home-manager/common: Add nix-tree package

nixos/netboot: Mount /boot via kernel command line
Working "shill From Home" full network boot
2024-06-29 23:42:31 +01:00 · 2024-06-29 23:41:01 +01:00 · 2024-06-29 23:12:21 +01:00 · 2024-06-24 00:42:26 +01:00 · 2024-06-23 19:00:29 +01:00 · 2024-06-22 16:24:30 +01:00
128 changed files with 3578 additions and 1406 deletions
--- a/.gitea/workflows/installer.yaml
+++ b/.gitea/workflows/installer.yaml
@@ -39,12 +39,13 @@ jobs:
        run: |
          nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.netbootArchive
          ln -s "$(readlink result)" \
-            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar.zst

      - name: Create release
        uses: https://gitea.com/actions/release-action@main
        with:
          title: Latest installer
+          api_key: '${{ secrets.RELEASE_TOKEN }}'
          files: |
            jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
-            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar.zst
--- a/devshell/commands.nix
+++ b/devshell/commands.nix
@@ -20,7 +20,7 @@ in
          [ -e "${homeFlake}" ] && echo "${homeFlake} already exists" && exit 1

          mkdir -p "$(dirname "${homeFlake}")"
-          ln -s "$(pwd)/flake.nix" "${homeFlake}"
+          ln -sf "$(pwd)/flake.nix" "${homeFlake}"
          echo "Installed link to $(pwd)/flake.nix at ${homeFlake}"
        '';
    }
@@ -52,7 +52,7 @@ in
      name = "json2nix";
      category = "utilities";
      help = "Convert JSON to formatted Nix";
-      command = "nix eval --impure --expr 'builtins.fromJSON (builtins.readFile /dev/stdin)' | ${pkgs.nixfmt}/bin/nixfmt";
+      command = "nix eval --impure --expr 'builtins.fromJSON (builtins.readFile /dev/stdin)' | ${pkgs.nixfmt-rfc-style}/bin/nixfmt";
    }

    {
@@ -106,8 +106,8 @@ in
    {
      name = "build-netboot";
      category = "tasks";
-      help = "Build NixOS configuration as netboot archive";
-      command = ''nix build "''${@:2}" ".#nixfiles.config.nixos.systems.\"$1\".configuration.config.my.buildAs.netbootArchive"'';
+      help = "Build NixOS configuration as netboot tree";
+      command = ''nix build "''${@:2}" ".#nixfiles.config.nixos.systems.\"$1\".configuration.config.my.buildAs.netbootTree"'';
    }
    {
      name = "build-home";
--- a/flake.lock
+++ b/flake.lock
@@ -3,17 +3,19 @@
    "agenix": {
      "inputs": {
        "darwin": "darwin",
+        "home-manager": "home-manager",
        "nixpkgs": [
          "ragenix",
          "nixpkgs"
-        ]
+        ],
+        "systems": "systems_8"
      },
      "locked": {
-        "lastModified": 1682101079,
-        "narHash": "sha256-MdAhtjrLKnk2uiqun1FWABbKpLH090oeqCSiWemtuck=",
+        "lastModified": 1707830867,
+        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "2994d002dcff5353ca1ac48ec584c7f6589fe447",
+        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
        "type": "github"
      },
      "original": {
@@ -35,11 +37,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1702969472,
-        "narHash": "sha256-IJP9sC+/gLUdWhm6TsnWpw6A1zQWUfn53ym63KeLXvU=",
+        "lastModified": 1711742460,
+        "narHash": "sha256-0O4v6e4a1toxXZ2gf5INhg4WPE5C5T+SVvsBt+45Mcc=",
        "owner": "zhaofengli",
        "repo": "attic",
-        "rev": "bdafd64910bb2b861cf90fa15f1fc93318b6fbf6",
+        "rev": "4dbdbee45728d8ce5788db6461aaaa89d98081f0",
        "type": "github"
      },
      "original": {
@@ -58,17 +60,17 @@
        "poetry2nix": "poetry2nix"
      },
      "locked": {
-        "lastModified": 1682289679,
-        "narHash": "sha256-DbhSJ6y62VAO2VsJwoz3VsxCEP/4KMeFVs0wIz6Im04=",
-        "owner": "devplayer0",
-        "repo": "boardie",
-        "rev": "e4b977f75bf7b4f656a691efca492ae057672a77",
-        "type": "github"
+        "lastModified": 1718746012,
+        "narHash": "sha256-sp9vGl3vWXvD/C2JeMDi5nbW6CkKIC3Q2JMGKwexYEs=",
+        "ref": "refs/heads/master",
+        "rev": "ea24100bd4a914b9e044a2085a3785a6bd3a3833",
+        "revCount": 5,
+        "type": "git",
+        "url": "https://git.nul.ie/dev/boardie"
      },
      "original": {
-        "owner": "devplayer0",
-        "repo": "boardie",
-        "type": "github"
+        "type": "git",
+        "url": "https://git.nul.ie/dev/boardie"
      }
    },
    "borgthin": {
@@ -116,26 +118,17 @@
    },
    "crane_2": {
      "inputs": {
-        "flake-compat": "flake-compat_3",
-        "flake-utils": [
-          "ragenix",
-          "flake-utils"
-        ],
        "nixpkgs": [
          "ragenix",
          "nixpkgs"
-        ],
-        "rust-overlay": [
-          "ragenix",
-          "rust-overlay"
        ]
      },
      "locked": {
-        "lastModified": 1681680516,
-        "narHash": "sha256-EB8Adaeg4zgcYDJn9sR6UMjN/OHdIiMMK19+3LmmXQY=",
+        "lastModified": 1708794349,
+        "narHash": "sha256-jX+B1VGHT0ruHHL5RwS8L21R6miBn4B6s9iVyUJsJJY=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "54b63c8eae4c50172cb50b612946ff1d2bc1c75c",
+        "rev": "2c94ff9a6fbeb9f3ea0107f28688edbe9c81deaa",
        "type": "github"
      },
      "original": {
@@ -153,11 +146,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1673295039,
-        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
        "type": "github"
      },
      "original": {
@@ -176,11 +169,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1703087360,
-        "narHash": "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=",
+        "lastModified": 1715699772,
+        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "b709d63debafce9f5645a5ba550c9e0983b3d1f7",
+        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
        "type": "github"
      },
      "original": {
@@ -195,11 +188,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1678957337,
-        "narHash": "sha256-Gw4nVbuKRdTwPngeOZQOzH/IFowmz4LryMPDiJN/ah4=",
+        "lastModified": 1717408969,
+        "narHash": "sha256-Q0OEFqe35fZbbRPPRdrjTUUChKVhhWXz3T9ZSKmaoVY=",
        "owner": "numtide",
        "repo": "devshell",
-        "rev": "3e0e60ab37cd0bf7ab59888f5c32499d851edb47",
+        "rev": "1ebbe68d57457c8cae98145410b164b5477761f4",
        "type": "github"
      },
      "original": {
@@ -208,6 +201,25 @@
        "type": "github"
      }
    },
+    "devshell-tools": {
+      "inputs": {
+        "flake-utils": "flake-utils_11",
+        "nixpkgs": "nixpkgs_4"
+      },
+      "locked": {
+        "lastModified": 1710099997,
+        "narHash": "sha256-WmBKTLdth6I/D+0//9enbIXohGsBjepbjIAm9pCYj0U=",
+        "owner": "eikek",
+        "repo": "devshell-tools",
+        "rev": "e82faf976d318b3829f6f7f6785db6f3c7b65267",
+        "type": "github"
+      },
+      "original": {
+        "owner": "eikek",
+        "repo": "devshell-tools",
+        "type": "github"
+      }
+    },
    "devshell_2": {
      "inputs": {
        "flake-utils": "flake-utils_5",
@@ -229,17 +241,17 @@
    },
    "devshell_3": {
      "inputs": {
+        "flake-utils": "flake-utils_7",
        "nixpkgs": [
          "nixpkgs-unstable"
-        ],
-        "systems": "systems_4"
+        ]
      },
      "locked": {
-        "lastModified": 1701787589,
-        "narHash": "sha256-ce+oQR4Zq9VOsLoh9bZT8Ip9PaMLcjjBUHVPzW5d7Cw=",
+        "lastModified": 1713532798,
+        "narHash": "sha256-wtBhsdMJA3Wa32Wtm1eeo84GejtI43pMrFrmwLXrsEc=",
        "owner": "numtide",
        "repo": "devshell",
-        "rev": "44ddedcbcfc2d52a76b64fb6122f209881bd3e1e",
+        "rev": "12e914740a25ea1891ec619bb53cf5e6ca922e40",
        "type": "github"
      },
      "original": {
@@ -280,22 +292,6 @@
        "type": "github"
      }
    },
-    "flake-compat_3": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
    "flake-utils": {
      "locked": {
        "lastModified": 1667395993,
@@ -312,6 +308,60 @@
      }
    },
    "flake-utils_10": {
+      "inputs": {
+        "systems": "systems_9"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_11": {
+      "inputs": {
+        "systems": "systems_10"
+      },
+      "locked": {
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_12": {
+      "inputs": {
+        "systems": "systems_11"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_13": {
      "locked": {
        "lastModified": 1667395993,
        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
@@ -327,12 +377,15 @@
      }
    },
    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems"
+      },
      "locked": {
-        "lastModified": 1642700792,
-        "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
        "type": "github"
      },
      "original": {
@@ -343,14 +396,14 @@
    },
    "flake-utils_3": {
      "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
        "type": "github"
      },
      "original": {
@@ -361,14 +414,14 @@
    },
    "flake-utils_4": {
      "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
        "type": "github"
      },
      "original": {
@@ -409,7 +462,7 @@
    },
    "flake-utils_7": {
      "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_6"
      },
      "locked": {
        "lastModified": 1701680307,
@@ -426,6 +479,24 @@
      }
    },
    "flake-utils_8": {
+      "inputs": {
+        "systems": "systems_7"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_9": {
      "locked": {
        "lastModified": 1659877975,
        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
@@ -440,21 +511,25 @@
        "type": "github"
      }
    },
-    "flake-utils_9": {
+    "home-manager": {
      "inputs": {
-        "systems": "systems_6"
+        "nixpkgs": [
+          "ragenix",
+          "agenix",
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
        "type": "github"
      },
      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "nix-community",
+        "repo": "home-manager",
        "type": "github"
      }
    },
@@ -465,11 +540,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1703367386,
-        "narHash": "sha256-FMbm48UGrBfOWGt8+opuS+uLBLQlRfhiYXhHNcYMS5k=",
+        "lastModified": 1716729592,
+        "narHash": "sha256-Y3bOjoh2cFBqZN0Jw1zUdyr7tjygyxl2bD/QY73GZP0=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "d5824a76bc6bb93d1dce9ebbbcb09a9b6abcc224",
+        "rev": "2c78a57c544dd19b07442350727ced097e1aa6e6",
        "type": "github"
      },
      "original": {
@@ -485,11 +560,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1703754036,
-        "narHash": "sha256-JpJdcj9Tg4lMuYikXDpajA8wOp+rHyn9RD2rKBEM4cQ=",
+        "lastModified": 1717097707,
+        "narHash": "sha256-HC5vJ3oYsjwsCaSbkIPv80e4ebJpNvFKQTBOGlHvjLs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "c24c298562fe41b39909f632c5a7151bbf6b4628",
+        "rev": "0eb314b4f0ba337e88123e0b1e57ef58346aafd9",
        "type": "github"
      },
      "original": {
@@ -499,11 +574,11 @@
    },
    "impermanence": {
      "locked": {
-        "lastModified": 1703656108,
-        "narHash": "sha256-hCSUqdFJKHHbER8Cenf5JRzjMlBjIdwdftGQsO0xoJs=",
+        "lastModified": 1708968331,
+        "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=",
        "owner": "nix-community",
        "repo": "impermanence",
-        "rev": "033643a45a4a920660ef91caa391fbffb14da466",
+        "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30",
        "type": "github"
      },
      "original": {
@@ -512,19 +587,41 @@
        "type": "github"
      }
    },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "boardie",
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703863825,
+        "narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
    "nixGL": {
      "inputs": {
-        "flake-utils": "flake-utils_8",
+        "flake-utils": "flake-utils_9",
        "nixpkgs": [
          "nixpkgs-unstable"
        ]
      },
      "locked": {
-        "lastModified": 1685908677,
-        "narHash": "sha256-E4zUPEUFyVWjVm45zICaHRpfGepfkE9Z2OECV9HXfA4=",
+        "lastModified": 1713543440,
+        "narHash": "sha256-lnzZQYG0+EXl/6NkGpyIz+FEOc/DSEG57AP1VsdeNrM=",
        "owner": "nix-community",
        "repo": "nixGL",
-        "rev": "489d6b095ab9d289fe11af0219a9ff00fe87c7c5",
+        "rev": "310f8e49a149e4c9ea52f1adf70cdc768ec53f8a",
        "type": "github"
      },
      "original": {
@@ -535,11 +632,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1677383253,
-        "narHash": "sha256-UfpzWfSxkfXHnb4boXZNaKsAcUrZT9Hw+tao1oZxd08=",
+        "lastModified": 1704161960,
+        "narHash": "sha256-QGua89Pmq+FBAro8NriTuoO/wNaUtugt29/qqA8zeeM=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9952d6bc395f5841262b006fbace8dd7e143b634",
+        "rev": "63143ac2c9186be6d9da6035fa22620018c85932",
        "type": "github"
      },
      "original": {
@@ -551,11 +648,11 @@
    },
    "nixpkgs-mine": {
      "locked": {
-        "lastModified": 1703756459,
-        "narHash": "sha256-ztEMyPQZh3Pb+LOoWl5lbIK2LenP59sOUBC86CDmLio=",
+        "lastModified": 1717628902,
+        "narHash": "sha256-qMAW+oKis3F8jXTjX9Ng02/LzZd+7YOK05Qa33h9yqY=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "e80160eb2ac3a7111d07cc43a15c16b9edca01ea",
+        "rev": "3e0ee08114e1563b1a0fd6a907563b5e86258fb4",
        "type": "github"
      },
      "original": {
@@ -567,11 +664,11 @@
    },
    "nixpkgs-mine-stable": {
      "locked": {
-        "lastModified": 1703756491,
-        "narHash": "sha256-9VL34e0gzomwqRnryRn23V2ImYcaZIQdp7CsWg5TmlE=",
+        "lastModified": 1717245305,
+        "narHash": "sha256-LrIS3+Aa4F2VmuJPQOASRd3W+uToj878PoUKSLVw/vE=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "36611f5f7cfd401f51ad4ca76fd6ee85a714bb74",
+        "rev": "17a50249712512f600eced89bebcc3252b5f630f",
        "type": "github"
      },
      "original": {
@@ -583,11 +680,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1703467016,
-        "narHash": "sha256-/5A/dNPhbQx/Oa2d+Get174eNI3LERQ7u6WTWOlR1eQ=",
+        "lastModified": 1716991068,
+        "narHash": "sha256-Av0UWCCiIGJxsZ6TFc+OiKCJNqwoxMNVYDBChmhjNpo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d02d818f22c777aa4e854efc3242ec451e5d462a",
+        "rev": "25cf937a30bf0801447f6bf544fc7486c6309234",
        "type": "github"
      },
      "original": {
@@ -598,11 +695,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1703438236,
-        "narHash": "sha256-aqVBq1u09yFhL7bj1/xyUeJjzr92fXVvQSSEx6AdB1M=",
+        "lastModified": 1716948383,
+        "narHash": "sha256-SzDKxseEcHR5KzPXLwsemyTR/kaM9whxeiJohbL04rs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5f64a12a728902226210bf01d25ec6cbb9d9265b",
+        "rev": "ad57eef4ef0659193044870c731987a6df5cf56b",
        "type": "github"
      },
      "original": {
@@ -613,15 +710,16 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1681756206,
-        "narHash": "sha256-7B2Jc1zosXvZJKlxTPBlGew0LeX/7cxguG/d3syc1JI=",
+        "lastModified": 1718632497,
+        "narHash": "sha256-YtlyfqOdYMuu7gumZtK0Kg7jr4OKfHUhJkZfNUryw68=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "6eceb07c28016ec50dd683fda94995702b67e855",
+        "rev": "c58b4a9118498c1055c5908a5bbe666e56abe949",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -642,17 +740,52 @@
        "type": "github"
      }
    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1709309926,
+        "narHash": "sha256-VZFBtXGVD9LWTecGi6eXrE0hJ/mVB3zGUlHImUs2Qak=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "79baff8812a0d68e24a836df0a364c678089e2c7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1674990008,
+        "narHash": "sha256-4zOyp+hFW2Y7imxIpZqZGT8CEqKmDjwgfD6BzRUE0mQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d2bbcbe6c626d339b25a4995711f07625b508214",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "poetry2nix": {
      "inputs": {
        "flake-utils": "flake-utils_4",
-        "nixpkgs": "nixpkgs_2"
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": "nixpkgs_2",
+        "systems": "systems_4",
+        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1681532901,
-        "narHash": "sha256-9ZN/gaCOlkx53km4J2QkLQh4bS+6UCBsjdi87kw6+jc=",
+        "lastModified": 1718726452,
+        "narHash": "sha256-w4hJSYvACz0i5XHtxc6XNyHwbxpisN13M2kA2Y7937o=",
        "owner": "nix-community",
        "repo": "poetry2nix",
-        "rev": "2e66fd2623eccb3086e52929c2cefd882faac8a8",
+        "rev": "53e534a08c0cd2a9fa7587ed1c3e7f6aeb804a2c",
        "type": "github"
      },
      "original": {
@@ -665,18 +798,18 @@
      "inputs": {
        "agenix": "agenix",
        "crane": "crane_2",
-        "flake-utils": "flake-utils_9",
+        "flake-utils": "flake-utils_10",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1682237245,
-        "narHash": "sha256-xbBR7LNK+d5Yi/D6FXQGc1R6u2VV2nwr/Df5iaEbOEQ=",
+        "lastModified": 1709831932,
+        "narHash": "sha256-WsP8rOFa/SqYNbVtYJ/l2mWWOgyDTJFbITMV8tv0biI=",
        "owner": "yaxitech",
        "repo": "ragenix",
-        "rev": "281f68c3d477904f79ff1cd5807a8c226cd80a50",
+        "rev": "06de099ef02840ec463419f12de73729d458e1eb",
        "type": "github"
      },
      "original": {
@@ -692,7 +825,7 @@
        "borgthin": "borgthin",
        "deploy-rs": "deploy-rs",
        "devshell": "devshell_3",
-        "flake-utils": "flake-utils_7",
+        "flake-utils": "flake-utils_8",
        "home-manager-stable": "home-manager-stable",
        "home-manager-unstable": "home-manager-unstable",
        "impermanence": "impermanence",
@@ -717,11 +850,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1682129965,
-        "narHash": "sha256-1KRPIorEL6pLpJR04FwAqqnt4Tzcm4MqD84yhlD+XSk=",
+        "lastModified": 1708740535,
+        "narHash": "sha256-NCTw235XwSDbeTAtAwg/hOeNOgwYhVq7JjDdbkOgBeA=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "2c417c0460b788328220120c698630947547ee83",
+        "rev": "9b24383d77f598716fa0cbb8b48c97249f5ee1af",
        "type": "github"
      },
      "original": {
@@ -730,23 +863,44 @@
        "type": "github"
      }
    },
+    "sbt": {
+      "inputs": {
+        "flake-utils": "flake-utils_13",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1698464090,
+        "narHash": "sha256-Pnej7WZIPomYWg8f/CZ65sfW85IfIUjYhphMMg7/LT0=",
+        "owner": "zaninime",
+        "repo": "sbt-derivation",
+        "rev": "6762cf2c31de50efd9ff905cbcc87239995a4ef9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zaninime",
+        "repo": "sbt-derivation",
+        "type": "github"
+      }
+    },
    "sharry": {
      "inputs": {
-        "flake-utils": "flake-utils_10",
+        "devshell-tools": "devshell-tools",
+        "flake-utils": "flake-utils_12",
        "nixpkgs": [
          "nixpkgs-unstable"
-        ]
+        ],
+        "sbt": "sbt"
      },
      "locked": {
-        "lastModified": 1687587666,
-        "narHash": "sha256-t1VNvdQdDUFTEKTFP2fc7Fb3buQBmP+h9WUeO8b2Bus=",
-        "owner": "eikek",
+        "lastModified": 1710796573,
+        "narHash": "sha256-23fLZFNacZU/skc8i7JExHfD//Mpkslhga6f5ATTqBA=",
+        "owner": "devplayer0",
        "repo": "sharry",
-        "rev": "a9b3371aa6c7b92088b20fd6e479c251a5556b86",
+        "rev": "4e7a87880ba0807afd5d21706ce383b8b8727990",
        "type": "github"
      },
      "original": {
-        "owner": "eikek",
+        "owner": "devplayer0",
        "repo": "sharry",
        "type": "github"
      }
@@ -766,6 +920,36 @@
        "type": "github"
      }
    },
+    "systems_10": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_11": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
@@ -806,9 +990,8 @@
        "type": "github"
      },
      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
+        "id": "systems",
+        "type": "indirect"
      }
    },
    "systems_5": {
@@ -841,9 +1024,76 @@
        "type": "github"
      }
    },
+    "systems_7": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_8": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_9": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "boardie",
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1718522839,
+        "narHash": "sha256-ULzoKzEaBOiLRtjeY3YoGFJMwWSKRYOic6VNw2UyTls=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "68eb1dc333ce82d0ab0c0357363ea17c31ea1f81",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
    "utils": {
      "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_5"
      },
      "locked": {
        "lastModified": 1701680307,
--- a/flake.nix
+++ b/flake.nix
@@ -24,13 +24,14 @@

    # Stuff used by systems
    impermanence.url = "github:nix-community/impermanence";
-    boardie.url = "github:devplayer0/boardie";
+    boardie.url = "git+https://git.nul.ie/dev/boardie";
    boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
    nixGL.url = "github:nix-community/nixGL";
    nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";

    # Packages not in nixpkgs
-    sharry.url = "github:eikek/sharry";
+    # sharry.url = "github:eikek/sharry";
+    sharry.url = "github:devplayer0/sharry";
    sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
    borgthin.url = "github:devplayer0/borg";
    borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
--- a/home-manager/modules/common.nix
+++ b/home-manager/modules/common.nix
@@ -199,17 +199,20 @@ in
          file
          tree
          pwgen
+
+          minicom
          iperf3
          mosh
          wget
-          hyx
          whois
          ldns
-          minicom
          mtr
+
+          hyx
          ncdu
          jq
          yq-go
+          nix-tree
        ];

        sessionVariables = {
--- a/home-manager/modules/gui/alacritty-xterm.toml
+++ b/home-manager/modules/gui/alacritty-xterm.toml
@@ -0,0 +1,28 @@
+# XTerm's default colors
+
+# Default colors
+[colors.primary]
+background = '#000000'
+foreground = '#ffffff'
+
+# Normal colors
+[colors.normal]
+black   = '#000000'
+red     = '#cd0000'
+green   = '#00cd00'
+yellow  = '#cdcd00'
+blue    = '#0000ee'
+magenta = '#cd00cd'
+cyan    = '#00cdcd'
+white   = '#e5e5e5'
+
+# Bright colors
+[colors.bright]
+black   = '#7f7f7f'
+red     = '#ff0000'
+green   = '#00ff00'
+yellow  = '#ffff00'
+blue    = '#5c5cff'
+magenta = '#ff00ff'
+cyan    = '#00ffff'
+white   = '#ffffff'
--- a/home-manager/modules/gui/default.nix
+++ b/home-manager/modules/gui/default.nix
@@ -10,6 +10,23 @@ let
    name = "Monocraft";
    size = 10;
  };
+
+  doomWad = pkgs.fetchurl {
+    url = "https://distro.ibiblio.org/slitaz/sources/packages/d/doom1.wad";
+    hash = "sha256-HX1DvlAeZ9kn5BXguPPinDvzMHXoWXIYFvZSpSbKx3E=";
+  };
+
+  doomsaver = pkgs.runCommand "doomsaver" {
+    inherit (pkgs) windowtolayer;
+    chocoDoom = pkgs.chocolate-doom2xx;
+    python = pkgs.python3.withPackages (ps: [ ps.filelock ]);
+    inherit doomWad;
+    enojy = ./enojy.jpg;
+  } ''
+    mkdir -p "$out"/bin
+    substituteAll ${./screensaver.py} "$out"/bin/doomsaver
+    chmod +x "$out"/bin/doomsaver
+  '';
 in
 {
  options.my.gui = {
@@ -32,11 +49,19 @@ in
            slurp
            swappy

-            python310Packages.python-lsp-server
+            python3Packages.python-lsp-server
            nil # nix language server
            zls # zig language server
            rust-analyzer
+
+            cowsay
+            fortune
+            jp2a
+            terminaltexteffects
+            screenfetch
            neofetch
+            cmatrix
+            doomsaver
          ];
        };

@@ -51,7 +76,15 @@ in
          alacritty = {
            enable = true;
            settings = {
-              font.normal.family = font.name;
+              import = [ ./alacritty-xterm.toml ];
+
+              font = {
+                size = font.size;
+                normal = {
+                  family = font.name;
+                  style = "Regular";
+                };
+              };
            };
          };

@@ -65,6 +98,25 @@ in
            };
          };

+          termite = {
+            enable = true;
+            font = "${font.name} ${toString font.size}";
+            backgroundColor = "rgba(0, 0, 0, 0.8)";
+          };
+
+          foot = {
+            enable = true;
+            settings = {
+              main = {
+                font = "${font.name}:size=${toString font.size}";
+              };
+              colors = {
+                alpha = 0.8;
+                background = "000000";
+              };
+            };
+          };
+
          helix = {
            enable = true;
            settings = {
@@ -162,7 +214,7 @@ in
                  in
                  lib.mkOptionDefault {
                    "${mod}+d" = null;
-                    "${mod}+l" = "exec swaylock -i ${./lock.png} -s stretch";
+                    "${mod}+l" = "exec ${doomsaver}/bin/doomsaver";
                    "${mod}+x" = "exec ${cfg.menu}";
                    "${mod}+Shift+x" = "exec rofi -show drun";
                    "${mod}+q" = "kill";
@@ -210,17 +262,10 @@ in
        };
        qt = {
          enable = true;
-          platformTheme = "gtk";
+          platformTheme.name = "gtk";
        };

        services = {
-          swaync = {
-            enable = true;
-            settings = {
-              widgets = [ "title" "dnd" "mpris" "notifications" ];
-            };
-          };
-
          playerctld.enable = true;
          spotifyd = {
            enable = false;
@@ -297,6 +342,15 @@ in
            ] (_: "chromium-browser.desktop");
          };
        };
+
+        my = {
+          swaync = {
+            enable = true;
+            settings = {
+              widgets = [ "title" "dnd" "mpris" "notifications" ];
+            };
+          };
+        };
      })

      (mkIf (cfg.standalone && !pkgs.stdenv.isDarwin) {
--- a/home-manager/modules/gui/enojy.jpg
+++ b/home-manager/modules/gui/enojy.jpg
--- a/home-manager/modules/gui/screensaver.py
+++ b/home-manager/modules/gui/screensaver.py
@@ -0,0 +1,209 @@
+#!@python@/bin/python
+import argparse
+import json
+import os
+import random
+import signal
+import subprocess
+import sys
+
+import filelock
+
+class Screensaver:
+    def __init__(self, cmd, env=None, weight=1):
+        self.cmd = cmd
+        self.weight = weight
+
+        if env is not None:
+            self.env = os.environ.copy()
+            for k, v in env.items():
+                self.env[k] = v
+        else:
+            self.env = None
+        self.proc = None
+
+    def start(self):
+        assert self.proc is None
+        self.proc = subprocess.Popen(self.cmd, env=self.env)
+
+    def wait(self):
+        assert self.proc is not None
+        self.proc.wait()
+
+    def stop(self, kill=False):
+        assert self.proc is not None
+        if kill:
+            self.proc.kill()
+        else:
+            self.proc.terminate()
+
+class DoomSaver(Screensaver):
+    wad = '@doomWad@'
+
+    def __init__(self, demo_index, weight=1.5):
+        super().__init__(
+            ['@chocoDoom@/bin/chocolate-doom',
+             '-iwad', self.wad,
+             '-demoloopi', str(demo_index)],
+            env={
+                'SDL_AUDIODRIVER': 'null',
+                'SDL_VIDEODRIVER': 'caca',
+                'CACA_DRIVER': 'ncurses',
+            },
+            weight=weight,
+        )
+
+    def stop(self):
+        super().stop(kill=True)
+
+class TTESaver(Screensaver):
+    effects = (
+        'beams,binarypath,blackhole,bouncyballs,bubbles,burn,colorshift,crumble,'
+        'decrypt,errorcorrect,expand,fireworks,middleout,orbittingvolley,overflow,'
+        'pour,print,rain,randomsequence,rings,scattered,slice,slide,spotlights,'
+        'spray,swarm,synthgrid,unstable,vhstape,waves,wipe'
+    ).split(',')
+
+    def __init__(self, cmd, env=None, weight=1):
+        super().__init__(cmd, env=env, weight=weight)
+        self.running = False
+
+    def start(self):
+        self.running = True
+
+    def wait(self):
+        while self.running:
+            effect_cmd = ['tte', random.choice(self.effects)]
+            print(f"$ {self.cmd} | {' '.join(effect_cmd)}")
+            content = subprocess.check_output(self.cmd, shell=True, env=self.env, stderr=subprocess.DEVNULL)
+
+            self.proc = subprocess.Popen(effect_cmd, stdin=subprocess.PIPE)
+            self.proc.stdin.write(content)
+            self.proc.stdin.close()
+            self.proc.wait()
+
+    def stop(self):
+        self.running = False
+        self.proc.terminate()
+
+class MultiSaver:
+    savers = [
+        DoomSaver(0),
+        DoomSaver(1),
+        DoomSaver(2),
+
+        Screensaver(['cmatrix']),
+
+        TTESaver('screenfetch -N'),
+        TTESaver('fortune | cowsay'),
+        TTESaver('top -bn1 | head -n50'),
+        TTESaver('ss -nltu'),
+        TTESaver('ss -ntu'),
+        TTESaver('jp2a --width=100 @enojy@'),
+    ]
+    state_filename = 'screensaver.json'
+
+    def __init__(self, select=None):
+        self.state_path = os.path.join(f'/run/user/{os.geteuid()}', self.state_filename)
+        self.lock = filelock.FileLock(f'{self.state_path}.lock')
+
+        if select is not None:
+            assert select >= 0 and select < len(self.savers), 'Invalid screensaver index'
+            self.selected = self.savers[select]
+        else:
+            self.selected = None
+        self.cleaned_up = False
+
+    def select(self):
+        with self.lock:
+            if not os.path.exists(self.state_path):
+                state = {'instances': []}
+            else:
+                with open(self.state_path) as f:
+                    state = json.load(f)
+
+            if self.selected is None:
+                available = set(range(len(self.savers)))
+                new_instances = []
+                for instance in state['instances']:
+                    if not os.path.exists(f"/proc/{instance['pid']}"):
+                        continue
+
+                    new_instances.append(instance)
+                    i = instance['saver']
+                    assert i in available
+                    available.remove(i)
+                assert available, 'No screensavers left'
+                available = list(available)
+
+                weights = []
+                for i in available:
+                    weights.append(self.savers[i].weight)
+                selected_i = random.choices(available, weights=weights)[0]
+
+                new_instances.append({'pid': os.getpid(), 'saver': selected_i})
+                state['instances'] = new_instances
+
+                # print(f'Selected saver {selected_i}')
+                self.selected = self.savers[selected_i]
+
+            with open(self.state_path, 'w') as f:
+                json.dump(state, f)
+
+    def cleanup(self):
+        if self.cleaned_up:
+            return
+        self.cleaned_up = True
+
+        with self.lock:
+            with open(self.state_path) as f:
+                state = json.load(f)
+
+            for i, instance in enumerate(state['instances']):
+                if instance['pid'] == os.getpid():
+                    del state['instances'][i]
+
+            with open(self.state_path, 'w') as f:
+                json.dump(state, f)
+
+    def run(self):
+        assert self.selected is not None
+        self.selected.start()
+
+        signal.signal(signal.SIGINT, self._sighandler)
+        signal.signal(signal.SIGTERM, self._sighandler)
+        signal.signal(signal.SIGHUP, self._sighandler)
+        self.selected.wait()
+        self.cleanup()
+
+    def stop(self):
+        assert self.selected is not None
+        print('Shutting down')
+        self.selected.stop()
+        self.cleanup()
+    def _sighandler(self, signum, frame):
+        self.stop()
+
+def main():
+    parser = argparse.ArgumentParser(description='Wayland terminal-based lock screen')
+    parser.add_argument('-l', '--locker-cmd', default='swaylock-plugin', help='swaylock-plugin command to use')
+    parser.add_argument('-t', '--terminal', default='alacritty', help='Terminal emulator to use')
+    parser.add_argument('-i', '--instance', action='store_true', help='Run as instance')
+    parser.add_argument('-s', '--screensaver', type=int, help='Force use of specific screensaver')
+
+    args = parser.parse_args()
+    if not args.instance:
+        cmd = [
+            args.locker_cmd, '--command-each',
+            f'@windowtolayer@/bin/windowtolayer -- {args.terminal} -e {sys.argv[0]} --instance']
+        if args.screensaver is not None:
+            cmd[-1] += f' --screensaver {args.screensaver}'
+        subprocess.check_call(cmd)
+        return
+
+    ms = MultiSaver(select=args.screensaver)
+    ms.select()
+    ms.run()
+
+if __name__ == '__main__':
+    main()
--- a/home-manager/modules/gui/waybar.nix
+++ b/home-manager/modules/gui/waybar.nix
@@ -146,9 +146,9 @@ in
          dnd-none = "";
        };
        return-type = "json";
-        exec = "${config.services.swaync.package}/bin/swaync-client -swb";
-        on-click = "${config.services.swaync.package}/bin/swaync-client -t -sw";
-        on-click-right = "${config.services.swaync.package}/bin/swaync-client -d -sw";
+        exec = "${config.my.swaync.package}/bin/swaync-client -swb";
+        on-click = "${config.my.swaync.package}/bin/swaync-client -t -sw";
+        on-click-right = "${config.my.swaync.package}/bin/swaync-client -d -sw";
        escape = true;
      };
    };
--- a/home-manager/modules/swaync.nix
+++ b/home-manager/modules/swaync.nix
@@ -19,10 +19,10 @@ let
    };
  };

-  cfg = config.services.swaync;
+  cfg = config.my.swaync;
 in
 {
-  options.services.swaync = with lib.types; {
+  options.my.swaync = with lib.types; {
    enable = mkEnableOption "Sway Notification Center";
    package = mkOption {
      type = package;
--- a/lib/constants.nix
+++ b/lib/constants.nix
@@ -11,6 +11,8 @@ rec {
      jellyseerr = 402;
      atticd = 403;
      kea = 404;
+      keepalived_script = 405;
+      photoprism = 406;
    };
    gids = {
      matrix-syncv3 = 400;
@@ -18,12 +20,14 @@ rec {
      jellyseerr = 402;
      atticd = 403;
      kea = 404;
+      keepalived_script = 405;
+      photoprism = 406;
    };
  };

  kernel = {
-    lts = pkgs: pkgs.linuxKernel.packages.linux_6_1;
-    latest = pkgs: pkgs.linuxKernel.packages.linux_6_6;
+    lts = pkgs: pkgs.linuxKernel.packages.linux_6_6;
+    latest = pkgs: pkgs.linuxKernel.packages.linux_6_9;
  };

  nginx = rec {
@@ -107,7 +111,7 @@ rec {
  };

  pubDomain = "nul.ie";
-  colony = {
+  colony = rec {
    domain = "ams1.int.${pubDomain}";
    pubV4 = "94.142.240.44";
    prefixes = with lib.my.net.cidr; rec {
@@ -144,6 +148,10 @@ rec {
        v4 = "94.142.242.255/32";
        v6 = subnet 8 1 cust.v6;
      };
+      jam = {
+        v4 = subnet 8 4 cust.v4;
+        v6 = subnet 8 2 cust.v6;
+      };

      vip1 = "94.142.241.224/30";
      vip2 = "94.142.242.254/31";
@@ -156,6 +164,12 @@ rec {
      home.v6 = "2a0e:97c0:4d0::/48";
    };

+    custRouting = with lib.my.net.cidr; {
+      mail-vm = host 1 prefixes.cust.v4;
+      darts-vm = host 2 prefixes.cust.v4;
+      jam-ctr = host 3 prefixes.cust.v4;
+    };
+
    firewallForwards = aa: [
      {
        port = "http";
@@ -169,6 +183,7 @@ rec {
        port = 8448;
        dst = aa.middleman.internal.ipv4.address;
      }
+
      {
        port = 25565;
        dst = aa.simpcraft-oci.internal.ipv4.address;
@@ -177,6 +192,7 @@ rec {
        port = 25566;
        dst = aa.simpcraft-staging-oci.internal.ipv4.address;
      }
+
      {
        port = 25575;
        dst = aa.simpcraft-oci.internal.ipv4.address;
@@ -227,7 +243,7 @@ rec {
      "stream"
    ];
    routersPubV4 = [
-      "109.255.1.246"
+      "188.141.14.7"
      "109.255.252.63"
    ];

@@ -277,6 +293,8 @@ rec {
        v6 = host ((1*65536*65536*65536) + 65535) prefixes.as211024.v6;
      };
    };
+
+    roceBootModules = [ "ib_core" "ib_uverbs" "mlx5_core" "mlx5_ib" "8021q" ];
  };

  britway = {
@@ -327,6 +345,7 @@ rec {
    };

    domain = "hentai.engineer";
+    ipv4MTU = 1460;
    vpn = {
      port = 51820;
    };
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -5,7 +5,7 @@ let
    genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
    mkOption mkOverride mkForce mkIf mergeEqualOption optional
    showWarnings concatStringsSep flatten unique optionalAttrs
-    mkBefore;
+    mkBefore toLower;
  inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -248,10 +248,37 @@ rec {
  in
  {
    trivial = prev.trivial // {
-      release = "23.12:u-${prev.trivial.release}";
-      codeName = "Amogus";
+      release = "24.06:u-${prev.trivial.release}";
+      codeName = "Carbrain";
      revisionWithDefault = default: self.rev or default;
      versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
    };
  };
+
+  netbootKeaClientClasses = { tftpIP, hostname, systems }:
+  let
+    testIPXE = "substring(option[user-class].hex, 0, 4) == 'iPXE'";
+  in
+    (mapAttrsToList (name: mac: {
+      name = "nixos-${name}";
+      test = "(${testIPXE}) and (hexstring(pkt4.mac, ':') == '${toLower mac}')";
+      next-server = tftpIP;
+      server-hostname = hostname;
+      boot-file-name = "http://${hostname}/systems/${name}/menu.ipxe";
+    }) systems) ++ [
+    {
+      name = "ipxe";
+      test = testIPXE;
+      next-server = tftpIP;
+      server-hostname = hostname;
+      boot-file-name = "http://${hostname}/boot.ipxe";
+    }
+    {
+      name = "efi-x86_64";
+      test = "option[client-system].hex == 0x0007";
+      next-server = tftpIP;
+      server-hostname = hostname;
+      boot-file-name = "ipxe-x86_64.efi";
+    }
+  ];
 }
--- a/nixos/boxes/castle/default.nix
+++ b/nixos/boxes/castle/default.nix
@@ -101,6 +101,12 @@ in
            dnssec = "false";
          };

+          pipewire.extraConfig.pipewire = {
+            "10-buffer"."context.properties" = {
+              "default.clock.quantum" = 128;
+              "default.clock.max-quantum" = 128;
+            };
+          };
          blueman.enable = true;
        };

@@ -131,14 +137,6 @@ in
          qperf
          ethtool
        ];
-        environment.etc = {
-          "pipewire/pipewire.conf.d/sample-size.conf".text = ''
-            context.properties = {
-              default.clock.quantum = 128
-              default.clock.max-quantum = 128
-            }
-          '';
-        };

        nix = {
          gc.automatic = false;
@@ -205,10 +203,7 @@ in
                packages = with pkgs; [
                  jacktrip
                  qpwgraph
-                  # TODO: seems to be borked (infinite recursion???)
-                  # (writeShellScriptBin "boardie" ''
-                  #   exec pw-jack ${boardie}/bin/boardie "$@"
-                  # '')
+                  boardie
                ];
              };

--- a/nixos/boxes/colony/default.nix
+++ b/nixos/boxes/colony/default.nix
@@ -1,7 +1,7 @@
 { lib, ... }:
 let
  inherit (lib.my) net;
-  inherit (lib.my.c.colony) domain prefixes firewallForwards;
+  inherit (lib.my.c.colony) domain prefixes custRouting firewallForwards;
 in
 {
  imports = [ ./vms ];
@@ -60,8 +60,8 @@ in
          kernelPackages = (lib.my.c.kernel.lts pkgs).extend (self: super: {
            kernel = super.kernel.override {
              structuredExtraConfig = with lib.kernel; {
-                #SOME_OPT = yes;
-                #A_MOD = module;
+                ACPI_APEI_PCIEAER = yes;
+                PCIEAER = yes;
              };
            };
          });
@@ -150,12 +150,12 @@ in
            "serial-getty@ttyS1".enable = true;
            lvm-activate-main = {
              description = "Activate remaining LVs";
-              before = [ "local-fs-pre.target" ];
+              unitConfig.DefaultDependencies = false;
              serviceConfig = {
                Type = "oneshot";
                ExecStart = "${pkgs.lvm2.bin}/bin/vgchange -aay main";
              };
-              wantedBy = [ "sysinit.target" ];
+              wantedBy = [ "local-fs-pre.target" ];
            };

            rsync-lvm-meta = {
@@ -276,6 +276,10 @@ in
                      Destination = lib.my.c.tailscale.prefix.v6;
                      Gateway = allAssignments.shill.internal.ipv6.address;
                    }
+                    {
+                      Destination = prefixes.jam.v6;
+                      Gateway = allAssignments.shill.internal.ipv6.address;
+                    }

                    {
                      Destination = prefixes.oci.v4;
@@ -307,7 +311,7 @@ in
              "90-vm-mail" = {
                matchConfig.Name = "vm-mail";
                address = [
-                  (net.cidr.subnet 8 1 prefixes.cust.v4)
+                  "${custRouting.mail-vm}/32"
                  prefixes.mail.v6
                ];
                networkConfig = {
@@ -330,7 +334,7 @@ in
              "90-vm-darts" = {
                matchConfig.Name = "vm-darts";
                address = [
-                  (net.cidr.subnet 8 2 prefixes.cust.v4)
+                  "${custRouting.darts-vm}/32"
                  prefixes.darts.v6
                ];
                networkConfig = {
--- a/nixos/boxes/colony/vms/default.nix
+++ b/nixos/boxes/colony/vms/default.nix
@@ -131,6 +131,7 @@
              (vm.lvmDisk "media")
              (vm.lvmDisk "minio")
              (vm.lvmDisk "nix-atticd")
+              (vm.lvmDisk "jam")
            ]);
          };

@@ -209,6 +210,7 @@
            drives = [
              (mkMerge [ (vm.disk "darts" "root") { frontendOpts.bootindex = 0; } ])
              (vm.lvmDisk' "media" "darts-media")
+              (vm.lvmDisk' "ext" "darts-ext")
            ];
          };
        };
--- a/nixos/boxes/colony/vms/estuary/default.nix
+++ b/nixos/boxes/colony/vms/estuary/default.nix
@@ -9,6 +9,7 @@ in
    vpns = {
      l2 = {
        as211024 = {
+          udpEncapsulation = true;
          vni = 211024;
          security.enable = true;
          peers = {
@@ -393,6 +394,9 @@ in
                      # Safe enough to allow all SSH
                      tcp dport ssh accept

+                      # jam-ctr forwards
+                      ip daddr ${aa.shill.internal.ipv4.address} tcp dport 60022 accept
+
                      ip6 daddr ${aa.middleman.internal.ipv6.address} tcp dport { http, https, 8448 } accept
                      ${matchInet "tcp dport { http, https } accept" "git"}
                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport { 25565, 25575 } accept
--- a/nixos/boxes/colony/vms/estuary/dns.nix
+++ b/nixos/boxes/colony/vms/estuary/dns.nix
@@ -2,7 +2,7 @@
 let
  inherit (builtins) attrNames;
  inherit (lib.my) net;
-  inherit (lib.my.c.colony) prefixes;
+  inherit (lib.my.c.colony) prefixes custRouting;

  authZones = attrNames config.my.pdns.auth.bind.zones;
 in
@@ -162,6 +162,10 @@ in

            andrey-cust IN A ${allAssignments.kelder.estuary.ipv4.address}

+            jam-cust IN A ${net.cidr.host 0 prefixes.jam.v4}
+            jam-fwd IN A ${allAssignments.shill.internal.ipv4.address}
+            jam-cust IN AAAA ${net.cidr.host 1 prefixes.jam.v6}
+
            $TTL 3
            _acme-challenge IN LUA TXT @@FILE@@

--- a/nixos/boxes/colony/vms/git/default.nix
+++ b/nixos/boxes/colony/vms/git/default.nix
@@ -102,34 +102,6 @@ in

            services = {
              fstrim = lib.my.c.colony.fstrimConfig;
-              # Hacks for Jsch (Minecraft FastBack) to work
-              openssh = {
-                hostKeys = [
-                  {
-                    bits = 4096;
-                    path = "/etc/ssh/ssh_host_rsa_key";
-                    type = "rsa";
-                  }
-                  {
-                    path = "/etc/ssh/ssh_host_ed25519_key";
-                    type = "ed25519";
-                  }
-
-                  {
-                    type = "ecdsa-sha2-nistp256";
-                    path = "/etc/ssh/ssh_host_ecdsa_key";
-                  }
-                ];
-                settings = {
-                  Macs = [
-                    "hmac-sha2-512-etm@openssh.com"
-                    "hmac-sha2-256-etm@openssh.com"
-                    "umac-128-etm@openssh.com"
-
-                    "hmac-sha2-256"
-                  ];
-                };
-              };
              netdata.enable = true;
              nginx = {
                enable = true;
--- a/nixos/boxes/colony/vms/shill/containers-ext.nix
+++ b/nixos/boxes/colony/vms/shill/containers-ext.nix
@@ -0,0 +1,105 @@
+{ lib, pkgs, assignments, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c.colony) prefixes custRouting;
+in
+{
+  fileSystems = {
+    "/mnt/jam" = {
+      device = "/dev/disk/by-label/jam";
+      fsType = "ext4";
+    };
+
+    "/var/lib/machines/jam" = {
+      device = "/mnt/jam";
+      options = [ "bind" ];
+    };
+  };
+
+  systemd = {
+    nspawn = {
+      jam = {
+        enable = true;
+        execConfig = {
+          Boot = true;
+          PrivateUsers = "pick";
+          LinkJournal = false;
+        };
+        networkConfig = {
+          Private = true;
+          VirtualEthernet = true;
+        };
+      };
+    };
+    network.networks = {
+      "50-ve-jam" = {
+        matchConfig = {
+          Kind = "veth";
+          Name = "ve-jam";
+        };
+        address = [
+          custRouting.jam-ctr
+          prefixes.jam.v6
+        ];
+        networkConfig = {
+          IPv6AcceptRA = false;
+          IPv6SendRA = true;
+        };
+        ipv6Prefixes = [
+          {
+            ipv6PrefixConfig.Prefix = prefixes.jam.v6;
+          }
+        ];
+        routes = map (r: { routeConfig = r; }) [
+          {
+            Destination = prefixes.jam.v4;
+            Scope = "link";
+          }
+        ];
+      };
+    };
+    services = {
+      "systemd-nspawn@jam" = {
+        overrideStrategy = "asDropin";
+
+        serviceConfig = {
+          CPUQuota = "400%";
+          MemoryHigh = "4G";
+          MemoryMax = "4.5G";
+        };
+
+        wantedBy = [ "machines.target" ];
+      };
+    };
+  };
+
+  my = {
+    firewall =
+    let
+      jamIP = net.cidr.host 0 prefixes.jam.v4;
+    in
+    {
+      nat.forwardPorts."${assignments.internal.ipv4.address}" = [
+        {
+          port = 60022;
+          dst = jamIP;
+          dstPort = "ssh";
+        }
+      ];
+      extraRules = ''
+        table inet filter {
+          chain forward {
+            iifname { ve-jam } oifname vms accept
+            iifname vms oifname { ve-jam } accept
+          }
+        }
+
+        table inet nat {
+          chain postrouting {
+            ip saddr ${jamIP} snat to ${assignments.internal.ipv4.address}
+          }
+        }
+      '';
+    };
+  };
+}
--- a/nixos/boxes/colony/vms/shill/containers/chatterbox.nix
+++ b/nixos/boxes/colony/vms/shill/containers/chatterbox.nix
@@ -24,7 +24,7 @@ in

    configuration = { lib, pkgs, config, assignments, allAssignments, ... }:
    let
-      inherit (lib) mkMerge mkIf mkForce;
+      inherit (lib) genAttrs mkMerge mkIf mkForce;
      inherit (lib.my) networkdAssignment;
    in
    {
@@ -45,10 +45,28 @@ in
                  owner = "matrix-synapse";
                  group = "matrix-synapse";
                };
+                "chatterbox/doublepuppet.yaml" = {
+                  owner = "matrix-synapse";
+                  group = "matrix-synapse";
+                };
+
                "chatterbox/syncv3.env" = {
                  owner = "matrix-syncv3";
                  group = "matrix-syncv3";
                };
+
+                "chatterbox/mautrix-whatsapp.env" = {
+                  owner = "mautrix-whatsapp";
+                  group = "mautrix-whatsapp";
+                };
+                "chatterbox/mautrix-messenger.env" = {
+                  owner = "mautrix-meta-messenger";
+                  group = "mautrix-meta";
+                };
+                "chatterbox/mautrix-instagram.env" = {
+                  owner = "mautrix-meta-instagram";
+                  group = "mautrix-meta";
+                };
              };
            };

@@ -59,6 +77,9 @@ in

          users = with lib.my.c.ids; {
            users = {
+              matrix-synapse.extraGroups = [
+                "mautrix-whatsapp"
+              ];
              matrix-syncv3 = {
                isSystemUser = true;
                uid = uids.matrix-syncv3;
@@ -79,7 +100,10 @@ in
                User = "matrix-syncv3";
                Group = "matrix-syncv3";
              };
-            };
+            } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
+              # ffmpeg needed to convert GIFs to video
+              path = with pkgs; [ ffmpeg ];
+            }));
          };

          services = {
@@ -168,17 +192,19 @@ in

                app_service_config_files = [
                  "/var/lib/heisenbridge/registration.yml"
+                  config.age.secrets."chatterbox/doublepuppet.yaml".path
+                  "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
                ];
              };

-              sliding-sync = {
-                enable = true;
-                createDatabase = false;
-                environmentFile = config.age.secrets."chatterbox/syncv3.env".path;
-                settings = {
-                  SYNCV3_BINDADDR = "[::]:8009";
-                  SYNCV3_SERVER = "http://localhost:8008";
-                };
+            };
+            matrix-sliding-sync = {
+              enable = true;
+              createDatabase = false;
+              environmentFile = config.age.secrets."chatterbox/syncv3.env".path;
+              settings = {
+                SYNCV3_BINDADDR = "[::]:8009";
+                SYNCV3_SERVER = "http://localhost:8008";
              };
            };

@@ -195,6 +221,140 @@ in
                ];
              };
            };
+
+            mautrix-whatsapp = {
+              enable = true;
+              environmentFile = config.age.secrets."chatterbox/mautrix-whatsapp.env".path;
+              settings = {
+                homeserver = {
+                  address = "http://localhost:8008";
+                  domain = "nul.ie";
+                };
+                appservice = {
+                  database = {
+                    type = "postgres";
+                    uri = "$MAU_WAPP_PSQL_URI";
+                  };
+                  id = "whatsapp2";
+                  bot = {
+                    username = "whatsapp2";
+                    displayname = "WhatsApp Bridge Bot";
+                  };
+                };
+                bridge = {
+                  username_template = "wapp2_{{.}}";
+                  displayname_template = "{{or .BusinessName .PushName .JID}} (WA)";
+                  personal_filtering_spaces = true;
+                  delivery_receipts = true;
+                  allow_user_invite = true;
+                  url_previews = true;
+                  command_prefix = "!wa";
+                  login_shared_secret_map."nul.ie" = "$MAU_WAPP_DOUBLE_PUPPET_TOKEN";
+                  encryption = {
+                    allow = true;
+                    default = true;
+                    require = true;
+                  };
+                  permissions = {
+                    "@dev:nul.ie" = "admin";
+                  };
+                };
+              };
+            };
+
+            mautrix-meta.instances = {
+              messenger = {
+                enable = true;
+                registerToSynapse = true;
+                dataDir = "mautrix-messenger";
+                environmentFile = config.age.secrets."chatterbox/mautrix-messenger.env".path;
+                settings = {
+                  homeserver = {
+                    address = "http://localhost:8008";
+                    domain = "nul.ie";
+                  };
+                  appservice = {
+                    database = {
+                      type = "postgres";
+                      uri = "$MAU_FBM_PSQL_URI";
+                    };
+                    id = "fbm2";
+                    bot = {
+                      username = "messenger2";
+                      displayname = "Messenger Bridge Bot";
+                      avatar = "mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak";
+                    };
+                  };
+                  meta.mode = "messenger";
+                  bridge = {
+                    username_template = "fbm2_{{.}}";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
+                    personal_filtering_spaces = true;
+                    delivery_receipts = true;
+                    management_room_text.welcome = "Hello, I'm a Messenger bridge bot.";
+                    command_prefix = "!fbm";
+                    login_shared_secret_map."nul.ie" = "$MAU_FBM_DOUBLE_PUPPET_TOKEN";
+                    backfill = {
+                      history_fetch_pages = 5;
+                    };
+                    encryption = {
+                      allow = true;
+                      default = true;
+                      require = true;
+                    };
+                    permissions = {
+                      "@dev:nul.ie" = "admin";
+                    };
+                  };
+                };
+              };
+
+              instagram = {
+                enable = true;
+                registerToSynapse = true;
+                dataDir = "mautrix-instagram";
+                environmentFile = config.age.secrets."chatterbox/mautrix-instagram.env".path;
+                settings = {
+                  homeserver = {
+                    address = "http://localhost:8008";
+                    domain = "nul.ie";
+                  };
+                  appservice = {
+                    database = {
+                      type = "postgres";
+                      uri = "$MAU_IG_PSQL_URI";
+                    };
+                    id = "instagram";
+                    bot = {
+                      username = "instagram";
+                      displayname = "Instagram Bridge Bot";
+                      avatar = "mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv";
+                    };
+                  };
+                  meta.mode = "instagram";
+                  bridge = {
+                    username_template = "ig_{{.}}";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
+                    personal_filtering_spaces = true;
+                    delivery_receipts = true;
+                    management_room_text.welcome = "Hello, I'm an Instagram bridge bot.";
+                    command_prefix = "!ig";
+                    login_shared_secret_map."nul.ie" = "$MAU_IG_DOUBLE_PUPPET_TOKEN";
+                    backfill = {
+                      history_fetch_pages = 5;
+                    };
+                    encryption = {
+                      allow = true;
+                      default = true;
+                      require = true;
+                    };
+                    permissions = {
+                      "@dev:nul.ie" = "admin";
+                    };
+                  };
+                };
+              };
+            };
          };
        }
        (mkIf config.my.build.isDevVM {
--- a/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
@@ -1,6 +1,8 @@
 { lib, ... }:
 let
+  inherit (lib) concatStringsSep;
  inherit (lib.my) net;
+  inherit (lib.my.c) pubDomain;
  inherit (lib.my.c.colony) domain prefixes;
 in
 {
@@ -35,6 +37,9 @@ in

          secrets = {
            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPUv1ntVrZv5ripsKpcOAnyDQX2PHjowzyhqWK10Ml53";
+            files = {
+              "jackflix/photoprism-pass.txt" = {};
+            };
          };
        };

@@ -50,10 +55,16 @@ in
              uid = uids.jellyseerr;
              group = "jellyseerr";
            };
+            photoprism = {
+              isSystemUser = true;
+              uid = uids.photoprism;
+              group = "photoprism";
+            };
          };
          groups = {
            media.gid = 2000;
            jellyseerr.gid = gids.jellyseerr;
+            photoprism.gid = gids.photoprism;
          };
        };

@@ -76,6 +87,10 @@ in
              RootDirectoryStartOnly = lib.mkForce false;
              RootDirectory = lib.mkForce "";
            };
+            photoprism.serviceConfig = {
+              # Needs to be able to access its data
+              DynamicUser = mkForce false;
+            };
          };
        };

@@ -117,6 +132,24 @@ in
          };

          jellyfin.enable = true;
+
+          photoprism = {
+            enable = true;
+            address = "[::]";
+            port = 2342;
+            originalsPath = "/mnt/media/photoprism/originals";
+            importPath = "/mnt/media/photoprism/import";
+            passwordFile = config.age.secrets."jackflix/photoprism-pass.txt".path;
+            settings = {
+              PHOTOPRISM_AUTH_MODE = "password";
+              PHOTOPRISM_ADMIN_USER = "dev";
+              PHOTOPRISM_APP_NAME = "/dev/player0 Photos";
+              PHOTOPRISM_SITE_URL = "https://photos.${pubDomain}/";
+              PHOTOPRISM_SITE_TITLE = "/dev/player0 Photos";
+              PHOTOPRISM_TRUSTED_PROXY = concatStringsSep "," (with prefixes.ctrs; [ v4 v6 ]);
+              PHOTOPRISM_DATABASE_DRIVER = "sqlite";
+            };
+          };
        };
      };
    };
--- a/nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix
+++ b/nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix
@@ -37,7 +37,7 @@ in
                tcp dport ${toString transmissionPeerPort} accept
                iifname vpn return

-                tcp dport { 19999, 9091, 9117, 7878, 8989, 8096 } accept
+                tcp dport { 19999, 9091, 9117, 7878, 8989, 8096, 2342 } accept
                return
              }
              chain input {
--- a/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
@@ -364,7 +364,7 @@ in
        useACMEHost = pubDomain;
      };
      "mc-rail.${pubDomain}" = {
-        locations."/".proxyPass = "http://simpcraft-staging-oci.${domain}:3876";
+        locations."/".proxyPass = "http://simpcraft-oci.${domain}:3876";
        useACMEHost = pubDomain;
      };

@@ -384,6 +384,18 @@ in
        };
        useACMEHost = pubDomain;
      };
+      "pb.${pubDomain}" = {
+        locations."/".proxyPass = "http://object-ctr.${domain}:8088";
+        useACMEHost = pubDomain;
+      };
+      "photos.${pubDomain}" = {
+        locations."/" = {
+          proxyPass = "http://jackflix-ctr.${domain}:2342";
+          proxyWebsockets = true;
+          extraConfig = proxyHeaders;
+        };
+        useACMEHost = pubDomain;
+      };
    };

    minio =
--- a/nixos/boxes/colony/vms/shill/containers/object.nix
+++ b/nixos/boxes/colony/vms/shill/containers/object.nix
@@ -49,6 +49,7 @@ in
                };
                "object/atticd.env" = {};
                "object/hedgedoc.env" = {};
+                "object/wastebin.env" = {};
              };
            };

@@ -58,6 +59,7 @@ in
                config.services.sharry.config.bind.port
                8069
                config.services.hedgedoc.settings.port
+                8088
              ];
            };

@@ -220,6 +222,15 @@ in
                allowEmailRegister = false;
              };
            };
+
+            wastebin = {
+              enable = true;
+              settings = {
+                WASTEBIN_MAX_BODY_SIZE = 67108864; # 16 MiB
+                WASTEBIN_PASSWORD_SALT = "TeGhaemeer0Siez3";
+              };
+              secretFile = config.age.secrets."object/wastebin.env".path;
+            };
          };
        }
        (mkIf config.my.build.isDevVM {
--- a/nixos/boxes/colony/vms/shill/default.nix
+++ b/nixos/boxes/colony/vms/shill/default.nix
@@ -49,7 +49,11 @@ in
        inherit (lib.my) networkdAssignment;
      in
      {
-        imports = [ "${modulesPath}/profiles/qemu-guest.nix" ];
+        imports = [
+          "${modulesPath}/profiles/qemu-guest.nix"
+
+          ./containers-ext.nix
+        ];

        config = mkMerge [
          {
--- a/nixos/boxes/colony/vms/whale2/default.nix
+++ b/nixos/boxes/colony/vms/whale2/default.nix
@@ -108,45 +108,30 @@ in
              oci-containers = {
                backend = "podman";
              };
-              # NixOS has switched to using netavark, which is native to podman. It's currently missing an option to
-              # disable iptables rules generation, which is very annoying.
-              containers.containersConf.settings.network.network_backend = mkForce "cni";
+              containers.containersConf.settings.network = {
+                network_backend = "netavark";
+                firewall_driver = "none";
+              };
            };

            environment = {
              etc = {
-                "cni/net.d/90-colony.conflist".text = toJSON {
-                  cniVersion = "0.4.0";
+                "containers/networks/colony.json".text = toJSON {
                  name = "colony";
-                  plugins = [
+                  id = "0000000000000000000000000000000000000000000000000000000000000001";
+                  driver = "bridge";
+                  network_interface = "oci";
+                  ipv6_enabled = true;
+                  internal = false;
+                  dns_enabled = false;
+                  subnets = [
                    {
-                      type = "bridge";
-                      bridge = "oci";
-                      isGateway = true;
-                      ipMasq = false;
-                      hairpinMode = true;
-                      ipam = {
-                        type = "host-local";
-                        routes = [
-                          { dst = "0.0.0.0/0"; }
-                          { dst = "::/0"; }
-                        ];
-                        ranges = [
-                          [
-                            {
-                              subnet = prefixes.oci.v4;
-                              gateway = net.cidr.host 1 prefixes.oci.v4;
-                            }
-                          ]
-                          [
-                            {
-                              subnet = prefixes.oci.v6;
-                              gateway = net.cidr.host 1 prefixes.oci.v6;
-                            }
-                          ]
-                        ];
-                      };
-                      capabilities.ips = true;
+                      subnet = prefixes.oci.v4;
+                      gateway = net.cidr.host 1 prefixes.oci.v4;
+                    }
+                    {
+                      subnet = prefixes.oci.v6;
+                      gateway = net.cidr.host 1 prefixes.oci.v6;
                    }
                  ];
                };
--- a/nixos/boxes/colony/vms/whale2/minecraft/default.nix
+++ b/nixos/boxes/colony/vms/whale2/minecraft/default.nix
@@ -25,22 +25,20 @@ let
      	email = "simpcraft@nul.ie"
      	name = "Simpcraft bot"
    '';
-    knownHosts = pkgs.writeText "known_hosts" ''
-      git.nul.ie ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBD023ECzYmLeXIpcGVaciPjq6UN/Sjmsys5HP/Nei5GkrUZqPa3OJ2uSXKLUSKGYdeNhxaFTPJe8Yx3TsZxMme8=
-    '';
  };
 in
 {
  config = {
    virtualisation.oci-containers.containers = {
      simpcraft = {
-        image = "ghcr.io/itzg/minecraft-server:2023.12.2-java17-alpine";
+        image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";

        environment = {
          TYPE = "MODRINTH";

          EULA = "true";
          ENABLE_QUERY = "true";
+          ENABLE_RCON = "true";
          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t §4§k-----";
          ICON = "/ext/icon.png";

@@ -52,15 +50,17 @@ in
          SPAWN_PROTECTION = "0";
          VIEW_DISTANCE = "20";

-          MAX_MEMORY = "6G";
-          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/cdj2bSKg/Simpcraft-0.1.2.mrpack";
+          MAX_MEMORY = "8G";
+          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/NGutsQSd/Simpcraft-0.2.1.mrpack";

          TZ = "Europe/Dublin";
        };
+        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];

        volumes = [
          "minecraft_data:/data"
          "${./icon.png}:/ext/icon.png:ro"
+          "${fastback.gitConfig}:/data/.config/git/config:ro"
        ];

        extraOptions = [
@@ -68,53 +68,77 @@ in
        ];
      };

-      simpcraft-staging = {
-        image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";
+      # simpcraft-staging = {
+      #   image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";

-        environment = {
-          TYPE = "MODRINTH";
+      #   environment = {
+      #     TYPE = "MODRINTH";

-          EULA = "true";
-          ENABLE_QUERY = "true";
-          ENABLE_RCON = "true";
-          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t [staging] §4§k-----";
-          ICON = "/ext/icon.png";
+      #     EULA = "true";
+      #     ENABLE_QUERY = "true";
+      #     ENABLE_RCON = "true";
+      #     MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t [staging] §4§k-----";
+      #     ICON = "/ext/icon.png";

-          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
-          WHITELIST = whitelist;
-          EXISTING_OPS_FILE = "SYNCHRONIZE";
-          OPS = op;
-          DIFFICULTY = "normal";
-          SPAWN_PROTECTION = "0";
-          VIEW_DISTANCE = "20";
+      #     EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
+      #     WHITELIST = whitelist;
+      #     EXISTING_OPS_FILE = "SYNCHRONIZE";
+      #     OPS = op;
+      #     DIFFICULTY = "normal";
+      #     SPAWN_PROTECTION = "0";
+      #     VIEW_DISTANCE = "20";

-          MAX_MEMORY = "4G";
-          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/Ym3sIi6H/Simpcraft-0.2.0.mrpack";
+      #     MAX_MEMORY = "4G";
+      #     MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/Ym3sIi6H/Simpcraft-0.2.0.mrpack";

-          TZ = "Europe/Dublin";
+      #     TZ = "Europe/Dublin";
+      #   };
+      #   environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
+
+      #   volumes = [
+      #     "minecraft_staging_data:/data"
+      #     "${./icon.png}:/ext/icon.png:ro"
+      #   ];
+
+      #   extraOptions = [
+      #     ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
+      #   ];
+      # };
+    };
+
+    services = {
+      borgbackup.jobs.simpcraft =
+      let
+        rconCommand = cmd: ''${pkgs.mcrcon}/bin/mcrcon -H simpcraft-oci -p "$RCON_PASSWORD" "${cmd}"'';
+      in
+      {
+        paths = [ "/var/lib/containers/storage/volumes/minecraft_data/_data/world" ];
+        repo = "/var/lib/containers/backup/simpcraft";
+        doInit = true;
+        encryption.mode = "none";
+        compression = "zstd,10";
+        # every ~15 minutes offset from 5 minute intervals (Minecraft seems to save at precise times?)
+        startAt = "*:03,17,33,47";
+        prune.keep = {
+          within = "12H";
+          hourly = 48;
        };
-        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];

-        volumes = [
-          "minecraft_staging_data:/data"
-          "${./icon.png}:/ext/icon.png:ro"
-          "${fastback.gitConfig}:/data/.config/git/config:ro"
-          "${fastback.knownHosts}:/data/.ssh/known_hosts:ro"
-          "${config.age.secrets."whale2/simpcraft-git.key".path}:/data/.ssh/id_rsa"
-        ];
+        # Avoid Minecraft poking the files while we back up
+        preHook = rconCommand "save-off";
+        postHook = rconCommand "save-on";
+      };
+    };

-        extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
-        ];
+    systemd = {
+      services = {
+        borgbackup-job-simpcraft.serviceConfig.EnvironmentFile = [ config.age.secrets."whale2/simpcraft.env".path ];
      };
    };

    my = {
      secrets.files = {
        "whale2/simpcraft.env" = {};
-        "whale2/simpcraft-git.key" = {
-          owner = "1000";
-        };
      };
    };
  };
--- a/nixos/boxes/home/palace/vms/cellar/default.nix
+++ b/nixos/boxes/home/palace/vms/cellar/default.nix
@@ -66,6 +66,7 @@ in
            ];

            services = {
+              fstrim.enable = true;
              netdata.enable = true;
            };

--- a/nixos/boxes/home/palace/vms/cellar/spdk.nix
+++ b/nixos/boxes/home/palace/vms/cellar/spdk.nix
@@ -129,6 +129,12 @@ in
            hostnqn =
              "nqn.2014-08.org.nvmexpress:uuid:2230b066-a674-4f45-a1dc-f7727b3a9e7b";
            serial = "SPDK00000000000002";
+          }) ++ (nvmfBdev {
+            bdev = "NVMeRaidp3";
+            nqn = "nqn.2016-06.io.spdk:sfh";
+            hostnqn =
+              "nqn.2014-08.org.nvmexpress:uuid:85d7df36-0de0-431b-b06e-51f7c0a455b4";
+            serial = "SPDK00000000000003";
          });
        };
      };
--- a/nixos/boxes/home/palace/vms/default.nix
+++ b/nixos/boxes/home/palace/vms/default.nix
@@ -2,6 +2,7 @@
  imports = [
    ./cellar
    ./river.nix
+    ./sfh
  ];

  nixos.systems.palace.configuration = { lib, pkgs, config, systems, allAssignments, ... }:
@@ -57,11 +58,11 @@

    systemd.services =
    let
-      awaitCellar = {
-        after = [ "vm@cellar.service" ];
-        bindsTo = [ "vm@cellar.service" ];
+      awaitVM = system: {
+        after = [ "vm@${system}.service" ];
+        bindsTo = [ "vm@${system}.service" ];
        preStart = ''
-          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.cellar.hi.ipv4.address} 22; do
+          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.${system}.hi.ipv4.address} 22; do
            sleep 1
          done
        '';
@@ -81,13 +82,13 @@
        vtapUnit = "sys-subsystem-net-devices-vm\\x2det1g0.device";
      in
      mkMerge [
-        awaitCellar
+        (awaitVM "cellar")
        {
          requires = [ vtapUnit ];
          after = [ vtapUnit ];
        }
      ];
-      "vm@sfh" = awaitCellar;
+      "vm@sfh" = (awaitVM "river");
    };

    my = {
--- a/nixos/boxes/home/palace/vms/river.nix
+++ b/nixos/boxes/home/palace/vms/river.nix
@@ -10,18 +10,7 @@
    let
      inherit (lib.my) networkdAssignment mkVLAN;
      inherit (lib.my.c) networkd;
-      inherit (lib.my.c.home) vlans;
-
-      lanLink = {
-        matchConfig = {
-          Driver = "mlx5_core";
-          PermanentMACAddress = "52:54:00:8a:8a:f2";
-        };
-        linkConfig = {
-          Name = "lan";
-          MTUBytes = toString lib.my.c.home.hiMTU;
-        };
-      };
+      inherit (lib.my.c.home) vlans domain prefixes roceBootModules;
    in
    {
      imports = [
@@ -30,29 +19,16 @@

      config = {
        boot = {
-          kernelModules = [ "kvm-intel" ];
+          kernelModules = [ "kvm-amd" ];
          kernelParams = [ "console=ttyS0,115200n8" ];
          initrd = {
            availableKernelModules = [
              "virtio_pci" "ahci" "sr_mod" "virtio_blk"
-              "ib_core" "ib_uverbs" "mlx5_core" "mlx5_ib" "8021q"
-              "rdma_cm" "iw_cm" "ib_cm" "nvme_core" "nvme_rdma"
-            ];
-            kernelModules = [ "dm-snapshot" "nvme-fabrics" ];
+            ] ++ roceBootModules;
+            kernelModules = [ "dm-snapshot" ];
            systemd = {
-              extraBin = with pkgs; {
-                dmesg = "${util-linux}/bin/dmesg";
-                ip = "${iproute2}/bin/ip";
-              };
-              extraConfig = ''
-                DefaultTimeoutStartSec=50
-                DefaultDeviceTimeoutSec=50
-              '';
              network = {
-                enable = true;
-                wait-online.enable = true;
-
-                links."10-lan" = lanLink;
+                # Don't need to put the link config here, they're copied from main config
                netdevs = mkVLAN "lan-hi" vlans.hi;
                networks = {
                  "20-lan" = {
@@ -70,9 +46,6 @@

        hardware = {
          enableRedistributableFirmware = true;
-          cpu = {
-            intel.updateMicrocode = true;
-          };
        };

        fileSystems = {
@@ -96,6 +69,7 @@
            boot.thin.enable = true;
            dmeventd.enable = true;
          };
+          fstrim.enable = true;
        };

        systemd.network = {
@@ -114,7 +88,16 @@
              };
            };

-            "10-lan" = lanLink;
+            "10-lan" = {
+              matchConfig = {
+                Driver = "mlx5_core";
+                PermanentMACAddress = "52:54:00:8a:8a:f2";
+              };
+              linkConfig = {
+                Name = "lan";
+                MTUBytes = toString lib.my.c.home.hiMTU;
+              };
+            };
          };

          # So we don't drop the IP we use to connect to NVMe-oF!
@@ -134,6 +117,14 @@
            };
          };

+          netboot.server = {
+            enable = true;
+            ip = assignments.lo.ipv4.address;
+            host = "boot.${domain}";
+            allowedPrefixes = with prefixes; [ hi.v4 hi.v6 lo.v4 lo.v6 ];
+            instances = [ "sfh" ];
+          };
+
          deploy.node.hostname = "192.168.68.1";
        };
      };
--- a/nixos/boxes/home/palace/vms/sfh/default.nix
+++ b/nixos/boxes/home/palace/vms/sfh/default.nix
@@ -0,0 +1,124 @@
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c) pubDomain;
+  inherit (lib.my.c.home) domain prefixes vips hiMTU roceBootModules;
+in
+{
+  config.nixos.systems.sfh = {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+    home-manager = "mine";
+    assignments = {
+      hi = {
+        inherit domain;
+        mtu = hiMTU;
+        ipv4 = {
+          address = net.cidr.host 81 prefixes.hi.v4;
+          mask = 22;
+          gateway = vips.hi.v4;
+        };
+        ipv6 = {
+          iid = "::4:2";
+          address = net.cidr.host (65536*4+2) prefixes.hi.v6;
+        };
+      };
+    };
+
+    configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
+    let
+      inherit (lib) mkMerge;
+      inherit (lib.my) networkdAssignment;
+      inherit (lib.my.c.home) domain;
+    in
+    {
+      imports = [
+        "${modulesPath}/profiles/qemu-guest.nix"
+      ];
+
+      config = {
+        boot = {
+          kernelModules = [ "kvm-amd" ];
+          kernelParams = [ "console=ttyS0,115200n8" ];
+          initrd = {
+            availableKernelModules = [
+              "virtio_pci" "ahci" "sr_mod" "virtio_blk"
+            ] ++ roceBootModules;
+            kernelModules = [ "dm-snapshot" ];
+            systemd = {
+              network = {
+                networks = {
+                  "20-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
+                };
+              };
+            };
+          };
+        };
+
+        hardware = {
+          enableRedistributableFirmware = true;
+        };
+
+        fileSystems = {
+          "/nix" = {
+            device = "/dev/main/nix";
+            fsType = "ext4";
+          };
+          "/persist" = {
+            device = "/dev/main/persist";
+            fsType = "ext4";
+            neededForBoot = true;
+          };
+        };
+
+        networking = { inherit domain; };
+
+        services = {
+          lvm = {
+            boot.thin.enable = true;
+            dmeventd.enable = true;
+          };
+        };
+
+        systemd.network = {
+          links = {
+            "10-lan-hi" = {
+              matchConfig = {
+                Driver = "mlx5_core";
+                PermanentMACAddress = "52:54:00:ac:15:a9";
+              };
+              linkConfig = {
+                Name = "lan-hi";
+                MTUBytes = toString lib.my.c.home.hiMTU;
+              };
+            };
+          };
+
+          networks."30-lan-hi" = mkMerge [
+            (networkdAssignment "lan-hi" assignments.hi)
+            # So we don't drop the IP we use to connect to NVMe-oF!
+            { networkConfig.KeepConfiguration = "static"; }
+          ];
+        };
+
+        my = {
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAAaav5Se1E/AbqEXmADryVszYfNDscyP6jrWioN57R7";
+          };
+          server.enable = true;
+
+          netboot.client = {
+            enable = true;
+          };
+          nvme = {
+            uuid = "85d7df36-0de0-431b-b06e-51f7c0a455b4";
+            boot = {
+              nqn = "nqn.2016-06.io.spdk:sfh";
+              address = "192.168.68.80";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/nixos/boxes/home/routing-common/default.nix
+++ b/nixos/boxes/home/routing-common/default.nix
@@ -148,19 +148,33 @@ in
                };
              };
            };
+
+            nginx.enable = true;
          };

-          networking.domain = "h.${pubDomain}";
+          networking = { inherit domain; };

-          systemd.services = {
-            ipsec =
-            let
-              waitOnline = "systemd-networkd-wait-online@wan.service";
-            in
-            {
+          systemd.services =
+          let
+            waitOnline = "systemd-networkd-wait-online@wan.service";
+          in
+          {
+            ipsec = {
              after = [ waitOnline ];
              requires = [ waitOnline ];
            };
+
+            ipv6-clear-default-route = {
+              description = "Clear IPv6 RA default route";
+              after = [ waitOnline ];
+              requires = [ waitOnline ];
+              script = ''
+                # Seems like we can sometimes pick up a default route somehow...
+                ${pkgs.iproute2}/bin/ip -6 route del default via fe80::1 || true
+              '';
+              serviceConfig.Type = "oneshot";
+              wantedBy = [ "multi-user.target" ];
+            };
          };

          systemd.network = {
@@ -214,7 +228,7 @@ in
                  extraConfig = ''
                    [CAKE]
                    Bandwidth=235M
-                    RTTSec=10ms
+                    RTTSec=50ms
                    PriorityQueueingPreset=besteffort
                    # DOCSIS preset
                    OverheadBytes=18
@@ -238,7 +252,7 @@ in
                      [CAKE]
                      Parent=root
                      Bandwidth=24M
-                      RTTSec=1ms
+                      RTTSec=50ms
                    '';
                  }
                ];
@@ -358,6 +372,16 @@ in
                    return
                  }

+                  chain forward-early {
+                    type filter hook forward priority -1; policy accept;
+
+                    # MSS clamping to workaround IPv6 PMTUD being broken...
+                    tcp flags syn tcp option maxseg size set rt mtu counter
+
+                    # More Disney+ discrimination...
+                    # TODO: This prefix could change (random AWS block)
+                    ip6 daddr 2600:9000:2245::/48 drop
+                  }
                  chain forward {
                    ${lib.my.c.as211024.nftTrust}
                    iifname lan-untrusted jump filter-untrusted
--- a/nixos/boxes/home/routing-common/dns.nix
+++ b/nixos/boxes/home/routing-common/dns.nix
@@ -61,6 +61,19 @@ in
          webserver = true;
          webserver-address = "::";
          webserver-allow-from = [ "127.0.0.1" "::1" ];
+
+          lua-dns-script = pkgs.writeText "pdns-script.lua" ''
+            -- Disney+ doesn't like our IP space...
+            function preresolve(dq)
+              local name = dq.qname:toString()
+              if dq.qtype == pdns.AAAA and (string.find(name, "disneyplus") or string.find(name, "disney-plus") or string.find(name , "disney.api")) then
+                dq.rcode = 0
+                return true
+              end
+
+              return false
+            end
+          '';
        };
      };
    };
@@ -159,6 +172,7 @@ in
            }}
            ${elemAt routers 0} IN AAAA ${net.cidr.host 1 prefixes.hi.v6}
            ${elemAt routers 1} IN AAAA ${net.cidr.host 2 prefixes.hi.v6}
+            boot IN CNAME river-hi.${config.networking.domain}.

            @ IN NS ns1
            @ IN NS ns2
@@ -182,8 +196,10 @@ in
            dave-lo IN A ${net.cidr.host 11 prefixes.lo.v4}
            dave-lo IN AAAA ${net.cidr.host (65536+2) prefixes.lo.v6}

-            ;ap0 IN A ${net.cidr.host 12 prefixes.hi.v4}
-            ;ap0 IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
+            shytzel IN A ${net.cidr.host 12 prefixes.core.v4}
+
+            wave IN A ${net.cidr.host 12 prefixes.hi.v4}
+            wave IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
            vibe IN A ${net.cidr.host 13 prefixes.hi.v4}
            vibe IN AAAA ${net.cidr.host (65536+4) prefixes.hi.v6}

--- a/nixos/boxes/home/routing-common/kea.nix
+++ b/nixos/boxes/home/routing-common/kea.nix
@@ -1,7 +1,7 @@
-index: { lib, pkgs, assignments, ... }:
+index: { lib, pkgs, config, assignments, allAssignments, ... }:
 let
  inherit (lib) mkForce;
-  inherit (lib.my) net;
+  inherit (lib.my) net netbootKeaClientClasses;
  inherit (lib.my.c.home) domain prefixes vips hiMTU;

  dns-servers = [
@@ -26,7 +26,11 @@ in
  };

  systemd.services = {
-    kea-dhcp4-server.serviceConfig.DynamicUser = mkForce false;
+    kea-dhcp4-server.serviceConfig = {
+      # Sometimes interfaces might not be ready in time and Kea doesn't like that
+      Restart = "on-failure";
+      DynamicUser = mkForce false;
+    };
    kea-dhcp-ddns-server.serviceConfig.DynamicUser = mkForce false;
  };

@@ -59,6 +63,13 @@ in
              always-send = true;
            }
          ];
+          client-classes = netbootKeaClientClasses {
+            tftpIP = allAssignments.river.lo.ipv4.address;
+            hostname = "boot.${domain}";
+            systems = {
+              sfh = "52:54:00:a5:7e:93";
+            };
+          };
          subnet4 = [
            {
              id = 1;
--- a/nixos/boxes/home/routing-common/keepalived.nix
+++ b/nixos/boxes/home/routing-common/keepalived.nix
@@ -1,52 +1,82 @@
 index: { lib, pkgs, config, ... }:
 let
-  inherit (builtins) attrNames concatMap;
-  inherit (lib) optional;
+  inherit (builtins) attrNames concatMap length;
+  inherit (lib) optional concatMapStringsSep;
  inherit (lib.my) net;
  inherit (lib.my.c.home) prefixes vips;

+  pingScriptFor = name: ips:
+  let
+    script' = pkgs.writeShellScript
+      "keepalived-ping-${name}"
+      (concatMapStringsSep " || " (ip: "${pkgs.iputils}/bin/ping -qnc 1 -W 1 ${ip}") ips);
+  in
+  {
+    script = toString script';
+    interval = 1;
+    timeout = (length ips) + 1;
+    rise = 3;
+    fall = 3;
+  };
+
  vlanIface = vlan: if vlan == "as211024" then vlan else "lan-${vlan}";
-  vrrpIPs = family: concatMap (vlan: [
+  vrrpIPs = family: concatMap (vlan: (optional (family == "v6") {
+      addr = "fe80::1/64";
+      dev = vlanIface vlan;
+    }) ++ [
    {
      addr = "${vips.${vlan}.${family}}/${toString (net.cidr.length prefixes.${vlan}.${family})}";
      dev = vlanIface vlan;
    }
-  ] ++ (optional (family == "v6") {
-    addr = "fe80::1/64";
-    dev = vlanIface vlan;
-  })) (attrNames vips);
+  ]) (attrNames vips);
  mkVRRP = family: routerId: {
    state = if index == 0 then "MASTER" else "BACKUP";
    interface = "lan-core";
    priority = 255 - index;
    virtualRouterId = routerId;
    virtualIps = vrrpIPs family;
+    trackScripts = [ "${family}Alive" ];
    extraConfig = ''
-      notify_master "${config.systemd.package}/bin/systemctl start radvd.service"
-      notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service"
+      notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
+      notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
    '';
  };
 in
 {
+  users = with lib.my.c.ids; {
+    users.keepalived_script = {
+      uid = uids.keepalived_script;
+      isSystemUser = true;
+      group = "keepalived_script";
+    };
+    groups.keepalived_script.gid = gids.keepalived_script;
+  };
+
  services = {
    keepalived = {
      enable = true;
+      enableScriptSecurity = true;
      extraGlobalDefs = ''
        vrrp_version 3
        nftables keepalived
      '';
+      vrrpScripts = {
+        v4Alive = pingScriptFor "v4" [ "1.1.1.1" "8.8.8.8" "216.218.236.2" ];
+        v6Alive = pingScriptFor "v6" [ "2606:4700:4700::1111" "2001:4860:4860::8888" "2600::" ];
+      };
      vrrpInstances = {
        v4 = mkVRRP "v4" 51;
        v6 = mkVRRP "v6" 52;
      };
-      extraConfig = ''
-        vrrp_sync_group main {
-          group {
-            v4
-            v6
-          }
-        }
-      '';
+      # Actually disable this for now, don't want to fault IPv4 just because IPv6 is broken...
+      # extraConfig = ''
+      #   vrrp_sync_group main {
+      #     group {
+      #       v4
+      #       v6
+      #     }
+      #   }
+      # '';
    };
  };
 }
--- a/nixos/boxes/home/stream.nix
+++ b/nixos/boxes/home/stream.nix
@@ -123,7 +123,7 @@
            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPYTB4zeAqotrEJ8M+AiGm/s9PFsWlAodz3hYSROGuDb";
          };
          server.enable = true;
-          deploy.node.hostname = "192.168.68.2";
+          # deploy.node.hostname = "192.168.68.2";
        };
      };
    };
--- a/nixos/boxes/kelder/containers/acquisition/default.nix
+++ b/nixos/boxes/kelder/containers/acquisition/default.nix
@@ -65,7 +65,13 @@ in
        systemd = {
          services = {
            jackett.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
+
            transmission.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
+            # https://github.com/NixOS/nixpkgs/issues/258793#issuecomment-1748168206
+            transmission.serviceConfig = {
+              RootDirectoryStartOnly = lib.mkForce false;
+              RootDirectory = lib.mkForce "";
+            };

            radarr.serviceConfig.UMask = "0002";
            sonarr.serviceConfig.UMask = "0002";
--- a/nixos/boxes/kelder/containers/acquisition/networking.nix
+++ b/nixos/boxes/kelder/containers/acquisition/networking.nix
@@ -2,6 +2,7 @@
 let
  inherit (lib) mkMerge mkIf;
  inherit (lib.my) networkdAssignment;
+  inherit (lib.my.c.kelder) ipv4MTU;

  wg = {
    keyFile = "kelder/acquisition/airvpn-privkey";
@@ -89,6 +90,7 @@ in
              (networkdAssignment "host0" assignments.internal)
              {
                networkConfig.DNSDefaultRoute = false;
+                linkConfig.MTUBytes = toString ipv4MTU;
              }
            ];
            "90-vpn" = with wg; {
--- a/nixos/boxes/kelder/containers/spoder/default.nix
+++ b/nixos/boxes/kelder/containers/spoder/default.nix
@@ -92,17 +92,17 @@ in

          nextcloud = {
            enable = true;
-            package = pkgs.nextcloud28;
+            package = pkgs.nextcloud29;
            datadir = "/mnt/storage/nextcloud";
            hostName = "cloud.${domain}";
            https = true;
            config = {
-              extraTrustedDomains = [ "cloud-local.${domain}" ];
              adminpassFile = config.age.secrets."kelder/nextcloud-root.txt".path;
-              defaultPhoneRegion = "IE";
            };
-            extraOptions = {
+            settings = {
              updatechecker = false;
+              trusted_domains = [ "cloud-local.${domain}" ];
+              default_phone_region = "IE";
            };
          };
        };
--- a/nixos/boxes/kelder/containers/spoder/nginx.nix
+++ b/nixos/boxes/kelder/containers/spoder/nginx.nix
@@ -84,6 +84,7 @@ in
            c
          ];
          acquisition = "http://${allAssignments.kelder-acquisition.internal.ipv4.address}";
+          # This is kinda borked because Virgin Media filters DNS responses with local IPs...
          localRedirect = to: ''
            rewrite_by_lua_block {
              if ngx.var.remote_addr == pub_ip then
@@ -103,7 +104,7 @@ in

            "monitor.${domain}" = withAuth {
              serverAliases = [ "monitor-local.${domain}" ];
-              extraConfig = localRedirect "monitor-local.${domain}";
+              # extraConfig = localRedirect "monitor-local.${domain}";
              locations = {
                "/" = {
                  proxyPass = "http://${allAssignments.kelder.ctrs.ipv4.address}:19999";
@@ -136,17 +137,17 @@ in
            };
            "torrents.${domain}" = withAuth {
              serverAliases = [ "torrents-local.${domain}" ];
-              extraConfig = localRedirect "torrents-local.${domain}";
+              # extraConfig = localRedirect "torrents-local.${domain}";
              locations."/".proxyPass = "${acquisition}:9091";
            };
            "jackett.${domain}" = withAuth {
              serverAliases = [ "jackett-local.${domain}" ];
-              extraConfig = localRedirect "jackett-local.${domain}";
+              # extraConfig = localRedirect "jackett-local.${domain}";
              locations."/".proxyPass = "${acquisition}:9117";
            };
            "radarr.${domain}" = withAuth {
              serverAliases = [ "radarr-local.${domain}" ];
-              extraConfig = localRedirect "radarr-local.${domain}";
+              # extraConfig = localRedirect "radarr-local.${domain}";
              locations."/" = {
                proxyPass = "${acquisition}:7878";
                proxyWebsockets = true;
@@ -155,7 +156,7 @@ in
            };
            "sonarr.${domain}" = withAuth {
              serverAliases = [ "sonarr-local.${domain}" ];
-              extraConfig = localRedirect "sonarr-local.${domain}";
+              # extraConfig = localRedirect "sonarr-local.${domain}";
              locations."/" = {
                proxyPass = "${acquisition}:8989";
                proxyWebsockets = true;
--- a/nixos/boxes/kelder/default.nix
+++ b/nixos/boxes/kelder/default.nix
@@ -1,7 +1,7 @@
 { lib, ... }:
 let
  inherit (lib.my) net;
-  inherit (lib.my.c.kelder) domain prefixes;
+  inherit (lib.my.c.kelder) domain prefixes ipv4MTU;
 in
 {
  imports = [ ./containers ];
@@ -182,7 +182,7 @@ in
                    {
                      wireguardPeerConfig = {
                        PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
-                        Endpoint = "estuary-vm.${lib.my.c.colony.domain}:${toString lib.my.c.kelder.vpn.port}";
+                        Endpoint = "${allAssignments.estuary.internal.ipv4.address}:${toString lib.my.c.kelder.vpn.port}";
                        AllowedIPs = [ "0.0.0.0/0" ];
                        PersistentKeepalive = 25;
                      };
@@ -200,6 +200,7 @@ in
                "50-lan" = {
                  matchConfig.Name = "et1g0";
                  DHCP = "yes";
+                  linkConfig.MTUBytes = toString ipv4MTU;
                };
                "80-ctrs" = mkMerge [
                  (networkdAssignment "ctrs" assignments.ctrs)
@@ -272,7 +273,7 @@ in
              config.name = "kontent";
            };

-            #deploy.node.hostname = "10.16.9.21";
+            # deploy.node.hostname = "192.168.0.69";
            secrets = {
              key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOFvUdJshXkqmchEgkZDn5rgtZ1NO9vbd6Px+S6YioWi";
              files = {
--- a/nixos/boxes/tower/default.nix
+++ b/nixos/boxes/tower/default.nix
@@ -129,10 +129,9 @@
            wifi = {
              backend = "wpa_supplicant";
            };
-            extraConfig = ''
-              [main]
-              no-auto-default=*
-            '';
+            settings = {
+              main.no-auto-default = "*";
+            };
          };
        };

--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -135,6 +135,7 @@ let
      ipv6 = mkBoolOpt' false "Whether this mesh's underlay operates over IPv6.";
      baseMTU = mkOpt' ints.unsigned 1500 "Base MTU to calculate VXLAN MTU with.";
      l3Overhead = mkOpt' ints.unsigned 40 "Overhead of L3 header (to calculate MTU).";
+      udpEncapsulation = mkBoolOpt' false "Whether to encapsulate ESP frames in UDP.";
      firewall = mkBoolOpt' true "Whether to generate firewall rules.";
      vni = mkOpt' ints.unsigned 1 "VXLAN VNI.";
      peers = mkOpt' (attrsOf (submodule l2PeerOpts)) { } "Peers.";
--- a/nixos/installer.nix
+++ b/nixos/installer.nix
@@ -1,7 +1,7 @@
 {
  nixos.systems.installer = { config, ... }: {
    system = "x86_64-linux";
-    nixpkgs = "unstable";
+    nixpkgs = "mine";
    docCustom = false;
    rendered = config.configuration.config.my.asISO;

@@ -52,6 +52,8 @@
            home.shellAliases = {
              show-hw-config = "nixos-generate-config --show-hardware-config --root $INSTALL_ROOT";
            };
+
+            my.gui.enable = false;
          };

          services = {
@@ -84,6 +86,7 @@
            dhcpcd
            lm_sensors
            ethtool
+            nfs-utils
          ];

          # Much of this onwards is yoinked from modules/profiles/installation-device.nix
--- a/nixos/modules/_list.nix
+++ b/nixos/modules/_list.nix
@@ -20,5 +20,6 @@
    nvme = ./nvme;
    spdk = ./spdk.nix;
    librespeed = ./librespeed;
+    netboot = ./netboot;
  };
 }
--- a/nixos/modules/build.nix
+++ b/nixos/modules/build.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, extendModules, modulesPath, options, config, ... }:
 let
-  inherit (lib) recursiveUpdate mkOption mkDefault mkIf mkMerge flatten optional;
+  inherit (lib) recursiveUpdate mkOption mkDefault mkIf mkMerge mkForce flatten optional;
  inherit (lib.my) mkBoolOpt' dummyOption;

  cfg = config.my.build;
@@ -43,15 +43,144 @@ let
    modules = flatten [
      "${modulesPath}/installer/netboot/netboot.nix"
      allHardware
+    ];
+  };
+
+  asNetboot = extendModules {
+    modules = flatten [
+      allHardware
      ({ pkgs, config, ... }: {
-        system.build.netbootArchive = pkgs.runCommand "netboot-${config.system.name}-archive.tar" { } ''
-          ${pkgs.gnutar}/bin/tar -rvC "${config.system.build.kernel}" \
-            -f "$out" "${config.system.boot.loader.kernelFile}"
-          ${pkgs.gnutar}/bin/tar -rvC "${config.system.build.netbootRamdisk}" \
-            -f "$out" initrd
-          ${pkgs.gnutar}/bin/tar -rvC "${config.system.build.netbootIpxeScript}" \
-            -f "$out" netboot.ipxe
-        '';
+        boot = {
+          loader.grub.enable = false;
+          initrd = {
+            kernelModules = [ "nbd" ];
+
+            systemd = {
+              storePaths = with pkgs; [
+                gnused
+                nbd
+                netcat
+              ];
+              extraBin = with pkgs; {
+                dmesg = "${util-linux}/bin/dmesg";
+                ip = "${iproute2}/bin/ip";
+                nbd-client = "${nbd}/bin/nbd-client";
+              };
+              extraConfig = ''
+                DefaultTimeoutStartSec=10
+                DefaultDeviceTimeoutSec=10
+              '';
+
+              network = {
+                enable = true;
+                wait-online.enable = true;
+
+                networks."10-netboot" = {
+                  matchConfig.Name = "et-boot";
+                  DHCP = "yes";
+                };
+              };
+
+              services = {
+                nbd = {
+                  description = "NBD Root FS";
+
+                  script = ''
+                    get_cmdline() {
+                      ${pkgs.gnused}/bin/sed -rn "s/^.*$1=(\\S+).*\$/\\1/p" < /proc/cmdline
+                    }
+
+                    s="$(get_cmdline nbd_server)"
+                    until ${pkgs.netcat}/bin/nc -zv "$s" 22; do
+                      sleep 0.1
+                    done
+
+                    exec ${pkgs.nbd}/bin/nbd-client -systemd-mark -N "$(get_cmdline nbd_export)" "$s" /dev/nbd0
+                  '';
+                  unitConfig = {
+                    IgnoreOnIsolate = "yes";
+                    DefaultDependencies = "no";
+                  };
+                  serviceConfig = {
+                    Type = "forking";
+                    Restart = "on-failure";
+                    RestartSec = 10;
+                  };
+
+                  wantedBy = [ "initrd-root-device.target" ];
+                };
+              };
+            };
+          };
+
+          postBootCommands = ''
+            # After booting, register the contents of the Nix store
+            # in the Nix database in the COW root.
+            ${config.nix.package}/bin/nix-store --load-db < /nix-path-registration
+
+            # nixos-rebuild also requires a "system" profile and an
+            # /etc/NIXOS tag.
+            touch /etc/NIXOS
+            ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
+          '';
+        };
+
+        programs.nbd.enable = true;
+
+        fileSystems = {
+          "/" = {
+            fsType = "ext4";
+            device = "/dev/nbd0";
+            noCheck = true;
+            autoResize = true;
+          };
+        };
+
+        networking.useNetworkd = mkForce true;
+
+        systemd = {
+          network.networks."10-boot" = {
+            matchConfig.Name = "et-boot";
+            DHCP = "yes";
+            networkConfig.KeepConfiguration = "yes";
+          };
+        };
+
+        system.build = {
+          rootImage = pkgs.callPackage "${modulesPath}/../lib/make-ext4-fs.nix" {
+            storePaths = [ config.system.build.toplevel ];
+            volumeLabel = "netboot-root";
+          };
+          netbootScript = pkgs.writeText "boot.ipxe" ''
+            #!ipxe
+            kernel ${pkgs.stdenv.hostPlatform.linux-kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ifname=et-boot:''${mac} nbd_server=''${next-server} ${toString config.boot.kernelParams} ''${cmdline}
+            initrd initrd
+            boot
+          '';
+
+          netbootTree = pkgs.linkFarm "netboot-${config.system.name}" [
+            {
+              name = config.system.boot.loader.kernelFile;
+              path = "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
+            }
+            {
+              name = "initrd";
+              path = "${config.system.build.initialRamdisk}/initrd";
+            }
+            {
+              name = "rootfs.ext4";
+              path = config.system.build.rootImage;
+            }
+            {
+              name = "boot.ipxe";
+              path = config.system.build.netbootScript;
+            }
+          ];
+          netbootArchive = pkgs.runCommand "netboot-${config.system.name}.tar.zst" { } ''
+            export PATH=${pkgs.zstd}/bin:$PATH
+            ${pkgs.gnutar}/bin/tar --dereference --zstd -cvC ${config.system.build.netbootTree} -f "$out" .
+          '';
+        };
      })
    ];
  };
@@ -77,6 +206,7 @@ in
      asISO = mkAsOpt asISO "a bootable .iso image";
      asContainer = mkAsOpt asContainer "a container";
      asKexecTree = mkAsOpt asKexecTree "a kexec-able kernel and initrd";
+      asNetboot = mkAsOpt asNetboot "a netboot-able kernel initrd, and iPXE script";

      buildAs = options.system.build;
    };
@@ -110,7 +240,8 @@ in
        iso = config.my.asISO.config.system.build.isoImage;
        container = config.my.asContainer.config.system.build.toplevel;
        kexecTree = config.my.asKexecTree.config.system.build.kexecTree;
-        netbootArchive = config.my.asKexecTree.config.system.build.netbootArchive;
+        netbootTree = config.my.asNetboot.config.system.build.netbootTree;
+        netbootArchive = config.my.asNetboot.config.system.build.netbootArchive;
      };
    };
  };
--- a/nixos/modules/common.nix
+++ b/nixos/modules/common.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, pkgs', inputs, config, ... }:
+{ lib, pkgsFlake, pkgs, pkgs', inputs, config, ... }:
 let
  inherit (lib) mkIf mkDefault mkMerge;
  inherit (lib.my) mkDefault';
@@ -53,7 +53,7 @@ in
          pkgs = {
            to = {
              type = "path";
-              path = "${pkgs.path}";
+              path = "${pkgsFlake}";
            };
            exact = true;
          };
--- a/nixos/modules/containers.nix
+++ b/nixos/modules/containers.nix
@@ -123,18 +123,7 @@ in
          (n: _: "ve-${n}")
          (filterAttrs (_: c: c.networking.bridge == null) cfg.instances);

-      systemd = mkMerge ([
-        {
-          # By symlinking to the original systemd-nspawn@.service for every instance we force the unit generator to
-          # create overrides instead of replacing the unit entirely
-          packages = [
-            (pkgs.linkFarm "systemd-nspawn-containers" (map (n: {
-              name = "etc/systemd/system/systemd-nspawn@${n}.service";
-              path = "${pkgs.systemd}/example/systemd/system/systemd-nspawn@.service";
-            }) (attrNames cfg.instances)))
-          ];
-        }
-      ] ++ (mapAttrsToList (n: c: {
+      systemd = mkMerge (mapAttrsToList (n: c: {
        nspawn."${n}" = {
          execConfig = {
            Boot = true;
@@ -182,6 +171,9 @@ in
            c.containerSystem;
        in
        {
+          # To prevent creating a whole new unit file
+          overrideStrategy = "asDropin";
+
          environment = {
            # systemd.nspawn units can't set the root directory directly, but /run/machines/${n} is one of the search paths
            root = "/run/machines/${n}";
@@ -247,7 +239,7 @@ in
            Bridge = c.networking.bridge;
          };
        };
-      }) cfg.instances));
+      }) cfg.instances);
    })

    # Inside container
--- a/nixos/modules/gui.nix
+++ b/nixos/modules/gui.nix
@@ -23,13 +23,13 @@ in

    security = {
      polkit.enable = true;
-      pam.services.swaylock = {};
+      pam.services.swaylock-plugin = {};
    };

    environment.systemPackages = with pkgs; [
      # for pw-jack
      pipewire.jack
-      swaylock
+      swaylock-plugin
    ];
    services = {
      pipewire = {
@@ -51,6 +51,8 @@ in
          SUBSYSTEM=="usb", ATTR{idVendor}=="0955", MODE="0664", GROUP="wheel"
          # Nintendo
          SUBSYSTEM=="usb", ATTR{idVendor}=="057e", MODE="0664", GROUP="wheel"
+          # FT
+          SUBSYSTEM=="usb", ATTR{idVendor}=="0403", MODE="0664", GROUP="wheel"
        '';
      };
    };
--- a/nixos/modules/l2mesh.nix
+++ b/nixos/modules/l2mesh.nix
@@ -36,8 +36,8 @@ let
        espOverhead =
          if (!mesh.security.enable) then 0
          else
-            # SPI + seq + IV + pad / header + ICV
-            4 + 4 + (if mesh.security.encrypt then 8 else 0) + 2 + 16;
+            # UDP encap + SPI + seq + IV + pad / header + ICV
+            (if mesh.udpEncapsulation then 8 else 0) + 4 + 4 + (if mesh.security.encrypt then 8 else 0) + 2 + 16;
        # UDP + VXLAN + Ethernet + L3 (IPv4/IPv6)
        overhead = espOverhead + 8 + 8 + 14 + mesh.l3Overhead;
      in
@@ -62,7 +62,11 @@ let
      chain l2mesh-${name} {
        ${optionalString mesh.security.enable ''
          udp dport isakmp accept
-          meta l4proto esp accept
+          ${if mesh.udpEncapsulation then ''
+            udp dport ipsec-nat-t accept
+          '' else ''
+            meta l4proto esp accept
+          ''}
        ''}
        ${optionalString (!mesh.security.enable) (vxlanAllow mesh.vni)}
        return
@@ -94,6 +98,7 @@ let
          esp=${if mesh.security.encrypt then "aes_gcm256" else "null-sha256"}
          ikev2=yes
          modecfgpull=no
+          encapsulation=${if mesh.udpEncapsulation then "yes" else "no"}
        '';
      })
    otherPeers);
--- a/nixos/modules/netboot/default.nix
+++ b/nixos/modules/netboot/default.nix
@@ -0,0 +1,223 @@
+{ lib, pkgs, config, ... }:
+let
+  inherit (lib) mkMerge mkIf mkForce genAttrs concatMapStringsSep;
+  inherit (lib.my) mkOpt' mkBoolOpt';
+
+  cfg = config.my.netboot;
+
+  tftpRoot = pkgs.linkFarm "tftp-root" [
+    {
+      name = "ipxe-x86_64.efi";
+      path = "${pkgs.ipxe}/ipxe.efi";
+    }
+  ];
+  menuFile = pkgs.runCommand "menu.ipxe" {
+    bootHost = cfg.server.host;
+  } ''
+    substituteAll ${./menu.ipxe} "$out"
+  '';
+
+  bootBuilder = pkgs.substituteAll {
+    src = ./netboot-loader-builder.py;
+    isExecutable = true;
+
+    inherit (pkgs) python3;
+    bootspecTools = pkgs.bootspec;
+    nix = config.nix.package.out;
+
+    inherit (config.system.nixos) distroName;
+    systemName = config.system.name;
+    inherit (cfg.client) configurationLimit;
+    checkMountpoints = pkgs.writeShellScript "check-mountpoints" ''
+      if ! ${pkgs.util-linuxMinimal}/bin/findmnt /boot > /dev/null; then
+        echo "/boot is not a mounted partition. Is the path configured correctly?" >&2
+        exit 1
+      fi
+    '';
+  };
+in
+{
+  options.my.netboot = with lib.types; {
+    client = {
+      enable = mkBoolOpt' false "Whether network booting should be enabled.";
+      configurationLimit = mkOpt' ints.unsigned 10 "Max generations to show in boot menu.";
+    };
+    server = {
+      enable = mkBoolOpt' false "Whether a netboot server should be enabled.";
+      ip = mkOpt' str null "IP clients should connect to via TFTP.";
+      host = mkOpt' str config.networking.fqdn "Hostname clients should connect to over HTTP / NFS.";
+      allowedPrefixes = mkOpt' (listOf str) null "Prefixes clients should be allowed to connect from (NFS).";
+      installer = {
+        storeSize = mkOpt' str "16GiB" "Total allowed writable size of store.";
+      };
+      instances = mkOpt' (listOf str) [ ] "Systems to hold boot files for.";
+    };
+  };
+
+  config = mkMerge [
+    (mkIf cfg.client.enable {
+      systemd = {
+        services = {
+          mount-boot = {
+            description = "Mount /boot";
+            after = [ "systemd-networkd-wait-online.service" ];
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+            path = with pkgs; [ gnused ldns nfs-utils ];
+            script = ''
+              get_cmdline() {
+                sed -rn "s/^.*$1=(\\S+).*\$/\\1/p" < /proc/cmdline
+              }
+
+              host="$(get_cmdline boothost)"
+              if [ -z "$host" ]; then
+                echo "boothost kernel parameter not found!" >&2
+                exit 1
+              fi
+
+              until [ -n "$(drill -Q $host)" ]; do
+                sleep 0.1
+              done
+
+              mkdir -p /boot
+              mount.nfs $host:/srv/netboot/systems/${config.system.name} /boot
+            '';
+
+            wantedBy = [ "remote-fs.target" ];
+          };
+        };
+      };
+
+      boot.supportedFilesystems.nfs = true;
+      boot.loader = {
+        grub.enable = false;
+        systemd-boot.enable = false;
+      };
+      system = {
+        build.installBootLoader = bootBuilder;
+        boot.loader.id = "ipxe-netboot";
+      };
+    })
+    (mkIf cfg.server.enable {
+      environment = {
+        etc = {
+          "netboot/menu.ipxe".source = menuFile;
+          "netboot/shell.efi".source = "${pkgs.edk2-uefi-shell}/shell.efi";
+        };
+      };
+
+      systemd = {
+        tmpfiles.settings."10-netboot" = genAttrs
+          (map (i: "/srv/netboot/systems/${i}") cfg.server.instances)
+          (p: {
+            d = {
+              user = "root";
+              group = "root";
+              mode = "0777";
+            };
+          });
+
+        services = {
+          netboot-update = {
+            description = "Update netboot images";
+            after = [ "systemd-networkd-wait-online.service" ];
+            serviceConfig.Type = "oneshot";
+            path = with pkgs; [
+              coreutils curl jq zstd gnutar
+            ];
+            script = ''
+              update_nixos() {
+                latestShort="$(curl -s https://git.nul.ie/api/v1/repos/dev/nixfiles/tags/installer \
+                             | jq -r .commit.sha | cut -c -7)"
+                if [ -f nixos-installer/tag.txt ] && [ "$(< nixos-installer/tag.txt)" = "$latestShort" ]; then
+                  echo "NixOS installer is up to date"
+                  return
+                fi
+
+                echo "Updating NixOS installer to $latestShort"
+                mkdir -p nixos-installer
+                fname="jackos-installer-netboot-$latestShort.tar.zst"
+                downloadUrl="$(curl -s https://git.nul.ie/api/v1/repos/dev/nixfiles/releases/tags/installer | \
+                               jq -r ".assets[] | select(.name == \"$fname\").browser_download_url")"
+                curl -Lo /tmp/nixos-installer-netboot.tar.zst "$downloadUrl"
+                tar -C nixos-installer --zstd -xf /tmp/nixos-installer-netboot.tar.zst
+                truncate -s "${cfg.server.installer.storeSize}" nixos-installer/rootfs.ext4
+                rm /tmp/nixos-installer-netboot.tar.zst
+                echo "$latestShort" > nixos-installer/tag.txt
+              }
+
+              mkdir -p /srv/netboot
+              cd /srv/netboot
+
+              ln -sf ${menuFile} boot.ipxe
+              ln -sf "${pkgs.edk2-uefi-shell}/shell.efi" "efi-shell-${config.nixpkgs.localSystem.linuxArch}.efi"
+              update_nixos
+            '';
+            startAt = "06:00";
+            wantedBy = [ "network-online.target" ];
+          };
+
+          nbd-server = {
+            serviceConfig = {
+              PrivateUsers = mkForce false;
+              CacheDirectory = "netboot";
+            };
+          };
+        };
+      };
+
+      services = {
+        atftpd = {
+          enable = true;
+          root = tftpRoot;
+        };
+
+        nginx = {
+          virtualHosts."${cfg.server.host}" = {
+            locations."/" = {
+              root = "/srv/netboot";
+              extraConfig = ''
+                autoindex on;
+              '';
+            };
+          };
+        };
+
+        nbd.server = {
+          enable = true;
+          extraOptions = {
+            allowlist = true;
+          };
+          exports = {
+            nixos-installer = {
+              path = "/srv/netboot/nixos-installer/rootfs.ext4";
+              extraOptions = {
+                copyonwrite = true;
+                cowdir = "/var/cache/netboot";
+                sparse_cow = true;
+              };
+            };
+          };
+        };
+
+        nfs = {
+          server = {
+            enable = true;
+            exports = ''
+              /srv/netboot/systems ${concatMapStringsSep " " (p: "${p}(rw,all_squash)") cfg.server.allowedPrefixes}
+            '';
+          };
+        };
+      };
+
+      my = {
+        tmproot.persistence.config.directories = [
+          "/srv/netboot"
+          { directory = "/var/cache/netboot"; mode = "0700"; }
+        ];
+      };
+    })
+  ];
+}
--- a/nixos/modules/netboot/menu.ipxe
+++ b/nixos/modules/netboot/menu.ipxe
@@ -0,0 +1,68 @@
+#!ipxe
+
+set server http://@bootHost@
+
+# Figure out if client is 64-bit capable
+cpuid --ext 29 && set arch x86_64 || set arch i386
+
+isset ${menu-default} || set menu-default exit
+
+:start
+menu Welcome to /dev/player0's humble iPXE boot menu
+item --gap --           Operating Systems
+iseq ${arch} x86_64 &&
+item --key n nixos      NixOS installer
+# iseq ${arch} x86_64 &&
+# item --key a archlinux Arch Linux (archiso x86_64)
+# iseq ${arch} x86_64 &&
+# item --key p alpine   Alpine Linux
+item --gap --           Other Options
+item --key e efi_shell  UEFI Shell
+item --key x xyz        netboot.xyz
+item --key c config     iPXE settings
+item --key s shell      Drop to iPXE shell
+item --key r reboot     Reboot
+item --key q exit       Exit (and continue to next boot device)
+choose --timeout 0 --default ${menu-default} selected || goto cancel
+goto ${selected}
+
+:cancel
+echo You cancelled the menu, dropping you to an iPXE shell
+
+:shell
+echo Type 'exit' to go back to the menu
+shell
+set menu-default nixos
+goto start
+
+:failed
+echo Booting failed, dropping to shell
+goto shell
+
+:reboot
+reboot
+
+:exit
+exit
+
+:config
+config
+set menu-default config
+goto start
+
+:efi_shell
+chain ${server}/efi-shell-${arch}.efi || goto failed
+
+:xyz
+chain --autofree https://boot.netboot.xyz || goto failed
+
+:nixos
+set cmdline nbd_export=nixos-installer
+chain ${server}/nixos-installer/boot.ipxe || goto failed
+
+:archlinux
+# set mirrorurl https://arch.nul.ie/
+chain ${server}/arch.ipxe || goto failed
+
+:alpine
+chain ${server}/alpine.ipxe || goto failed
--- a/nixos/modules/netboot/netboot-loader-builder.py
+++ b/nixos/modules/netboot/netboot-loader-builder.py
@@ -0,0 +1,280 @@
+#! @python3@/bin/python3 -B
+# Based on `nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py`
+import argparse
+import datetime
+import glob
+import os
+import os.path
+import shutil
+import subprocess
+import sys
+import json
+from typing import NamedTuple, Dict, List
+from dataclasses import dataclass
+
+BOOT_MOUNT_POINT = '/boot'
+STORE_DIR = 'nix'
+
+# These values will be replaced with actual values during the package build
+BOOTSPEC_TOOLS = '@bootspecTools@'
+NIX = '@nix@'
+DISTRO_NAME = '@distroName@'
+SYSTEM_NAME = '@systemName@'
+CONFIGURATION_LIMIT = int('@configurationLimit@')
+CHECK_MOUNTPOINTS = "@checkMountpoints@"
+
+@dataclass
+class BootSpec:
+  init: str
+  initrd: str
+  kernel: str
+  kernelParams: List[str]
+  label: str
+  system: str
+  toplevel: str
+  specialisations: Dict[str, 'BootSpec']
+  sortKey: str
+  initrdSecrets: str | None = None
+
+class SystemIdentifier(NamedTuple):
+  profile: str | None
+  generation: int
+  specialisation: str | None
+
+def copy_if_not_exists(source: str, dest: str) -> None:
+  if not os.path.exists(dest):
+    shutil.copyfile(source, dest)
+
+def generation_dir(profile: str | None, generation: int) -> str:
+  if profile:
+    return f'/nix/var/nix/profiles/system-profiles/{profile}-{generation}-link'
+  else:
+    return f'/nix/var/nix/profiles/system-{generation}-link'
+
+def system_dir(i: SystemIdentifier) -> str:
+  d = generation_dir(i.profile, i.generation)
+  if i.specialisation:
+    return os.path.join(d, 'specialisation', i.specialisation)
+  else:
+    return d
+
+def entry_key(i: SystemIdentifier) -> str:
+  pieces = [
+    'nixos',
+    i.profile or None,
+    'generation',
+    str(i.generation),
+    f'specialisation-{i.specialisation}' if i.specialisation else None,
+  ]
+  return '-'.join(p for p in pieces if p)
+
+def bootspec_from_json(bootspec_json: Dict) -> BootSpec:
+  specialisations = bootspec_json['org.nixos.specialisation.v1']
+  specialisations = {k: bootspec_from_json(v) for k, v in specialisations.items()}
+  systemdBootExtension = bootspec_json.get('org.nixos.systemd-boot', {})
+  sortKey = systemdBootExtension.get('sortKey', 'nixos')
+  return BootSpec(
+    **bootspec_json['org.nixos.bootspec.v1'],
+    specialisations=specialisations,
+    sortKey=sortKey
+  )
+
+bootspecs = {}
+def get_bootspec(profile: str | None, generation: int) -> BootSpec:
+  k = (profile, generation)
+  if k in bootspecs:
+    return bootspecs[k]
+
+  system_directory = system_dir(SystemIdentifier(profile, generation, None))
+  boot_json_path = os.path.realpath(f'{system_directory}/boot.json')
+  if os.path.isfile(boot_json_path):
+    boot_json_f = open(boot_json_path, 'r')
+    bootspec_json = json.load(boot_json_f)
+  else:
+    boot_json_str = subprocess.check_output([
+      f'{BOOTSPEC_TOOLS}/bin/synthesize',
+      '--version',
+      '1',
+      system_directory,
+      '/dev/stdout',
+    ],
+    universal_newlines=True)
+    bootspec_json = json.loads(boot_json_str)
+
+  bs = bootspec_from_json(bootspec_json)
+  bootspecs[k] = bs
+  return bs
+
+def copy_from_file(file: str, dry_run: bool = False) -> str:
+  store_file_path = os.path.realpath(file)
+  suffix = os.path.basename(store_file_path)
+  store_dir = os.path.basename(os.path.dirname(store_file_path))
+  dst_path = f'/{STORE_DIR}/{store_dir}-{suffix}'
+  if not dry_run:
+    copy_if_not_exists(store_file_path, f'{BOOT_MOUNT_POINT}{dst_path}')
+  return dst_path
+
+MENU_ITEM = 'item {gen_key} {title} Generation {generation} {description}'
+
+BOOT_ENTRY = ''':{gen_key}
+kernel ${{server}}/systems/{system_name}{kernel} {kernel_params} boothost=${{boothost}}
+initrd ${{server}}/systems/{system_name}{initrd}
+boot
+'''
+
+def gen_entry(i: SystemIdentifier) -> (str, str):
+  bootspec = get_bootspec(i.profile, i.generation)
+  if i.specialisation:
+    bootspec = bootspec.specialisations[i.specialisation]
+  kernel = copy_from_file(bootspec.kernel)
+  initrd = copy_from_file(bootspec.initrd)
+
+  gen_key = entry_key(i)
+  title = '{name}{profile}{specialisation}'.format(
+    name=DISTRO_NAME,
+    profile=' [' + i.profile + ']' if i.profile else '',
+    specialisation=f' ({i.specialisation})' if i.specialisation else '')
+
+  kernel_params = f'init={bootspec.init} '
+
+  kernel_params = kernel_params + ' '.join(bootspec.kernelParams)
+  build_time = int(os.path.getctime(system_dir(i)))
+  build_date = datetime.datetime.fromtimestamp(build_time).strftime('%F')
+
+  return MENU_ITEM.format(
+    gen_key=gen_key,
+    title=title,
+    description=f'{bootspec.label}, built on {build_date}',
+    generation=i.generation,
+  ), BOOT_ENTRY.format(
+    gen_key=gen_key,
+    generation=i.generation,
+    system_name=SYSTEM_NAME,
+    kernel=kernel,
+    kernel_params=kernel_params,
+    initrd=initrd,
+  )
+
+def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
+  gen_list = subprocess.check_output([
+    f'{NIX}/bin/nix-env',
+    '--list-generations',
+    '-p',
+    '/nix/var/nix/profiles/' + ('system-profiles/' + profile if profile else 'system')],
+    universal_newlines=True)
+  gen_lines = gen_list.split('\n')
+  gen_lines.pop()
+
+  configurationLimit = CONFIGURATION_LIMIT
+  configurations = [
+    SystemIdentifier(
+      profile=profile,
+      generation=int(line.split()[0]),
+      specialisation=None
+    )
+    for line in gen_lines
+  ]
+  return configurations[-configurationLimit:]
+
+def remove_old_files(gens: list[SystemIdentifier]) -> None:
+  known_paths = []
+  for gen in gens:
+    bootspec = get_bootspec(gen.profile, gen.generation)
+    known_paths.append(copy_from_file(bootspec.kernel, True))
+    known_paths.append(copy_from_file(bootspec.initrd, True))
+  for path in glob.iglob(f'{BOOT_MOUNT_POINT}/{STORE_DIR}/*'):
+    if not path in known_paths and not os.path.isdir(path):
+      os.unlink(path)
+
+def get_profiles() -> list[str]:
+  if os.path.isdir('/nix/var/nix/profiles/system-profiles/'):
+    return [x
+      for x in os.listdir('/nix/var/nix/profiles/system-profiles/')
+      if not x.endswith('-link')]
+  else:
+    return []
+
+MENU = '''#!ipxe
+# Server hostname option
+set boothost ${{66:string}}
+set server http://${{boothost}}
+
+:start
+menu {distro} boot menu
+item --gap -- Generations
+{generation_items}
+item --gap -- Other
+item --key m main Main netboot menu
+choose --timeout 5000 --default {menu_default} selected || goto cancel
+goto ${{selected}}
+
+:cancel
+shell
+goto start
+
+:error
+echo Booting failed, dropping to shell
+shell
+goto start
+
+:main
+chain ${{server}}/boot.ipxe || goto error
+'''
+
+def write_menu(gens: list[SystemIdentifier], default: SystemIdentifier) -> None:
+  gen_menu_items = []
+  gen_cmds = []
+
+  for g in gens:
+    bootspec = get_bootspec(g.profile, g.generation)
+    specialisations = [
+      SystemIdentifier(profile=g.profile, generation=g.generation, specialisation=s) for s in bootspec.specialisations]
+    for i in [g] + specialisations:
+      mi, cmds = gen_entry(i)
+      gen_menu_items.append(mi)
+      gen_cmds.append(cmds)
+
+  menu_file = f'{BOOT_MOUNT_POINT}/menu.ipxe'
+  with open(f'{menu_file}.tmp', 'w') as f:
+    f.write(MENU.format(
+      distro=DISTRO_NAME,
+      generation_items='\n'.join(gen_menu_items),
+      menu_default=entry_key(default),
+    ))
+
+    print(file=f)
+    print('\n\n'.join(gen_cmds), file=f)
+
+  os.rename(f'{menu_file}.tmp', menu_file)
+
+def install_bootloader(args: argparse.Namespace) -> None:
+  os.makedirs(f'{BOOT_MOUNT_POINT}/{STORE_DIR}', exist_ok=True)
+
+  gens = get_generations()
+  for profile in get_profiles():
+    gens += get_generations(profile)
+
+  gens = sorted(gens, key=lambda g: entry_key(g), reverse=True)
+
+  remove_old_files(gens)
+
+  for g in gens:
+    if os.path.dirname(get_bootspec(g.profile, g.generation).init) == os.path.realpath(args.default_config):
+      default = g
+      break
+  else:
+    assert False, 'No default generation found'
+
+  write_menu(gens, default)
+
+def main() -> None:
+  parser = argparse.ArgumentParser(description=f'Update {DISTRO_NAME}-related netboot files')
+  parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help=f'The default {DISTRO_NAME} config to boot')
+  args = parser.parse_args()
+
+  subprocess.check_call(CHECK_MOUNTPOINTS)
+
+  install_bootloader(args)
+
+if __name__ == '__main__':
+  main()
--- a/nixos/modules/nvme/default.nix
+++ b/nixos/modules/nvme/default.nix
@@ -6,7 +6,7 @@ let
  cfg = config.my.nvme;
  nvme-cli = pkgs.nvme-cli.override {
    libnvme = pkgs.libnvme.overrideAttrs (o: {
-      patches = o.patches ++ [ ./libnvme-hostconf.patch ];
+      patches = (if (o ? patches) then o.patches else [ ]) ++ [ ./libnvme-hostconf.patch ];
    });
  };

@@ -33,24 +33,43 @@ in
      etc = etc "";
    };

-    boot.initrd.systemd = mkIf (cfg.boot.nqn != null) {
-      contents = etc "/etc/";
-      extraBin.nvme = "${nvme-cli}/bin/nvme";
+    boot = mkIf (cfg.boot.nqn != null) {
+      initrd = {
+        availableKernelModules = [ "rdma_cm" "iw_cm" "ib_cm" "nvme_core" "nvme_rdma" ];
+        kernelModules = [ "nvme-fabrics" ];
+        systemd = {
+          contents = etc "/etc/";
+          extraBin = with pkgs; {
+            dmesg = "${util-linux}/bin/dmesg";
+            ip = "${iproute2}/bin/ip";
+            nvme = "${nvme-cli}/bin/nvme";
+          };
+          extraConfig = ''
+            DefaultTimeoutStartSec=20
+            DefaultDeviceTimeoutSec=20
+          '';

-      services.connect-nvme = {
-        description = "Connect NVMe-oF";
-        before = [ "initrd-root-device.target" ];
-        after = [ "systemd-networkd-wait-online.service" ];
-        requires = [ "systemd-networkd-wait-online.service" ];
+          network = {
+            enable = true;
+            wait-online.enable = true;
+          };

-        serviceConfig = {
-          Type = "oneshot";
-          ExecStart = "${nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn}";
-          Restart = "on-failure";
-          RestartSec = 10;
+          services.connect-nvme = {
+            description = "Connect NVMe-oF";
+            before = [ "initrd-root-device.target" ];
+            after = [ "systemd-networkd-wait-online.service" ];
+            requires = [ "systemd-networkd-wait-online.service" ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              ExecStart = "${nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn}";
+              Restart = "on-failure";
+              RestartSec = 10;
+            };
+
+            wantedBy = [ "initrd-root-device.target" ];
+          };
        };
-
-        wantedBy = [ "initrd-root-device.target" ];
      };
    };
  };
--- a/nixos/modules/tmproot.nix
+++ b/nixos/modules/tmproot.nix
@@ -2,7 +2,7 @@
 let
  inherit (lib)
    optionalString concatStringsSep concatMap concatMapStringsSep mkIf mkDefault mkMerge mkForce mkVMOverride
-    mkAliasDefinitions;
+    mkAliasDefinitions mapAttrsToList filterAttrs;
  inherit (lib.my) mkOpt' mkBoolOpt' mkVMOverride';

  cfg = config.my.tmproot;
@@ -492,6 +492,37 @@ in
          }
        ];
      })
+      (mkIf config.services.wastebin.enable {
+        my.tmproot.persistence.config.directories = [ "/var/lib/private/wastebin" ];
+      })
+      (mkIf config.services.photoprism.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = config.services.photoprism.storagePath;
+            mode = "0750";
+            user = "photoprism";
+            group = "photoprism";
+          }
+        ];
+      })
+      (mkIf config.services.mautrix-whatsapp.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/mautrix-whatsapp";
+            mode = "0750";
+            user = "mautrix-whatsapp";
+            group = "mautrix-whatsapp";
+          }
+        ];
+      })
+      {
+        my.tmproot.persistence.config.directories = mapAttrsToList (n: i: {
+          directory = "/var/lib/${i.dataDir}";
+          mode = "0750";
+          user = "mautrix-meta-${n}";
+          group = "mautrix-meta";
+        }) (filterAttrs (_: i: i.enable) config.services.mautrix-meta.instances);
+      }
    ]))
  ]);

--- a/pkgs/chocolate-doom2xx/default.nix
+++ b/pkgs/chocolate-doom2xx/default.nix
@@ -0,0 +1,49 @@
+{ lib, stdenv, autoreconfHook, pkg-config, SDL, SDL_mixer, SDL_net
+, fetchFromGitHub, fetchpatch, python3 }:
+
+stdenv.mkDerivation rec {
+  pname = "chocolate-doom";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "chocolate-doom";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "sha256-1uw/1CYKBvDNgT5XxRBY24Evt3f4Y6YQ6bScU+KNHgM=";
+  };
+
+  patches = [
+    # Pull upstream patch to fix build against gcc-10:
+    #   https://github.com/chocolate-doom/chocolate-doom/pull/1257
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/chocolate-doom/chocolate-doom/commit/a8fd4b1f563d24d4296c3e8225c8404e2724d4c2.patch";
+      sha256 = "1dmbygn952sy5n8qqp0asg11pmygwgygl17lrj7i0fxa0nrhixhj";
+    })
+    ./demoloopi.patch
+  ];
+
+  outputs = [ "out" "man" ];
+
+  postPatch = ''
+    patchShebangs --build man/{simplecpp,docgen}
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    # for documentation
+    python3
+  ];
+  buildInputs = [ (SDL.override { cacaSupport = true; }) SDL_mixer SDL_net ];
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "http://chocolate-doom.org/";
+    description = "A Doom source port that accurately reproduces the experience of Doom as it was played in the 1990s";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    hydraPlatforms = lib.platforms.linux; # darwin times out
+    maintainers = with lib.maintainers; [ ];
+  };
+}
--- a/pkgs/chocolate-doom2xx/demoloopi.patch
+++ b/pkgs/chocolate-doom2xx/demoloopi.patch
@@ -0,0 +1,91 @@
+diff --git a/src/doom/d_main.c b/src/doom/d_main.c
+index 65a39a10..3f799b0f 100644
+--- a/src/doom/d_main.c
+++ b/src/doom/d_main.c
+@@ -483,6 +483,8 @@ void D_DoomLoop (void)
+ //  DEMO LOOP
+ //
+ int             demosequence;
+int             demoloopi;
+char            demoloopname[9];
+ int             pagetic;
+ char                    *pagename;
+ 
+@@ -524,6 +526,8 @@ void D_AdvanceDemo (void)
+ //
+ void D_DoAdvanceDemo (void)
+ {
+    int havedemo4;
+
+     players[consoleplayer].playerstate = PST_LIVE;  // not reborn
+     advancedemo = false;
+     usergame = false;               // no save / end game here
+@@ -539,10 +543,14 @@ void D_DoAdvanceDemo (void)
+     // However! There is an alternate version of Final Doom that
+     // includes a fixed executable.
+ 
+-    if (gameversion == exe_ultimate || gameversion == exe_final)
+    havedemo4 = gameversion == exe_ultimate || gameversion == exe_final;
+    if (havedemo4)
+       demosequence = (demosequence+1)%7;
+     else
+       demosequence = (demosequence+1)%6;
+
+    if (demoloopi < 0 || demoloopi > (havedemo4 ? 3 : 2))
+      I_Error("Invalid demo loop start %d", demoloopi);
+     
+     switch (demosequence)
+     {
+@@ -558,17 +566,11 @@ void D_DoAdvanceDemo (void)
+ 	else
+ 	  S_StartMusic (mus_intro);
+ 	break;
+-      case 1:
+-	G_DeferedPlayDemo(DEH_String("demo1"));
+-	break;
+       case 2:
+ 	pagetic = 200;
+ 	gamestate = GS_DEMOSCREEN;
+ 	pagename = DEH_String("CREDIT");
+ 	break;
+-      case 3:
+-	G_DeferedPlayDemo(DEH_String("demo2"));
+-	break;
+       case 4:
+ 	gamestate = GS_DEMOSCREEN;
+ 	if ( gamemode == commercial)
+@@ -587,12 +589,14 @@ void D_DoAdvanceDemo (void)
+ 	      pagename = DEH_String("HELP2");
+ 	}
+ 	break;
+      case 1:
+      case 3:
+       case 5:
+-	G_DeferedPlayDemo(DEH_String("demo3"));
+-	break;
+         // THE DEFINITIVE DOOM Special Edition demo
+       case 6:
+-	G_DeferedPlayDemo(DEH_String("demo4"));
+	DEH_snprintf(demoloopname, 9, "demo%d", demoloopi + 1);
+	G_DeferedPlayDemo(demoloopname);
+	demoloopi = (demoloopi+1) % (havedemo4 ? 4 : 3);
+ 	break;
+     }
+ 
+@@ -1891,7 +1895,15 @@ void D_DoomMain (void)
+ 	G_TimeDemo (demolumpname);
+ 	D_DoomLoop ();  // never returns
+     }
+-	
+
+    p = M_CheckParmWithArgs("-demoloopi", 1);
+    if (p)
+    {
+        demoloopi = atoi(myargv[p+1]);
+    } else {
+        demoloopi = 0;
+    }
+
+     if (startloadgame >= 0)
+     {
+         M_StringCopy(file, P_SaveGameFile(startloadgame), sizeof(file));
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -8,4 +8,9 @@ in
  vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
  librespeed-go = callPackage ./librespeed-go.nix { };
  modrinth-app = callPackage ./modrinth-app { };
+  glfw-minecraft = callPackage ./glfw-minecraft { };
+  chocolate-doom2xx = callPackage ./chocolate-doom2xx { };
+  windowtolayer = callPackage ./windowtolayer.nix { };
+  swaylock-plugin = callPackage ./swaylock-plugin.nix { };
+  terminaltexteffects = callPackage ./terminaltexteffects.nix { };
 }
--- a/pkgs/glfw-minecraft/default.nix
+++ b/pkgs/glfw-minecraft/default.nix
@@ -0,0 +1,6 @@
+{ lib, glfw-wayland-minecraft, ... }:
+glfw-wayland-minecraft.overrideAttrs (o: {
+  patches = [
+    ./suppress-wayland-errors.patch
+  ];
+})
--- a/pkgs/glfw-minecraft/suppress-wayland-errors.patch
+++ b/pkgs/glfw-minecraft/suppress-wayland-errors.patch
@@ -0,0 +1,43 @@
+diff --git a/src/wl_window.c b/src/wl_window.c
+index 7c509896..db9a6451 100644
+--- a/src/wl_window.c
+++ b/src/wl_window.c
+@@ -2115,25 +2115,21 @@ void _glfwSetWindowTitleWayland(_GLFWwindow* window, const char* title)
+ void _glfwSetWindowIconWayland(_GLFWwindow* window,
+                                int count, const GLFWimage* images)
+ {
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the window icon");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window icon\n");
+ }
+ 
+ void _glfwGetWindowPosWayland(_GLFWwindow* window, int* xpos, int* ypos)
+ {
+     // A Wayland client is not aware of its position, so just warn and leave it
+     // as (0, 0)
+-
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not provide the window position");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not provide the window position\n");
+ }
+ 
+ void _glfwSetWindowPosWayland(_GLFWwindow* window, int xpos, int ypos)
+ {
+     // A Wayland client can not set its position, so just warn
+ 
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the window position");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window position\n");
+ }
+ 
+ void _glfwGetWindowSizeWayland(_GLFWwindow* window, int* width, int* height)
+@@ -2359,8 +2355,7 @@ void _glfwRequestWindowAttentionWayland(_GLFWwindow* window)
+ 
+ void _glfwFocusWindowWayland(_GLFWwindow* window)
+ {
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the input focus");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the input focus\n");
+ }
+ 
+ void _glfwSetWindowMonitorWayland(_GLFWwindow* window,
--- a/pkgs/modrinth-app/default.nix
+++ b/pkgs/modrinth-app/default.nix
@@ -81,7 +81,7 @@ rustPlatform.buildRustPackage rec {

    dontFixup = true;
    outputHashMode = "recursive";
-    outputHash = "sha256-9HtTdIotG3sNIlWhd76v7Ia6P69ufp/FFqZfINXSkVc=";
+    outputHash = "sha256-Txttk8qZpDsAuiF8laKbZss/KEoT1Z+oepbj2s4XjE8=";
  };

  preBuild = ''
--- a/pkgs/swaylock-plugin.nix
+++ b/pkgs/swaylock-plugin.nix
@@ -0,0 +1,41 @@
+{ lib, stdenv, fetchFromGitHub, fetchpatch
+, meson, ninja, pkg-config, scdoc, wayland-scanner
+, wayland, wayland-protocols, libxkbcommon, cairo, gdk-pixbuf, pam
+}:
+
+stdenv.mkDerivation rec {
+  pname = "swaylock-plugin";
+  version = "1dd15b6";
+
+  src = fetchFromGitHub {
+    owner = "mstoeckl";
+    repo = pname;
+    rev = "1dd15b6ecbe91be7a3dc4a0fa9514fb166fb2e07";
+    hash = "sha256-xWyDDT8sXAL58HtA9ifzCenKMmOZquzXZaz3ttGGJuY=";
+  };
+
+  strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
+  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
+  buildInputs = [ wayland wayland-protocols libxkbcommon cairo gdk-pixbuf pam ];
+
+  mesonFlags = [
+    "-Dpam=enabled" "-Dgdk-pixbuf=enabled" "-Dman-pages=enabled"
+  ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-maybe-uninitialized";
+
+  meta = with lib; {
+    description = "Screen locker for Wayland -- fork with background plugin support";
+    longDescription = ''
+      Fork of swaylock, a screen locking utility for Wayland compositors.
+      With swaylock-plugin, you can for your lockscreen background display
+      the animated output from any wallpaper program that implements the
+      wlr-layer-shell-unstable-v1 protocol.
+    '';
+    inherit (src.meta) homepage;
+    mainProgram = "swaylock";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ devplayer0 ];
+  };
+}
--- a/pkgs/terminaltexteffects.nix
+++ b/pkgs/terminaltexteffects.nix
@@ -0,0 +1,19 @@
+{ lib
+, python3Packages
+, fetchPypi
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "terminaltexteffects";
+  version = "0.10.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-NyWPfdgLeXAxKPJOzB7j4aT+zjrURN59CGcv0Vt99y0=";
+  };
+
+  build-system = with python3Packages; [
+    poetry-core
+  ];
+}
--- a/pkgs/windowtolayer.nix
+++ b/pkgs/windowtolayer.nix
@@ -0,0 +1,18 @@
+{ lib
+, fetchFromGitLab
+, rustPlatform
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "windowtolayer";
+  version = "a5b89c3c";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mstoeckl";
+    repo = pname;
+    rev = "a5b89c3c047297fd574932860a6c89e9ea02ba5d";
+    hash = "sha256-rssL2XkbTqUvJqfUFhzULeE4/VBzjeBC5iZWSJ8MJ+M=";
+  };
+
+  cargoHash = "sha256-XHmLsx9qdjlBz4xJFFiO24bR9CMw1o5368K+YMpMIBA=";
+}
--- a/secrets/britway/bgp-password-vultr.conf.age
+++ b/secrets/britway/bgp-password-vultr.conf.age
@@ -1,10 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBJYzdr
-b1d2aEtVd3lVb3NBamRwVFpTaTRjZFlCczk4MVIwQUoxWklwN0NrCmFFekpPYUlO
-YlgvVlQ2WDR6amZDN0ZSY0Q3WWtTME5pUmhQeks1c3dGOVUKLT4gWDI1NTE5IHVK
-bUZvUVAvL0NmQzFkY3BuYm1wMjcwbFpLRUNpZjJCaW15SEVDUDV0REkKRXFMQ2d1
-NlFBejBvTlJrcUtCYWZxSDBkbmxIdExBNTU0aC8zRW5OVWllVQotPiBDLWdyZWFz
-ZSBkeC4oTFUgO0FtJG9+RyB2IF1QXGhxVwpJS213MXBRMWY1cXlHZwotLS0gRUF2
-ZkswNlhvcDhTc2tybCs1dldwa2l6SDZZVmNkNUNjNGlkV1ZVa09pOAp88dxHGxVU
-vuFQO6JcroY9MF5Te/YV+wMc3hVxksibMnH1TWGh207prwcOWNOEz2iEkZY=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBoNHhS
+YS81MkpQR2w0ZWNQS1BXMDF1Ry9RNm5heVhYc1haMUx4YWFaUFFrCnJUM2lGdkty
+enNFQVhRSzRONzVjVEZwdHR1K0FCV0N1UHhrd1VTQVZkc3MKLT4gWDI1NTE5IFRS
+ZlAxV1ROLzhNcnNhQ1NRaFQ3VnlkRkFFSXg0UjlrUnFuejRlSFVrQ28KSUNYbndD
+T0tSWGFYT29WeW9CcTlybU9pWlZyVGw1eG5QVHBGZFFuKzlzdwotPiB3YnJOZi1n
+cmVhc2UKVW5EVFowdUJHa3R6MjgvS2FFL283K0h2b1VzVGhkSnFPL25FMndvZnVv
+OW5tVXluQXMzSDRIR2UzbnBYTWJQQgpUN1lqYi9Pd0JFajZ3RjhhWm16NlVnbwot
+LS0gZlVpbm8ydWZ5MGp1aTZUY242NlBuTlF6U1BzUSszVTdTYnNWRStTOEtEawoq
+gb0uEspmy6YU+mtaHJAEBKsAYKg5g8pR2GIy50C0HcVn9d19p1p5yA+7yzzVx07p
+Kdk=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/britway/cloudflare-credentials.conf.age
+++ b/secrets/britway/cloudflare-credentials.conf.age
@@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBLVlg2
-ZUdtUlFUQXBLT3B5YmkycWJnMXJyKzltbyt6K2dJK1RBUm5ydWwwCmRUdjJFSEYz
-Wnp4cGtzTXZwc0s0SUJQUjRlOUJlQUoyQ3BETXZmY0ppWG8KLT4gWDI1NTE5IGR5
-QUJzeG1DQTRLUmRwNnNSRUJRSFFtUDl5VjB0clVLYUp3R1g4TEVKaTgKb09tVlhF
-R0tmcmIxMHVHcG80RGxRTEhBcngvT3MrdnNPbmpCTlRyZW5xQQotPiA6RzEtZ3Jl
-YXNlCldSUlN2ejB0MGpyUHYzNS9OQmJTK3MvcXRDakdBVlhuUEt6SFE4QmhnWVN0
-V1JMOE1oaEp5QQotLS0gYW1OMTcxNWJrUndmR2h0ZmRDWk5CYnJjc29pSERUMnNk
-d2VhTGdpOW4yUQrEeH2E9m0YycuW60QrdlRetO1kNU5FaKXRQt46iA9lACIWD4rC
-Cx6WxhCBgz3hvm9x6iuYiiQxZzgJNK7qXcV2MBeQdivazeEbC7blAKVPhwD/dl+b
-PzBDXRXG3c3jMjeZFT69fIBGJfZrrLGKpTALVE4dTVXmQmVVQDTp19IC+jUXHBti
-Pj6Dpc7452s8zPkzZyRbasO9b4PYTwq8IHT6X7ITwbzZZm8gexDYe2SzRZ5VcPz3
-El+yoULZ92WbXPSQIP/Slx4BEZjmsQS+sm0N8AnBRNZkWVbHPF9IZRg3VjDAn2i8
-F3un5js=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAvWHc4
+a1ZnYktVT0dIMDVocVQxU1Y3bmQwckVnbDBZSGhqRnhrUm9yTGxnCnZmcGMwSjJG
+ZUdzdFR5Z0dUZUo5aVVydHpHbVVQZVVSNm9MT1YzbGEzamsKLT4gWDI1NTE5IG5l
+RGF0RzNKR1JsVlZWRmFGMjlwelJTYU9DMVM2WEJMc0R0YVBYSnJxbUkKNE5JRnQx
+UG9UcG0rZ2NLTDhid25mbzBoa1J3RFQzSmpzWDZCcURCaVZXWQotPiBHaC1ncmVh
+c2UgUjlqLUoga1AKNFlKZ3IyYnVSY2twUzVRdWxHRE1sT2Z5bit3bys4VXFORXBN
+Si9za0h3MjhpUkNvemROMDRnCi0tLSA1eFA4N1hVOGNZb25OZUZMWUthRFJoU3F2
+UmlqcHJ6S3ZCeE9zT0dXSUJrCs5Hb+UODXrBeIwr9agp/YwEEq21M5x8kQ5YDihQ
+zvH7cIRMq8wx9hDQtij0O/hg1PMLw6F5XG17t9HS3yIqP+JRUw40QYPfeRIXlf2g
+ua/QHrqcN5f3Nv69rFvyDd9khEa/Rwm+m0pVdTJVp1uNkla90h7nRpGxCzQ4tiBZ
+IWPELBTR3bVSW2hL3Uwzf1YX3w4KUBidujZLHVGd+BQY6DXeVjjESgbxqIqqDIqU
+fQnx2mp2gJMLS/yWUvLyvUI54t6DUV4livFOu9m5p41n+vsXuF4ACEP8KcCqjV3U
+hCFgJMossidwKV9Cfg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/britway/oidc-secret.txt.age
+++ b/secrets/britway/oidc-secret.txt.age
@@ -1,13 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAyMWox
-cEFDWWUrVzJSM1o2azJqei9HV2xFY25oQXV5SzM3akxEaUJiN1J3CjkrQVhjWHY5
-Uk01eGp5Q0RKNVREVXJVZytndTM0SXNZSGIvUVp1TnRiNXMKLT4gWDI1NTE5IFZn
-WjAyR1RMajEyMnFSYnNGT2EyekROVWNoakFJQVZxaFc0YThOMHVyanMKWldrdlAv
-cVg0OTFHL2loeGJ3RHA0MnlnckN3czF4RUgyc1NjYXVOSXF5cwotPiBvTFQtZ3Jl
-YXNlIDRsSDp6eikgT1ojIGEzOFZMIFc3MUZGCkttZ3ZLNGxucnlJc01kRXFZTGpC
-eCsvRzl5WnFUMUIyTWNVWGk4SjQyN3V0bXQ4VzFuM1RjSzVMcDJkaW1JYXMKQkE4
-YWI1Mmg3MkpjdVpVYWJkczJQMnM1SVMvNkZhOXBDVEZPCi0tLSB3SVIyU3M5RHBE
-VFRtMFU4OUFLbkNjbkJmVmhlc2VsYzdsd0pFaFkrUmkwCs+h2KlXoyZ8U++A9wmV
-kh4N2YyI/a84yPGDNoFdSlXaU8jxUzolnadImXSXyB4CroqQLvGEbkZZlWqPLVfh
-Iav7Ja8=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBlZTVp
+eFhBR0hOSkN6RW9Lc1lCUUNTc2t2MkRSVmplV2xkK016U051ZkE4CktQSlBlRDI2
+ZVNRVVU0azNjVnBQRmVqeVQrREI0amlWYlhhbEVKOWdkRkEKLT4gWDI1NTE5IGV0
+UXcvWjg0YVJCN0pGeXR4cnQ2VmdvMWRqSmpsZ08vUkFVejRHQStCUWcKZkpLM3Uv
+RXA1dGdTRms3L0FrM3piRzU2bTRaczRlL0hydERMUGxFOGNCWQotPiBTLWdyZWFz
+ZSBINl4gJ1xACnM0Mzk1MGF2Ci0tLSBtYzJJQUZwMkVSaWxlZ0VMRHh5U09jNGZ6
+YVEwc0tkNlZBRmNucEV3d29FCvd8zYn+WWCKfaO/eJZgTOzGK6VGrK7HMnmRRGbp
+SmD48NagOvcls7+w6XKJfjjgLqrr+4QIuMEZOwbjwDwUXZAE1EY=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/doublepuppet.yaml.age
+++ b/secrets/chatterbox/doublepuppet.yaml.age
@@ -0,0 +1,33 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB0b3pq
+Q1hPakI5WkdMYkFWWWZQN0RVTTluMlY4cnZONG54cGJvUkNkamdrCjV0elB4T3Rw
+TU5FeTU0ZS9idmIyWHhyN2Z0Smx1TmRJbXJyaDlWb1NxaGsKLT4gWDI1NTE5IGhx
+am14VjRuLytLb2VHQXp4NGorUERaSWRXQ2NuMXcwbDBwUEhvUXA0bncKbTNyaGpo
+TkZSUzdpcHNvR3YwQ1NMbjRuZ0RmVzU0YjdTR2l0RHFhN3dVYwotPiBgLWdyZWFz
+ZSByMyJ0IEE7NEViXHhHIHxnMk99IFM7ZwpVRWFlbTBvYXI0M0ROZmlFZ2x2MUw1
+QThUb3FqalZ2Qys1bXdwek5yMmdJSUI1bjVQN0JLb2F3U2NWUzlZUHFzCldoWmt2
+MVhta3hocWhGbDQ2UmdvNStLaVQwWVI4Q0M3V3hlTzhXaGRGV25kU3NwZ3Zra0ZN
+OVY0Zlk4M09LdHAKCi0tLSBiUEZyRkhKU0h0NVV2SENZczMzZWVJeUZncnJHcHNO
+VXVjY1ZyR0l5OUlvCuU6ngVGt/cxi5/ky5PPV1UvRBR4D13wCLhDtc/uDmG/fHeR
+tVl+u4aeOHYm/K1sCRWCFGXzrF5Wo2CBVNP8NzDtgSBATwgLSyIhRe9r6MH/Pmlp
+pYDZ23/pLeylzkLmKu9g1Wo6j2Y78k6ec57epj/uwBRtMVRLNk67UmQ7b72wwsIh
+0hxLQBPTJsjymkJLSJ21KkTkr++PIeyBL5yWAXpx6OErL5JiZGfXFfd7QFq3DCo4
+FY5CrCT63xqzA2bBA8TtgJA6XfEpUyVSOB8t0CnyY2/SOdHK6ZHKwam53/ieHtPQ
+HBJHCYex/hSeugJ+OtdK2qF2/pXTPXcgL4p5vzMBf2xuSwoaBmPX1wvrDT17PrcD
+3lHGyQ48crEfalMFt/AXjJI1EjLj6N7YMvCXiw3h3m0o06402KQySt9euuYkvLnd
+JCg3qFbJeyOks7NQLvtVr7B/9A0ksaOLRoLzWIqZ9uS1XneeS2HS3V7MA3gf+1Mb
+rhDl51svwZcYKy2mUjX4BqR9s/zuFfW+4EmyJ/TyVuAxDRvty0QmKlREE7bHejEp
+xeX0qhhs/87gURpZaHu+pZyeofRB2FyUQy5UF6GnCzQMw702ZnQhGcNAfN1ioIYa
+VnLqVg8OtUUvatZgPywpW+RwjlBkvOGgWBElmCtdJNU9rmPUq/GZwyFuBf9BgIis
+UEdA5R3Kt7W+4HL0oLNtL+hXX5g2/8iSyuYgmZ2WMdRJHyY4TDYQ5hL4iL+53ea
+O1CIlNNIsUJdNHx5IjyO7gfFt0UiQEtKmJgPBrKMTeVAipbZG+3pW6yi2WvezswJ
+R/6hNR+t6CR45wu3z9rSv6S72HvP8QChxrtLo0A0oOnFx34ioRxhfv00tG0GEPCn
+smPo/Obp6VGr+5clwqQFzlKz4KgMI8NIWDRDTJBZ6Pl08ut3Nz/mW6aUQxkcAovM
+7KF88iBHT46FOeGEZmCjQZNTNLfeO8cM6SM71y/k882+Zy155G+DsHKHx7+NtiDf
+mIYqX1mexeTIEDfDlIiJX5xvgHewXUch+PQZYW8Cm7A2oJESuPLwqoY18+r0u7d
+OYAf37G0cXB4vtngtrShgfbqda4f0s9o2Y06Ovb3wkegLIb8eTGN8pLU40rbprVG
+UNctWsA1VXd8Un7Dzq2JZHN94wvf2lcYJc9Lw/Dy3VIntyAg0sKkWqEgwKnQM1s8
+s8vxFyEeCacQWIX44r6/XeOlyzIsKOTEpmJpCkC52BGiMwv7nvMpD9cmYnn6wFGt
+XerPeB1lQiV0p/GYxuby/rlpl3eYbw7GL55CrlvLQK1YuEaT/ORKRRb0gFubrTSM
+eDja9oZ5
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/mautrix-instagram.env.age
+++ b/secrets/chatterbox/mautrix-instagram.env.age
@@ -0,0 +1,14 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBiUm9p
+OEMzMElsQmhJdk5yRkYzUFoyTldxU0FrVDk2b2NoK01rQ05Md1RNClFQM0VrTFBk
+WGtMUU8yR3prN3NpR254ZFRNSjNQYTRwanNrQzN0ek80bUEKLT4gWDI1NTE5IEJx
+WXZwWlZ4dFRMTEZCZ0JTNHFSWms5Zm4vSzdjRFhBSHJqeXhDMDBIVW8KU1VaNTc0
+bHFtMGxab0N3L1IySHlaM0RwQWM2Mm10cDFEaW1UdmFMTUVHTQotPiBiY1VjUnd+
+RS1ncmVhc2UKSmtJS3QwS09HaUtUN2g1VGY2Wk9Pemx3RTdBOEV4K281bFZqCi0t
+LSBhZUxiOUVyVGJEdkp1Mk9uaFNzSEozQ05DdFpqdkN1ZFgvRzFMeFd0R3Z3CllO
+0SHrUFQNV/oKtgY9bEZ60IdlJclVst2wNfpc3z96aSMQRO2kN0ehGNR3YDg28B5f
+fccsUh1/PAkasRCqiVjKvrzWlTyIWIV5XdXN1XfO5Ny9I/LldKRDCIbNnFu4IWqg
+k22RerhY8+6BzPszQI61tu84URwMgTSM9y0jGhdn8WFf39FgIOM9L0Hi+a0V7f72
+zw54+vbACUdNuXH/D3R5h/xLwaO1cyEzeJVXtdC6VkT+XcotAcMUU1b0FcQMYB5k
+R/d31u/SeXqjFrGiTaj10TjCMZ0kz9jLBkLPPhPBSw==
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/mautrix-messenger.env.age
+++ b/secrets/chatterbox/mautrix-messenger.env.age
@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBubFN5
+MHRvVCtqYWxtNzJrM3dBVDJPWUc0anloV0tTZlhwUEh3SExVQmxVCkxiQSthaExG
+Z0VrV3NOTHpzNkx4eDVKWGpYdEVxMWhuTTcwa0ttL3dsQ2cKLT4gWDI1NTE5IHEy
+OWl6MzNqZGdkN21BVFdQR3JHdmxRSnFPNXFhaklDVWZzWnJ0QXo3a0UKZGlHbk1G
+TlRCK2h5VGZJd2E5YWlhLzcvcy9nSVorbk5KR2NTeE0rclJzZwotPiB8PylGLWdy
+ZWFzZQo4R3J1MHdZbVNMZWZFNWNuOVN3QkN0SFVjbFoydWN0STJUTUk1N21ldDZF
+MnhGMFExMnlFQWNLVVdQMVFDVG1mCkdEQmYvVkxDQzR5dUpDQzNnUm1yK3ZEK0p6
+dkZsVmJTVEpURitRCi0tLSBnWXhmUjJjbXBNTndSN056QUJiY3pabUhoc21mZUY5
+aVBmZVE5ZU5SaU5FCkdH2p99e4weWPUnqNPlxBKs0CD8wS7iCgOD/FtWaToTMNlU
+7jSQZhXr+s4Sq4B3WG3CIT0Imyf3toEoxuLBv7iMR/pGi+bC+ygwxwTxC8rOmN8w
+NGK3PzKVrr/XPDFmwfpkHdgPVWQYvy02FkS314wu2bsQEcUn7bpZdztmBzrJRl6b
+3C7CEop0UptyQgMOD0UkulFXHyEvFAShoGKJnO1PUDSLq1gLCooNLJ/kdkme1bzW
+UjLW3pz30kVXorL0vhSucteMjnc5WnX/KOiCqStVKN8QhFkPjEbxF5DRNRTsYzYr
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/mautrix-whatsapp.env.age
+++ b/secrets/chatterbox/mautrix-whatsapp.env.age
@@ -0,0 +1,16 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USAzQldO
+U0NtR3lZaGg3Wk1sUFZFL2VBQnV0c0t5V3VRd08vSGZVUzRyaVRzCm1ud0lvQkU1
+TmQ4cmNaNDYxU1BmeERNRURnL1VtTUthMi9oQWk4Wmh1amcKLT4gWDI1NTE5IEwv
+c1ZlOUdRSGFRSnNTMklVR0pSNWl1cm1nSVAvRTYzQXdqM3JZM2RsUkkKUmFjcG5j
+OTVwSlFyZnNxTy9rMC9LZTJUU2VQbW41bWJGQlVGbVpqbFNWUQotPiApKy1ncmVh
+c2UgSiBOIGxWYS4Kc0lrN2ZVdmhEaFoyNjZzWE1nVUU0V01iSWh1ZkdmcmE2YkJ0
+ZmNHQWFDNE1LTkVOM1lZYXFpTFROL0gvNXhQKwo0WDhlWDNzbmpGcS95Y3Fadlo5
+bnlieUYrUWVFcnpEbGpBTHJWRWcKLS0tIGZOajhoYmczc0VDVGVheU9GWXFOVWJY
+ZXVPb01lMThoWWpjcjJJQUYrdzQKu7TpvAxtz0QAGw3UI+IOq7uHo2dHuvL7i9GB
+9PET2JogH7Ay3g0asUmqJhFGrRRDK9P2KOX9ONHOcAatOt4IsGT3Jgsm2Zm1uGOJ
+1dC0vj0vNCbRMhidE0Bi7SRalh3RSyidiTwWZqDevTsnPHjMeJSUQ7Mav8l4BvcZ
+JLUwhfnTb577uGO1x8xiSTaeJ5AIM7DaVHcI0OuTJ+nQfkIUNL4eVtgPvxFzxp47
+fFvupVShi5/nOoPxGLN2Iadi8zvu6Fyo3R5dSHA76J8UPJ0cq4PWo83JbveaNPHM
+427s+94ShVU=
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/nul.ie.signing.key.age
+++ b/secrets/chatterbox/nul.ie.signing.key.age
@@ -1,13 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB2WFY2
-MzFnVFYvb0wzc3grRDBrUi9teW1tNmx5dVBIRVc5OUdlcjdvTDJFCmpJL2tlYXND
-bVJKbzd2S3JkSFVMdG40MS84V0lPTVJSNHVBQlNXSkN1eTAKLT4gWDI1NTE5IFBM
-ZGo3L2VlNUZqOEE1UHBuMHdqc1pyYlQ3R29ucE9pajU0bHMzamlXRDAKcG1Qdmw2
-cUlncDFWNXBOWnpIeDNZSFA3d1E1bjNaVVpKU3lMRjRaSHNtMAotPiB2XUh8eF4t
-Z3JlYXNlICUrO0cxIH4gaTRoIF81SEpTN0Q5CnpWdEZpb1hZa2t5YkE5RnJFMHVZ
-WkhkQ2o0eWtyOE9ueDJkeGd2aUhmLzRUUGs1aUc1NURIOTYxczZhOEVmT0EKd2xk
-TXFHN051d25PQmtNUVZkVEFGUVliZjdmZDF3RWFkaEhNTzd3ZVd5N3dlNzQKLS0t
-IGZDR1Mxd24zOW05bitzQnN5WWVOOGtCNEc5aXIraEF4eXFUQm5CZUdCV2MKd44C
-/Trgg0OEZ89/jqbj56z/Hia1Ka3ZsEv6bXPI/kcRvFDBFTgtvG3KWCgMBtTUHXzY
-TKBPoQqrUf7plH7a/mTx3KR+4Y+yF+1i86s7TzYjD8d1xfFH3BsVtg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBYZ0o2
+STVhRGNoMUYyaTZkMmFIRXQwNUZveS85ZXY2Wmhyb2U4aEZUZWlFCnBzc1l1dTcz
+cER1Tnh5TGlLeG5IcEMzNEhGSVVrV3JTdEs4ajBkUEtIc2MKLT4gWDI1NTE5IHNn
+Skw0enFTakE3Ly90NThlcm84RitDWDl1RURTSlIveWE5TzlqTU1CelUKLzlMTCtP
+QWtlU2E0dm1QV2NHSndVNnpUbEVDR3V1OVpBdGpqbTMwQnJxVQotPiAoRC1ncmVh
+c2UgJz9yb3opClYyMTVUWEFnSityRi9nCi0tLSAvOVpZWGJjQWtweVkrUmFVYy9Z
+Z3lXeTh4VGliUk95WDFzL0R2ZC80NWZZCjzgQLewxLJ/OxteyXXioIMfjbXlKiZ9
+0YZo/t4HWWRfqIruSWaPkXEiT7knXRAFPkec5vOHOk/MlRZqAVUf8edvFHYh1JWs
+iiog8wGk0fJ6qNqMSYJKwGTUvfM=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/synapse.yaml.age
+++ b/secrets/chatterbox/synapse.yaml.age
@@ -1,30 +1,28 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBuQjBY
-K1ZTUzR0SmFoYUZLdzUzNUt2M1B4RFdPZzFkcW8rMWJLUjVHOUN3Cjd3ZHdMSzdp
-OWswditVWUhYNjZCdjV6M1d6U3pNak5hUlZjTHNqSkZPSk0KLT4gWDI1NTE5IGNG
-ZytHazJQWTExMjNkZWV2aDUwcnZjUGcwcXRkZWl0M0F2R2JpUVlJekUKWTFlbkEz
-YlN6dkgrMmFFcmlZMjQ0b2oySjlEMC85cUF5QlA4NGF3blBKRQotPiA8M1hbWS1n
-cmVhc2UgOmlZJFYmJgo3UExzUHhSVi9lbVRjNW4xTnVaUTVGSGVDNzRUNlJ2TnVu
-U0wrWU5kd3dyR2phcUNVUHJCYjdzeWhjNVFOV011CmZMOVN0WDk5eUg3ajhwbStQ
-aHExT0EwblpreTBXVHh6Zk1HRkhzcmFQNnoyVUlaeStMUkgKLS0tIG1aY3Zadko3
-V3pDMGswSDZCeit4SVhSRCsrZVRVZVkvQkNsQWN1MXFMUGcKcK74YULWqWw9VvkI
-NH38VHfDPW5ueSiyHHKn8MI9YosPr/TmkwgKd/DOIMVB74ahPalo1QUeg+eaBVnq
-Uncsbx5ecW3JswthkAhiktWHcdHmioGD6hCcgbWtfA3VvbAYc2gtAF2plfDVH6BD
-c8veai3B15ZmDmq3b62sgVA9JUgbFaB1eRqcaPXmNgQJR4c8J+CZWXGQ/TKMqtAg
-chCDuczjLX8IxhMPF1gdCggSt5GtMhY47fpZJRbBUw01l8koqjm63KvEeg2ejFGU
-+tXonI4jm2JUxlDTqmNSrVpmAgtPoEPszHc+GsnyNjAz4IXMm5UrQAZyDPgxtwQW
-ZAn0IdOB8rSL/AnRGUpPrecuauINQjONe8CapijjJPQK7g1AHscfxr+OJD1j2eV3
-O6TNlz8vKW4t/V7CUf46ykxxExhA0mKJ53ksaXy2+HWoro2+c4nao/bEld5gt08U
-uCpJtjPKB64X6vdzbY21/l87VRDyxbb3poENfrXlawqS0Z7i2gAbHN5EuiMv+35o
-sBaR0BfcbTn6VagC3i8HEEOO964FrW65pkqmGJcJMgUdcZSl+Y7gHMjWyodqGPOY
-evT6xj4iyeM49vXynV2vrJRu5rr02hOS/8rPphV9c9q9ju5n8xbhS6IiybAelPwt
-sa+xM+w0n+fxVksiXeFj7qD1LDN4+kwqhYP9SlzbA4fT3AkYYrxthTww4IFAweyQ
-IJkpVL0/IZEIEfRzpr0lWLprAaoyPc64pecl0z/gBJDgz1kSG6iEh6K4qx7ahGde
-kBBpS2I2ZsdBkvmQxDSM7tYYBzPxcUNZlSFOIeUy3Xl+OGPlKgtMofbnjV8AFqUf
-tOpgKpLUEkTgXbGUKBxHLj+8pbw7zOFp4sJ00i48ZzLP5D9jom+jS19wGshRc7cH
-dK92CctvrfndQ85yO0vqlyOdMTqjh/z3P2KmhL5SW6P51q5mseTvj7FNM7331DTs
-rq7XWaBLE61eWWQ/dZKnqh5YbkSlU1+08Rl6H/vCU5hTC8fht3KTQSWPofkrP+5f
-We/Pe62LyhV/MbLRA0nmU7Sf4IAnpHfa4kLtlYeB3xiqKd0McM//qzjuk5NoIgE4
-nL0T8YXdGt8K01w+nt+j5bo5gFoRz5+1/ZZ9BgN2DOo4SClYnJWQ/x80X061yJ33
-0SGv4eAC3vFi6xE=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USArR2kr
+YmM0TDU0bVhoZlE1ajBmYWdscXk5TXM4Ylpydmd6ZFB6K2VvYVJFCnlMZ3Y1Nlpl
+ZFdkSTFIeDl0dEtnSFlKWWs5ZDZ2andQYld2eGsyem1SK3MKLT4gWDI1NTE5IHZt
+OVp3Q1U0WS8rakpVSHRwME1iVk9jRkhCaFNIcTFFVTdhVDhjb2JiVWsKV01ETlVp
+NlM3dnpQRFF0elI4OU0wWm44VU4wbGlEVkZOR1ZGMTNJZHNyZwotPiAhPy1ncmVh
+c2Ugb01BdCFGLCBBICUgMGE4OFlGWgpLbUUyMzB5NwotLS0gNVlvZkhISEMveUI4
+TXJpVmFnK2FkdFB1UFhETk1hQXE5R202MHI5MmEyNArH8iLdJN52W23zEKH1f5wZ
+6xfMYH/WHoAxphv4PFDMaGXXx5P8NyMCy4w4rXbohPpoT9oMmJbz2Dt48q0MEp8L
+tdbiQ6OhM1iyQQwbZYeU94z9EcrZSOld+HdYDReQyAAcVCs37mvmqcTIzkdG3dSf
+g6BH0Dn0jSOO68lUZV3Mx5kpPNE4VcN1BItJz2b5fJZ0IdvdlOfHyYV6n8qiP+R3
+4CnaCz6w2P1uksSWAuzmDyouIXUbJuixDf8Ks0HNO65Ar64cb0XAzkuVFbVS6B+f
+Ucu56KkLslsfFabq85C1r1naueuXbbgDKmBkleLbEkK8JunReg49XF/po48iLeZp
+11idYaFMtphmDkL+1WOzzKWGH2YaZXW3KjEcEeFZOdSUCq7gJnHb1nDfmwCcQKjM
+8CsI89ypLIisyM6uNoQNkAlRoiQ6FgkHMpO1SfJcYjHHWIsAWhC/dflUvqkVcJSy
+UOX120f8MQKUxxa2ozC6eFHunjB1ozAzWMx0Mi+h0zVzaAIS/oJNZVBVhnCqZwTu
+6Udw3JWObBRg9N2GkfFnq8iRdithya9PH5XjT4OnF+OfKfYP+MjMTdfZ+ezceTnB
+xMeme9fGhIjo2hYYCIawC0ga52XPTHDfa93fK9WA3fVy/Jatl+V/ezU8DHGANqaR
+mUjOw9ducJ6Qu9cr378Os35zHKQ7+VUugqtv5tkzxZQrpF/dcrYnJRLvMFfKWX4u
+2UctW1zmbwKaIvvo8Rwh2tZS/RazdSV3X2bYESk3x+ozZg+Oo2uRavm7qpYa+ASX
+YtAsG5j9NngFTOVH+hN7Py5rppNgHVS9kKAB5rflTvPQ8nk5KMdSxEDaq50z7vY8
+lZinF59SjN2vIyrIyybU/b+KeatSeLNoT1XPqTDi2xyPYlhn8nU/J33/4QWsqufG
+WaROcQ7elAEdyp9R/ioAB5EK2rUONlZy7ijPvXOmkc9c9z9x0RfoF4FkoN4MyUPH
+8AlrW4m47K/jw+17eqZ5iZfLYQzQrhjC5eBWIuhCHy5Qr2VpwLk+Z2pdwQRA4OR3
+8WSMRf+a4qFpAcCoe0nBNFHyqMq+5r7DvHm+eFzjJ1hBU1Jzes42a9T9IlBHKZPr
+WUTyu8Z/ndt3moJpFUIHEVxbSXLqqsO23W9hhNeg1dYg//LGs+VMM0O10WZQmsIb
+uj3YyOwdMA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/syncv3.env.age
+++ b/secrets/chatterbox/syncv3.env.age
@@ -1,16 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USA3MEFh
-YURySHY5RjVQa1c0QmMvTkZtZElNd1BIeDFpR1U1YXZ5dndnclUwClA2M0ZYMk90
-RmlCZHVISkxZQTZXeEhZVUROSVRGRVg4TmZKZytSL05FcTgKLT4gWDI1NTE5IFY2
-V2k3S0VQdGlQZ0hkU2ZoSWdOUG9rQ0p5Ukg3ZHU3MXVvNHlWYVN5VVUKcWtoWDJh
-LzRwcktWUGQ1bnJvRzVBVlpHU3NhdzYwUDBPTmx3MFNrdWNQYwotPiBKQil6Km0t
-Z3JlYXNlIFdlRTlUU2cgVlxLIzUgJlVyQiJ8Cng3NzF2b3d6MnlEdURQWHgrSFJv
-Y1BMUkZyelJSdDJvUUUwY1k5R3ZBMnJaa1R4NWxlUll2azNseW5MQlpvVWUKYUdN
-d1ZscXVxd1dxSGpzMjBYeWhhYyt5ZlNkSjhmV1ZTTDBTCi0tLSBBTG45VUJOSXZv
-N3lYNVlyZldMVkpZdUMvS21NdSswVmU3VThZK2M2eis4CjwfWWJVR9Ty5dBXEr5s
-U+QrifXvyMJJvqOKEfMYYomFLpt/VtbDAUwNlqLnFIk1VZ2xPUBisXPtReiCK3gq
-P+i6bUONSmPYvmF82VgiuKDuz/kmWqVGg2iSBPIXAGLNIEojndQwmhnrsN9ex4Xy
-lBHkvVsN8EamUJwZ+FEZe4+PjA5yEnANWpeTELOt2gA92/jwwnNIsr07eVTlkh8X
-UmQ2owGwktXP7it6//NV3C7sAdazs2bX65WSnog2E8WPNAorKWI8RCYs33CshVFt
-zzclZ4hRmlAmqMHYqFY=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USA0cXhJ
+U0R6cW9KM2xwY1V3Y1VKVVBmcEFmTEFQRk5rdy8vZWhRZU1CclRzClJsc3ZablBL
+ZW1Va3N5aEtyMUJmWkZaOHExdjBmRDJPcVlvanM1dFMvMVEKLT4gWDI1NTE5IG9I
+UGc2RkNsNmcwL3NLdkRXZVE5UFI5eGZuSExocmEvMXJ0YkZaNzhsbHcKcWw1MTJR
+cUJCTC9SR3pNRmcvT0ZGdHBwdU9OZVJoK0dacVF1SkdmQjlkZwotPiA8LWdyZWFz
+ZSBRW3hICkc1Qk13QzBkRUwxQ0dkQ3UwNU85L3E2M3ppTjVSUnNaNExYTU04dEd0
+c2FlVStOLzRLQQotLS0gWVgzSDFUUDd6RzJjaTJUOTgxSUR4aFF4YjB4RW5xZW0z
+ZFFnR3czTU9vRQokL7wsRHEdFXrihqXGE/XPNNJ1qgHskz4bJI1Vj6dAsvT9CRkS
+GT7ZtnRwYxL+E37f+MXCQdCbfsL07wVcLrVE3wLSyc5i33/tBvMW2jhFmCVwkwDd
+aLpI26s6p5HbFniJK4G3zFhc+UXdSYfjxa0fSL06f+lmcqSol01nUu1gyiMrVMQn
+RjxhKdgyoNE6xAUD10e7KbnjLgKSe1lXaapcuoIXIELf7cCbZpi7f2AE0H0hc0Nt
+b0iBFTN+zN45tvOiTA9qRRVlBjf4ZKMDKWGXIkq8F8VXThGCO/bk
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/colony/borg-pass.txt.age
+++ b/secrets/colony/borg-pass.txt.age
@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBoYlRq
-ckk2c21uMVZSR05SdlJpck5MT0FZeUpLTmpTRVN2WDkxWWxmVTBvCjlHZWtEQ2Jh
-YUdybjJLWkNsZkxabTVIR0JnMno5YlMvVmhodDU1bktrSzgKLT4gWDI1NTE5IFZT
-Um9lWXhqRFFLTWdNaTR3Sm1acmY4N0l6WE1FSW54ZEtQcEE5RHBRRHcKcE5KYmp1
-WVdCVk0wMHZ2SCtUR0xKWU10N0xETXlXZmgxcmZZOFBXYWtBawotPiBlRm1gKGxU
-LWdyZWFzZSAqXF8gOkU8Tm96IGA4IC1TCjY3NUgKLS0tIDhjaTNrbG1iQ05iTWRS
-UzIvNzA5TmVGS2ozZmYrYjlBY3J4Z1RRUGRNeWcKUTIEhWqr0fOODu86MDll7k3U
-ThgmS9nlcUY3fMgXzZLtpHIJ/4ZSI+miu8RmLMaeC61qv6xNThGdx+MvU4tMBWKA
-Hv3XGi2MYL1jdHh2KYg5PgdqchYuHrFuBPS7c/tQow==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBSUzJ4
+VCt1bmtmL3dPTDg5YVo3a1JtOGsyRGZuSktadlJGbG9SeFNpbWgwCkRtUjI3TjhU
+MUtjUi9VTU5Mb2piNTFvWForZmZHZWhmZE1QeEp1cG9rVUUKLT4gWDI1NTE5IC9D
+RnZjdDBCbFVqaC9BKy9lMjhrOFlkTEhtQTdFMVVNY2dnTDRlYVUxRGsKWU9icGRw
+UDRjQmUzdjZqTkFjMGFNblFvM1pEOGZqc1o1TlpqNEc4VHZxNAotPiBMJFxgOU4h
+Jy1ncmVhc2UgUSl6c1lYb2sKS0hIOUZZajJmczlyYlZZeAotLS0ga2hSYU1wU0I2
+NlY4V2hFRytnOHlIZVBaUFk2VXdmNnNsTVJJK2ZwWnFiRQqNbSwUc4uw8BIFGgAW
+jiH2RF9iQXxjbl5n0leegyOs6ViBwDdIQ97sdA/QcEUDPMc3+j22uIIvHF74rvPO
+v8572JDMAb0mPutee/CzkJZOiHscGhV6FCRH43QX0rjQ+zpZ
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/colony/rsync.key.age
+++ b/secrets/colony/rsync.key.age
@@ -1,82 +1,81 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBZVkFh
-RDNNZCtySlNQTTZFbzJvZmF2TEZKVUM5VjFjQWNSeHlNc1JNZ2hNClVac2pEdWdw
-OVpOTmhWWklVRDA3UzZWWk9QVG1ySUFmTzRSVlFReVdFVFEKLT4gWDI1NTE5IDVD
-eWN2S29aWVNVTTdldXFxZG1vWUNYK2RrajI0OGNGaklzdFByTzlPUkUKTmsvdTE3
-ZFBvalZsdENxR0VnV3FVSnFxTitBRlFWR1BzcjJWd1h0U3hpYwotPiAyOkUlJC1n
-cmVhc2UgIWFOMiogVDc8IFZETk9BSDVTIHEKQ01rc1ZoNXQxUDdtWGRQUlRCV3k1
-djNZeEtOaUl6Tkl5TDA1S2ZXWTFQZEFiV2pWMDJpZ2dkYXdBOGhSTVA2ego4UnBz
-ZGhXcklMd0NVWlhsc0Voem1wUzMyREViUllCRAotLS0gMU5GQjdJaVdlUFJGMG82
-YnZCUm05ak9qcmVyUVJSS0tHaWRRTld3ZkNPMArRgojrBQvlyjMhChn8jgUNDysj
-9Nh3BVqf44fiUNMKARTrFTz3wVMlioo6MmKRzJ/yj0fWkZ2h80X68Nq3rQvy+0UK
-4PNPRbwY5ib0nf7n3itFKjehrYr8HnOjreQps4it52bT5re2TWIC9ogZhNKBLRvB
-qv14HjcF5bGnia8TgSU/8nUZJuIaLwHvS5sc9GOtmV4lDwiSTEJQEtGh716Jzuvs
-XxQLPEVVufAjZUKLp+jWUhXGkvUEeY5bxE2aOLuB8kLfHPC/5p2rl/n2sW3oEDFn
-Fw+XcNnCHWBzk3DlzKZFXwIaZL6Ocqrt+p8CBpWoNhbssuKyOtEbWQOmJxX3UPMt
-sBFNdKSKFhoBQ4ukqkKDhgcm0i+8wG4eBbNIMIDwzPBxK0QiVriwlPQHl7RS2M/J
-LgGeS7qrKC3SgmLu57CdUVUlnogJ4oOg7FPh6x+jQBIIv7gtYCzJb040TUZWZWvi
-cfKWBBwLqLa+7Y6kEhcosLUgw2c9Et5P4rvNjU598q7qrZq7uK6Mr+PMwD3Pd66O
-SQyT4nYhhXBnaIsLXZfima2nRzPocaBmfsuXQwlnLJC8JB6yzqEViK0xYKfl0fIi
-jxuYBw/8Y+MWQhIkF1pP8z+Kw51QdK4CIV33mlLBJnGjlizewsjj04EIgpzQ0+3I
-ZRyee/SzFmGBBk/pMGN0DizA8LS9yZ9DRGrc13rYVUTN6G5xT5AT1eEtFbQ6DH/n
-q13Tur4QJ8AqJmwv1cnX+faH61dXahfbinveXWqB5S95/HE3OGnZfAiS5bs1jW4U
-D3BLaBiFMYD+ccPedg5MLXRgEryVaOWlQ5wuXxqmaCG0KS6YLxl8o0bRR3lKXNZP
-B7Ye0Px69aYtOs58dTOq0Peu039Fi5iNC0beocdKOjig4tZ6p41uz0jPGMUoDebZ
-MYHax+a7Qpi5M6ZVGVpF1ieW2hqnm0lfb18cEYHuXjoI/YlgVhFPCGSzHJpuNiDU
-qJSfOuD8HUB2iXFeEgAi+V3EKTsyjlS+R1zWxkr2awqAk7Uf3svLGWZNINHNoJRe
-CPPANHzTSHlNPSelQ1CyOhl0W/eMCEJuJ9/6kZsmUC3zvzxEMGofG+Ub9RRBW/+/
-TkrVvMrQv7/Va/4dxMPCqrdOQ+3/LkVzGX7qg6tQR76Su0q7aqh38Ki9qWY47bTm
-lq5I2EcQApt/O1cGQJTFowdXVJXx/qQv436p/jL1mymQ8241iQ6XX3DUjbnqdI33
-4XcPa/B7naRkgSG1Z55Vv+IIBOzcjzUMzeQVP/WM3SFRNYT79mJnV0SsKvUFtUOM
-1OxMGEx+ZxfNIZqdp+qo0+uIU00ciokldh4URo9u8EIHjFVcV3Eyb7EbbCxzDiU9
-iwoAAaJjwBlyaRQFWYsKhY2J3NEay142WAyAiHmnNBNhZM9TKkCpjton4ehxeRUC
-hoXpzh4J2lMhdcmXXZ675C3MYiLDpajgLS1dwRp+mAUXwjvQG5rmJd7UWdgpbdpJ
-K6wABNkl601XgKv3/nV9touE0KQjHg1fzo9vzmf8zVEViTgXxH3NECZHctObwgoo
-SlbUOW8vihCi2HU9G3tqH7dwkUsgB2a22JFovgwwW8ePKJQpdvwAV/jyFMLL6jyj
-6Tf0Gsc/Iut6Mh5TYiTWJdCzvEBjcybOVnppj2zR32/A/vAXUrJQaq0kwKkCwG+e
-TL0hAQuA2Su27qTR9Xy2QKpQ5NppRH7V9YxCpjGfcLbcCh7XH7AEZaYfrrX8NoP5
-zPalFA+7E1IuDRtT29wFNRVb3lAet9t5q0LUHf3x+Qk23dQ7Mdq2JIf9RIo5xZ6X
-nsKa9eBQ0O5OAv1VGWVvbrVCMpmyiklYV2rcIT+dbrhrgiTu/BvODSvtmeANIkhC
-uF112/+QW1UNPCENioYq9OWPcEwby+s9JkQf5nTub2o/0lTFKJxNgXa1QBcKKVyC
-9aTCRhcxXsfuR7YzbCXRcK2hUW203iS8+UgAfZBVe5GhskOd0ZR0WSkse+jGzPqI
-tnH5F0yQgLn9emebpL6dNFUVvssjpiMlvkijXFJv1tWSKLb3TxJd2BE/w5Zj7Haz
-iv7Wz6o5+bY4v2YL2Ev7hGzfSaef+ip7/BYZ9TGuzSoZEHMYa7dNT8kRR18IhfXv
-Y3wa2xlOhB+WE3AjtYy1oTi2c6Vmd9UKASZy/Eb++j1MSPtxZQLNaj+svCmqqfvO
-/gElVfGlgkomYwc2EfJvR1lt9u9YGepxKrafPsgvjR6bYPwLF7eHKkKyEiqGCYnW
-mcNJz/B0egxhFjoGd0U17tNuZcYRD/Tsj9ugGF+4/q+IaEV2YzZTdGzupI3lW17o
-Q4H+EksxkWYDr0WRlYKn7VT1gTThuggEz77JskjNP4jK29EOIEO9IqGMh39tXsud
-mhL2Z6XMX6sgxSjSkYxLpFnS1mRZ6uQnSptxHTfnG6jYhq//MTjGX7xmYBj5EoTC
-duHuaCqjRXc3yHWoNm8jepkpbe1PPbwEbL6RDK16G3g0WVREjZopj+66C2xlY8Bq
-ZCmHhud22QHs+5r1LLSIynsUlGIOvq30DZ0F2/f9Gm7uayIYbp8gA4z7M7RjmHoZ
-+XHYSPc4kH4a3T9MucQQGzJMl1k/bifBAWLbu9uPcDUe7Cglfz0wHnPemOu8HZXY
-6qS1n6PAHyyGlqX/pNWxR2vQrHJRksdTCvjl4g6256PhaMDop3QAHuQj9meYKIqP
-MiZexiuOW3KjPJ30Gx1Q7PnUc+w3SjjsKaZEvRgeWKa37rvj1ICTnBQUPq2HV6y8
-zaGnJcfd0ENAmFnRaCIbdU6TRonnIAAuSfE2gtLni/PJbmUpznuq82W//kxvH1tR
-oPx6LuM2+hRncMoyXUTWSUVO1DAUPXgZA+j7fkkwmosi14d/5xe3wO4U3dGZ6wAY
-D+zlzhq4d/4vIvLIL0NoBcp8yM+xWxPTtvj7HUJ7BOVV06ICnilUlv2wjR+dZLZK
-DyjWhMoqk8r2TDZbAQr8MNX+sSlp1JxQEgBijpqBvRdF/ulqraF/GFDFRLcEi7D+
-AkHPg4TrmaNB5ixsj72j0xruFJxgQJGj8fwQtemJGu8QcuJbCvJ74TI3vu0Pac/C
-MRov1TAVJB7+iVvVNEgCMlzimJCSCUYh1Zgk5Ci2CDFMFRAEcGoHywIW6v5V8j5o
-v30mJKZCVFc4Yibivjj1aGhQVO72vgiog4L++i7CeXHIu6Fe1Jmlve5iuxrQA2aM
-9vjCbFJIi8k5vQTVcKPRcsto7/qbyxvWvahKBBbHl53XnSb0WtLUyTEaXJ+0l5gy
-Epxfl6ZRNkt+YBYBqCZL9aK6TNpCR+zTC7OhrKcZntqFYCeRB25YEfc1z0lTH4SE
-TPymGSMOeUX8YEIr+XNYG0H/I7ZtEdNGBEXaUrC4YUNrvojpq3PS9bhfLhAf5D11
-wmI2tS9cqxAuS2zkaBr9Qo5xNEVsyGNFd1K0q0JJosiMnVZDzOA4wJTYhOw5gwcW
-T1Kh/LDvK4RE0CV0jRqN81YO8V6Jq+/c2kgtwTLzrx1GCcdHRsY2kPhCEWOTLKb8
-Jn5nyyvOOjMIkAEYYqoRRxl05UbNWNS9SuO2g9HF6JpNJmw0cmzT8erIIjVvaUs5
-dd0Bd5EgkkLq3RMPNTiidQCyIy8QtoElmxYfM11mbf+JMgxsB3sDcRGN4lauUhho
-JlayuFUfrQEwtHFwyULiJwUC55faVqOQzyvcQ8C9AJezDXS7//ku1kvEgbzK0nFm
-3bCCiuog7pG9XlldSReYvlJtnqTmp6E5+m9YaP+yB2E+swKBORHkbCfBu1CuX6R+
-aryBYIDeLaIiJs5GWJN//37TT0hVUCipY9QISfTiZ5tIy0aNKRu9syjWphcoTJuv
-YBaRxKNdZs81ppFTa3sXB824+QXwzRJJPjBndXOtyX/a2U68NK3dqau/A5190VAn
-bn7jnJ68rhcL9ewwydQRm72qwyxBbRHFXnEXpkJhzYRw6fosglqbOJMxFiy36HWD
-RkVluvTInw8Em/DhhWgn+UrxLlQN6JnVdpkT9hwrlFWooiM56UKAPO2a1FM2XKXe
-TqsolY07uWnA+ouiljqIpsaFlVDBcz/sGZWqy4aKKPBTcZlreW88PMsS0c9nixVi
-nKnmI00HuzeL85zVHGo0IKYfktVVjuZNPzJ6+w18XpKIi8TxHpxELC9M2kVOCnuy
-uwuntJlRty+GpXVvx2VLi1wBKyLpXUxhyg1tSi2sZyjIdVt4yEOKfajZYOp73JZx
-IcInD7Cby9olkMsa25YhloljY8YELfW8EWutF13m8tsjGP9c6aOuMIXhrrpwLgYy
-E27iFh9tHq0mjCMibwQnHld7Ccd4OqO4AKfPofHDxWoY9+ivArOBAXjsCxhxWWWp
-aLqLJz+JH+idcsVDlw8jJzFW6pQFbM3VxXObvCg9ou5+P+Pc5XYyALJzIlmoOrN+
-ns5Z+U/2XKGyySQASUyFXUNml6csSrTd+ejz1QvEX9POU1nLmvS1+aojgnptgdpn
-sAtksQHMt1Njo1oRug3+/0iC6XWEig==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBSOE9m
+UWdwRWZGdzRObTJuSzI2QWxZSWtYNHFCbGZtVHNaY3dPeUg3OGpJCndQbzVVTWtV
+aXlwb0pWK0g0ZFl1MElOWWFDMnc1cVBZTDV0b0NMTmxTVmcKLT4gWDI1NTE5IDQv
+dktPREtiKzEzUi9UNkptK1JESWgwU0k2TFcxWkhQMkdxdjMwQnI3Uk0KWU5KKzZT
+RzJmK0RRREJ5QjgyZ0lpeGF1UE9IRjZoTFlkNTlQYzU2VVk2ZwotPiB4LWdyZWFz
+ZQpNSm5jdDRuU3pCQ0Y3QVNMZisvZHk3NEp4dXAxS2JvRGZlU2htZWVCRXYxWXkz
+Sm1nN3laeUJPTnJJZGlHWjNyCndKRlRmaDlQSVFwLy9JUQotLS0gL1NEWWw1MnFO
+V2pDcDFIdVIxZ1ZHQXQ4aEN6TDA2LzNVNFdsdml5QXY0TQokgptIWQ47Gd9dI/lZ
+j4aoLl/OrydZBlq3cu9bLw+N9pdZsFjWBXT7+k1UwbpE5LgCrq+4ybgNyWHBxiko
+DRuKVWQ0gwHpQ3WzQ0Jp3ftwHWJvm5n71AQ9EWDwg2UdlHbNcF0A7wGu6S93lKZV
+I9zNRXlAPfwfLn/xhUiWoImh9nrhs9segV4gnDrrLT3lPLf+sOVEAUp+MTaZDZPt
+UhEtVIjxAf/z8B2+M3FFsMLkD68KjK55JxpkZ/1sIMquz7hcgXQfkOAz7NF7AvDG
+EyMnKGFoWgVAxtRy5zkBgc3svT9tRLaFe1ZjcUNJ4dd2ZeaUhKalCvJBFgUgOp1s
+a4Yxz6LuwVd/CgoquB78NOp5kiF5HCGzstKo6Z7ROeY6tGcYb7KZr7gmIikgnNhR
+1YG/FkxQ3N3p3RqFHzbgTVWoCNBdT7wIvjpnL/R88VvssO6O4OeTaJlax6CwhS3x
+szWJWEnbGctzBXIGgrXlG3gp14U9dt4GJCpJEcqdhqD3Psc4dzdbXpRW66EW8+sE
+ZJDOTDRdGAr3Ds+ZTZAHwyQ18WLk2S8M2pNVrgXKB2iYhMaElLwN9QMno2gptajK
+YrBelPfAwBdnWL5yG9kmQ/mxOKQCNLzZqqsED3tw+VxDXs4d0nPU030ipu+Yh7YH
+LcmSjyoBVMt4ziGGoijvzP4vpgYGBt54dnPYiByrRM1K/qoZoDAN49+89qWk+t8l
+VYfznyzfFUISxPna/T7+smIECjlFQbw2H9c6Fq1nZGrW5a+A58JqxKcwLZNHM6fj
+SzPcC3n+v7noQqO62aYpUKTNVyRxbhpxxG6XZCiU+KU9zMPBwkDnDgf9+VQYAPLS
+FuKyBrkXL4gkHR9j8gg377rdWhHXR6Uu8xEZY1tFrESVm6LJIr27dXTdhKFvds0M
+AU1BMgAbugibLpBSguWMp0Vr59WqyeczHuHk4iru/4hD6GkeAGVX0bB7Fq8EWJwL
+Mv7ELAJOCUN4SyjW4BWKL3WRQkz3acp3abvENx1Zw737JFrwvzOi7Pqj597JGH+A
+HN5H8j5nizyoHMhpHZ80L+G7v5NV9Cj0c43phh86SdVB0Ow4uibL1kVr+m4YMd2B
+W8aARDUWHhUhcf51BzlEkEuAh3Lg9BGFWjRra47RNOmlqyTEM6YGRIVKFR6uh2A8
+UUC7ERGGBgBsZdrK8ufz1xdRS1ASzPcY+ZSMnhDVtMbF4V2qvOOgfq5DWz98veA
+wc4Y8FgfPXWrPNrv1+u+BiZt7oVBpYCIFRxfWZd8+tIQCZ7n+LbyEs/qZlSCbZ+O
+YxB3o078LOlb0njhny6TPAUxhyPlGrpTDruzj9NFwA7b3M+saZ1BgFSBTz/6q+2f
+t8mnF/4isKywvAK3Lc8/glytLUMrtZn8ZzgqR7X+NFmA61LLFt97BomLKnIqYtss
+22A4V4EwO+yMBkbBgz+Xxo51WJt+6Qd0WX70VBhk8BdCSlY36O2kvFFTZtmVXm13
+d6ScDZWa4KDtsQ18lbly4uw9G3JfJ5UlYhwExxvmes4Ny/XmRsvKlbc3T2rQICsd
+HiJjfv+tSAjsvm80ygP4v7izkzXSssiswn29rAyR8GsV9gOQxqjsVloSeKXEEKik
+/2PKTYITR5tsSYSg5lZ6KHKmVpYPBqYF49mH6gDNK2+HHpulfNV+zm0MWRCT6qtX
+pzhmDEwB+E5GWFoITx7TGvy9PwobdpBToUTu61wTXKnrndp8PYFv2mpgzXVDjeZS
+JzClaWc42aLeoeXq6/kwWlXTzk2ZVDYYMErRYHhg+bt1EWOTrC9Trk0n6o/1lXH1
+gTT3ACSg5JVrMwRNY4a3QriNYgjaWEyzgXXDcDPj2Bb2s2XXusfekt+JMew0mvoA
+aWe5u3Iptr/OGjRu7K1jIycnBgcKBcTA2Sh1QMF9opud1snnA5m4OBZ4aeAquvkj
+N0mp8ihIuTRWtLxK158gxXUPGihUAhCFO4pL3f/HPtVMgc3xByaERfFl6lK5g0cQ
+esT5p+GrpXwe/x7doG7QalYICZTuBPAd6A0zhOVkcj/+wKPPMPM+yj+twPupJ+qw
+ywaHkm8e5u/zL0ee82J++wF1MMLOWA/TFkSeZ1nQ1J14BQMakIt/VdSOWkJtC81u
+fAdt7akkmQYCI4KusKP+c4TVgc2MxGS4vLEDdJyEI6F4vnxjySDr4XgfZPX4orpx
+n2tuk8OOZak9G7VcM1N0AXLiTA3LSDmEA79uzqwkW/q8tIyZ181BQXaTDiUFnEzX
+B7UYlSapjv+qDk/7tPUJM94wZXzNbZZrb71lipRiq69vqMGNjzBzCgaYLITgj+XH
+PGvHM3CLQdAsJ01evTHKlUmWpBM775+1O2Of0v0XohuEWTLlnRz+x03BsvSxHfnc
+i+T4hF9YwOvD6IWXb+y5/xcED7zZojD1f2PJsE9AUHSykRjFBUq1umUKOTeCNtRS
+1C+U/QJOVls93nVtp7KkBQM8m+0lEMukWP6wq3Hx9l919Eqa2FWOCGrBTZpCrnjI
+mQyayY1ib/Zds9ZIkzbJtvse5EB7u4kvBs9mWwe0fQikczy+b/OcWJ5GzJElEo6O
+hB2bS+0ebjRYBWdw/hzFyhzlSIoPTpNwNcLyS9R071Xkgj9WnmuoK4hhKySw0zdm
+T04Z8ve0LTXvpCyzQDlT/FQbp6CfEmroR5sqw+KZoI3BMdZrjRtHERz1mVEIEvXc
+wVqygonuf1iFY9y3ueAbjA0xn7waEJ1AuCV6u+58+IFsvUoA7g1fO6/m2VQBOf1i
+XCQVIY8NmwB8z5IZeXnCrA/cqa977HFNJmWKsEgmKO5oGwEdmOed/+kKi6ebGCeC
+c7YNIFf2yLfs/jNvctmgfmYTlgwcNI2PAjfw6N3OQDlRc8LoUVclfiyOxLJd+Lng
+X1si9PvcN61tnVIu8N8RDErr71x+W6gN7lsD0o/tdaUEjbadqtBukaws+fJsL+Yb
+ulcfntIbhqNQJRAyc4b6PW0l6l4wj3vgipcGoWBFLMzhXcI9VENLQ6RYZU9hV7gb
+iyfGs3Z7P2wPkolzxvvORT89PWPyIidJVCKmz3Jef7D8itqsiduWw+XUmxECNq3t
+jhvNJjrrsEk/u0V5jPIwJRPJNGiofq3LktU8vRs/MUxj+HKU+/Rs0EioPS937VGE
+ug+Q5/RLiNdK6HqbUbGuYYRWb59jKNrxSN/T2M6p2Q5qa0e2nOzmTn/JKEJblJGw
+5oAUJQjEeGztLaJm2hBpbSoHkdbHlL6UCulD35MweTNnnwhwHq/lYScvZMMqNB3C
+m0VURvfgKuSstm4DYMFC879SOHjYyY3qAfQaViu8UShw/xTuKYw/0g7KnZf0y02h
+0NMANaT6RtvZ+VXUdCYlPzCCo1IyqVgu9mZauGZ+yRPf1SMPKPxH1vjY+WbFZUJp
+EUDuonWLwnRxDx3sXNiYd4rOSHpWKrSYqmM96827GYEqidG/E+5mnZj9WeRFSrqv
+eS8go0nh0ONZ8Wep8rzQHMQ2G1Et9s760BrjO+oQl0ORr2+vCahumdLsJfC7g5PQ
+52Y4+uvYvgQtpSjXABcBR46In83psdOzLHATCogvAioGqC1WSBLjaypNpuUuVT/n
+ZMcCT0XohrFi19MSbdKasV0aADlyarwpliCl/B77aKE2oHGQbn0QqBtjjqmp4FpB
+W3LANTYgVzoBUDZAehsiCIY+yBQEoV6F1xebHGZdIxRCDBaPwpu/vi8nPDp7G+Wx
+FgyOkxazZkwg/IhUWNGWAQ/wUZqxGw/BmAmjCjhvh24sI4z+S1+82vxhlts1iwZe
+z1CZyPd4BkVpn2hyok3u+kcvdqxcOnKkQdg8rdO1ZQ/dibCdpMIZv4zLJoXiu+qg
+a0XYzat67imK4CleOTlj/kUqeyGKFE/LQ6V3BAwYilU6nkfl2kGmCbtiBP2x4jZW
+gg3peGaD/AYgfxBEkmtDdct5WvxvlhLjk0nBT6ppS40yMdf02sOCKEFZ13KfPYP0
+kuYQ9gSRuuoYQjMoEB31u8/uUpM2RjkiP3C0zlPDsjCC5wQhTaDFyHeG6E4na1o0
+q2mcCfAwmXKfqtd4Ijs5qXdxB0C0n7Zrw0NQ1DUQ3sfR5I85x0bi9oz4HjmjcNQx
+naVOIoMELJtFPZXBCUkEhH8H4m1fG/BqI6fIvX79boQVhzU0P4j6M++tmfymrIi8
+nKKTcf1a1RiEhmsTZvGY7rlJ2ukMtotY+APXjQA4UaeAZEjp5wJgrvo3U8T8MbLg
+fyNP17MM/9CtEBMK4Xym1eRG/27sXXotd6TQdKONXY3Ag8mYgXAraKqobEwL93EQ
+1pchSMUaGKi1EzrFZV3NjAd8wN+M2ExxrOHXKIQ+j2XSlp+kWeV/fU4hNbBMnRsp
+QWoYK56boMt1mqlEk8JHqTxkuSUwjm8utz1/emMSjDuYSRMB8RqOwNnop1ucEcdT
+Ia1MyM+jTpKFE40zizOxOZ0NaVkB7zFGGzSgp4QvzN2Cy2SEoPWxzCCIcxCprQVt
+1q8rx6T3AzqyJngzClYUTFe9EOLNwTlovhYyTw==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/dhparams.pem.age
+++ b/secrets/dhparams.pem.age
@@ -1,35 +1,33 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyB3QTU1
-TEdvbFNaUmE4U1lCNzI1dlloVDBTNXdURjZ2akRMV0R6dm5ST0FNCk9YclRSakhT
-NlV2UVJwak9Fa3dQNTNBK0xKWGlkNXdwZTBEMm4xZzc3azQKLT4gc3NoLWVkMjU1
-MTkgakk4UkFnIGNBMHNrdG84cUQxd1lqQmJIczlScU1jNk52Y3BtR2tXeDNWdWRX
-cEFCR0UKVU5vem5MZUFPbGhoQzJTYnF4OTd3OW9jYTRkazdocVJkZ0pRRGNLek93
-cwotPiBzc2gtZWQyNTUxOSBnU3hQMFEgQ2RUaEUyV1ZGbGRtZnlIUEtTQXk5MUZF
-djYxZ0hBUThlV2tXTHNvdXpVSQpMdiswMy9QNUtCb1hkbGRqR0Nia3FXTzE1ajZL
-UXljSTZqM2YvbzVuWUFzCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBYL1NrRjRaRnFn
-RlNLdWJ3cThteDM3WmNaY210d3RmZzhCYmNpVXBwVGlVCjBkM0IzZC9zNjhmTTZV
-R25ySkVoQWxQQ252WWFlWWZFMlc5dWtUN3VvVTgKLT4gWDI1NTE5IE8yUU1pWGFr
-NzUvZVpwalB6aklkWmJGWUQzTnJiRjNzdzY2MUp6MkY5M1UKR1VIWDVyTFpxem5F
-TmRNWE9zZStLanRTdlU5d0NOSEJKdWhDUjBCdy9vOAotPiBTJCd2NyFYey1ncmVh
-c2UgfE4mYSBXfms0TC5FPiBiYmx8IGRFV35mciNoCjVZdHRiVUtMMWxEMlJ4b1F1
-TGgxY01XTlZpTEtndkg0T0hRVjlqVUJGMUpSaE5tVlZWR3VGenpkUXY2eXJtbmkK
-ZCtqRVN4dnZENXdoYkpjNHRWYXkvN2laY1p4YjV0WQotLS0gOHlEVTVOSmlNemNQ
-TW5ISk1DeDlEM1RoQ2JtUFlyTXRKQjdnT0hiend2VQqrUFvr+76sKn0ldBmZMlEW
-U2k85DLo2KU+/+GtbkZwVXxxIZHMLpoJgghHk9ptdalUgLGcl0X15x9jVaw8aeta
-hbeOHotRHY7bC3z0S74riTk3xDMR1eT0QGhDMWHjfo8SkCftOYBlFfhTftevdep3
-pKMZsuQMwH9JzxgUfcxIcWE975cZzrEJ85nfWMGvdSjcg51KNxP/UUPRxDlcbCEf
-9XX5apSzNsTI3ibGD1n6Qwq8bdVYDMHmy5pAhw4l8L+SdoU1tGdw7JOA16sMCJbx
-T4bV0ky/PGRonjJuCyDBj8oe9vMe1ZI1O/ITtktekS+wocxBs6QXlY7pIZMlGUn2
-6m59ZEEaf7R4/MdnmBDNDkQuyXaKc7SaTc6h5sKWzXdYScGUKvgUQ7U/WJ2ItUTC
-N/Xq07GkZZMt5MYBlyEr+/mKWlcy+ylJPGb7EswvQWaHoeM1QF0XLZ1v+W/Xsso0
-seIoz+geSu9a02kwfsa8WvWXdIAT5X2pNGPClVNzjQ23pfQfQuW8ZQrGmIFR4g5A
-58T1K+vGLdShqqVGyJFMVrSuOzqX5FVmZalu7/++1IQfiRGUlrHKoPlKWnCfFEOu
-AYjaPeEFX2ByxcqfMK1YVPvUufdISUQeaQOO7mXGE3FqB0oUqmRIUiWZATwhq3Pw
-p5QdcySTnmMpD/w05hvwski77kCdmYuHlMlLZez/kfhTnIGXris+Vwi/V19bsZ8G
-zwaZ/Xr6WNC+df5JqSfTGREnXZPFRDkaTt3ri5/eEm6BqliuYjGbuiKsDECi4+JX
-bHpH6LBBoKQ6ms7jCAn0Ls4cUKF37PcjGAOuWnzCSBU+REht1EDfHzx4C7hNiP8X
-87NjEqJbwE9lORho0hQJRTn8uriQcidlVoB3se2SYKbMy8UA4NNnxN9PTj0TuQjL
-OD3LtqHBElqNPbGNyyEAAJmMBmmkUvPPXlGQ0D99b1+jIdHzYSRtOLshBFykqWYQ
-LJD61duhGqcQqcLx4+JdQ+oVcfAI2nG7YINnHB0OmS2DOZvvwqQ7ASScSujUWIjA
-LNQxu3ruMz+bw/G0tYZBBiE=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAyMHdi
+VHdHcE1uY3plMmE0VHd2bXF5S09aSy9XSXgwNVhIUUcwaytkc21zCmRXbEZRRHVm
+T2p3N3ZTNnA2M1lZdnNlaTZNS2Rka2h5MWE5bWxMN2QyQU0KLT4gc3NoLWVkMjU1
+MTkgakk4UkFnIDRtMDJJTm5WSUh5S1ZtZXljNmt1c2JhdERuOTA4WU1iWC9QWVl6
+ZSs5VFkKSDd3RE9hK3RMRm9qclVySDNGUXFjVFh1cnFKUXpmaHo3QlRqY3MyTHJu
+SQotPiBzc2gtZWQyNTUxOSBnU3hQMFEgNXFDdUsxTHZMUmlQcFdUOXpSMGZlaEpP
+em85NGNoMjlpbjh5M1VHYWFIQQo0RG1DTzBQUmpQMGs5VTJvbEF6c2o4ZlBkOVYy
+S2Z6Wm9GM29lT2F2enVNCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBzNVZaUkljK1oz
+RS8rRldsc0ZuQ3hpa3R3L2RISWpQdGgzQ2RuTzE2Wm5FCmZ1U213SWcrQ0ZPZGhF
+R3YraTg4U3lBdVNnZzFmL2N3aEQ0eWV4Z2xETUkKLT4gWDI1NTE5IEFVVjRJck9h
+WkNBN3JVbGZQV1lHUWllejZRY1VMSkwzY3Btb2V0NFNCbncKYWhXOEFvYjc2cEZp
+RnRnSlpRWThDdlpNQ1VxMWdMM0pCVTNPczlhWDh3WQotPiB2LikwTzMhLWdyZWFz
+ZSBeJSAmZlYqIEBgK2w6fDBWCkV0OGIrTXIzb1piLzl2Mlk2OTQKLS0tIERzdG1k
+dUFOcmJjL25MNHo3MDhRS2lCVGxzRnZnQUZDZ2JManpJTTlXcTgKpmHNMXWNS6I9
+QIuY1L705kkDEGlHghiRfciV6+vK/FxeEQpqDjR9NXLUtPCsgzlcqAjg6w4CAsdm
+2wxVD3FPutB0uZQSWdRSPZ9zG2UiwfV3cIMhZn/0OU4DqLVo/xlapiOImO3GyQRd
+ILWBnu9a9WPsSDbqp5zSgwqcpzbERurADl+J+9f7HqRSCMlA8BlpVS24wdiC8Ruf
+rB5rQ5qIzZ8YS5GVD5EHzekywnK4PbgmnXi4Gin+E68Irkwhtxqp22VnJFABsHDJ
+o4ZhM5UiJXXAnqlQfd14BUi4u8UhvY6sC3XD7NT2zz0giSP49aSBkdcv0L+vvRkv
+xtLRv8M16d+2Kzlgc9ii6jAlewuCV2ElARgdgNMizCiVgQEPHaXA5/ESmI1e76vA
+3GqdgAn86/6fbZrquQzf5jsrLF1VIzwxmUGzjDpJPZm50TSPrXX/7GsuSfhWzeEj
+6FBCgwb8+WZkwl51BFVrQpMs7m1yvMn/69ttEfg87V0nu9o063rfVgEh5TVCfTqx
+39o1HeThkonLAYKoiYAQFjsJ7i28AvcUM6m65tOBB6+QFDqGo75mptpf0iyQ7hpf
+jc4XY3IpWekOzaub7AXkLHhVFPes3JTknqF5f8dogk6bMi56DXAfYpoxlmvA8vxA
+Ucc7NvzF0MRjIy/+d6gnDaF4lrepvF4JgSW0jtP6AzghFttILTKO17tY9fZadFfa
+jd30GZ/sKtYbvfwZL1yIO3Uey1+JKrQNd24+3VZnv9vbBPRSkh1KGTIMd9/OgeZ/
+nh3KncUA5pVdf22kloNf8APm3q0ueBVCdMik9wc4vDt+dmjb/BVkjeqI/gpQ53sE
+o11OuVn53trLNisG5pxLZsEchUo87mkDrvD2c8TdE8N46GF/CyI/d6MS/OO8kwmR
+cCy4Mnw5sP8Q+ZOgfJI7ri2dAtuJnx4CvXVXaqL0dXICJHIaRMHgjKbuxsbm9pXc
+QfBZMQRyWmWxc23jEKfbWQ4Lm5d5+vT+uTprOUQTkViuqYcWh/jdIPBfzKnwzmuu
+1m+YZvbOcxdGmARmHKRWu4KTqhzRzF5U
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/kelder-wg.key.age
+++ b/secrets/estuary/kelder-wg.key.age
@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBEcDNm
-ajc3a0gwYmVSdkowak1aakJ3VWZ1Rk50S1JIS0ExVktVSW9OVWljCjJqbUEySlNK
-a0xyT3NPK1BBMjZzN0RrLzhwVitvS0pzQ25iSnJSc3FmM0EKLT4gWDI1NTE5IHk0
-M2pkWHgyMHR1WHc5bE4xWTFDTndKdkhRdTg5bzZIWEU2cm02UDZBQjgKUUY3dS9p
-U3h1L1ZvTkFPdURLZ2tSYXJXOGNZZ21KVGdIbXdhSUJrd2puYwotPiAoL0RtO0lH
-OS1ncmVhc2UKVGthN0ZSU0ZFTTg5YW9UOXMwa3RnSzFlMjE2VTN3Ci0tLSBwMEMx
-Q0tQckd3SzBwUUE4SndMV01kUjVrOTdDWmxlcWs2Zy9TZk5yMzhvCrBXyLBZGuSD
-dJodNI13obTM3UvX6hSgQ8Su+J3fOKr5NibkhQ0Auvlr2tUXhhDm2WOUlHjqVTq+
-jWLSyhioDlIEyBgk8Zrl7KGeDzBi
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBCWDl3
+eTdyK2EvaVZNWWl6UmMyOXdGZ3I4M0U2dTZvZzg1SEc4MXpuTUVJClRWVjFobzh2
+N1VWeDA3eW5lcHR3TW5QUWZXbmpPTmxTdzJKa1hnTXNkOU0KLT4gWDI1NTE5IHJ2
+ODVMYUw3NkhjWWgyck9TOEFMdlBiU1U0T1JFY1lHWkFyYXlmckg3bVUKd2xmQU5r
+d1FjQ1ZiMEF4VjkrL1hiamNhYVowRFd6ZDdVWkVvSjRVeTM4VQotPiB0YH1CQS1n
+cmVhc2UKTlBTeVpKRkpRc2pqMWprMVVIcElhRjJFQVIxN05iaS9EZkFwR2FkRG80
+dmtMNTcxaHgrZml4N1pCZ0J3M3ZHcgoKLS0tIEY1THAvVm9jc0VXT1l2dkgwSmln
+QTlKbGs1MnZaL0lYL0I0Y0N6Y2Y5UDQKQ1Xo41y8MDzUvkrgJHFkrAAgVTQ/tPr1
+pDfzNqSn0NZY8rba44wDFNLv69e9fxecolA6SQ9LpKg15BS9MdRINULUKn1ZW3VD
+P1oYmXs=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/netdata/powerdns.conf.age
+++ b/secrets/estuary/netdata/powerdns.conf.age
@@ -1,15 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBzaEo5
-RzNndHBLMUl3Z2txdVZoOVJBbWsrTVJwY01WeHQ0VTBaSm5VclY0CnJLYStYNEI5
-VTN3dEQ0ZjBKaU1PZSt3d0lldkE5VC9wNHdWazNWV2F6WWMKLT4gWDI1NTE5IEJ5
-amlzTDhCOFF0TllPd2RsME5Cb1lRQUZPTGNvOEZnL1J2Wlpnb29GblUKT2t1NFZy
-blNZSHdxZjlHTlZmaTFYT0laQ1IwOCtDZ21vTjhxM0owdTAvawotPiBLYS1ncmVh
-c2UgRX0nVGtpSCUgNVNDWCVwIDBuPjM3MwplK2cwc2htQ2RLcFhUZ0RSc21uQlFV
-Y1QwSStOK3lKYmVVQ0J5RXA3Zytaa0JoMWtlWU9qMHBLNktFZWxtbFpDCnJyS0JJ
-WEcwbndYbERreFhLZlRyQ3E0czB5NkREancxZk5BTGdWRkR6N2NrZmFrbnhSYlZZ
-NElHNEEKLS0tIGVLdXAxU0ZaZVkxaHV4dEZNNUVuc2J4N3VRMzZzTktSMDY3bDVB
-bWtmUVkKigIZ3J0s23vNzmbzJGjSMGBXK6o6xnsA9HXeQZ13VgKv5Qv+UHu+Z0g2
-TeKdQSrHbDB3ydIxaiXsi2ivULdrIMCyd96rEJFxrkVuVqSZE0ehG5j+o8lKk4OU
-PDe70slbZrVYDSu+OOUOCVRSopZreCURlYn2Pc4rjvrMAn5r1r+/AxjZMdkmmQZ0
-l0wMBTus5zZzKg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrR0Q0
+SE5jV0c3Sm1Gcks3OUFZeDc5QzR4cFZqbkp4WVNZVDhWOWozQWx3CkZjQlc3RW4r
+cG4zLzFnNHpjdUs3NE5WZXk4NmxiSzJ6eEVXOXEwY2I1YjAKLT4gWDI1NTE5IDA2
+dzd5MFd0b3dSUmpiMzNwdDA3dWhwOEorWU5veDN0YXk2NUFUV3JTWGMKck5jdlJT
+eiswR1VqTlZOQzVtTGVOUzlWS2xkMll2Q054enY0cUJxOXlvTQotPiA6biFtSjRm
+LWdyZWFzZSB+MCApaEsgR1gpYiUlIH5IRWAKVURzVndnSUphTzdoWmhZSjFZNURS
+a0lOSTg5NThOemR2VC9jSVVMTmk1K0MyRnRQdUhVNzViS0ZqQmV0ZkxQMQoycXIy
+a2JyZGptN0FaT3kzendKUlRoOFBJNTAKLS0tIFNmUlFrM3U2T0lTd1IrTzUwdVl0
+S0FWMXRxV2h4SC9pdWpUSTVySWNydDAKt5pyhC3SbNgPEwRfxE2vHpiGoIOej1sL
+ar5C3X1RZFv2uDzH/Km7TWkhsqqRoOvtbxoLcZTAlKzNIG0KEwcFjpJRas86gd1+
+eZYjm3QtixvrLp2doXtTHfl3RLW/dLMVGFFn96tWlvecUPm7hwTy8ehR3xPVblY1
+5vFRZTnsh1V/9NRkFjBOwkfXdJtU7Hf1iRpgwg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/netdata/powerdns_recursor.conf.age
+++ b/secrets/estuary/netdata/powerdns_recursor.conf.age
@@ -1,15 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBoZUI4
-bEdWSW1pcDdMYVRJLzdQOWhsdTlZMmlyZjRVeEFwU3Z3NzVFa3lBCkxRZ1FYeU9D
-L2dramp4WFFlREZ3NTFnWUs3clVEcnBhLzExclVac1M2SG8KLT4gWDI1NTE5IHVZ
-bk9QYy94Tk50c1dVanNvNzhpYWNqeFMzVVR0eTQ5OXozMmp2VFlad2cKaEdvUnR5
-ZjhsQ1FRaittQXFkbnRZei85MmtWb3pXRVFsc0RzNzBPMXFMWQotPiAzSXJZb0RE
-LWdyZWFzZSBudCBGIDklTWIjVnwgM3YvCjRVYUd2TForc0gycnRBR05MbU90QmNu
-dXlmQVB2bnZyME5heXlyMUdGTmR6SVd5SHcrTThrZEJYRlpnUmdmWnkKU1lyNjQ3
-T0J6b3NPQ1FYZnhxTjFrYmN1UUJzMjEwcDBwSTJkTnlmeHl3WmFFTXB4eUVMWm9i
-NExUZzM2SHlLLwpiZjQKLS0tIHdqakpMSUNOdnlBcVA4RGJHR2d5QnJNT2dVclZN
-djd4WXBLSUhORktzZ2sKzMjxqL3UPrtGmXDijdfu0AwxLJooK7ZKauYvXWSuZUrR
-vl5i1QPMEEBYEl+NaZIFgxAFqWpAXHQ1VxSijMWxNjKUd1Chq0tbLrpbh9wXJflK
-SW19Wyqc9eTb8BnFoOSYWpDvAs2Lbyr2kJkOj2TNrwMv8nDJdOB8XIPlV5drCj1q
-Dx/1zWqm6NMYxsep6eZkv4AzxA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyAzVGNn
+YUNPRm45VTQ1YWJja0wrNDZnUis0UDFpQ2NvVm5zWWxWcjBXdkNZCk9OdDczR3pq
+TkVYVmZ5N0JMZVE4eWV6Si9qOFN0di9JWDc2OFE1L2p6TkUKLT4gWDI1NTE5IEJx
+Ky8zWjhLcXVQVWprVnJMQnlMR3hxRmVHTXgwZ3dhcmxwUWtoTjBPVkUKaG0rQU1k
+YzBmQW13MlFqVGJ3YUpLMTI0U24rbjZxL3ZYbFlJdVlqOGhvVQotPiB+LWdyZWFz
+ZSAoQl5NRDcKRHhzCi0tLSBRbmNGdDBxa0p4S2NKclVNSjlKOWF2dW9XMHA3K3B3
+bmVCK0s2WldDeU5vChTZYjN3rWDIVs9tkiMrdqWjcFBFJnoHZJd6Xqd9gAXVOBdE
+tNPc3n5Am9kJqNER2jcJCuVMuoYiqVqCElWq1JNYHzzL1+jPDy03blfytPU6nkL4
+g7DkAFUyzlpar4Q8tEgjWLG5fVPvmdxTXU+pcvzwFxDa7dJqMh1Lp/1AniY9fENu
+GLK25GqhzdzYakdnEsWWdUY=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/auth.conf.age
+++ b/secrets/estuary/pdns/auth.conf.age
@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrd0pM
-TGw1anJNaGoyQ3lMUis1cHVtRWFPcFFNZk9Cdm9TMEh1QTdKc25ZCm9VNzVQcUxE
-Njh2Wi80RWszSU5NczRNcHpVYXpRMzJNcDRsdGxyWVZsUDgKLT4gWDI1NTE5IFpT
-MEJVUkcycVFJaVFOUURoL29VT3R0MVJCWW04NXVRVEpKY3hlY1lWRkEKcENya1Jx
-VnBCMVBrZkc4VDkvMnZoTllCL09vQ0VOZytuMnRvYVQxL2FldwotPiAzLWdyZWFz
-ZSBCNX0gIiB7InIsfCAkOT9uM2UKUWpSYTZ1dUo3SHNaUlFibTl0UDhTaFh5Mk1n
-bFp2cjM5RGhqU0s0Qm50Zk1pUVZmT0R6ZjBoUG1EUGlKbHFzVwozQ2t1cWVDVVAv
-Q21QTjF3NW5UdTBZRldnL0RmSlV3QndHcDB0d0lvZ1RHTTByS1ZwNkNVQnU3WmVn
-ZwotLS0gb0Fxb2FsYzgwRjJwSUF3ei9hZVR2Vk1ORDlIMWoyZ2RTd09hUmtvMWpD
-cwrEjdaYfoGZ9i/S97xL9QvA/yii+sJLeuUzzv7a3DE661eQ5ezurV8Qz1tIhxWG
-RsOppaaj1podFx3U1x7QQbLO6zQbJA458RMjYgc=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBPaWFI
+eUNkNTNuYTRLTjA2akFybkNLQzdaOXNCSWZFaGEyTmRFUE5iU25zCkhtZEFzU0FU
+RDk1SmRtOGpQWlgyTUVGcG8yY3pnWnhXSjhMTzFxdytZNUUKLT4gWDI1NTE5IEZQ
+bGkyWjdZZU1XZFo1WTk1dVA4UHNXWXhITjVxODFjY3BLZk5mdkM1eU0KbjVKMzgx
+MEJzY2poekV3SXdLazdjVUR3elFSeUo2N01RUnp1VXdpbVc2awotPiBYaXctZ3Jl
+YXNlIGEgaCEsTD1xCmtZRDZjN1JwK2pZVlBrQTJVRW13NGdRSzZSNXV2cG93UzlR
+YUhsKzBlZmFmdVBGNzhiV0VvSUlNV0FmMmR0ZzcKcloxeURaQXkrVFAvUjcrQjly
+aDZWQk9ETjJscEdPeSsvUWZ3UW1FOUZ6UGswLzRHbmxQalB0MWFiK0dBNFFVCi0t
+LSBZcEQ3WTZJdXB2VTdWdVl2RFZEM09VSFZ2OVdRQU9CZjY3MTlyVU1hTjBVCm+z
+D0JiEYoHVIfMwIFjA3ZWLGjNqaKfkgHyaeuBaMVu/+hSq/kToIESepC/WdX2Bg78
+MdDauw3Ne6cWCukv8uAkgznK/G92W6UXKg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/recursor.conf.age
+++ b/secrets/estuary/pdns/recursor.conf.age
@@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBHNWg0
-WGRGZnlTdEhsRm96T0ZMOWx4UUxkTitJa3hMWDE1dVkreEtEa0RVClpvR2I5NGpz
-aUF0N1VZU05oWXUzTEI1TVBLYlVVang3Zzgwbi9teDVlQlEKLT4gWDI1NTE5IG4v
-OXRIbzhaZEdXc1pjTnRRWHVxc2ZTcmozSlJkY3lyOGtvd1BVeGprVUkKdUNqSW94
-SUIyOWtsNU83cnVOTUxNR1BvWHJPczdzUWc4aGp1MjlpZm5ESQotPiA2KSV2PVx5
-LWdyZWFzZSBqezVxOHc9biA+aD4tP20mXwpwRCtMUDhmcVhGNXpCZlFmSllpdDVp
-SmFZelNhZnJlR25DS2l2MlQ3ZGFtdGxkZEdEWVNrRlk1VEZBRm9GMHBFCkVlQ1hp
-WnhOTGl2R2s5RDRKN0p5TmF6Y0cyN3ZlR2pDZlhMVjQ1c0FJN3hCbFEKLS0tIEFT
-bjFiRStXMmJueHdsRm1nU084dDRpS0tBT21ENzZFclJXbE11NWJETm8KyMHU+tZY
-QELtZCbXKWnP8QC6V84JIFAxoRslACwsIJZpogcZO/IFIV2RGunGjCJk6QBmhOPV
-kJXRcGO/ndYjWfuU0U3+9HtPocnO
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBoSzZC
+cDN3UEllRTZKVWcvWExMTlJOcTJIbG9LZVcyQ1R6MVd3amdwVXlJClNKUGZKdjN5
+a01LQnNOL1lOekNCcjRuUTc5OHhHT3lVY1o1ZWRUWlhDMmsKLT4gWDI1NTE5IG4w
+dUdFOTB6YjVnOStUYXdBM21TZ3ZiSi9sT09oV3cwOWt6VFZvYTJpeEkKeVNFVkJJ
+b2lNSXNSRDdXbVg1RjlFT2x3dW9WYnNQNWVib2J6Tzl1cWlrVQotPiBdLWdyZWFz
+ZSBJOG17b0Q3NiBWUDFrd1NZcCBEIFtRSiQKd2V0RVlRUnRad3lGV0daT25hTkpO
+M01kZVZvUVhyZjBQTHUyd3I0UktoRHVER3g4Ci0tLSB1SSt0bkxKWUl3bUh4d3BO
+Z01reWl3RVpMdmo2RDZUUnEvNzVJSzVyRTVnCsL5btAUdWO+ru0ROIgNVrbIOysH
+gfnbLNYgF/S/kH+ahA9Q4zbjq4y4R+C4zYeCVDinOXExLXqsKk/gvOKp99tVCLor
+4AFK6Ol6tg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/actions-runner.env.age
+++ b/secrets/gitea/actions-runner.env.age
@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBOZ1RV
-VVpOZ0Jhd2x4YklMOHdkNkd0MEM4ekZiYXFKMjRIdXlZVDFkOTFZCkRreDZlK3Bo
-WmJ1MDBxSU5UYzRuUDMvdnpVc0prNFF4MjM0M1FaZmg4V1EKLT4gWDI1NTE5IEkz
-THNsVDVCbU9KYWpXL010OVRmNjBVVmVyVzhRZW5McVFJcnA3ZWJvZzQKOE1lQnVX
-Nk1rWVAvS1lpbDEzb2ViUUE4RlB5NnJOZmNoUGdUMGNuMk1iMAotPiBuYVwtZ3Jl
-YXNlIHdYXzh3MSB0TyREIGpdTjheeQpJZ2pYUyt6UC9vVmRNZU1uaDdvR2ZUNG0K
-LS0tIHNCRno2V21tZU9XV1UwR2IvZDdkWEMzZDI4V25Yb0lvdmJadXNEZFV6TEEK
-81uT8S3QJNe+mVadi/VpXSPEP0Ygzm0/+1pB5qqYlSQEWTHqS55gCyFCwu+sjaDq
-DpYTSm1JAk5ql9NRj4fJvCS53lJZ4zo+5c0iJKmuRg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBIMEZW
+aFY1bk9JZEY5YTN1eHNLNzh2STdnVUlFaXlqNlZNQVlSZWhkblZRCmhVa1BROTFo
+S0JNcVdzVTMyK0pNTUhlQmpDaks3MG1naHdHdGpySGl6R0UKLT4gWDI1NTE5IGVC
+VnFwNFMzWHdIZFB3K0Z4aVNTSXFaaUJpREdxZEc3N05JL21vemp6MVUKSDJEOUx0
+MzZUVVY2bGwvQjc5Z3BWOUdFZ1o5ZDBlYXZHeG82VVpHZDRLMAotPiBmLWlSentR
+LWdyZWFzZSAoNjkiU2BtdAoxMVZSeEdmM1Brelk0cnJSV2ZWSVRBK28xNDY1R2VK
+enJGeDI1eHFURFZJdEJwdE9XaEtqVDJsanVFUFlOY1UxCkhCQVpUc1hkM285cmo5
+TzNUcHcxL1U1WUdjTQotLS0gb1lIVnNWUUN5SVVLQkxPc0ZJWnF4K21TMDZ0OUlp
+ak5rZjR2bTdlVEZJSQqtDNO7Rm9G+7rOSLYzqOuiel0fCWGHPslkLj95g6L/Yckd
+vC/+s5Il9crZEJoCFO/7DDHe3KgQXcMMIKnTbgxtNqh9R+MI63CarYtoujq3
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/db.txt.age
+++ b/secrets/gitea/db.txt.age
@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBBOVJi
-SXdGVDlXWmVGZUM0OTJPUWFYem5qZzAwZWxhNzhpT2t1VjdZU0ZrCjYxWUE2VW5o
-cGFLZ3g3Y3BpUWlWOUtUYTg4MGZXVHZvdVV3eU9iZW0ybE0KLT4gWDI1NTE5IDIw
-QmxaWTY0WjJFZUd6TUxqaHhRelpRQ1hGZVBEcm43d3JYUVhpTWp4aGcKVzhJdFFu
-SEhUUUZVNVk1N2tzekpzUS9RazRCcFBhb2xxbkhRNEwzVys5cwotPiBkeE19PHEm
-LWdyZWFzZQpwR0xsb05JVlFXQTZZQkJSWHY0akNRdjh1eXFnbmFDWUlCM0xLWXBi
-QkVuanloRQotLS0gZTkrT212MXdsZy9Kb1AwMkFHU3VsTElweGNlYkZ2UWVXRzkr
-dnB0SHRnYwrveLSY6SdUDO+QH7WGniLIOPcECTQ7CiTj9lwD5Hm0rYLdvizolb33
-CsGX/kSEI2bD
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBuVkFm
+akZuLzFFQk55cGdzRk5MM1dDWTlwQktnREpScUpkbFlFMHh2QkE0CmxjK1ZQd240
+RXZ4V2VsYjFURndVTnJCbGVkM2R6WjkrN3ZSQ09nL0xPM1kKLT4gWDI1NTE5IFNO
+NEJYVDVzVFFhWkFkcUJ1alZnL0w3MUFwM1JDM003Zm5Kb1QxRW83UkUKR3lkSFAy
+TjZDOW5lM0MzNWlYZ0NyRUd2VHhuenRXdzhINEk0cUxGN3hoawotPiAkPWgtZ3Jl
+YXNlIE9yRSA3TlFnLVFTYwptWEJCalNTdXIzai8zTUpFNjBKOTZXRFJPSUVuVWVJ
+bVN5cC9nVkhnL1BXNWVTV3ZNOVRrMmNXSzZPUXZuZVlxCksvS1hsd3dJR2VuR3J3
+cDBaM1B5MG02bStRWnJFUndva0EKLS0tIGlWMko3bHR3NGdCSFU3L1R1a1p5aVV6
+T2FrTmE1OWxwd0dkeGJMWHE2MUUK8hoazoNI4HD1S2GC2NRb41ZF9yf25Qr3YsZE
+ivkpLPzXy8kjC18JwwDmGez2QJV87w==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/mail.txt.age
+++ b/secrets/gitea/mail.txt.age
@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBrTW1E
-ZDFSRXIwbXZXUlNJbHZCVjFzMzRxTmdtbDQ5eWVOWWp3SEdSUERrClVMeFRLOGUx
-U0dmT2ZUUXlCSGhJdE5ibkZLMmZ2VmZFWU9PQXpGZFRPQkkKLT4gWDI1NTE5IDIw
-VXd5N2EwTVdhdkRYeVF3c201SnV3TmxnUGpOZWY5bFJaQWRWMWxQVmMKR2RNc2pE
-aUs4ZW1XSGU1RzM4bHZYQks2cHZWUkhZN1hob2d1QnM3cCtlMAotPiB0XENxMSct
-Z3JlYXNlIC5LIEIoJ1w6Ci93eE5lMUxDQjE3dWI4a05wUE5sV2dWN21ZN2lFRThv
-YVJGNXNWaEtmbjVMaXhnemVuTXhOMXFtNkQvbGNuS3oKalZ6bEtGdHcxYnZNb0Zy
-YnlGTDdoVVdyeTJpYjJjZkc3alUyV2ZGa0taeEFIYTdiRnZmYmRjR3BzNUp2Ci0t
-LSBROCtSMzFNR3hTK1p5NVhGcFpqM0U0L0MwbWpzNUNTUWUyNEVXbzFFMGpjCnot
-A6mYbp+jhpoyjZidXQfzLVcu6y34WqAfJZsfT6l5SJONVfSvSw+iP7XXW2T5OnE=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBBTDB4
+aitJOHhDS0liamE2aVJPN2t5YlpudGpLWGtZOE9qVGFvalNwWFY0ClFHSzFENE1D
+QlIwZGVJUlhlWmhxdW1wRFlIRTdGTGZ3T2d0LzdFUnNsaE0KLT4gWDI1NTE5IDVR
+S2E4bFVLekJZbmczVnVGUjF4RCtRMWVoOE5INWVDTUFaa3JDK0htQzAKZGY0UUZa
+dDBucTZCRnBYbHAxTkZtbzF1OEhvalFuTkR5MHZzYmJ5cVl3NAotPiA/WUM7Qy1n
+cmVhc2UKeStlMFRNQm8xYzk1UDR4cTJxSEEzUEJyQkdRREoxbzdLZmhpZGwvMFJM
+RnYwYUVHUFRNQVJjZGdnbU1Ea1EKLS0tIGdjb29GNVErTHMzWHUwckJzYmd5ZjUy
+ditNZGxiRGdXWTJ2bG15QlVvRmMKbW6LYZpRKW8IyATjS56cL3io4FGo9LP9Qv1F
+wXSJ//BMnY6u5+eFyO6xqYK2C8pfBw==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/minio.txt.age
+++ b/secrets/gitea/minio.txt.age
@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA3dDEx
-SUw4QVh5T3QySHFFemo2N1JWTjNCSGRiS1lmRTkxVEQ3S1NKR2dNClZNM1Vwc3dF
-elB0Unk1OWpUb1RQMVpSTUpJUDNrZzFMWkhKK0l1dXVBYlkKLT4gWDI1NTE5IGRF
-TTZlMjdaamlwTUJzYlVkcVIxbmtybkFwakVtK2craXVBNVZraGZ1VlEKN2VvaU5r
-VjNRS2I5WE9kVDhES2dWTUV2cEVJaXZxNzRUcFo5blhGTDBaawotPiAxXCJQemxa
-dS1ncmVhc2UgcDphKHFVTGUgIUonYydBPgowQnc2Wk5yS0E1bVBCWmpOc25MWWs2
-UTR1dVlJbnNXYUVJSkx5bWFIcmtpT1lPSVE3b2Zpd0JaTGZWcEtjelFDCitQcy83
-bEVvM3FNTEhyWVVFS21tS0VQWG5OOHFza28KLS0tIEZZeUZwVGxUdEdtQTZuYk5K
-SHJaUDhHZ0JqbGNFSjJCaVlQTVo0OStkMWcKz/w0SnoHxnw71gr5DbXgMl59Kgjy
-SW4tzNGeRcX2j4YdRjr77TP5UAzpQE30tEcrtw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBDNzl5
+NjlaOWJ3K1FlZ3JCN0JSb3N4K1VvdFVJbURuNjM5QUZYdjdkN1dNCnVKT3p5WXFZ
+aENNVXozMEZ3TTNzbXJpamlrL0s0cXljbys1RmsyVzRBMDAKLT4gWDI1NTE5IDAz
+dUwwRGhGREJiQTJNSGRqTXpFR3JuSGR4allyOTdNL2o5WWxacldMaWcKRkZ6VWgy
+Z3I0T2hTa01xQWdWQTBwNldDV1FBSXJrL1hGN29BMVlEa2t4bwotPiAhQUVXLWdy
+ZWFzZSAnJgpYeVMreGxSUExWa0JuUFNHR3QvWnJIeDBycUVwVEZJTlpWakdxaCtm
+ckd4VkMyb3E5c3NsR0lnYm1Ia0Q4TVZ3CnMrTVRmTGV3VUM3ampPUUtmcVNhbk5q
+aXVuUjZya1h0dG5nCi0tLSBFZlZyUEZKSG92MTBqOXhYMWkyM1l2QzJZck82WWd3
+Rm9wQzhxZ3lNQTVrCoIaIO18v+FQdXXdTqp73b0F7E3xASNBXE0jmZ2GxvNAVIad
+hW4NcZTNQBvrsZKGk/8=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/home/ddclient-cloudflare.key.age
+++ b/secrets/home/ddclient-cloudflare.key.age
@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBNalB5
-RUZRNE1CTUJsbW1kSkxBSWVIcG1RUnBKd1gvcnRQVkZCUXFOQmhvClJUN2ltbnNk
-T1grdVJSTzIyNTBTTGVEckVGQXdYNHdwOU5NbW1md3lGM0kKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIHZ4bFZSS0huWFBDbUhNcTd2MFhvV0lOY1l3d3ZXNU4vT3dwMmlI
-emhoV0kKcDF4M0FPK0JpclI5Q3Q5WGxpZWVYbHVWbkNWdTArclZsN09XK3VJSXc1
-awotPiBYMjU1MTkgRjRCNVZmcXVnQnJ4KzZoM1ZkdWxYUkJTM1JuK3ZlRWJYdkFR
-WXpFSmR4NApTbU5qR3ZuN0ZmbzIvMTFsMkdNSGJXSVlrVmZPdnZvcHFiZW45SW9I
-endJCi0+IDEoIjlcJi1ncmVhc2UgJUE4IWl5ODkgfGVdLihEfT4gWCAreSduPS4K
-bkI2Wm9LRGJXdW11aDl2VgotLS0gTENqYjZEUUZaWVZEcWQvWW5yTzJEdHRLeDJm
-QUl5aytXdDE5QVMwVHZVSQo+aDbaGNOrz+hTSUQ4IAjDC9EfNwrlXDZtBqw8HkRv
-1/Rr737scjrM7Bgt9zuKn6CB0zdeHTW5u685V2hCW/3aTy1eppWMWj3r
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBaVlB5
+Ky9mc05ZTjZ1Y3grOTV3R0QzR2xKNWZhUjJjTVhWenpkdmRBRWtVCng2MmJMZjIx
+aFEwcGRFTG1YTkhQWkVuT2xMbnZtbWdMazlEUDRzVjhTbzAKLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIHlyN2liK3pWeGRIdXVmOWcxUzBSRVJTSlJhcUdaWi9TRXdqZUNB
+YTg3eGMKYmVyM0ZOTEV3RENiUWk3TEhmM1hqNTRJVVIwZDBpaUx0aHRSNitEdHdo
+awotPiBYMjU1MTkgemRaS2xzTTNiTFpWeWIyRnFEZGkvTktJaGIvN1pqVmxyYjUw
+WWcxSEhIbwpJTStRUzZyUHF3cU5PZmNqUFdvYUhuZXAzNFRrWHB6L2d6VzE2R2tR
+VkZFCi0+IFhmLWdyZWFzZSBSciFXQVhXUwpQcXFqVEpKMVgxNGFXcVhlNlpGSmRk
+ejIwVVNCV2ZQNSt6ZTFVdwotLS0gU1JSZis0TWZ2U2hDRnZ2L2pjTi9vQkVQM3ho
+YWFObG5OSW9ub2hYSXU1YwpRT/yTLKhFr2QDaxL/Qu9uBB1yXyN66zG9wqBpNEHc
+2Eg96I4hBN1+TkF0HXvvhrJiQ38CDYgERniCa2+6T4qx9F+Sn6OHNM1I
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/home/pdns/auth.conf.age
+++ b/secrets/home/pdns/auth.conf.age
@@ -1,16 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBFb2hL
-MCt6c0I4Nm5SMFhEaWNZRTRtNkpYeVQvVGFVZzVqd0E3L2dZdzFBCiszUXZSVENo
-cmxqdVFwMFA0elpFOGZoM3B6SW80MEhCNlJoRXV0WXpUeG8KLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIHQxR2MrakZmRFJMcjhabGFON2xQU2RBSDNvRCtuV3NwNGJ2bjZF
-b2lCQVUKcFNzM3paS1ZnWk8xY1VzVmdTWndMK0JCTU14bUJvM3E2bjR2TmlTY2tF
-NAotPiBYMjU1MTkgY1MrT3ZkN1pUd0JVb0JWSDByNUNRd1NUd2ZiNVJrc0JCb0J5
-NENrU0MySQp0bFpwRXRZcHRVdnN3eitkNHlWc0c0a0NmUjVYSVFXSVNFVHI0b0ZB
-U3kwCi0+IHQmKm9ERFdfLWdyZWFzZSBJIFkvRG5JIC9ZI002bmkgNX1hQHcKc2l4
-S0N4YzgvK2xqZm1YVkl4ZlF1REVOTGRWOVZRQm80R2NnczlsdFlhTEd1RmVoNjZa
-KzlkVXNpbGZsNTRybAp4RDlIWmRqR0t3VjF6WVlSeTJ4aGZBd1dDNEpMTUhZenZS
-WjZCK0FZcXJORkJwc1piS1FvSlkzc3R5T2s3Vk0KLS0tIDFPODlkZ1BSWEhHUHJK
-QjdZOE1KcFNvcUYxYlFkL1FLNVJETTkySVNYRTgKOipmWGTV9SvGE4KVqgQqGw4e
-CLP4PYlgdSmOATTIg32G/GVTM8NlvaII3q2GNS0Enx7Y8YwnwS2dGkYKVN3Da3b2
-WJwMiBZRu/PC
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBEdGdu
+Rlg5UG1IRFRGNXpyT25LaldEMzVtRFlqU2ZGcVN1UytVbTlwaENvCmdEaGM2R1hw
+UTA4SjBlY056NE9ha1BvZHFtcnpGbVQwWXRoNVM0YTBTV28KLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIHFPc2VaS05pK0RkR3RxU3F1YkZGanZOUHc0dkplVmE2V3RaNUZt
+RjdYaWcKTFRndDVoN3hoWTRjWE1qOU9DZ1hMMzBUTjVGdmhuWUhYNFluaExETi8v
+YwotPiBYMjU1MTkgM2oxaHRUeVZQeVBLRE1kNTJwWXgwcmh2YXNRZnBKc1hvRHNG
+OXFLdG1XRQpuY3NwWUx1WE9SY2h0RDk4WG5Ba01oWXpuQ3BuNGdVeC9uanhjWEF5
+YUlRCi0+IE1LZHotZ3JlYXNlICZAJmhqKGoKCi0tLSBCMktCWkY5N3lGTG9BQ0tK
+TFhlbUZhUHJBOEZ2ZG84YXlITWtMdHNVSEJBChdTeXiW23QUC7Am0fsto/YKrU95
+GPix08xVSBgsguBWE9N0BUAqzhXSW6etfHloXx7UsIgjCKCOb5WV5G82WGFVB7oL
+Peie/FJEaA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/home/pdns/recursor.conf.age
+++ b/secrets/home/pdns/recursor.conf.age
@@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBjbUF2
-VXYyVkRud3JFU0tDQThjQlVMTTFaaW5uTkt3K2dmd1pleTFOQm5jCkNUeEVqSXVX
-RGUxcU14Z04zMlRubVIxV0VwazhlZlFtTCtXT2dVS3l4b2MKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIG5SRTFOWWVIMU5yK3VTdkVtc0VYNnFkRXFrdEpiNTJIRHBvVnky
-OHRyWEUKVXVvZlBBR0dsUXFMa2dSZ1FWVWpvZGlwcHJ3YXRscnBoaU1FWlVFYTdt
-dwotPiBYMjU1MTkgMWlBWCtSU0I4Q1I0T0JrZ1ErYzlHRTZsUHhZQkpYQVJGNnFy
-U3ZPeU9RTQoxaGZDYnRaNjBRRGQzMGNsTmZwcjhBRXdLeEFqVWxoT3hNNHk5cU9C
-Qk00Ci0+ICF8Q0EuPSIhLWdyZWFzZSBKcCp6MgpaTXQwdEllbmhRVDhOQTdpb0RU
-T1VGZmdZK1VEMWdPUXduYWQ2YWx5aDFTQ3ZzRnRWbFRGN0lWUU5iQWdPakpZCnl6
-MnI0SE5sS0x2MUZibW96SllDQVVOK2grRldPOWo0VSs3SkFUN1dqS3RqTTdPZG1M
-eHI0T1BHK1F1cWlINAotLS0gckFnWkoydklhWHZhZHBkSkN5ZmdadVdiMU1QOUZW
-VkJENWlHVWNXcEVsWQqYscIBmSi//ev3IN2ax0Ei7p8Atu4nYQui7yoY/1fiyGQL
-DB5+R9Dm4YUNHt3bjrBYclLohDGdLUnOB00BXUqNmlLm4psL4Ey5Go8=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBCb2cz
+VXdzRUNLVDRZT0VqbjQ3VlllWk5ZYWtxY2RENXpDT0NhMDU4elFRCjhrVzQ0Y0Z0
+OEFuOHM4OEo3K3pvWjVxanZDR08wTDJieVNEeXFNQm9Lc0UKLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIEw3K01RS2t6NDk1Q2w4UTN3cE9qdkdZLzEwUUVOcGtBdVZ5YWRu
+clEwZ28KTHZWQjhMa0t4dkMvVzlFcW0zWXl4UVpibjFFc21LeHlnTXU1MjQrcXhj
+RQotPiBYMjU1MTkgVzZUcW5tOGdqZlJiWDN0WjNqMFJGVnl4SUVNZC8rRG5kTVJn
+dVA0QUhHRQp6UkRaWVowNWFwQ3J6UTlJTlFVTk92ZERVN3ZkRnRUR3d0ck1HWlIw
+VlhNCi0+IFhyMVgidTwtZ3JlYXNlIEN+N1IgbApxS2tENktCWFRGdVdYRC9VSU8v
+anNFMlJFQVAvbzlrcktkVnJ4WFVxb0VWaHI2a1l3dmFMcmNDVUh5L1U4SEZJCjdx
+bys2dWk2aFdUQnBxcUlwS2FxYUxqZmVJTDAvZW4wVlU2T0lJYnR6YjVkVWw1bzdC
+Z0kvSXFhWUJ3UEdqaWEKVis4Ci0tLSBxZFhjSEUvbTc5dTNycFluUDN1SjhkRis2
+YkZnWlVBWWRrUmh6T1Q4RU1vCvVxHQ/uIqakQa8Mn9Eq7WfdXzApmNAcnGIHN92c
+O+LKqQ4Mfv5QTzYtzvUJN2jz/SDmeZczTCO9e7iOqQ1i7TrAe26SjzzjVqq1RQ==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/airvpn-privkey.age
+++ b/secrets/jackflix/airvpn-privkey.age
@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB1N0V0
-UW5ZKzQrSlFUMnR5QUE5N2Mzd0FvK3JCeFM2RVRtUklVQkNkU0dNCnJuUUxjQjcw
-NURFOFRWRG5WSnBPT1dOVjFNQWZVUjJUSU9WVTExeS9XZkEKLT4gWDI1NTE5IHdq
-eDhJSTZKN1lQRXNaZzNIWEx4NTZINzZpdFRPZWJGcys5SUV6bmc0Q1EKeGlqTjF6
-b3Y3ZWNhcjF4WlpOcXh1OHBucmNCZmp6VTI1MXRjN1FlNlA3VQotPiBtQ01Dey8t
-Z3JlYXNlCnFKKys4Y0I3RkE3bzl2NDJ2aDNMeTRTUUU4dFFwelV3SjVReExnCi0t
-LSA1QSthdHR0cVE4bXhiczZqUTNJdzkzdnZ2TEpESWwwQ3BWNnoyNmp4ZXdrCl1g
-oNwCvlTrPx5b5l0OUymxMo1HMCV9fsQ9zyaoJoPFN1hv7l4hjjX5oVoj/IdTJbbe
-ZMs1yqa7YbR4+HG9GG8nPhU36hchSN2whoz8
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBYTVly
+aGgyRHlKdEpVTXRRR1Y4QU1yN1BnbnJPVm16Q2Z3MlBwM3VycFhVCklGTHFtcHIz
+Qnd4RUMrRGl5RDd3Rk8vaEI0Z1lIQVF2bmY2WldCdEpTR2MKLT4gWDI1NTE5IFhz
+b1AzTzZmcXhrdUkyS0E5L0doZ09ld1JZVzVCcjhNQzMyakFjS2plUkEKU0tEQnl5
+eDZZajV5RloxYWs0NThwOXZHVjBtampQLzRNUlhzQUVUWFNKcwotPiBjLWdyZWFz
+ZQpwaVNVcXI4eUErZm5STkxRVVh0MFFPOFY1bWhPOFVHcVo1QmRwUVRWNUhjYmJ2
+RXFMV2xsQ2dFCi0tLSBSS0xlK0R4OGN4Mm1CYUJ5TmNJQzBVSFFyL3ZZKy8vQXZy
+N01OMHFjalR3CqeMysLSZi1iWQ5U86rNMUC2BR8Y17cBq/ZjMBs+6laXxjYrLcQh
+M6PEjYQuYE1WM3l9Wq9OJDxBKbCE4i7uI27C/XlhCkwpGjTCdvQ
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/airvpn-psk.age
+++ b/secrets/jackflix/airvpn-psk.age
@@ -1,11 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB6dGZN
-VDF3ME9IWWJMQUVrbmlKeXhZbzE1THUwVWhBc2ZBQXdUUkpod0FzCkVncGlyTXVv
-bmxPN0F3ODdvUmw3Sit1cERNTXN6YWZlU2IvYUhoUThER3cKLT4gWDI1NTE5IGQ2
-RzdCWUw2N1BHWVhiOGhvNEdzQVlUanR3emdDV3FUTFRXUDB3RDdrMmsKZDkvWWgv
-MFZhbHZtVDVQSWVEQ2NxQUZrOXFMVmYxbEU0STFJTVBzZm16ZwotPiB+Ty1ncmVh
-c2UgMnpCPlV9ClY2TzJGcnBrbUJTU3lyNVlrNDdwYTd3Ci0tLSBHaU9ZVnZoUkx5
-QnE4UXhMdEg1elE1dDRoQWx4bDhBMHNwS1BlQkRaUm93CspT9YnuzfpKxC9y6SWJ
-JRyT8aFEJTjoDEqN2I/DBwRikSxKyspHi7grCwFaoofylqJzsP/In7Xlf91xbMXz
-njjXbBQQP9PG3Z2c0OHk
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB5a1VF
+WC83NDBzTVdVWGVpdy9oS3dVWnZYMENIMU1BNjJrWWtEU1UzNGw4CjF3WEVDZEs3
+Ulg2ZDFrTjVXRmI1VU5oRlptQWIvU0R2ZzF0VldMeDNySVUKLT4gWDI1NTE5IFVU
+dkVKdHBjbVJaVTZWZjcrUk5aajVyS1dEM0YwVHBLZU4yZ3laQm8yVlEKNlI3WVNX
+N200Rld3bkZNYStUQVFWZi9ybDk0L1B1cXY5NUhyMUNCRzBrcwotPiBKMEw4LWdy
+ZWFzZQpiNWxxQk95Qnp4T0dsakpzWGdLajhESCtTbUFrMGJzRG40WGZoYzNNME9v
+VlVRNjhlWlEyM0tSa1RLSEZycUNNCjVGZWdCZlh6QnlpVjJjY2NSY0ZFaXBpS1FH
+QzVxR05xbFpENFBlc1UxR0lWWHZ1OVU1YU9US1pwVVE5MHJIZC8KCi0tLSB0dnha
+ZlhkZUY0ckwwN0dpQUJxbVg3dzNYTkFPQmR1MzR3VS9vS2dmNU5BCpfV2N/8Bkci
+HDA0vQv0/AZnglUxqXKnQXN3+Ipf1mBIYKlA5ZZdFGChh6Ro+LcI+b1BJdRcEgIi
+gM1CN7Yph1Aj7b1lcadD8t0u4WCO
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/photoprism-pass.txt.age
+++ b/secrets/jackflix/photoprism-pass.txt.age
@@ -0,0 +1,11 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBoWmM0
+NktTeDViMGZETVdwRFdCY1hmZWg0cy84WGVzdWxuQkI3NkpFL0cwClF0cHF3RFNt
+OHZORjVrOFVXdllMdGR6UWtpTDN4Uml3ZEhxSFZzb0xKNUkKLT4gWDI1NTE5IDE2
+R08za1huaWZSTGtzYkR6cVNLbEtJQVhkcDJEemRMbTdkS3JzbVZaekEKdFprd0h5
+eVo3WkJlb3Uza3JzMmNmZ01qWUtIaXpOcVQ1Y2w0MEZxandBbwotPiBNLWdyZWFz
+ZSAtYDU/NXUtIE4vaTlBJTwwIF1fUD8gcU41ClUzQ09ITjR2K1dTOTNUNVczblBm
+Q29zL1NUSkU5b1RmQ1EKLS0tIGI4UFlxakRta2drNmYxK1BCOUFzZmdGMlNKTFdh
+Nk80cXA5NU85NWhrMUEKnWC+dGL2xPeu7dzg5xKdOoEC2Se8uSOZnvP7ioF5QKRK
+RLeI9lmOOt4zUR6mYWCCPQNIAg==
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/acquisition/airvpn-privkey.age
+++ b/secrets/kelder/acquisition/airvpn-privkey.age
@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBaUm1C
-WGJDSUNtTUYxbHVnWU44VkRnY3F6cTR0Tm1EUEdDYmltWHBrL1dvCnMzSEFqZTdS
-K25tMkdkNEZ1dGhBMVhSUkR2M21EY0NtbnJjb0R5RVoyTDAKLT4gWDI1NTE5IHhv
-RlJOd3dCa3ZaeE5JS0ovV3ZiY0N5QThNSi9LaXQ5d1JIa1UyeVFJekUKd216RGw2
-Szg3VG1PWUVweE9udFpta0gxdWx1NEU5ZmNwK3hMdHdZNlB6SQotPiB3dlxKIXxG
-LWdyZWFzZSBCLGsgWCU+UWwKWXVYQTBqVkRMKzNsU3JuWmlQdVpzdWJWcVdwVUM5
-aHpmZFVPbWlidHJEYlN2M3NvUWNqVgotLS0gZHhwUlE3YXJSdHFkdFpkTnh0bC9a
-TytZcmtxd0pldUg2YUEzMFJ4QjR5dwqaUnjT3oaUunudOqNfh9twKyaRttf4sk9G
-uiiKoEa314HbI1vgS4iCNX4vG+468SECiF9llZL9U1w+1MSF1y1BKy7XrDCsp7Xs
-HiA2aA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBMZm8x
+RzAzWXRlQytFSUxRRTk0OEtVOVlnK2ZaU3Y4TER3TmtYcDdCcDBZCm9wbXRlaDZx
+UlVkRzcvVW5EQUFsMVdYamY2aHU5SUN3T0tQOXU1Q2grQjgKLT4gWDI1NTE5IFNW
+UUlmdFNBMTJWcllXS1lUWlZJZ2k4UE15V2NXeEtjaGlocjZPOXJheGcKbERWck1a
+L21ISnlCeU43YjdSSWp2ZEFyMGxBUnVjU1RSbzFPN21rQmpJZwotPiBrUT84LWdy
+ZWFzZSBTOCB0bU4/OApLNFRZVTVHTFdSMEYvNlIxMnhXLzJXZkF2V2pVS3ZLRGRM
+SHJUekJRakRtZUZTdndwazV3ZEw5TkdWVGc5Q0N6CjUxdnpmY1JTCi0tLSBPNklL
+WDE1cmR0ejZZTG9FUlUzWG4zS0V0ZlNTdU1QU2xHdFpNVHFlS3FNCs1z1hVkviH+
+1d1Wqu0s0Lt0xEWX2xk+xpJ4QAP9E8P6GdoMBT+bzGxfakRuwDWUtng6dd6SK41A
+aIIAjWxFfdgh4XcVuZ0vpGls/Hmf
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/acquisition/airvpn-psk.age
+++ b/secrets/kelder/acquisition/airvpn-psk.age
@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBIdGI1
-UVl5bVN5TDUvMTRuVFdpdG9lSkRjL2hOTHo3OVFxQ25IMDRlRGdJCm1oOEM5Rzlv
-cUljejB0aUNCS0x5Qjh1Y1JWQTNmWE9kcjF1ZktJVUxLSUEKLT4gWDI1NTE5IHBN
-Vm4vbC9GcUdaYjNlWEg0UUVTVVVHWG5VTnVPRFBkUXk1dm8wWlF1QU0KZEU3dXFR
-YU5GalhSakF3OEduSlhuYTN3SVdFU0NrWmJBZThvN1BGU21TUQotPiBdLVQtZ3Jl
-YXNlIElWPzRFcicgYVoldUFzClA3M2JUNFU4T2xSRmpyeStMQjZNa1I0bmxLSUdj
-NGN6NkFvbmJEVWJXSEhCMjhkWjhyZkZPRyt5N2diZDI5SGwKczFsaEZXbDljVGQz
-cnpMcHpPdTBPL0hwb0t3dE1XNURWckVEOFZmQwotLS0gbmQrNm9QQkpxTnYzTTFt
-bHU3WWVDai9BY3VSaTB3NDN5bk1IdUNiMWk4NAqyrvPkq+FP+fSs9mZMgxLTJICD
-5l8Ii5h9fl2APzedygOLFGQLq0qW7pjBygfmQWgG4gqsO4iKIwEjUiv30/QCUhKL
-CGZJpN8AfZAcow==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBnVWow
+SHJzNi83TGFQMDhqMnpBd0RrVldSSzZjMWh6VG01ajgyOWJzNTNJCmFTR3pUeWxH
+dHpWYzlqZENheFFHay91OTJVYWR5clRKU3ZiNm4ycXdwZW8KLT4gWDI1NTE5IGJx
+amx4c0tVQlcvdVJneU9hazQrZXFjbmt5T1d0US9jMzAzUkR5VlJEQ1EKR2UvRTBQ
+dlBqcldaVk05dmNhK3AwRk1iM1l3TnEwNVA2emtDVStibFBHZwotPiB5Xi1ncmVh
+c2UgRE4gMXstKDpnZH0gVSlMbSJcOkogUgpaZXcwdHdxVEpXSTgwZ2oxd0NaczNY
+eXlPOWxpNGxHMEdJclJnNGd0dWlwa29Bdk0rZG83OWxyRytlSGRGOXF2CmVLUWs2
+WFV6TVRaLzNGZGsvY3pJcmlqTm1vVUNwMEJVVExVNnNLWTV4K0RweC9rZi9HVUI0
+Rnl0NEx2N0htazkKb2cKLS0tIGtZbFdSTTRia1RjWm9pM3RGekRhWTJXVGpmWk9H
+azZ4UUhjbjZEZm5XVXcKiJfvO6GgQkA+EOJGrZtidms+p4plupP9w7P/Ukgh3Dl+
+y60gpsB3Ibpm0JlKSan2TO97g2VvmBZmP8o7NBHSM7w9SsU5E5igeKjJdLU=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/cloudflare-credentials.conf.age
+++ b/secrets/kelder/cloudflare-credentials.conf.age
@@ -1,15 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBSdmly
-aEtUTHh3Uy95ZGhEcno5VktOcmlWYzVqUTE1MUs4NDg4WnZBT0Y4CjY2QndadEF2
-TzF6TlJxall2cW4zeGltQVNabUJkcWNCUDRwZXpjYXJubVUKLT4gWDI1NTE5IGVL
-N3dkVDFuSXdXZTFCVStzSCtCRUJGWUd0bnNGdnBhUlIzMExSNjBqWEEKOUdvZTlK
-dzhyYWUzTmFzbnVxRTZRNHZ1NGFXSkJ3ejM0S0JCTGNpcHVzcwotPiB1dS1ncmVh
-c2UgY0NxK2VxdyBdRE8vQSV1cSBcIFw/TG8jQwplZk1ZeTAzUnZJUm1qQ0VxUGpU
-NU1waVZ6OXF3NXQvS08vblYvRDl6TzF4RUhvdW16anZWcXdORTVnCi0tLSB6ayth
-aWRVUGgwazBMSUk0MEdETkhnbURkbEZXUGNCNnN4OUdPMXpkelcwCoil0uw2yDNc
-mOUMhVzALll4DgCX/MskwCdYohSBnMpSzqtltAhkW1aqdbuU3PC9LHQElpuHqpl9
-leNTu6n5nU5BHQ5qWShedL1G11SRzcblImwUcyg10d6Z0nUoCUjmw3BnGQ2wwvhC
-M+GGeb9X1ORRciqprtTq1WXWGG3tYgL9SjTAEtyMhAZ3CFjh3p4BdC9pVhCAJ9TA
-tbRAtqIz8VTzG86G4zPJYzBwtAse8tJDEO40GUqcOsmXhmPPpd7je1k381+GVrMj
-q2g2gTCUOrMryVRX/7+H2iRxtIxmhqESXIWgY5SIUv9uRA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBMOFFx
+WXlGdk1vVSt5TmpKakNjM2lsOWpwem1BcVNFdTFIYnBobDNxV1gwCjBWZ3J1ODhp
+NEZucWppYWw5TmRXREtVU0krQ2FGdmZadVNxZE5lNTV3MTAKLT4gWDI1NTE5IGRi
+bXhPNjlOZ0lVK09UR1VmUlIvaWxiVnlJMGVhU0c1YnRGNFdQNnA0a3MKQ3Zra2sv
+dGpMSFZDNWk5aGc3YWVNei9XV2tnMk1zTnhZdnd0UmRQSFpVawotPiBOayUtZ3Jl
+YXNlCnJLSmQ4dE9SakhJcUhGbys4UlBTdFJSNkkyVmdKZmJpbnRjdTduemFmVlV2
+UHh6c0poMUNSTGphRW1xZWpHbGYKRENFRDdUYUFFSnByQXhhc1I1Qy9VRzJVdzZK
+akRZOEFpUlB5VEhZVjVzYjJXekZNaGJiSmZCNThld3NBQVEKLS0tICt2RkJkaGQ4
+TXJ3N3oram5HQVZNSStGelowSTJHb2FrK2FMTW4wQWtPT2cKIMU6vOUPEWb94/pv
+lmGsbgnc12mgeygKea54H5u0vdOanxEAzd6OpKhlfhZCMjYYPcQAn8q4PJtsyX9Z
+3sO0lHC3FlmIs5LKsruNK7J8FoCh/cfsc3CbmHghogRDQ+Or3H7fLz0v1eJiOQJF
+DGL9Lv3+t51JmZZf46AaLIJLE5YBRy1wYmo+YIIcPJsxJTly5r7lSLvGrOHQDFfq
+IAAqSFzROE02zKWeAOhC1rtpa+tGhsS2l+nldWIO3lTOH1yjzWKXqwPjyDgtWEaJ
+mp86FQbuyiNdYMx1dhh82yfP8sLsFcz/r8WskxAl
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/ddclient-cloudflare.key.age
+++ b/secrets/kelder/ddclient-cloudflare.key.age
@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyB0blBa
-Nlo2VGUzZzdTNW9heXhuUTJWYi9lWkl5WEp2VXcycExWd3FsLzNzCnpoZVVHaUxK
-aHAxVmxQSkJ6a0JnSFpkdmRzLzl3ZktwYy9yckFSNGxzRWsKLT4gWDI1NTE5IFhl
-RlR5TjJoUVdScjRKN3hDQmg4aDJpSllnd25WNmlVVTU4SzZRZEdnQ28KVGsyVHN6
-TmZyV1hSbWZqWUtYNFdEQ0FLMjczRW5HSWVEaHJidHBjZzBZTQotPiA/by1ncmVh
-c2UKUlJ1V2Y1eW1aNG1CTkx5VjZlREt5VkJjOVZoUno1T3p4WldSUTFpNDBXb21m
-Z0l6eGZKaTBqbjRiTTRybnEyagpxQlRIZldEVGdNblRrZkMycFljdkwxSjl4VHcK
-LS0tIDV2Q0NHeGRUblhCc3JUenl2bGhueER0UnFkcUZNWXR1c09QWDI0R2FkdXcK
-8DfpILM67mlC23bKjt2hWfpI51JvTa2YBEvHwHDuaaZBw8FIU6E8s77iyjTysmsw
-vmQwTrdoUPhfLHXspjHH1GGObwOxvdw/Mg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyA0aUpP
+M0xNSzFPRkozdVFYc2ZMZEgzUTdhTTBPZFl4Vk5ScXM2aWNoY0V3CkFmVG9CL2Mr
+ajNwSkt5dE5Gd1ZPZUtocllqYkk3Y3hBQ1VTUkNNdU1CNk0KLT4gWDI1NTE5IGJW
+S2ZSWTBzNXk3Y2tVZERqd0pkaGdhM2d0S3JQN0p3U0krTHM1RE03bGMKaDRXd0sw
+cnJlMFpnZmd0SGhYRkVtQlZQZWdwL290NDlXbUxjcU9NVDJCNAotPiA0K1Q8Tkc3
+LWdyZWFzZSA9QmM4XyBmWl9sU2wgdTkgU0pGYDUkCjE2WmR2OUxYTEF2OEhydnpO
+eXFPb1RoMG5va0lmQldiUy8ydDhEWTc5bFlDVUJuNm4zMktPbEtGeXlBWE9kR2EK
+aDVSNHJYVEVjSzBkcnV6M2pLRGoxYlI3YzU2enRxc2o3azZVQi9lcFZGQmwxTnln
+MGlQU3A2alFpZ1czQ0EKLS0tIHZKd1J2S1IrY3dkZi84U04zMGMzNkxEREtPVnQ2
+WHFpMEVPbENReGdSdTgK0A2R0MgSUrQ69tID2tBpPE0RJVLmo52tALktitTt58sy
+tiDr0+aVLkS7Zq90U+JuvHCFozfa0h1RqH/ZGlTtWZbheaJTxCyoVg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/estuary-wg.key.age
+++ b/secrets/kelder/estuary-wg.key.age
@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyAxUzdG
-dG9ZNkpPNGlreWxRMFlPQUdFTk9FZ0kvVjNhbUNvMWU4a2krcmcwCnl1Vk1PUS8r
-S0lveDV3OVphc3d6UDdLKzR4ZjB3RUloRzE2Zis3bjhsL00KLT4gWDI1NTE5IGVx
-TEMzdDRDbFBuT0c0V1Y1d1diSUVYMEw0dmJwcG9WaWQwcUdMMEVtZ3cKZ0x0OExq
-REFEdlJPU3o2WTlUQWU3b1NxcnJ1ajRRNkhxR1lxUmNpM1BLZwotPiBrMTREQ0lb
-LWdyZWFzZSB6TSp5Y0knClQ3V1VFY0dzSy9iNVdkRVZYU09yWjhONXkzck9VZVpC
-THh5amMvTlNLRDN2YUh1Mk1ncFcvZTZJZTRIRUlON1QKUzVDTDJJVk8KLS0tIENE
-N0ZzdjNnTER6ejRqZ0Y2WTd6dUJOaHJqTk1HT2U2TlkyUnBPTFc5WmsKYcIKEURp
-YcoFwU+gxq7BQlXo5LJDIcB73HPeerPnKYpfdyXFlsdm8mv3IXPEabSPwSNHXGIx
-BdinoqfHgAjMwptksMA3iIOWqp1cF6E=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyB1OEZC
+cElibS9nS0d1WHFtcEhSeUlsaVlzUGNHelBVaUFnaWlFbnhyb2o4CndScG53UkxV
+S1hiNzE0STZ5d1R2aG9kSnZoam5XVXBIVmNxaFJYRUx2Q3MKLT4gWDI1NTE5IHIy
+SXVzalEvRnlXL0dlTS8zbnl2bjhRWEpaV0xLUHFReHdvLzgzeGh5QUUKNFI1Z2hS
+S3d4RkR6WXF4SkVHUXVHa2FLQnBwUmJnQ2ZFc2Z6MTZTamcyawotPiA1MC1ncmVh
+c2UgVlgwPHxDIEEgbiBqP3tCCmlITHNiajMzcjRwNmZsbXp0ckFtZzRYYm4yUFBL
+SWhvNCtOamJ0UG5ETFVBb0pkdEoyQko4elpVQ2oycXFEdXMKCi0tLSBNUE1FWGNt
+L09qUTNZMEsyc2NWM0V6WXRCczMwbnJvSllRUFRoa09kaGswCvEaR2LTuopcssFG
+u5AzxVGagfznhgX8F5SSWHu/t/tkortU3Jn3++Cm6zf1uSeWNQfHhaNSY3dpbfC2
+6HXpQWTbpbhbQ3QsNonWPbL8
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kelder/htpasswd.age
+++ b/secrets/kelder/htpasswd.age
@@ -1,12 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBvRWE1
-Z1ZpNTFjTnluOUlPMldCQ3BzQzdVaEw4dlZjc2xuMkhGWlNDU1ZZCjVGNk9PNjNS
-elNlSzMzYUNOQ0dzYkNFUDlxNlg4S3BGbXNldGN5eWYwZTgKLT4gWDI1NTE5IHp2
-eDFPZ0VadjFVZFdVMXlYd3ZFRXIyeDRQU1dMV3ZEWHJEaGxOSzgxRE0KVVpvVnFQ
-WHhpWjN2Mm9TV0EwajlyRTg4TVIvbm0zZGFBVkJqbkJTZEh5RQotPiB6QS1ncmVh
-c2UgdycgQmJMCnVhd01JSEpUQ1U1Q3o2Wnh5UQotLS0gSkZwd0tNTGs0NkFiY250
-eGR1WXRLTWhzWlZOaHlGaHQvNUh2MjNDUm8yWQpH1cWbszmSTjpqz8Wyrt6g2TNP
-rtCRSnfw7UcoMh2oW3kyYcQrwf/sAFAHLNMh8oOWoxrKG1vtPxpOz251hlnee8JV
-dIZ/2Gj/lPXDFTkhmX0TfABAe4wPJlM2wu9pj70UvGnI1osR6avrpYr9mMau3Ypm
-Ucix6cE=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBvakpj
+SG9wRitBV2VyU2g2MUZ2S2VQcHNDWGNPK0ZDeVdYNlhhRE01UGpnCnEyYmZUaUtL
+VDQ1MTZ6Qnd0Q1loZlB5U0VYZ2cyTEhDb3NjYkdGRXhjWEUKLT4gWDI1NTE5IGg1
+NTl1SUh6dzF4SVNkWUZzVytwcEh0Y1RuUWNGOFVXcUJRSTNHMXZYSHMKdml2YlJL
+dTAwdXg1b1l6cko5N1RUR2lMWlMzNloyUXlIY25xT1ZBcW8rMAotPiBCclUtZ3Jl
+YXNlIDw3IHJyCjAzczU5V21hekFyWmhTQmpqOHh6WXlrT0FKaUF3QmZQakFURE1P
+c3BkMXdNYXcwWDdqY3JTSWxhdmx5QjhDTW0KbGl1SmdvYVBDOStFUHhCbWRxTFBm
+dnV2MmJQWUZHS3llSmluMjVlcTlqQVh4TXYvR1kwaHhmUQotLS0gTUFRcXc1R0xl
+OG9neFpSd3ZXcCszMXBqMDUwUkFZWFlWV1RiN3dTUGRBawr7l/HCt8B95tLf/0Ns
+GDo+72SlIoitk4WdG00n4fD92xBnAfWjQiridjb8RgGnJOEes24MwXyfx3fgrdor
+rlS6mvmsR0G95L2eih8vArvNmGQwfyG4q6Y7nCLoC+pKp5hs1Rjjeu6n31jaCi1O
+vJdc78tM3yYJlI8=
 -----END AGE ENCRYPTED FILE-----
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jack O'Sullivan	ffa5d19854	home-manager/common: Add `nix-tree` package Some checks failed Installer / Build installer (push) Has been cancelled Details CI / Check, build and cache Nix flake (push) Has been cancelled Details	2024-06-29 23:42:31 +01:00
Jack O'Sullivan	19fb29213e	nixos/netboot: Mount `/boot` via kernel command line	2024-06-29 23:41:01 +01:00
Jack O'Sullivan	f9870abc9e	Working "shill From Home" full network boot	2024-06-29 23:12:21 +01:00
Jack O'Sullivan	84ca556c47	nixos: Initial netbooting installer All checks were successful CI / Check, build and cache Nix flake (push) Successful in 34m36s Details Installer / Build installer (push) Successful in 4m34s Details	2024-06-24 00:42:26 +01:00
Jack O'Sullivan	9f2651e352	nixos/installer: Disable GUI stuff	2024-06-23 19:00:29 +01:00
Jack O'Sullivan	bce876ec42	Add release token to installer workflow Some checks failed CI / Check, build and cache Nix flake (push) Has been cancelled Details Installer / Build installer (push) Successful in 6m0s Details	2024-06-22 16:24:30 +01:00
Jack O'Sullivan	bc8adcecad	Update river public IP	2024-06-22 15:26:48 +01:00
Jack O'Sullivan	8878ce56c4	nixos/kelder: MTU fix + disable all local redirects All checks were successful CI / Check, build and cache Nix flake (push) Successful in 33m1s Details	2024-06-21 21:42:17 +01:00
Jack O'Sullivan	dd9439b7fa	nixos/shill: Add jam container All checks were successful CI / Check, build and cache Nix flake (push) Successful in 33m30s Details	2024-06-20 23:43:07 +01:00
Jack O'Sullivan	bc9f266ef0	nixos/containers: Remove workaround for systemd-nspawn@ drop-in	2024-06-20 23:37:43 +01:00
Jack O'Sullivan	1b083d298b	nixos/castle: Re-add boardie All checks were successful CI / Check, build and cache Nix flake (push) Successful in 32m55s Details	2024-06-18 23:29:48 +01:00
Jack O'Sullivan	83ba26735e	nixos/colony: Add extra disk to darts VM Some checks failed CI / Check, build and cache Nix flake (push) Failing after 6m28s Details	2024-06-15 20:05:27 +01:00
Jack O'Sullivan	50bd96ccdf	nixos/chatterbox: Add ffmpeg to mautrix bridges All checks were successful CI / Check, build and cache Nix flake (push) Successful in 32m8s Details	2024-06-10 13:27:02 +01:00
Jack O'Sullivan	a133cfb189	nixos/installer: Use my nixpkgs All checks were successful CI / Check, build and cache Nix flake (push) Successful in 33m39s Details	2024-06-09 01:49:18 +01:00
Jack O'Sullivan	051e68254e	nixos/chatterbox: Add Instagram bridge	2024-06-09 01:46:00 +01:00
Jack O'Sullivan	3fa8ab43ef	nixos/chatterbox: Add Messenger bridge	2024-06-08 23:08:27 +01:00
Jack O'Sullivan	c6720f87c1	nixos/chatterbox: Add WhatsApp bridge	2024-06-08 22:16:02 +01:00
Jack O'Sullivan	55ecdddadb	home-manager/gui: Fix screensaver top output, add cowsay to fortune Some checks failed CI / Check, build and cache Nix flake (push) Failing after 1m20s Details	2024-06-07 16:45:35 +01:00
Jack O'Sullivan	9b5173a587	home-manager/gui: More screensavers and options Some checks failed CI / Check, build and cache Nix flake (push) Failing after 1m5s Details	2024-06-07 15:27:20 +01:00
Jack O'Sullivan	73f5a690bb	home-manager/gui: Add cmatrix and TTE screensavers Some checks failed CI / Check, build and cache Nix flake (push) Failing after 1m23s Details	2024-06-07 03:11:55 +01:00
Jack O'Sullivan	54db751e23	pkgs: Add terminaltexteffects	2024-06-07 02:36:12 +01:00
Jack O'Sullivan	85299b65dc	home-manager/gui: Working randomised doomsaver	2024-06-07 02:26:27 +01:00
Jack O'Sullivan	45bda5b588	pkgs/chocolate-doom2xx: Add `-demoloopi` flag All checks were successful CI / Check, build and cache Nix flake (push) Successful in 32m58s Details	2024-06-06 14:39:09 +01:00
Jack O'Sullivan	9114f5ce74	home-manager/gui: Add Doom lock screen All checks were successful CI / Check, build and cache Nix flake (push) Successful in 33m7s Details	2024-06-06 02:30:22 +01:00
Jack O'Sullivan	3925c1090e	pkgs: Add window2layer and swaylock-plugin	2024-06-06 02:08:35 +01:00
Jack O'Sullivan	e74538a1a9	pkgs: Add chocolate-doom2xx	2024-06-06 02:02:28 +01:00
Jack O'Sullivan	b8ee21b6e8	nixos/home/routing-common: More Disney+ IPv6 workarounds	2024-06-05 20:21:48 +01:00
Jack O'Sullivan	41fd54cfad	nixos/whale2: Update to netavark backend All checks were successful CI / Check, build and cache Nix flake (push) Successful in 31m25s Details	2024-06-03 18:29:36 +01:00
Jack O'Sullivan	1df34e0515	lib: Update latest kernel Some checks failed CI / Check, build and cache Nix flake (push) Successful in 33m0s Details Installer / Build installer (push) Failing after 5m31s Details	2024-06-01 17:21:27 +01:00
Jack O'Sullivan	ce0c194761	Update all inputs (JackOS 24.06 "Carbrain") All checks were successful CI / Check, build and cache Nix flake (push) Successful in 32m36s Details	2024-06-01 14:30:35 +01:00
Jack O'Sullivan	a5e51ddd6b	nixos/home: Filter out Disney+ IPv6 DNS queries All checks were successful CI / Check, build and cache Nix flake (push) Successful in 36m4s Details	2024-05-16 21:05:48 +01:00
Jack O'Sullivan	746e0b9dc4	nixos/castle: Fix PipeWire latency config Some checks failed CI / Check, build and cache Nix flake (push) Failing after 58s Details	2024-05-11 16:10:15 +01:00
Jack O'Sullivan	77600a64fc	nixos/gui: Add udev rules for FT All checks were successful CI / Check, build and cache Nix flake (push) Successful in 34m43s Details	2024-05-11 00:46:13 +01:00
Jack O'Sullivan	c6d5705097	nixos/jackflix: Add PhotoPrism All checks were successful CI / Check, build and cache Nix flake (push) Successful in 34m59s Details	2024-05-06 00:57:52 +01:00
Jack O'Sullivan	6eefe97764	lib: Update river public IP All checks were successful CI / Check, build and cache Nix flake (push) Successful in 35m59s Details	2024-04-13 15:04:52 +01:00
Jack O'Sullivan	4bc4fe3ee8	Update my nixpkgs (spdk 24.01)	2024-04-13 15:02:54 +01:00
Jack O'Sullivan	57ec2bfc1b	nixos/home/routing-common: Make keepalived ping more resilient All checks were successful CI / Check, build and cache Nix flake (push) Successful in 33m37s Details	2024-04-05 15:22:10 +01:00
Jack O'Sullivan	d9d1150feb	Update nixpkgs and home-manager All checks were successful CI / Check, build and cache Nix flake (push) Successful in 1h21m12s Details	2024-04-04 19:08:12 +01:00
Jack O'Sullivan	92896d8e52	nixos/stream: Un-hardcode deploy host All checks were successful CI / Check, build and cache Nix flake (push) Successful in 35m24s Details	2024-03-25 11:20:58 +00:00
Jack O'Sullivan	477ffca33e	nixos/common: Update registry to point to nixpkgs flake	2024-03-25 11:17:30 +00:00
Jack O'Sullivan	fdc65c544e	nixos/home/routing-common: Add ping test to keepalived All checks were successful CI / Check, build and cache Nix flake (push) Successful in 35m51s Details	2024-03-24 13:32:03 +00:00
Jack O'Sullivan	945302b7c0	lib: Update river IP	2024-03-24 12:45:43 +00:00
Jack O'Sullivan	5ccf19cab8	nixos/colony: Fix LVM activatio dependency cycle All checks were successful CI / Check, build and cache Nix flake (push) Successful in 35m28s Details	2024-03-23 13:25:32 +00:00
Jack O'Sullivan	7b61dd7f03	nixos/colony: Enable PCIe AER	2024-03-23 12:45:59 +00:00
Jack O'Sullivan	682865a0e1	nixos/l2mesh: Add option to enable UDP encapsulation	2024-03-23 12:14:26 +00:00
Jack O'Sullivan	a0e4cf2479	lib: Bump JackOS version All checks were successful CI / Check, build and cache Nix flake (push) Successful in 24m28s Details	2024-03-22 21:23:18 +00:00
Jack O'Sullivan	a5880d66f4	home-manager/gui: Use python3Packages instead of python310Packages All checks were successful CI / Check, build and cache Nix flake (push) Successful in 1h12m52s Details	2024-03-21 23:32:01 +00:00
Jack O'Sullivan	27a4583879	pkgs/modrinth-app: Fix deps hash Some checks failed CI / Check, build and cache Nix flake (push) Has been cancelled Details	2024-03-21 23:10:42 +00:00
Jack O'Sullivan	fdbf5f8aca	lib: Update river IP	2024-03-21 21:16:01 +00:00
Jack O'Sullivan	40c491aa14	nixos/home/routing-common: Add MSS clamping to work around PMTUD Some checks failed CI / Check, build and cache Nix flake (push) Failing after 1h4m53s Details	2024-03-21 20:42:06 +00:00
Jack O'Sullivan	1a8740fb9c	nixos/home/routing-common: Increase RTT for CAKE	2024-03-21 20:41:28 +00:00
Jack O'Sullivan	f857e751b5	nixos/home/routing-common: Restart kea on failure	2024-03-21 20:40:38 +00:00
Jack O'Sullivan	b420f2377c	Use fork of sharry for now Some checks failed CI / Check, build and cache Nix flake (push) Failing after 1h2m37s Details	2024-03-18 21:22:52 +00:00
Jack O'Sullivan	7d90b5ecb8	Fix API changes from updates Some checks failed CI / Check, build and cache Nix flake (push) Failing after 16m14s Details	2024-03-18 20:23:52 +00:00
Jack O'Sullivan	ace979c226	Update inputs Some checks failed CI / Check, build and cache Nix flake (push) Failing after 6m13s Details	2024-03-18 17:41:41 +00:00
Jack O'Sullivan	f540edb361	nixos/routing-common: Clear IPv6 local default route All checks were successful CI / Check, build and cache Nix flake (push) Successful in 25m16s Details	2024-03-13 21:52:09 +00:00
Jack O'Sullivan	6bc5cd79da	lib: Update river IP	2024-03-13 21:31:05 +00:00
Jack O'Sullivan	5ec77dfde6	nixos/routing-common: Add DNS for Shytzel and wave All checks were successful CI / Check, build and cache Nix flake (push) Successful in 25m32s Details	2024-03-13 21:00:20 +00:00
Jack O'Sullivan	52623d458e	nixos/simpcraft: Update to Simpcraft 0.2.1 All checks were successful CI / Check, build and cache Nix flake (push) Successful in 26m17s Details	2024-01-27 14:36:40 +00:00
Jack O'Sullivan	23b29f0707	nixos/acquisition: Add transmission workaround All checks were successful CI / Check, build and cache Nix flake (push) Successful in 26m39s Details	2024-01-21 23:27:27 +00:00
Jack O'Sullivan	338902497f	nixos/simpcraft: Increase memory allocation to 8GiB All checks were successful CI / Check, build and cache Nix flake (push) Successful in 26m19s Details	2024-01-20 12:07:43 +00:00
Jack O'Sullivan	977846991a	nixos/simpcraft: Disable autosave during backup All checks were successful CI / Check, build and cache Nix flake (push) Successful in 26m20s Details	2024-01-19 20:06:23 +00:00
Jack O'Sullivan	0e8aec58fb	nixos/simpcraft: Update at odd intervals All checks were successful CI / Check, build and cache Nix flake (push) Successful in 25m52s Details	2024-01-19 00:46:55 +00:00
Jack O'Sullivan	0f1de58917	nixos/simpcraft: Add backup All checks were successful CI / Check, build and cache Nix flake (push) Successful in 25m52s Details	2024-01-18 12:12:06 +00:00
Jack O'Sullivan	32183bd331	devshell/commands: Overwrite home symlink if needed All checks were successful CI / Check, build and cache Nix flake (push) Successful in 26m29s Details	2024-01-15 14:59:01 +00:00
Jack O'Sullivan	1813ca1927	nixos/simpcraft: Add missing environment file All checks were successful CI / Check, build and cache Nix flake (push) Successful in 25m59s Details	2024-01-15 13:21:25 +00:00
Jack O'Sullivan	51d44e472a	pkgs: Add working Minecraft on Wayland GLFW Some checks failed CI / Check, build and cache Nix flake (push) Failing after 12m18s Details	2024-01-12 14:00:50 +00:00
Jack O'Sullivan	44e87aa387	Add wastebin All checks were successful CI / Check, build and cache Nix flake (push) Successful in 27m3s Details	2024-01-10 15:21:40 +00:00
Jack O'Sullivan	f90deabb50	nixos/whale2: Update Simpcraft to 0.2.0 All checks were successful CI / Check, build and cache Nix flake (push) Successful in 25m49s Details	2024-01-10 01:10:13 +00:00