.home.vips.as211024.v4;
-                      }
-
-                      {
-                        # Just when routing traffic from Tailscale nodes, otherwise use WAN
-                        Destination = lib.my.c.colony.prefixes.all.v6;
-                        Gateway = allAssignments.estuary.as211024.ipv6.address;
-                        Table = "ts-extra";
-                      }
-                    ];
-                    routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
-                      {
-                        IncomingInterface = "tailscale0";
-                        To = lib.my.c.colony.prefixes.all.v6;
-                        Table = "ts-extra";
-                      }
-                    ];
-                  }
-                ];
-              };
-            };
-
-            my = {
-              server.enable = true;
-              secrets = {
-                key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmXC9egI46Qtaiifhq2I+rv2s1yPyzTlO4BHzUb+3Su";
-                files = {
-                  "l2mesh/as211024.key" = {};
-                };
-              };
-              vpns = {
-                l2.pskFiles = {
-                  as211024 = config.age.secrets."l2mesh/as211024.key".path;
-                };
-              };
-
-              firewall = {
-                trustedInterfaces = [ "tailscale0" ];
-                extraRules = ''
-                  table inet filter {
-                    chain forward {
-                      ${lib.my.c.as211024.nftTrust}
-                      oifname as211024 accept
-                    }
-                  }
-                  table inet nat {
-                    chain postrouting {
-                      iifname tailscale0 oifname veth0 snat ip to ${assignments.vultr.ipv4.address}
-                      iifname tailscale0 oifname veth0 snat ip6 to ${assignments.as211024.ipv6.address}
-                    }
-                  }
-                '';
-              };
-            };
-          }
-        ];
-      };
-  };
-}

nixos/boxes/britway/nginx.nix

@@ -1,109 +0,0 @@
-{ lib, pkgs, config, ... }:
-let
-  inherit (builtins) mapAttrs;
-  inherit (lib) mkMerge mkDefault;
-  inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
-in
-{
-  config = {
-    my = {
-      secrets.files = {
-        "dhparams.pem" = {
-          owner = "acme";
-          group = "acme";
-          mode = "440";
-        };
-        "britway/cloudflare-credentials.conf" = {
-          owner = "acme";
-          group = "acme";
-        };
-      };
-
-      firewall = {
-        tcp.allowed = [ "http" "https" ];
-      };
-    };
-
-    users = {
-      users = {
-        nginx.extraGroups = [ "acme" ];
-      };
-    };
-
-    security.acme = {
-      acceptTerms = true;
-      defaults = {
-        email = "dev@nul.ie";
-        server = "https://acme-v02.api.letsencrypt.org/directory";
-        reloadServices = [ "nginx" ];
-        dnsResolver = "8.8.8.8";
-      };
-      certs = {
-        "${pubDomain}" = {
-          extraDomainNames = [
-            "*.${pubDomain}"
-          ];
-          dnsProvider = "cloudflare";
-          credentialsFile = config.age.secrets."britway/cloudflare-credentials.conf".path;
-        };
-      };
-    };
-
-    services = {
-      nginx = {
-        enable = true;
-        enableReload = true;
-
-        logError = "stderr info";
-        recommendedTlsSettings = true;
-        serverTokens = true;
-        sslDhparam = config.age.secrets."dhparams.pem".path;
-
-        # Based on recommended*Settings, but probably better to be explicit about these
-        appendHttpConfig = ''
-          ${baseHttpConfig}
-
-          # caching
-          proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=512m;
-        '';
-
-        virtualHosts =
-        let
-          hosts = {
-            "_" = {
-              default = true;
-              forceSSL = true;
-              onlySSL = false;
-              locations = {
-                "/".root = "${pkgs.nginx}/html";
-              };
-            };
-
-            "ts.${pubDomain}" = {
-              locations."/" = {
-                proxyPass = "http://localhost:${toString config.services.headscale.port}";
-                proxyWebsockets = true;
-                extraConfig = ''
-                  proxy_buffering off;
-                  add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-                '';
-              };
-            };
-          };
-
-          defaultsFor = mapAttrs (n: _: {
-            onlySSL = mkDefault true;
-            useACMEHost = mkDefault pubDomain;
-            kTLS = mkDefault true;
-            http2 = mkDefault true;
-          });
-        in
-        mkMerge [
-          hosts
-          (defaultsFor hosts)
-        ];
-      };
-    };
-  };
-}

nixos/boxes/britway/tailscale.nix

@@ -1,110 +0,0 @@
-{ lib, pkgs, config, assignments, allAssignments, ... }:
-let
-  inherit (lib) concatStringsSep;
-  inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.britway) prefixes domain;
-
-  # Can't use overrideAttrs because we need to override `vendorHash` within `buildGoModule`
-  headscale = pkgs.headscale.override {
-    buildGoModule = args: pkgs.buildGoModule (args // rec {
-      version = "0.23.0-alpha2";
-      src = pkgs.fetchFromGitHub {
-        owner = "juanfont";
-        repo = "headscale";
-        rev = "v${version}";
-        hash = "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=";
-      };
-      vendorHash = "sha256-u9AmJguQ5dnJpfhOeLN43apvMHuraOrJhvlEIp9RoIc=";
-    });
-  };
-
-  advRoutes = concatStringsSep "," [
-    lib.my.c.home.prefixes.all.v4
-    lib.my.c.home.prefixes.all.v6
-  ];
-  pubNameservers = [
-    "1.1.1.1"
-    "1.0.0.1"
-    "2606:4700:4700::1111"
-    "2606:4700:4700::1001"
-  ];
-in
-{
-  config = {
-    environment.systemPackages = [
-      # For CLI
-      config.services.headscale.package
-    ];
-
-    services = {
-      headscale = {
-        enable = true;
-        package = headscale;
-        settings = {
-          disable_check_updates = true;
-          unix_socket_permission = "0770";
-          server_url = "https://ts.${pubDomain}";
-          db_type = "sqlite3";
-          db_path = "/var/lib/headscale/db.sqlite3";
-          noise.private_key_path = "/var/lib/headscale/noise_private.key";
-          ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ];
-          dns_config = {
-            # Use IPs that will route inside the VPN to prevent interception
-            # (e.g. DNS rebinding filtering)
-            restricted_nameservers = {
-              "${domain}" = pubNameservers;
-              "${lib.my.c.colony.domain}" = with allAssignments.estuary.base; [
-                ipv4.address ipv6.address
-              ];
-              "${lib.my.c.home.domain}" = with allAssignments; [
-                river.hi.ipv4.address
-                river.hi.ipv6.address
-                stream.hi.ipv4.address
-                stream.hi.ipv6.address
-              ];
-            };
-            magic_dns = true;
-            base_domain = "ts.${pubDomain}";
-            override_local_dns = false;
-          };
-          oidc = {
-            only_start_if_oidc_is_available = true;
-            issuer = "https://accounts.google.com";
-            client_id = "545475967061-l45cln081mp8t4li2c34v7t7b8la6f4f.apps.googleusercontent.com";
-            client_secret_path = config.age.secrets."britway/oidc-secret.txt".path;
-            scope = [ "openid" "profile" "email" ];
-            allowed_users = [ "jackos1998@gmail.com" ];
-          };
-        };
-      };
-
-      tailscale = {
-        enable = true;
-        authKeyFile = config.age.secrets."tailscale-auth.key".path;
-        openFirewall = true;
-        interfaceName = "tailscale0";
-        extraUpFlags = [
-          "--operator=${config.my.user.config.name}"
-          "--login-server=https://ts.nul.ie"
-          "--netfilter-mode=off"
-          "--advertise-exit-node"
-          "--advertise-routes=${advRoutes}"
-          "--accept-routes=false"
-        ];
-      };
-    };
-
-    my = {
-      secrets = {
-        files = {
-          "britway/oidc-secret.txt" = {
-            owner = "headscale";
-            group = "headscale";
-            mode = "440";
-          };
-          "tailscale-auth.key" = {};
-        };
-      };
-    };
-  };
-}

nixos/boxes/colony/default.nix

@@ -66,21 +66,10 @@ in
             };
           });
           kernelModules = [ "kvm-amd" ];
-          kernelParams = [
+          kernelParams = [ "amd_iommu=on" "console=ttyS0,115200n8" "console=ttyS1,115200n8" "console=tty0" ];
-            "amd_iommu=on"
-            "console=ttyS0,115200n8" "console=ttyS1,115200n8" "console=tty0"
-            "systemd.setenv=SYSTEMD_SULOGIN_FORCE=1"
-          ];
           initrd = {
             kernelModules = [ "dm-raid" ];
             availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
-            systemd = {
-              enable = true;
-              # Onlu activate volumes needed for boot to prevent thin check from getting killed while switching root
-              contents."/etc/lvm/lvm.conf".text = ''
-                activation/auto_activation_volume_list = [ "main/colony-nix" "main/colony-persist" ]
-              '';
-            };
           };
         };
 
@@ -148,15 +137,6 @@ in
           services = {
             "serial-getty@ttyS0".enable = true;
             "serial-getty@ttyS1".enable = true;
-            lvm-activate-main = {
-              description = "Activate remaining LVs";
-              before = [ "local-fs-pre.target" ];
-              serviceConfig = {
-                Type = "oneshot";
-                ExecStart = "${pkgs.lvm2.bin}/bin/vgchange -aay main";
-              };
-              wantedBy = [ "sysinit.target" ];
-            };
 
             rsync-lvm-meta = {
               description = "rsync lvm metadata backups / archives to rsync.net";
@@ -268,14 +248,6 @@ in
                       Destination = allAssignments.shill.internal.ipv4.address;
                       Gateway = allAssignments.shill.routing.ipv4.address;
                     }
-                    {
-                      Destination = lib.my.c.tailscale.prefix.v4;
-                      Gateway = allAssignments.shill.routing.ipv4.address;
-                    }
-                    {
-                      Destination = lib.my.c.tailscale.prefix.v6;
-                      Gateway = allAssignments.shill.internal.ipv6.address;
-                    }
 
                     {
                       Destination = prefixes.oci.v4;

nixos/boxes/colony/vms/default.nix

@@ -120,7 +120,7 @@
               cpus = 12;
               threads = 2;
             };
-            memory = 40960;
+            memory = 49152;
             networks.vms.mac = "52:54:00:27:3d:5c";
             cleanShutdown.timeout = 120;
             drives = [ ] ++ (optionals (!config.my.build.isDevVM) [
@@ -160,7 +160,7 @@
               cpus = 12;
               threads = 2;
             };
-            memory = 40960;
+            memory = 32768;
             networks.vms.mac = "52:54:00:75:78:a8";
             cleanShutdown.timeout = 120;
             drives = [
@@ -181,7 +181,7 @@
               cpus = 3;
               threads = 2;
             };
-            memory = 6144;
+            memory = 8192;
             networks.public = {
               bridge = null;
               mac = "52:54:00:a8:d1:03";

nixos/boxes/colony/vms/estuary/bgp.nix

@@ -27,9 +27,7 @@ in
           define HOMENET6 = ${homenet6};
 
           define OWNIP6 = ${assignments.base.ipv6.address};
-          # we have issues with sending ICMPv6 too big back on the wrong interface right now...
+          define OWNNETSET6 = [ ${intnet6}, ${amsnet6}, ${homenet6} ];
-          define OWNNETSET6 = [ ${intnet6}, ${amsnet6} ];
-          define CCNETSET6 = [ ];
           #define TRANSSET6 = [ ::1/128 ];
 
           define DUB1IP6 = ${lib.my.c.home.vips.as211024.v6};
@@ -44,7 +42,7 @@ in
             if net ~ OWNNETSET4 || net ~ OWNNETSET6 then accept; else reject;
           }
           filter bgp_export_cc {
-            if net ~ OWNNETSET4 || net ~ OWNNETSET6 || net ~ CCNETSET4 || net ~ CCNETSET6 then accept; else reject;
+            if net ~ OWNNETSET4 || net ~ OWNNETSET6 || net ~ CCNETSET4 then accept; else reject;
           }
 
           router id from "wan";
@@ -190,12 +188,10 @@ in
           protocol bgp upstream6_coloclue_eun2 from upstream_bgp6 {
             description "ColoClue euNetworks 2 (IPv6)";
             neighbor 2a02:898:0:20::e2 as 8283;
-            ipv6 { export filter bgp_export_cc; };
           }
           protocol bgp upstream6_coloclue_eun3 from upstream_bgp6 {
             description "ColoClue euNetworks 3 (IPv6)";
             neighbor 2a02:898:0:20::e1 as 8283;
-            ipv6 { export filter bgp_export_cc; };
           }
 
           protocol bgp upstream6_ifog from upstream_bgp6 {

nixos/boxes/colony/vms/estuary/default.nix

@@ -15,7 +15,6 @@ in
             estuary.addr = pubV4;
             river.addr = elemAt lib.my.c.home.routersPubV4 0;
             stream.addr = elemAt lib.my.c.home.routersPubV4 1;
-            britway.addr = lib.my.c.britway.pubV4;
           };
         };
       };
@@ -298,15 +297,6 @@ in
                           Destination = prefixes.cust.v6;
                           Gateway = allAssignments.colony.internal.ipv6.address;
                         }
-
-                        {
-                          Destination = lib.my.c.tailscale.prefix.v4;
-                          Gateway = allAssignments.colony.routing.ipv4.address;
-                        }
-                        {
-                          Destination = lib.my.c.tailscale.prefix.v6;
-                          Gateway = allAssignments.colony.internal.ipv6.address;
-                        }
                       ] ++
                       (map (pName: [
                         {
@@ -326,12 +316,6 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
-                      {
-                        Destination = lib.my.c.home.prefixes.all.v4;
-                        Gateway = lib.my.c.home.vips.as211024.v4;
-                      }
-                    ];
                   }
                 ];
                 "95-kelder" = {
@@ -366,6 +350,7 @@ in
                 };
               };
               firewall = {
+                trustedInterfaces = [ "as211024" ];
                 udp.allowed = [ 5353 lib.my.c.kelder.vpn.port ];
                 tcp.allowed = [ 5353 "bgp" ];
                 nat = {
@@ -393,16 +378,12 @@ in
                       # Safe enough to allow all SSH
                       tcp dport ssh accept
 
-                      ip6 daddr ${aa.middleman.internal.ipv6.address} tcp dport { http, https, 8448 } accept
+                      ${matchInet "tcp dport { http, https, 8448 } accept" "middleman"}
-                      ${matchInet "tcp dport { http, https } accept" "git"}
+                      ${matchInet "udp dport { 2456-2457 } accept" "valheim-oci"}
-                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport { 25565, 25575 } accept
+
-                      ip6 daddr ${aa.simpcraft-staging-oci.internal.ipv6.address} tcp dport 25565 accept
                       return
                     }
                     chain routing-udp {
-                      ip6 daddr ${aa.valheim-oci.internal.ipv6.address} udp dport { 2456-2457 } accept
-                      ip6 daddr ${aa.waffletail.internal.ipv6.address} udp dport 41641 accept
-                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} udp dport 25565 accept
                       return
                     }
                     chain filter-routing {
@@ -419,8 +400,7 @@ in
                     }
 
                     chain forward {
-                      ${lib.my.c.as211024.nftTrust}
+                      iifname { wan, $ixps } oifname base jump filter-routing
-                      iifname { wan, as211024, $ixps } oifname base jump filter-routing
                       oifname $ixps jump ixp
                       iifname base oifname { base, wan, $ixps } accept
                       oifname { as211024, kelder } accept
@@ -433,9 +413,11 @@ in
                   table inet nat {
                     chain prerouting {
                       ${matchInet "meta l4proto { udp, tcp } th dport domain redirect to :5353" "estuary"}
+                      ip daddr ${aa.git.internal.ipv4.address} tcp dport { http, https } dnat to ${aa.middleman.internal.ipv4.address}
+                      ip6 daddr ${aa.git.internal.ipv6.address} tcp dport { http, https } dnat to ${aa.middleman.internal.ipv6.address}
                     }
                     chain postrouting {
-                      ip saddr ${prefixes.all.v4} oifname != as211024 snat to ${assignments.internal.ipv4.address}
+                      ip saddr ${prefixes.all.v4} snat to ${assignments.internal.ipv4.address}
                     }
                   }
                 '';

nixos/boxes/colony/vms/estuary/dns.nix

@@ -52,7 +52,7 @@ in
           allowFrom = [
             "127.0.0.0/8" "::1/128"
             prefixes.all.v4 prefixes.all.v6
-          ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
+          ];
         };
 
         settings = {
@@ -145,14 +145,9 @@ in
 
             http IN A ${assignments.internal.ipv4.address}
             http IN AAAA ${allAssignments.middleman.internal.ipv6.address}
-            librespeed IN CNAME http.${config.networking.domain}.
 
             valheim IN A ${assignments.internal.ipv4.address}
             valheim IN AAAA ${allAssignments.valheim-oci.internal.ipv6.address}
-            simpcraft IN A ${assignments.internal.ipv4.address}
-            simpcraft IN AAAA ${allAssignments.simpcraft-oci.internal.ipv6.address}
-            simpcraft-staging IN A ${assignments.internal.ipv4.address}
-            simpcraft-staging IN AAAA ${allAssignments.simpcraft-staging-oci.internal.ipv6.address}
 
             mail-vm IN A ${net.cidr.host 0 prefixes.mail.v4}
             mail-vm IN AAAA ${net.cidr.host 1 prefixes.mail.v6}

nixos/boxes/colony/vms/git/default.nix

@@ -1,11 +1,8 @@
 { lib, ... }:
 let
-  inherit (builtins) mapAttrs;
-  inherit (lib) mkMerge mkDefault;
   inherit (lib.my) net;
   inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.colony) domain prefixes;
-  inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
 in
 {
   nixos.systems.git = {
@@ -75,109 +72,9 @@ in
               };
             };
 
-            users = {
-              users = {
-                nginx.extraGroups = [ "acme" ];
-              };
-            };
-
-            security.acme = {
-              acceptTerms = true;
-              defaults = {
-                email = "dev@nul.ie";
-                server = "https://acme-v02.api.letsencrypt.org/directory";
-                reloadServices = [ "nginx" ];
-                dnsResolver = "8.8.8.8";
-              };
-              certs = {
-                "${pubDomain}" = {
-                  extraDomainNames = [
-                    "*.${pubDomain}"
-                  ];
-                  dnsProvider = "cloudflare";
-                  credentialsFile = config.age.secrets."middleman/cloudflare-credentials.conf".path;
-                };
-              };
-            };
-
             services = {
               fstrim = lib.my.c.colony.fstrimConfig;
-              # Hacks for Jsch (Minecraft FastBack) to work
-              openssh = {
-                hostKeys = [
-                  {
-                    bits = 4096;
-                    path = "/etc/ssh/ssh_host_rsa_key";
-                    type = "rsa";
-                  }
-                  {
-                    path = "/etc/ssh/ssh_host_ed25519_key";
-                    type = "ed25519";
-                  }
-
-                  {
-                    type = "ecdsa-sha2-nistp256";
-                    path = "/etc/ssh/ssh_host_ecdsa_key";
-                  }
-                ];
-                settings = {
-                  Macs = [
-                    "hmac-sha2-512-etm@openssh.com"
-                    "hmac-sha2-256-etm@openssh.com"
-                    "umac-128-etm@openssh.com"
-
-                    "hmac-sha2-256"
-                  ];
-                };
-              };
               netdata.enable = true;
-              nginx = {
-                enable = true;
-                enableReload = true;
-
-                logError = "stderr info";
-                recommendedTlsSettings = true;
-                clientMaxBodySize = "0";
-                serverTokens = true;
-                sslDhparam = config.age.secrets."dhparams.pem".path;
-
-                # Based on recommended*Settings, but probably better to be explicit about these
-                appendHttpConfig = ''
-                  ${baseHttpConfig}
-
-                  # caching
-                  proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=512m;
-                '';
-
-                virtualHosts =
-                let
-                  hosts = {
-                    "_" = {
-                      default = true;
-                      forceSSL = true;
-                      onlySSL = false;
-                      locations = {
-                        "/".root = "${pkgs.nginx}/html";
-                      };
-                    };
-
-                    "git.${pubDomain}" = {
-                      locations."/".proxyPass = "http://localhost:3000";
-                    };
-                  };
-
-                  defaultsFor = mapAttrs (n: _: {
-                    onlySSL = mkDefault true;
-                    useACMEHost = mkDefault pubDomain;
-                    kTLS = mkDefault true;
-                    http2 = mkDefault true;
-                  });
-                in
-                mkMerge [
-                  hosts
-                  (defaultsFor hosts)
-                ];
-              };
             };
 
             virtualisation = {
@@ -207,24 +104,11 @@ in
             };
 
             my = {
-              secrets = {
+              secrets.key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+KINpHLMduBuW96JzfSRDLUzkI+XaCBghu5/wHiW5R";
-                key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+KINpHLMduBuW96JzfSRDLUzkI+XaCBghu5/wHiW5R";
-                files = {
-                  "dhparams.pem" = {
-                    owner = "acme";
-                    group = "acme";
-                    mode = "440";
-                  };
-                  "middleman/cloudflare-credentials.conf" = {
-                    owner = "acme";
-                    group = "acme";
-                  };
-                };
-              };
               server.enable = true;
 
               firewall = {
-                tcp.allowed = [ 19999 "http" "https" ];
+                tcp.allowed = [ 19999 ];
                 extraRules = ''
                   table inet filter {
                     chain forward {

nixos/boxes/colony/vms/git/gitea.nix

@@ -26,6 +26,18 @@ in
 
     systemd = {
       services = {
+        # TODO: Figure out a way to do this properly... redirecting localhost is awkward...
+        local-http-forward = {
+          description = "Forward local HTTP connections";
+          serviceConfig.ExecStart = "${pkgs.socat}/bin/socat tcp-listen:80,fork tcp:${allAssignments.middleman.internal.ipv4.address}:80";
+          wantedBy = [ "multi-user.target" ];
+        };
+        local-https-forward = {
+          description = "Forward local HTTPS connections";
+          serviceConfig.ExecStart = "${pkgs.socat}/bin/socat tcp-listen:443,fork tcp:${allAssignments.middleman.internal.ipv4.address}:443";
+          wantedBy = [ "multi-user.target" ];
+        };
+
         gitea = mkMerge [
           (lib.my.systemdAwaitPostgres pkgs.postgresql "colony-psql")
           {
@@ -129,6 +141,21 @@ in
           "gitea/minio.txt" = ownedByGit;
         };
       };
+
+      firewall.extraRules = ''
+        table inet filter {
+          chain input {
+            ip saddr ${prefixes.all.v4} tcp dport 3000 accept
+            ip6 saddr ${prefixes.all.v6} tcp dport 3000 accept
+          }
+        }
+        table inet nat {
+          chain prerouting {
+            ip daddr ${assignments.internal.ipv4.address} tcp dport { http, https } dnat to ${allAssignments.middleman.internal.ipv4.address}
+            ip6 daddr ${assignments.internal.ipv6.address} tcp dport { http, https } dnat to ${allAssignments.middleman.internal.ipv6.address}
+          }
+        }
+      '';
     };
   };
 }

nixos/boxes/colony/vms/shill/containers/default.nix

@@ -7,6 +7,5 @@
     ./jackflix
     ./object.nix
     ./toot.nix
-    ./waffletail.nix
   ];
 }

nixos/boxes/colony/vms/shill/containers/middleman/default.nix

@@ -2,7 +2,6 @@
 let
   inherit (lib.my) net;
   inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.nginx) baseHttpConfig;
   inherit (lib.my.c.colony) domain prefixes;
 in
 {
@@ -66,7 +65,6 @@ in
                   owner = "nginx";
                   group = "nginx";
                 };
-                "librespeed.toml" = { };
               };
             };
 
@@ -123,19 +121,6 @@ in
                 baseURL = "https://sso.${pubDomain}";
               };
             };
-
-            librespeed = {
-              frontend.servers = [
-                {
-                  name = "Amsterdam, Netherlands";
-                  server = "//librespeed.${domain}";
-                }
-              ];
-              backend = {
-                enable = true;
-                extraSettingsFile = config.age.secrets."librespeed.toml".path;
-              };
-            };
           };
 
           users = {
@@ -146,10 +131,6 @@ in
 
           systemd = {
             network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
-            services = {
-              # HACK: nginx seems to get stuck not being able to DNS early...
-              nginx = lib.my.systemdAwaitPostgres pkgs.postgresql "colony-psql";
-            };
           };
 
           security = {
@@ -250,9 +231,43 @@ in
 
               # Based on recommended*Settings, but probably better to be explicit about these
               appendHttpConfig = ''
-                ${baseHttpConfig}
+                # NixOS provides a logrotate config that auto-compresses :)
+                log_format main
+                  '$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
+                access_log /var/log/nginx/access.log main;
 
-                resolver_timeout 5s;
+                # optimisation
+                sendfile on;
+                tcp_nopush on;
+                tcp_nodelay on;
+                keepalive_timeout 65;
+
+                # gzip
+                gzip on;
+                gzip_proxied any;
+                gzip_comp_level 5;
+                gzip_types
+                  application/atom+xml
+                  application/javascript
+                  application/json
+                  application/xml
+                  application/xml+rss
+                  image/svg+xml
+                  text/css
+                  text/javascript
+                  text/plain
+                  text/xml;
+                gzip_vary on;
+
+                # proxying
+                proxy_buffering off;
+                proxy_redirect off;
+                proxy_connect_timeout 60s;
+                proxy_read_timeout 60s;
+                proxy_send_timeout 60s;
+                proxy_http_version 1.1;
+
+                ${lib.my.c.nginx.proxyHeaders}
 
                 # caching
                 proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=4g;

nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix

@@ -347,41 +347,9 @@ in
         };
         useACMEHost = pubDomain;
       };
-      "public.${pubDomain}" = {
-        serverAliases = [ "p.${pubDomain}" ];
-        locations."/" = {
-          root = "/mnt/media/public";
-          extraConfig = ''
-            fancyindex on;
-            fancyindex_show_dotfiles on;
-          '';
-        };
-        useACMEHost = pubDomain;
-      };
 
-      "mc-map.${pubDomain}" = {
+      "git.${pubDomain}" = {
-        locations."/".proxyPass = "http://simpcraft-oci.${domain}:8100";
+        locations."/".proxyPass = "http://git-vm.${domain}:3000";
-        useACMEHost = pubDomain;
-      };
-      "mc-rail.${pubDomain}" = {
-        locations."/".proxyPass = "http://simpcraft-staging-oci.${domain}:3876";
-        useACMEHost = pubDomain;
-      };
-
-      "librespeed.${domain}" = {
-        locations."/".proxyPass = "http://localhost:8989";
-      };
-      "speed.${pubDomain}" = {
-        locations."/".proxyPass = "http://localhost:8989";
-        useACMEHost = pubDomain;
-      };
-
-      "md.${pubDomain}" = {
-        locations."/" = {
-          proxyPass = "http://object-ctr.${domain}:3000";
-          proxyWebsockets = true;
-          extraConfig = proxyHeaders;
-        };
         useACMEHost = pubDomain;
       };
     };
@@ -419,22 +387,7 @@ in
       "s3.${pubDomain}" = {
         serverAliases = [ "*.s3.${pubDomain}" ];
         inherit extraConfig;
-        locations = {
+        locations."/".proxyPass = s3Upstream;
-          "/".proxyPass = s3Upstream;
-          "/gitea/packages/" = {
-            proxyPass = s3Upstream;
-            # HACK: Docker images need the MIME type to be correct for the manifest but Gitea
-            # doesn't tell S3... By hiding the header we can use add_header to set Content-Type
-            # (normally can't be set directly)
-            extraConfig = ''
-              proxy_hide_header Content-Type;
-              add_header Content-Type $upstream_http_content_type always;
-              if ($args ~ "response-content-disposition=.+filename%3D%22manifest\.json%22") {
-                add_header Content-Type "application/vnd.docker.distribution.manifest.v2+json";
-              }
-            '';
-          };
-        };
         useACMEHost = pubDomain;
       };
 

nixos/boxes/colony/vms/shill/containers/object.nix

@@ -48,17 +48,11 @@ in
                   group = config.my.user.config.group;
                 };
                 "object/atticd.env" = {};
-                "object/hedgedoc.env" = {};
               };
             };
 
             firewall = {
-              tcp.allowed = [
+              tcp.allowed = [ 9000 9001 config.services.sharry.config.bind.port 8069 ];
-                9000 9001
-                config.services.sharry.config.bind.port
-                8069
-                config.services.hedgedoc.settings.port
-              ];
             };
 
             user.homeConfig = {
@@ -200,26 +194,6 @@ in
                 };
               };
             };
-
-            hedgedoc = {
-              enable = true;
-              environmentFile = config.age.secrets."object/hedgedoc.env".path;
-              settings = {
-                domain = "md.${pubDomain}";
-                protocolUseSSL = true;
-                db = {
-                  dialect = "postgresql";
-                  username = "hedgedoc";
-                  database = "hedgedoc";
-                  host = "colony-psql";
-                };
-                host = "::";
-                allowAnonymous = false;
-                allowAnonymousEdits = true;
-                email = true;
-                allowEmailRegister = false;
-              };
-            };
           };
         }
         (mkIf config.my.build.isDevVM {

nixos/boxes/colony/vms/shill/containers/waffletail.nix

@@ -1,100 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.colony) domain prefixes;
-in
-{
-  nixos.systems.waffletail = { config, ... }: {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    rendered = config.configuration.config.my.asContainer;
-
-    assignments = {
-      internal = {
-        name = "waffletail-ctr";
-        inherit domain;
-        ipv4.address = net.cidr.host 9 prefixes.ctrs.v4;
-        ipv6 = {
-          iid = "::9";
-          address = net.cidr.host 9 prefixes.ctrs.v6;
-        };
-      };
-      tailscale = with lib.my.c.tailscale; {
-        ipv4 = {
-          address = net.cidr.host 5 prefix.v4;
-          mask = 32;
-          gateway = null;
-        };
-        ipv6 = {
-          address = net.cidr.host 5 prefix.v6;
-          mask = 128;
-        };
-      };
-    };
-
-    configuration = { lib, config, assignments, ... }:
-    let
-      inherit (lib) concatStringsSep mkMerge mkIf mkForce;
-      inherit (lib.my) networkdAssignment;
-    in
-    {
-      config = {
-        my = {
-          deploy.enable = false;
-          server.enable = true;
-
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICZc88lcSQ9zzQzDITdE/T5ty++TxFQUAED7p9YfFBiR";
-            files = {
-              "tailscale-auth.key" = {};
-            };
-          };
-
-          firewall = {
-            trustedInterfaces = [ "tailscale0" ];
-            extraRules = ''
-              table inet filter {
-                chain forward {
-                  iifname host0 oifname tailscale0 ip saddr ${prefixes.all.v4} accept
-                  iifname host0 oifname tailscale0 ip6 saddr ${prefixes.all.v6} accept
-                }
-              }
-              table inet nat {
-                chain postrouting {
-                  iifname tailscale0 ip daddr != ${prefixes.all.v4} snat to ${assignments.internal.ipv4.address}
-                  iifname tailscale0 ip6 daddr != ${prefixes.all.v6} snat ip6 to ${assignments.internal.ipv6.address}
-                }
-              }
-            '';
-          };
-        };
-
-        systemd = {
-          network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
-        };
-
-        services = {
-          tailscale =
-          let
-            advRoutes = concatStringsSep "," (with prefixes.all; [ v4 v6 ]);
-          in
-          {
-            enable = true;
-            authKeyFile = config.age.secrets."tailscale-auth.key".path;
-            port = 41641;
-            openFirewall = true;
-            interfaceName = "tailscale0";
-            extraUpFlags = [
-              "--operator=${config.my.user.config.name}"
-              "--login-server=https://ts.nul.ie"
-              "--netfilter-mode=off"
-              "--advertise-exit-node"
-              "--advertise-routes=${advRoutes}"
-              "--accept-routes=false"
-            ];
-          };
-        };
-      };
-    };
-  };
-}

nixos/boxes/colony/vms/shill/default.nix

@@ -139,16 +139,6 @@ in
                         ipv6PrefixConfig.Prefix = prefixes.ctrs.v6;
                       }
                     ];
-                    routes = map (r: { routeConfig = r; }) [
-                      {
-                        Destination = lib.my.c.tailscale.prefix.v4;
-                        Gateway = allAssignments.waffletail.internal.ipv4.address;
-                      }
-                      {
-                        Destination = lib.my.c.tailscale.prefix.v6;
-                        Gateway = allAssignments.waffletail.internal.ipv6.address;
-                      }
-                    ];
                   }
                 ];
               };
@@ -206,7 +196,6 @@ in
                     };
                   };
                   toot = {};
-                  waffletail = {};
                 };
               in
               mkMerge [

nixos/boxes/colony/vms/whale2/default.nix

@@ -50,8 +50,6 @@ in
       };
     }) {
       valheim-oci = 2;
-      simpcraft-oci = 3;
-      simpcraft-staging-oci = 4;
     };
 
     configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -65,7 +63,6 @@ in
           "${modulesPath}/profiles/qemu-guest.nix"
 
           ./valheim.nix
-          ./minecraft
         ];
 
         config = mkMerge [

nixos/boxes/colony/vms/whale2/minecraft/default.nix

@@ -1,121 +0,0 @@
-{ lib, pkgs, config, allAssignments, ... }:
-let
-  inherit (lib) concatStringsSep;
-  inherit (lib.my) dockerNetAssignment;
-
-  # devplayer0
-  op = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
-  whitelist = concatStringsSep "," [
-    op
-    "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56" # Elderlypug
-    "fcb26db2-c3ce-41aa-b588-efec79d37a8a" # Jesthral_
-    "1d366062-12c0-4e29-aba7-6ab5d8c6bb05" # shr3kas0ras
-    "703b378a-09f9-4c1d-9876-1c9305728c49" # OROURKEIRE
-    "f105bbe6-eda6-4a13-a8cf-894e77cab77b" # Adzerq
-    "1fc94979-41fb-497a-81e9-34ae24ca537a" # johnnyscrims
-    "d53c91df-b6e6-4463-b106-e8427d7a8d01" # BossLonus
-    "f439f64d-91c9-4c74-9ce5-df4d24cd8e05" # hynge_
-    "d6ec4c91-5da2-44eb-b89d-71dc8fe017a0" # Eefah98
-    "096a7348-fabe-4b2d-93fc-fd1fd5608fb0" # ToTheMoonStar
-  ];
-
-  fastback = {
-    gitConfig = pkgs.writeText "git-config" ''
-      [user]
-      	email = "simpcraft@nul.ie"
-      	name = "Simpcraft bot"
-    '';
-    knownHosts = pkgs.writeText "known_hosts" ''
-      git.nul.ie ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBD023ECzYmLeXIpcGVaciPjq6UN/Sjmsys5HP/Nei5GkrUZqPa3OJ2uSXKLUSKGYdeNhxaFTPJe8Yx3TsZxMme8=
-    '';
-  };
-in
-{
-  config = {
-    virtualisation.oci-containers.containers = {
-      simpcraft = {
-        image = "ghcr.io/itzg/minecraft-server:2023.12.2-java17-alpine";
-
-        environment = {
-          TYPE = "MODRINTH";
-
-          EULA = "true";
-          ENABLE_QUERY = "true";
-          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t §4§k-----";
-          ICON = "/ext/icon.png";
-
-          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
-          WHITELIST = whitelist;
-          EXISTING_OPS_FILE = "SYNCHRONIZE";
-          OPS = op;
-          DIFFICULTY = "normal";
-          SPAWN_PROTECTION = "0";
-          VIEW_DISTANCE = "20";
-
-          MAX_MEMORY = "6G";
-          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/cdj2bSKg/Simpcraft-0.1.2.mrpack";
-
-          TZ = "Europe/Dublin";
-        };
-
-        volumes = [
-          "minecraft_data:/data"
-          "${./icon.png}:/ext/icon.png:ro"
-        ];
-
-        extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-oci"}''
-        ];
-      };
-
-      simpcraft-staging = {
-        image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";
-
-        environment = {
-          TYPE = "MODRINTH";
-
-          EULA = "true";
-          ENABLE_QUERY = "true";
-          ENABLE_RCON = "true";
-          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t [staging] §4§k-----";
-          ICON = "/ext/icon.png";
-
-          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
-          WHITELIST = whitelist;
-          EXISTING_OPS_FILE = "SYNCHRONIZE";
-          OPS = op;
-          DIFFICULTY = "normal";
-          SPAWN_PROTECTION = "0";
-          VIEW_DISTANCE = "20";
-
-          MAX_MEMORY = "4G";
-          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/Ym3sIi6H/Simpcraft-0.2.0.mrpack";
-
-          TZ = "Europe/Dublin";
-        };
-        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
-
-        volumes = [
-          "minecraft_staging_data:/data"
-          "${./icon.png}:/ext/icon.png:ro"
-          "${fastback.gitConfig}:/data/.config/git/config:ro"
-          "${fastback.knownHosts}:/data/.ssh/known_hosts:ro"
-          "${config.age.secrets."whale2/simpcraft-git.key".path}:/data/.ssh/id_rsa"
-        ];
-
-        extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
-        ];
-      };
-    };
-
-    my = {
-      secrets.files = {
-        "whale2/simpcraft.env" = {};
-        "whale2/simpcraft-git.key" = {
-          owner = "1000";
-        };
-      };
-    };
-  };
-}

nixos/boxes/home/palace/default.nix

@@ -94,7 +94,7 @@ in
             extraOptions = [ "-A /var/log/smartd/" "--interval=600" ];
           };
           udev.extraRules = ''
-            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="3"
+            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="2"
           '';
         };
 
@@ -110,7 +110,7 @@ in
           hwloc
         ];
 
-        networking = { inherit domain; };
+        networking.domain = "h.${pubDomain}";
 
         systemd = {
           tmpfiles.rules = [
@@ -144,13 +144,6 @@ in
 
             netdevs = mkMerge [
               (mkVLAN "lan-hi" vlans.hi)
-              (mkVLAN "lan-lo-phy" vlans.lo)
-              {
-                "25-lan-lo".netdevConfig = {
-                  Name = "lan-lo";
-                  Kind = "bridge";
-                };
-              }
             ];
 
             networks = {
@@ -158,7 +151,6 @@ in
                 (networkdAssignment "lan-core" assignments.core)
                 {
                   matchConfig.Name = "lan-core";
-                  vlan = [ "lan-lo-phy" ];
                   networkConfig.IPv6AcceptRA = mkForce false;
                 }
               ];
@@ -181,28 +173,9 @@ in
                   VirtualFunction=1
                   LinkState=yes
                   MACAddress=52:54:00:8a:8a:f2
-
-                  # sfh
-                  [SR-IOV]
-                  VirtualFunction=2
-                  VLANId=${toString vlans.hi}
-                  LinkState=yes
-                  MACAddress=52:54:00:ac:15:a9
                 '';
               };
               "60-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
-
-              "50-lan-lo-phy" = {
-                matchConfig.Name = "lan-lo-phy";
-                networkConfig = {
-                  Bridge = "lan-lo";
-                } // networkd.noL3;
-              };
-              "60-lan-lo" = {
-                matchConfig.Name = "lan-lo";
-                linkConfig.RequiredForOnline = "no";
-                networkConfig = networkd.noL3;
-              };
             };
           };
         };

nixos/boxes/home/palace/vms/cellar/default.nix

@@ -58,8 +58,6 @@ in
               };
             };
 
-            networking = { inherit domain; };
-
             environment.systemPackages = with pkgs; [
               pciutils
               partclone

nixos/boxes/home/palace/vms/default.nix

@@ -55,19 +55,7 @@
       };
     };
 
-    systemd.services =
+    systemd.services = {
-    let
-      awaitCellar = {
-        after = [ "vm@cellar.service" ];
-        bindsTo = [ "vm@cellar.service" ];
-        preStart = ''
-          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.cellar.hi.ipv4.address} 22; do
-            sleep 1
-          done
-        '';
-      };
-    in
-    {
       "vm@cellar" = {
         serviceConfig = {
           CPUAffinity = "numa";
@@ -75,19 +63,20 @@
           NUMAMask = "1";
         };
       };
-
       "vm@river" =
       let
         vtapUnit = "sys-subsystem-net-devices-vm\\x2det1g0.device";
       in
-      mkMerge [
-        awaitCellar
       {
         requires = [ vtapUnit ];
-          after = [ vtapUnit ];
+        after = [ vtapUnit "vm@cellar.service" ];
-        }
+        bindsTo = [ "vm@cellar.service" ];
-      ];
+        preStart = ''
-      "vm@sfh" = awaitCellar;
+          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.cellar.hi.ipv4.address} 22; do
+            sleep 1
+          done
+        '';
+      };
     };
 
     my = {
@@ -139,7 +128,7 @@
               threads = 2;
             };
             memory = 4096;
-            cleanShutdown.timeout = 60;
+            cleanShutdown.timeout = 120;
             networks = {
               et1g0 = {
                 ifname = "vm-et1g0";
@@ -161,29 +150,6 @@
               };
             };
           };
-
-          sfh = {
-            uuid = "82ec149d-577c-421a-93e2-a9307c756cd8";
-            cpu = "host,topoext";
-            smp = {
-              cpus = 8;
-              threads = 2;
-            };
-            memory = 32768;
-            cleanShutdown.timeout = 120;
-            networks.netboot = {
-              bridge = "lan-lo";
-              waitOnline = "carrier";
-              mac = "52:54:00:a5:7e:93";
-              extraOptions.bootindex = 1;
-            };
-            hostDevices = {
-              et100g0vf2 = {
-                index = 0;
-                hostBDF = "44:00.3";
-              };
-            };
-          };
         };
       };
     };

nixos/boxes/home/routing-common/default.nix

@@ -66,7 +66,7 @@ in
         };
         ipv6 = {
           address = net.cidr.host ((1*65536*65536*65536) + index + 1) prefixes.as211024.v6;
-          gateway = net.cidr.host ((2*65536*65536*65536) + 1) prefixes.as211024.v6;
+          gateway = net.cidr.host 1 prefixes.as211024.v6;
         };
       };
     };
@@ -262,21 +262,6 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
-                      {
-                        Destination = lib.my.c.colony.prefixes.all.v4;
-                        Gateway = allAssignments.estuary.as211024.ipv4.address;
-                      }
-
-                      {
-                        Destination = lib.my.c.tailscale.prefix.v4;
-                        Gateway = allAssignments.britway.as211024.ipv4.address;
-                      }
-                      {
-                        Destination = lib.my.c.tailscale.prefix.v6;
-                        Gateway = allAssignments.britway.as211024.ipv6.address;
-                      }
-                    ];
                   }
                 ];
               }
@@ -318,29 +303,16 @@ in
                 enable = true;
                 externalInterface = "wan";
               };
-              extraRules =
+              extraRules = ''
-              let
-                aa = allAssignments;
-              in
-              ''
                 table inet filter {
                   chain input {
-                    ${lib.my.c.as211024.nftTrust}
                     iifname base meta l4proto { udp, tcp } th dport domain accept
                     iifname lan-core meta l4proto vrrp accept
                   }
 
                   chain routing-tcp {
-                    ip daddr {
+                    # Safe enough to allow all SSH
-                      ${aa.castle.hi.ipv4.address},
+                    tcp dport ssh accept
-                      ${aa.cellar.hi.ipv4.address},
-                      ${aa.palace.hi.ipv4.address}
-                    } tcp dport ssh accept
-                    ip6 daddr {
-                      ${aa.castle.hi.ipv6.address},
-                      ${aa.cellar.hi.ipv6.address},
-                      ${aa.palace.hi.ipv6.address}
-                    } tcp dport ssh accept
 
                     return
                   }
@@ -359,10 +331,8 @@ in
                   }
 
                   chain forward {
-                    ${lib.my.c.as211024.nftTrust}
                     iifname lan-untrusted jump filter-untrusted
-                    iifname { wan, as211024, lan-untrusted } oifname { lan-hi, lan-lo } jump filter-routing
+                    iifname { wan, lan-untrusted } oifname { lan-hi, lan-lo } jump filter-routing
-                    oifname as211024 accept
                   }
                   chain output { }
                 }

nixos/boxes/home/routing-common/dns.nix

@@ -2,7 +2,6 @@ index: { lib, pkgs, config, assignments, allAssignments, ... }:
 let
   inherit (builtins) attrNames elemAt;
   inherit (lib.my) net;
-  inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.home) prefixes vips routers;
 
   name = elemAt routers index;
@@ -23,7 +22,6 @@ in
           owner = "pdns-recursor";
           group = "pdns-recursor";
         };
-        "home/ddclient-cloudflare.key" = {};
       };
 
       pdns.recursor = {
@@ -44,7 +42,7 @@ in
             "127.0.0.0/8" "::1/128"
             prefixes.hi.v4 prefixes.hi.v6
             prefixes.lo.v4 prefixes.lo.v6
-          ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
+          ];
         };
 
         settings = {
@@ -65,36 +63,9 @@ in
       };
     };
 
-    systemd = {
+    systemd.services = {
-      services = {
       # Add AF_NETLINK to allow pulling IP from network interfaces
       pdns.serviceConfig.RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
-        ddns-update = {
-          description = "DNS update script";
-          after = [ "network.target" ];
-          path = [
-            (pkgs.python3.withPackages (ps: [ ps.cloudflare ]))
-            pkgs.ldns
-          ];
-          serviceConfig = {
-            Type = "oneshot";
-            ExecStart =
-              ''${./dns_update.py} -k ${config.age.secrets."home/ddclient-cloudflare.key".path} '' +
-              ''${pubDomain} ns${toString (index + 1)}.${config.networking.domain}'';
-          };
-          wantedBy = [ "multi-user.target" ];
-        };
-      };
-      timers = {
-        ddns-update = {
-          description = "Periodically update DNS";
-          wantedBy = [ "timers.target" ];
-          timerConfig = {
-            OnBootSec = "5min";
-            OnUnitInactiveSec = "5min";
-          };
-        };
-      };
     };
 
     environment.systemPackages = with pkgs; [
@@ -182,11 +153,6 @@ in
             dave-lo IN A ${net.cidr.host 11 prefixes.lo.v4}
             dave-lo IN AAAA ${net.cidr.host (65536+2) prefixes.lo.v6}
 
-            ;ap0 IN A ${net.cidr.host 12 prefixes.hi.v4}
-            ;ap0 IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
-            vibe IN A ${net.cidr.host 13 prefixes.hi.v4}
-            vibe IN AAAA ${net.cidr.host (65536+4) prefixes.hi.v6}
-
             ups IN A ${net.cidr.host 20 prefixes.lo.v4}
             palace-kvm IN A ${net.cidr.host 21 prefixes.lo.v4}
 

nixos/boxes/home/routing-common/dns_update.py

@@ -1,35 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-import subprocess
-
-import CloudFlare
-
-def main():
-    parser = argparse.ArgumentParser(description='Cloudflare DNS update script')
-    parser.add_argument('-k', '--api-token-file', help='Cloudflare API token file')
-    parser.add_argument('zone', help='Cloudflare Zone')
-    parser.add_argument('record', help='Cloudflare record name')
-    args = parser.parse_args()
-
-    address = subprocess.check_output(
-        ['drill', '-Q', '-p5353', '@127.0.0.1', args.record, 'A'],
-        encoding='utf8').strip()
-
-    cf_token = None
-    if args.api_token_file:
-        with open(args.api_token_file) as f:
-            cf_token = f.readline().strip()
-
-    cf = CloudFlare.CloudFlare(token=cf_token)
-    zones = cf.zones.get(params={'name': args.zone})
-    assert zones, f'Zone {args.zone} not found'
-    records = cf.zones.dns_records.get(zones[0]['id'], params={'name': args.record})
-    assert records, f'Record {args.record} not found in zone {args.zone}'
-
-    print(f'Updating {args.record} -> {address}')
-    cf.zones.dns_records.patch(
-        zones[0]['id'], records[0]['id'],
-        data={'type': 'A', 'name': args.record, 'content': address})
-
-if __name__ == '__main__':
-    main()

nixos/boxes/home/routing-common/kea.nix

@@ -2,7 +2,7 @@ index: { lib, pkgs, assignments, ... }:
 let
   inherit (lib) mkForce;
   inherit (lib.my) net;
-  inherit (lib.my.c.home) domain prefixes vips hiMTU;
+  inherit (lib.my.c.home) domain prefixes vips;
 
   dns-servers = [
     {
@@ -55,7 +55,7 @@ in
             }
             {
               name = "domain-search";
-              data = "${domain}, dyn.${domain}, ${lib.my.c.colony.domain}, ${lib.my.c.britway.domain}";
+              data = "${domain}, dyn.${domain}";
               always-send = true;
             }
           ];
@@ -73,10 +73,6 @@ in
                   name = "domain-name-servers";
                   data = "${net.cidr.host 1 prefixes.hi.v4}, ${net.cidr.host 2 prefixes.hi.v4}";
                 }
-                {
-                  name = "interface-mtu";
-                  data = toString hiMTU;
-                }
               ];
               pools = [
                 {

nixos/boxes/home/routing-common/radvd.nix

@@ -11,7 +11,7 @@ let
       AdvLinkMTU ${toString prefixes."${name}".mtu};
       prefix ${prefixes."${name}".v6} {};
       RDNSS ${net.cidr.host 1 prefixes."${name}".v6} ${net.cidr.host 2 prefixes."${name}".v6} {};
-      DNSSL ${domain} dyn.${domain} ${lib.my.c.colony.domain} ${lib.my.c.britway.domain} {};
+      DNSSL ${domain} dyn.${domain} {};
      };
   '';
 in

nixos/boxes/kelder/containers/spoder/default.nix

@@ -92,7 +92,7 @@ in
 
           nextcloud = {
             enable = true;
-            package = pkgs.nextcloud28;
+            package = pkgs.nextcloud27;
             datadir = "/mnt/storage/nextcloud";
             hostName = "cloud.${domain}";
             https = true;

nixos/boxes/kelder/containers/spoder/nginx.nix

@@ -2,7 +2,7 @@
 let
   inherit (builtins) mapAttrs;
   inherit (lib) mkMerge mkIf mkDefault;
-  inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
+  inherit (lib.my.c.nginx) proxyHeaders;
   inherit (lib.my.c.kelder) domain;
 in
 {
@@ -39,7 +39,43 @@ in
 
         # Based on recommended*Settings, but probably better to be explicit about these
         appendHttpConfig = ''
-          ${baseHttpConfig}
+          # NixOS provides a logrotate config that auto-compresses :)
+          log_format main
+            '$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
+          access_log /var/log/nginx/access.log main;
+
+          # optimisation
+          sendfile on;
+          tcp_nopush on;
+          tcp_nodelay on;
+          keepalive_timeout 65;
+
+          # gzip
+          gzip on;
+          gzip_proxied any;
+          gzip_comp_level 5;
+          gzip_types
+            application/atom+xml
+            application/javascript
+            application/json
+            application/xml
+            application/xml+rss
+            image/svg+xml
+            text/css
+            text/javascript
+            text/plain
+            text/xml;
+          gzip_vary on;
+
+          # proxying
+          proxy_buffering off;
+          proxy_redirect off;
+          proxy_connect_timeout 60s;
+          proxy_read_timeout 60s;
+          proxy_send_timeout 60s;
+          proxy_http_version 1.1;
+
+          ${proxyHeaders}
 
           # caching
           proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=4g;

nixos/boxes/kelder/default.nix

@@ -135,14 +135,12 @@ in
             samba-wsdd.enable = true;
 
             minecraft-server = {
-              enable = false;
+              enable = true;
-              package = pkgs.minecraftServers.vanilla-1-20;
+              package = pkgs.minecraftServers.vanilla-1-19;
               declarative = true;
               eula = true;
               whitelist = {
                 devplayer0 = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
-                Elderlypug = "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56";
-                shr3kas0ras = "1d366062-12c0-4e29-aba7-6ab5d8c6bb05";
               };
               serverProperties = {
                 motd = "Simpcraft";

nixos/boxes/tower/default.nix

@@ -107,19 +107,10 @@
 
           fprintd.enable = true;
           blueman.enable = true;
-
-          tailscale = {
-            enable = true;
-            openFirewall = true;
-          };
         };
 
         programs = {
           steam.enable = true;
-          wireshark = {
-            enable = true;
-            package = pkgs.wireshark-qt;
-          };
         };
 
         networking = {
@@ -175,14 +166,6 @@
                 packages = with pkgs; [ ];
               };
 
-              programs = {
-                fish = {
-                  shellAbbrs = {
-                    tsup = "doas tailscale up --login-server=https://ts.nul.ie --accept-routes";
-                  };
-                };
-              };
-
               services = {
                 blueman-applet.enable = true;
               };

nixos/default.nix

@@ -1,4 +1,4 @@
-{ self, lib, pkgsFlakes, hmFlakes, inputs, pkgs', config, ... }:
+{ lib, pkgsFlakes, hmFlakes, inputs, pkgs', config, ... }:
 let
   inherit (builtins) attrValues mapAttrs;
   inherit (lib)
@@ -25,14 +25,10 @@ let
 
       modules' = [ hmFlakes.${config'.home-manager}.nixosModule ] ++ (attrValues cfg.modules);
     in
-    # Import eval-config ourselves since the flake now force-sets lib
+    pkgsFlake.lib.nixosSystem {
-    import "${pkgsFlake}/nixos/lib/eval-config.nix" {
       # Gotta override lib here unforunately, eval-config.nix likes to import its own (unextended) lib. We explicitly
       # don't pass pkgs so that it'll be imported with modularly applied config and overlays.
-      lib = pkgs.lib.extend (lib.my.versionOverlay { inherit self pkgsFlake; });
+      lib = pkgs.lib;
-
-      # Set to null since we pass modularly
-      system = null;
 
       # Put the inputs in specialArgs to avoid infinite recursion when modules try to do imports
       specialArgs = { inherit inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
@@ -55,7 +51,7 @@ let
             pkgs' = allPkgs;
           };
 
-          system = { inherit name; };
+          system.name = name;
           networking = {
             domain = let d = config'.assignments.internal.domain or null; in mkIf (d != null) (mkDefault' d);
             hostName = mkDefault (config'.assignments.internal.name or name);
@@ -90,8 +86,6 @@ let
                   pkgsPath = toString pkgsFlakes.${config'.hmNixpkgs};
                   pkgs' = allPkgs;
                 };
-
-                home.enableNixpkgsReleaseCheck = false;
               }
               (homeStateVersion config'.home-manager)
             ];

nixos/installer.nix

@@ -32,8 +32,7 @@
           };
 
           isoImage = {
-            isoBaseName = "jackos-installer";
+            isoBaseName = "nixos-installer-devplayer0";
-            volumeID = "jackos-${config.system.nixos.release}-${pkgs.stdenv.hostPlatform.uname.processor}";
             edition = "devplayer0";
             appendToMenuLabel = " /dev/player0 Installer";
           };

nixos/modules/_list.nix

@@ -19,6 +19,5 @@
     borgthin = ./borgthin.nix;
     nvme = ./nvme;
     spdk = ./spdk.nix;
-    librespeed = ./librespeed;
   };
 }

nixos/modules/build.nix

@@ -92,7 +92,6 @@ in
     };
     isoImage = {
       isoBaseName = dummyOption;
-      volumeID = dummyOption;
       edition = dummyOption;
       appendToMenuLabel = dummyOption;
     };

nixos/modules/common.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, pkgs', inputs, config, ... }:
 let
   inherit (lib) mkIf mkDefault mkMerge;
-  inherit (lib.my) mkDefault';
+  inherit (lib.my) mkBoolOpt' dummyOption;
 in
 {
   options = with lib.types; {
@@ -121,11 +121,6 @@ in
           services.lvm.enable = mkDefault true;
         };
       };
-      system = {
-        nixos = {
-          distroName = mkDefault' "JackOS";
-        };
-      };
 
       environment.systemPackages = with pkgs; mkMerge [
         [
@@ -156,7 +151,6 @@ in
               font-name=SauceCodePro Nerd Font Mono
             '';
         };
-        getty.greetingLine = mkDefault' ''<<< Welcome to ${config.system.nixos.distroName} ${config.system.nixos.label} (\m) - \l >>>'';
 
         openssh = {
           enable = mkDefault true;

nixos/modules/containers.nix

@@ -209,16 +209,12 @@ in
             mkdir -p -m 0755 "$root"/sbin "$root"/etc
             touch "$root"/etc/os-release
 
-            ${if system == sysProfile then ''
+            if [ -e "${containerSystem}"/prepare-root ]; then
-              if [ -e "${sysProfile}"/prepare-root ]; then
               initSource="${containerSystem}"/prepare-root
             else
               initSource="${containerSystem}"/init
             fi
             ln -sf "$initSource" "$root"/sbin/init
-            '' else ''
-              ln -sf "${containerSystem}/prepare-root" "$root"/sbin/init
-            ''}
           '';
           postStop =
           ''

nixos/modules/deploy-rs.nix

@@ -15,20 +15,16 @@ let
   # Based on https://github.com/serokell/deploy-rs/blob/master/flake.nix
   nixosActivate = cfg': base: (pkgs.deploy-rs.lib.activate.custom // {
     dryActivate = "$PROFILE/bin/switch-to-configuration dry-activate";
-    boot = ''
+    boot = "$PROFILE/bin/switch-to-configuration boot";
-      $PROFILE/bin/switch-to-configuration boot
-
-      ${keepGensSnippet "$PROFILE" cfg'.keepGenerations}
-    '';
   }) base.config.system.build.toplevel ''
     # work around https://github.com/NixOS/nixpkgs/issues/73404
     cd /tmp
 
-    "$PROFILE"/bin/switch-to-configuration switch
+    "$PROFILE"/bin/switch-to-configuration ${cfg'.mode}
 
     # https://github.com/serokell/deploy-rs/issues/31
     ${with base.config.boot.loader;
-    optionalString systemd-boot.enable
+    optionalString ((cfg'.mode == "switch" || cfg'.mode == "boot") && systemd-boot.enable)
     "sed -i '/^default /d' ${efi.efiSysMountPoint}/loader/loader.conf"}
 
     ${keepGensSnippet "$PROFILE" cfg'.keepGenerations}
@@ -63,11 +59,7 @@ let
   {
     name = "container-${n}";
     value = {
-      path = (pkgs.deploy-rs.lib.activate.custom // {
+      path = pkgs.deploy-rs.lib.activate.custom ctrConfig.my.buildAs.container ''
-        boot = ''
-          echo "Next systemd-nspawn@${n}.service restart / reload will load config"
-        '';
-      }) ctrConfig.my.buildAs.container ''
         source ${systemdUtil}/bin/systemd-util.sh
         ${if c.hotReload then ''
           if (! systemctl show -p ActiveState systemd-nspawn@${n} | grep -q "ActiveState=active") || \

nixos/modules/firewall.nix

@@ -222,7 +222,7 @@ in
                 "iifname ${cfg.nat.externalInterface} jump filter-iif-port-forwards"}
               ${optionalString
                 dipForward
-                (concatMapStringsSep "\n    " (ip: "jump ${natFilterChain ip}") (attrNames cfg.nat.forwardPorts))}
+                (concatMapStringsSep "\n    " (ip: "${ipK ip} daddr ${ip} jump ${natFilterChain ip}") (attrNames cfg.nat.forwardPorts))}
             }
           }
 

nixos/modules/librespeed/default.nix

@@ -1,76 +0,0 @@
-{ lib, pkgs, config, ... }:
-let
-  inherit (builtins) toJSON;
-  inherit (lib) mkOption mkMerge mkIf mkDefault;
-  inherit (lib.my) mkOpt' mkBoolOpt';
-
-  cfg = config.my.librespeed;
-
-  serversConf = map (s: s // {
-    dlURL = "backend/garbage";
-    ulURL = "backend/empty";
-    pingURL = "backend/empty";
-    getIpURL = "backend/getIP";
-  }) cfg.frontend.servers;
-  frontendTree = pkgs.runCommand "librespeed-frontend" {
-    speedtestServers = toJSON serversConf;
-  } ''
-    mkdir "$out"
-    cp "${pkgs.librespeed-go}"/assets/* "$out"/
-    substitute ${./index.html} "$out"/index.html --subst-var speedtestServers
-  '';
-
-  backendConf = pkgs.writers.writeTOML "librespeed.toml" cfg.backend.settings;
-  generateBackendSettings = base: dst: if (cfg.backend.extraSettingsFile != null) then ''
-    oldUmask="$(umask)"
-    umask 006
-    cat "${base}" "${cfg.backend.extraSettingsFile}" > "${dst}"
-    umask "$oldUmask"
-  '' else ''
-    cp "${base}" "${dst}"
-  '';
-in
-{
-  options.my.librespeed = with lib.types; {
-    frontend = {
-      servers = mkOpt' (listOf (attrsOf unspecified)) { } "Server configs.";
-      webroot = mkOption {
-        description = "Frontend webroot.";
-        type = package;
-        readOnly = true;
-      };
-    };
-    backend = {
-      enable = mkBoolOpt' false "Whether to enable librespeed backend.";
-      settings = mkOpt' (attrsOf unspecified) { } "Backend settings.";
-      extraSettingsFile = mkOpt' (nullOr str) null "Extra settings file.";
-    };
-  };
-
-  config = mkMerge [
-    (mkIf (cfg.frontend.servers != { }) {
-      my.librespeed.frontend.webroot = frontendTree;
-    })
-    (mkIf cfg.backend.enable {
-      my.librespeed.backend.settings = {
-        assets_path = frontendTree;
-        database_type = mkDefault "bolt";
-        database_file = mkDefault "/var/lib/librespeed-go/speedtest.db";
-      };
-
-      systemd.services.librespeed = {
-        description = "LibreSpeed Go backend";
-        wants = [ "network-online.target" ];
-        after = [ "network-online.target" ];
-
-        preStart = generateBackendSettings backendConf "/run/librespeed-go/settings.toml";
-        serviceConfig = {
-          ExecStart = "${pkgs.librespeed-go}/bin/speedtest -c /run/librespeed-go/settings.toml";
-          RuntimeDirectory = "librespeed-go";
-          StateDirectory = "librespeed-go";
-        };
-        wantedBy = [ "multi-user.target" ];
-      };
-    })
-  ];
-}

nixos/modules/librespeed/index.html

@@ -1,491 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<link rel="shortcut icon" href="favicon.ico">
-<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no, user-scalable=no" />
-<meta charset="UTF-8" />
-<script type="text/javascript" src="speedtest.js"></script>
-<script type="text/javascript">
-function I(i){return document.getElementById(i);}
-
-//LIST OF TEST SERVERS. See documentation for details if needed
-var SPEEDTEST_SERVERS=@speedtestServers@;
-// var SPEEDTEST_SERVERS=[
-// 	{	//this server doesn't actually exist, remove it
-// 		name:"Example Server 1", //user friendly name for the server
-// 		server:"//test1.mydomain.com/", //URL to the server. // at the beginning will be replaced with http:// or https:// automatically
-// 		dlURL:"backend/garbage.php",  //path to download test on this server (garbage.php or replacement)
-// 		ulURL:"backend/empty.php",  //path to upload test on this server (empty.php or replacement)
-// 		pingURL:"backend/empty.php",  //path to ping/jitter test on this server (empty.php or replacement)
-// 		getIpURL:"backend/getIP.php"  //path to getIP on this server (getIP.php or replacement)
-// 	},
-// 	{	//this server doesn't actually exist, remove it
-// 		name:"Example Server 2", //user friendly name for the server
-// 		server:"//test2.example.com/", //URL to the server. // at the beginning will be replaced with http:// or https:// automatically
-// 		dlURL:"garbage.php",  //path to download test on this server (garbage.php or replacement)
-// 		ulURL:"empty.php",  //path to upload test on this server (empty.php or replacement)
-// 		pingURL:"empty.php",  //path to ping/jitter test on this server (empty.php or replacement)
-// 		getIpURL:"getIP.php"  //path to getIP on this server (getIP.php or replacement)
-// 	}
-// 	//add other servers here, comma separated
-// ];
-
-//INITIALIZE SPEEDTEST
-var s=new Speedtest(); //create speed test object
-s.setParameter("telemetry_level","basic"); //enable telemetry
-
-//SERVER AUTO SELECTION
-function initServers(){
-    var noServersAvailable=function(){
-        I("message").innerHTML="No servers available";
-    }
-    var runServerSelect=function(){
-        s.selectServer(function(server){
-            if(server!=null){ //at least 1 server is available
-                I("loading").className="hidden"; //hide loading message
-                //populate server list for manual selection
-                for(var i=0;i<SPEEDTEST_SERVERS.length;i++){
-                    if(SPEEDTEST_SERVERS[i].pingT==-1) continue;
-                    var option=document.createElement("option");
-                    option.value=i;
-                    option.textContent=SPEEDTEST_SERVERS[i].name;
-                    if(SPEEDTEST_SERVERS[i]===server) option.selected=true;
-                    I("server").appendChild(option);
-                }
-                //show test UI
-                I("testWrapper").className="visible";
-                initUI();
-            }else{ //no servers are available, the test cannot proceed
-                noServersAvailable();
-            }
-        });
-    }
-    if(typeof SPEEDTEST_SERVERS === "string"){
-        //need to fetch list of servers from specified URL
-        s.loadServerList(SPEEDTEST_SERVERS,function(servers){
-            if(servers==null){ //failed to load server list
-                noServersAvailable();
-            }else{ //server list loaded
-                SPEEDTEST_SERVERS=servers;
-                runServerSelect();
-            }
-        });
-    }else{
-        //hardcoded server list
-        s.addTestPoints(SPEEDTEST_SERVERS);
-        runServerSelect();
-    }
-}
-
-var meterBk=/Trident.*rv:(\d+\.\d+)/i.test(navigator.userAgent)?"#EAEAEA":"#80808040";
-var dlColor="#6060AA",
-	ulColor="#616161";
-var progColor=meterBk;
-
-//CODE FOR GAUGES
-function drawMeter(c,amount,bk,fg,progress,prog){
-	var ctx=c.getContext("2d");
-	var dp=window.devicePixelRatio||1;
-	var cw=c.clientWidth*dp, ch=c.clientHeight*dp;
-	var sizScale=ch*0.0055;
-	if(c.width==cw&&c.height==ch){
-		ctx.clearRect(0,0,cw,ch);
-	}else{
-		c.width=cw;
-		c.height=ch;
-	}
-	ctx.beginPath();
-	ctx.strokeStyle=bk;
-	ctx.lineWidth=12*sizScale;
-	ctx.arc(c.width/2,c.height-58*sizScale,c.height/1.8-ctx.lineWidth,-Math.PI*1.1,Math.PI*0.1);
-	ctx.stroke();
-	ctx.beginPath();
-	ctx.strokeStyle=fg;
-	ctx.lineWidth=12*sizScale;
-	ctx.arc(c.width/2,c.height-58*sizScale,c.height/1.8-ctx.lineWidth,-Math.PI*1.1,amount*Math.PI*1.2-Math.PI*1.1);
-	ctx.stroke();
-	if(typeof progress !== "undefined"){
-		ctx.fillStyle=prog;
-		ctx.fillRect(c.width*0.3,c.height-16*sizScale,c.width*0.4*progress,4*sizScale);
-	}
-}
-function mbpsToAmount(s){
-	return 1-(1/(Math.pow(1.3,Math.sqrt(s))));
-}
-function format(d){
-    d=Number(d);
-    if(d<10) return d.toFixed(2);
-    if(d<100) return d.toFixed(1);
-    return d.toFixed(0);
-}
-
-//UI CODE
-var uiData=null;
-function startStop(){
-    if(s.getState()==3){
-		//speed test is running, abort
-		s.abort();
-		data=null;
-		I("startStopBtn").className="";
-		I("server").disabled=false;
-		initUI();
-	}else{
-		//test is not running, begin
-		I("startStopBtn").className="running";
-		I("shareArea").style.display="none";
-		I("server").disabled=true;
-		s.onupdate=function(data){
-            uiData=data;
-		};
-		s.onend=function(aborted){
-            I("startStopBtn").className="";
-            I("server").disabled=false;
-            updateUI(true);
-            if(!aborted){
-                //if testId is present, show sharing panel, otherwise do nothing
-                try{
-                    var testId=uiData.testId;
-                    if(testId!=null){
-                        var shareURL=window.location.href.substring(0,window.location.href.lastIndexOf("/"))+"/results/?id="+testId;
-                        I("resultsImg").src=shareURL;
-                        I("resultsURL").value=shareURL;
-                        I("testId").innerHTML=testId;
-                        I("shareArea").style.display="";
-                    }
-                }catch(e){}
-            }
-		};
-		s.start();
-	}
-}
-//this function reads the data sent back by the test and updates the UI
-function updateUI(forced){
-	if(!forced&&s.getState()!=3) return;
-	if(uiData==null) return;
-	var status=uiData.testState;
-	I("ip").textContent=uiData.clientIp;
-	I("dlText").textContent=(status==1&&uiData.dlStatus==0)?"...":format(uiData.dlStatus);
-	drawMeter(I("dlMeter"),mbpsToAmount(Number(uiData.dlStatus*(status==1?oscillate():1))),meterBk,dlColor,Number(uiData.dlProgress),progColor);
-	I("ulText").textContent=(status==3&&uiData.ulStatus==0)?"...":format(uiData.ulStatus);
-	drawMeter(I("ulMeter"),mbpsToAmount(Number(uiData.ulStatus*(status==3?oscillate():1))),meterBk,ulColor,Number(uiData.ulProgress),progColor);
-	I("pingText").textContent=format(uiData.pingStatus);
-	I("jitText").textContent=format(uiData.jitterStatus);
-}
-function oscillate(){
-	return 1+0.02*Math.sin(Date.now()/100);
-}
-//update the UI every frame
-window.requestAnimationFrame=window.requestAnimationFrame||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||window.msRequestAnimationFrame||(function(callback,element){setTimeout(callback,1000/60);});
-function frame(){
-	requestAnimationFrame(frame);
-	updateUI();
-}
-frame(); //start frame loop
-//function to (re)initialize UI
-function initUI(){
-	drawMeter(I("dlMeter"),0,meterBk,dlColor,0);
-	drawMeter(I("ulMeter"),0,meterBk,ulColor,0);
-	I("dlText").textContent="";
-	I("ulText").textContent="";
-	I("pingText").textContent="";
-	I("jitText").textContent="";
-	I("ip").textContent="";
-}
-</script>
-<style type="text/css">
-	html,body{
-		border:none; padding:0; margin:0;
-		background:#FFFFFF;
-		color:#202020;
-	}
-	body{
-		text-align:center;
-		font-family:"Roboto",sans-serif;
-	}
-	h1{
-		color:#404040;
-	}
-	#loading{
-		background-color:#FFFFFF;
-		color:#404040;
-		text-align:center;
-	}
-	span.loadCircle{
-		display:inline-block;
-		width:2em;
-		height:2em;
-		vertical-align:middle;
-		background:url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMAAAD04JH5AAAAP1BMVEUAAAB2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZyFzwnAAAAFHRSTlMAEvRFvX406baecwbf0casimhSHyiwmqgAAADpSURBVHja7dbJbQMxAENRahnN5lkc//5rDRAkDeRgHszXgACJoKiIiIiIiIiIiIiIiIiIiIj4HHspsrpAVhdVVguzrA4OWc10WcEqpwKbnBo0OU1Q5NSpsoJFTgOecrrdEag85DRgktNqfoEdTjnd7hrEHMEJvmRUYJbTYk5Agy6nau6Abp5Cm7mDBtRdPi9gyKdU7w4p1fsLvyqs8hl4z9/w3n/Hmr9WoQ65lAU4d7lMYOz//QboRR5jBZibLMZdAR6O/Vfa1PlxNr3XdS3HzK/HVPRu/KnLs8iAOh993VpRRERERMT/fAN60wwWaVyWwAAAAABJRU5ErkJggg==');
-		background-size:2em 2em;
-		margin-right:0.5em;
-		animation: spin 0.6s linear infinite;
-	}
-	@keyframes spin{
-		0%{transform:rotate(0deg);}
-		100%{transform:rotate(359deg);}
-	}
-	#startStopBtn{
-		display:inline-block;
-		margin:0 auto;
-		color:#6060AA;
-		background-color:rgba(0,0,0,0);
-		border:0.15em solid #6060FF;
-		border-radius:0.3em;
-		transition:all 0.3s;
-		box-sizing:border-box;
-		width:8em; height:3em;
-		line-height:2.7em;
-		cursor:pointer;
-		box-shadow: 0 0 0 rgba(0,0,0,0.1), inset 0 0 0 rgba(0,0,0,0.1);
-	}
-	#startStopBtn:hover{
-		box-shadow: 0 0 2em rgba(0,0,0,0.1), inset 0 0 1em rgba(0,0,0,0.1);
-	}
-	#startStopBtn.running{
-		background-color:#FF3030;
-		border-color:#FF6060;
-		color:#FFFFFF;
-	}
-	#startStopBtn:before{
-		content:"Start";
-	}
-	#startStopBtn.running:before{
-		content:"Abort";
-	}
-	#serverArea{
-		margin-top:1em;
-	}
-	#server{
-		font-size:1em;
-		padding:0.2em;
-	}
-	#test{
-		margin-top:2em;
-		margin-bottom:12em;
-	}
-	div.testArea{
-		display:inline-block;
-		width:16em;
-		height:12.5em;
-		position:relative;
-		box-sizing:border-box;
-	}
-	div.testArea2{
-		display:inline-block;
-		width:14em;
-		height:7em;
-		position:relative;
-		box-sizing:border-box;
-		text-align:center;
-	}
-	div.testArea div.testName{
-		position:absolute;
-		top:0.1em; left:0;
-		width:100%;
-		font-size:1.4em;
-		z-index:9;
-	}
-	div.testArea2 div.testName{
-        display:block;
-        text-align:center;
-        font-size:1.4em;
-	}
-	div.testArea div.meterText{
-		position:absolute;
-		bottom:1.55em; left:0;
-		width:100%;
-		font-size:2.5em;
-		z-index:9;
-	}
-	div.testArea2 div.meterText{
-        display:inline-block;
-        font-size:2.5em;
-	}
-	div.meterText:empty:before{
-		content:"0.00";
-	}
-	div.testArea div.unit{
-		position:absolute;
-		bottom:2em; left:0;
-		width:100%;
-		z-index:9;
-	}
-	div.testArea2 div.unit{
-		display:inline-block;
-	}
-	div.testArea canvas{
-		position:absolute;
-		top:0; left:0; width:100%; height:100%;
-		z-index:1;
-	}
-	div.testGroup{
-		display:block;
-        margin: 0 auto;
-	}
-	#shareArea{
-		width:95%;
-		max-width:40em;
-		margin:0 auto;
-		margin-top:2em;
-	}
-	#shareArea > *{
-		display:block;
-		width:100%;
-		height:auto;
-		margin: 0.25em 0;
-	}
-	#privacyPolicy{
-        position:fixed;
-        top:2em;
-        bottom:2em;
-        left:2em;
-        right:2em;
-        overflow-y:auto;
-        width:auto;
-        height:auto;
-        box-shadow:0 0 3em 1em #000000;
-        z-index:999999;
-        text-align:left;
-        background-color:#FFFFFF;
-        padding:1em;
-	}
-	a.privacy{
-        text-align:center;
-        font-size:0.8em;
-        color:#808080;
-        padding: 0 3em;
-	}
-    div.closePrivacyPolicy {
-        width: 100%;
-        text-align: center;
-    }
-    div.closePrivacyPolicy a.privacy {
-        padding: 1em 3em;
-    }
-	@media all and (max-width:40em){
-		body{
-			font-size:0.8em;
-		}
-	}
-	div.visible{
-		animation: fadeIn 0.4s;
-		display:block;
-	}
-	div.hidden{
-		animation: fadeOut 0.4s;
-		display:none;
-	}
-	@keyframes fadeIn{
-		0%{
-			opacity:0;
-		}
-		100%{
-			opacity:1;
-		}
-	}
-	@keyframes fadeOut{
-		0%{
-			display:block;
-			opacity:1;
-		}
-		100%{
-			display:block;
-			opacity:0;
-		}
-	}
-</style>
-<title>/dev/player0's speedtest</title>
-</head>
-<body onload="initServers()">
-<h1>/dev/player0's speedtest</h1>
-<div id="loading" class="visible">
-	<p id="message"><span class="loadCircle"></span>Selecting a server...</p>
-</div>
-<div id="testWrapper" class="hidden">
-	<div id="startStopBtn" onclick="startStop()"></div><br/>
-	<a class="privacy" href="#" onclick="I('privacyPolicy').style.display=''">Privacy</a>
-	<div id="serverArea">
-		Server: <select id="server" onchange="s.setSelectedServer(SPEEDTEST_SERVERS[this.value])"></select>
-	</div>
-	<div id="test">
-		<div class="testGroup">
-            <div class="testArea2">
-				<div class="testName">Ping</div>
-				<div id="pingText" class="meterText" style="color:#AA6060"></div>
-				<div class="unit">ms</div>
-			</div>
-			<div class="testArea2">
-				<div class="testName">Jitter</div>
-				<div id="jitText" class="meterText" style="color:#AA6060"></div>
-				<div class="unit">ms</div>
-			</div>
-		</div>
-		<div class="testGroup">
-			<div class="testArea">
-				<div class="testName">Download</div>
-				<canvas id="dlMeter" class="meter"></canvas>
-				<div id="dlText" class="meterText"></div>
-				<div class="unit">Mbit/s</div>
-			</div>
-			<div class="testArea">
-				<div class="testName">Upload</div>
-				<canvas id="ulMeter" class="meter"></canvas>
-				<div id="ulText" class="meterText"></div>
-				<div class="unit">Mbit/s</div>
-			</div>
-		</div>
-		<div id="ipArea">
-			<span id="ip"></span>
-		</div>
-		<div id="shareArea" style="display:none">
-			<h3>Share results</h3>
-			<p>Test ID: <span id="testId"></span></p>
-			<input type="text" value="" id="resultsURL" readonly="readonly" onclick="this.select();this.focus();this.select();document.execCommand('copy');alert('Link copied')"/>
-			<img src="" id="resultsImg" />
-		</div>
-	</div>
-	<a href="https://github.com/librespeed/speedtest">Source code</a>
-</div>
-<div id="privacyPolicy" style="display:none">
-    <h2>Privacy Policy</h2>
-    <p>This HTML5 speed test server is configured with telemetry enabled.</p>
-    <h4>What data we collect</h4>
-    <p>
-        At the end of the test, the following data is collected and stored:
-        <ul>
-            <li>Test ID</li>
-            <li>Time of testing</li>
-            <li>Test results (download and upload speed, ping and jitter)</li>
-            <li>IP address</li>
-            <li>ISP information</li>
-            <li>Approximate location (inferred from IP address, not GPS)</li>
-            <li>User agent and browser locale</li>
-            <li>Test log (contains no personal information)</li>
-        </ul>
-    </p>
-    <h4>How we use the data</h4>
-    <p>
-        Data collected through this service is used to:
-        <ul>
-            <li>Allow sharing of test results (sharable image for forums, etc.)</li>
-            <li>To improve the service offered to you (for instance, to detect problems on our side)</li>
-        </ul>
-        No personal information is disclosed to third parties.
-    </p>
-    <h4>Your consent</h4>
-    <p>
-        By starting the test, you consent to the terms of this privacy policy.
-    </p>
-    <h4>Data removal</h4>
-    <p>
-        If you want to have your information deleted, you need to provide either the ID of the test or your IP address. This is the only way to identify your data, without this information we won't be able to comply with your request.<br/><br/>
-        Contact this email address for all deletion requests: <a href="mailto:dev@nul.ie">dev@nul.ie</a>.
-    </p>
-    <br/><br/>
-    <div class="closePrivacyPolicy">
-        <a class="privacy" href="#" onclick="I('privacyPolicy').style.display='none'">Close</a>
-    </div>
-    <br/>
-</div>
-</body>
-</html>

nixos/modules/tmproot.nix

@@ -476,22 +476,6 @@ in
           }
         ];
       })
-      (persistSimpleSvc "headscale")
-      (mkIf config.services.tailscale.enable {
-        my.tmproot.persistence.config.directories = [ "/var/lib/tailscale" ];
-      })
-      (mkIf config.my.librespeed.backend.enable {
-        my.tmproot.persistence.config.directories = [ "/var/lib/librespeed-go" ];
-      })
-      (mkIf config.services.hedgedoc.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/hedgedoc";
-            user = "hedgedoc";
-            group = "hedgedoc";
-          }
-        ];
-      })
     ]))
   ]);
 

nixos/modules/user.nix

@@ -38,8 +38,7 @@ in
               [ "wheel" "kvm" "dialout" ] ++
               (optional config.networking.networkmanager.enable "networkmanager") ++
               (optional config.virtualisation.libvirtd.enable "libvirtd") ++
-              (optional config.programs.wireshark.enable "wireshark") ++
+              (optional config.programs.wireshark.enable "wireshark");
-              (with config.services.headscale; (optional enable group));
             password = mkIf (cfg.passwordSecret == null) (mkDefault "hunter2");
             shell =
               let shell = cfg.homeConfig.my.shell;

nixos/modules/vms.nix

@@ -116,7 +116,7 @@ let
         });
         default = { };
       };
-      drives = mkOpt' (listOf (submodule driveOpts)) [ ] "Drives to attach to VM.";
+      drives = mkOpt' (listOf (submodule driveOpts)) { } "Drives to attach to VM.";
       hostDevices = mkOpt' (attrsOf (submodule hostDevOpts)) { } "Host PCI devices to pass to the VM.";
     };
   };
@@ -126,8 +126,8 @@ let
       (map
         (i: mapAttrsToList (name: c: c // { inherit name; }) i.hostDevices)
         (attrValues cfg.instances));
-  anyVfioDevs = any (d: d.bindVFIO);
+  anyVfioDevs = any (d: d.bindVFIO) allHostDevs;
-  vfioHostDevs = filter (d: d.bindVFIO);
+  vfioHostDevs = filter (d: d.bindVFIO) allHostDevs;
 
   mkQemuScript = n: i:
   let
@@ -204,7 +204,7 @@ in
     services.udev = {
       packages =
         optionals
-          (anyVfioDevs allHostDevs)
+          anyVfioDevs
           [
             pkgs.vfio-pci-bind
             (pkgs.writeTextDir
@@ -212,7 +212,7 @@ in
               (concatMapStringsSep
                 "\n"
                 (d: ''ACTION=="add", SUBSYSTEM=="pci", KERNEL=="0000:${d.hostBDF}", TAG="vfio-pci-bind"'')
-                (vfioHostDevs allHostDevs)))
+                vfioHostDevs))
           ];
     };
 
@@ -261,15 +261,12 @@ in
           };
 
           preStart =
-          let
-            hostDevs = attrValues i.hostDevices;
-          in
             ''
               if [ ! -e "$STATE_DIRECTORY"/ovmf_vars.bin ]; then
                 cp "${cfg.ovmfPackage.fd}"/FV/OVMF_VARS.fd "$STATE_DIRECTORY"/ovmf_vars.bin
               fi
 
-              ${optionalString (anyVfioDevs hostDevs) ''
+              ${optionalString anyVfioDevs ''
                 iommu_group() {
                   g=/sys/bus/pci/devices/0000:$1/iommu_group
                   until [ -e $g ]; do
@@ -283,7 +280,7 @@ in
                   done
                 }
 
-                ${concatMapStringsSep "\n" (d: "wait_vfio ${d.hostBDF}") (vfioHostDevs hostDevs) }
+                ${concatMapStringsSep "\n" (d: "wait_vfio ${d.hostBDF}") vfioHostDevs}
               ''}
             '';
           script = mkQemuScript n i;

pkgs/default.nix

@@ -6,6 +6,4 @@ in
   # yeah turns out this is in nixpkgs now... we'll leave it as a sample i guess lol
   monocraft' = callPackage ./monocraft.nix { };
   vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
-  librespeed-go = callPackage ./librespeed-go.nix { };
-  modrinth-app = callPackage ./modrinth-app { };
 }

pkgs/librespeed-go.nix

@@ -1,26 +0,0 @@
-{ lib, fetchFromGitHub, buildGoModule, ... }:
-let
-  webSrc = fetchFromGitHub {
-    owner = "librespeed";
-    repo = "speedtest";
-    rev = "5.3.0";
-    hash = "sha256-OgKGLQcfWX/sBLzaHI6TcJHxX1Wol6K7obLf0+CHrC8=";
-  };
-in
-buildGoModule rec {
-  pname = "librespeed-go";
-  version = "1.1.5";
-
-  src = fetchFromGitHub {
-    owner = "librespeed";
-    repo = "speedtest-go";
-    rev = "v${version}";
-    hash = "sha256-ywGrodl/mj/WB25F0TKVvaV0PV4lgc+KEj0x/ix9HT8=";
-  };
-  vendorHash = "sha256-ev5TEv8u+tx7xIvNaK8b5iq2XXF6I37Fnrr8mb+N2WM=";
-
-  postInstall = ''
-    mkdir -p "$out"/assets
-    cp "${webSrc}"/{speedtest.js,speedtest_worker.js,favicon.ico} "$out"/assets/
-  '';
-}

pkgs/modrinth-app/default.nix

@@ -1,97 +0,0 @@
-{ lib
-, fetchFromGitHub
-, rustPlatform
-, pkg-config
-, openssl
-, libsoup
-, dbus
-, glib
-, glib-networking
-, gtk3
-, webkitgtk
-, libayatana-appindicator
-, librsvg
-, wrapGAppsHook
-, stdenvNoCC
-, jq
-, moreutils
-, nodePackages
-, cacert
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "modrinth-app";
-  version = "0.6.3";
-
-  src = fetchFromGitHub {
-    owner = "modrinth";
-    repo = "theseus";
-    rev = "v${version}";
-    hash = "sha256-gFQXcTqHgSKfne6+v837ENXYYiEYu/Yks9TpnfBCPnA=";
-  };
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "tauri-plugin-single-instance-0.0.0" = "sha256-G4h2OXKPpZMmradutdUWxGG5axL9XMz2ACAe8AQ40eg=";
-    };
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    nodePackages.pnpm
-    wrapGAppsHook
-  ];
-  buildInputs = [
-    openssl
-    libsoup
-    dbus
-    glib
-    glib-networking
-    gtk3
-    webkitgtk
-    libayatana-appindicator
-    librsvg
-  ];
-
-  pnpm-deps = stdenvNoCC.mkDerivation {
-    pname = "${pname}-pnpm-deps";
-    inherit src version;
-
-    sourceRoot = "${src.name}/theseus_gui";
-
-    nativeBuildInputs = [
-      jq
-      moreutils
-      nodePackages.pnpm
-      cacert
-    ];
-
-    installPhase = ''
-      export HOME=$(mktemp -d)
-      pnpm config set store-dir $out
-      pnpm install --ignore-scripts
-
-      # Remove timestamp and sort the json files
-      rm -rf $out/v3/tmp
-      for f in $(find $out -name "*.json"); do
-        sed -i -E -e 's/"checkedAt":[0-9]+,//g' $f
-        jq --sort-keys . $f | sponge $f
-      done
-    '';
-
-    dontFixup = true;
-    outputHashMode = "recursive";
-    outputHash = "sha256-9HtTdIotG3sNIlWhd76v7Ia6P69ufp/FFqZfINXSkVc=";
-  };
-
-  preBuild = ''
-    cd theseus_gui
-    export HOME=$(mktemp -d)
-    pnpm config set store-dir ${pnpm-deps}
-    pnpm install --ignore-scripts --offline
-    chmod -R +w node_modules
-    pnpm rebuild
-    pnpm build
-    cd ..
-  '';
-}

secrets/britway/bgp-password-vultr.conf.age

@@ -1,10 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBJYzdr
-b1d2aEtVd3lVb3NBamRwVFpTaTRjZFlCczk4MVIwQUoxWklwN0NrCmFFekpPYUlO
-YlgvVlQ2WDR6amZDN0ZSY0Q3WWtTME5pUmhQeks1c3dGOVUKLT4gWDI1NTE5IHVK
-bUZvUVAvL0NmQzFkY3BuYm1wMjcwbFpLRUNpZjJCaW15SEVDUDV0REkKRXFMQ2d1
-NlFBejBvTlJrcUtCYWZxSDBkbmxIdExBNTU0aC8zRW5OVWllVQotPiBDLWdyZWFz
-ZSBkeC4oTFUgO0FtJG9+RyB2IF1QXGhxVwpJS213MXBRMWY1cXlHZwotLS0gRUF2
-ZkswNlhvcDhTc2tybCs1dldwa2l6SDZZVmNkNUNjNGlkV1ZVa09pOAp88dxHGxVU
-vuFQO6JcroY9MF5Te/YV+wMc3hVxksibMnH1TWGh207prwcOWNOEz2iEkZY=
------END AGE ENCRYPTED FILE-----

secrets/britway/cloudflare-credentials.conf.age

@@ -1,15 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBLVlg2
-ZUdtUlFUQXBLT3B5YmkycWJnMXJyKzltbyt6K2dJK1RBUm5ydWwwCmRUdjJFSEYz
-Wnp4cGtzTXZwc0s0SUJQUjRlOUJlQUoyQ3BETXZmY0ppWG8KLT4gWDI1NTE5IGR5
-QUJzeG1DQTRLUmRwNnNSRUJRSFFtUDl5VjB0clVLYUp3R1g4TEVKaTgKb09tVlhF
-R0tmcmIxMHVHcG80RGxRTEhBcngvT3MrdnNPbmpCTlRyZW5xQQotPiA6RzEtZ3Jl
-YXNlCldSUlN2ejB0MGpyUHYzNS9OQmJTK3MvcXRDakdBVlhuUEt6SFE4QmhnWVN0
-V1JMOE1oaEp5QQotLS0gYW1OMTcxNWJrUndmR2h0ZmRDWk5CYnJjc29pSERUMnNk
-d2VhTGdpOW4yUQrEeH2E9m0YycuW60QrdlRetO1kNU5FaKXRQt46iA9lACIWD4rC
-Cx6WxhCBgz3hvm9x6iuYiiQxZzgJNK7qXcV2MBeQdivazeEbC7blAKVPhwD/dl+b
-PzBDXRXG3c3jMjeZFT69fIBGJfZrrLGKpTALVE4dTVXmQmVVQDTp19IC+jUXHBti
-Pj6Dpc7452s8zPkzZyRbasO9b4PYTwq8IHT6X7ITwbzZZm8gexDYe2SzRZ5VcPz3
-El+yoULZ92WbXPSQIP/Slx4BEZjmsQS+sm0N8AnBRNZkWVbHPF9IZRg3VjDAn2i8
-F3un5js=
------END AGE ENCRYPTED FILE-----

secrets/britway/oidc-secret.txt.age

@@ -1,13 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAyMWox
-cEFDWWUrVzJSM1o2azJqei9HV2xFY25oQXV5SzM3akxEaUJiN1J3CjkrQVhjWHY5
-Uk01eGp5Q0RKNVREVXJVZytndTM0SXNZSGIvUVp1TnRiNXMKLT4gWDI1NTE5IFZn
-WjAyR1RMajEyMnFSYnNGT2EyekROVWNoakFJQVZxaFc0YThOMHVyanMKWldrdlAv
-cVg0OTFHL2loeGJ3RHA0MnlnckN3czF4RUgyc1NjYXVOSXF5cwotPiBvTFQtZ3Jl
-YXNlIDRsSDp6eikgT1ojIGEzOFZMIFc3MUZGCkttZ3ZLNGxucnlJc01kRXFZTGpC
-eCsvRzl5WnFUMUIyTWNVWGk4SjQyN3V0bXQ4VzFuM1RjSzVMcDJkaW1JYXMKQkE4
-YWI1Mmg3MkpjdVpVYWJkczJQMnM1SVMvNkZhOXBDVEZPCi0tLSB3SVIyU3M5RHBE
-VFRtMFU4OUFLbkNjbkJmVmhlc2VsYzdsd0pFaFkrUmkwCs+h2KlXoyZ8U++A9wmV
-kh4N2YyI/a84yPGDNoFdSlXaU8jxUzolnadImXSXyB4CroqQLvGEbkZZlWqPLVfh
-Iav7Ja8=
------END AGE ENCRYPTED FILE-----

secrets/chatterbox/nul.ie.signing.key.age

@@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB2WFY2
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBnMUZn
-MzFnVFYvb0wzc3grRDBrUi9teW1tNmx5dVBIRVc5OUdlcjdvTDJFCmpJL2tlYXND
+YTE4djNQaktTcDRxZGNPM0RjVUJRTUE4cUhraTRSUUxPUnJ2WXhZCjZ5ajk0K2lS
-bVJKbzd2S3JkSFVMdG40MS84V0lPTVJSNHVBQlNXSkN1eTAKLT4gWDI1NTE5IFBM
+eUN1Yk1ydGxaOHErWHVNWUxaUW5hMnBBanppR2owdnRPYWsKLT4gWDI1NTE5IGlM
-ZGo3L2VlNUZqOEE1UHBuMHdqc1pyYlQ3R29ucE9pajU0bHMzamlXRDAKcG1Qdmw2
+T014WmFiY3BtRzhLV1NFaTJMNnZwTkVVUUpnVjZ6OFBGNzFCUm54azAKTm9uTVow
-cUlncDFWNXBOWnpIeDNZSFA3d1E1bjNaVVpKU3lMRjRaSHNtMAotPiB2XUh8eF4t
+b1lVN0RUMkZVS3grYUljRXprdzgrcWExekFiUU1wYnBEdk1tawotPiBOYTMtZ3Jl
-Z3JlYXNlICUrO0cxIH4gaTRoIF81SEpTN0Q5CnpWdEZpb1hZa2t5YkE5RnJFMHVZ
+YXNlCkxEMnBPK1AyTFI5ME0vaUFUVURoTG9ncEFtYWNzdTRlRU1XN04xajd0bUVL
-WkhkQ2o0eWtyOE9ueDJkeGd2aUhmLzRUUGs1aUc1NURIOTYxczZhOEVmT0EKd2xk
+dUFpdmg5Yno3R2FVSDdHVnlYYWsKTGJzcEFIZEVZc2JsT0FtNWVzK3FURW80TjNj
-TXFHN051d25PQmtNUVZkVEFGUVliZjdmZDF3RWFkaEhNTzd3ZVd5N3dlNzQKLS0t
+Ci0tLSA2VWVtOVhoaFV6R3BDRzgzWW1BOEdXVVpMZ3psRzRzcGVuZ0I5VjRRZE84
-IGZDR1Mxd24zOW05bitzQnN5WWVOOGtCNEc5aXIraEF4eXFUQm5CZUdCV2MKd44C
+Cql55Kzze8L84kGF3UKci3jcPIm0iRFAFZOrhEKhGAS5lS4XIQz7dLR2/hCn7GeV
-/Trgg0OEZ89/jqbj56z/Hia1Ka3ZsEv6bXPI/kcRvFDBFTgtvG3KWCgMBtTUHXzY
+d7DZ/I2gZiHvssWIoTnex+BR1RxaJ2cjXN40FfEWc8EdXyXZwkEySyKxDAo=
-TKBPoQqrUf7plH7a/mTx3KR+4Y+yF+1i86s7TzYjD8d1xfFH3BsVtg==
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/synapse.yaml.age

@@ -1,30 +1,30 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBuQjBY
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBpZE1S
-K1ZTUzR0SmFoYUZLdzUzNUt2M1B4RFdPZzFkcW8rMWJLUjVHOUN3Cjd3ZHdMSzdp
+VDd3aUdWTVIyKzRXMnYxODJyTmlqdTNCdUNSL2o5VHN5cVFFQXd3CnRjZEs3NUNk
-OWswditVWUhYNjZCdjV6M1d6U3pNak5hUlZjTHNqSkZPSk0KLT4gWDI1NTE5IGNG
+MjZDTEllT0V1VW13TFJCaEl4K0hRNWNCeWlZSXVCVHBLWGcKLT4gWDI1NTE5IExv
-ZytHazJQWTExMjNkZWV2aDUwcnZjUGcwcXRkZWl0M0F2R2JpUVlJekUKWTFlbkEz
+Nml0dWRlMDM1d1JudnYwempFaXovZVZMYnQ3QzRFVnBoc3Rocm1hRDgKdlVqTXBB
-YlN6dkgrMmFFcmlZMjQ0b2oySjlEMC85cUF5QlA4NGF3blBKRQotPiA8M1hbWS1n
+RC82cUkvd1ZEU2N0Z3lFV2FyOFRWaWFRNitBd3Z0aG5sdkwzYwotPiA2NzNvTS1n
-cmVhc2UgOmlZJFYmJgo3UExzUHhSVi9lbVRjNW4xTnVaUTVGSGVDNzRUNlJ2TnVu
+cmVhc2UgI0xTdSEhIHFwXT1nICkhbAovWitTSSszVmgzTjMzR01qbEk4Nm1CSFUz
-U0wrWU5kd3dyR2phcUNVUHJCYjdzeWhjNVFOV011CmZMOVN0WDk5eUg3ajhwbStQ
+amUxZkthL1VYM09FQnZDRy9vZmxxVXhpYTJBdlpqSHIyMHRZczBKCmFoaWVaSk5G
-aHExT0EwblpreTBXVHh6Zk1HRkhzcmFQNnoyVUlaeStMUkgKLS0tIG1aY3Zadko3
+L0dabE5KQWpjanc1MThXVGpFZ1oxd3IybkJlNEpmWnBoWDFNVXM0eFExN0ZHUWNI
-V3pDMGswSDZCeit4SVhSRCsrZVRVZVkvQkNsQWN1MXFMUGcKcK74YULWqWw9VvkI
+VHprZUZ3Ci0tLSBXL1ptR001MjB2NUxGQzYwUFRsTElTZUk1di9UNERKQUFTNExE
-NH38VHfDPW5ueSiyHHKn8MI9YosPr/TmkwgKd/DOIMVB74ahPalo1QUeg+eaBVnq
+cHJWZXdRClEedBLfmm36+AnKXAe/Ll9awAi6q0eS3m5W+8L8Fry9EWybLRkOIyuy
-Uncsbx5ecW3JswthkAhiktWHcdHmioGD6hCcgbWtfA3VvbAYc2gtAF2plfDVH6BD
+PapzCN03M4oPAVpzbdWqO3HGHYY9lafZSlKx8fpZ4ponbt9fQOeruYqcljtX5Dq0
-c8veai3B15ZmDmq3b62sgVA9JUgbFaB1eRqcaPXmNgQJR4c8J+CZWXGQ/TKMqtAg
+3yXfrFeDhwB2FXCpFoa9ZQgn9rip6B7GtNGCIxbAXpggVZhKtBpxNFDRE0h7Z3Rs
-chCDuczjLX8IxhMPF1gdCggSt5GtMhY47fpZJRbBUw01l8koqjm63KvEeg2ejFGU
++PAES0QSk1tA/CnZTyuG1EVA73jxKCIJyRK6UfBMOqIJnsJPQ6Arc4DMvY0vQ3Oz
-+tXonI4jm2JUxlDTqmNSrVpmAgtPoEPszHc+GsnyNjAz4IXMm5UrQAZyDPgxtwQW
+WQBXeZvPt1hyMUzscLaOWQX/n8clrwflmVaVLAghZx/vReXuZqHWhC4nTPxTwEyh
-ZAn0IdOB8rSL/AnRGUpPrecuauINQjONe8CapijjJPQK7g1AHscfxr+OJD1j2eV3
+yp9+JjmXEjWxKxdxhu1JIjauKo13E9r5wpqhPi5kjzYVFGWZA1g+sBA+oIg9hQFm
-O6TNlz8vKW4t/V7CUf46ykxxExhA0mKJ53ksaXy2+HWoro2+c4nao/bEld5gt08U
+AYPbpJLufiGo/8Q98xOOLljCydWUh7BQVT8A4mDT2TgE6WTCIMiYByZvpOZWtOEF
-uCpJtjPKB64X6vdzbY21/l87VRDyxbb3poENfrXlawqS0Z7i2gAbHN5EuiMv+35o
+j5gNXNYR0BVLgLnxKHFGhJbtxWVQyK6FcGkyKI/45szjWPFymb9561sMHoGQUbYX
-sBaR0BfcbTn6VagC3i8HEEOO964FrW65pkqmGJcJMgUdcZSl+Y7gHMjWyodqGPOY
+S0iofDcvYYzAh0d20CsrKJYne7IY5SLVPiH0jaLDQbGldyaS+qDwJQVZ2I9hgpLc
-evT6xj4iyeM49vXynV2vrJRu5rr02hOS/8rPphV9c9q9ju5n8xbhS6IiybAelPwt
+i/swzvoTheecWfSpXdQNMIeGbWDnIBmKGOAZnNKu5U7G9eGqMg82u/zTzy5D+9aX
-sa+xM+w0n+fxVksiXeFj7qD1LDN4+kwqhYP9SlzbA4fT3AkYYrxthTww4IFAweyQ
+49beIm0B//Z10FbaB0mz4ktOBCIEAWr1Ee7wWsRoPtYwj7MYNGIz6XvjXYMWpIDb
-IJkpVL0/IZEIEfRzpr0lWLprAaoyPc64pecl0z/gBJDgz1kSG6iEh6K4qx7ahGde
+FaI8ZnMWiFr1onduD/23SzVatVruGVrWIpL2ephh9bKLjtHpXTIakhEiWvCp4zp3
-kBBpS2I2ZsdBkvmQxDSM7tYYBzPxcUNZlSFOIeUy3Xl+OGPlKgtMofbnjV8AFqUf
+A7UwizVDCr7crRUNy12CCeAd25f1NSLBf54Aps3vYOF7yYu626GvMpE9sdKETL6m
-tOpgKpLUEkTgXbGUKBxHLj+8pbw7zOFp4sJ00i48ZzLP5D9jom+jS19wGshRc7cH
+09YDH6C8Oz42wJx7gutX3EgvmNaNzxnpmVOf4vG92RMekPfCpB9qAkKxkaMRZf6b
-dK92CctvrfndQ85yO0vqlyOdMTqjh/z3P2KmhL5SW6P51q5mseTvj7FNM7331DTs
+Pp9sdXd11VnFOK6swVMIxs2ZOQ6HvQZsMmHN3sh1LP0T0kP3idhrsLZY5S9oy86c
-rq7XWaBLE61eWWQ/dZKnqh5YbkSlU1+08Rl6H/vCU5hTC8fht3KTQSWPofkrP+5f
+7PHZDcHNKgG6xsyrudeMVF9DdHCjxXAgsTN3OVxyPUJYsX2tPpFW10++FokUknFc
-We/Pe62LyhV/MbLRA0nmU7Sf4IAnpHfa4kLtlYeB3xiqKd0McM//qzjuk5NoIgE4
+jfVrCReyKXCQghRuJHrqNtyINEdCfUfw/cpM7nfukEs24gDdgZkMtKUgjowHCSr7
-nL0T8YXdGt8K01w+nt+j5bo5gFoRz5+1/ZZ9BgN2DOo4SClYnJWQ/x80X061yJ33
+Q3xgC20nbRss/w1KZ4foiQaDJ6H6Bb+jQgqwt992GEq0vwAh8mhe/WHDYtNXOLtr
-0SGv4eAC3vFi6xE=
+dvOM0D6UTNrn4083k1g6QPE439K5zTKEWtTwHswx
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/syncv3.env.age

@@ -1,16 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USA3MEFh
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USByNWdJ
-YURySHY5RjVQa1c0QmMvTkZtZElNd1BIeDFpR1U1YXZ5dndnclUwClA2M0ZYMk90
+RTFFKzd0OTRlV25PSTRWYUx3WjZrdW81aWxlY1lOOWN4WHIreG5rClVvWUUxeWEz
-RmlCZHVISkxZQTZXeEhZVUROSVRGRVg4TmZKZytSL05FcTgKLT4gWDI1NTE5IFY2
+OGprT0JYMFpiUERuaExRQjBqZVdscFhYSTM0c0VycDBab1kKLT4gWDI1NTE5IEdk
-V2k3S0VQdGlQZ0hkU2ZoSWdOUG9rQ0p5Ukg3ZHU3MXVvNHlWYVN5VVUKcWtoWDJh
+NStOSTVWV1NPeHlJdWFueDJ4bW5CSWVJd3JaR1dxUGQ2Q21XMEJSQ00KSXFPZVdF
-LzRwcktWUGQ1bnJvRzVBVlpHU3NhdzYwUDBPTmx3MFNrdWNQYwotPiBKQil6Km0t
+RzhqemJpNS9rOVUraE1WSkk4NUlPUjNlR1ZDUWRYOGZYdkZLawotPiA3T3IyLEEt
-Z3JlYXNlIFdlRTlUU2cgVlxLIzUgJlVyQiJ8Cng3NzF2b3d6MnlEdURQWHgrSFJv
+Z3JlYXNlIEA6YEJZKFg3IF9kCi9tZ3NjcGFWWkJxWVBUcjNjMUhwRXlEMzJyUFFj
-Y1BMUkZyelJSdDJvUUUwY1k5R3ZBMnJaa1R4NWxlUll2azNseW5MQlpvVWUKYUdN
+QXhPOWMwRjFjK0hYc3V5Q0QxTVVRWTVyNnhtQUEKLS0tIGVmZjgwdVJldGNLMUVm
-d1ZscXVxd1dxSGpzMjBYeWhhYyt5ZlNkSjhmV1ZTTDBTCi0tLSBBTG45VUJOSXZv
+VE5aTzZmd2t0dSt5K0YvZmRYQ0YwdlgwVCthTXMKEFtExlrGEJGAFdM6snloZLA6
-N3lYNVlyZldMVkpZdUMvS21NdSswVmU3VThZK2M2eis4CjwfWWJVR9Ty5dBXEr5s
+r9hTjFJDR2bPV1qWEMXt2hFCrESx87KNVwoffF0i1y5704HFmB9fF5IWDVUDLrY3
-U+QrifXvyMJJvqOKEfMYYomFLpt/VtbDAUwNlqLnFIk1VZ2xPUBisXPtReiCK3gq
+1168vGtlxTePkp8NHQdb4k/Eda+35vaONf2bi2YIi70XPVHzKxZIaRV0UGrNAAbO
-P+i6bUONSmPYvmF82VgiuKDuz/kmWqVGg2iSBPIXAGLNIEojndQwmhnrsN9ex4Xy
+a+OL9tjSsA6Nyusp4X+FOLcwMIe7AdVuUaIlTnfAcnEWiUrCXoaZPCVaE5aDdGgA
-lBHkvVsN8EamUJwZ+FEZe4+PjA5yEnANWpeTELOt2gA92/jwwnNIsr07eVTlkh8X
+PSeRNQQncqVBwp4m9DbGFiD9mExMYeU2H4a3AVE3ba165an5PkSi1EZHIO+urHIy
-UmQ2owGwktXP7it6//NV3C7sAdazs2bX65WSnog2E8WPNAorKWI8RCYs33CshVFt
+qU+NiPFUjwgzaQ==
-zzclZ4hRmlAmqMHYqFY=
 -----END AGE ENCRYPTED FILE-----

secrets/colony/borg-pass.txt.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBoYlRq
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBEUDk0
-ckk2c21uMVZSR05SdlJpck5MT0FZeUpLTmpTRVN2WDkxWWxmVTBvCjlHZWtEQ2Jh
+TFFzYkd0Ni9HVThkWnExNmMyUENaWHZMK2NselpQZjZOL2VaNWpVCmlTVHcyZXlu
-YUdybjJLWkNsZkxabTVIR0JnMno5YlMvVmhodDU1bktrSzgKLT4gWDI1NTE5IFZT
+enFSTlAvV0piN2xtcWg3Rnk4NWF1cE5kaExobEEyU0R5S0EKLT4gWDI1NTE5IEFI
-Um9lWXhqRFFLTWdNaTR3Sm1acmY4N0l6WE1FSW54ZEtQcEE5RHBRRHcKcE5KYmp1
+MUFmM0RLb2hSRmdZQXVEa3JpS3ZiY2tQeXdFM2VIQWZVUnhZR3k5Um8KZHg3Zy9y
-WVdCVk0wMHZ2SCtUR0xKWU10N0xETXlXZmgxcmZZOFBXYWtBawotPiBlRm1gKGxU
+Mk52NFZ2QldTY3Q2WHNUMTZmKzdSMTh2YTVza3h0aFRQdlI5bwotPiAldCg0O0kk
-LWdyZWFzZSAqXF8gOkU8Tm96IGA4IC1TCjY3NUgKLS0tIDhjaTNrbG1iQ05iTWRS
+LWdyZWFzZSBEPShYbi1jdQpNTlZKamkrZ0I5em5kVXBKdldST25wdGdZYkpWT29s
-UzIvNzA5TmVGS2ozZmYrYjlBY3J4Z1RRUGRNeWcKUTIEhWqr0fOODu86MDll7k3U
+emlweEQ2RTBqU09ocnY5NUxlSjhnYVpOejh5Z2JHZ2N2CjZRCi0tLSB5cklPZmwx
-ThgmS9nlcUY3fMgXzZLtpHIJ/4ZSI+miu8RmLMaeC61qv6xNThGdx+MvU4tMBWKA
+b2FGSnUvU1Z5WXFrZkZEWXQ2b2pVY1Q5cWJVL2VDb0NlZUVNCox5BZhbD6neHv9K
-Hv3XGi2MYL1jdHh2KYg5PgdqchYuHrFuBPS7c/tQow==
+usD6g49XWn+1VYO/KDMLGiTzRDYi0EhGAUI7qjR4AoJ/8+2xAAPuohebavELH0EX
+dqhddaHLJaSgv/4gPMYMn2K0oo7HX0+59MvttnX98GEP85skMP4=
 -----END AGE ENCRYPTED FILE-----

secrets/colony/rsync.key.age

@@ -1,82 +1,82 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBZVkFh
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBlZmpZ
-RDNNZCtySlNQTTZFbzJvZmF2TEZKVUM5VjFjQWNSeHlNc1JNZ2hNClVac2pEdWdw
+MXNjQVFlaVhrd28ySkc5S0ZIcmpvU0hQUzNXVTl6cjBhYThWWHhvCmZmd0pPWTlh
-OVpOTmhWWklVRDA3UzZWWk9QVG1ySUFmTzRSVlFReVdFVFEKLT4gWDI1NTE5IDVD
+N0o0ay8rZkxrdmxOYy9QMDh6bFhPVXFOYmtRUUNnYkZTMDQKLT4gWDI1NTE5IGtZ
-eWN2S29aWVNVTTdldXFxZG1vWUNYK2RrajI0OGNGaklzdFByTzlPUkUKTmsvdTE3
+RmxYNVBFL3Z1UVltWThwVnhMaHhLdjdOZG4xVzhxYlhXcXFkdzVZbk0KYVVLVDdV
-ZFBvalZsdENxR0VnV3FVSnFxTitBRlFWR1BzcjJWd1h0U3hpYwotPiAyOkUlJC1n
+bGlVT2hhV1djSmcvdjhJOFR3M21TbDRtS1lhQnp1Y0tab3ZNVQotPiAvVWRsS2ZP
-cmVhc2UgIWFOMiogVDc8IFZETk9BSDVTIHEKQ01rc1ZoNXQxUDdtWGRQUlRCV3k1
+LWdyZWFzZSA1R2kkfmsgLjEsIHNDMm5TIG1YKgpXN1BDR3dYOXhHV1VKREhBdDRX
-djNZeEtOaUl6Tkl5TDA1S2ZXWTFQZEFiV2pWMDJpZ2dkYXdBOGhSTVA2ego4UnBz
+cVg2YlhVTjJJbGF4WURoL0drRXd4VkoyaDR6NlJrRm5NUVl4SmowTlZ0dDF2ClFG
-ZGhXcklMd0NVWlhsc0Voem1wUzMyREViUllCRAotLS0gMU5GQjdJaVdlUFJGMG82
+NzFwT1NTc2hHYmlrcTZoZXN2VmVKbnkweFl6U3hSazdKazl5YVVKdU5pNXY4Qjcr
-YnZCUm05ak9qcmVyUVJSS0tHaWRRTld3ZkNPMArRgojrBQvlyjMhChn8jgUNDysj
+QQotLS0gS2ZiQTl4aThCa0RYVXdKNUc4SlEreWNHaW0ycEsxUWJaVFdFZHl1TVpy
-9Nh3BVqf44fiUNMKARTrFTz3wVMlioo6MmKRzJ/yj0fWkZ2h80X68Nq3rQvy+0UK
+VQpFH8YP85+5wIgkxKat6/Wq/X6t83nC2Aqcv0b6YkQh5rmtENSltIS0mlHRpsdp
-4PNPRbwY5ib0nf7n3itFKjehrYr8HnOjreQps4it52bT5re2TWIC9ogZhNKBLRvB
+CJ/pSrNHhkbykyAAC7FsPQbQSjasERdS9I4ycUn72EnBakfJvN11uzbQybEF8T1K
-qv14HjcF5bGnia8TgSU/8nUZJuIaLwHvS5sc9GOtmV4lDwiSTEJQEtGh716Jzuvs
+CjVBmZy+b2MUU/+75RqQFL437Zl2ZYaCTYSH6T033J2ogAK8usT4Xyr6hBI6dtiS
-XxQLPEVVufAjZUKLp+jWUhXGkvUEeY5bxE2aOLuB8kLfHPC/5p2rl/n2sW3oEDFn
+jaAyV1QfmuzpBF729lAQkPbdxvlG5j4g18fVTkMGd0t/YWG8TID/KscJxNg63NaW
-Fw+XcNnCHWBzk3DlzKZFXwIaZL6Ocqrt+p8CBpWoNhbssuKyOtEbWQOmJxX3UPMt
+2Ijk6cLI8yi+PK6udYuA2Z4rnfCpbsR/bBccSng5K8r4U9u4KPfYeh0v5YeMHKZ4
-sBFNdKSKFhoBQ4ukqkKDhgcm0i+8wG4eBbNIMIDwzPBxK0QiVriwlPQHl7RS2M/J
+0+gG+D4vBPKBRk6nvruxRq8VgQloxB99d18CsGilAcpski1Yq8/VgHs6rvE2lx3k
-LgGeS7qrKC3SgmLu57CdUVUlnogJ4oOg7FPh6x+jQBIIv7gtYCzJb040TUZWZWvi
+N2DohlIIrdO/ZQpF0+jFvMKTeqNZ51Ho9vDJtMIrH2ZdcpkoYiUEidFX2RJrvvS9
-cfKWBBwLqLa+7Y6kEhcosLUgw2c9Et5P4rvNjU598q7qrZq7uK6Mr+PMwD3Pd66O
+YFyaF5UAcEAUHvS1/kukd3XgW6rYzbj6dUrODj3lfQS2+PcOpdAXxf7gTRREZ+3R
-SQyT4nYhhXBnaIsLXZfima2nRzPocaBmfsuXQwlnLJC8JB6yzqEViK0xYKfl0fIi
+O1ijz/6R+qudfQMFWuboMNxg2CD0We/76Vs9qPLcKB2T9ChP6qWGUMrACYA6viC8
-jxuYBw/8Y+MWQhIkF1pP8z+Kw51QdK4CIV33mlLBJnGjlizewsjj04EIgpzQ0+3I
+3p1i2tBk00Xc1YAWe1IvoMKJ25LEHMfGMWJql2HJOMuZ3xUdr5J9StZ6FA6o/XQO
-ZRyee/SzFmGBBk/pMGN0DizA8LS9yZ9DRGrc13rYVUTN6G5xT5AT1eEtFbQ6DH/n
+0gwftRdbY7P9a1j2wLo85L5yCQHKVLnF8dxQS1CdQfcbrlmSFgrMwgINlMyhPQoa
-q13Tur4QJ8AqJmwv1cnX+faH61dXahfbinveXWqB5S95/HE3OGnZfAiS5bs1jW4U
+bU6dermKLoDp8JISIQVe7tksez5qlA+Hxa/8VVoaQxWnUpqRHEnKNsr1VRawNy7t
-D3BLaBiFMYD+ccPedg5MLXRgEryVaOWlQ5wuXxqmaCG0KS6YLxl8o0bRR3lKXNZP
+St9kpnQ0P9gZLROh1LJCMB1UceoyVb0/dEUVd00gofxMu8lUrrCuPM1yW37nSfMV
-B7Ye0Px69aYtOs58dTOq0Peu039Fi5iNC0beocdKOjig4tZ6p41uz0jPGMUoDebZ
+ClDjFueTR468s+pLcGhwwvTPACgz7xQlvBNAZYzHobCJbwOZXhSGS5Rrz2yGQ5W3
-MYHax+a7Qpi5M6ZVGVpF1ieW2hqnm0lfb18cEYHuXjoI/YlgVhFPCGSzHJpuNiDU
+BYMbhWn9NixlXtpdUZeh21eua9HjvEo9Z9W8HFCT7KJBrji8eVwSuSJSSGeg0m7D
-qJSfOuD8HUB2iXFeEgAi+V3EKTsyjlS+R1zWxkr2awqAk7Uf3svLGWZNINHNoJRe
+BgNFRymNW74P5zf2xB8M2IouCFVdZHTitrawQjVn3vAsOMzUlyN/X7g9jq2gsII6
-CPPANHzTSHlNPSelQ1CyOhl0W/eMCEJuJ9/6kZsmUC3zvzxEMGofG+Ub9RRBW/+/
+Hcv0USJsBQ9P/RJuHQfrCKP+/yJ0dntbLv6dC8qPvAp0WMaqCgTtkNpJAZEypEIu
-TkrVvMrQv7/Va/4dxMPCqrdOQ+3/LkVzGX7qg6tQR76Su0q7aqh38Ki9qWY47bTm
+cQsga4UkNRJ3evei7tuhb4IZOhI9aaEWTV3Gqsa5pNCxSdkP7qMBBynALpD5Kljf
-lq5I2EcQApt/O1cGQJTFowdXVJXx/qQv436p/jL1mymQ8241iQ6XX3DUjbnqdI33
+h0FVPu3oll0BuCGz9+LiuPmBxQy4kR0IqXo7qOVCwEEkPSU8QwjcLBSP0Ccjykj8
-4XcPa/B7naRkgSG1Z55Vv+IIBOzcjzUMzeQVP/WM3SFRNYT79mJnV0SsKvUFtUOM
+qWJ3sYb1sFjCpzU4TQhXzt0jIzpMfgjQFSntMRahtKq5lpV82M9eafP4w0wHc6uV
-1OxMGEx+ZxfNIZqdp+qo0+uIU00ciokldh4URo9u8EIHjFVcV3Eyb7EbbCxzDiU9
+tr8w4UfQvC16dWF1hULQhi288WwR8UHTYc+x5ecLKx06WI++QnG8EJ5K/sA/cggd
-iwoAAaJjwBlyaRQFWYsKhY2J3NEay142WAyAiHmnNBNhZM9TKkCpjton4ehxeRUC
+wsR9aWejw3/6dDOBo2El77K6j4EcVPKvyYZp0R9d4zOWABVToftIRN1VJQa+9e65
-hoXpzh4J2lMhdcmXXZ675C3MYiLDpajgLS1dwRp+mAUXwjvQG5rmJd7UWdgpbdpJ
+K959sDtk03b7kc2VI7l8lUVjcMLqkRQVK5BYVqRyYaIntGZVt7iZaH0Ab9wjdCem
-K6wABNkl601XgKv3/nV9touE0KQjHg1fzo9vzmf8zVEViTgXxH3NECZHctObwgoo
+20TsKHl8P92lZ7TbHOihHVQAPIZO3FiDI9L+ezpGTBJNEeRDua5g90rse+/uHbPZ
-SlbUOW8vihCi2HU9G3tqH7dwkUsgB2a22JFovgwwW8ePKJQpdvwAV/jyFMLL6jyj
+6z2kUoYEyUxb0d7dqApOIb+udcP7gMecOqcYsBRnV7v0s9T2Cc1ePg3Tg3kM0V9E
-6Tf0Gsc/Iut6Mh5TYiTWJdCzvEBjcybOVnppj2zR32/A/vAXUrJQaq0kwKkCwG+e
+se7vMiWz6/SuJcDEOIGb0RjK8nLHnqARduph1LUkwOs0psoiHq5GvlVHPPK3F7vO
-TL0hAQuA2Su27qTR9Xy2QKpQ5NppRH7V9YxCpjGfcLbcCh7XH7AEZaYfrrX8NoP5
+jOpLNliRun5kj5uo3rZh1xu8vm8nQfpCnr+pBd2KjDBNzcTO+sU+H2s7Ewsbsrto
-zPalFA+7E1IuDRtT29wFNRVb3lAet9t5q0LUHf3x+Qk23dQ7Mdq2JIf9RIo5xZ6X
+tZNTvXnKEBiTg7fe7cqQ/E5hsHlQHuCg2AWbWpFSLeXoE0MQ4LNNdx3s6WSjWzAV
-nsKa9eBQ0O5OAv1VGWVvbrVCMpmyiklYV2rcIT+dbrhrgiTu/BvODSvtmeANIkhC
+5Q9s68CjiHUOlG+4HJDQ4DxCeSnnItpVHau7DzKLE1xCU5vF7TxarxObZ5H4VjGF
-uF112/+QW1UNPCENioYq9OWPcEwby+s9JkQf5nTub2o/0lTFKJxNgXa1QBcKKVyC
+dqYZWYjJ0qtdvNjQl+juUeZW1QdaEMnqFmI/AL/SfbkMr0nQ1YXf3mTWn3LwvCZF
-9aTCRhcxXsfuR7YzbCXRcK2hUW203iS8+UgAfZBVe5GhskOd0ZR0WSkse+jGzPqI
+VAPZ22HtSmH5kdM9Uh/hyH2rcktJjKBVcdlBUB91/VkahbCSxwM1GD+VFtMYZWpf
-tnH5F0yQgLn9emebpL6dNFUVvssjpiMlvkijXFJv1tWSKLb3TxJd2BE/w5Zj7Haz
+SR92qGuElKPVTFy6h7uaNb8ca3fYf274dI9fYDso0liFs9KA8wZeNnOHccuuVGH9
-iv7Wz6o5+bY4v2YL2Ev7hGzfSaef+ip7/BYZ9TGuzSoZEHMYa7dNT8kRR18IhfXv
+EM/p7cLFU+G53ls0/uOfs1dORaY1j0vty7ujasbPHvbe+6BOH1hvstwfF6j0RxRx
-Y3wa2xlOhB+WE3AjtYy1oTi2c6Vmd9UKASZy/Eb++j1MSPtxZQLNaj+svCmqqfvO
+K8W10f5/jPFW/3hpdl48zOdlp8AyXBHKKLCVV7KhBVmGGvP71wVDY2IhiV6Yfqgw
-/gElVfGlgkomYwc2EfJvR1lt9u9YGepxKrafPsgvjR6bYPwLF7eHKkKyEiqGCYnW
+GOLy31dLqLnA3yQb44l1baeVdpDlOOASaQS05llAcSmIhQr0kzlYF+IUtjrPxDhA
-mcNJz/B0egxhFjoGd0U17tNuZcYRD/Tsj9ugGF+4/q+IaEV2YzZTdGzupI3lW17o
+YlKSbm6qIMERKO988DyGCAl8/46HAEx5AkeKlrxvyMpmMVZzOBN5k6BCnuNToA8f
-Q4H+EksxkWYDr0WRlYKn7VT1gTThuggEz77JskjNP4jK29EOIEO9IqGMh39tXsud
+zpofXdg0Nyws95+W942iH+62DzSVD5q1UlawqAR+8ww2/guk5DE/3BIVx5+ByErk
-mhL2Z6XMX6sgxSjSkYxLpFnS1mRZ6uQnSptxHTfnG6jYhq//MTjGX7xmYBj5EoTC
+NS3/OqlvN20/WeJrtHUGj2y+4QRx1brPhHDEQzHh4GF05vE0+KB2hDBajZLTCGBR
-duHuaCqjRXc3yHWoNm8jepkpbe1PPbwEbL6RDK16G3g0WVREjZopj+66C2xlY8Bq
+mX+VJad3EOwKKEhUs5JmaI6+O81d7lbEgXOHjqAiDW0h90bLvcopi4W+TSBW64az
-ZCmHhud22QHs+5r1LLSIynsUlGIOvq30DZ0F2/f9Gm7uayIYbp8gA4z7M7RjmHoZ
+MHOx8O6spwy95wIWVCYtlbC7eUSBjUbc1VkSVLFFgXohZDsbO3Q1rYwp0FwJ22V8
-+XHYSPc4kH4a3T9MucQQGzJMl1k/bifBAWLbu9uPcDUe7Cglfz0wHnPemOu8HZXY
+T6dOMMb5v7sLfKW4vbLGD4xm90v1DicjmMuON5f9XcLuUNZrX3U5ZaTay1xz+QPK
-6qS1n6PAHyyGlqX/pNWxR2vQrHJRksdTCvjl4g6256PhaMDop3QAHuQj9meYKIqP
+NwHUqfV9dq6+eN8FR+Ik+1EQYpzufHuSpD2YdR/7ioCqnldCHPwt0/ybsHbfduPf
-MiZexiuOW3KjPJ30Gx1Q7PnUc+w3SjjsKaZEvRgeWKa37rvj1ICTnBQUPq2HV6y8
+YPFCjmBqTBgwKw8lUejqElx6nXmpvSv7/qmyGO0pZMmQM37GMrLStXrsT9lO3mn0
-zaGnJcfd0ENAmFnRaCIbdU6TRonnIAAuSfE2gtLni/PJbmUpznuq82W//kxvH1tR
+vJSwJ0+2844AV46c35L0lxcg9Ew33LE3aQqmRFLF9hCwsTu92RAvIWQWV6heqjK1
-oPx6LuM2+hRncMoyXUTWSUVO1DAUPXgZA+j7fkkwmosi14d/5xe3wO4U3dGZ6wAY
+zmAbBY5FQ3rprVvMsBx9eKaeLVIM6/PCL7gdtsAjKDjFPRiWzsWbJL1A2/SB9J8g
-D+zlzhq4d/4vIvLIL0NoBcp8yM+xWxPTtvj7HUJ7BOVV06ICnilUlv2wjR+dZLZK
+/k+VZyf3+Kz6i1xiFxDN5eKlo7TZCG2qdqcf+Hr39c7aPN17giCCKUAGXShUytWJ
-DyjWhMoqk8r2TDZbAQr8MNX+sSlp1JxQEgBijpqBvRdF/ulqraF/GFDFRLcEi7D+
+YVMUSKwCQ7Utos639oYfXe14AOEEyeJZLniNvk2YTC7I/bc4bRb4DN+YcVkxmkTg
-AkHPg4TrmaNB5ixsj72j0xruFJxgQJGj8fwQtemJGu8QcuJbCvJ74TI3vu0Pac/C
+2yzGYugCRL7xc8XGfPeUsDCrg//WCl3dVa8gJxJYREHKPLJFyQdsMvdLWBP9xY9i
-MRov1TAVJB7+iVvVNEgCMlzimJCSCUYh1Zgk5Ci2CDFMFRAEcGoHywIW6v5V8j5o
+hzadXEaLuu2G1pCoJus8dpl+8A5VTT3hixiWsspDKD6TuXPZgCSnRYd0bBD7d2bo
-v30mJKZCVFc4Yibivjj1aGhQVO72vgiog4L++i7CeXHIu6Fe1Jmlve5iuxrQA2aM
+cjIkir79OU5cYXCVyE//URLTOhPEIAKbg584PqOoG86bN/x6fJfQxQI8YxduAHQ7
-9vjCbFJIi8k5vQTVcKPRcsto7/qbyxvWvahKBBbHl53XnSb0WtLUyTEaXJ+0l5gy
+/v8bLAQ4SLpSWshQoSbvQw+kFbYd2+2+s3h1gL3ioCVTgfsIaBsWHRwg8snrV+ar
-Epxfl6ZRNkt+YBYBqCZL9aK6TNpCR+zTC7OhrKcZntqFYCeRB25YEfc1z0lTH4SE
+r0Vjiub6lt/sBQyqdcUU4gnVhYHI8XXR39D3DD3SiE7K1tijep2Si3ET3PVTOqxn
-TPymGSMOeUX8YEIr+XNYG0H/I7ZtEdNGBEXaUrC4YUNrvojpq3PS9bhfLhAf5D11
+e+/A/irESg0u6uJCktptrRL3EF/pyfGNQV1LQME2eQjja7/WmG0Pi2fDEIycVWoI
-wmI2tS9cqxAuS2zkaBr9Qo5xNEVsyGNFd1K0q0JJosiMnVZDzOA4wJTYhOw5gwcW
+E4HH9jv/cbLkZBbct3R3EreZWRAsoM/Y7Mnnha8pj8Cj5iQGNKHkWSufhJrTtMNl
-T1Kh/LDvK4RE0CV0jRqN81YO8V6Jq+/c2kgtwTLzrx1GCcdHRsY2kPhCEWOTLKb8
+0OlVGDew+ikffcazhYZDsf7GdlnkY7+o+UHhGDP7sKGFYVKZ6oQxKrZlNJNttNyM
-Jn5nyyvOOjMIkAEYYqoRRxl05UbNWNS9SuO2g9HF6JpNJmw0cmzT8erIIjVvaUs5
+7Av6S+w1Bq69pba62AxTxJ7jO4gcSQiOxO/6IbsyCtMcTYoSXwbc5KKWrdapRYJT
-dd0Bd5EgkkLq3RMPNTiidQCyIy8QtoElmxYfM11mbf+JMgxsB3sDcRGN4lauUhho
+QBeUDQdMtzYnVQW8wIUfmcE9x8aU7Ertk6cO6v+VMYdXJfw19VS8zuayB5ctMxQv
-JlayuFUfrQEwtHFwyULiJwUC55faVqOQzyvcQ8C9AJezDXS7//ku1kvEgbzK0nFm
+AingSZIFy367I7Cf3+Dc4z3U4UTWyZwyrq4faeUs58Qeqa83Jf0lwuTYDESa2Mh5
-3bCCiuog7pG9XlldSReYvlJtnqTmp6E5+m9YaP+yB2E+swKBORHkbCfBu1CuX6R+
+DzOLX5nkQnOPRzjjGm3F65fgHPfSI6lliTTD4cBqXGnzSSVrPUq6ss2UqMQ2N0yo
-aryBYIDeLaIiJs5GWJN//37TT0hVUCipY9QISfTiZ5tIy0aNKRu9syjWphcoTJuv
+s4CGueS/jvrPbO6t7sdtUTnlm/XMqFOtkB3XFDj3LDi/S9IdRkUVAsnAMqDzAog0
-YBaRxKNdZs81ppFTa3sXB824+QXwzRJJPjBndXOtyX/a2U68NK3dqau/A5190VAn
+tHACw0Qbwk6peWa9zVLQzlocATqQtuNmPiR58IV1w8o4F1laEKj8b823WiK8KNVD
-bn7jnJ68rhcL9ewwydQRm72qwyxBbRHFXnEXpkJhzYRw6fosglqbOJMxFiy36HWD
+d31mJ9z62VjBM31DwHW8dHfeiYgAUTXTAs6ch9HLh1antavNXAsJo1sCw6dgniS9
-RkVluvTInw8Em/DhhWgn+UrxLlQN6JnVdpkT9hwrlFWooiM56UKAPO2a1FM2XKXe
+UZfUd5vE4YYZRig7rRuDVTRIjdP7KPYFOblnu3UELKALOiQWKtDwS0K62EKDBuPq
-TqsolY07uWnA+ouiljqIpsaFlVDBcz/sGZWqy4aKKPBTcZlreW88PMsS0c9nixVi
+G/hZ0wO8Apj9CPblytIhorTnWyNHifOyoYdBivdwklikck/jxY3c5SR1HXQtvIas
-nKnmI00HuzeL85zVHGo0IKYfktVVjuZNPzJ6+w18XpKIi8TxHpxELC9M2kVOCnuy
+GbGSwJWWA00V9Mg3/hmG7d6YGXboBQcDd4RYBkT8YcWmspP56YxHRQZYEX1rF5Wr
-uwuntJlRty+GpXVvx2VLi1wBKyLpXUxhyg1tSi2sZyjIdVt4yEOKfajZYOp73JZx
+m2EL1BlORe/5reJmd7e3rTCUax+4TYppLGMDB0CbxGsgfDuC8NEbpAav4FGBTrHL
-IcInD7Cby9olkMsa25YhloljY8YELfW8EWutF13m8tsjGP9c6aOuMIXhrrpwLgYy
+lPwy1u44BWFliV/+LlGcuga6LkM2TvSdGwEuXTuWuUIhQ4BRbvljob96/x/wiSMU
-E27iFh9tHq0mjCMibwQnHld7Ccd4OqO4AKfPofHDxWoY9+ivArOBAXjsCxhxWWWp
+za6EavFLbeKkRiKH9BBspJCoLMoVBDwL+jTc7gz14zGSDrBQFU1J4wA9YY3OZSCR
-aLqLJz+JH+idcsVDlw8jJzFW6pQFbM3VxXObvCg9ou5+P+Pc5XYyALJzIlmoOrN+
+QdE8N0RYlKBkrpa+qsyAVxmbIZHWT0EHAFMBzZheOPagVCD6PsI4SWtjW/9tFIXj
-ns5Z+U/2XKGyySQASUyFXUNml6csSrTd+ejz1QvEX9POU1nLmvS1+aojgnptgdpn
+8L2L0nimhU5USEHbfGzGyif1mhN8bNbTFgY2rfNa4H02g3g0pn98jCI4mMuLfxLY
-sAtksQHMt1Njo1oRug3+/0iC6XWEig==
+QVAXjJZZOtMpICIxoD4ejxyEkzOUGtAP3oxOdoXogU0iQJkhLerRWZF+dA==
 -----END AGE ENCRYPTED FILE-----

secrets/dhparams.pem.age

@@ -1,35 +1,29 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyB3QTU1
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBBWUs1
-TEdvbFNaUmE4U1lCNzI1dlloVDBTNXdURjZ2akRMV0R6dm5ST0FNCk9YclRSakhT
+eWQ1TnJucHN5SkZlQkFZRDUwcWJweW5aYWxmZGVTSFFmbWg2YVRZCkdKSFZGN3Fz
-NlV2UVJwak9Fa3dQNTNBK0xKWGlkNXdwZTBEMm4xZzc3azQKLT4gc3NoLWVkMjU1
+WDNUZDlLN0p1ZktWL3VxbTJMdm1FTkNYNk1aeDlVT1B5eWcKLT4gc3NoLWVkMjU1
-MTkgakk4UkFnIGNBMHNrdG84cUQxd1lqQmJIczlScU1jNk52Y3BtR2tXeDNWdWRX
+MTkgVkZjdzVnIEdaUmd0YVFNWSs2c1BEN3YrQ2h6NUxpcHJWaFFzZ1lqc3MwYlp2
-cEFCR0UKVU5vem5MZUFPbGhoQzJTYnF4OTd3OW9jYTRkazdocVJkZ0pRRGNLek93
+eC9BRFkKWTlBVFZYMHEzdUx6dFZGbDdlUDFjbzJLRUs5cHFJOFJrTUx2bUFtWERa
-cwotPiBzc2gtZWQyNTUxOSBnU3hQMFEgQ2RUaEUyV1ZGbGRtZnlIUEtTQXk5MUZF
+NAotPiBYMjU1MTkgYTNMVjlqejJxNytGSFNna2hiZktEZGJCME1GbnhBbW0xSXYw
-djYxZ0hBUThlV2tXTHNvdXpVSQpMdiswMy9QNUtCb1hkbGRqR0Nia3FXTzE1ajZL
+bmQ2SVNpQQo1Y3ZUOHhkcmliU2JWNkpDMDRld0pJWTdCUVd6QTVqWkVFWFJxbVBt
-UXljSTZqM2YvbzVuWUFzCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBYL1NrRjRaRnFn
+N2RFCi0+IDtacWtxa0ItZ3JlYXNlIEooK3xzagpTcDIxMWgzejNxTVNIWmVSUkhq
-RlNLdWJ3cThteDM3WmNaY210d3RmZzhCYmNpVXBwVGlVCjBkM0IzZC9zNjhmTTZV
+TG82SEdvRTNoVVdjUW5EdlBqeUtGZTJrVWdtSDhib3lvbUE5emJ1aldNUlFvCnhz
-R25ySkVoQWxQQ252WWFlWWZFMlc5dWtUN3VvVTgKLT4gWDI1NTE5IE8yUU1pWGFr
+TVBsNnA5Ci0tLSBSVlRhWDNHNXJuck9QR3JEOWl3MFhEQWNiUktvbEVlOTByRkQ1
-NzUvZVpwalB6aklkWmJGWUQzTnJiRjNzdzY2MUp6MkY5M1UKR1VIWDVyTFpxem5F
+VGpvcUFNCpbxW5nbaK4WcMd1e6ASuETvrP/az98wYN+NjVdOhik/6eO6nWAI6C6D
-TmRNWE9zZStLanRTdlU5d0NOSEJKdWhDUjBCdy9vOAotPiBTJCd2NyFYey1ncmVh
+ftTgIwQgIFYLagTrhMkQ/NjvDtDufT5Gbvbpjvk4ohFsOALlGj2S5zttIuF+MRwj
-c2UgfE4mYSBXfms0TC5FPiBiYmx8IGRFV35mciNoCjVZdHRiVUtMMWxEMlJ4b1F1
+j3Nsd0YVjgB4WrG3u+0I8gla3lw0nPAKGpkEf7Ie9EDNxeNFP2//VXjNFjWB4UmJ
-TGgxY01XTlZpTEtndkg0T0hRVjlqVUJGMUpSaE5tVlZWR3VGenpkUXY2eXJtbmkK
+c1lkHf7CeZSa0o3WQcssPpCLMYNNf0eFucdcX4SPlKrmKdavkYMUQxLb7Ul7n1k5
-ZCtqRVN4dnZENXdoYkpjNHRWYXkvN2laY1p4YjV0WQotLS0gOHlEVTVOSmlNemNQ
+PRGNpSdlA/ps1U6LtGSQ9rG/fF16MzA4mIntu6j4XaGSmqDOw9+IDs6vMmXq/HWo
-TW5ISk1DeDlEM1RoQ2JtUFlyTXRKQjdnT0hiend2VQqrUFvr+76sKn0ldBmZMlEW
+wOMS7pQ9E/+snQjgxV3mxu3OCViihCiZxYiy6vU1xpMLcESTN2nYsNotdwBs4uGe
-U2k85DLo2KU+/+GtbkZwVXxxIZHMLpoJgghHk9ptdalUgLGcl0X15x9jVaw8aeta
+oGo/HaU0LZn0KlW6qNUdwNesNQ7kUC599Fn1GtEkdy8xiuwfjndkMLlbW7Y46lgJ
-hbeOHotRHY7bC3z0S74riTk3xDMR1eT0QGhDMWHjfo8SkCftOYBlFfhTftevdep3
+mQRQFOxKh33yK+w4zyybmfKL2Lrvaoz23AOTPVV2dlV85hCalktebo6ZVGa6rAhK
-pKMZsuQMwH9JzxgUfcxIcWE975cZzrEJ85nfWMGvdSjcg51KNxP/UUPRxDlcbCEf
+8NRRQscn2RYMLZcAywDKoA0WA9iKKUFxQdkVCdEqZcxN/c5Al4tN2u0sqwt1cLcd
-9XX5apSzNsTI3ibGD1n6Qwq8bdVYDMHmy5pAhw4l8L+SdoU1tGdw7JOA16sMCJbx
+NqzX/AeMDCpvOAe7X/7ejaP5b6OTboo6Pqnpr2X+6OKvIGPHLJmw64I06L0fPk7N
-T4bV0ky/PGRonjJuCyDBj8oe9vMe1ZI1O/ITtktekS+wocxBs6QXlY7pIZMlGUn2
+ezdzHtJOo/jofYKNC46nvuSPp8eDZaE0tsDL/x6Zk93KweWicu3JOjO3Ox8uaTX4
-6m59ZEEaf7R4/MdnmBDNDkQuyXaKc7SaTc6h5sKWzXdYScGUKvgUQ7U/WJ2ItUTC
+B3JcONGYJgXCriHDE0nQWTmOlmAJBzjxP5bgwO50lEurJTAQX1qdNgj7sSvrPlZs
-N/Xq07GkZZMt5MYBlyEr+/mKWlcy+ylJPGb7EswvQWaHoeM1QF0XLZ1v+W/Xsso0
+d+JGid12F4nfCvRnxRHVZh8WGBgLdlVHZ3Fbh8VcBXRVJYD+6mOp1q5B4DyqElwJ
-seIoz+geSu9a02kwfsa8WvWXdIAT5X2pNGPClVNzjQ23pfQfQuW8ZQrGmIFR4g5A
+io5+S3NDDeHpBNzIk+2GZNhoqcTdn8aEpOxPCoBGWeJ3LcFKr8hEFbx59xL02ggN
-58T1K+vGLdShqqVGyJFMVrSuOzqX5FVmZalu7/++1IQfiRGUlrHKoPlKWnCfFEOu
+Z9A/nDoL8qkpFzKYYhukIINDbOeC+ditBD9QMYySAlIpBjx7le7QDdMPN5+mczAt
-AYjaPeEFX2ByxcqfMK1YVPvUufdISUQeaQOO7mXGE3FqB0oUqmRIUiWZATwhq3Pw
+cz2YLbGobs5YLUhJbzomfXIaNr1srIYzGNt1gb6OgbatFkw3/kQDR/eZN6gCq/lL
-p5QdcySTnmMpD/w05hvwski77kCdmYuHlMlLZez/kfhTnIGXris+Vwi/V19bsZ8G
+mymcUtzwVJTEofIjiv8Y1fDwfQp2EQ8FqU0iG9p9wgEf0dHbi8tl/g==
-zwaZ/Xr6WNC+df5JqSfTGREnXZPFRDkaTt3ri5/eEm6BqliuYjGbuiKsDECi4+JX
-bHpH6LBBoKQ6ms7jCAn0Ls4cUKF37PcjGAOuWnzCSBU+REht1EDfHzx4C7hNiP8X
-87NjEqJbwE9lORho0hQJRTn8uriQcidlVoB3se2SYKbMy8UA4NNnxN9PTj0TuQjL
-OD3LtqHBElqNPbGNyyEAAJmMBmmkUvPPXlGQ0D99b1+jIdHzYSRtOLshBFykqWYQ
-LJD61duhGqcQqcLx4+JdQ+oVcfAI2nG7YINnHB0OmS2DOZvvwqQ7ASScSujUWIjA
-LNQxu3ruMz+bw/G0tYZBBiE=
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/kelder-wg.key.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBEcDNm
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBaTGhw
-ajc3a0gwYmVSdkowak1aakJ3VWZ1Rk50S1JIS0ExVktVSW9OVWljCjJqbUEySlNK
+dHZMZERSU3FPUW1RTHo3VEg1WTlDUEhIdHB4L0lHOExsVk9tcDBFCkoyMDlQaXdq
-a0xyT3NPK1BBMjZzN0RrLzhwVitvS0pzQ25iSnJSc3FmM0EKLT4gWDI1NTE5IHk0
+T0pRSHJFSHFJa1JoTXdQYUlhZS9kQ3pQYXE5UlBFSnNraGMKLT4gWDI1NTE5IHpY
-M2pkWHgyMHR1WHc5bE4xWTFDTndKdkhRdTg5bzZIWEU2cm02UDZBQjgKUUY3dS9p
+UzRSM1RRSzQra0xpeTV6bXdWRTFlZGJsa2JmYjNGSWJuZFBQZU5NemcKVUY1ekhJ
-U3h1L1ZvTkFPdURLZ2tSYXJXOGNZZ21KVGdIbXdhSUJrd2puYwotPiAoL0RtO0lH
+dmV3cDZGd2ptWFNBZm9LVU4zWG1tdDZoVndobEJ6Z1hDYWdZcwotPiA1ajNWXy1n
-OS1ncmVhc2UKVGthN0ZSU0ZFTTg5YW9UOXMwa3RnSzFlMjE2VTN3Ci0tLSBwMEMx
+cmVhc2UgbFprW3NJSiAmUSB9CnhHdDhRQ3pEOEV3NDJJR2RUQmNjbm9FZEwzTDJw
-Q0tQckd3SzBwUUE4SndMV01kUjVrOTdDWmxlcWs2Zy9TZk5yMzhvCrBXyLBZGuSD
+b3prOHFVTGFiTXdUM0tqRlRHYjl0MTR6UHJtTXlrYlBoTHgKNHlraTdiU1g3YjJH
-dJodNI13obTM3UvX6hSgQ8Su+J3fOKr5NibkhQ0Auvlr2tUXhhDm2WOUlHjqVTq+
+MDFrRUxWUQotLS0gcWMrU1pBcHlOWEQ5TWVZVkZNZk1XcXhqVHE4T0t0NHZNcTVs
-jWLSyhioDlIEyBgk8Zrl7KGeDzBi
+SUkyTGhRcwpG02jLWWTFQBDFcIIdBSWTot/V0X3ns1+13mBZ1nHQdony0moJGRyG
+OkHKvy3dglXLOndeDuHvvJw0XoKTvBv/WzKnkndIOhrjgbKNxQ==
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/netdata/powerdns.conf.age

@@ -1,15 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBzaEo5
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA1SXFN
-RzNndHBLMUl3Z2txdVZoOVJBbWsrTVJwY01WeHQ0VTBaSm5VclY0CnJLYStYNEI5
+Vy9YRGd0YnRsdVZRSG51QTZ3TWFiM3d2dmM4SmcxeFgyYnBTSzFFCk92U1VIYWkx
-VTN3dEQ0ZjBKaU1PZSt3d0lldkE5VC9wNHdWazNWV2F6WWMKLT4gWDI1NTE5IEJ5
+UVVrYVpLR0tieVdsQjQ2QTVFbk5QcDRFTXJURkN0Yis1SUUKLT4gWDI1NTE5IFdT
-amlzTDhCOFF0TllPd2RsME5Cb1lRQUZPTGNvOEZnL1J2Wlpnb29GblUKT2t1NFZy
+c0d5UlpzajRIWW9zL0VIeUlHUUU5Snp0bnRMZmZCT0RMSTJzcGZmUlkKdWVaL1BC
-blNZSHdxZjlHTlZmaTFYT0laQ1IwOCtDZ21vTjhxM0owdTAvawotPiBLYS1ncmVh
+Z3NxQ0FtazBoUldWZVQyQktiemJKbnprcXJuVUZaRE9RVkpaTQotPiBgLWdyZWFz
-c2UgRX0nVGtpSCUgNVNDWCVwIDBuPjM3MwplK2cwc2htQ2RLcFhUZ0RSc21uQlFV
+ZSAwW0wwc0ZvIFgkOitncQp1NHRSSm5aSWY5TmpBQlZTb0FVaWtNOXF4RFRvUHcK
-Y1QwSStOK3lKYmVVQ0J5RXA3Zytaa0JoMWtlWU9qMHBLNktFZWxtbFpDCnJyS0JJ
+LS0tIG0vS0hnSG1CaW4zS0JuL1Zrc1NvTHZEaTIzWkp3a0xIWDFaVXdoNVlBOVkK
-WEcwbndYbERreFhLZlRyQ3E0czB5NkREancxZk5BTGdWRkR6N2NrZmFrbnhSYlZZ
+DJOWDeHFZ7DFi3RkpWZY/JgOfZRzegYbCMosO2RtAickW0LfN0w72pSt5lwEuOVT
-NElHNEEKLS0tIGVLdXAxU0ZaZVkxaHV4dEZNNUVuc2J4N3VRMzZzTktSMDY3bDVB
+YlrZwZKFCX/q9KtTek4DM6zHeZ8oweKaMf9hznA/hQ+l0CG9n8uxvWaOdRZVNw/s
-bWtmUVkKigIZ3J0s23vNzmbzJGjSMGBXK6o6xnsA9HXeQZ13VgKv5Qv+UHu+Z0g2
+YdP2XdxL89L5QDvSttaEN2y5kpKOVqql/d4vmldmpIx2gFUdqq8JIyfOHkJ5lOXZ
-TeKdQSrHbDB3ydIxaiXsi2ivULdrIMCyd96rEJFxrkVuVqSZE0ehG5j+o8lKk4OU
+LdGTGw==
-PDe70slbZrVYDSu+OOUOCVRSopZreCURlYn2Pc4rjvrMAn5r1r+/AxjZMdkmmQZ0
-l0wMBTus5zZzKg==
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/netdata/powerdns_recursor.conf.age

@@ -1,15 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBoZUI4
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBhc3NI
-bEdWSW1pcDdMYVRJLzdQOWhsdTlZMmlyZjRVeEFwU3Z3NzVFa3lBCkxRZ1FYeU9D
+Zkc2UlB1QndwYXRtYjl3cGZFMDJDbnZnR1pTVGZFRVdFc1AxTXdvCmgvRkpGUjVz
-L2dramp4WFFlREZ3NTFnWUs3clVEcnBhLzExclVac1M2SG8KLT4gWDI1NTE5IHVZ
+OHpsWDlEaTFmQ3ZJNHViekV4anArTkhXUHJLaXZJbldOTG8KLT4gWDI1NTE5IFg2
-bk9QYy94Tk50c1dVanNvNzhpYWNqeFMzVVR0eTQ5OXozMmp2VFlad2cKaEdvUnR5
+aGZrYjJHeWFIdDl1TktFM1FXckEvenB5azlXNXp6RGM0UXUrRTkrU3cKVWNYZmZ0
-ZjhsQ1FRaittQXFkbnRZei85MmtWb3pXRVFsc0RzNzBPMXFMWQotPiAzSXJZb0RE
+V0d1WTVXajZpenhvbDlOcDB3MzQ5QWVMNzdsa09YRitTZHhCQQotPiAvby1ncmVh
-LWdyZWFzZSBudCBGIDklTWIjVnwgM3YvCjRVYUd2TForc0gycnRBR05MbU90QmNu
+c2UgIyBAMUQgUmY8QjY2IDlpdQpHdwotLS0gY1g1bERWNmVibTJmWFVRZ3pwUVFE
-dXlmQVB2bnZyME5heXlyMUdGTmR6SVd5SHcrTThrZEJYRlpnUmdmWnkKU1lyNjQ3
+MUhLREw4TktCTTc0dzY5eDFpbHZFQQp5QPn4Dj0jrXk0YjIWumiMSLweZAYgWMqi
-T0J6b3NPQ1FYZnhxTjFrYmN1UUJzMjEwcDBwSTJkTnlmeHl3WmFFTXB4eUVMWm9i
+704Y84T+R9H6H59LUTrUBQ7LEnyuzrOwLq8YsPxk8iLl0MxiTHOZJJtZ6OlkG1no
-NExUZzM2SHlLLwpiZjQKLS0tIHdqakpMSUNOdnlBcVA4RGJHR2d5QnJNT2dVclZN
+7hZCYrnyMNpFbgx4iaZaVp2WqdLcyPM/MaCKyFPNhSONMo/4uc52Hd3G/82pqWO8
-djd4WXBLSUhORktzZ2sKzMjxqL3UPrtGmXDijdfu0AwxLJooK7ZKauYvXWSuZUrR
+LSmZFCPZqUacBHeO/Kn2nxhpo5hyNRCSX+k0
-vl5i1QPMEEBYEl+NaZIFgxAFqWpAXHQ1VxSijMWxNjKUd1Chq0tbLrpbh9wXJflK
-SW19Wyqc9eTb8BnFoOSYWpDvAs2Lbyr2kJkOj2TNrwMv8nDJdOB8XIPlV5drCj1q
-Dx/1zWqm6NMYxsep6eZkv4AzxA==
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/pdns/auth.conf.age

@@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrd0pM
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBLTUJk
-TGw1anJNaGoyQ3lMUis1cHVtRWFPcFFNZk9Cdm9TMEh1QTdKc25ZCm9VNzVQcUxE
+RllycjhGdERQejN0aVhGRERhUmxnc2cwTlNnb05FOHQ4S3FVbEVrCkZzMXVUMFAz
-Njh2Wi80RWszSU5NczRNcHpVYXpRMzJNcDRsdGxyWVZsUDgKLT4gWDI1NTE5IFpT
+dlhIaE9kQkpzZHlvZVJrb0x6TXF5ZmJ6aU9oTE9UTVpzZDgKLT4gWDI1NTE5IGtS
-MEJVUkcycVFJaVFOUURoL29VT3R0MVJCWW04NXVRVEpKY3hlY1lWRkEKcENya1Jx
+VmJZKzJxL2M5K0ZuWnN5L255eUw4a21naXB0ZFlSSEZXRUQ3VUp0QVEKd05yMGdD
-VnBCMVBrZkc4VDkvMnZoTllCL09vQ0VOZytuMnRvYVQxL2FldwotPiAzLWdyZWFz
+ZUlYRXlmc2hSNzZxKzJWbWorbjU5T1FYYWNvRDZoVWJ4RGpwOAotPiBTW0gtZ3Jl
-ZSBCNX0gIiB7InIsfCAkOT9uM2UKUWpSYTZ1dUo3SHNaUlFibTl0UDhTaFh5Mk1n
+YXNlIF5sZUFedQpFdlVIRm1WcGpiZDhzV1lVdDFUN0IxOGQ3RjdzMnU3SDJmdThN
-bFp2cjM5RGhqU0s0Qm50Zk1pUVZmT0R6ZjBoUG1EUGlKbHFzVwozQ2t1cWVDVVAv
+NENoOXlLZjFDazhheWtVTURkdVVMcUYKLS0tIGpSY2J2eDM4SHVQd2huWXBMZERI
-Q21QTjF3NW5UdTBZRldnL0RmSlV3QndHcDB0d0lvZ1RHTTByS1ZwNkNVQnU3WmVn
+NHIxYUpvL2ZwRllIN2J5UnRodVBuMGMKrj4hHa5abTUuU+XyvcxvuPYZly5IUUFK
-ZwotLS0gb0Fxb2FsYzgwRjJwSUF3ei9hZVR2Vk1ORDlIMWoyZ2RTd09hUmtvMWpD
+I76KkSLu/ATWrVyFCSqbyfE2tZ0qkbq1cYf3hLvNkOoBMQSJAn/3DLXiJFDVg8Au
-cwrEjdaYfoGZ9i/S97xL9QvA/yii+sJLeuUzzv7a3DE661eQ5ezurV8Qz1tIhxWG
+LEmh
-RsOppaaj1podFx3U1x7QQbLO6zQbJA458RMjYgc=
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/pdns/recursor.conf.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBHNWg0
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrd0dl
-WGRGZnlTdEhsRm96T0ZMOWx4UUxkTitJa3hMWDE1dVkreEtEa0RVClpvR2I5NGpz
+VktWOGhqdlB4T2Rib1hEekozL3pOYWF3YTJqcGRpYzlXWUp6UUI4Ck9neGxpTWFC
-aUF0N1VZU05oWXUzTEI1TVBLYlVVang3Zzgwbi9teDVlQlEKLT4gWDI1NTE5IG4v
+VVI3UEhRQ2NDbWQvVUFwR3FOQXFaLzUveWNhcXJ4dzBQVTgKLT4gWDI1NTE5IHFn
-OXRIbzhaZEdXc1pjTnRRWHVxc2ZTcmozSlJkY3lyOGtvd1BVeGprVUkKdUNqSW94
+WXpHRXNHb1Q1MGVzbTRXbXhVeUlHaE1XekluR2Ivcm16WkxvTTROMDAKWUdrUWN6
-SUIyOWtsNU83cnVOTUxNR1BvWHJPczdzUWc4aGp1MjlpZm5ESQotPiA2KSV2PVx5
+amRjSjErQTRxdDlmcHpkTUhhSm92VTRZblErZUFPSzdkdVhNUQotPiBaMSZdZU1o
-LWdyZWFzZSBqezVxOHc9biA+aD4tP20mXwpwRCtMUDhmcVhGNXpCZlFmSllpdDVp
+LWdyZWFzZSB5e1pUIDg0UmM+IlZPIEQrbz49MyRRIEVBMU13VwprUzlnMVp0ZnJP
-SmFZelNhZnJlR25DS2l2MlQ3ZGFtdGxkZEdEWVNrRlk1VEZBRm9GMHBFCkVlQ1hp
+VFJrL05iczJlZSszd25YcW5CWCtySkFaNW5JTW0xYWxPbHBIZ1dYN3kraHprMUwx
-WnhOTGl2R2s5RDRKN0p5TmF6Y0cyN3ZlR2pDZlhMVjQ1c0FJN3hCbFEKLS0tIEFT
+N0RnU0dyCk5KcU1BWWdFWGhNRzViQkdkUQotLS0gRk9ORmhqeUJxcC9NemJZckpU
-bjFiRStXMmJueHdsRm1nU084dDRpS0tBT21ENzZFclJXbE11NWJETm8KyMHU+tZY
+OWh6V1RBeVJiWmd0YzZBQ3hCMHJwN2szdwpaTwj65x4L2fWZ4zne18OX+K/qMOCw
-QELtZCbXKWnP8QC6V84JIFAxoRslACwsIJZpogcZO/IFIV2RGunGjCJk6QBmhOPV
+7pf/F1kBPxAMMJHn7foqchuygESUdGxR7N/e7kFfeoh7zYlRzal1DKbPJCAPKozA
-kJXRcGO/ndYjWfuU0U3+9HtPocnO
+7KWVyLI=
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/actions-runner.env.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBOZ1RV
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA1Y1Bq
-VVpOZ0Jhd2x4YklMOHdkNkd0MEM4ekZiYXFKMjRIdXlZVDFkOTFZCkRreDZlK3Bo
+WFluTzdIY2d5RmsycTd5ZEhaVzNVYmxINFhqL1hRSTcxbjBtRGx3CngzdEJ2NGhC
-WmJ1MDBxSU5UYzRuUDMvdnpVc0prNFF4MjM0M1FaZmg4V1EKLT4gWDI1NTE5IEkz
+RDBxMFRCMDVFamZvODJ1NGJCRzJsSm9YdCswQWZ5VlhUR1UKLT4gWDI1NTE5IDRV
-THNsVDVCbU9KYWpXL010OVRmNjBVVmVyVzhRZW5McVFJcnA3ZWJvZzQKOE1lQnVX
+amRveWlWL0xhYVJRdXZjU3F4ZDRtdVRvT2Nma24zRWtGbVBzL1BaamcKNm96c0Vq
-Nk1rWVAvS1lpbDEzb2ViUUE4RlB5NnJOZmNoUGdUMGNuMk1iMAotPiBuYVwtZ3Jl
+aThXOWF5Vit0V2JvSUt2TUtqMTc3V0RYbzdRS1dQUEgvcE1jdwotPiBxKWN3ay1n
-YXNlIHdYXzh3MSB0TyREIGpdTjheeQpJZ2pYUyt6UC9vVmRNZU1uaDdvR2ZUNG0K
+cmVhc2UKcGlEb3BWV3dzL25PWEd4VGY3RmQyQUxuaEcyd2xURGJMaGpPM09kUHhX
-LS0tIHNCRno2V21tZU9XV1UwR2IvZDdkWEMzZDI4V25Yb0lvdmJadXNEZFV6TEEK
+NnJ1eFR4UGVUWFdBSUdtYUh4cXJtYgpCdGhvY1pBYThGRkRjSHowZk00Ci0tLSA2
-81uT8S3QJNe+mVadi/VpXSPEP0Ygzm0/+1pB5qqYlSQEWTHqS55gCyFCwu+sjaDq
+VlA2MnpJM2FMc2pCTDRXVmovam9WOHdUbmwxTno3Tm1JZGFqOVo1U3hVCjPYbm1u
-DpYTSm1JAk5ql9NRj4fJvCS53lJZ4zo+5c0iJKmuRg==
+7Da0EUA3BWCbGYa/UPa+EWiV7h/NczMRMW+T1CVopFf57t0sPbLk97JzUfyuJnT6
+bxKMaWBOd3XTebxBxKOIj7UkbI5ql4tBlEA=
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/db.txt.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBBOVJi
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBoZ08x
-SXdGVDlXWmVGZUM0OTJPUWFYem5qZzAwZWxhNzhpT2t1VjdZU0ZrCjYxWUE2VW5o
+QnRrS3h3SXJ3MXZnRXpvQ0dTSWZjQ0NLUTl0eUxiV2xnM1pIUVZVCk83OVhGVVAv
-cGFLZ3g3Y3BpUWlWOUtUYTg4MGZXVHZvdVV3eU9iZW0ybE0KLT4gWDI1NTE5IDIw
+aXJpOTA1d0JlNXdKaWFqS2phNjlMMTRnMFd4K3FKOXlodmcKLT4gWDI1NTE5IDQ5
-QmxaWTY0WjJFZUd6TUxqaHhRelpRQ1hGZVBEcm43d3JYUVhpTWp4aGcKVzhJdFFu
+SmE1bnVSUnJMbDM4ZUJGUDdjQnM1V1Fha1VRYWFmRk81L2VQTmp3REUKMW5lZWRi
-SEhUUUZVNVk1N2tzekpzUS9RazRCcFBhb2xxbkhRNEwzVys5cwotPiBkeE19PHEm
+ZEFSekhlTGhpZTZhbWp1T3JEaGRkM0xOTjlGT3Rqcjh2aDFiRQotPiAkeU9kfU5G
-LWdyZWFzZQpwR0xsb05JVlFXQTZZQkJSWHY0akNRdjh1eXFnbmFDWUlCM0xLWXBi
+LWdyZWFzZSAxCnB4UHFLQnN5RVB0M0xHd1F4M254R0NnWHByQWloOWh3Wm5IeDUx
-QkVuanloRQotLS0gZTkrT212MXdsZy9Kb1AwMkFHU3VsTElweGNlYkZ2UWVXRzkr
+WHBIL012RVVhSGFBSE1TY1I2ZXNqMWgxU2YKaWxadkJla2NERERPaXhRMDY2ZTJZ
-dnB0SHRnYwrveLSY6SdUDO+QH7WGniLIOPcECTQ7CiTj9lwD5Hm0rYLdvizolb33
+SzRvSzlPRFVUWG90WTQKLS0tIDM2Q00waEwveUlKRENZSWlQeWpCUzhXZXJrRVJ2
-CsGX/kSEI2bD
+czAvYWorLytUcWdzcVEKDHfSKAadS4AXkF3xsafW77DFS0UElUmmm8oTzhjEb1ww
+R1V3R0ItrJoBnSuC0SE29g==
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/mail.txt.age

@@ -1,12 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBrTW1E
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBpV2hu
-ZDFSRXIwbXZXUlNJbHZCVjFzMzRxTmdtbDQ5eWVOWWp3SEdSUERrClVMeFRLOGUx
+WUFDdXNVVFAvNjNmUkI1emRMYW5nT1dNVk5DZmxlU25IeTJIV1YwCmRWcWtSMi9B
-U0dmT2ZUUXlCSGhJdE5ibkZLMmZ2VmZFWU9PQXpGZFRPQkkKLT4gWDI1NTE5IDIw
+SW9HRncxNlh2U1JJSVVwczRQeGw0RGYrMGZUOXF5L0w2TUkKLT4gWDI1NTE5IGxG
-VXd5N2EwTVdhdkRYeVF3c201SnV3TmxnUGpOZWY5bFJaQWRWMWxQVmMKR2RNc2pE
+NDJjbDd3MDdyUnkxYlNZOW9vVzZnNDc3S3RZRG5mbnY5djQvR2RLUTAKNE1sS1Zi
-aUs4ZW1XSGU1RzM4bHZYQks2cHZWUkhZN1hob2d1QnM3cCtlMAotPiB0XENxMSct
+cnpNRjNOays3VmtCR1BrNSswaU4yeDhCL0M0Wm9kZ3M1V0o3OAotPiBRK3xdWy1n
-Z3JlYXNlIC5LIEIoJ1w6Ci93eE5lMUxDQjE3dWI4a05wUE5sV2dWN21ZN2lFRThv
+cmVhc2UgeEoKNU5OQlNoeDdHZUFzUHpRYXJERE9xcHAxSWJxejZ2blkKLS0tIHFi
-YVJGNXNWaEtmbjVMaXhnemVuTXhOMXFtNkQvbGNuS3oKalZ6bEtGdHcxYnZNb0Zy
+eVNOeVZYRFFacUdadUJ6S1I5WFQzdUVLbHdwUEtQS0tQTjBzRy9DY1UK6+dW6bqH
-YnlGTDdoVVdyeTJpYjJjZkc3alUyV2ZGa0taeEFIYTdiRnZmYmRjR3BzNUp2Ci0t
+sM3s5t3A7D/ethY/paLr9cbbuM6FsjOFD1K1qmoVqt5z61dzRTcrfMtZsg==
-LSBROCtSMzFNR3hTK1p5NVhGcFpqM0U0L0MwbWpzNUNTUWUyNEVXbzFFMGpjCnot
-A6mYbp+jhpoyjZidXQfzLVcu6y34WqAfJZsfT6l5SJONVfSvSw+iP7XXW2T5OnE=
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/minio.txt.age

@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA3dDEx
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBiM1l6
-SUw4QVh5T3QySHFFemo2N1JWTjNCSGRiS1lmRTkxVEQ3S1NKR2dNClZNM1Vwc3dF
+bVZBQXlIOWRKMEhFR0lJVHZnNVIwS1ZmeldnU1JIRUdCWDlPN2x3CnFKVDN1WWxF
-elB0Unk1OWpUb1RQMVpSTUpJUDNrZzFMWkhKK0l1dXVBYlkKLT4gWDI1NTE5IGRF
+ZXRpeFBocnRLTGFBZ21GUVBKYVZVV20wak0wUXR4SC9Hb0UKLT4gWDI1NTE5ICth
-TTZlMjdaamlwTUJzYlVkcVIxbmtybkFwakVtK2craXVBNVZraGZ1VlEKN2VvaU5r
+R2dUVlQvcWZkRlJwV2h6T1ZlemZYcDQrYTlNVXcyOUZsaysrVTFwVU0KeGFib0dI
-VjNRS2I5WE9kVDhES2dWTUV2cEVJaXZxNzRUcFo5blhGTDBaawotPiAxXCJQemxa
+TCsvT2RvMlR1WjlWemQ3Z3YxSlNaeVVKdWFaLzFXUGExbXpUVQotPiAkQUZsRS1n
-dS1ncmVhc2UgcDphKHFVTGUgIUonYydBPgowQnc2Wk5yS0E1bVBCWmpOc25MWWs2
+cmVhc2UKbms4d1ZlUGI5Vmh1TjNKRkpIY0syMmJGNEk3SXJvMStsWDZPeDM4b2dt
-UTR1dVlJbnNXYUVJSkx5bWFIcmtpT1lPSVE3b2Zpd0JaTGZWcEtjelFDCitQcy83
+OHJFc25kMjZYYkRNZjR6OHlLVEZmYwpoVENzd3lBCi0tLSBKYWhnTFRicUtmR2Jn
-bEVvM3FNTEhyWVVFS21tS0VQWG5OOHFza28KLS0tIEZZeUZwVGxUdEdtQTZuYk5K
+cytTL0Fzc3A0VzFETkVybWhBVytrS2ZvUjBkVmVNCp4i4tW5lDIxFhvxvYT3MBfr
-SHJaUDhHZ0JqbGNFSjJCaVlQTVo0OStkMWcKz/w0SnoHxnw71gr5DbXgMl59Kgjy
+fV52kb1gB+xg0acu4wlmHdiCvTVdbOG2pXdWSsjXV5Y=
-SW4tzNGeRcX2j4YdRjr77TP5UAzpQE30tEcrtw==
 -----END AGE ENCRYPTED FILE-----

secrets/home/ddclient-cloudflare.key.age

@@ -1,13 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBNalB5
-RUZRNE1CTUJsbW1kSkxBSWVIcG1RUnBKd1gvcnRQVkZCUXFOQmhvClJUN2ltbnNk
-T1grdVJSTzIyNTBTTGVEckVGQXdYNHdwOU5NbW1md3lGM0kKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIHZ4bFZSS0huWFBDbUhNcTd2MFhvV0lOY1l3d3ZXNU4vT3dwMmlI
-emhoV0kKcDF4M0FPK0JpclI5Q3Q5WGxpZWVYbHVWbkNWdTArclZsN09XK3VJSXc1
-awotPiBYMjU1MTkgRjRCNVZmcXVnQnJ4KzZoM1ZkdWxYUkJTM1JuK3ZlRWJYdkFR
-WXpFSmR4NApTbU5qR3ZuN0ZmbzIvMTFsMkdNSGJXSVlrVmZPdnZvcHFiZW45SW9I
-endJCi0+IDEoIjlcJi1ncmVhc2UgJUE4IWl5ODkgfGVdLihEfT4gWCAreSduPS4K
-bkI2Wm9LRGJXdW11aDl2VgotLS0gTENqYjZEUUZaWVZEcWQvWW5yTzJEdHRLeDJm
-QUl5aytXdDE5QVMwVHZVSQo+aDbaGNOrz+hTSUQ4IAjDC9EfNwrlXDZtBqw8HkRv
-1/Rr737scjrM7Bgt9zuKn6CB0zdeHTW5u685V2hCW/3aTy1eppWMWj3r
------END AGE ENCRYPTED FILE-----

secrets/home/pdns/auth.conf.age

@@ -1,16 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBFb2hL
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBaejNS
-MCt6c0I4Nm5SMFhEaWNZRTRtNkpYeVQvVGFVZzVqd0E3L2dZdzFBCiszUXZSVENo
+M01lYlhZMWZOVUFsVjFOcWFzdmNGdWpnL0RwNWJDeThYMTBham5ZCm1lM1lVeHE4
-cmxqdVFwMFA0elpFOGZoM3B6SW80MEhCNlJoRXV0WXpUeG8KLT4gc3NoLWVkMjU1
+cmVrVkZZQmxsSks0YUQ3ZnREV2ZSdGt6b3hHUXhvVzNWdEUKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIHQxR2MrakZmRFJMcjhabGFON2xQU2RBSDNvRCtuV3NwNGJ2bjZF
+MTkgcytxUmZnIHM3NThSTEVUWG5ZeFNqMFhDWjNWNlYwK3RQcEhPcTdUOTFmcGlK
-b2lCQVUKcFNzM3paS1ZnWk8xY1VzVmdTWndMK0JCTU14bUJvM3E2bjR2TmlTY2tF
+cGM1ZzgKbDhuY1Z3N0twQlNJdTJYM2dpU3IrdThqTHdEWkRBM3ArcmVnNWQzYzNB
-NAotPiBYMjU1MTkgY1MrT3ZkN1pUd0JVb0JWSDByNUNRd1NUd2ZiNVJrc0JCb0J5
+YwotPiBYMjU1MTkgbW9WVGFUMGRVN2duVjFHTkRqSStEUlpRMk81QXpGQ2Zzb2RJ
-NENrU0MySQp0bFpwRXRZcHRVdnN3eitkNHlWc0c0a0NmUjVYSVFXSVNFVHI0b0ZB
+eXVnS2lqWQp5ZzhOQ1ZrazJSME11SXdNNk1ZaFdmY2ZPaHJnTHpEUjNBci9BSVRu
-U3kwCi0+IHQmKm9ERFdfLWdyZWFzZSBJIFkvRG5JIC9ZI002bmkgNX1hQHcKc2l4
+YU80Ci0+IDV+Ti1ncmVhc2UgMCZzTHBrM1kgWApGS202Q0NIUTVrUFVWdU1qU0Rx
-S0N4YzgvK2xqZm1YVkl4ZlF1REVOTGRWOVZRQm80R2NnczlsdFlhTEd1RmVoNjZa
+bjM3bjVieC9FMHVzM29aU3pSdEV2c2c2R2c2R2pkaDNUU3cKLS0tIGZuZy9udTdN
-KzlkVXNpbGZsNTRybAp4RDlIWmRqR0t3VjF6WVlSeTJ4aGZBd1dDNEpMTUhZenZS
+d3AyT21EZ00xTEs3cFVhSEZ2NnZUZjc3emtXY2lIQkZrN00Kn069S5Es7Rr8B2P0
-WjZCK0FZcXJORkJwc1piS1FvSlkzc3R5T2s3Vk0KLS0tIDFPODlkZ1BSWEhHUHJK
+F+JYJKGeqSyt7GzB8nd6DY53Bs1HCjAycYufcB5fx13efxR1oGNWHdZgDSRpp87m
-QjdZOE1KcFNvcUYxYlFkL1FLNVJETTkySVNYRTgKOipmWGTV9SvGE4KVqgQqGw4e
+zttLbgw4rAVdRVV3wJjy
-CLP4PYlgdSmOATTIg32G/GVTM8NlvaII3q2GNS0Enx7Y8YwnwS2dGkYKVN3Da3b2
-WJwMiBZRu/PC
 -----END AGE ENCRYPTED FILE-----

secrets/home/pdns/recursor.conf.age

@@ -1,15 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBjbUF2
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBvSnpo
-VXYyVkRud3JFU0tDQThjQlVMTTFaaW5uTkt3K2dmd1pleTFOQm5jCkNUeEVqSXVX
+SkI0L1R4WUdQQ1Bqc0YrMUREVEV5YVFkR08xb1ZEMjZYbXZEc1NRCkZVdkhWVFJW
-RGUxcU14Z04zMlRubVIxV0VwazhlZlFtTCtXT2dVS3l4b2MKLT4gc3NoLWVkMjU1
+NWhSekRmNkJFOFg0TG5yOE1KaU5QSnJmQVJDZmduR2tQU2sKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIG5SRTFOWWVIMU5yK3VTdkVtc0VYNnFkRXFrdEpiNTJIRHBvVnky
+MTkgcytxUmZnIG5nVmZsTTA4NmdLUmhtQ0lLb3JHQURBbVk2MDBzek4wMjlwK2d3
-OHRyWEUKVXVvZlBBR0dsUXFMa2dSZ1FWVWpvZGlwcHJ3YXRscnBoaU1FWlVFYTdt
+cm5VVTgKS29VeEhTQzU2WkFCN014VHpxMWtaN20rdkdnN3k4M0RvR21JUDJURzBl
-dwotPiBYMjU1MTkgMWlBWCtSU0I4Q1I0T0JrZ1ErYzlHRTZsUHhZQkpYQVJGNnFy
+cwotPiBYMjU1MTkgTXJUM2VaaHFvTGV3Rlp5eWhyd2lESDJYR21RanpMVXl3dHZR
-U3ZPeU9RTQoxaGZDYnRaNjBRRGQzMGNsTmZwcjhBRXdLeEFqVWxoT3hNNHk5cU9C
+VDlsWEkwVQo1b1QwU0Q3V0hMWktFdlozZ0Y3cTAybFZrWVRONHNyOUs3OFB2QnBl
-Qk00Ci0+ICF8Q0EuPSIhLWdyZWFzZSBKcCp6MgpaTXQwdEllbmhRVDhOQTdpb0RU
+ajF3Ci0+ICpzOG5KLWdyZWFzZSBJJXBxIFAKODVtZFNrcFNuTUFNVEdJOHhubTRS
-T1VGZmdZK1VEMWdPUXduYWQ2YWx5aDFTQ3ZzRnRWbFRGN0lWUU5iQWdPakpZCnl6
+YSs5QXdyb3VjUFdlTkkxMUNJNnY1bHVDTG1UOWFJa1VWT3VlbnFCUVl1QgpSeVlF
-MnI0SE5sS0x2MUZibW96SllDQVVOK2grRldPOWo0VSs3SkFUN1dqS3RqTTdPZG1M
+Ci0tLSBmUENxdnd1d3djRkpNTTQxc3UvSEJyQ0NKd0pNNW9qT3VVdExBNUhORy9F
-eHI0T1BHK1F1cWlINAotLS0gckFnWkoydklhWHZhZHBkSkN5ZmdadVdiMU1QOUZW
+CqKljzlqh+iV4+JjxyAVvEgyEBvemzDulwTNgSX0QByuEDuHMg5LrLJ0xxprVkhF
-VkJENWlHVWNXcEVsWQqYscIBmSi//ev3IN2ax0Ei7p8Atu4nYQui7yoY/1fiyGQL
+VDclljFdxKchzSZUHIHAns2btW6+U1WFvLd6KA==
-DB5+R9Dm4YUNHt3bjrBYclLohDGdLUnOB00BXUqNmlLm4psL4Ey5Go8=
 -----END AGE ENCRYPTED FILE-----

secrets/jackflix/airvpn-privkey.age

@@ -1,11 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB1N0V0
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB5bTla
-UW5ZKzQrSlFUMnR5QUE5N2Mzd0FvK3JCeFM2RVRtUklVQkNkU0dNCnJuUUxjQjcw
+RmdoZnd3WXRDd0hDK0c2ZHhyKytFM0VPK3BacEw2MjNHcHJoQ0VrClhoellSMGNM
-NURFOFRWRG5WSnBPT1dOVjFNQWZVUjJUSU9WVTExeS9XZkEKLT4gWDI1NTE5IHdq
+VFN5RGlPTHpEZ1NmVllOYkZuM1RLTkRBNmdlOHJqb0JLQXcKLT4gWDI1NTE5IHA0
-eDhJSTZKN1lQRXNaZzNIWEx4NTZINzZpdFRPZWJGcys5SUV6bmc0Q1EKeGlqTjF6
+TThaNlZHNjlNeVZDUys4Zk5NbElFWlpRQjI5TWU5SW1ER1FoZEFhMlEKSm1EaTNa
-b3Y3ZWNhcjF4WlpOcXh1OHBucmNCZmp6VTI1MXRjN1FlNlA3VQotPiBtQ01Dey8t
+NW5ZUGZqZWxTRDFrTlJ4U0ZlRjlTYk9vZ2JnUTBxS1BZM3VVYwotPiBPeXtILWdy
-Z3JlYXNlCnFKKys4Y0I3RkE3bzl2NDJ2aDNMeTRTUUU4dFFwelV3SjVReExnCi0t
+ZWFzZSBFSSAwTFA/ClZDV3V4RUhlSy9JS0liYUc5VlNlZUVrTFp5WVV4aXV5VlZ5
-LSA1QSthdHR0cVE4bXhiczZqUTNJdzkzdnZ2TEpESWwwQ3BWNnoyNmp4ZXdrCl1g
+SzlJWERpNEo5NndiRm5aUEpvdVQzaFFnYXF0WE4KVjh6bUdLMU80ZmlNM25PZzlL
-oNwCvlTrPx5b5l0OUymxMo1HMCV9fsQ9zyaoJoPFN1hv7l4hjjX5oVoj/IdTJbbe
+ZHFoVVgvUU5FVnc0ZjltVGtIWWVrM0VnWlYKLS0tIEh2OU83YVJlQ2ZkdEJxVUlU
-ZMs1yqa7YbR4+HG9GG8nPhU36hchSN2whoz8
+ekthYzVMaklZZmVhUmpvcy9FdWQzK0t0WUEKeNxuqkWlgQB2t+I/qGYtpYCrQpF8
+Y9yU9W0U2QJywb9uFEzrhVgi+rfqczieoSLAYUzN6miCap+AnrrspK0csCNzAqTD
+BtxHihG5BF8=
 -----END AGE ENCRYPTED FILE-----

secrets/jackflix/airvpn-psk.age

@@ -1,11 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB6dGZN
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBOK2F3
-VDF3ME9IWWJMQUVrbmlKeXhZbzE1THUwVWhBc2ZBQXdUUkpod0FzCkVncGlyTXVv
+N3hYdXhkS0lrRUg5WDJVdzdMd2NpVU5CRm54SGZtQVJ5ZUp5V3pVCmtUcW5GMVBu
-bmxPN0F3ODdvUmw3Sit1cERNTXN6YWZlU2IvYUhoUThER3cKLT4gWDI1NTE5IGQ2
+OTNKdWhBL0I0MVFZTTNKOUZNR0U2M1pDMW83TDBsRy81dU0KLT4gWDI1NTE5IGRG
-RzdCWUw2N1BHWVhiOGhvNEdzQVlUanR3emdDV3FUTFRXUDB3RDdrMmsKZDkvWWgv
+V25jWFczOTh0VGRjTmE0V2lDRzVKSGl3NnZtdFZaZitxSVZvVERLVXcKQlJUbWxr
-MFZhbHZtVDVQSWVEQ2NxQUZrOXFMVmYxbEU0STFJTVBzZm16ZwotPiB+Ty1ncmVh
+QldlemNHeGExVmE2aVh0aFJhR2wrN3ltSm5GOVEyT1UwenlSZwotPiBVSW43Qy1n
-c2UgMnpCPlV9ClY2TzJGcnBrbUJTU3lyNVlrNDdwYTd3Ci0tLSBHaU9ZVnZoUkx5
+cmVhc2UgamdvLWAgM2h9bC9iVSArSW4gI35KOiNjewpvdTc0NG0wQStlUFdxTHN0
-QnE4UXhMdEg1elE1dDRoQWx4bDhBMHNwS1BlQkRaUm93CspT9YnuzfpKxC9y6SWJ
+b2xYOWFqT1NWeFFpeVMyeEl3MTBOZWNiN1hUeDNQalh1MytLcDZEWGtnZDlYNHpP
-JRyT8aFEJTjoDEqN2I/DBwRikSxKyspHi7grCwFaoofylqJzsP/In7Xlf91xbMXz
+ClUrSk1OdkZsb1JKRmZyNlhEUXlxSHY3YkdXSUtoaTliTE5TSXlkVDZSSVVyQ2hK
-njjXbBQQP9PG3Z2c0OHk
+TXM2N05IVVowYWNzdzdhK0MKCi0tLSAvQkpKSS93N29rSFdGTS8yaUh1dy9KTjM4
+TDFEOXdUc0tRUWE0TU9NUmh3CjUGRpG0chZckclsVNpQUDQy7S0Ik2dMHKLzEKjM
+Dv8NrzjJs0kWAlOt9pLv+37ider1q+PSp2J+lqEEbswLf2xaQt0rkZXdSr/3bG1Y
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/acquisition/airvpn-privkey.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBaUm1C
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSB4VVc2
-WGJDSUNtTUYxbHVnWU44VkRnY3F6cTR0Tm1EUEdDYmltWHBrL1dvCnMzSEFqZTdS
+bGZlMmZtanJhN3NHeGpndGdsMVNKdVRsL3plQzF3MjhhWFlaU1VJClpmM1REVUUw
-K25tMkdkNEZ1dGhBMVhSUkR2M21EY0NtbnJjb0R5RVoyTDAKLT4gWDI1NTE5IHhv
+eFA3eHZjWCtLWFdjakhpeXpYZ1dWSHErejNaN05jMWNQQk0KLT4gWDI1NTE5IEMz
-RlJOd3dCa3ZaeE5JS0ovV3ZiY0N5QThNSi9LaXQ5d1JIa1UyeVFJekUKd216RGw2
+eWFMQnovc2pVWFpvNW4rY3BuWmo0emc1RHdOUjdOT2NtenJGYTBmemMKa1d4VFBG
-Szg3VG1PWUVweE9udFpta0gxdWx1NEU5ZmNwK3hMdHdZNlB6SQotPiB3dlxKIXxG
+bUQranlrcTkwcXhhWmpvd0t2ekxmSnNQZWovU002d2tMTnNmSQotPiBmLWdyZWFz
-LWdyZWFzZSBCLGsgWCU+UWwKWXVYQTBqVkRMKzNsU3JuWmlQdVpzdWJWcVdwVUM5
+ZSA/R3p7IE8gcTxBI0I+WQpUVE1DWldzd1IrZC9zWitOb3NQZlZ1eFNXZy9SdGt6
-aHpmZFVPbWlidHJEYlN2M3NvUWNqVgotLS0gZHhwUlE3YXJSdHFkdFpkTnh0bC9a
+UXFGeHN1WU1FMWxjeG16WVZjaWdWV2lSZUhBCi0tLSBISjNVQmt6RWYvdFJRWmFw
-TytZcmtxd0pldUg2YUEzMFJ4QjR5dwqaUnjT3oaUunudOqNfh9twKyaRttf4sk9G
+SUp4L2RpeERXK2txTDVvZ3pPUmRlaVJBcU53ChdRO7fcT9vwWgVxO2sDWjM4KPXG
-uiiKoEa314HbI1vgS4iCNX4vG+468SECiF9llZL9U1w+1MSF1y1BKy7XrDCsp7Xs
+aaYzwrV0YuhNI0/OB0wEAWlPRYmGw7xXeVNQUDgyCu84pGUt5OKC6ineOvSKLmb1
-HiA2aA==
+gQjpofJQ0aiW
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/acquisition/airvpn-psk.age

@@ -1,13 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBIdGI1
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSB2NGxY
-UVl5bVN5TDUvMTRuVFdpdG9lSkRjL2hOTHo3OVFxQ25IMDRlRGdJCm1oOEM5Rzlv
+NnpHM0VuWmozLzdBSHc4UVMrb1JhWGJaYTVEVndQLzR2ck90M1M0CmR6VzZiRGhs
-cUljejB0aUNCS0x5Qjh1Y1JWQTNmWE9kcjF1ZktJVUxLSUEKLT4gWDI1NTE5IHBN
+VWxoNk9LZ2RSY1NwTVRadTJLRXlDbmU4TE1qZkpOOWJJd0EKLT4gWDI1NTE5ICt2
-Vm4vbC9GcUdaYjNlWEg0UUVTVVVHWG5VTnVPRFBkUXk1dm8wWlF1QU0KZEU3dXFR
+NUNoTlYzazY3Qm1HY091Zm5samFZQVo5RmJHNGxnWWtpZzFxanY4eTQKWENHcXFp
-YU5GalhSakF3OEduSlhuYTN3SVdFU0NrWmJBZThvN1BGU21TUQotPiBdLVQtZ3Jl
+VjlNTUQxaHBLbnFLVUExZW01NkppZXZkNGZtd205UVdTeHVSWQotPiBXKHlSLWdy
-YXNlIElWPzRFcicgYVoldUFzClA3M2JUNFU4T2xSRmpyeStMQjZNa1I0bmxLSUdj
+ZWFzZSBycSBUUycKcTF6TURtYitTbXVzZnpONFV0aHFUZjRmc08rWE5HcHZYdwot
-NGN6NkFvbmJEVWJXSEhCMjhkWjhyZkZPRyt5N2diZDI5SGwKczFsaEZXbDljVGQz
+LS0gOHp4U2w4MExDcjVSRUVMeTZ3b0RiM1Zpa25YVW9ndkxlbWFNMFg2RlVKbwrf
-cnpMcHpPdTBPL0hwb0t3dE1XNURWckVEOFZmQwotLS0gbmQrNm9QQkpxTnYzTTFt
+irm/8ZQMmH3U5gwwYXLyBRn1PPntePtHW66Hn9StQaUSJX81+KaazppMBsHXkg1q
-bHU3WWVDai9BY3VSaTB3NDN5bk1IdUNiMWk4NAqyrvPkq+FP+fSs9mZMgxLTJICD
+3T/qvw5eyFiWorLYm3IKUqertzUVyO3ajsBCdQ==
-5l8Ii5h9fl2APzedygOLFGQLq0qW7pjBygfmQWgG4gqsO4iKIwEjUiv30/QCUhKL
-CGZJpN8AfZAcow==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/cloudflare-credentials.conf.age

@@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBSdmly
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBSUHcx
-aEtUTHh3Uy95ZGhEcno5VktOcmlWYzVqUTE1MUs4NDg4WnZBT0Y4CjY2QndadEF2
+NE9VNmRvTllERXltV3AzRmJRTmNiWHpJQlBOdFJYMDZPWGlYUDJRClAvd3lPTWxF
-TzF6TlJxall2cW4zeGltQVNabUJkcWNCUDRwZXpjYXJubVUKLT4gWDI1NTE5IGVL
+bW1nb054Tld0RnBoQW5udjVCNndJMHJjYWdMQnIyblBjYWsKLT4gWDI1NTE5IGZR
-N3dkVDFuSXdXZTFCVStzSCtCRUJGWUd0bnNGdnBhUlIzMExSNjBqWEEKOUdvZTlK
+YmJ3ZHZxLzVsNFYxM3JtQStlNHp6LzV5Mkl3T1E1T2ora0JINEhGbTAKeUpUUURn
-dzhyYWUzTmFzbnVxRTZRNHZ1NGFXSkJ3ejM0S0JCTGNpcHVzcwotPiB1dS1ncmVh
+SnVTUEloSzg1UDB2Uk9IT2xBNWdWelhuL0N1dXkxS2U0MFgyUQotPiBDY21jQXYt
-c2UgY0NxK2VxdyBdRE8vQSV1cSBcIFw/TG8jQwplZk1ZeTAzUnZJUm1qQ0VxUGpU
+Z3JlYXNlCld4aUliNVpHSEs1U0tMYTFCZVBwa0s2THI1VG5ucTVwWkVxZmdsUDRD
-NU1waVZ6OXF3NXQvS08vblYvRDl6TzF4RUhvdW16anZWcXdORTVnCi0tLSB6ayth
+aVZlRCtIcmV6Zk5PZnVQQ3NnYllXSXQKT2NkbHdEWG9DWkorCi0tLSBNU0QrQVND
-aWRVUGgwazBMSUk0MEdETkhnbURkbEZXUGNCNnN4OUdPMXpkelcwCoil0uw2yDNc
+RFgvekM2V2FEK2FTdzlRL3ZKSnM2dStQM3p1ZEVjRWo1NldRChP+Ju3pDMe5N2SO
-mOUMhVzALll4DgCX/MskwCdYohSBnMpSzqtltAhkW1aqdbuU3PC9LHQElpuHqpl9
+TxQUx5lg5gTtSXD2U43xREso9QEJVAS4BaQmkwCYo3vAFToRHNaR5RZiZ0kyoofC
-leNTu6n5nU5BHQ5qWShedL1G11SRzcblImwUcyg10d6Z0nUoCUjmw3BnGQ2wwvhC
+f+bH5XnoI9h+CdaCPT4poGVGz9sGWVGo5XOnIWS2Twlg6OGSgbD4lkVTmBoCcx63
-M+GGeb9X1ORRciqprtTq1WXWGG3tYgL9SjTAEtyMhAZ3CFjh3p4BdC9pVhCAJ9TA
+vR8ajFOeY3b8Tjx58LrP38icCO4OF3plp8VMhckqq3e1LCCiX/5V35mUqcxjE8Jc
-tbRAtqIz8VTzG86G4zPJYzBwtAse8tJDEO40GUqcOsmXhmPPpd7je1k381+GVrMj
+t6LTpi30wes3ppXkKp4IPMRHWXa0gWex09YpSxXtRrS0yZ327tJHZtD66OoUr8ve
-q2g2gTCUOrMryVRX/7+H2iRxtIxmhqESXIWgY5SIUv9uRA==
+KPEXqd6AtCjUk6MaExsYPnjMnB19BxMAMFAkCNPbAw==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/ddclient-cloudflare.key.age

@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyB0blBa
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyBmV2tP
-Nlo2VGUzZzdTNW9heXhuUTJWYi9lWkl5WEp2VXcycExWd3FsLzNzCnpoZVVHaUxK
+RVEyZzNraUVRZ1hyTm8waTA3UVlLeEZPeUFTU2xoZ2N0bk9STkV3Ck5qM1VFeGFp
-aHAxVmxQSkJ6a0JnSFpkdmRzLzl3ZktwYy9yckFSNGxzRWsKLT4gWDI1NTE5IFhl
+cDFVQ3lhWHZRVVZIZnE4LzIwb0U4LzhRWjBzN3BKaEFVUTAKLT4gWDI1NTE5IHJm
-RlR5TjJoUVdScjRKN3hDQmg4aDJpSllnd25WNmlVVTU4SzZRZEdnQ28KVGsyVHN6
+RDJZRUxIQ0FwQi85Q3g4dW5BSWY5QURDOHJBZWViOHdybHVEM2lGaEEKRjIzVklv
-TmZyV1hSbWZqWUtYNFdEQ0FLMjczRW5HSWVEaHJidHBjZzBZTQotPiA/by1ncmVh
+RllPeTNKRmh6RDBpdE9OUEVaa3NLUFRTWjVjcVB5OFl3bURmdwotPiA4OiotLnEo
-c2UKUlJ1V2Y1eW1aNG1CTkx5VjZlREt5VkJjOVZoUno1T3p4WldSUTFpNDBXb21m
+cS1ncmVhc2UgdyBWXzZKZiAsVTV0ei4KUk5KTnlZS0VBMXNYZndFQWlpRzBYQVQ1
-Z0l6eGZKaTBqbjRiTTRybnEyagpxQlRIZldEVGdNblRrZkMycFljdkwxSjl4VHcK
+MmRzeVc5TDVwSVpsQmJ4YjN3Ci0tLSBUczhhMjRMckV1amhkdFZuY2JCR2dWd3Br
-LS0tIDV2Q0NHeGRUblhCc3JUenl2bGhueER0UnFkcUZNWXR1c09QWDI0R2FkdXcK
+ZTBFWWFxai8veVFydUVBV1I0CirnhmVgavdnHIgL5KQTwjJcQ1RVvw/RxXonq9Gp
-8DfpILM67mlC23bKjt2hWfpI51JvTa2YBEvHwHDuaaZBw8FIU6E8s77iyjTysmsw
+7gpCvmnaV/iucS0myKREF//irXBz9qZG6DDZpvvIHMDsdliMAaAHWvE9+Dk=
-vmQwTrdoUPhfLHXspjHH1GGObwOxvdw/Mg==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/estuary-wg.key.age

@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyAxUzdG
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyBqalRY
-dG9ZNkpPNGlreWxRMFlPQUdFTk9FZ0kvVjNhbUNvMWU4a2krcmcwCnl1Vk1PUS8r
+bU9WQWM1dmxOd0ZDWGNaWFpKYTlncnNsWGE0Vnc5OE93ZnRvV1F3Cnh1SEFnQjBT
-S0lveDV3OVphc3d6UDdLKzR4ZjB3RUloRzE2Zis3bjhsL00KLT4gWDI1NTE5IGVx
+RVRVOWVKQjIvQ2o2b1BEZThFUGZ5d2xvZCtNQXlpa3VSajAKLT4gWDI1NTE5IHY5
-TEMzdDRDbFBuT0c0V1Y1d1diSUVYMEw0dmJwcG9WaWQwcUdMMEVtZ3cKZ0x0OExq
+cFJBMUM2S0tSYXlyVHVUOGhuVStsOU03SDhvWE1pRFVIRTZabWdQQncKQW5OZ3hj
-REFEdlJPU3o2WTlUQWU3b1NxcnJ1ajRRNkhxR1lxUmNpM1BLZwotPiBrMTREQ0lb
+bmNjWFc0T1FkVlpGd0pVd3BncEhRSDdyTE1SemFRcTlEMjZtawotPiBmcS1ncmVh
-LWdyZWFzZSB6TSp5Y0knClQ3V1VFY0dzSy9iNVdkRVZYU09yWjhONXkzck9VZVpC
+c2UgLSY8fCggNW9PNiJVCmVCcFl3QlRGcnVLZ05jaXE1WlNocTFRcnR1NUtVbFJp
-THh5amMvTlNLRDN2YUh1Mk1ncFcvZTZJZTRIRUlON1QKUzVDTDJJVk8KLS0tIENE
+d3F2L1NBMUdUZVJUeEJ5T3NjNVA2MDFHTXBvRitIV00KQjZ4VG9VemUzZ1p6d1ln
-N0ZzdjNnTER6ejRqZ0Y2WTd6dUJOaHJqTk1HT2U2TlkyUnBPTFc5WmsKYcIKEURp
+NFdDT290K3Y2QXQvK2NTMmtySkxPcTNzQQotLS0gQ2lCUEhUVlh1SmVlaWhUOXl1
-YcoFwU+gxq7BQlXo5LJDIcB73HPeerPnKYpfdyXFlsdm8mv3IXPEabSPwSNHXGIx
+a1V5NjBTbG91U2ZJUjQ4Mkx5TWNDZTQxTQpBl3ECvYohopb+98O3ahFfh5Qnqsa2
-BdinoqfHgAjMwptksMA3iIOWqp1cF6E=
+6rOdnP3KfsAPXqtbFmbVqKHeLtvlaxt/gUj2YcGHUcpI7jW92J5hbHsB4gJj1jz8
+PdogwYfHKQ==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/htpasswd.age

@@ -1,12 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBvRWE1
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBROVVR
-Z1ZpNTFjTnluOUlPMldCQ3BzQzdVaEw4dlZjc2xuMkhGWlNDU1ZZCjVGNk9PNjNS
+MXJkMEJJR09udytTU3QvWEZnMjFWb1NsZHVBYXZXUUd2Z0hZaHhnCmVRT1VkSVpR
-elNlSzMzYUNOQ0dzYkNFUDlxNlg4S3BGbXNldGN5eWYwZTgKLT4gWDI1NTE5IHp2
+QUZ6MS96K0QxeUhuNXU1NHBVMWpudnJOSkxlRTRCUjhZT1EKLT4gWDI1NTE5IHhB
-eDFPZ0VadjFVZFdVMXlYd3ZFRXIyeDRQU1dMV3ZEWHJEaGxOSzgxRE0KVVpvVnFQ
+MmYxeXAwRVgxcTBpVXdEdElzSU4wQkdMV3UweUxqemVQNjIrTnVmR2sKc2xrQWQw
-WHhpWjN2Mm9TV0EwajlyRTg4TVIvbm0zZGFBVkJqbkJTZEh5RQotPiB6QS1ncmVh
+TnQyYkVDSmljSWFHOUFQeWR4anpaMEpZOHpNOHZDMjM0RGlhYwotPiBwK0YtZ3Jl
-c2UgdycgQmJMCnVhd01JSEpUQ1U1Q3o2Wnh5UQotLS0gSkZwd0tNTGs0NkFiY250
+YXNlCis5dm9Oc1NqQ2hlTWR2NEtwNFIreHdVbXNlSnZoWGUvbWREK0VSdk1CYVNs
-eGR1WXRLTWhzWlZOaHlGaHQvNUh2MjNDUm8yWQpH1cWbszmSTjpqz8Wyrt6g2TNP
+c2paTEMzZ1R6NXh1Vml4ZURBRmQKaVB2TGVieFdjVWtXSndmYi9qcTFld3IrblVE
-rtCRSnfw7UcoMh2oW3kyYcQrwf/sAFAHLNMh8oOWoxrKG1vtPxpOz251hlnee8JV
+bzlZUkhpMno4eklYZUtuQ1p2RkNuVlRhK3VRTnFPdG1nTEtjWgp2YmxSCi0tLSBZ
-dIZ/2Gj/lPXDFTkhmX0TfABAe4wPJlM2wu9pj70UvGnI1osR6avrpYr9mMau3Ypm
+NjRPY1YwQWhwMEpRcVVqUjdPOGpjL1hUN1pTWWhWbjVPYWRhNEJBVVdjCiX336fQ
-Ucix6cE=
+uUv/N211zQADOvYuKFaW1VWgHXI8ppxAp7KZFNihgQO33iVQkcRzMQhhpIhWxtAS
+z5tCW5KKXxVGn22j1kOgDs4g0Z2yieTWHI3tZ0D+LCvaWX/K6XAvu3U3lEPhXGSt
+51vW+2NVVXYNBfieqKMtNb8VQg==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/nextcloud-root.txt.age

@@ -1,10 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSArMzRH
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBMaFVZ
-YnRFQUNJd0dRZDBEMGJZeitaS3Zaa214c2FnakxMYVVxOW1xMkh3ClpSeEprOTBW
+ckY5b1dWc3BXWnJSSU1kVWhrUnZBUGs1ZTZvVlBaQzQ5a1ZkQ0NzCm9QNThMSzVs
-dk1tRWhmUXRzeWpLUm13Z05pTnhsV0hCRk1YUjJQMTdDQ28KLT4gWDI1NTE5IGQ4
+WDk0SUNLN2pUdzQxOWhuWDZBRkxGZ1R4clZnZFcyVXJTbEEKLT4gWDI1NTE5IHNo
-OXBuVkRiS0lRQitweU1TRURzK1VhY0lnWFpZRGQ0aG9yOGhsa1JnUlEKUkU2VUhr
+YXIwU0hqbmxZMk9qT3NGaHhYQzNrQzVKRzBkdEtqejBJUnhxb015Q2sKR0RWZnNl
-MTc5N2tkdFYxd1RUemk3MFEvb3d4eHFaVU9ycEhBWHk3QVRwZwotPiBbXGVcI3J6
+ajRoUWpDbUpjTkVESllmUE14cHJaVHZIQjZQVElDZkIwdlNzYwotPiAiLWdyZWFz
-LWdyZWFzZQptTGx5SmVNM0FPMHdGY0NQK3AwCi0tLSBwbUxtKzMxYTNpdUlPc3BZ
+ZSA8TzNReV9DKSB3bCNqSiBaUnRHIHBbS31fCmxOY1JpeDg2YW9zc3JNNkNVaGdO
-V1N2cFlyTkZvYThES2wrZTdHTy82cXVoeStJCk0ed1c9gQUw93efGmqJDQ608cwj
+VDMzMjlPd21UaEhHMS85bU96ZHJSdThhbndWbVBFNkZtZGZIcWFBcGFlbzgKSTZy
-PDVTyJ7erVlArctJkTKOx57QMqWzMSEGh7O196SceZEv
+N1NaSzk2Yjg2RldOQStNY2Y4UU9LOTdVTDQrcHcxQlZrZjIwbHVzS3NKUQotLS0g
+aXYzL1ZuUkYxd3VRV0R1c2gvQ3BiQnQ0TjZxWk5nTllpRE10cVBPdlNOVQpp9eCD
+uw2Gd47si4im8kx48dqRMLg63xi7aHlwfE6mr9szrZDFl8yUMD2/jKNJrXATJcnI
+Yw==
 -----END AGE ENCRYPTED FILE-----

secrets/l2mesh/as211024.key.age

@@ -1,18 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBUUmlu
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBlM2tx
-VkJMYVltVTZyUnh0aXdZZzduSEl0ZFAxb2lIb2F2ck4zdlBjdFZNCm51RnV0M0pi
+bVhHc2VYOGVHdkVuQmFFbTdheStJMDBjcXdUVVJCNWdVMkpUaGdrCnBpYTF4MWNo
-VkVaZVdOMWpKOW43ZjhFODgzZTJ2c1F1eXc5WnJvMHVZUGMKLT4gc3NoLWVkMjU1
+SDZqVHdoUm1HQXNMdGJrdmhrV2ZFWWx1QVVoa3BnUVc4aUkKLT4gc3NoLWVkMjU1
-MTkgbjhDcFV3IDdhNjB5U1h3ellMRDRRQWVkQ3hNcVQxUnQrbkQ0V2doR3pFWFRI
+MTkgWk5xSW9nIDlFRFhpT3dEVG81Y09zTHlDNmJFNGJLcWtBT1E1MXpJOEtXdEd5
-RE9xMDQKTUh2bXV0eTdvRmhmTVVaRllRcEpiRStnSnpMeGFpeGt0eEhvQlZETXhi
+NXBOQk0KQ3p1YzNRSk8vL2JXeTIxSnl5Snl1MU9KSWUwdGdGSk53d3h2QndMc2h6
-awotPiBzc2gtZWQyNTUxOSBaTnFJb2cgUW03aXgrM3FWbURXR3o0ZkZsUE83YVk1
+bwotPiBzc2gtZWQyNTUxOSBzK3FSZmcgVmhGL2JJNXN2OVRzdzJIcEpmTW9zS2hH
-ZzkwZm1JdC81aHI4YVJOdWQzTQpzS1dHRFZYeHV2djVFN1Q3MHdhWVl5WVc5NExy
+aHNzd1VuY1A2RE80a3N0Q3psVQpnWmtUcTd4NHRyR3k3dnhmVzVaRTlJMjVVOXoy
-M2xEckFMTjFvTWI1Y3BrCi0+IHNzaC1lZDI1NTE5IHMrcVJmZyAwQ0Z0a1FHU0lV
+bTcyMmRVcU5rZFU3TUZrCi0+IFgyNTUxOSBVUjRjNXByVmFYdjdUM3NscFFaaS9W
-VEFmMFpsNXF3Z0l3eTkrdzRZQ3lSQUg4MFhPaUNEbGdVCnFuVEhXWDdndnhxdUtV
+MzNFb1B5U2lXM0wxcmpreWVSMFc0Cm5ITVJadTFrTDJGTVhvRHZTYk5aa2YyNEJC
-TkdRZnpFTGpaZDNJalI3b1NHUld2NEV0TlphK2MKLT4gWDI1NTE5IExObHUwOEFT
+UktWSGpZUWM4c2dHdFJGWTQKLT4gUz5eXnUtZ3JlYXNlCjlKZURvRDNidWRuc0Rs
-bGl4S2F0YVdHaGFnRjdIQ3VDeVFDbjh5SFpkczN3d0ZuQUUKSEFvdTIwSUhvd0dz
+WG55VmhiCi0tLSBzbnliVkpkVUxRVlJmenFwWGpjdnZ6dzNFdStqaWh2dk4vSTQz
-dDdBSUxDOHZaNkNLL0x0aDRCS1ZORUsrdWpJS3EwVQotPiApcDQxLWdyZWFzZSA5
+N1RHdExRCj2UQ+zo5APubLuTDgV5TY91CZ2cCSWwggEV5T/X05HXg25u8uIZ8Fta
-ZSA9YD4gbWMgRH18eXd0YnkKbmcKLS0tIElQa3pEcVhtN0N1bW4rSTZ5VnB3N256
+yh1exnKcLTUjS+9qFgIyxU8MWlcGcZboV0DpfPjYma6LdokZ
-bnM0OXpSc1BuNmJwZnBremRIZnMKhN29J3s+Cif3jvx63Xay77CdC6uVhjsojdbF
-zhWad9vPolrrbEiNkhcdrutyTRniFBUEwxQVGmAxcEySNTr3lnWnWQFagphu3F27
-zLs=
 -----END AGE ENCRYPTED FILE-----

secrets/librespeed.toml.age

@@ -1,13 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyA4N0Qw
-bFd4Q01yb3M3M05Ua1BPZjNsK2cwYlBuSUM3TXRaa2hPU2wxb1hzCnhoTzNMYVNT
-bjRUTzFJdjdZVG1IVWJNa29PNjVVQ2NWbFdnNWNjcDk1bk0KLT4gWDI1NTE5IGVu
-d2x5N21ZaW5MeHBzWkw5QnV0SUNiZTJBVlhXOFZacUFJVktNQXI4MTgKYmxQYmlC
-YXJvYjhKbWVZWGRPWWh0eTlIZTJPSFZTZmt4UHJ1M2thNHRCMAotPiBvPls2N3ct
-Z3JlYXNlIGowLGEgUFNKKWljTX4gInUKMkFwNGRiZUJCbUZhN2Z3YnZnZ3Nna0tD
-UCtrODlldWZ0Rk5INmxTd0tmTGx1NS8rQUtTdVFwSVROcjVqeUJaWAplNWd3SUR5
-MjRzeXlyemtka2EwdVZDTkowTk5NMk1rdUxCdkR5ZUJOCi0tLSA4bWVKMXFTalg4
-ODFIN0hsTS9lekdWZVI2VTNKYlE3UzhXNk5nM1ZCMlowCn3ZLml2b8qDs+A2W8Nn
-YGCfDV+aes39ef/2wu6EMISradXZQrzhSj8JHn7HqsarqSQmOhYP5juawEFxAuZJ
-kUc=
------END AGE ENCRYPTED FILE-----

secrets/middleman/cloudflare-credentials.conf.age

@@ -1,19 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA2NGhR
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBkZHBq
-aGJ3RjRaTjlFeUtWa1FZbmdQcGJmbVdxNVkveURqbmdwL2x1RGpVCnY5eTFZRjV3
+SnRTeW53WXR4T0dNZzZrTFdweDVvczZrNU5aN2x5Wm1QREFVb1dVClF2ME1uOW0y
-QVNMZ2xGMHVBek1BaklxUUtiRU5pTU9kWFk1VHhGNE81SFUKLT4gc3NoLWVkMjU1
+UWNhc1hNWXBwbHJQM3ErNUlpb1NqWUZzSlhqdkd5YWtuTk0KLT4gWDI1NTE5IGFO
-MTkgVkZjdzVnIElYUmkwbUFPeEExZnJGVWwvUFZsRTdhYkJsSC9CM3hMbGtuSVFs
+T3FVa21DcDcydEk1bnBtYkpCRkNJWTRUam54YndCYmVvZW1VRUJOejgKUGhQZ1hm
-UGJXQkUKQnc4MGNMM0JZcC9FeG5HeHpLUVFlNE9xelo4Qk1mam5WNlBITnF3WnJs
+eGFYMzBvOWkvWjd0VlZtZWZ3R083b1JMa3QzTkZBekZmaTRvcwotPiB4MF5RLWdy
-WQotPiBYMjU1MTkgVkpmUVdBY1p2UDdLcFpXVnJOZGUyZ1VXNVYrUmxkZlpqazRn
+ZWFzZSApRS8KamdGc2ZoWlloWVdSMnVZZDVxRC9DVEFDNEM5SHBRCi0tLSBtaFVL
-cVlLYkt5YwpZSUtIN0RwSEdOSUFYQ0Zsc1NzeUhiQ2Q0T296dmZ3UW5hY1Y1MEJn
+SkV5ODQ4RzFmQ2l6S0Q3bStYOEVvR0ZoV2NWcTE1citpalFuVmZJCq64kaAJbLWQ
-MzF3Ci0+ICV5Qy1ncmVhc2UgXSggRWprMCBuCkdKVldUMHozVXlqTVNrUVdyUVd0
+PLLxik0zObKDNHZ50MtucFjwHvjZuee8JlcOhs6BCJQcgJOIMNZ50eAc7r2lfjHK
-MFdSN0dPSVdnT3hMN2NNYVBRSGZnV2k2cVp4NGdjMHBHS0xadC96YmNObEIKUWVH
+Nn5v55VMlfrojQOHdkmJ7Hi93I+KXts/xecF/M64Ii5Se1/ZrAau2SolsOtYQlpc
-YWk1Q2tuQUpsV01JWVozbG4rd0ZiN1JHOHRFYVFIenVxOFhXRndrN09lODkvaVhB
+WQQR6rWGjm0p7XO1kW9dA96elcLT7DCOlZgBwz+2PSgybWngwk2bRTBlopgwyJj+
-eDBoVmxvbU1FbWJrCi0tLSBSeU5TaVZUbmdwdmh1TDVzb0s1eDFvNkVrK1dqTmZG
+G48qS349+qRQ3OtCMKZl82MigwBqJyG1lFKXL53sMuUP9/Ml6oWUb6qftf/FhCnp
-cDJobU1DZkdHRWhnCvEtMAlEC+BPPYX1YvvcmvRjeOgbuuxzjkGjuB+tT1pBKfYR
+3+RRBE6hrtQY8sp3j+yZ98HtKjd4iGkjxMW9kjZGw03U7nnaMO+sDzLVssO6nffV
-9gsHtkPWibhCk546Q1w+fY4StxKmaoxPddBjeQNXh9W6cCQ/vSmxAFya3w5SEtPd
+J/ZUZKQaGs6mjZ5TVRqMo3wzrxr3WDs=
-QjozqEVsiwBmBrZgt0UJ96e5hmhmD6zU7fp/RhpFpZv1JrEkhYEz8+jk5Ai96mSg
-0pKDAU8xtCnyBBaPiaj2jU/6kiKoGaVXCEuIv0uayRhRp0wap/kf+ToHA/oXVXbl
-TZsalOEKH38udhBJiMjRgemqyHQEEpjmYIMWdiTvH6PGZ0yp/09iiEyBCMwzcJAk
-nr8HyZKcuzswBcVjRak/raM9lAbpdWWktHxAZa67wsCH017FDrN9e15B2MI8
 -----END AGE ENCRYPTED FILE-----

secrets/middleman/htpasswd.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyAzb1cy
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyA2K3Aw
-bHBVd3ZEQTI2R0tyaStqei9KWnZkNklSYnc2NWlwa3NNM3hXNEVrCnV6anpBUEVG
+Ujc2TVkzbWhsM3lDSWdwWmxyVkxjRjVubURnc1FZbDlpNGh1Y0ZZCnB0Wjh3cFl2
-RU16RksrWWpkS2Jwd242dVQrbWFjaHUyQjl4NU5EVFZRc2MKLT4gWDI1NTE5IGdS
+WXJaZDd2aWYyVW50a3kyaU1CaGpyclNuY1ZBV3ZOMHAwRWcKLT4gWDI1NTE5IFlI
-ejBneU92c1BXVVZyS1BBd3BYd3lHMXNWTW95UCt3MzNEQnQvc0RFMmsKRTE2bVFH
+ZmVzYjQvbUF4RzFuaURpclBaNnhkSHFXOUpSSmIvcVQ1WkxRQmdDbmsKZEl3L1pm
-TUpWUzNoWmx5SnJhMkw0NVRwNFAzYUEvdm03UmJvdm1iNlB5dwotPiBRaWBxXS1n
+VWFpcGJRcFB5TUUyOWtjTkVyWTN4d2Q3VzgwSWFYNFBRcTFTNAotPiBgfEklLWdy
-cmVhc2UgUiogYk1BYG9RIDtQIC9yO1A2Ugp5SkVsSHdFeXlUOVJqWWludTBOa2lo
+ZWFzZSA1UlNFWjAgXmkpfTpeCnBpWjVCS09LczRVNDdlUUJ0YnNZQWFaMVI2OVpC
-WnFwVFlzTTczMDd6QTV3bjh4WXFGczdFa2VPREVQYk5Id3gwQy9TODVVCjcvbwot
+WExQSHdjd1loTGJub1k5ZzZKRC94T3NzOHhibS9kazMwQy8KTTdBbHI1Zi83Ukoy
-LS0gckpMRnk1ZzNqK0dwTUpTM08rNzJXTy9pYSt4Yms4bDJKRTJNdEZiempaOAqM
+VWZoTlovME1yajlpCi0tLSA0RWo5bmUyVGJSR2dqR3FVMXI3WUZxUWlVZThtaHdk
-fEEZwzb9VpBOCyxctqnyXmhVnOKB38DoE0yvUup9nVgu2ncwXVrPh3tMmbCq7GpX
+QURIcE05cGJiM2kwCp0dqrzGcBT0VoVmPexyPDE+/6Wgje+lr/m3f8GSHwMeO0NL
-MqpicRitNIlGhP02YyXpb/LMUU1nV4V7kN5dCIzM3mve03Y0SZG1zw+eAkDDgs75
+bYgN9sBehD8fOqBwBGHMOTDg2qObqdwzjLRbm4arZZdVTQwusm63kjm6/iLy/Qav
-Lr7rI/blUgbbo19v1swXKZzxykIQ
+Y+fD9KwJRgratQSL4K19XLngsoN26vEeC2SkK5FsLDqYKVc=
 -----END AGE ENCRYPTED FILE-----

secrets/middleman/mailcow-ssh.key.age

@@ -1,64 +1,64 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBzeE55
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBvOHMw
-R05zRTBpMFIvRlpseVdjMjI0UVJ2WDBxRmlJdUlVejdXdU4xQVMwCkR2d0RsYk5D
+SmhVT2pZWmhmclJaNEp3eGdIMDQweDNYdWlOYXRkRGpmVDNpSkZZCm9yM2ZKQVpa
-cStTUVN0K3IzY1RYZE43S2d0WktZV0JCNFR2ZWVydUpMZm8KLT4gWDI1NTE5IGpy
+bUZUc2RHNEtjUG9vaDZ3OE4vVHhMNjV4NEcrcXAxdVF0NkkKLT4gWDI1NTE5IGRr
-U2c2T1lFbC9iRnlEdXhidVgrVmZzcmxpRmdkTTNScmY5eDZMZE1LV28KZE5WQVNX
+ajNyTnkzZGQzMVBqZGl5SE15eHJsTmVuZFBBbTNKMHR2cS95MjBpVmMKRENCUi9B
-d01pYlNsc01Ja0wyY1VNeTBDZWREN0FQb21kd3VTT1Rjc1NtOAotPiByPTQmJi1n
+MFEvNmJnbGpQdmEycjJiOStQL29IQVVnVzJBZHAxbC9KWGljOAotPiA4LWdyZWFz
-cmVhc2UKSWxoSHUzT09uWXRqNG9BdwotLS0gTTJ2NVFjQ0Q1NkZmb0dTZE1Xc1F3
+ZSAzM3wybCBtMHcqCk1pS3VzZjhyZ3gvSjMzbGczTEVPCi0tLSBsazAvRzdtbE05
-K1o4SWMwaVB1WDFkZTBMWUNxQnBPNArt2aY0Lb0ey64r80mWia4oYkczRtqs6XJy
+b29oNzZMeEVheXVJUHVnSURkNnZZN09OdjFoazJqb0lJClYEPWPzNptYjbF48WDb
-34qL66Fx5OCxbq0q5klZz3S3CPMV4cqglODpsAOf4vq/3uZIbbVXOe1T4jwZ4TAN
+gnYDk8U4oIBAX5cOyMyLjqsusph9fqnHg7JSZCysNP1p7zQn5LGjTvW7A4kcvVmH
-9Wx8nA6LOGNO+NB7RakJUDDjZ0u+PsVH1ohEUGrpu26+oHFRRigyB4r7Cr4LZ/Pb
+sM93qTPjQ4or78rVLpLtiA8rAtx6i/3qJ2BblGttoUYiJARNGjmWW1wRDt7Dm77v
-6T8S4vDCCl8gMgxKkapCC74eghSyulx9d1uEFmlbdureAuig0iUUFCktSECtPOT3
+B+w8tpOTB+SkO2FtR46GZwGFOyOxJFf1dwLeHfQFVL25KCim/N+U86i4siI3sd2q
-7bw/dHi2KiSVoT1ujWW0cJUThqyuS2ugrbXqU2Op9FjM0mkoccRkwbjbMMZz2DVY
+wH5SkPShG2L5+nSQFz1pFZJRDvPtFtADw7QIFEj5EqgB3h5Lx9CD4JtLao78Q0dp
-i9KYOIFW3MC6kARgNfIjiggkJlZT15JorbGB88ScPpePrybRv4AX4hLlygK5mHEv
+gppk7JtQdHIcRwu60luWQI6TpV/ZG6w5z6B81ukNjqnBZCfafADUgj5a38qDTLc/
-9VlnSqW0XARkS/JUdcnxfJUSIgh4xN6papiO9ArKRvqTcUkcRagQfWwDkwWR2lBi
+6rdNOqobxoJcw6zBnUZHuSBgB0Z2XcIYh1vkhTmqs25Mezr3bW2QGm4YvNoMAaeD
-7oAfPNkB0UjczlZqWPbnDhLNzh6xDHjVBYg2ZBwaqpyFRSjzn9Yaj2S18EzvuWU6
+Qcc4omZwDk2giX1bGiljrDaEGpMJG3I2v65FGkHtiKT1Vyg9JPCi0ot4u/re8bVN
-RqjLrLZQv13UPG1dyBvKSWf+wSnVJ5dLsjVl7H1SFYhOU0hrdELORPq/Kw05jpTw
+ZiF1udB/AYY3DrC6PFCI/XoAg0acDpxsKvpiODeaoNqFh/Cb5KJ+coBWb6g+4l/8
-EKOB+rC4wyKUGJo3MYlKiUFhTUSMlyhY6RX4hfivLYeU7NCV50UDy/JAQHssQcfX
+tD7pt4xq0I/Yj7KG3srNiZcQqsdEtRj2DLTlCgsNWJ71iMlSzFbv6/Bdk885T9ts
-LLAAg7bYbYCmRay0gGD19lO6OpWXWCI9JvdkFw6UU0btc+aaT4l24+pb3uHLun2a
+vWWCcV80XfPyzEiAn7UwL5lGq6N/ExNifB5/etnU8oVNqDxqgVxZnVlKuhpMACTF
-V+O3RFLgKmhdtCx3e2dV5x8XjzIqKHWw0mio4dFOyEhgeUXxsoulOivOFXDEBfkq
+wU74/XUQrWNN7HuZu5mB25RJEdF+AFiUGKto+qX9QwLw/uEjesx5bAzRVuQS2TBm
-Ds/kBl7B7mDvtKUmaVgmi3XGhT1TMucXii7JL8w9MBWgdrBbl0rewpvafp34W0n3
+kRN6gK8eIX0xIjHI0u6XnwKQbYqFRuKLrShVI2y+pKJUEBa9iG1IBIyA4ssw9Avo
-wQh+oqUqf/0E+5LGAuQQ623MeCaXmYEyypJSctZbmf0zCKFFzTU1/HVjZgYbP4AM
+UCMz9MX+ZP5qzuwJ9AgIquyez+GZHgQeOv5pRYC+vVRN/IatxWCazlv7XLwBYy9J
-pI9H0mqxHyk/V6BxmvvZXw48kVoV8fOMseE+Q8TNp/NnM/TOgBGQQBEwGeiKDZnr
+CndNG7TP5Wyq1uMH7ScK6+4F6Z0xY44tAd92WwCceKtZmrHBLVeMP4Gv6dxTsb40
-Wk/GJBYNeGYMOJMYYkRToBeQowqBQ+NtNpersUda1RoJhH7EdxYzLBK0jN51kYBS
+yGaIfNvHy/zPpOpCBLIcEFjlBtlIT/zRaFAFvczv3AFbHKKC7Lx6KEDk4Sn9+I4X
-7pHU5M1ZCnmF59RtEezq6TNRwQAO3tnp3+qbUxim6U3V8MTOpumL4sapuqv4fR/S
+Ucq+bCww9NShsdTRWKVrW3UZOYmOUtUIzGdAcp6lNOQp9HKhjP5CuU04J34D2aC/
-UoTgcnJIyKBif9e7XR82da75YXeBYWq8tj8d17+FPolJivdwiyB6ZTvkzfXo6Y6S
+ptRgAzoYT5akKI2vLm7b8besa2A2UbDL8wl5koBt66xSjugXEerbJeWnTInEUknT
-veNv7F6bRf1hukTviMUQnsc8XC3oDYyqKrwMXRzgq7oaim45zx+8MHVPqw9t4NSE
+8IhmkNKW7fcOEDEQd4Ie+++9mJpltaO8TMmeij6nmy2AvI2RlPK5oS3AipimuYSY
-0FA5VqEqRRdQWL59zuey88Uh3GtW9W4z32NYWYlC67fLZUqBqckbYmqqwqcS7XkS
+ApjMvIy3J7065c2RsQh1cpVd8JwW5Dm2/eAzMlbmX+Jn/D403Jf03LrN9Zf64+2l
-Egswa1KHHW9bGAkJvLdxryT65EKnZWlVj/oTild/JmAeMLi4lR4d9DQ3N+ko6Zcc
+0L1+9TYANtL4UcsvGmd0WBKGyni28UnwMPM59N7iaNNQHfUpBDm+r1+bV2KJ6/Aa
-DFQD+00pncDCFNtk5BeAG8j1Vp+qpZ/5PvqNAWsnoy/yR7UZ9i/AUsW5ZtQHJTnV
+W1mGoKR1nTuwmBgqkLQ2soOOlt7a+/5w+pFy+8ltuBuMSYOTB/2JakiFMM0pMo19
-tuQYvYQilnKr+yNjHX+mvnee3ZmlParbWh1FqcVPEZ8dM7F0x5zGUPAPdScyzYtC
+Qqd85YZ3vuLQnOH6NEa+0e7kwtkzumcMm/pi9YFMGhlWmGd5qzOUwc1e3PJKj78M
-P46vhCRLKjzXXBxFK/qLtzqLmGiCumk5FFEelyhoJmZO1OoVZOrdUOi891OCUyKy
+jX81DN+lrKi5ooAbB6DUTJlwbUt/4s1yiMrtIVbDRMseUM//4hInOrpU8JAKt5Us
-m3zsh4IJ//QqGg5+sza4Q+z4bjwg2wIAH6vy4ULtdIF+vij+j8dCH4FR1TbQ2Q1V
+BobHcdwuEqviD62r+oqfHp5o2ZRoAEjyzcxE6sKmEYDJ8xdXpLdlL4IIpsxl+PBs
-/urgMGj6N2sjxjBmAwxtcGgwc5HI23SxtBQh1msSbJQKChSvbI6CvkFdwfzGuWZy
+aqPKcMfE1OaJj/iRS1tAdvYLHuxMSBBz3iuJzRH1YrmPaj86egtg0a3eDabXBmcX
-c8jWNbrv6Xf6HW2pUrnvtdUdH7+Jfx3O6N8t+yNKbxCC53GwHnqclkrhvXcwQCH8
+ZSGQry4lUtDFyPxBORMlOy57mqWgL+1ZBAQBGCkcZnW8lrEJk3kmQKy8ExCvAFP6
-sMq7GFzS7xZ8n8qMVhITh9CrKuFYmrh5gOrFwLlQArwuKo3fK2/CSOgGzqVgg08r
+qCgDsR6U1cR6kepTbUT+HEf1iVxt2yrvKNbvQNQdGsLuw6wzk0eISGrAzAdTllow
-ddyeFzvDlWXg62uinUQhni1w9Ou6Psy5Azw/yBRG4wnBw/n7WgRZ7ncVCD7ws/c5
+VvO1fO8T8nPXquKB6JYFH/QEg1pTT8K1DBqS7Ms8hyEZYHOIYYglUB1025rLhMkQ
-FHAvkKdd95F6EwSfK2gNGmPO09D+srmbdHUJbGN4VgN7qQ2ZyfA/rceLDOrPyt9r
+SToqJRtJZKZogafBQPgW2HKJmt4S2QGwtkW2Vfe5cJU8kOtLm7dJGfUEs75CeTw4
-ipkhhcgg50eMWEZr72JT9feKDwAzQ4drx5+9VFH0T7vWCyCBEMrATctnE2gRzS6a
++4d316f+yM13+OqPt09zYZbAW9kwbRp2MGULODu84Obul9TTGZhB5sF/mG/iLMny
-JQD/cn5FHbrXXs68gAhyL10bktnkcCp1I3TTYgy/guC1NFhK7/Ja4VmP0JEyuSv+
++2p1/ugtj8Ms1MMCT3IMoKEkKeIeL0T0fuTcjqHGPpXdBpGkv5g3ZTY0NLZ7M8VI
-ZNzXtjx7T+/HDxXo8pXC1hm5Q1GHmkwfpzPpd4nRZZEgtcfdat1VxBii67XaB6VD
+l7PGpaugqhZb+XsJ6tznSFmIEhfQl/0iU97FOXRnXS1wJUKdgNliQqavhgsDsl4g
-+oWZgd3WocxWtTQHFKMStKeM835RnA220jmyXKQM6q7NF06dqx+grtFkoK54uqbd
+mjQfoTw+1DhpRSHxBPdu9YvQ1uvffbM55FTrQbIgNY7aZ5VqATO8u1bMopnsw7+0
-7PPnn6M1WvzC0xadBmO58Z8uNzo0cOipaxLACcyC/GYb7M1wGWbC3iKcNbw0asxU
+jXn7EKnf/tolyS4LNlCvfF12wxXycfuIG6zqOcnvtbQPckqEktdJd0/8pEjpdCT4
-ybslcEc2M8002nFU47CzqAppN2KfcGJLj5cjLcHHNrwsVf/Z7QdS/vXaGbuV6rtl
+OdihiOsxQVX8Y0idh8NHB1US+wsJ6X6e2rejKrQ0JfIok/+V501PLNkSrAsWI3zE
-xo+euN25R9uLsEzAtRl3JeofcZRNtA2itROxxxS4MCivqz2rexTg94xyipFNqFzd
+jTQlXPZwS/4rehL0jRlfzl6UQgw69Bb54Xs6gaAgIU1j23PPYoSI52Id9Fot0c6a
-63bA3nRIBbrUWgekjgqcRPlQ6m5cOq7zOd5aelhUZu0xiQJaUtj9A92iJ/9EkUVT
+Lm1IMEJSB7/5+tD/9AltDJ9mqusmhuIFGFfLWyFlgNa3W0AKRZtIorZXKhBn1Ur8
-ZpF6PliFg9Tx1EOGMIHwHyiCfwn8fR7QkvKihId5gpKT59kr9JDLw94r9iGdpXN0
+UzkcxoLMPSW0OU4+W4mm1bHCSFunZBfrjLfdRDGqXZCdrvJiMEkhsHZbwuqGV8cG
-r2ozitfGWiNX9g2FvskG8bs4mqxv5lgyw1JexJf9+SiuDQgsRc1qYIpM71phLtI6
+M+eoqqmLOQyV8iCkasxx7r/g8qYPSNvnzmz22x/OeBS6CV+iF5EYWsQkej//voHP
-eF3t8xI9E5ALFk5lTh4TFuv1vs97fmXnZ1TUO7DDA7C7xMhF/9SgBjS8bs/anZgt
+wHDebEwOkvva+AdSTHX8B6k1Ik084ppdXWm1sKI3LqN/97rFnQKZXIfdCf0qk9fu
-BBfCQCPezIXxtE+oVELHGAyoK5q3kQRJrlxqMnK13/Ugzn/3DsHXimAneqCZR+B3
+infB2DbdEoLDRzTqKMJ9lSh4Fw3I25ar0YC9WTGapY4hUU7YMV+EIqulASkwYRUj
-T9NYtNgxWHubF+XW4sBa9cBXPQyjY5BWUQYiBk51zdxVkPcqt4ezeSPn7EHQKGDO
+ZTjvwlmRudTogcoTJkn5KrCOJP8UUnrePp2g+jYO4UjBA1nksbjpSPFfDDOwC/RS
-6Cpc3E4T6C65TsXuUgFROXIRjft9Hwt59UwcXHGUqb6eeX9I5uSMuhfPZe1Iv7mM
+ps0Qy0JRyyvN216y+cfCS9XRT7Of/TrcFJbsfbzoIrAz2Bbw4l3c7Msy5gLhw46b
-ZvYPan0zY5kZ1PMHrApgx+10pmonxIoqj063WP1jT/4JC2TJxGncl38mDCZ9cynl
+fW0vSWoasTrhQRqFJn8ug8lM+l/5uppGa35Bm2dfAUKkjye6LaRCE5CODvADD0zo
-FA8ShMdZcdSgYDZZ3BrF3MFJFTUKL81N63ER+n00xPf9+ZqTTqIZgLInO2B9kVo6
+hmoUz/tp4kCv9tzR8Ry2dj/uuUqmryqA+XlSpYm4318AxdeOC/l/BHu3qMQ3eQtw
-pAp3Azh5d3yfSoh8i0r2VCKIZXpreQvts4/mdrJXEZLmRcGZKmeg3wCxQ7mTq3gm
+e2UroUSm+dlebdsEwvVCX8KF2IKO/UPKC70pXg+WcxZ+mysX7DiWHnWWCFLJYXlq
-m7zdvsDxh0AK/HEd+fd4wCkFqtHOGb0mzuTLoDZ53cmf72uhT+npw/K83kIr9wQZ
+5GmNVafXnWdQjkoLtkurdQciBX3lZMW4oQgUJPXV6mdw/cy0W5jfHKLKxpgwwQWa
-h87QRVEefXbEMzbxu95nLZBpgf/xS4VaUOdzBbHfV2LE92309VEO/GOWANz+kTew
+8EPe3Ep7phJ073lwv2pxfWGWofxcOBWQMItg3Y1D8jfJjEsFUJXZIUAhNrBhHX/u
-G7lRhTP17nzmuLVn5VZNGulSqvfxZghl9CUHYlH8aqEju8Yhod6IGl/86feHs99I
+Ei1n7JM5XZ10eXNVMIavSpR1Z9sPN/1QL4VUrPoN7Bfy3aR0CYke6JHQKYnLUMTb
-MRpWs8qgIFtiVTxbCSma/pa0nC8z0p8YeFVCdzBHXipdszXNV2iAc7UIxVjwejMV
+wOdWE6UU93KtzsqN+dResaAKnCSm6HlEKGnX4EZZfzxoR1QOaF+vGvMmPLVbFbcu
-typEIZM4JFjqpuSrN9s8hRzd/mwxPcOlboje0BrndbZiRQ9+itefGIX92jLqpNM1
+n9+/vF857JvYAj8XbSpgENcXT8p4lN7YXHdXJJwVg8hYhmDz1dru9cRxZkz7O0nv
-avEHk+R9yxxcvoP724ZPzaRg6K8ZNjPOavJ7afh6ewnO9/j+SdJVozYGpupsBy9i
+PCMeNCIbp9MBR1gf4LM9BujifVmNSMFZ2/s54AK28N0q/Akb98LBLb/RoFG71opm
-3OaJYY1+/DsTodCYF/mu6+P3S20k2SwesutT+5KPrKhQ3fASfmDwslHnUS8/zuhU
+T/s3hOLvrJu42KHz8t3NY1nYQa1BxmnBmyzquoa00x9WpWZvoen8gIIEJfSJ7kKK
-OPDzGySCQsPzVOW76k7BsaE5zGgNToq8lnhYlE017yg1BVyDlTdBPWn8IILz/ZEc
+V2Qd3A+ZLi9BS439eMyNUeSC47gKgE+Cw2d9BiRlayrI6NEeK39XhS0XpWQfZne+
-L2QMeVI=
+tZa4RLKo/rI2Pi2URtrIxw==
 -----END AGE ENCRYPTED FILE-----

secrets/middleman/nginx-sso.yaml.age

@@ -1,22 +1,21 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyB0Zk5z
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBlK1BK
-dzVqSGJxNlVnTi9KN3dvelh0cFpTdXR1UldsQWkrTmVrOW9SaERJClI2djdMQTQr
+SHo2SEpLZkZiSHRTdTB4azlaOTB2WEVGT3VhaGhiTGxubnU3ejFZCklEYklGMDdF
-U2hMeGxZOWpWVG5SWUtnVXNZazlXK0F4bUtkRW5hZVk2bncKLT4gWDI1NTE5IG10
+VmlJMGpGS0VUOG01dHkxZGhPNmRHb3lzczZCM0NXNjFJV0kKLT4gWDI1NTE5IC9v
-aWhlaXNFMy9ONllrYVRwazF5MmFNOGJJOWVxRnNqQnNocmVTTExKVlEKWW44d1BU
+Wm1xQW9VMVNUWXUrVW9CYUM3bzh5cHBobFlVRjZnM2pvT1dyU2I5RzQKbjdHSFpV
-ZHJXTkJJTEdSdFU4dzlJc3NaNlI4WlVEVVhFUWV4UWI3Rzd1bwotPiA4SS0jZi1n
+WW5vQUpISjBEZ0NIQ0JTVDFnell5dFFhbE5ueXZXVWxGQXFpZwotPiBDXFVzVWgt
-cmVhc2UgVD0gRXIleGAqUXogYgpTbVdueWxHN0NNQ3Jqa2hsSWUwYXpTVmRwQVFW
+Z3JlYXNlIFg4dTwmWjN0IDhsWgpTWkcwVngrenF4YlNMZS82VXBFUU84TlM1QXhX
-UTgwd3Q3eWY1ZFZDRWxjditRdEdUNFVZV2UwTGpQZUZFYjhNCkZuZnA4WUNVeWht
+ZEFaRFhreisvSzdiRDNJbjFndGxXbjVRZmVMQk9tMWdTVEQxCnpRCi0tLSBHZ253
-SWtHam00NWNjSHhBM3RTTmdjaFRTKytzRFpJTm02TXF5Q1BGdWkxN3lMRmk4Ylk3
+M0lydWpTdXBTc3RPZmZkZEdOMnN0U2w0YjRsZmZRdmxRc2hTdDc4CkC7mU1haU/s
-ci9BCi0tLSAvcVExWEh5Tkx6TDNJRkJuZUVmS1UrK1ZtQ3hSVnV5OGtmRVp2WU8v
+G0kFQDXBNOJ7DXt6/fBJZye4540fAIYjoa0H4L8PCB2c551JdbG7JvE/eF4ssDkT
-NkY4CpSGlODuKDBde83bkqU20xgamzp5o1px5VcyDFhm/q6/QkGTrqPZFqp4Ho96
+XoUEE15FjLERSKjEbxfRw5gUO2lLM0IfF3aRO4QZrp9l7MZBXh3qSj76PMgGLT/f
-Om8Jk3RkOBTSbdYlRXlNOjq7SB9t83bf4nwKU/RH9bKBOXlOtuU6vgDdtZnct+L4
+u7hje2CPB1Kk/LE4RfC0HjGgcZWNabO1CbZVRhQ3oqMrc9PdVzT/XM30bopDtuiJ
-S6P93brPGYhV41IkjNxg+HemIToZxZwO4lUqlICmkJDQhuk6F9SWYfiNQd8l+lXa
+jgTnPMjzyrSPhtbJahvzrA9kTQmOfHKx5hmZzZRzrZTZTExTScsug1/rUxQzJ+He
-e4WbldWMpwlOtJVplen2F8itZWAIGPNRq5UTmzKA40Zk6eW+YWqB2mhvbZ7b4Nto
+8kHqQPFMCMz0elS+SeuNuNsfmdOUWNaYSp461dLYR2/FMlp1+BH2sYzFfEN7awi6
-gruh/4URaWqjOGLGjCfw8zJIU3qf5wWntd5BnLkFYjFZMYLWQHnF/SCKxxLVlzsE
+MrOD85TbC8+R3Spno7yXdbnHcdIJmhx9FjYI1HR6AJBoY7dWSBi6JzPIj6uIZlT/
-9t4vu2lCwjGKj7uEoPUcF9bTSNZjynNFLZsshGjwi5L3dvnUJzUc+JXKxMqBaVYF
+1Wj9/MdD4KbphkvjrlSgCw8tEO4vJgS8W0qZgA+43qUQUJya3wTM0GHHFQ/Rr/z6
-DrBDBtUnjae9jj+/YPLoO+6BnbezJLhvfIyT0Fw82CGa9Utlt/VltWp7gUep6YyK
+s/qdRQRxdz8xnCz0il/BsvNjrVThp3BUzfxKisN1iNMGa84hhkudSJiqyRcgIujC
-ArhZam2c45rzlwV1tnsxjZFK9EuRYJeN1VRYr+tR2wShUGKP1CEz1CFmkTa+r91V
+Nx/XbidhEsHAUXJoZdDhWJ69V3fsiKkbIHMVl2oqwzOyy3cfJO18B3qdnWmvUBQ/
-/8eUvOAgEtP41y2vxmpFu4kjNQEAiRs9Chbg+Ap0zUSxDZqkaQXSXE4PWEgks6VL
+uuzJ5c4nHA8dcKtnEuXc1vkulkAEWsohhEKMhhA0LJZzrQPKAV6OJsskv7wDMPs0
-I8ss2HfQDtcnEoNOwuESawI+i2oDclvkmGD+UDYz/BmxkDrjWjL0CxKQHDv3GHgx
+ntEHKSOSA+zTJdJKliktMw==
-URR5TtwKc/YoiSkJTYpBYB1VLhgHCnsQ175p3w==
 -----END AGE ENCRYPTED FILE-----

secrets/object/atticd.env.age

@@ -1,16 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBKM1VC
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyB2VzJx
-TGJOMU4xVkVnMjlTRlpmY1BKT3h6WTJEcEJFWnZyYThqczZPUms4CitRUStIdlhY
+d0ZudzdWbDZsaW1VWWZjQzV5M1RmT2JwWEswZmdWaVVpUy9pZ0ZjCllWSjNKN09k
-MHdEV0gwZ2hBbE9pM3VkSTVOL2ZBZFBKekFqMmErTzZ4VTQKLT4gWDI1NTE5IHBt
+emwzSjZFMWloMVFabmJBZUFTS3I1MkRaeTVwZHljMTZrOVEKLT4gWDI1NTE5IENX
-czNzeldEVnh0L1RDa241U0dWcGs4emJ6ZjNyZzV0R29nQnpkdmhUMlUKa2RCUzlJ
+ZkpsZGJqQkpzREhqK2J4UkpPb3VMNFR3SkNjTHdLTWV6ZUlhTkwzVGsKeisyMlVp
-VXNRZnEzV3BwQWFJc28vWk9obHMyem8yWmhDZzlvUmduSWJRdwotPiB1clEtZ3Jl
+R3B3NG1yU1MzL0FIN3I2N1JpTzNVU0d1bndFbzhYelBTOFFFNAotPiArUipFXVEt
-YXNlICh8NkYgPC57OiAwdixSfDEjIEl0MWoKcnRQNWVKSTJqM1U0YytFYThuVm1B
+Z3JlYXNlIGhONVggYyA5JEIKVUwvNzVRSTRlSVFtQ1RpT2Njdlh5bkM5c0tNWXZx
-S01MOFQweG5zcmhBbkQ1elJOOFJ3SXdoNXNBaTB3VW1YUjJxdkxGZU5PMgoydwot
+TGNxekE5N1FKTjZnVGVhb2hZY202dzVSRU9MREtmVCtwMQoyanNpTWVmSEtWMG1h
-LS0gMTFBNmtWUXRKWFVWNi9aaGZVZVkzUzVUeGg1ZkplUW13b0l5UE12c3VvUQpV
+UlhMUzVjRXZtS3RudwotLS0gbHQrd2Z4ZDZHSnF4V1Y3TFBwcDRBSkJzaVdUenBF
-KCGAO6MlgPP0wVcDfMnJWEMSpqIs3X9wkkIoo5yw6NAeUhlxe2emWwk663PPUkXt
+dGdmVmFTSHdiUFdKdwryhPUveYq6wJSDuTAAs97LHdWC3mQ0tKpEzu+rs5338CzR
-NfiLA2jUTu8B7I2BNQKi8PMmnrydfjV5sGH8ACeP9QDWPHb6Hlri2R7IK8juEpl6
+sqrfspgGrJ9+nXUZk1cj4z1LkSzTW43L07Tjo5EH+VWYBDWCwrUFCurJhfr8HkdI
-0sDrh5ktb2+vNqoz9lNm1hk0S1l+InjctP7HUM8hhNjXVASBUhUX37NJEtH1DQdB
+GqUaBYNoN/BhtSeBJN0S41NFek8XN6fiPdY521BPjfds8+HEKxyQXahb9noxg+77
-7AlebX6bd1VDGwsfCyEzdg4N2nd/73J4fcjvtqoEz7fdfkGisNjjJ42iFNitLNZw
+sk9KPjLx0xn75t3eHKray8kcKf5qMqBz+dmdP721YJNyNhpMr8gkXBfNpYilZyl9
-WnhcUByV7msJq9QuYI2dozDn8qJPFyva6sfmeuZTgqclBOMsDTsBzWlXgK11k1Pz
+DOQDwWtMiXv6+ugdkhwhfYK0V9MMwpmf1a4wNwQgmTludgZYeVkbQGVBwIeIijTq
-got2TcUCfPIVqWQ=
+bvOp4FPGG8/f1MszUhXcd4uco8KnSZsAEUA=
 -----END AGE ENCRYPTED FILE-----

secrets/object/hedgedoc.env.age

@@ -1,14 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyA3MjM3
-dytZeGQ1VmFtdmtEdFlQWG9zMzZLY3psY1NBaVloeUh2VG4xbVVrCjdua1BHajdT
-WEpvdTRoTVdTUGpqTzhQWXpEMkxEVzBwQkwwZ21qNkdMVkEKLT4gWDI1NTE5IG9x
-d0ViazRzcG1qSDNFR29GcFJtMWxabWRqdnBjQUZBWklyNUZvdjBmMlkKcWhDUGxu
-YTZUbEhtMW5pajdpQXYrdEp4NllXRkQ0NWRhc2p5Y1Vub2VjTQotPiBMSTgtZ3Jl
-YXNlIHQ3Ngo3enhCRVhiV3N0TlkzdHNMMHJTZ3F5ckc0UUlUa3hCVEZQdTUxaW9p
-R2hJRmlxWTZPU2VVbEpvZDZpKzN2NXh0CndxRVM4ZkEKLS0tIHMyTEZJUVRGWlB0
-bS9hbjduWWJuVW5KVXpnYlRkMFdCK052RkUvSEdMV1kK4fjaE0yBZXu55Kn1j/yG
-PRwEhA9QyNbas21qCikGh8RxCUfoobhlKHpYxyvOMenhv0+8gb3ceXzSUR/3a98Y
-orARTVFlOvVZolCwoyC86kUExIBubJxO3EpH2UxrvQoCOrAf5XdD+qzt/G71wpYk
-jGUknUWUyPbj9HWoVo2aRmC//bCnena9DUVicAXbDwqr5/KCHHFlkT9UI5Vqvgfw
-rPpyZ+De
------END AGE ENCRYPTED FILE-----

secrets/object/minio-client-config.json.age

@@ -1,15 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBjdm8z
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBOWEpE
-TzNmSFBzTEdVT2Y0cW81azFsM1MycWF4MlBCNWNEamNXeklVVEZvClAwbUd3dmVH
+SzZZa1VhTEYzNmdJYnVOMUFvRWZDUDkxeG1BRmRkUHdrazl4d2xzCm1teFFNZzAv
-dWsxZWh3eG9ianA4M1JET1RDSkpHU2NLcGgwRlJ6eURsQm8KLT4gWDI1NTE5IEQr
+T1AzVmtOam8yYlJacmJza0g1cWg4VkMxQ3Q3RU82SXgvZnMKLT4gWDI1NTE5IE9D
-em40K0ZFejlrMW1yQ2p5UUcraWd4RmpseVZsbjFwTndRYmMyUzhyemMKZ3U4c3NH
+N09ZMUdWczJGSzNheWJrL3E5L1JFYTd1cW9sTE9DUDdZaklEWWI5SHcKNVZISXdF
-bk1CV2hZNjRNaXJHQy9PN25Fc2cxekpNNnlyTktOcHh4eFlFSQotPiBLeTdiXHct
+TlZjV2Z0SFFBdnZsWm9FVFJBbE8vSUdFdUROanpKazBrYUkxRQotPiAlV1ttdC1n
-Z3JlYXNlCmdRCi0tLSBraGk5eTQ0K2k0bTVBdFdsY3JqZW0vL1N5V2FFSjNsbmdE
+cmVhc2UKaDBoc2c1dWxtU3NwTWExZzRnYldnTzBpN01pY2d6Q1F1Q3JOV2RVRgot
-Nmw1OGwrWW1JCvuxFmnBfZEpLHNyN3Uyygvf7MfsG8PJg7Rr2tA3a+SrBrRijJi9
+LS0gd3hTc3BIWnVOTjZWOGhldFhodnlEUmhoZXFpTDM0UkdGUUIrTGdXby82TQrB
-XVsDzB3HWYGHTRegf9pz8KruyedFNu0volXDSjT0uC7Mofj50nF30+d/2Z25Vem3
+ujaYS/FV5GOcppqO2RSDr42bL2ERM8BYaWzq3lERzYGwF/csK9ZhS7x1+F/89+k/
-2KEpvrQ4o0C89il4L6ptRndmbn3uEe6+eFPBGLeDeuUaXUcuz811145ZNz7kalJL
+35Zl65JRyfzCrP30tVbCTYd0wIWPmb4mnC8Nv7AlEZSi6AY5c5mUGTJQz38So1js
-TJfeG2gOV53lu0NxK3wQ7bW+xtrwOHToIssGN0TlVVi8qapSXLYwxTkglYCD8jwE
+jOwJfn5yoxhCD36c9B74qAXajNXXSZo/Os3boP2o24ZMjPCSk7h8mID6kcmCsWq/
-6fVpGA81JQy6EcKtVZ13xfFwF5pzrqeZQWSrW9b8Mk5SkIKC3MxTTWdlI9Gobqx5
+XMGiYSdEqxX+sgHDh+jeCmh+1D3IDsA5LYMg1YMkRA+huYPUBJdgIML62H99vZHW
-RsiphGvQ4ra+GraZNXDn80w5phXXv9jNX0VUGe7hi1/G+KYl1m1OOsdyD/QluG8P
+eylli1v5iAxUhdYkN007JOdlfi32PhyxPm5VSKOJNof0CbjVs4Ew4WvNMHG9xJUe
-dqwfbXTo0F4zqWagP9dGhMkjA+lC0jmmFhZDQrS1RabVMCsK
+7z7T6iboHgiVJZGqjHQ/Nl7YpkqI0u83tVVqLeiFdDMLNXsoRqMA4a8kfg9h7c3Z
+EmjQPAO2tIRfNXzp63KVVcy6xMizWL3e9w==
 -----END AGE ENCRYPTED FILE-----

secrets/object/minio.env.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBrU1FR
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBzOSt2
-VUZoVjNFUmxNSFZIYzY3TDRpZ2drbklvemZBKzQveFRGUnJDUmlJCkFpZ3F5VkVB
+MEpEd0FyTklGckp6OGo1L0NpWWFIVVNvViszVVRERi8wTEdlRkVzCkJUOTBCUXJx
-ZWhKTDB5UGJkTVZrNHp3YnBxYzdwa3NDN3dTSXg3YVl1dGcKLT4gWDI1NTE5IEwv
+YW9SKzNtaGdjSVlFQ2FPVEM5Vko1V3o3TFZXNTNKL0ZQUUEKLT4gWDI1NTE5IGU3
-KzhUWXh2ZFE1YTZUMzdKRnZKMU5tVEppV0tvem1lQkFxb25TZExYbEEKWWVsdHFD
+L0FpMHJRN09KeXpTd2JmSk5iWWRLSjJiTUcyU0tNYXRvd2FnK3RsbkUKVjhMcTJ0
-dXFSRWNIa0UwdzZlc1lzejRSdmp2N2lHSitDSWhCeVpwWFdncwotPiAiSzhzZi1n
+UGNFU1JYZUVKclRndmwySlVEUlpsYldsc1lUU3NqSHdxbkoxZwotPiBlJV1QRiEm
-cmVhc2UgQi5TMyg1aSBUdCApZXYoclcyZCAnW14KLzNjbXJNOHdOcEJMZE8ydW41
+TC1ncmVhc2UgWzJmUzA2P3AgM01dZDhMXwpaK1FsL1lPZ3QxUnBaNHovUGJoMGo0
-ZDdpWmRSCi0tLSB3b25sbnhBMDZrZXduNCtqd0RoOWZSdXF6L1pSbEF1K0ZVZ2tB
+QmZXRG1Yc0EKLS0tIGxsU1VQSmpmZXJ0NFprT2NYR0dxTS9MNDA1WklQcEFjcGZl
-TE15WFUwClKgHieoFUU9aDCR5P3RtjWMYDHqJ3BGHawqgJFySxUw6ZaiBKe5eFjD
+SHJFL2FUTmcKLoJ/aa5cdDY+vRWRZDUcUGGuKhjT+BQaYA4nSIlH//GYhN46tlRi
-4/gtY9hIVVYvGgaULCLaM6pSE1wm85EsvqMXMU9S7TbxL7gplOugbtnYSggCF9Qz
+KheC+N1+u3GUPTG7peouUl4kzU6hxIJ6XNg5Zx+GwrgErBgmOVElG3bLSD24kyI1
-pl2FTQ==
+TuBtdWBF
 -----END AGE ENCRYPTED FILE-----

secrets/object/sharry.conf.age

@@ -1,18 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBQcmhx
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyB1akxN
-UW5zUXljNzdPTHNLZmZrbnNEQlZqY2pWODJsSDlROStwamRLeFQwClM5UVdmVFpa
+b3pnVG5nN2IyYzg2QiszZmgybGlTYVJlV21EQVgraThXWDJsV1ZFClJDU1dvb0wz
-dGd6WkwyNkJicVplUFRHbGtVaE81clFRV0tQSzMyUlFvQjgKLT4gWDI1NTE5IEVE
+ZjUvRzBBK0djbUE1QnE1ek5LRWlMMXhzNWx3T3N5RHpLUmsKLT4gWDI1NTE5IDdH
-eTJDNFpnMTJJc2pXZUU4UXp5SXhaYm9SV0Fuc1BFR0lVYStGeTFORUUKR2x5SkJR
+UmFrdWtYVGJqUVZWbXBKMFJrWlVOQk1XVE9KOE5VbWlTakpqZXVQMmsKeVhSUjBi
-VUxSVTA5VGliTlhseHhjcTEzVVp0aDMvRmIrVitTSFdaYWpEMAotPiBRTmgieS1n
+TytVREpQcmloOS9GMGQ0Sk5DZlhiMHRHY3R2NzVVR1N1Q0JoWQotPiBdfC0tZX5a
-cmVhc2UgKFFzbEo1SSBiLmt9Zm8KWDd4MkV1M1pKaG0rdzFMTDU0NDJ1cWVMOHdu
+US1ncmVhc2UgaksgbjpBKygtIFk0fD8gcz9CCnM1aW9FOGxzMjlZTDJCY3Q4TXRJ
-NkhwMkNwaG8zZkJ2R283bk02b3ZsSTd4N2FGdTJabHFYMjFRYgp4S2lOU0l0L0Nn
+YzcwcVh6NG1uVjhHaHRXSVl4QlRSWmNsSWlZQTc3aEw3Yyt5SE5XM1BNNW0KaFIy
-bklhSHFEdkRxcTdDTUlrcGJxSGVZCi0tLSBFaTJNTCtCUTYyTEtUdWJkamVBZXRL
+bUswL0RVaXQyCi0tLSArQ2lDTDR2ZitPREpSZXdTaStQSWxJR3FjSnIybTlKUCtt
-Z1ZyRk5TemJPNThkeStBRDd4SDMwCqHkFPwwIwQyNRKz+qiaTlEg+wae9/zBVEso
+S0RQWVVIcUpFCq7ovYv9pFMNM92DSq6vXVhREi7pTD+yxpIO7o+YaAQPg54z5F12
-lvsNmDQmShacPxNMX8gRJdDeZwPgVVj6vbzuvsZsaeqS0tz8Mky1t0lGtMlVWkBn
+gyJcKaU2EgzLacJdCERsTdOQHMXiJA28Qa7OTMJOj/engmA/cTY/y8eqaupmjYye
-bKzlrpMMmc4myREz3a8GgSK7Q3fEM9iy0lnKXsOrjXmO2J6Ebc+Uzp85Mn8cWT5q
+wTovBFPG78/IpbJWRLjLO60YBRTegjfGPO2k9VRlC+61OBlv97OkzoTVczuvMXtP
-BHN18Vt4BjJXs+0XUwPxVEy6vnw7yXVeKEpFLtzjRXRVKpp3VwimDvgfE6XewR3y
+36KI5RT4AMw1kkwiaK0GhN60eLQwBmHpOpctuq2P8995Pj+kUiveIXAVvKPk9aZ5
-qv7B36u7xU4iTZam1N0ZwbdunVKWeqRfMv0auWpkGgU/gLjM0E+5qFZ6ENEBN9iP
+hw2uPxw8Yv1iPOxG6mHlu6Cnpb3dHvr1OfqMQ2Agn6iahizbLcgm110ScVxwC3Gr
-8wHddrpap1fYNYgrMGM37x96+J4NYomcUlcZ4M79vLUJHyXLWrhRhIfh6HZPjYra
+RqCt4Q2biTQSyAGJPrKV0bPsdevTS1HfybMZf/XXnCQ3Iqv2lfikWt3UZg4Nlut2
-i5q8jB8oSE6UpAxkCkbcdmdmaRgMm3aNMZTfLcRCqOt33ScintJWeMZaybUGWzzg
+naXBb0N3hwfV9Yzi7/yg+gZbmoUdK/BGZ/6WnN9KsNJqOtAnk9r21t6nB/2uSu2y
-gnVSbp5C3On33EKOqPgR677CkB+TW4ME2/myGGW5/1w=
++ydpukQtQrIyJFhz/WLwTW4W+Fw=
 -----END AGE ENCRYPTED FILE-----

secrets/pdns-file-records.key.age

@@ -1,20 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBEZXdm
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBuZUlG
-NEtBZ0x5OEFURXBhMlZtck1qYUc1bEd4dHpsQzdKdzBpejh3dFJVClIxdWtwbnhp
+SHU3RlhyMUYvUkoxWS81WmdvbmpYdE92Zy9rUTEwMEtjaWZJckI4CjRtYmRBSHRR
-Mk5hT1lhdEtuTjd6b2p0dlU4SmhIK283L21YZWJEVHNjdnMKLT4gWDI1NTE5IEk5
+UzV6WXRkZVRDYzAzL0M0MDhyMDB3R2hLMlVTczRCaW9IMVEKLT4gWDI1NTE5IGlw
-MGZuelB4SUhpMU5DTStNN293STQzeHhMdys2N1FNS1dnREMxenBkUnMKalpPQWVr
+cDRWUlVDenArWC9HbUtFTWFsd0RBRUhKT0lVdEo3alM0QVQ5N2lYaFUKTFQvOW02
-NHRDcnQydVk4ZHNXQTZpaENmTHVMWEZ1Um9DakJoUUx1TGRSUQotPiBjcS1ncmVh
+UGRLWUpOUm1ZL2pXaWl4Y1dsSFFCTGV5OEQwbG5vRW5tbHB1QQotPiBrdnJLKWI1
-c2UgckEgdyZSbzkrXiBjOUtnfiB8UVUiCml0K3hnMlcxS1B5dFpRYjczVzE1ZWtz
+MS1ncmVhc2UgZEt8P0xzCjVEcwotLS0gSVNTQjZ0RDF0TzY3T2FxSXBMNTdNYWtU
-NkUrYUVTcFJiekZ0aEFodWk4NXFNUnZJRjEzRFd4djhUZXFPUitwWTYKV1RMbHFn
+NWRuTXc4aWlqaGRmM28yTUxNbwoo9ln2nmiKMAPAnzxMHl3hyxDVwJBPQbSOWn0h
-Ci0tLSBlUzUvSTYvK2V5TFVnYjZGNWtmenFXOFNVNE9MOHBZcGZyamdIUmxtWFZr
+Fm/ZvmD/8WTZDU1w7BEzLnsWLHbUkE5xTeDbQiaQkj/IwWmGj5/Kr5dGKbDoDm8S
-CmswM8RLtrvvhmuy/efwx+ARv9Fmam6XTe0khQ2NoPa5K2EGI/ZJVoQr0h9p48u8
+jqeUj84Dc1LInFgqjut0nrANheaFwyg7pwauH4sfXS55pDF8brp1Si86eXf5Xgkb
-Qsi/1tALMjYh52SGaQd8m6pj2q0M+bnpld2xtrP3vPA20lrJbH1K1LadbZEt9Urj
+uCMXZgOqO37M6B9kB1kdu1IQWeYSeih95I9WcKVm41zonIhX9s1Fk8oZZlNQ3bYm
-oX8oP486qBkRk9mxNv/+ngwFT2hcbeobQUUu70+iwTChPpFtfP4THPRFQA1Nth7p
+s3JhcV2SsBDl2nlD8zqYD9254qSr0XsgRjuef6Dsr7d6bIqhuxVeI9AMuGHIwi4R
-A+HWsLlWyWk8QaW2QIa80Gq1BBstDMNjiIvgTMTWZeEO0GEAlE+07sXOwz/fnpTd
+O4PmMRsKUjsk394SmRQWkUIN3Khqayz7D7r89QoHtgtzYlKjQ+5kCZPg40ZV2ytv
-7llNvmaZACQXP74aNA5xZXzirq65e1alFCC25tPedggMuCFKWoTwlAla8UvThqlD
+3D/kmca6WPlc3gzB7BGFqnKJ17zXX9lGz+x/j3IhmWFyphsn49kuIknxMrKhtAF6
-VI60ARkRJ2GfKJ2RVblS380RotNiWTG1GiOdzJ3OngYceAvdEcCcYdfjoCTJoQTj
+hQNfg6vihTNbfcnTb2q6FIbERwBqDm77DVIuQHBofbTcMiYd3u68gPmdDjyNIda6
-IXW6NLI6GR2n/daInVrh9cwEAd0kNsOvjpZTkEgEeZzmLvZi1Z1H2a8ZyJq6A4L7
+pBdHnvfakTr3rRTBo0Jpx3QLcNCcXVaUSBmBT17hJNEYVTvGB2s11T9VUbRYOPo5
-jxqynZa3TKzcS3bhQG3iLJHEnQhhxUyf+S2d+3EZi03uWEvwGWX4aOKEpCEIUCVY
+dRLtsp1nmr+EYiJahzs3IYNuf6hgMq5NHMENf7kWH5w=
-mj0o3p5JPDaNIQPf3Bz0ByHYOu4LpRcCkYqphHVutG5K0P7Lw/Vs29oE7pSgm9uZ
-tj1CHRDoKXuRSk5koQ==
 -----END AGE ENCRYPTED FILE-----

secrets/tailscale-auth.key.age

@@ -1,15 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBySGJi
-WVFhRmdaRDNMVlhmcm1URW5FSzNmNVZleStBL1lOcWVNcVJoQ2s0Cmx2U08wVmRx
-YysxREo3eG1tWTlYL1BrVWk2WTByZnREWHNlVHluMHVac0EKLT4gc3NoLWVkMjU1
-MTkgT0VxTXNnIGlENXpQVVhNSm9lWVoxUVhjaE40OXRSSlA3TVlRYjVESHVVWGVS
-bVZkQkUKK3ZyRmVPNmRXTW1pbDVwTlFXRGxWcFhNMWNqbDZFREw4VkFzYStMd1J1
-cwotPiBYMjU1MTkgcU4xSnVKbmNPbFZORlRWdnEvdnhvZnhPanE0SmtSYTZFUFQ4
-ejVOYWMySQppYUhCNHFuam9UVUllMFZSWHh6Q1ZmbFNhZ1dMckNJWEl2alBkZGdl
-ZzhRCi0+IG80N0p0Mi1ncmVhc2UKTXZnK3NOdnc2Mk85VFU4NTFCVXhlQ0RuMURi
-UE9tdk1TTWE0WlJDaktrVnlxVWJtRm9Ha1JYclRuc1VRZ2VhbAp2OUl0a09mYUFL
-MUtPYnJZUEJ0OU96ODVEQ1JGOWNvRzBsMkh2QWFYQS9rdTEyNjlXRDE4RldvCi0t
-LSBrQ2k0UDdjc3V1ZkVwOXdOa1p1dGU1WVN5amIvWnpKam5uYlUwR3RZVjRJCpS8
-TNqU8U4bRRS7bISPugIUpx+VSGNg+sIj6sbiQJk84mpQwfcfLYTiPjq0KizhtBco
-DiyHW7BsPntLiRem/PRMquzMy1sl1QelbeZaF1EAYA==
------END AGE ENCRYPTED FILE-----

secrets/toot/otp-secret.txt.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSArcDVp
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBackhy
-TnB1QStoMWJzUWhMWnVtb1JSYTFublZKL25nL3JvU3B5M09TcXdBCmVHRk13R2cy
+eWNKRGdjYTdxL21LbFdIcWs1bXI2bXhGa09Nczh0QkpQR1NxY2o4CjdYR0kxQXh4
-UmlXU0V5VlFCUUFHZ0ZiMUxFV294MW9tOTRKS0xNUDFGN28KLT4gWDI1NTE5IE9i
+VndkQlhhSkNVNlplem1sbXVTT1I4blhJdHIvODc0dTR2R1EKLT4gWDI1NTE5IFFX
-SUtBVElCa2tWdGlKZzJLWnBmeEw2UG8xSGdWYXNLdk1IejFNNG9YZ1UKSVRJNnhw
+TzFmb2dKeHJjb3IxQmhRT0JYWUdDWkEvUy8ySVFudmNlbWpBSlVyVm8KOEF4cTFs
-WEV4dkFUYVpuMmFaWFFYc0dLM3BMWlpSN3RzR0hYaVE2OU8rQQotPiB4LWdyZWFz
+dDY2YVlBMVdKaUxLWjBoRXdDWmNTQkZGQ3FUbktnZ1cwVVhyRQotPiBUJ2RwLWdy
-ZSB+XyB2ZFU1SQpUVVZpVWRLVVZqTmNTU2d1S2Z1L2x3NHY3UTZCbHZVRHZlZXhq
+ZWFzZQpwVVZPZmNIWXQvMjZENHZxYzRVakFsMmFTYlVxNVEKLS0tICszbmFOKysr
-d2RFN3lURmlYU2ZTQzJ0bEdtRUNvNll1V2llCgotLS0gbXNpSWpPaEZIQTBybUtR
+NEgxSVFwVlJ6ZWlvdFRYMUJWZk9qYzlvaVp4cG9qdlNaaVkK6Fa29cIlyybSB//a
-eW5MT0RBdW9xZDFCbmVoajRjM2JhcEpmY2tUUQo8LhWOKi2MNQsYiRtYoIsmvPaQ
+N+fK9Llnf9NoFF5Wn+mVswSdxEXYI4RjQz2DYqTwy/76vcF4lX6cetDXkuXDoN3I
-DWH3JkE2kZvy8Y5vSxSEWDuXY8Wj0sOj35wu5Ox5Ti6+XwG1VlEBYwKYwqU6homd
+v5guDXYDgCtmXl7JDGU9iJb7sQqxtVEgnpiLS65oZQVIPsUrHnadIl7UVNE6ieHV
-h2TWE5f1kb0M4aQEA9+PZat3XJqnLKsG+NmLGQAbn8+LqyXYfEdqm8VF3jc0lZmJ
+Xo6V1Roy8GQRAIM2yNe27wwjNIzA36UJE05FyYLeMtJ0330JBr+wHRyohC+gAG76
-kdLsXZEsHy4PzAQgQmxBD73dUOOaggQfeSKSbLODku+Tn0YODojv22/DqfN79A==
+a3QuNxE=
 -----END AGE ENCRYPTED FILE-----