lib: River IP update

The old build-n-parse seemed to output null sometimes.....

.gitea/workflows/ci.yaml

@@ -6,11 +6,11 @@ on:
 
 jobs:
   check:
-    name: Check, build and cache Nix flake
+    name: Check, build and cache nixfiles
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v23
+      - uses: cachix/install-nix-action@v27
         with:
           # Gitea will supply a token in GITHUB_TOKEN, which this action will
           # try to pass to Nix when downloading from GitHub
@@ -18,22 +18,30 @@ jobs:
           extra_nix_config: |
             # Make sure we're using sandbox
             sandbox-fallback = false
+            # Big C++ projects fill up memory...
+            cores = 6
 
-            extra-substituters = https://nix-cache.nul.ie/main
+            extra-substituters = https://nix-cache.nul.ie
-            extra-trusted-public-keys = main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8=
+            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
-      - name: Set up attic
-        run: |
-          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
-            login --set-default colony https://nix-cache.nul.ie "${{ secrets.NIX_CACHE_TOKEN }}"
 
       - name: Check flake
-        run: nix flake check
+        run: nix flake check --no-build
-      - name: Build the world
+
+      - name: Build (and cache) the world
         id: build
+        env:
+          HARMONIA_SSH_KEY: ${{ secrets.HARMONIA_SSH_KEY }}
         run: |
-          path=$(nix build --no-link .#ci.x86_64-linux --json | jq -r .[0].outputs.out)
+          nix eval --json --apply "builtins.attrNames" .#ci.x86_64-linux | jq -cr '.[]' | while read job; do
-          echo "path=$path" >> "$GITHUB_OUTPUT"
+            echo "::group::Build $job"
-      - name: Push to cache
+            nix build --no-link .#ci.x86_64-linux."$job"
-        run: |
+            echo "::endgroup::"
-          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+
-            push main ${{ steps.build.outputs.path }}
+            echo "::group::Cache $job"
+            ci/push-to-cache.sh "$(nix eval --raw .#ci.x86_64-linux."$job")"
+            echo "::endgroup::"
+          done
+
+          echo "Building and caching CI derivation"
+          nix build --no-link .#ciDrv.x86_64-linux
+          UPDATE_PROFILE=1 ci/push-to-cache.sh "$(nix eval --raw .#ciDrv.x86_64-linux)"

.gitea/workflows/installer.yaml

@@ -14,22 +14,20 @@ jobs:
         uses: https://github.com/actions/setup-go@v4
         with:
           go-version: '>=1.20.1'
-      - uses: cachix/install-nix-action@v23
+      - uses: cachix/install-nix-action@v27
         with:
           github_access_token: ${{ secrets.GH_PULL_TOKEN }}
           extra_nix_config: |
             # Make sure we're using sandbox
             sandbox-fallback = false
 
-            extra-substituters = https://nix-cache.nul.ie/main
+            extra-substituters = https://nix-cache.nul.ie
-            extra-trusted-public-keys = main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8=
+            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
-      - name: Set up attic
+
+      - name: Set up vars
         id: setup
         run: |
-          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
-            login --set-default colony https://nix-cache.nul.ie "${{ secrets.NIX_CACHE_TOKEN }}"
           echo "short_rev=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
-
       - name: Build installer ISO
         run: |
           nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.iso

.keys/harmonia.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXRXkYnBf2opIjN+bXE7HmhUpa4hyXJUGmBT+MRccT4 harmonia

ci/known_hosts

@@ -0,0 +1 @@
+object-ctr.ams1.int.nul.ie ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8

ci/push-to-cache.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+set -e
+
+REMOTE_STORE=/var/lib/harmonia
+SSH_HOST="harmonia@object-ctr.ams1.int.nul.ie"
+SSH_KEY=/tmp/harmonia.key
+STORE_URI="ssh-ng://$SSH_HOST?ssh-key=$SSH_KEY&remote-store=$REMOTE_STORE"
+
+remote_cmd() {
+  ssh -i "$SSH_KEY" "$SSH_HOST" env HOME=/run/harmonia NIX_REMOTE="$REMOTE_STORE" "$@"
+}
+
+umask_old=$(umask)
+umask 0066
+echo "$HARMONIA_SSH_KEY" | base64 -d > "$SSH_KEY"
+umask $umask_old
+
+mkdir -p ~/.ssh
+cp ci/known_hosts ~/.ssh/
+path="$1"
+
+echo "Pushing $path to cache..."
+nix copy --no-check-sigs --to "$STORE_URI" "$path"
+
+if [ -n "$UPDATE_PROFILE" ]; then
+  echo "Updating profile..."
+  remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
+
+  echo "Collecting garbage..."
+  remote_cmd nix-collect-garbage --delete-older-than 60d
+fi

devshell/commands.nix

@@ -77,7 +77,12 @@ in
       name = "build-n-switch";
       category = "tasks";
       help = "Shortcut to nixos-rebuild for this flake";
-      command = ''doas nixos-rebuild --flake . "$@"'';
+      command = ''
+        # HACK: Upstream changes in Git + Nix makes this necessary
+        # https://github.com/NixOS/nix/issues/10202
+        doas git config --global --add safe.directory "$PWD"
+        doas nixos-rebuild --flake . "$@"
+      '';
     }
     {
       name = "run-vm";
@@ -115,29 +120,17 @@ in
       help = "Build home-manager configuration";
       command = ''nix build "''${@:2}" ".#homeConfigurations.\"$1\".activationPackage"'';
     }
-    {
-      name = "update-inputs";
-      category = "tasks";
-      help = "Update flake inputs";
-      command = ''
-        args=()
-        for f in "$@"; do
-          args+=(--update-input "$f")
-        done
-        nix flake lock "''${args[@]}"
-      '';
-    }
     {
       name = "update-nixpkgs";
       category = "tasks";
       help = "Update nixpkgs flake inputs";
-      command = ''update-inputs nixpkgs-{unstable,stable,mine,mine-stable}'';
+      command = ''nix flake update nixpkgs-{unstable,stable,mine,mine-stable}'';
     }
     {
       name = "update-home-manager";
       category = "tasks";
       help = "Update home-manager flake inputs";
-      command = ''update-inputs home-manager-{unstable,stable}'';
+      command = ''nix flake update home-manager-{unstable,stable}'';
     }
     {
       name = "update-installer";
@@ -145,5 +138,15 @@ in
       help = "Update installer tag (to trigger new release)";
       command = ''git tag -f installer && git push -f origin installer'';
     }
+    {
+      name = "deploy-multi";
+      category = "tasks";
+      help = "Deploy multiple flakes at once";
+      command = ''
+        for f in $@; do
+          deploy "$O" $f
+        done
+      '';
+    }
   ];
 }

devshell/default.nix

@@ -11,7 +11,7 @@ in
 
     NIX_USER_CONF_FILES = toString (pkgs.writeText "nix.conf"
       ''
-        experimental-features = nix-command flakes ca-derivations repl-flake
+        experimental-features = nix-command flakes ca-derivations
         connect-timeout = 5
         fallback = true
         ${lib.my.c.nix.cache.conf}
@@ -24,10 +24,10 @@ in
     coreutils
     nixVersions.stable
     rage
+    wireguard-tools
     (pkgs.writeShellScriptBin "deploy" ''
       exec ${deploy-rs.deploy-rs}/bin/deploy --skip-checks "$@"
     '')
     home-manager
-    attic-client
   ];
 }

flake.lock

@@ -8,14 +8,14 @@
           "ragenix",
           "nixpkgs"
         ],
-        "systems": "systems_8"
+        "systems": "systems_7"
       },
       "locked": {
-        "lastModified": 1707830867,
+        "lastModified": 1723293904,
-        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
+        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
+        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
         "type": "github"
       },
       "original": {
@@ -24,36 +24,10 @@
         "type": "github"
       }
     },
-    "attic": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs-stable"
-        ]
-      },
-      "locked": {
-        "lastModified": 1711742460,
-        "narHash": "sha256-0O4v6e4a1toxXZ2gf5INhg4WPE5C5T+SVvsBt+45Mcc=",
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "rev": "4dbdbee45728d8ce5788db6461aaaa89d98081f0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "type": "github"
-      }
-    },
     "boardie": {
       "inputs": {
         "devshell": "devshell",
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
@@ -76,17 +50,17 @@
     "borgthin": {
       "inputs": {
         "devshell": "devshell_2",
-        "flake-utils": "flake-utils_6",
+        "flake-utils": "flake-utils_5",
         "nixpkgs": [
           "nixpkgs-mine"
         ]
       },
       "locked": {
-        "lastModified": 1692446555,
+        "lastModified": 1732994213,
-        "narHash": "sha256-Uzl8TiGKVBCjwYhkprSwbcu8xlcQwnDNIqsk9rM+P9w=",
+        "narHash": "sha256-3v8cTsPB+TIdWmc1gmRNd0Mi0elpfi39CXRsA/2x/Oo=",
         "owner": "devplayer0",
         "repo": "borg",
-        "rev": "44a3dc19b014ebc8d33db0b3e145ed7bfc9a0cb7",
+        "rev": "795f5009445987d42f32de1b49fdeb2d88326a64",
         "type": "github"
       },
       "original": {
@@ -96,39 +70,12 @@
       }
     },
     "crane": {
-      "inputs": {
-        "nixpkgs": [
-          "attic",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1702918879,
+        "lastModified": 1725409566,
-        "narHash": "sha256-tWJqzajIvYcaRWxn+cLUB9L9Pv4dQ3Bfit/YjU5ze3g=",
+        "narHash": "sha256-PrtLmqhM6UtJP7v7IGyzjBFhbG4eOAHT6LPYOFmYfbk=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "7195c00c272fdd92fc74e7d5a0a2844b9fadb2fb",
+        "rev": "7e4586bad4e3f8f97a9271def747cf58c4b68f3c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "crane_2": {
-      "inputs": {
-        "nixpkgs": [
-          "ragenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1708794349,
-        "narHash": "sha256-jX+B1VGHT0ruHHL5RwS8L21R6miBn4B6s9iVyUJsJJY=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "2c94ff9a6fbeb9f3ea0107f28688edbe9c81deaa",
         "type": "github"
       },
       "original": {
@@ -162,18 +109,18 @@
     },
     "deploy-rs": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1715699772,
+        "lastModified": 1727447169,
-        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
+        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
+        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
         "type": "github"
       },
       "original": {
@@ -184,7 +131,7 @@
     },
     "devshell": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       },
       "locked": {
@@ -203,7 +150,7 @@
     },
     "devshell-tools": {
       "inputs": {
-        "flake-utils": "flake-utils_11",
+        "flake-utils": "flake-utils_9",
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
@@ -222,7 +169,7 @@
     },
     "devshell_2": {
       "inputs": {
-        "flake-utils": "flake-utils_5",
+        "flake-utils": "flake-utils_4",
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
@@ -241,17 +188,16 @@
     },
     "devshell_3": {
       "inputs": {
-        "flake-utils": "flake-utils_7",
         "nixpkgs": [
           "nixpkgs-unstable"
         ]
       },
       "locked": {
-        "lastModified": 1713532798,
+        "lastModified": 1728330715,
-        "narHash": "sha256-wtBhsdMJA3Wa32Wtm1eeo84GejtI43pMrFrmwLXrsEc=",
+        "narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "12e914740a25ea1891ec619bb53cf5e6ca922e40",
+        "rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
         "type": "github"
       },
       "original": {
@@ -261,22 +207,6 @@
       }
     },
     "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1696426674,
@@ -293,90 +223,6 @@
       }
     },
     "flake-utils": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_10": {
-      "inputs": {
-        "systems": "systems_9"
-      },
-      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_11": {
-      "inputs": {
-        "systems": "systems_10"
-      },
-      "locked": {
-        "lastModified": 1709126324,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_12": {
-      "inputs": {
-        "systems": "systems_11"
-      },
-      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_13": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
       "inputs": {
         "systems": "systems"
       },
@@ -394,7 +240,40 @@
         "type": "github"
       }
     },
-    "flake-utils_3": {
+    "flake-utils_10": {
+      "inputs": {
+        "systems": "systems_10"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_11": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
       "inputs": {
         "systems": "systems_2"
       },
@@ -412,7 +291,7 @@
         "type": "github"
       }
     },
-    "flake-utils_4": {
+    "flake-utils_3": {
       "inputs": {
         "systems": "systems_3"
       },
@@ -430,7 +309,7 @@
         "type": "github"
       }
     },
-    "flake-utils_5": {
+    "flake-utils_4": {
       "locked": {
         "lastModified": 1642700792,
         "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
@@ -445,7 +324,7 @@
         "type": "github"
       }
     },
-    "flake-utils_6": {
+    "flake-utils_5": {
       "locked": {
         "lastModified": 1667395993,
         "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
@@ -460,16 +339,31 @@
         "type": "github"
       }
     },
-    "flake-utils_7": {
+    "flake-utils_6": {
       "inputs": {
         "systems": "systems_6"
       },
       "locked": {
-        "lastModified": 1701680307,
+        "lastModified": 1731533236,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_7": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
         "type": "github"
       },
       "original": {
@@ -480,7 +374,7 @@
     },
     "flake-utils_8": {
       "inputs": {
-        "systems": "systems_7"
+        "systems": "systems_8"
       },
       "locked": {
         "lastModified": 1710146030,
@@ -497,12 +391,15 @@
       }
     },
     "flake-utils_9": {
+      "inputs": {
+        "systems": "systems_9"
+      },
       "locked": {
-        "lastModified": 1659877975,
+        "lastModified": 1709126324,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
         "type": "github"
       },
       "original": {
@@ -540,16 +437,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1716729592,
+        "lastModified": 1732466619,
-        "narHash": "sha256-Y3bOjoh2cFBqZN0Jw1zUdyr7tjygyxl2bD/QY73GZP0=",
+        "narHash": "sha256-T1e5oceypZu3Q8vzICjv1X/sGs9XfJRMW5OuXHgpB3c=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2c78a57c544dd19b07442350727ced097e1aa6e6",
+        "rev": "f3111f62a23451114433888902a55cf0692b408d",
         "type": "github"
       },
       "original": {
         "id": "home-manager",
-        "ref": "release-23.11",
+        "ref": "release-24.11",
         "type": "indirect"
       }
     },
@@ -560,11 +457,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1717097707,
+        "lastModified": 1732884235,
-        "narHash": "sha256-HC5vJ3oYsjwsCaSbkIPv80e4ebJpNvFKQTBOGlHvjLs=",
+        "narHash": "sha256-r8j6R3nrvwbT1aUp4EPQ1KC7gm0pu9VcV1aNaB+XG6Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0eb314b4f0ba337e88123e0b1e57ef58346aafd9",
+        "rev": "819f682269f4e002884702b87e445c82840c68f2",
         "type": "github"
       },
       "original": {
@@ -574,11 +471,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1708968331,
+        "lastModified": 1731242966,
-        "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=",
+        "narHash": "sha256-B3C3JLbGw0FtLSWCjBxU961gLNv+BOOBC6WvstKLYMw=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30",
+        "rev": "3ed3f0eaae9fcc0a8331e77e9319c8a4abd8a71a",
         "type": "github"
       },
       "original": {
@@ -611,7 +508,7 @@
     },
     "nixGL": {
       "inputs": {
-        "flake-utils": "flake-utils_9",
+        "flake-utils": "flake-utils_7",
         "nixpkgs": [
           "nixpkgs-unstable"
         ]
@@ -648,11 +545,11 @@
     },
     "nixpkgs-mine": {
       "locked": {
-        "lastModified": 1717628902,
+        "lastModified": 1732985787,
-        "narHash": "sha256-qMAW+oKis3F8jXTjX9Ng02/LzZd+7YOK05Qa33h9yqY=",
+        "narHash": "sha256-6rSJ9L4QywpHLi/xvpOHdTuPm6/eOJcXxnYzDbP3U1k=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "3e0ee08114e1563b1a0fd6a907563b5e86258fb4",
+        "rev": "a28c46933ef5038fb7a2dd483b85152a539c7969",
         "type": "github"
       },
       "original": {
@@ -664,11 +561,11 @@
     },
     "nixpkgs-mine-stable": {
       "locked": {
-        "lastModified": 1717245305,
+        "lastModified": 1732985894,
-        "narHash": "sha256-LrIS3+Aa4F2VmuJPQOASRd3W+uToj878PoUKSLVw/vE=",
+        "narHash": "sha256-YYuQQCcSF6KjgtAenZJiBmqt5jqP3UvYgC424VQ+22s=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "17a50249712512f600eced89bebcc3252b5f630f",
+        "rev": "e0a3f4e2bbc5f7b681e344b389dcbab23f2e92a8",
         "type": "github"
       },
       "original": {
@@ -680,26 +577,26 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1716991068,
+        "lastModified": 1732824227,
-        "narHash": "sha256-Av0UWCCiIGJxsZ6TFc+OiKCJNqwoxMNVYDBChmhjNpo=",
+        "narHash": "sha256-fYNXgpu1AEeLyd3fQt4Ym0tcVP7cdJ8wRoqJ+CtTRyY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "25cf937a30bf0801447f6bf544fc7486c6309234",
+        "rev": "c71ad5c34d51dcbda4c15f44ea4e4aa6bb6ac1e9",
         "type": "github"
       },
       "original": {
         "id": "nixpkgs",
-        "ref": "nixos-23.11",
+        "ref": "nixos-24.11",
         "type": "indirect"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1716948383,
+        "lastModified": 1732758367,
-        "narHash": "sha256-SzDKxseEcHR5KzPXLwsemyTR/kaM9whxeiJohbL04rs=",
+        "narHash": "sha256-RzaI1RO0UXqLjydtz3GAXSTzHkpb/lLD1JD8a0W4Wpo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ad57eef4ef0659193044870c731987a6df5cf56b",
+        "rev": "fa42b5a5f401aab8a32bd33c9a4de0738180dc59",
         "type": "github"
       },
       "original": {
@@ -774,7 +671,7 @@
     },
     "poetry2nix": {
       "inputs": {
-        "flake-utils": "flake-utils_4",
+        "flake-utils": "flake-utils_3",
         "nix-github-actions": "nix-github-actions",
         "nixpkgs": "nixpkgs_2",
         "systems": "systems_4",
@@ -797,35 +694,35 @@
     "ragenix": {
       "inputs": {
         "agenix": "agenix",
-        "crane": "crane_2",
+        "crane": "crane",
-        "flake-utils": "flake-utils_10",
+        "flake-utils": "flake-utils_8",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1709831932,
+        "lastModified": 1731774781,
-        "narHash": "sha256-WsP8rOFa/SqYNbVtYJ/l2mWWOgyDTJFbITMV8tv0biI=",
+        "narHash": "sha256-vwsUUYOIs8J6weeSK1n1mbZf8fgvygGUMsadx0JmG70=",
-        "owner": "yaxitech",
+        "owner": "devplayer0",
         "repo": "ragenix",
-        "rev": "06de099ef02840ec463419f12de73729d458e1eb",
+        "rev": "ec4115da7b67c783b1091811e17dbcba50edd1c6",
         "type": "github"
       },
       "original": {
-        "owner": "yaxitech",
+        "owner": "devplayer0",
+        "ref": "add-rekey-one-flag",
         "repo": "ragenix",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "attic": "attic",
         "boardie": "boardie",
         "borgthin": "borgthin",
         "deploy-rs": "deploy-rs",
         "devshell": "devshell_3",
-        "flake-utils": "flake-utils_8",
+        "flake-utils": "flake-utils_6",
         "home-manager-stable": "home-manager-stable",
         "home-manager-unstable": "home-manager-unstable",
         "impermanence": "impermanence",
@@ -840,21 +737,17 @@
     },
     "rust-overlay": {
       "inputs": {
-        "flake-utils": [
-          "ragenix",
-          "flake-utils"
-        ],
         "nixpkgs": [
           "ragenix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1708740535,
+        "lastModified": 1725675754,
-        "narHash": "sha256-NCTw235XwSDbeTAtAwg/hOeNOgwYhVq7JjDdbkOgBeA=",
+        "narHash": "sha256-hXW3csqePOcF2e/PYnpXj72KEYyNj2HzTrVNmS/F7Ug=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "9b24383d77f598716fa0cbb8b48c97249f5ee1af",
+        "rev": "8cc45e678e914a16c8e224c3237fb07cf21e5e54",
         "type": "github"
       },
       "original": {
@@ -865,7 +758,7 @@
     },
     "sbt": {
       "inputs": {
-        "flake-utils": "flake-utils_13",
+        "flake-utils": "flake-utils_11",
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
@@ -885,22 +778,22 @@
     "sharry": {
       "inputs": {
         "devshell-tools": "devshell-tools",
-        "flake-utils": "flake-utils_12",
+        "flake-utils": "flake-utils_10",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
         "sbt": "sbt"
       },
       "locked": {
-        "lastModified": 1710796573,
+        "lastModified": 1720592125,
-        "narHash": "sha256-23fLZFNacZU/skc8i7JExHfD//Mpkslhga6f5ATTqBA=",
+        "narHash": "sha256-vR89LefkY8mBPWxDTQ8SNg6Z7/J6Yga80T4kSb6MNdk=",
-        "owner": "devplayer0",
+        "owner": "eikek",
         "repo": "sharry",
-        "rev": "4e7a87880ba0807afd5d21706ce383b8b8727990",
+        "rev": "604b20517150599cb05dbe178cd35cd10659aa4c",
         "type": "github"
       },
       "original": {
-        "owner": "devplayer0",
+        "owner": "eikek",
         "repo": "sharry",
         "type": "github"
       }
@@ -935,21 +828,6 @@
         "type": "github"
       }
     },
-    "systems_11": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "systems_2": {
       "locked": {
         "lastModified": 1681028828,

flake.nix

@@ -7,17 +7,18 @@
     devshell.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
     nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "nixpkgs/nixos-23.11";
+    nixpkgs-stable.url = "nixpkgs/nixos-24.11";
     nixpkgs-mine.url = "github:devplayer0/nixpkgs/devplayer0";
     nixpkgs-mine-stable.url = "github:devplayer0/nixpkgs/devplayer0-stable";
 
     home-manager-unstable.url = "home-manager";
     home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    home-manager-stable.url = "home-manager/release-23.11";
+    home-manager-stable.url = "home-manager/release-24.11";
     home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";
 
     # Stuff used by the flake for build / deployment
-    ragenix.url = "github:yaxitech/ragenix";
+    # ragenix.url = "github:yaxitech/ragenix";
+    ragenix.url = "github:devplayer0/ragenix/add-rekey-one-flag";
     ragenix.inputs.nixpkgs.follows = "nixpkgs-unstable";
     deploy-rs.url = "github:serokell/deploy-rs";
     deploy-rs.inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -30,14 +31,10 @@
     nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
     # Packages not in nixpkgs
-    # sharry.url = "github:eikek/sharry";
+    sharry.url = "github:eikek/sharry";
-    sharry.url = "github:devplayer0/sharry";
     sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
     borgthin.url = "github:devplayer0/borg";
     borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
-    attic.url = "github:zhaofengli/attic";
-    attic.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    attic.inputs.nixpkgs-stable.follows = "nixpkgs-stable";
   };
 
   outputs =
@@ -52,7 +49,7 @@
       ...
     }:
     let
-      inherit (builtins) mapAttrs replaceStrings;
+      inherit (builtins) mapAttrs replaceStrings elem;
       inherit (lib) mapAttrs' filterAttrs nameValuePair recurseIntoAttrs evalModules;
       inherit (lib.flake) flattenTree eachDefaultSystem;
       inherit (lib.my) mkDefaultSystemsPkgs flakePackageOverlay;
@@ -96,7 +93,6 @@
             inputs.ragenix.overlays.default
             inputs.deploy-rs.overlay
             (flakePackageOverlay inputs.home-manager-unstable system)
-            inputs.attic.overlays.default
           ];
         }))
         pkgsFlakes;
@@ -108,6 +104,16 @@
             pkgsLibOverlay
             myPkgsOverlay
           ];
+
+          config = {
+            # RMS forgive me...
+            # Normally this is set modularly, but sometimes we need to use other pkgs
+            allowUnfreePredicate = p: elem (lib.getName p) [
+              "widevine-cdm"
+              "chromium-unwrapped"
+              "chromium"
+            ];
+          };
         }))
         pkgsFlakes;
 
@@ -116,9 +122,9 @@
         nixos/installer.nix
         nixos/boxes/colony
         nixos/boxes/tower
-        nixos/boxes/castle
         nixos/boxes/home/stream.nix
         nixos/boxes/home/palace
+        nixos/boxes/home/castle
         nixos/boxes/britway
         nixos/boxes/kelder
 
@@ -198,8 +204,9 @@
         systems' = mapAttrs' (n: v: nameValuePair "system-${n}" v) systems;
         packages' = mapAttrs' (n: v: nameValuePair "package-${n}" v) packages;
       in
-        pkgs.linkFarm "ci" (homes' // systems' // packages' // {
+        homes' // systems' // packages' // {
           inherit shell;
-        });
+        };
+      ciDrv = pkgs.linkFarm "ci" ci;
     }));
 }

home-manager/modules/gui/default.nix

@@ -1,6 +1,6 @@
-{ lib, pkgs, config, ... }:
+{ lib, pkgs', pkgs, config, ... }:
 let
-  inherit (lib) genAttrs mkIf mkMerge mkForce;
+  inherit (lib) genAttrs mkIf mkMerge mkForce mapAttrs mkOptionDefault;
   inherit (lib.my) mkBoolOpt';
 
   cfg = config.my.gui;
@@ -39,10 +39,11 @@ in
       {
         home = {
           packages = with pkgs; [
+            xdg-utils
+
             font.package
-            (nerdfonts.override {
+            nerd-fonts.sauce-code-pro
-              fonts = [ "DroidSansMono" "SourceCodePro" ];
+            nerd-fonts.droid-sans-mono
-            })
             noto-fonts-emoji
 
             grim
@@ -62,6 +63,8 @@ in
             neofetch
             cmatrix
             doomsaver
+
+            xournalpp
           ];
         };
 
@@ -76,7 +79,7 @@ in
           alacritty = {
             enable = true;
             settings = {
-              import = [ ./alacritty-xterm.toml ];
+              general.import = [ ./alacritty-xterm.toml ];
 
               font = {
                 size = font.size;
@@ -92,9 +95,10 @@ in
             enable = true;
             inherit font;
             settings = {
-              background_opacity = "0.8";
+              background_opacity = "0.65";
               tab_bar_edge = "top";
               shell_integration = "no-sudo";
+              font_features = "${font.name} -liga";
             };
           };
 
@@ -160,6 +164,19 @@ in
               };
               Install.RequiredBy = [ "sway-session.target" ];
             };
+
+            activate-linux = {
+              Unit = {
+                Description = "Linux activation watermark";
+                After = "graphical-session.target";
+                PartOf = "graphical-session.target";
+              };
+              Service = {
+                Type = "simple";
+                ExecStart = "${pkgs.activate-linux}/bin/activate-linux";
+              };
+              Install.RequiredBy = [ "graphical-session.target" ];
+            };
           };
         };
 
@@ -169,6 +186,7 @@ in
             wl-clipboard
             wev
             wdisplays
+            swaysome
 
             pavucontrol
             libsecret
@@ -178,10 +196,11 @@ in
           ];
 
           pointerCursor = {
-            package = pkgs.vanilla-dmz;
+            package = pkgs.posy-cursors;
-            name = "Vanilla-DMZ";
+            name = "Posy_Cursor";
-            size = 16;
+            size = 32;
             gtk.enable = true;
+            x11.enable = true;
           };
         };
 
@@ -190,9 +209,36 @@ in
         xsession.preferStatusNotifierItems = true;
         wayland = {
           windowManager = {
-            sway = {
+            sway =
+            let
+              cfg = config.wayland.windowManager.sway.config;
+              mod = cfg.modifier;
+
+              renameWs = pkgs.writeShellScript "sway-rename-ws" ''
+                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
+                focused_num="$(jq -r ".num" <<< "$focused_ws")"
+                focused_name="$(jq -r ".name" <<< "$focused_ws")"
+                placeholder="$(sed -E 's/[0-9]+: //' <<< "$focused_name")"
+
+                name="$(rofi -dmenu -p "rename ws $focused_num" -theme+entry+placeholder "\"$placeholder\"")"
+                if [ -n "$name" ]; then
+                  swaymsg rename workspace "$focused_name" to "$focused_num: $name"
+                fi
+              '';
+              clearWsName = pkgs.writeShellScript "sway-clear-ws-name" ''
+                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
+                focused_num="$(jq -r ".num" <<< "$focused_ws")"
+                focused_name="$(jq -r ".name" <<< "$focused_ws")"
+
+                swaymsg rename workspace "$focused_name" to "$focused_num"
+              '';
+            in
+            {
               enable = true;
               xwayland = true;
+              extraConfigEarly = ''
+                set $mod ${mod}
+              '';
               config = {
                 input = {
                   "type:touchpad" = {
@@ -207,31 +253,95 @@ in
 
                 modifier = "Mod4";
                 terminal = "kitty";
-                keybindings =
+                keybindings = mapAttrs (k: mkOptionDefault) {
-                  let
+                  "${mod}+Left" = "focus left";
-                    cfg = config.wayland.windowManager.sway.config;
+                  "${mod}+Down" = "focus down";
-                    mod = cfg.modifier;
+                  "${mod}+Up" = "focus up";
-                  in
+                  "${mod}+Right" = "focus right";
-                  lib.mkOptionDefault {
-                    "${mod}+d" = null;
-                    "${mod}+l" = "exec ${doomsaver}/bin/doomsaver";
-                    "${mod}+x" = "exec ${cfg.menu}";
-                    "${mod}+Shift+x" = "exec rofi -show drun";
-                    "${mod}+q" = "kill";
-                    "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
-                    "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
-                    "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
-                    "${mod}+Shift+e" = "exec rofi -show emoji";
-                    # Config for this doesn't seem to work :/
-                    "${mod}+c" = ''exec rofi -show calc -calc-command "echo -n '{result}' | ${pkgs.wl-clipboard}/bin/wl-copy"'';
 
-                    "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
+                  "${mod}+Shift+Left" = "move left";
-                    "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
+                  "${mod}+Shift+Down" = "move down";
-                    "XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play";
+                  "${mod}+Shift+Up" = "move up";
-                    "XF86AudioPause" = "exec ${pkgs.playerctl}/bin/playerctl pause";
+                  "${mod}+Shift+Right" = "move right";
-                    "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
+
-                    "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
+                  "${mod}+b" = "splith";
-                  };
+                  "${mod}+v" = "splitv";
+                  "${mod}+f" = "fullscreen toggle";
+                  "${mod}+a" = "focus parent";
+
+                  "${mod}+s" = "layout stacking";
+                  "${mod}+w" = "layout tabbed";
+                  "${mod}+e" = "layout toggle split";
+
+                  "${mod}+Shift+space" = "floating toggle";
+                  "${mod}+space" = "focus mode_toggle";
+
+                  "${mod}+1" = "workspace number 1";
+                  "${mod}+2" = "workspace number 2";
+                  "${mod}+3" = "workspace number 3";
+                  "${mod}+4" = "workspace number 4";
+                  "${mod}+5" = "workspace number 5";
+                  "${mod}+6" = "workspace number 6";
+                  "${mod}+7" = "workspace number 7";
+                  "${mod}+8" = "workspace number 8";
+                  "${mod}+9" = "workspace number 9";
+                  "${mod}+0" = "workspace number 10";
+
+                  "${mod}+Shift+1" =
+                    "move container to workspace number 1";
+                  "${mod}+Shift+2" =
+                    "move container to workspace number 2";
+                  "${mod}+Shift+3" =
+                    "move container to workspace number 3";
+                  "${mod}+Shift+4" =
+                    "move container to workspace number 4";
+                  "${mod}+Shift+5" =
+                    "move container to workspace number 5";
+                  "${mod}+Shift+6" =
+                    "move container to workspace number 6";
+                  "${mod}+Shift+7" =
+                    "move container to workspace number 7";
+                  "${mod}+Shift+8" =
+                    "move container to workspace number 8";
+                  "${mod}+Shift+9" =
+                    "move container to workspace number 9";
+                  "${mod}+Shift+0" =
+                    "move container to workspace number 10";
+
+                  "${mod}+Shift+minus" = "move scratchpad";
+                  "${mod}+minus" = "scratchpad show";
+
+                  "${mod}+Return" = "exec ${cfg.terminal}";
+                  "${mod}+r" = "mode resize";
+                  "${mod}+d" = null;
+                  "${mod}+l" = "exec ${doomsaver}/bin/doomsaver";
+                  "${mod}+q" = "kill";
+                  "${mod}+Shift+c" = "reload";
+                  "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
+
+                  # rofi
+                  "${mod}+x" = "exec ${cfg.menu}";
+                  "${mod}+Shift+x" = "exec rofi -show drun";
+                  "${mod}+Shift+e" = "exec rofi -show emoji";
+                  # Config for this doesn't seem to work :/
+                  "${mod}+c" = ''exec rofi -show calc -calc-command "echo -n '{result}' | ${pkgs.wl-clipboard}/bin/wl-copy"'';
+                  "${mod}+Shift+r" = "exec ${renameWs}";
+                  "${mod}+Shift+n" = "exec ${clearWsName}";
+
+                  # Screenshots
+                  "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
+                  "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
+
+                  "XF86MonBrightnessDown" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
+                  "XF86MonBrightnessUp" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set +5%";
+
+                  "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
+                  "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
+                  "XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play";
+                  "XF86AudioPause" = "exec ${pkgs.playerctl}/bin/playerctl pause";
+                  "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
+                  "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
+                };
                 keycodebindings = {
                   # keycode for XF86AudioPlayPause (no sym for some reason)
                   "172" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
@@ -240,6 +350,9 @@ in
                 menu = "rofi -show run";
                 bars = mkForce [ ];
               };
+              extraConfig = ''
+                include ${./swaysome.conf}
+              '';
 
               swaynag = {
                 enable = true;
@@ -290,6 +403,7 @@ in
             diff-so-fancy.enable = true;
             userEmail = "jackos1998@gmail.com";
             userName = "Jack O'Sullivan";
+            lfs.enable = true;
             extraConfig = {
               pull.rebase = true;
             };
@@ -297,11 +411,13 @@ in
 
           waybar = import ./waybar.nix { inherit lib pkgs config font; };
           rofi = {
+            package = pkgs.rofi-wayland;
             enable = true;
             font = "${font.name} ${toString font.size}";
-            plugins = with pkgs; [
+            plugins = with pkgs; (map (p: p.override { rofi-unwrapped = rofi-wayland-unwrapped; }) [
               rofi-calc
-              rofi-emoji
+            ]) ++ [
+              rofi-emoji-wayland
             ];
             extraConfig = {
               modes = "window,run,ssh,filebrowser,calc,emoji";
@@ -316,7 +432,7 @@ in
 
           chromium = {
             enable = true;
-            package = (pkgs.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
+            package = (pkgs'.unstable.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
               buildCommand = ''
                 ${old.buildCommand}
 

home-manager/modules/gui/swaysome.conf

@@ -0,0 +1,66 @@
+# Use (un)bindcode or (un)bindsym, depending on what you used in your main sway config file.
+# The `--no-warn` setting is only added to shortcuts that exist in the default config. You may want to add or remove
+# that flag on some bindings depending on your config.
+
+
+# Change focus between workspaces
+bindsym $mod+Alt+1 exec "swaysome focus 1"
+bindsym $mod+Alt+2 exec "swaysome focus 2"
+bindsym $mod+Alt+3 exec "swaysome focus 3"
+bindsym $mod+Alt+4 exec "swaysome focus 4"
+bindsym $mod+Alt+5 exec "swaysome focus 5"
+bindsym $mod+Alt+6 exec "swaysome focus 6"
+bindsym $mod+Alt+7 exec "swaysome focus 7"
+bindsym $mod+Alt+8 exec "swaysome focus 8"
+bindsym $mod+Alt+9 exec "swaysome focus 9"
+bindsym $mod+Alt+0 exec "swaysome focus 0"
+
+# Focus workspace groups
+bindsym --no-warn $mod+1 exec "swaysome focus-group 1"
+bindsym --no-warn $mod+2 exec "swaysome focus-group 2"
+bindsym --no-warn $mod+3 exec "swaysome focus-group 3"
+bindsym --no-warn $mod+4 exec "swaysome focus-group 4"
+bindsym --no-warn $mod+5 exec "swaysome focus-group 5"
+bindsym --no-warn $mod+6 exec "swaysome focus-group 6"
+bindsym --no-warn $mod+7 exec "swaysome focus-group 7"
+bindsym --no-warn $mod+8 exec "swaysome focus-group 8"
+bindsym --no-warn $mod+9 exec "swaysome focus-group 9"
+bindsym --no-warn $mod+0 exec "swaysome focus-group 0"
+
+# Move containers between workspaces
+bindsym $mod+Alt+Shift+1 exec "swaysome move 1"
+bindsym $mod+Alt+Shift+2 exec "swaysome move 2"
+bindsym $mod+Alt+Shift+3 exec "swaysome move 3"
+bindsym $mod+Alt+Shift+4 exec "swaysome move 4"
+bindsym $mod+Alt+Shift+5 exec "swaysome move 5"
+bindsym $mod+Alt+Shift+6 exec "swaysome move 6"
+bindsym $mod+Alt+Shift+7 exec "swaysome move 7"
+bindsym $mod+Alt+Shift+8 exec "swaysome move 8"
+bindsym $mod+Alt+Shift+9 exec "swaysome move 9"
+bindsym $mod+Alt+Shift+0 exec "swaysome move 0"
+
+# Move containers to other workspace groups
+bindsym --no-warn $mod+Shift+1 exec "swaysome move-to-group 1"
+bindsym --no-warn $mod+Shift+2 exec "swaysome move-to-group 2"
+bindsym --no-warn $mod+Shift+3 exec "swaysome move-to-group 3"
+bindsym --no-warn $mod+Shift+4 exec "swaysome move-to-group 4"
+bindsym --no-warn $mod+Shift+5 exec "swaysome move-to-group 5"
+bindsym --no-warn $mod+Shift+6 exec "swaysome move-to-group 6"
+bindsym --no-warn $mod+Shift+7 exec "swaysome move-to-group 7"
+bindsym --no-warn $mod+Shift+8 exec "swaysome move-to-group 8"
+bindsym --no-warn $mod+Shift+9 exec "swaysome move-to-group 9"
+bindsym --no-warn $mod+Shift+0 exec "swaysome move-to-group 0"
+
+# Move focused container to next output
+bindsym $mod+Alt+Right exec "swaysome next-output"
+# Move focused container to previous output
+bindsym $mod+Alt+Left exec "swaysome prev-output"
+
+# Move focused workspace group to next output
+bindsym $mod+Shift+Alt+Right exec "swaysome workspace-group-next-output"
+# Move focused workspace group to previous output
+bindsym $mod+Shift+Alt+Left exec "swaysome workspace-group-prev-output"
+
+# Init workspaces for every screen
+exec "swaysome init 1"
+

lib/constants.nix

@@ -27,7 +27,7 @@ rec {
 
   kernel = {
     lts = pkgs: pkgs.linuxKernel.packages.linux_6_6;
-    latest = pkgs: pkgs.linuxKernel.packages.linux_6_9;
+    latest = pkgs: pkgs.linuxKernel.packages.linux_6_12;
   };
 
   nginx = rec {
@@ -98,10 +98,10 @@ rec {
   nix = {
     cache = rec {
       substituters = [
-        "https://nix-cache.${pubDomain}/main"
+        "https://nix-cache.${pubDomain}"
       ];
       keys = [
-        "main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8="
+        "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
       ];
       conf = ''
         extra-substituters = ${concatStringsSep " " substituters}
@@ -135,6 +135,9 @@ rec {
         v4 = subnet 8 3 all.v4;
         v6 = subnet 4 3 all.v6;
       };
+      qclk = {
+        v4 = subnet 8 4 all.v4;
+      };
 
       cust = {
         v4 = subnet 8 100 all.v4; # single ip for routing only
@@ -170,6 +173,10 @@ rec {
       jam-ctr = host 3 prefixes.cust.v4;
     };
 
+    qclk = {
+      wgPort = 51821;
+    };
+
     firewallForwards = aa: [
       {
         port = "http";
@@ -220,6 +227,23 @@ rec {
         dst = aa.simpcraft-oci.internal.ipv4.address;
         proto = "udp";
       }
+
+      {
+        port = 15636;
+        dst = aa.enshrouded-oci.internal.ipv4.address;
+        proto = "udp";
+      }
+      {
+        port = 15637;
+        dst = aa.enshrouded-oci.internal.ipv4.address;
+        proto = "udp";
+      }
+
+      {
+        port = qclk.wgPort;
+        dst = aa.qclk.internal.ipv4.address;
+        proto = "udp";
+      }
     ];
 
     fstrimConfig = {
@@ -243,7 +267,7 @@ rec {
       "stream"
     ];
     routersPubV4 = [
-      "188.141.14.7"
+      "109.255.31.155"
       "109.255.252.63"
     ];
 
@@ -294,7 +318,7 @@ rec {
       };
     };
 
-    roceBootModules = [ "ib_core" "ib_uverbs" "mlx5_core" "mlx5_ib" "8021q" ];
+    roceBootModules = [ "ib_core" "ib_uverbs" "mlx5_core" "mlx5_ib" ];
   };
 
   britway = {
@@ -359,6 +383,7 @@ rec {
     deploy = ../.keys/deploy.pub;
     rsyncNet = ../.keys/zh2855.rsync.net.pub;
     mailcowAcme = ../.keys/mailcow-acme.pub;
+    harmonia = ../.keys/harmonia.pub;
   };
   sshHostKeys = {
     mail-vm = ../.keys/mail-vm-host.pub;

lib/default.nix

@@ -248,8 +248,8 @@ rec {
   in
   {
     trivial = prev.trivial // {
-      release = "24.06:u-${prev.trivial.release}";
+      release = "24.12:u-${prev.trivial.release}";
-      codeName = "Carbrain";
+      codeName = "Epic";
       revisionWithDefault = default: self.rev or default;
       versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
     };

nixos/boxes/britway/default.nix

@@ -106,7 +106,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
+                    routes = [
                       {
                         Destination = lib.my.c.colony.prefixes.all.v4;
                         Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -123,7 +123,7 @@ in
                         Table = "ts-extra";
                       }
                     ];
-                    routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+                    routingPolicyRules = [
                       {
                         IncomingInterface = "tailscale0";
                         To = lib.my.c.colony.prefixes.all.v6;

nixos/boxes/britway/nginx.nix

@@ -80,7 +80,7 @@ in
               };
             };
 
-            "ts.${pubDomain}" = {
+            "hs.${pubDomain}" = {
               locations."/" = {
                 proxyPass = "http://localhost:${toString config.services.headscale.port}";
                 proxyWebsockets = true;

nixos/boxes/britway/tailscale.nix

@@ -5,18 +5,20 @@ let
   inherit (lib.my.c.britway) prefixes domain;
 
   # Can't use overrideAttrs because we need to override `vendorHash` within `buildGoModule`
-  headscale = pkgs.headscale.override {
+  headscale' = (pkgs.headscale.override {
     buildGoModule = args: pkgs.buildGoModule (args // rec {
-      version = "0.23.0-alpha2";
+      version = "0.23.0-alpha12";
       src = pkgs.fetchFromGitHub {
         owner = "juanfont";
         repo = "headscale";
         rev = "v${version}";
-        hash = "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=";
+        hash = "sha256-kZZK0cXnFARxblSMz01TDcBbTorkHGAwGpR+a4/mYfU=";
       };
-      vendorHash = "sha256-u9AmJguQ5dnJpfhOeLN43apvMHuraOrJhvlEIp9RoIc=";
+      patches = [];
+      vendorHash = "sha256-EorT2AVwA3usly/LcNor6r5UIhLCdj3L4O4ilgTIC2o=";
+      doCheck = false;
     });
-  };
+  });
 
   advRoutes = concatStringsSep "," [
     lib.my.c.home.prefixes.all.v4
@@ -39,19 +41,20 @@ in
     services = {
       headscale = {
         enable = true;
-        package = headscale;
         settings = {
           disable_check_updates = true;
           unix_socket_permission = "0770";
-          server_url = "https://ts.${pubDomain}";
+          server_url = "https://hs.${pubDomain}";
-          db_type = "sqlite3";
+          database = {
-          db_path = "/var/lib/headscale/db.sqlite3";
+            type = "sqlite3";
+            sqlite.path = "/var/lib/headscale/db.sqlite3";
+          };
           noise.private_key_path = "/var/lib/headscale/noise_private.key";
-          ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ];
+          prefixes = with lib.my.c.tailscale.prefix; { inherit v4 v6; };
-          dns_config = {
+          dns = {
             # Use IPs that will route inside the VPN to prevent interception
             # (e.g. DNS rebinding filtering)
-            restricted_nameservers = {
+            nameservers.split = {
               "${domain}" = pubNameservers;
               "${lib.my.c.colony.domain}" = with allAssignments.estuary.base; [
                 ipv4.address ipv6.address
@@ -65,7 +68,6 @@ in
             };
             magic_dns = true;
             base_domain = "ts.${pubDomain}";
-            override_local_dns = false;
           };
           oidc = {
             only_start_if_oidc_is_available = true;
@@ -85,7 +87,7 @@ in
         interfaceName = "tailscale0";
         extraUpFlags = [
           "--operator=${config.my.user.config.name}"
-          "--login-server=https://ts.nul.ie"
+          "--login-server=https://hs.nul.ie"
           "--netfilter-mode=off"
           "--advertise-exit-node"
           "--advertise-routes=${advRoutes}"

nixos/boxes/colony/default.nix

@@ -252,10 +252,10 @@ in
                   };
                   ipv6Prefixes = [
                     {
-                      ipv6PrefixConfig.Prefix = prefixes.vms.v6;
+                      Prefix = prefixes.vms.v6;
                     }
                   ];
-                  routes = map (r: { routeConfig = r; }) [
+                  routes = [
                     {
                       Destination = prefixes.ctrs.v4;
                       Gateway = allAssignments.shill.routing.ipv4.address;
@@ -264,10 +264,12 @@ in
                       Destination = prefixes.ctrs.v6;
                       Gateway = allAssignments.shill.internal.ipv6.address;
                     }
+
                     {
                       Destination = allAssignments.shill.internal.ipv4.address;
                       Gateway = allAssignments.shill.routing.ipv4.address;
                     }
+
                     {
                       Destination = lib.my.c.tailscale.prefix.v4;
                       Gateway = allAssignments.shill.routing.ipv4.address;
@@ -276,6 +278,11 @@ in
                       Destination = lib.my.c.tailscale.prefix.v6;
                       Gateway = allAssignments.shill.internal.ipv6.address;
                     }
+                    {
+                      Destination = prefixes.qclk.v4;
+                      Gateway = allAssignments.shill.routing.ipv4.address;
+                    }
+
                     {
                       Destination = prefixes.jam.v6;
                       Gateway = allAssignments.shill.internal.ipv6.address;
@@ -320,10 +327,10 @@ in
                 };
                 ipv6Prefixes = [
                   {
-                    ipv6PrefixConfig.Prefix = prefixes.mail.v6;
+                    Prefix = prefixes.mail.v6;
                   }
                 ];
-                routes = map (r: { routeConfig = r; }) [
+                routes = [
                   {
                     Destination = prefixes.mail.v4;
                     Scope = "link";
@@ -343,10 +350,10 @@ in
                 };
                 ipv6Prefixes = [
                   {
-                    ipv6PrefixConfig.Prefix = prefixes.darts.v6;
+                    Prefix = prefixes.darts.v6;
                   }
                 ];
-                routes = map (r: { routeConfig = r; }) [
+                routes = [
                   {
                     Destination = prefixes.darts.v4;
                     Scope = "link";

nixos/boxes/colony/vms/default.nix

@@ -29,6 +29,9 @@
     };
   in
   {
+    # Kernel Same-Page Merging to attempt memory usage reduction
+    hardware.ksm.enable = false;
+
     systemd = {
       network = {
         links = {
@@ -130,7 +133,7 @@
 
               (vm.lvmDisk "media")
               (vm.lvmDisk "minio")
-              (vm.lvmDisk "nix-atticd")
+              (vm.lvmDisk "nix-cache")
               (vm.lvmDisk "jam")
             ]);
           };

nixos/boxes/colony/vms/estuary/default.nix

@@ -164,11 +164,9 @@ in
                     };
                     wireguardPeers = [
                       {
-                        wireguardPeerConfig = {
+                        PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
-                          PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
+                        AllowedIPs = [ allAssignments.kelder.estuary.ipv4.address ];
-                          AllowedIPs = [ allAssignments.kelder.estuary.ipv4.address ];
+                        PersistentKeepalive = 25;
-                          PersistentKeepalive = 25;
-                        };
                       }
                     ];
                   };
@@ -278,47 +276,51 @@ in
                     };
                     ipv6Prefixes = [
                       {
-                        ipv6PrefixConfig.Prefix = prefixes.base.v6;
+                        Prefix = prefixes.base.v6;
                       }
                     ];
-                    routes = map (r: { routeConfig = r; }) (flatten
+                    routes = flatten ([
-                      ([
+                      {
-                        {
+                        Destination = prefixes.vip1;
-                          Destination = prefixes.vip1;
+                        Gateway = allAssignments.colony.routing.ipv4.address;
-                          Gateway = allAssignments.colony.routing.ipv4.address;
+                      }
-                        }
+                      {
-                        {
+                        Destination = prefixes.vip3;
-                          Destination = prefixes.vip3;
+                        Gateway = allAssignments.colony.routing.ipv4.address;
-                          Gateway = allAssignments.colony.routing.ipv4.address;
+                      }
-                        }
+                      {
-                        {
+                        Destination = prefixes.darts.v4;
-                          Destination = prefixes.darts.v4;
+                        Gateway = allAssignments.colony.routing.ipv4.address;
-                          Gateway = allAssignments.colony.routing.ipv4.address;
+                      }
-                        }
+                      {
-                        {
+                        Destination = prefixes.cust.v6;
-                          Destination = prefixes.cust.v6;
+                        Gateway = allAssignments.colony.internal.ipv6.address;
-                          Gateway = allAssignments.colony.internal.ipv6.address;
+                      }
-                        }
 
-                        {
+                      {
-                          Destination = lib.my.c.tailscale.prefix.v4;
+                        Destination = lib.my.c.tailscale.prefix.v4;
-                          Gateway = allAssignments.colony.routing.ipv4.address;
+                        Gateway = allAssignments.colony.routing.ipv4.address;
-                        }
+                      }
-                        {
+                      {
-                          Destination = lib.my.c.tailscale.prefix.v6;
+                        Destination = lib.my.c.tailscale.prefix.v6;
-                          Gateway = allAssignments.colony.internal.ipv6.address;
+                        Gateway = allAssignments.colony.internal.ipv6.address;
-                        }
+                      }
-                      ] ++
+
-                      (map (pName: [
+                      {
-                        {
+                        Destination = prefixes.qclk.v4;
-                          Gateway = allAssignments.colony.routing.ipv4.address;
+                        Gateway = allAssignments.colony.routing.ipv4.address;
-                          Destination = prefixes."${pName}".v4;
+                      }
-                        }
+                    ] ++
-                        {
+                    (map (pName: [
-                          Destination = prefixes."${pName}".v6;
+                      {
-                          Gateway = allAssignments.colony.internal.ipv6.address;
+                        Gateway = allAssignments.colony.routing.ipv4.address;
-                        }
+                        Destination = prefixes."${pName}".v4;
-                      ]) [ "vms" "ctrs" "oci" ])));
+                      }
+                      {
+                        Destination = prefixes."${pName}".v6;
+                        Gateway = allAssignments.colony.internal.ipv6.address;
+                      }
+                    ]) [ "vms" "ctrs" "oci" ]));
                   }
                 ];
 
@@ -327,7 +329,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
+                    routes = [
                       {
                         Destination = lib.my.c.home.prefixes.all.v4;
                         Gateway = lib.my.c.home.vips.as211024.v4;
@@ -339,10 +341,8 @@ in
                   matchConfig.Name = "kelder";
                   routes = [
                     {
-                      routeConfig = {
+                      Destination = allAssignments.kelder.estuary.ipv4.address;
-                        Destination = allAssignments.kelder.estuary.ipv4.address;
+                      Scope = "link";
-                        Scope = "link";
-                      };
                     }
                   ];
                 };
@@ -407,6 +407,7 @@ in
                       ip6 daddr ${aa.valheim-oci.internal.ipv6.address} udp dport { 2456-2457 } accept
                       ip6 daddr ${aa.waffletail.internal.ipv6.address} udp dport 41641 accept
                       ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} udp dport 25565 accept
+                      ip6 daddr ${aa.enshrouded-oci.internal.ipv6.address} udp dport { 15636-15637 } accept
                       return
                     }
                     chain filter-routing {

nixos/boxes/colony/vms/estuary/dns.nix

@@ -153,6 +153,7 @@ in
             simpcraft IN AAAA ${allAssignments.simpcraft-oci.internal.ipv6.address}
             simpcraft-staging IN A ${assignments.internal.ipv4.address}
             simpcraft-staging IN AAAA ${allAssignments.simpcraft-staging-oci.internal.ipv6.address}
+            enshrouded IN A ${assignments.internal.ipv4.address}
 
             mail-vm IN A ${net.cidr.host 0 prefixes.mail.v4}
             mail-vm IN AAAA ${net.cidr.host 1 prefixes.mail.v6}

nixos/boxes/colony/vms/git/gitea-actions.nix

@@ -35,6 +35,11 @@ in
           ];
           url = "https://git.${pubDomain}";
           tokenFile = config.age.secrets."gitea/actions-runner.env".path;
+          settings = {
+            runner = {
+              timeout = "8h";
+            };
+          };
         };
       };
     };

nixos/boxes/colony/vms/shill/containers-ext.nix

@@ -47,10 +47,10 @@ in
         };
         ipv6Prefixes = [
           {
-            ipv6PrefixConfig.Prefix = prefixes.jam.v6;
+            Prefix = prefixes.jam.v6;
           }
         ];
-        routes = map (r: { routeConfig = r; }) [
+        routes = [
           {
             Destination = prefixes.jam.v4;
             Scope = "link";
@@ -64,8 +64,8 @@ in
 
         serviceConfig = {
           CPUQuota = "400%";
-          MemoryHigh = "4G";
+          MemoryHigh = "infinity";
-          MemoryMax = "4.5G";
+          MemoryMax = "4G";
         };
 
         wantedBy = [ "machines.target" ];

nixos/boxes/colony/vms/shill/containers/chatterbox.nix

@@ -50,11 +50,6 @@ in
                   group = "matrix-synapse";
                 };
 
-                "chatterbox/syncv3.env" = {
-                  owner = "matrix-syncv3";
-                  group = "matrix-syncv3";
-                };
-
                 "chatterbox/mautrix-whatsapp.env" = {
                   owner = "mautrix-whatsapp";
                   group = "mautrix-whatsapp";
@@ -80,32 +75,21 @@ in
               matrix-synapse.extraGroups = [
                 "mautrix-whatsapp"
               ];
-              matrix-syncv3 = {
-                isSystemUser = true;
-                uid = uids.matrix-syncv3;
-                group = "matrix-syncv3";
-              };
-            };
-            groups = {
-              matrix-syncv3.gid = gids.matrix-syncv3;
             };
+            groups = { };
           };
 
           systemd = {
             network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
-            services = {
+            services = { } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
-              matrix-sliding-sync.serviceConfig = {
-                # Needs to be able to read its secrets
-                DynamicUser = mkForce false;
-                User = "matrix-syncv3";
-                Group = "matrix-syncv3";
-              };
-            } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
               # ffmpeg needed to convert GIFs to video
               path = with pkgs; [ ffmpeg ];
             }));
           };
 
+          # TODO/FIXME: https://github.com/NixOS/nixpkgs/issues/336052
+          nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
+
           services = {
             netdata.enable = true;
             matrix-synapse = {
@@ -193,20 +177,10 @@ in
                 app_service_config_files = [
                   "/var/lib/heisenbridge/registration.yml"
                   config.age.secrets."chatterbox/doublepuppet.yaml".path
-                  "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
                 ];
               };
 
             };
-            matrix-sliding-sync = {
-              enable = true;
-              createDatabase = false;
-              environmentFile = config.age.secrets."chatterbox/syncv3.env".path;
-              settings = {
-                SYNCV3_BINDADDR = "[::]:8009";
-                SYNCV3_SERVER = "http://localhost:8008";
-              };
-            };
 
             heisenbridge = {
               enable = true;
@@ -285,10 +259,12 @@ in
                       avatar = "mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak";
                     };
                   };
-                  meta.mode = "messenger";
+                  network = {
+                    mode = "messenger";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
+                  };
                   bridge = {
                     username_template = "fbm2_{{.}}";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
                     personal_filtering_spaces = true;
                     delivery_receipts = true;
                     management_room_text.welcome = "Hello, I'm a Messenger bridge bot.";
@@ -331,10 +307,12 @@ in
                       avatar = "mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv";
                     };
                   };
-                  meta.mode = "instagram";
+                  network = {
+                    mode = "instagram";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
+                  };
                   bridge = {
                     username_template = "ig_{{.}}";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
                     personal_filtering_spaces = true;
                     delivery_receipts = true;
                     management_room_text.welcome = "Hello, I'm an Instagram bridge bot.";

nixos/boxes/colony/vms/shill/containers/default.nix

@@ -8,5 +8,6 @@
     ./object.nix
     ./toot.nix
     ./waffletail.nix
+    ./qclk
   ];
 }

nixos/boxes/colony/vms/shill/containers/jackflix/default.nix

@@ -94,6 +94,14 @@ in
           };
         };
 
+        nixpkgs.config.permittedInsecurePackages = [
+          # FIXME: This is needed for Sonarr
+          "aspnetcore-runtime-wrapped-6.0.36"
+          "aspnetcore-runtime-6.0.36"
+          "dotnet-sdk-wrapped-6.0.428"
+          "dotnet-sdk-6.0.428"
+        ];
+
         services = {
           netdata.enable = true;
 

nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix

@@ -71,14 +71,12 @@ in
               RouteTable = routeTable;
             };
             wireguardPeers = [
+              # AirVPN NL
               {
-                # AirVPN NL
+                Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
-                wireguardPeerConfig = {
+                PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
-                  Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
+                PresharedKeyFile = config.age.secrets."${pskFile}".path;
-                  PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
+                AllowedIPs = [ "0.0.0.0/0" "::/0" ];
-                  PresharedKeyFile = config.age.secrets."${pskFile}".path;
-                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
-                };
               }
             ];
           };
@@ -94,7 +92,7 @@ in
               matchConfig.Name = "vpn";
               address = [ "10.182.97.37/32" "fd7d:76ee:e68f:a993:735d:ef5e:6907:b122/128" ];
               dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+              routingPolicyRules = [
                 {
                   Family = "both";
                   SuppressPrefixLength = 0;

nixos/boxes/colony/vms/shill/containers/middleman/default.nix

@@ -239,6 +239,9 @@ in
               ];
 
               recommendedTlsSettings = true;
+              recommendedBrotliSettings = true;
+              # Uh so nginx is hanging with zstd enabled... maybe let's not for now
+              # recommendedZstdSettings = true;
               clientMaxBodySize = "0";
               serverTokens = true;
               resolver = {

nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix

@@ -2,7 +2,7 @@
 let
   inherit (builtins) mapAttrs toJSON;
   inherit (lib) mkMerge mkDefault genAttrs flatten concatStringsSep;
-  inherit (lib.my.c) pubDomain;
+  inherit (lib.my.c) pubDomain home;
   inherit (lib.my.c.nginx) proxyHeaders;
   inherit (config.networking) domain;
 
@@ -35,7 +35,6 @@ let
       # For clients
       (mkWellKnown "matrix/client" (toJSON {
         "m.homeserver".base_url = "https://matrix.nul.ie";
-        "org.matrix.msc3575.proxy".url = "https://matrix-syncv3.nul.ie";
       }))
     ];
   };
@@ -145,7 +144,7 @@ in
 
       "pass.${pubDomain}" =
       let
-        upstream = "http://vaultwarden-ctr.${domain}";
+        upstream = "http://vaultwarden-ctr.${domain}:8080";
       in
       {
         locations = {
@@ -182,10 +181,6 @@ in
         ];
         useACMEHost = pubDomain;
       };
-      "matrix-syncv3.${pubDomain}" = {
-        locations."/".proxyPass = "http://chatterbox-ctr.${domain}:8009";
-        useACMEHost = pubDomain;
-      };
 
       "element.${pubDomain}" =
       let
@@ -206,7 +201,8 @@ in
           # Currently it seems like single quotes aren't escaped like they should be...
           conf = {
             brand = "/dev/player0 Matrix";
-            showLabsSettings = true;
+            show_labs_settings = true;
+            default_country_code = "IE";
             disable_guests = true;
             default_server_config = {
               "m.homeserver" = {
@@ -214,9 +210,8 @@ in
                 server_name = "nul.ie";
               };
             };
-            roomDirectory.servers = [
+            room_directory.servers = [
               "nul.ie"
-              "netsoc.ie"
               "matrix.org"
             ];
           };
@@ -396,6 +391,28 @@ in
         };
         useACMEHost = pubDomain;
       };
+
+      "pront.${pubDomain}" = mkMerge [
+        {
+          locations."/" = mkMerge [
+            {
+              proxyPass = "http://stream-hi.${home.domain}:5000";
+              proxyWebsockets = true;
+              extraConfig = proxyHeaders;
+            }
+            (ssoLoc "generic")
+          ];
+          locations."~* ^/webcam/(.*)" = mkMerge [
+            {
+              proxyPass = "http://stream-hi.${home.domain}:5050/$1$is_args$args";
+              extraConfig = proxyHeaders;
+            }
+            (ssoLoc "generic")
+          ];
+          useACMEHost = pubDomain;
+        }
+        (ssoServer "generic")
+      ];
     };
 
     minio =
@@ -407,10 +424,13 @@ in
         ignore_invalid_headers off;
       '';
 
-      nixCacheableRegex = ''^\/(\S+\.narinfo|nar\/\S+\.nar\.\S+)$'';
+      nixCacheableRegex = ''^\/(\S+\.narinfo|nar\/\S+\.nar.*|serve\/.+)$'';
       nixCacheHeaders = ''
         add_header Cache-Control $nix_cache_control;
         add_header Expires $nix_expires;
+
+        brotli on;
+        brotli_types application/x-nix-archive;
       '';
     in
     {
@@ -452,9 +472,11 @@ in
 
       "nix-cache.${pubDomain}" = {
         locations = {
-          "/".proxyPass = "http://${host}:8069";
+          "/" = {
+            proxyPass = "http://${host}:5000";
+          };
           "~ ${nixCacheableRegex}" = {
-            proxyPass = "http://${host}:8069";
+            proxyPass = "http://${host}:5000";
             extraConfig = nixCacheHeaders;
           };
         };

nixos/boxes/colony/vms/shill/containers/object.nix

@@ -31,6 +31,13 @@ in
     {
       config = mkMerge [
         {
+          fileSystems = {
+            "/var/lib/harmonia" = {
+              device = "/mnt/nix-cache";
+              options = [ "bind" ];
+            };
+          };
+
           my = {
             deploy.enable = false;
             server.enable = true;
@@ -48,6 +55,7 @@ in
                   group = config.my.user.config.group;
                 };
                 "object/atticd.env" = {};
+                "nix-cache.key" = {};
                 "object/hedgedoc.env" = {};
                 "object/wastebin.env" = {};
               };
@@ -58,6 +66,7 @@ in
                 9000 9001
                 config.services.sharry.config.bind.port
                 8069
+                5000
                 config.services.hedgedoc.settings.port
                 8088
               ];
@@ -68,14 +77,26 @@ in
             };
           };
 
-          users = with lib.my.c.ids; let inherit (config.services.atticd) user group; in {
+          users = with lib.my.c.ids; mkMerge [
-            users."${user}" = {
+            (let inherit (config.services.atticd) user group; in {
-              isSystemUser = true;
+              users."${user}" = {
-              uid = uids.atticd;
+                isSystemUser = true;
-              group = group;
+                uid = uids.atticd;
-            };
+                group = group;
-            groups."${user}".gid = gids.atticd;
+              };
-          };
+              groups."${user}".gid = gids.atticd;
+            })
+            {
+              users = {
+                harmonia = {
+                  shell = pkgs.bashInteractive;
+                  openssh.authorizedKeys.keyFiles = [
+                    lib.my.c.sshKeyFiles.harmonia
+                  ];
+                };
+              };
+            }
+          ];
 
           systemd = {
             network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
@@ -93,7 +114,9 @@ in
                   MINIO_BROWSER_REDIRECT_URL = "https://minio.nul.ie";
                 };
               };
+
               sharry = awaitPostgres;
+
               atticd = mkMerge [
                 awaitPostgres
                 {
@@ -104,6 +127,15 @@ in
                   };
                 }
               ];
+              harmonia = {
+                environment.NIX_REMOTE = "/var/lib/harmonia";
+                preStart = ''
+                  ${config.nix.package}/bin/nix store ping
+                '';
+                serviceConfig = {
+                  StateDirectory = "harmonia";
+                };
+              };
             };
           };
 
@@ -183,8 +215,8 @@ in
             };
 
             atticd = {
-              enable = true;
+              enable = false;
-              credentialsFile = config.age.secrets."object/atticd.env".path;
+              environmentFile = config.age.secrets."object/atticd.env".path;
               settings = {
                 listen = "[::]:8069";
                 allowed-hosts = [ "nix-cache.${pubDomain}" ];
@@ -203,6 +235,14 @@ in
               };
             };
 
+            harmonia = {
+              enable = true;
+              signKeyPaths = [ config.age.secrets."nix-cache.key".path ];
+              settings = {
+                priority = 30;
+              };
+            };
+
             hedgedoc = {
               enable = true;
               environmentFile = config.age.secrets."object/hedgedoc.env".path;

nixos/boxes/colony/vms/shill/containers/qclk/default.nix

@@ -0,0 +1,115 @@
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c.colony) domain prefixes qclk;
+in
+{
+  nixos.systems.qclk = { config, ... }: {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+    rendered = config.configuration.config.my.asContainer;
+
+    assignments = {
+      internal = {
+        name = "qclk-ctr";
+        inherit domain;
+        ipv4.address = net.cidr.host 10 prefixes.ctrs.v4;
+        ipv6 = {
+          iid = "::a";
+          address = net.cidr.host 10 prefixes.ctrs.v6;
+        };
+      };
+      qclk = {
+        ipv4 = {
+          address = net.cidr.host 1 prefixes.qclk.v4;
+          gateway = null;
+        };
+      };
+    };
+
+    configuration = { lib, pkgs, config, assignments, ... }:
+    let
+      inherit (lib) concatStringsSep mkMerge mkIf mkForce;
+      inherit (lib.my) networkdAssignment;
+
+      apiPort = 8080;
+
+      instances = [
+        {
+          host = 2;
+          wgKey = "D7z1FhcdxpnrGCE0wBW5PZb5BKuhCu6tcZ/5ZaYxdwQ=";
+        }
+      ];
+      ipFor = i: net.cidr.host i.host prefixes.qclk.v4;
+    in
+    {
+      config = {
+        environment = {
+          systemPackages = with pkgs; [
+            wireguard-tools
+          ];
+        };
+
+        my = {
+          deploy.enable = false;
+          server.enable = true;
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC1kcfvahYmSk8IJKaUIcGkhxf/8Yse2XnU7Qqgcglyq";
+            files = {
+              "qclk/wg.key" = {
+                group = "systemd-network";
+                mode = "440";
+              };
+            };
+          };
+
+          firewall = {
+            udp.allowed = [ qclk.wgPort ];
+            extraRules = ''
+              table inet filter {
+                chain input {
+                  iifname management tcp dport ${toString apiPort} accept
+                }
+                chain forward {
+                  iifname host0 oifname management ip saddr { ${concatStringsSep ", " lib.my.c.as211024.trusted.v4} } accept
+                }
+              }
+              table inet nat {
+                chain postrouting {
+                  iifname host0 oifname management snat ip to ${assignments.qclk.ipv4.address}
+                }
+              }
+            '';
+          };
+        };
+
+        systemd = {
+          network = {
+            netdevs."30-management" = {
+              netdevConfig = {
+                Name = "management";
+                Kind = "wireguard";
+              };
+              wireguardConfig = {
+                PrivateKeyFile = config.age.secrets."qclk/wg.key".path;
+                ListenPort = qclk.wgPort;
+              };
+              wireguardPeers = map (i: {
+                PublicKey = i.wgKey;
+                AllowedIPs = [ (ipFor i) ];
+              }) instances;
+            };
+            networks = {
+              "30-container-host0" = networkdAssignment "host0" assignments.internal;
+
+              "30-management" = networkdAssignment "management" assignments.qclk;
+            };
+          };
+        };
+
+        services = { };
+      };
+    };
+  };
+}

nixos/boxes/colony/vms/shill/containers/vaultwarden.nix

@@ -83,7 +83,7 @@ in
                 DOMAIN = "https://pass.${lib.my.c.pubDomain}";
 
                 ROCKET_ADDRESS = "::";
-                ROCKET_PORT = 80;
+                ROCKET_PORT = 8080;
 
                 SMTP_HOST = "mail.nul.ie";
                 SMTP_FROM = "pass@nul.ie";
@@ -99,6 +99,8 @@ in
             };
 
             borgbackup.jobs.vaultwarden = {
+              readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];
+
               paths = [ vwData ];
               repo = "zh2855@zh2855.rsync.net:borg/vaultwarden2";
               doInit = true;

nixos/boxes/colony/vms/shill/containers/waffletail.nix

@@ -86,7 +86,7 @@ in
             interfaceName = "tailscale0";
             extraUpFlags = [
               "--operator=${config.my.user.config.name}"
-              "--login-server=https://ts.nul.ie"
+              "--login-server=https://hs.nul.ie"
               "--netfilter-mode=off"
               "--advertise-exit-node"
               "--advertise-routes=${advRoutes}"

nixos/boxes/colony/vms/shill/default.nix

@@ -94,8 +94,8 @@ in
                 device = "/dev/disk/by-label/minio";
                 fsType = "xfs";
               };
-              "/mnt/atticd" = {
+              "/mnt/nix-cache" = {
-                device = "/dev/disk/by-label/atticd";
+                device = "/dev/disk/by-label/nix-cache";
                 fsType = "ext4";
               };
             };
@@ -140,10 +140,10 @@ in
                     };
                     ipv6Prefixes = [
                       {
-                        ipv6PrefixConfig.Prefix = prefixes.ctrs.v6;
+                        Prefix = prefixes.ctrs.v6;
                       }
                     ];
-                    routes = map (r: { routeConfig = r; }) [
+                    routes = [
                       {
                         Destination = lib.my.c.tailscale.prefix.v4;
                         Gateway = allAssignments.waffletail.internal.ipv4.address;
@@ -152,6 +152,11 @@ in
                         Destination = lib.my.c.tailscale.prefix.v6;
                         Gateway = allAssignments.waffletail.internal.ipv6.address;
                       }
+
+                      {
+                        Destination = prefixes.qclk.v4;
+                        Gateway = allAssignments.qclk.internal.ipv4.address;
+                      }
                     ];
                   }
                 ];
@@ -206,11 +211,12 @@ in
                   object = {
                     bindMounts = {
                       "/mnt/minio".readOnly = false;
-                      "/mnt/atticd".readOnly = false;
+                      "/mnt/nix-cache".readOnly = false;
                     };
                   };
                   toot = {};
                   waffletail = {};
+                  qclk = {};
                 };
               in
               mkMerge [

nixos/boxes/colony/vms/whale2/default.nix

@@ -52,6 +52,7 @@ in
       valheim-oci = 2;
       simpcraft-oci = 3;
       simpcraft-staging-oci = 4;
+      enshrouded-oci = 5;
     };
 
     configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -66,6 +67,7 @@ in
 
           ./valheim.nix
           ./minecraft
+          # ./enshrouded.nix
         ];
 
         config = mkMerge [

nixos/boxes/colony/vms/whale2/enshrouded.nix

@@ -0,0 +1,35 @@
+{ lib, config, allAssignments, ... }:
+let
+  inherit (lib) concatStringsSep;
+  inherit (lib.my) dockerNetAssignment;
+in
+{
+  config = {
+    virtualisation.oci-containers.containers = {
+      enshrouded = {
+        image = "sknnr/enshrouded-dedicated-server@sha256:f163e8ba9caa2115d8a0a7b16c3696968242fb6fba82706d9a77a882df083497";
+
+        environment = {
+          SERVER_NAME = "UWUshrouded";
+          # SERVER_IP = "::"; # no IPv6?? :(
+          TZ = "Europe/Dublin";
+        };
+        environmentFiles = [ config.age.secrets."whale2/enshrouded.env".path ];
+
+        volumes = [
+          "enshrouded:/home/steam/enshrouded/savegame"
+        ];
+
+        extraOptions = [
+          ''--network=colony:${dockerNetAssignment allAssignments "enshrouded-oci"}''
+        ];
+      };
+    };
+
+    my = {
+      secrets.files = {
+        "whale2/enshrouded.env" = {};
+      };
+    };
+  };
+}

nixos/boxes/colony/vms/whale2/minecraft/default.nix

@@ -123,6 +123,7 @@ in
           within = "12H";
           hourly = 48;
         };
+        readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];
 
         # Avoid Minecraft poking the files while we back up
         preHook = rconCommand "save-off";

nixos/boxes/home/castle/default.nix

@@ -1,7 +1,8 @@
 { lib, ... }:
 let
   inherit (lib.my) net;
-  inherit (lib.my.c.home) domain vlans prefixes;
+  inherit (lib.my.c) networkd;
+  inherit (lib.my.c.home) domain vlans prefixes vips roceBootModules;
 in
 {
   nixos.systems.castle = {
@@ -15,7 +16,7 @@ in
         ipv4 = {
           address = net.cidr.host 40 prefixes.hi.v4;
           mask = 22;
-          gateway = null;
+          gateway = vips.hi.v4;
         };
         ipv6 = {
           iid = "::3:1";
@@ -35,7 +36,7 @@ in
           cpu = {
             amd.updateMicrocode = true;
           };
-          opengl.extraPackages = with pkgs; [
+          graphics.extraPackages = with pkgs; [
             intel-media-driver
           ];
           bluetooth.enable = true;
@@ -47,7 +48,7 @@ in
             timeout = 10;
           };
           kernelPackages = lib.my.c.kernel.latest pkgs;
-          kernelModules = [ "kvm-amd" ];
+          kernelModules = [ "kvm-amd" "dm-snapshot" ];
           kernelParams = [ "amd_iommu=on" "amd_pstate=passive" ];
           kernelPatches = [
             # {
@@ -57,27 +58,40 @@ in
             # }
           ];
           initrd = {
-            availableKernelModules = [ "thunderbolt" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+            availableKernelModules = [
+              "thunderbolt" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sd_mod"
+              "8021q"
+            ] ++ roceBootModules;
+            systemd.network = {
+              netdevs = mkVLAN "lan-hi" vlans.hi;
+              networks = {
+                "10-et100g" = {
+                  matchConfig.Name = "et100g";
+                  vlan = [ "lan-hi" ];
+                  linkConfig.RequiredForOnline = "no";
+                  networkConfig = networkd.noL3;
+                };
+                "20-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
+              };
+            };
           };
+
+          binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
         };
 
         fileSystems = {
-          "/boot" = {
-            device = "/dev/disk/by-partuuid/8ce4248a-3ee4-f44f-801f-064a628b4d6e";
-            fsType = "vfat";
-          };
           "/nix" = {
-            device = "/dev/disk/by-partuuid/2da23a1d-2daf-d943-b91e-fc175f3dad07";
+            device = "/dev/nvmeof/nix";
             fsType = "ext4";
           };
-
           "/persist" = {
-            device = "/dev/disk/by-partuuid/f4c80d4f-a022-e941-b5d1-fe2e65e444b9";
+            device = "/dev/nvmeof/persist";
             fsType = "ext4";
             neededForBoot = true;
           };
+
           "/home" = {
-            device = "/dev/disk/by-partuuid/992a93cf-6c9c-324b-b0ce-f8eb2d1ce10d";
+            device = "/dev/nvmeof/home";
             fsType = "ext4";
           };
         };
@@ -120,7 +134,7 @@ in
         virtualisation.libvirtd.enable = true;
 
         networking = {
-          domain = "h.${lib.my.c.pubDomain}";
+          inherit domain;
           firewall.enable = false;
         };
 
@@ -140,11 +154,14 @@ in
 
         nix = {
           gc.automatic = false;
+          settings = {
+            experimental-features = [ "recursive-nix" ];
+            system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" "recursive-nix" ];
+          };
         };
 
         systemd = {
           network = {
-            wait-online.enable = false;
             netdevs = mkMerge [
               (mkVLAN "lan-hi" vlans.hi)
             ];
@@ -161,29 +178,20 @@ in
                 matchConfig.PermanentMACAddress = "24:8a:07:a8:fe:3a";
                 linkConfig = {
                   Name = "et100g";
-                  MTUBytes = "9000";
+                  MTUBytes = toString lib.my.c.home.hiMTU;
                 };
               };
             };
             networks = {
-              "50-lan" = {
+              "30-et100g" = {
-                matchConfig.Name = "et2.5g";
-                DHCP = "no";
-                address = [ "10.16.7.1/16" ];
-              };
-
-              "50-et100g" = {
                 matchConfig.Name = "et100g";
                 vlan = [ "lan-hi" ];
                 networkConfig.IPv6AcceptRA = false;
               };
-              "60-lan-hi" = mkMerge [
+              "40-lan-hi" = mkMerge [
                 (networkdAssignment "lan-hi" assignments.hi)
-                {
+                # So we don't drop the IP we use to connect to NVMe-oF!
-                  DHCP = "yes";
+                { networkConfig.KeepConfiguration = "static"; }
-                  matchConfig.Name = "lan-hi";
-                  linkConfig.MTUBytes = "9000";
-                }
               ];
             };
           };
@@ -217,6 +225,7 @@ in
                     HDMI-A-1 = {
                       transform = "270";
                       position = "0 0";
+                      bg = "${./his-team-player.jpg} fill";
                     };
                     DP-1 = {
                       mode = "2560x1440@170Hz";
@@ -238,11 +247,19 @@ in
           };
 
           #deploy.generate.system.mode = "boot";
-          deploy.node.hostname = "castle.box.${config.networking.domain}";
           secrets = {
             key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlVuTzKObeaUuPocCF41IO/8X+443lzUJLuCIclt2vr";
           };
-          nvme.uuid = "2230b066-a674-4f45-a1dc-f7727b3a9e7b";
+          netboot.client = {
+            enable = true;
+          };
+          nvme = {
+            uuid = "2230b066-a674-4f45-a1dc-f7727b3a9e7b";
+            boot = {
+              nqn = "nqn.2016-06.io.spdk:castle";
+              address = "192.168.68.80";
+            };
+          };
 
           firewall = {
             enable = false;

nixos/boxes/home/palace/default.nix

@@ -94,7 +94,7 @@ in
             extraOptions = [ "-A /var/log/smartd/" "--interval=600" ];
           };
           udev.extraRules = ''
-            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="3"
+            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="4"
           '';
         };
 
@@ -188,6 +188,13 @@ in
                   VLANId=${toString vlans.hi}
                   LinkState=yes
                   MACAddress=52:54:00:ac:15:a9
+
+                  # sfh bridge
+                  [SR-IOV]
+                  VirtualFunction=3
+                  VLANId=${toString vlans.hi}
+                  LinkState=yes
+                  MACAddress=52:54:00:90:34:95
                 '';
               };
               "60-lan-hi" = networkdAssignment "lan-hi" assignments.hi;

nixos/boxes/home/palace/vms/default.nix

@@ -183,6 +183,10 @@
                 index = 0;
                 hostBDF = "44:00.3";
               };
+              et100g0vf3 = {
+                index = 1;
+                hostBDF = "44:00.4";
+              };
             };
           };
         };

nixos/boxes/home/palace/vms/river.nix

@@ -24,6 +24,7 @@
           initrd = {
             availableKernelModules = [
               "virtio_pci" "ahci" "sr_mod" "virtio_blk"
+              "8021q"
             ] ++ roceBootModules;
             kernelModules = [ "dm-snapshot" ];
             systemd = {
@@ -122,7 +123,7 @@
             ip = assignments.lo.ipv4.address;
             host = "boot.${domain}";
             allowedPrefixes = with prefixes; [ hi.v4 hi.v6 lo.v4 lo.v6 ];
-            instances = [ "sfh" ];
+            instances = [ "sfh" "castle" ];
           };
 
           deploy.node.hostname = "192.168.68.1";

nixos/boxes/home/palace/vms/sfh/containers/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./unifi.nix
+  ];
+}

nixos/boxes/home/palace/vms/sfh/containers/unifi.nix

@@ -0,0 +1,65 @@
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c.home) domain prefixes vips hiMTU;
+in
+{
+  nixos.systems.unifi = { config, ... }: {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+    rendered = config.configuration.config.my.asContainer;
+
+    assignments = {
+      hi = {
+        name = "unifi-ctr";
+        inherit domain;
+        mtu = hiMTU;
+        ipv4 = {
+          address = net.cidr.host 100 prefixes.hi.v4;
+          mask = 22;
+          gateway = vips.hi.v4;
+        };
+        ipv6 = {
+          iid = "::5:1";
+          address = net.cidr.host (65536*5+1) prefixes.hi.v6;
+        };
+      };
+    };
+
+    configuration = { lib, config, pkgs, assignments, ... }:
+    let
+      inherit (lib) mkMerge mkIf mkForce;
+      inherit (lib.my) networkdAssignment;
+    in
+    {
+      config = {
+        my = {
+          deploy.enable = false;
+          server.enable = true;
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdgcziQki/RH7E+NH2bYnzSVKaJ27905Yo5TcOjSh/U";
+            files = { };
+          };
+
+          firewall = {
+            tcp.allowed = [ 8443 ];
+          };
+        };
+
+        systemd = {
+          network.networks."80-container-host0" = networkdAssignment "host0" assignments.hi;
+        };
+
+        services = {
+          unifi = {
+            enable = true;
+            openFirewall = true;
+            unifiPackage = pkgs.unifi8;
+            mongodbPackage = pkgs.mongodb-6_0;
+          };
+        };
+      };
+    };
+  };
+}

nixos/boxes/home/palace/vms/sfh/default.nix

@@ -1,14 +1,16 @@
 { lib, ... }:
 let
   inherit (lib.my) net;
-  inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.home) domain prefixes vips hiMTU roceBootModules;
 in
 {
+  imports = [ ./containers ];
+
   config.nixos.systems.sfh = {
     system = "x86_64-linux";
     nixpkgs = "mine";
     home-manager = "mine";
+
     assignments = {
       hi = {
         inherit domain;
@@ -27,8 +29,9 @@ in
 
     configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
     let
-      inherit (lib) mkMerge;
+      inherit (lib) mapAttrs mkMerge;
       inherit (lib.my) networkdAssignment;
+      inherit (lib.my.c) networkd;
       inherit (lib.my.c.home) domain;
     in
     {
@@ -92,13 +95,30 @@ in
                 MTUBytes = toString lib.my.c.home.hiMTU;
               };
             };
+            "10-lan-hi-ctrs" = {
+              matchConfig = {
+                Driver = "mlx5_core";
+                PermanentMACAddress = "52:54:00:90:34:95";
+              };
+              linkConfig = {
+                Name = "lan-hi-ctrs";
+                MTUBytes = toString lib.my.c.home.hiMTU;
+              };
+            };
           };
 
-          networks."30-lan-hi" = mkMerge [
+          networks = {
-            (networkdAssignment "lan-hi" assignments.hi)
+            "30-lan-hi" = mkMerge [
-            # So we don't drop the IP we use to connect to NVMe-oF!
+              (networkdAssignment "lan-hi" assignments.hi)
-            { networkConfig.KeepConfiguration = "static"; }
+              # So we don't drop the IP we use to connect to NVMe-oF!
-          ];
+              { networkConfig.KeepConfiguration = "static"; }
+            ];
+            "30-lan-hi-ctrs" = {
+              matchConfig.Name = "lan-hi-ctrs";
+              linkConfig.RequiredForOnline = "no";
+              networkConfig = networkd.noL3;
+            };
+          };
         };
 
         my = {
@@ -117,6 +137,19 @@ in
               address = "192.168.68.80";
             };
           };
+
+          containers.instances =
+          let
+            instances = {
+              unifi = {};
+            };
+          in
+          mkMerge [
+            instances
+            (mapAttrs (n: i: {
+              networking.macVLAN = "lan-hi-ctrs";
+            }) instances)
+          ];
         };
       };
     };

nixos/boxes/home/routing-common/default.nix

@@ -227,7 +227,7 @@ in
                   networkConfig = networkd.noL3;
                   extraConfig = ''
                     [CAKE]
-                    Bandwidth=235M
+                    Bandwidth=490M
                     RTTSec=50ms
                     PriorityQueueingPreset=besteffort
                     # DOCSIS preset
@@ -251,7 +251,7 @@ in
                     extraConfig = ''
                       [CAKE]
                       Parent=root
-                      Bandwidth=24M
+                      Bandwidth=48M
                       RTTSec=50ms
                     '';
                   }
@@ -276,7 +276,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
+                    routes = [
                       {
                         Destination = lib.my.c.colony.prefixes.all.v4;
                         Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -301,7 +301,7 @@ in
 
               {
                 "60-lan-hi" = {
-                  routes = map (r: { routeConfig = r; }) [
+                  routes = [
                     {
                       Destination = elemAt routersPubV4 otherIndex;
                       Gateway = net.cidr.host (otherIndex + 1) prefixes.hi.v4;

nixos/boxes/home/routing-common/dns.nix

@@ -170,8 +170,8 @@ in
               hostname = "${otherName}.${config.networking.domain}";
               server = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
             }}
-            ${elemAt routers 0} IN AAAA ${net.cidr.host 1 prefixes.hi.v6}
+            ${elemAt routers 0} IN AAAA ${allAssignments."${elemAt routers 0}".as211024.ipv6.address}
-            ${elemAt routers 1} IN AAAA ${net.cidr.host 2 prefixes.hi.v6}
+            ${elemAt routers 1} IN AAAA ${allAssignments."${elemAt routers 1}".as211024.ipv6.address}
             boot IN CNAME river-hi.${config.networking.domain}.
 
             @ IN NS ns1
@@ -199,7 +199,7 @@ in
             shytzel IN A ${net.cidr.host 12 prefixes.core.v4}
 
             wave IN A ${net.cidr.host 12 prefixes.hi.v4}
-            wave IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
+            ; wave IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
             vibe IN A ${net.cidr.host 13 prefixes.hi.v4}
             vibe IN AAAA ${net.cidr.host (65536+4) prefixes.hi.v6}
 

nixos/boxes/home/routing-common/kea.nix

@@ -68,6 +68,7 @@ in
             hostname = "boot.${domain}";
             systems = {
               sfh = "52:54:00:a5:7e:93";
+              castle = "c8:7f:54:6e:17:0f";
             };
           };
           subnet4 = [

nixos/boxes/home/routing-common/keepalived.nix

@@ -36,10 +36,6 @@ let
     virtualRouterId = routerId;
     virtualIps = vrrpIPs family;
     trackScripts = [ "${family}Alive" ];
-    extraConfig = ''
-      notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
-      notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
-    '';
   };
 in
 {
@@ -66,7 +62,12 @@ in
       };
       vrrpInstances = {
         v4 = mkVRRP "v4" 51;
-        v6 = mkVRRP "v6" 52;
+        v6 = (mkVRRP "v6" 52) // {
+          extraConfig = ''
+            notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
+            notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
+          '';
+        };
       };
       # Actually disable this for now, don't want to fault IPv4 just because IPv6 is broken...
       # extraConfig = ''

nixos/boxes/home/stream.nix

@@ -43,6 +43,38 @@
           };
         };
 
+        services = {
+          mjpg-streamer = {
+            enable = true;
+            inputPlugin = "input_uvc.so";
+            outputPlugin = "output_http.so -w @www@ -n -p 5050";
+          };
+          octoprint = {
+            enable = true;
+            host = "::";
+            extraConfig = {
+              plugins = {
+                classicwebcam = {
+                  snapshot = "/webcam/?action=snapshot";
+                  stream = "/webcam/?action=stream";
+                  streamRatio = "4:3";
+                };
+              };
+              serial = {
+                port = "/dev/ttyACM0";
+                baudrate = 115200;
+              };
+              temperature.profiles = [
+                {
+                  bed = 60;
+                  extruder = 215;
+                  name = "PLA";
+                }
+              ];
+            };
+          };
+        };
+
         systemd.network = {
           netdevs = {
             "25-lan" = {

nixos/boxes/kelder/containers/acquisition/default.nix

@@ -26,7 +26,7 @@ in
 
       config = {
         # Hardware acceleration for Jellyfin
-        hardware.opengl = {
+        hardware.graphics = {
           enable = true;
           extraPackages = with pkgs; [
             vaapiIntel
@@ -78,6 +78,14 @@ in
           };
         };
 
+        nixpkgs.config.permittedInsecurePackages = [
+          # FIXME: This is needed for Sonarr
+          "aspnetcore-runtime-wrapped-6.0.36"
+          "aspnetcore-runtime-6.0.36"
+          "dotnet-sdk-wrapped-6.0.428"
+          "dotnet-sdk-6.0.428"
+        ];
+
         services = {
           transmission = {
             enable = true;

nixos/boxes/kelder/containers/acquisition/networking.nix

@@ -73,14 +73,12 @@ in
               RouteTable = routeTable;
             };
             wireguardPeers = [
+              # AirVPN IE
               {
-                # AirVPN IE
+                Endpoint = "146.70.94.2:1637";
-                wireguardPeerConfig = {
+                PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
-                  Endpoint = "146.70.94.2:1637";
+                PresharedKeyFile = config.age.secrets."${pskFile}".path;
-                  PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
+                AllowedIPs = [ "0.0.0.0/0" "::/0" ];
-                  PresharedKeyFile = config.age.secrets."${pskFile}".path;
-                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
-                };
               }
             ];
           };
@@ -97,7 +95,7 @@ in
               matchConfig.Name = "vpn";
               address = [ "10.161.170.28/32" "fd7d:76ee:e68f:a993:b12d:6d15:c80a:9516/128" ];
               dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+              routingPolicyRules = [
                 {
                   Family = "both";
                   SuppressPrefixLength = 0;

nixos/boxes/kelder/default.nix

@@ -121,8 +121,7 @@ in
 
             samba = {
               enable = true;
-              enableNmbd = true;
+              settings = {
-              shares = {
                 storage = {
                   path = "/mnt/storage";
                   browseable = "yes";
@@ -131,6 +130,8 @@ in
                   "directory mask" = "0775";
                 };
               };
+
+              nmbd.enable = true;
             };
             samba-wsdd.enable = true;
 
@@ -180,12 +181,10 @@ in
                   };
                   wireguardPeers = [
                     {
-                      wireguardPeerConfig = {
+                      PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
-                        PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
+                      Endpoint = "${allAssignments.estuary.internal.ipv4.address}:${toString lib.my.c.kelder.vpn.port}";
-                        Endpoint = "${allAssignments.estuary.internal.ipv4.address}:${toString lib.my.c.kelder.vpn.port}";
+                      AllowedIPs = [ "0.0.0.0/0" ];
-                        AllowedIPs = [ "0.0.0.0/0" ];
+                      PersistentKeepalive = 25;
-                        PersistentKeepalive = 25;
-                      };
                     }
                   ];
                 };
@@ -213,7 +212,7 @@ in
                   address = with assignments.estuary; [
                     (with ipv4; "${address}/${toString mask}")
                   ];
-                  routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+                  routingPolicyRules = [
                     {
                       Family = "both";
                       SuppressPrefixLength = 0;

nixos/boxes/tower/default.nix

@@ -14,7 +14,7 @@
           cpu = {
             intel.updateMicrocode = true;
           };
-          opengl.extraPackages = with pkgs; [
+          graphics.extraPackages = with pkgs; [
             intel-media-driver
           ];
           bluetooth.enable = true;
@@ -177,7 +177,7 @@
               programs = {
                 fish = {
                   shellAbbrs = {
-                    tsup = "doas tailscale up --login-server=https://ts.nul.ie --accept-routes";
+                    tsup = "doas tailscale up --login-server=https://hs.nul.ie --accept-routes";
                   };
                 };
               };

nixos/default.nix

@@ -35,7 +35,7 @@ let
       system = null;
 
       # Put the inputs in specialArgs to avoid infinite recursion when modules try to do imports
-      specialArgs = { inherit inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
+      specialArgs = { inherit self inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
 
       # `baseModules` informs the manual which modules to document
       baseModules =

nixos/installer.nix

@@ -61,8 +61,8 @@
           };
 
           networking = {
-            # Will be set dynamically
+            # Will be set dynamically, but need something to satisfy `/etc/os-release` stuff
-            hostName = "";
+            hostName = "installer";
             useNetworkd = false;
           };
 
@@ -82,11 +82,12 @@
                 ${pkgs.gawk}/bin/awk '{ print $1 }')"
             '';
 
+          boot.supportedFilesystems.nfs = true;
+
           environment.systemPackages = with pkgs; [
             dhcpcd
             lm_sensors
             ethtool
-            nfs-utils
           ];
 
           # Much of this onwards is yoinked from modules/profiles/installation-device.nix

nixos/modules/build.nix

@@ -54,6 +54,7 @@ let
           loader.grub.enable = false;
           initrd = {
             kernelModules = [ "nbd" ];
+            availableKernelModules = [ "igb" "igc" ];
 
             systemd = {
               storePaths = with pkgs; [
@@ -67,8 +68,8 @@ let
                 nbd-client = "${nbd}/bin/nbd-client";
               };
               extraConfig = ''
-                DefaultTimeoutStartSec=10
+                DefaultTimeoutStartSec=20
-                DefaultDeviceTimeoutSec=10
+                DefaultDeviceTimeoutSec=20
               '';
 
               network = {

nixos/modules/common.nix

@@ -1,4 +1,4 @@
-{ lib, pkgsFlake, pkgs, pkgs', inputs, config, ... }:
+{ lib, pkgsFlake, pkgs, pkgs', self, inputs, config, ... }:
 let
   inherit (lib) mkIf mkDefault mkMerge;
   inherit (lib.my) mkDefault';
@@ -12,7 +12,6 @@ in
     inputs.impermanence.nixosModule
     inputs.ragenix.nixosModules.age
     inputs.sharry.nixosModules.default
-    inputs.attic.nixosModules.atticd
   ];
 
   config = mkMerge [
@@ -41,6 +40,7 @@ in
 
       nix = {
         package = pkgs'.mine.nix;
+        channel.enable = false;
         settings = with lib.my.c.nix; {
           trusted-users = [ "@wheel" ];
           experimental-features = [ "nix-command" "flakes" "ca-derivations" ];
@@ -127,6 +127,9 @@ in
         };
       };
 
+      environment.etc = {
+        "nixos/flake.nix".source = "/run/nixfiles/flake.nix";
+      };
       environment.systemPackages = with pkgs; mkMerge [
         [
           bash-completion
@@ -142,7 +145,10 @@ in
         fish.enable = mkDefault true;
         # TODO: This is expecting to look up the channel for the database...
         command-not-found.enable = mkDefault false;
-        vim.defaultEditor = true;
+        vim = {
+          enable = true;
+          defaultEditor = true;
+        };
       };
 
       services = {
@@ -209,14 +215,35 @@ in
             # python.d plugin script does #!/usr/bin/env bash
             path = with pkgs; [ bash ];
           };
+
+          nixfiles-mutable = {
+            description = "Mutable nixfiles";
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+
+            path = with pkgs; [ util-linux ];
+            script = ''
+              nixfilesDir="${self}"
+
+              mkdir -p /run/nixfiles{,/.rw,/.work}
+              mount -t overlay overlay -o lowerdir="$nixfilesDir",upperdir=/run/nixfiles/.rw,workdir=/run/nixfiles/.work /run/nixfiles
+              chmod -R u+w /run/nixfiles
+            '';
+            preStop = ''
+              umount /run/nixfiles
+              rm -rf /run/nixfiles
+            '';
+
+            wantedBy = [ "multi-user.target" ];
+          };
         };
       };
     }
     (mkIf config.services.kmscon.enable {
       fonts.fonts = with pkgs; [
-        (nerdfonts.override {
+        nerd-fonts.sauce-code-pro
-          fonts = [ "SourceCodePro" ];
-        })
       ];
     })
   ];

nixos/modules/containers.nix

@@ -1,6 +1,6 @@
 { lib, pkgs, options, config, systems, ... }:
 let
-  inherit (builtins) attrNames attrValues all hashString toJSON;
+  inherit (builtins) attrNames attrValues all hashString toJSON any;
   inherit (lib)
     groupBy' mapAttrsToList optionalString optional concatMapStringsSep filterAttrs mkOption mkDefault mkIf mkMerge;
   inherit (lib.my) mkOpt' mkBoolOpt';
@@ -98,6 +98,7 @@ let
       };
       networking = {
         bridge = mkOpt' (nullOr str) null "Network bridge to connect to.";
+        macVLAN = mkOpt' (nullOr str) null "Network interface to make MACVLAN interface from.";
       };
     };
   };
@@ -115,13 +116,17 @@ in
           assertion = config.systemd.network.enable;
           message = "Containers currently require systemd-networkd!";
         }
+        {
+          assertion = all (i: i.networking.bridge == null || i.networking.macVLAN == null) (attrValues cfg.instances);
+          message = "Only bridge OR MACVLAN can be set";
+        }
       ];
 
       # TODO: Better security
       my.firewall.trustedInterfaces =
         mapAttrsToList
           (n: _: "ve-${n}")
-          (filterAttrs (_: c: c.networking.bridge == null) cfg.instances);
+          (filterAttrs (_: c: c.networking.bridge == null && c.networking.macVLAN == null) cfg.instances);
 
       systemd = mkMerge (mapAttrsToList (n: c: {
         nspawn."${n}" = {
@@ -154,6 +159,8 @@ in
           };
           networkConfig = if (c.networking.bridge != null) then {
             Bridge = c.networking.bridge;
+          } else if (c.networking.macVLAN != null) then {
+            MACVLAN = "${c.networking.macVLAN}:host0";
           } else {
             VirtualEthernet = true;
           };

nixos/modules/gui.nix

@@ -12,7 +12,7 @@ in
 
   config = mkIf cfg.enable {
     hardware = {
-      opengl.enable = mkDefault true;
+      graphics.enable = mkDefault true;
     };
 
     systemd = {
@@ -53,6 +53,8 @@ in
           SUBSYSTEM=="usb", ATTR{idVendor}=="057e", MODE="0664", GROUP="wheel"
           # FT
           SUBSYSTEM=="usb", ATTR{idVendor}=="0403", MODE="0664", GROUP="wheel"
+          # /dev/player0
+          SUBSYSTEM=="usb", ATTR{idVendor}=="6969", MODE="0664", GROUP="wheel"
         '';
       };
     };

nixos/modules/l2mesh.nix

@@ -44,10 +44,8 @@ let
       toString (mesh.baseMTU - overhead);
 
       bridgeFDBs = mapAttrsToList (n: peer: {
-        bridgeFDBConfig = {
+        MACAddress = "00:00:00:00:00:00";
-          MACAddress = "00:00:00:00:00:00";
+        Destination = peer.addr;
-          Destination = peer.addr;
-        };
       }) otherPeers;
     };
   };

nixos/modules/netboot/default.nix

@@ -5,10 +5,19 @@ let
 
   cfg = config.my.netboot;
 
+  ipxe = pkgs.ipxe.overrideAttrs (o: rec {
+    version = "1.21.1-unstable-2024-06-27";
+    src = pkgs.fetchFromGitHub {
+      owner = "ipxe";
+      repo = "ipxe";
+      rev = "b66e27d9b29a172a097c737ab4d378d60fe01b05";
+      hash = "sha256-TKZ4WjNV2oZIYNefch7E7m1JpeoC/d7O1kofoNv8G40=";
+    };
+  });
   tftpRoot = pkgs.linkFarm "tftp-root" [
     {
       name = "ipxe-x86_64.efi";
-      path = "${pkgs.ipxe}/ipxe.efi";
+      path = "${ipxe}/ipxe.efi";
     }
   ];
   menuFile = pkgs.runCommand "menu.ipxe" {

nixos/modules/nvme/default.nix

@@ -5,7 +5,15 @@ let
 
   cfg = config.my.nvme;
   nvme-cli = pkgs.nvme-cli.override {
-    libnvme = pkgs.libnvme.overrideAttrs (o: {
+    libnvme = pkgs.libnvme.overrideAttrs (o: rec {
+      # TODO: Remove when 1.11.1 releases (see https://github.com/linux-nvme/libnvme/pull/914)
+      version = "1.11.1";
+      src = pkgs.fetchFromGitHub {
+        owner = "linux-nvme";
+        repo = "libnvme";
+        rev = "v${version}";
+        hash = "sha256-CEGr7PDOVRi210XvICH8iLYDKn8S9bGruBO4tycvsT8=";
+      };
       patches = (if (o ? patches) then o.patches else [ ]) ++ [ ./libnvme-hostconf.patch ];
     });
   };

nixos/modules/tmproot.nix

@@ -147,6 +147,15 @@ in
             "/var/lib/systemd"
 
             { directory = "/root/.cache/nix"; mode = "0700"; }
+            # Including these unconditionally due to infinite recursion problems...
+            {
+              directory = "/etc/lvm/archive";
+              mode = "0700";
+            }
+            {
+              directory = "/etc/lvm/backup";
+              mode = "0700";
+            }
           ];
           files = [
             "/etc/machine-id"
@@ -260,18 +269,6 @@ in
         my.tmproot.persistence.config.files =
           concatMap (k: [ k.path "${k.path}.pub" ]) config.services.openssh.hostKeys;
       })
-      (mkIf config.services.lvm.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/etc/lvm/archive";
-            mode = "0700";
-          }
-          {
-            directory = "/etc/lvm/backup";
-            mode = "0700";
-          }
-        ];
-      })
       (mkIf (config.security.acme.certs != { }) {
         my.tmproot.persistence.config.directories = [
           {
@@ -523,6 +520,37 @@ in
           group = "mautrix-meta";
         }) (filterAttrs (_: i: i.enable) config.services.mautrix-meta.instances);
       }
+      (mkIf config.services.unifi.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/unifi";
+            mode = "0750";
+            user = "unifi";
+            group = "unifi";
+          }
+          {
+            directory = "/var/cache/unifi";
+            mode = "0750";
+            user = "unifi";
+            group = "unifi";
+          }
+        ];
+      })
+      (persistSimpleSvc "octoprint")
+      (mkIf (config.services.borgbackup.jobs != { }) {
+        my.tmproot.persistence.config.directories = [
+          "/var/lib/borgbackup"
+          "/var/cache/borgbackup"
+        ];
+
+        services.borgbackup.package = pkgs.borgbackup.overrideAttrs (o: {
+          makeWrapperArgs = o.makeWrapperArgs ++ [
+            "--set-default BORG_BASE_DIR /var/lib/borgbackup"
+            "--set-default BORG_CONFIG_DIR /var/lib/borgbackup/config"
+            "--set-default BORG_CACHE_DIR /var/cache/borgbackup"
+          ];
+        });
+      })
     ]))
   ]);
 

nixos/modules/user.nix

@@ -82,6 +82,10 @@ in
       # NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
       # passed to it
       home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
+
+      systemd.services.nixfiles-mutable.script = ''
+        chown -R ${user'.name} /run/nixfiles
+      '';
     }
     (mkIf (cfg.passwordSecret != null) {
       my = {

pkgs/default.nix

@@ -7,8 +7,7 @@ in
   monocraft' = callPackage ./monocraft.nix { };
   vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
   librespeed-go = callPackage ./librespeed-go.nix { };
-  modrinth-app = callPackage ./modrinth-app { };
+  # modrinth-app = callPackage ./modrinth-app { };
-  glfw-minecraft = callPackage ./glfw-minecraft { };
   chocolate-doom2xx = callPackage ./chocolate-doom2xx { };
   windowtolayer = callPackage ./windowtolayer.nix { };
   swaylock-plugin = callPackage ./swaylock-plugin.nix { };

pkgs/glfw-minecraft/default.nix

@@ -1,6 +0,0 @@
-{ lib, glfw-wayland-minecraft, ... }:
-glfw-wayland-minecraft.overrideAttrs (o: {
-  patches = [
-    ./suppress-wayland-errors.patch
-  ];
-})

pkgs/glfw-minecraft/suppress-wayland-errors.patch

@@ -1,43 +0,0 @@
-diff --git a/src/wl_window.c b/src/wl_window.c
-index 7c509896..db9a6451 100644
---- a/src/wl_window.c
-+++ b/src/wl_window.c
-@@ -2115,25 +2115,21 @@ void _glfwSetWindowTitleWayland(_GLFWwindow* window, const char* title)
- void _glfwSetWindowIconWayland(_GLFWwindow* window,
-                                int count, const GLFWimage* images)
- {
--    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
--                    "Wayland: The platform does not support setting the window icon");
-+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window icon\n");
- }
- 
- void _glfwGetWindowPosWayland(_GLFWwindow* window, int* xpos, int* ypos)
- {
-     // A Wayland client is not aware of its position, so just warn and leave it
-     // as (0, 0)
--
--    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
--                    "Wayland: The platform does not provide the window position");
-+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not provide the window position\n");
- }
- 
- void _glfwSetWindowPosWayland(_GLFWwindow* window, int xpos, int ypos)
- {
-     // A Wayland client can not set its position, so just warn
- 
--    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
--                    "Wayland: The platform does not support setting the window position");
-+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window position\n");
- }
- 
- void _glfwGetWindowSizeWayland(_GLFWwindow* window, int* width, int* height)
-@@ -2359,8 +2355,7 @@ void _glfwRequestWindowAttentionWayland(_GLFWwindow* window)
- 
- void _glfwFocusWindowWayland(_GLFWwindow* window)
- {
--    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
--                    "Wayland: The platform does not support setting the input focus");
-+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the input focus\n");
- }
- 
- void _glfwSetWindowMonitorWayland(_GLFWwindow* window,

secrets/britway/bgp-password-vultr.conf.age

@@ -1,12 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBoNHhS
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBrMXND
-YS81MkpQR2w0ZWNQS1BXMDF1Ry9RNm5heVhYc1haMUx4YWFaUFFrCnJUM2lGdkty
+Zm1ma0FoNE5lWTFNTGlyeUQzdUZxMkxyVlU0cWdrcTJEakhDVXg4ClkyczJDR1FL
-enNFQVhRSzRONzVjVEZwdHR1K0FCV0N1UHhrd1VTQVZkc3MKLT4gWDI1NTE5IFRS
+eXE3QWFTM0wyeDNvL1gvcmx6eGE4elNuZW9wRHhJZ3Aya2cKLT4gWDI1NTE5IDhO
-ZlAxV1ROLzhNcnNhQ1NRaFQ3VnlkRkFFSXg0UjlrUnFuejRlSFVrQ28KSUNYbndD
+S2JWNDhlclpERFFUTktyUG5HbnNxcVQvWmphOGp1cmNpK0NGZWVTejQKN0dybHl5
-T0tSWGFYT29WeW9CcTlybU9pWlZyVGw1eG5QVHBGZFFuKzlzdwotPiB3YnJOZi1n
+eHhicFNpUHQ3WFZDQS90NG5VZW5zVm8rcUxCdkZkOFVqdVFzRQotPiBBLWdyZWFz
-cmVhc2UKVW5EVFowdUJHa3R6MjgvS2FFL283K0h2b1VzVGhkSnFPL25FMndvZnVv
+ZSBaIDMiRCBYO1g6IF9EawpJZwotLS0geXhWb1FORm00RVJoMm4zQjhBT0hERyt3
-OW5tVXluQXMzSDRIR2UzbnBYTWJQQgpUN1lqYi9Pd0JFajZ3RjhhWm16NlVnbwot
+ekM1YXNzdTgzUTVMeHNsNDUwbwqSjgIVhg9bqtIydYC1FCA4ly2gurTcb1SUCMG8
-LS0gZlVpbm8ydWZ5MGp1aTZUY242NlBuTlF6U1BzUSszVTdTYnNWRStTOEtEawoq
+XA9WAx1jv05xje+U97tRTTongJEW5vw=
-gb0uEspmy6YU+mtaHJAEBKsAYKg5g8pR2GIy50C0HcVn9d19p1p5yA+7yzzVx07p
-Kdk=
 -----END AGE ENCRYPTED FILE-----

secrets/britway/cloudflare-credentials.conf.age

@@ -1,15 +1,17 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAvWHc4
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBjQmZr
-a1ZnYktVT0dIMDVocVQxU1Y3bmQwckVnbDBZSGhqRnhrUm9yTGxnCnZmcGMwSjJG
+VDl4TVlzK0lCc0YwdFM3TEptU3Q3cWZ1d0FJQUI4Q1g1TVNyOENFCkU4NE5lYVhI
-ZUdzdFR5Z0dUZUo5aVVydHpHbVVQZVVSNm9MT1YzbGEzamsKLT4gWDI1NTE5IG5l
+d3B0amFJT1A1RTRSaUdUSmZ1WmU1SkVhTU9sdFZJR0p6UXcKLT4gWDI1NTE5IG5O
-RGF0RzNKR1JsVlZWRmFGMjlwelJTYU9DMVM2WEJMc0R0YVBYSnJxbUkKNE5JRnQx
+RG1SQnZtSUk0SThNYkRpOHFPS29kbjdUenZyYjBBSTJKdXNUaGpYMG8KME8waXJ0
-UG9UcG0rZ2NLTDhid25mbzBoa1J3RFQzSmpzWDZCcURCaVZXWQotPiBHaC1ncmVh
+NWR2NHoyUkN1UUJoaVRxYXVMZlNvTHZqRmYvS2h4QjZpZm5NZwotPiBPclJULlkt
-c2UgUjlqLUoga1AKNFlKZ3IyYnVSY2twUzVRdWxHRE1sT2Z5bit3bys4VXFORXBN
+Z3JlYXNlIEVdKEBXIDUgXTBzIi58TwpweFJEcUFpR0x2WWhiVDlOTFArenhjNXBB
-Si9za0h3MjhpUkNvemROMDRnCi0tLSA1eFA4N1hVOGNZb25OZUZMWUthRFJoU3F2
+dVo2d1JQWEJyVHlTRnUzdUlFUE45RWlLU3ZRS0c4UWs5Nm1qVHorCko1RVdqOVdz
-UmlqcHJ6S3ZCeE9zT0dXSUJrCs5Hb+UODXrBeIwr9agp/YwEEq21M5x8kQ5YDihQ
+aVAwY09KOUx4WktIVFBQclFXdFJZMTNVWHNKcTZFbDU5Q0xLaExvNVdlZ0pTczUr
-zvH7cIRMq8wx9hDQtij0O/hg1PMLw6F5XG17t9HS3yIqP+JRUw40QYPfeRIXlf2g
+SkVDTzhDUysKCi0tLSA2VGJMM2lrNkViaU0wcnArSG9PemJrQ3lrUFNnRDRVeE1p
-ua/QHrqcN5f3Nv69rFvyDd9khEa/Rwm+m0pVdTJVp1uNkla90h7nRpGxCzQ4tiBZ
+V3lxeG1iN3I4Ckf36lD/b7agsT0qW8eGDnxsVor8hEmLBSa35/eeAxqMd0xPvQko
-IWPELBTR3bVSW2hL3Uwzf1YX3w4KUBidujZLHVGd+BQY6DXeVjjESgbxqIqqDIqU
+REzIxPuEHRQM5dE4s4H/mySTC/AVsiwfcMrnOXInm4o3MNAC9PREcef4NBOP3IMl
-fQnx2mp2gJMLS/yWUvLyvUI54t6DUV4livFOu9m5p41n+vsXuF4ACEP8KcCqjV3U
+Mcoifar27EXs21XdXw/lLOVNDX7oDKZh1zXVX4lFTcRW0v8abbwchvuTiayKePMG
-hCFgJMossidwKV9Cfg==
+DrcyFsj4jiwpJ5MmY/Q+n0lZmoAlAJkeTHRUptJxGMq+pWVEGMa8p1vUdrVwWq7G
+YYO5lPlms01BFJfUsysh07HY1HPkOyFHeEkviZtt4N8hopx0pP4fyAZYYdrBAIdt
+CLpQFQ==
 -----END AGE ENCRYPTED FILE-----

secrets/britway/oidc-secret.txt.age

@@ -1,10 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBlZTVp
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBETE9p
-eFhBR0hOSkN6RW9Lc1lCUUNTc2t2MkRSVmplV2xkK016U051ZkE4CktQSlBlRDI2
+VVVHeThGT3daNW1xZjBDblFwQWozQ2VSUmR3NlJVak12YXdWUDNNCitTWnBHd1Mv
-ZVNRVVU0azNjVnBQRmVqeVQrREI0amlWYlhhbEVKOWdkRkEKLT4gWDI1NTE5IGV0
+L2ViUWJvR0dtckpTQnRNMWZtazZHQ0tON0RhM0Z3cTlYVUUKLT4gWDI1NTE5IGhV
-UXcvWjg0YVJCN0pGeXR4cnQ2VmdvMWRqSmpsZ08vUkFVejRHQStCUWcKZkpLM3Uv
+ZEFqcW9CcHUya0s5dmgxc1JqUWRicmpXTllIckxaWjhtYzMrOFp0R2MKNUcxVllk
-RXA1dGdTRms3L0FrM3piRzU2bTRaczRlL0hydERMUGxFOGNCWQotPiBTLWdyZWFz
+WWJ2cEkzdXdiVFNDQVN2cUVNRnlMQ1BZWEx0QTI2M0FKSHE1ZwotPiBHaCJASk9u
-ZSBINl4gJ1xACnM0Mzk1MGF2Ci0tLSBtYzJJQUZwMkVSaWxlZ0VMRHh5U09jNGZ6
+LWdyZWFzZSBsIFxuClVieGM0alFSdmttVjVsNDZIT2hjSTdWc1Z2VXRIUC9BbXNL
-YVEwc0tkNlZBRmNucEV3d29FCvd8zYn+WWCKfaO/eJZgTOzGK6VGrK7HMnmRRGbp
+MXArcHI2eDM4QWwyeXhtMU41cEtLQ2tkVllJdjkKTjMvNENSNXd1UjV2bGQzbnJx
-SmD48NagOvcls7+w6XKJfjjgLqrr+4QIuMEZOwbjwDwUXZAE1EY=
+U3RubVRxQXVSSzJXbG5uQmcKLS0tIFFIeEVhR29qY3FBaUlJd1M4K3FvdDNybHZB
+MmVMZGxyYUYxVDNydjZLbXMKiPpxBn4WtzaH2iTFfjayYgNFPa0Mi6tIH0LOqkAj
+RyHNF/6vgWlmnivbhP+74dVaqR8IwUdFQN7S8/fx7eW/7qvtlg==
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/doublepuppet.yaml.age

@@ -1,33 +1,33 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB0b3pq
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBSS3E0
-Q1hPakI5WkdMYkFWWWZQN0RVTTluMlY4cnZONG54cGJvUkNkamdrCjV0elB4T3Rw
+YWsxbHZXQXo1R3BzL1BDdERxN3d2ek5acFZWK3F6andTeGVacVNVCnhPR3I4dXFV
-TU5FeTU0ZS9idmIyWHhyN2Z0Smx1TmRJbXJyaDlWb1NxaGsKLT4gWDI1NTE5IGhx
+dFd0N2lsTU5NOCtsM3Z1YUdIaER4YjlrdkNXT1g4dGZXNFkKLT4gWDI1NTE5IDBQ
-am14VjRuLytLb2VHQXp4NGorUERaSWRXQ2NuMXcwbDBwUEhvUXA0bncKbTNyaGpo
+cHBYSG04eHA1ZG9KN1Q5bFk0eXk0T0o4c2pLVUdNbEtWaDdwckdJVmcKd3lkZmVY
-TkZSUzdpcHNvR3YwQ1NMbjRuZ0RmVzU0YjdTR2l0RHFhN3dVYwotPiBgLWdyZWFz
+cDc3dGdXSWViNGlMVW9jZENUWXd5MVNheStiVU1adG5MNEpnNAotPiBfJWZ0eWtP
-ZSByMyJ0IEE7NEViXHhHIHxnMk99IFM7ZwpVRWFlbTBvYXI0M0ROZmlFZ2x2MUw1
+LWdyZWFzZSA/VGRDTT5kSCB4QH05QF96eyAtfUpxQ1ggZU5FQEhZbGMKa2xDUlMw
-QThUb3FqalZ2Qys1bXdwek5yMmdJSUI1bjVQN0JLb2F3U2NWUzlZUHFzCldoWmt2
+Wml2QldxcS96YXVJT0hPVStqelhmUEd4K2R3ZDM4Uk83MXV6VlVoKzRiMWhxVlJx
-MVhta3hocWhGbDQ2UmdvNStLaVQwWVI4Q0M3V3hlTzhXaGRGV25kU3NwZ3Zra0ZN
+Ykg4ZTJ6SSswTQpTdjYzUkhMWjFwblhzRWV4bFZOVnRjRGMveDFaUTJWM3diK3lj
-OVY0Zlk4M09LdHAKCi0tLSBiUEZyRkhKU0h0NVV2SENZczMzZWVJeUZncnJHcHNO
+MUE3dFlhUEVENAotLS0gd2lKQ05PRUF1b1RzZEs0ckY0eFlPaFFBNHRQZ01rZzBV
-VXVjY1ZyR0l5OUlvCuU6ngVGt/cxi5/ky5PPV1UvRBR4D13wCLhDtc/uDmG/fHeR
+SW01L0VzUUpYSQrJxWuL6pjjZs+hCS0f6DTNwW6HSD33bUwdBpyTCLeLMyDT646H
-tVl+u4aeOHYm/K1sCRWCFGXzrF5Wo2CBVNP8NzDtgSBATwgLSyIhRe9r6MH/Pmlp
+4pjAhrVjVH1kgBFmuCjTP+SrD2bie/WhkQPSYrG7qygcmXbdNXlJn1tluEedDLzK
-pYDZ23/pLeylzkLmKu9g1Wo6j2Y78k6ec57epj/uwBRtMVRLNk67UmQ7b72wwsIh
+djbOaSuohlgneGw9Z00Zkm8rz//2NSB89+WiWuT5/6Pm/d6763FteRI1LsPOyWx2
-0hxLQBPTJsjymkJLSJ21KkTkr++PIeyBL5yWAXpx6OErL5JiZGfXFfd7QFq3DCo4
+vmTZMIcuclmrGn611T1kKR87R5AkaZ6xyhkOrOvWrb7BktmA69Kd9r5fXyxnLRZD
-FY5CrCT63xqzA2bBA8TtgJA6XfEpUyVSOB8t0CnyY2/SOdHK6ZHKwam53/ieHtPQ
+W6vPm4EJLo0b1a4DWlnIvFTy5I6e2fFT9h2+rU1qITn5fwQD5aAYdL8W8ELIEJ98
-HBJHCYex/hSeugJ+OtdK2qF2/pXTPXcgL4p5vzMBf2xuSwoaBmPX1wvrDT17PrcD
+zYNxpbepHY5fBpHOGvOKM4AAO/R2pjaDaK7DRIFhSx/1RJLJvigXFd7YKl0WWn3w
-3lHGyQ48crEfalMFt/AXjJI1EjLj6N7YMvCXiw3h3m0o06402KQySt9euuYkvLnd
+PGK/YxXnhtxnZngEPrnwf3JPj+zQ3RwKDx/v12s+KTbfQu6sGvw3MhDwYsFrRn+J
-JCg3qFbJeyOks7NQLvtVr7B/9A0ksaOLRoLzWIqZ9uS1XneeS2HS3V7MA3gf+1Mb
+T/jqlcZ/RodnxDngMnJCzc+YPkCJ/yAiot1DthVdpW0mWFiPsZvzN3co7t+6nopR
-rhDl51svwZcYKy2mUjX4BqR9s/zuFfW+4EmyJ/TyVuAxDRvty0QmKlREE7bHejEp
+WYnSjp5igjHbO/E3zXQ8qRlOvXSp6zspOIv9AETq49felAxXF7uz28lMnBeCReVq
-xeX0qhhs/87gURpZaHu+pZyeofRB2FyUQy5UF6GnCzQMw702ZnQhGcNAfN1ioIYa
+4hzBII+wDTR1Y/itKcOGm5mTdyvLF4qKRZFJFiJ3ATGZDEYh2dCrO2juaL4VczCl
-VnLqVg8OtUUvatZgPywpW+RwjlBkvOGgWBElmCtdJNU9rmPUq/GZwyFuBf9BgIis
++qwt9gYF+pOgY4ekOtW6BpvOGZ591LHTMWoP52O0MnZADU8GHkh66AvMDemQGumj
-+UEdA5R3Kt7W+4HL0oLNtL+hXX5g2/8iSyuYgmZ2WMdRJHyY4TDYQ5hL4iL+53ea
+7qI6kI49Rwr5CoDMds5XlUBKlzeLgZLSo46FJghWOOQaiFiXWVQ+jYZpZPkgGjkU
-O1CIlNNIsUJdNHx5IjyO7gfFt0UiQEtKmJgPBrKMTeVAipbZG+3pW6yi2WvezswJ
+wDkrnbdglkdPO93bT2drkNbPWziHRkV505lGk1s4zCvsUPMH0D6KYkA6o/hCum4B
-R/6hNR+t6CR45wu3z9rSv6S72HvP8QChxrtLo0A0oOnFx34ioRxhfv00tG0GEPCn
+IK8Sj215CmjQv5LYBwzHTNRusksXDu/+Ud5FpKCNw34aKblLIEPJNSk1BWLwyLzM
-smPo/Obp6VGr+5clwqQFzlKz4KgMI8NIWDRDTJBZ6Pl08ut3Nz/mW6aUQxkcAovM
+oCNTiI490ZBh3vcnXpHZorS1Hxzb536SW03l0Z6q1Izn/vfzhZ7HbFY4qS9Qe+je
-7KF88iBHT46FOeGEZmCjQZNTNLfeO8cM6SM71y/k882+Zy155G+DsHKHx7+NtiDf
+Cvx+upRzt+mIQt8edbhrC1twfo/6whuvpT1HqGQDUr62+4zqVJ3lbccmXRX6uOAq
-+mIYqX1mexeTIEDfDlIiJX5xvgHewXUch+PQZYW8Cm7A2oJESuPLwqoY18+r0u7d
+sfK9if7qo0wkfWqa4RutO008ocVSKt0JjDOUpGHHP9Z95NRMyKJiOlv7dgVwWEid
-OYAf37G0cXB4vtngtrShgfbqda4f0s9o2Y06Ovb3wkegLIb8eTGN8pLU40rbprVG
+J8YMxexAgkmjByzwt1CBC7XizEHl09ZyjJrzN420NMRzaG3C6PY82cnKdbXNfEM2
-UNctWsA1VXd8Un7Dzq2JZHN94wvf2lcYJc9Lw/Dy3VIntyAg0sKkWqEgwKnQM1s8
+0dlN/xUTaOG1dAjdlgr2oMA5o0jFptr3hTFcoOQ/va1zkkNDHvfgjzri9HSID0bP
-s8vxFyEeCacQWIX44r6/XeOlyzIsKOTEpmJpCkC52BGiMwv7nvMpD9cmYnn6wFGt
+kE0Akj6H9457cyo+xI+gD+2CtJW37TR/A7GLrzc+BDdDNZWtJz8t7oU0STL38h0d
-XerPeB1lQiV0p/GYxuby/rlpl3eYbw7GL55CrlvLQK1YuEaT/ORKRRb0gFubrTSM
+rfHgC8uFj7Ozh0nvsPbviwHCw6F+Z3lOT2qaFjzWKMuhnB8s3C//vmMFCfY2XglJ
-eDja9oZ5
+Tmcz+A==
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/mautrix-instagram.env.age

@@ -1,14 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBiUm9p
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBBTHhU
-OEMzMElsQmhJdk5yRkYzUFoyTldxU0FrVDk2b2NoK01rQ05Md1RNClFQM0VrTFBk
+TVdvcWhvb0c3NjlTT1JBWlRaRXBYSlFySFJhQVZHRUsxcTFVT1ZzCmVaZW1ucTRG
-WGtMUU8yR3prN3NpR254ZFRNSjNQYTRwanNrQzN0ek80bUEKLT4gWDI1NTE5IEJx
+MVN0VnZEWndlVS9iclNhRlB2dkZPT241dHRxcjBRc1BpVncKLT4gWDI1NTE5IGh1
-WXZwWlZ4dFRMTEZCZ0JTNHFSWms5Zm4vSzdjRFhBSHJqeXhDMDBIVW8KU1VaNTc0
+aitYSmVudUZPS0FHbUliUjFCWXJaTWI1RzRlK1Q0ZlpQNmRwN0haemcKaHhQS1JO
-bHFtMGxab0N3L1IySHlaM0RwQWM2Mm10cDFEaW1UdmFMTUVHTQotPiBiY1VjUnd+
+UVYxYUU1OTR0dXJhTm1EMGdER0hYUXVRd2VmNURwTEdVV09tVQotPiAnbHAtZ3Jl
-RS1ncmVhc2UKSmtJS3QwS09HaUtUN2g1VGY2Wk9Pemx3RTdBOEV4K281bFZqCi0t
+YXNlIH0gLCJ9IDwhIEB2QW0lfSkKMUJLd21ubDVQdWJOR1VvCi0tLSB3N2dJV2o1
-LSBhZUxiOUVyVGJEdkp1Mk9uaFNzSEozQ05DdFpqdkN1ZFgvRzFMeFd0R3Z3CllO
+WGF2TENYNE8vSzI2UzVPZW01RzRtK1VCaUVKemN1RzVhaGlvChPEVtylQsq+EWK4
-0SHrUFQNV/oKtgY9bEZ60IdlJclVst2wNfpc3z96aSMQRO2kN0ehGNR3YDg28B5f
+X6HxFl3JY+M9clfpicNlSqUjPcB3roEMpD9BmGcG46nVSZVDguVjPzwTltAGE72Q
-fccsUh1/PAkasRCqiVjKvrzWlTyIWIV5XdXN1XfO5Ny9I/LldKRDCIbNnFu4IWqg
+Q4RP8/yhssA2rrLEuWz+JKcaASF/yEmu9QBILrWBIWz0rQyHfTRvBC9d83MdHS5f
-k22RerhY8+6BzPszQI61tu84URwMgTSM9y0jGhdn8WFf39FgIOM9L0Hi+a0V7f72
+DQl1abC7Lv8imVm0pJ9vthvB56mXlGgm16fnsd/UhgMQSWZuVLSitaoDEFCz/LWi
-zw54+vbACUdNuXH/D3R5h/xLwaO1cyEzeJVXtdC6VkT+XcotAcMUU1b0FcQMYB5k
+QAUKYTRVL2UcomgHsQqMx+2g3HT0RYQu1Ud3M5rT9eMSSqPG7IzyjNA3HmH5dw/4
-R/d31u/SeXqjFrGiTaj10TjCMZ0kz9jLBkLPPhPBSw==
+EdnilIaW7c6k1RAYMFY270E6qlxqdQ==
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/mautrix-messenger.env.age

@@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBubFN5
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB1QUhX
-MHRvVCtqYWxtNzJrM3dBVDJPWUc0anloV0tTZlhwUEh3SExVQmxVCkxiQSthaExG
+dTlNY3h2SElIMytCTGlmY2syMmlTL1VMeDFnanN2UE9QK3RvRlUwCkVMM3ZKMU52
-Z0VrV3NOTHpzNkx4eDVKWGpYdEVxMWhuTTcwa0ttL3dsQ2cKLT4gWDI1NTE5IHEy
+ZmIrZ1VxUDNWZm1lU2MrWnpkUzBLcDB5cUFCSXZmQ3RXR0UKLT4gWDI1NTE5IE5W
-OWl6MzNqZGdkN21BVFdQR3JHdmxRSnFPNXFhaklDVWZzWnJ0QXo3a0UKZGlHbk1G
+cE5uSlpRd3dIRXEyRnpSZ0VHZ253OE1ZVTd1OTJQYkZVd1NRdnh2aE0KNTFTaHJM
-TlRCK2h5VGZJd2E5YWlhLzcvcy9nSVorbk5KR2NTeE0rclJzZwotPiB8PylGLWdy
+OE9tc0VkMHFHUGN2dFZVSGFBdTh5Tzk0TGU4SWwzYTBOb3FtdwotPiB9WnwtZ3Jl
-ZWFzZQo4R3J1MHdZbVNMZWZFNWNuOVN3QkN0SFVjbFoydWN0STJUTUk1N21ldDZF
+YXNlIHZVYHxaIEBSbmZ9XiAhfF52YCNwCld0K0RCTFlQamNLeitWM0kwUnVJdXFV
-MnhGMFExMnlFQWNLVVdQMVFDVG1mCkdEQmYvVkxDQzR5dUpDQzNnUm1yK3ZEK0p6
+QjNFcEYxWFBkVjJ3QlAwTGVvTE1GTkxCTEdDcmlZMC9xbUcrSHp2V3cKdzJLb011
-dkZsVmJTVEpURitRCi0tLSBnWXhmUjJjbXBNTndSN056QUJiY3pabUhoc21mZUY5
+aEM3a0V4eXBTMjhnCi0tLSBOWHozZTRjRldrOXBmM05BZ1lPRDYwaDFCcHBPNHhQ
-aVBmZVE5ZU5SaU5FCkdH2p99e4weWPUnqNPlxBKs0CD8wS7iCgOD/FtWaToTMNlU
+SzlaWGM2RXY1THI4Cj4RzG3G1yGkmDyqxCBciqMNPAQYge4mXOib7mqOuyIbkT+k
-7jSQZhXr+s4Sq4B3WG3CIT0Imyf3toEoxuLBv7iMR/pGi+bC+ygwxwTxC8rOmN8w
+qrJ8fLnW7Jbnb7+Rzr7BAEC5/dpOfjkyY9JPeg0FRutlkKyPIhRMAEhSsNvUFzXg
-NGK3PzKVrr/XPDFmwfpkHdgPVWQYvy02FkS314wu2bsQEcUn7bpZdztmBzrJRl6b
+uwNbnSBI+9Str6nTKI5c9IWT5eT/8zsKwtK1/pr39mApRY/y6NlA5X7ZRIFeku3K
-3C7CEop0UptyQgMOD0UkulFXHyEvFAShoGKJnO1PUDSLq1gLCooNLJ/kdkme1bzW
+6I/bCI5cT0qhIMJbF5D0KiCnMCnMdmRLrwLzM2zcJoisxRAvj4dNfLktsUQOauZ+
-UjLW3pz30kVXorL0vhSucteMjnc5WnX/KOiCqStVKN8QhFkPjEbxF5DRNRTsYzYr
+Gta96qQkAewvrdfz8Z4lTYJQmEqeOs1vTA6sAMf4iLp5EhPE0jN0n6D8v7Lq7+2b
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/mautrix-whatsapp.env.age

@@ -1,16 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USAzQldO
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBJbWVs
-U0NtR3lZaGg3Wk1sUFZFL2VBQnV0c0t5V3VRd08vSGZVUzRyaVRzCm1ud0lvQkU1
+bkt4a1RBaU14cjJzRm9KUGhydnZlWGU0NGVYK0NmWXRsclpjVUU0CmNiVDJTODFw
-TmQ4cmNaNDYxU1BmeERNRURnL1VtTUthMi9oQWk4Wmh1amcKLT4gWDI1NTE5IEwv
+TnloNW1LMUliVmlnUGt0SFFzWmxVTWxZQ3crNWVHVy9IL0EKLT4gWDI1NTE5IDcw
-c1ZlOUdRSGFRSnNTMklVR0pSNWl1cm1nSVAvRTYzQXdqM3JZM2RsUkkKUmFjcG5j
+TUQva3UxN3o1MXJ5QmVmQWVmeTFLejVwOVdQZks3a0dVQUJTdUdZdzgKajBFK2dX
-OTVwSlFyZnNxTy9rMC9LZTJUU2VQbW41bWJGQlVGbVpqbFNWUQotPiApKy1ncmVh
+R1NNR3l5d010MnJGUktNWldwVjY2cDIwbU1laEMwOWJITEg0NAotPiBeLS1ncmVh
-c2UgSiBOIGxWYS4Kc0lrN2ZVdmhEaFoyNjZzWE1nVUU0V01iSWh1ZkdmcmE2YkJ0
+c2UgJjhQIF0pcSB4Ci90SVhIZzRGVlcrd0hRCi0tLSBKdVgwZ0pidC93aEFscm9w
-ZmNHQWFDNE1LTkVOM1lZYXFpTFROL0gvNXhQKwo0WDhlWDNzbmpGcS95Y3Fadlo5
+Mm5GbEc3RDdZRDRpeTdONHpWN0xHYXkvVU5zCjjFfwumbetHbq8MKrBIx18YXmny
-bnlieUYrUWVFcnpEbGpBTHJWRWcKLS0tIGZOajhoYmczc0VDVGVheU9GWXFOVWJY
+z+0ifVbksJhYLYk7hViSUDy+F3RRad23dSPvDdd7JCEpj+2PvcezBLkwfUkFdQe7
-ZXVPb01lMThoWWpjcjJJQUYrdzQKu7TpvAxtz0QAGw3UI+IOq7uHo2dHuvL7i9GB
+uQhUJJ9c62oKSX7PMbQeW1tyX10SVkt/P20z6HPXvBlY715lsXspjZERi+DheZk0
-9PET2JogH7Ay3g0asUmqJhFGrRRDK9P2KOX9ONHOcAatOt4IsGT3Jgsm2Zm1uGOJ
+ZDc3dPYMeyoAIWicf40ZxH8C6rWl5HOLIaTMbCOKwpD+wPjpzeZHat605YWReFxR
-1dC0vj0vNCbRMhidE0Bi7SRalh3RSyidiTwWZqDevTsnPHjMeJSUQ7Mav8l4BvcZ
+Yd3cKCRqSb2QdAdtZ0XUDSPl7HVwkw0xobCsvtPzmObA3YbLopBq7Dvrvh7XW5ns
-JLUwhfnTb577uGO1x8xiSTaeJ5AIM7DaVHcI0OuTJ+nQfkIUNL4eVtgPvxFzxp47
+BPlTaI8WnrI03CplGP00
-fFvupVShi5/nOoPxGLN2Iadi8zvu6Fyo3R5dSHA76J8UPJ0cq4PWo83JbveaNPHM
-427s+94ShVU=
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/nul.ie.signing.key.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBYZ0o2
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USAwa1k3
-STVhRGNoMUYyaTZkMmFIRXQwNUZveS85ZXY2Wmhyb2U4aEZUZWlFCnBzc1l1dTcz
+S3dka3ZjcVdIQ2hSN0xsb0hTNEhneXFYS3BXNWZDVlBNc2toQ25vCldqSlMrT0hB
-cER1Tnh5TGlLeG5IcEMzNEhGSVVrV3JTdEs4ajBkUEtIc2MKLT4gWDI1NTE5IHNn
+Rkg2aDZUYlY4U1E4Y2djMVdwT1VsbGdpUm12Z3gzditmMncKLT4gWDI1NTE5IG13
-Skw0enFTakE3Ly90NThlcm84RitDWDl1RURTSlIveWE5TzlqTU1CelUKLzlMTCtP
+YXF4WWdmNFRPR1JDWkk4OFZkSjdzRS9BbXVzSC9YNG5FRnpqUXJZVk0KV0tOSG9N
-QWtlU2E0dm1QV2NHSndVNnpUbEVDR3V1OVpBdGpqbTMwQnJxVQotPiAoRC1ncmVh
+c2VVWE10WkxUZXpqZjBZZUQyWE14TUFsdStMeWVlcFdJaTRVUQotPiBWaHxWdCYt
-c2UgJz9yb3opClYyMTVUWEFnSityRi9nCi0tLSAvOVpZWGJjQWtweVkrUmFVYy9Z
+Z3JlYXNlIDYgdDsgcW97Ii5yIE95Clhqa3RVUmJENngwTDNoR3BCNjlaTkVYc2JR
-Z3lXeTh4VGliUk95WDFzL0R2ZC80NWZZCjzgQLewxLJ/OxteyXXioIMfjbXlKiZ9
+ZWQwb2FOVy9sc2d5MmtkeUhkajJBOFE3TWJTOWViWVlJSTkxWQotLS0gN01aNGdm
-0YZo/t4HWWRfqIruSWaPkXEiT7knXRAFPkec5vOHOk/MlRZqAVUf8edvFHYh1JWs
+VjR0ai96VzRqb3QzYU4yRzVCby8ycVhXVlpubVptam5mYldoOAoZnbsXB5we9BQ5
-iiog8wGk0fJ6qNqMSYJKwGTUvfM=
+AXQ08mXmMxRMg9iH7qgyCVc1ywR/uo5Fcefhuw23TyluRkYt7tZ9yiuFJIx5Znsr
+QEqaBioL1UfePVyDLi8LcBvUgnnx5uN05hUvTOt6gqaE
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/synapse.yaml.age

@@ -1,28 +1,28 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USArR2kr
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBvdjZT
-YmM0TDU0bVhoZlE1ajBmYWdscXk5TXM4Ylpydmd6ZFB6K2VvYVJFCnlMZ3Y1Nlpl
+WWFyNzdXVENweXlVT1kxNElaUDFUSG1DSGMybTZlN3VKVDNNMGdBCklDRk9oaXdT
-ZFdkSTFIeDl0dEtnSFlKWWs5ZDZ2andQYld2eGsyem1SK3MKLT4gWDI1NTE5IHZt
+MEhrR1VTcGE2NWwzdW9NQklwcGFsd1BWSXBpa1YzREdTUUUKLT4gWDI1NTE5IFN4
-OVp3Q1U0WS8rakpVSHRwME1iVk9jRkhCaFNIcTFFVTdhVDhjb2JiVWsKV01ETlVp
+Nlg1OXFNMjVzbDlRME01WW5iMTZvU05hUTExNnB4MFpUQ1QreXFXbmMKb3BzamRT
-NlM3dnpQRFF0elI4OU0wWm44VU4wbGlEVkZOR1ZGMTNJZHNyZwotPiAhPy1ncmVh
+OVM0TWZIdkJnYlByRjRQUXNtQWtXS1FXRVlFTkpSNHFVTWV3OAotPiBpQy1ncmVh
-c2Ugb01BdCFGLCBBICUgMGE4OFlGWgpLbUUyMzB5NwotLS0gNVlvZkhISEMveUI4
+c2UgJT9RYi1YewpadEZzVUpqc3F4U09zUQotLS0gWkg5ZWlxYUJGMUVDd2o0TTJT
-TXJpVmFnK2FkdFB1UFhETk1hQXE5R202MHI5MmEyNArH8iLdJN52W23zEKH1f5wZ
+OTk0WlJ2aE96Z3FGNmQrNEx6Z3N5UkRxbwrp1nF8mtgoTEYfQ/aE7KgzFOei1PVt
-6xfMYH/WHoAxphv4PFDMaGXXx5P8NyMCy4w4rXbohPpoT9oMmJbz2Dt48q0MEp8L
+cLAh3v7wo7C3lxhBOL0v8ToIAVgSoGP6cj9/4k7+9GngpOgot0IOdoXsThVdcg7w
-tdbiQ6OhM1iyQQwbZYeU94z9EcrZSOld+HdYDReQyAAcVCs37mvmqcTIzkdG3dSf
+soDjArsSWDYn6Th0yZf+trSXfA24BKIS5qQnAMT2ivQQtO9Kqxko2Zj6+wZO4LEj
-g6BH0Dn0jSOO68lUZV3Mx5kpPNE4VcN1BItJz2b5fJZ0IdvdlOfHyYV6n8qiP+R3
+DEr7cqRCWVFfvPLJurkfbCRjGlW2rKMlJotnLMYTE+Ot5SlSwVic5Nu3inGx1U/a
-4CnaCz6w2P1uksSWAuzmDyouIXUbJuixDf8Ks0HNO65Ar64cb0XAzkuVFbVS6B+f
+gKjCPfWw1h0Gus6PKXpSq8wGrGp+ov4ocpDmumbgh/E0D82JtBBPoWojxuGSFzrm
-Ucu56KkLslsfFabq85C1r1naueuXbbgDKmBkleLbEkK8JunReg49XF/po48iLeZp
+UDKrgx7MObGbjwkj5Xd+SDdKytjNqV+9g8GdRYVGhIr3muLn2JJlKKw/eD4Now86
-11idYaFMtphmDkL+1WOzzKWGH2YaZXW3KjEcEeFZOdSUCq7gJnHb1nDfmwCcQKjM
+tPB3ms/E1N0HR/LoQ/Y65WeuHKgv55CZMWauC/1ECxVS/jDAXnQ2lAqFlzmU1ItQ
-8CsI89ypLIisyM6uNoQNkAlRoiQ6FgkHMpO1SfJcYjHHWIsAWhC/dflUvqkVcJSy
+4EefV7FRWxgMeMOIVKOCus03Js4yZp+5byjJ7+O3MRrOED9/M60B60zXhvPDtwb3
-UOX120f8MQKUxxa2ozC6eFHunjB1ozAzWMx0Mi+h0zVzaAIS/oJNZVBVhnCqZwTu
+D5sFtC0ZBZT1+d4pUnEnLzSjM8DTf9as1uoNSuzh6ASiSiepAhdKMNtS8xzo85bf
-6Udw3JWObBRg9N2GkfFnq8iRdithya9PH5XjT4OnF+OfKfYP+MjMTdfZ+ezceTnB
+Yw2WxiXQfSyN2xWWjSH/YQUXKZRBNATxB0FRMaa1TOFKo0dDYOAu83bY7wwAwSvZ
-xMeme9fGhIjo2hYYCIawC0ga52XPTHDfa93fK9WA3fVy/Jatl+V/ezU8DHGANqaR
+zCZ1QepCCjiWe7ujd9HMPWDgnvd47c8teSYgjX0T4nCEk7EbNpUcrDXcz78ZKAlm
-mUjOw9ducJ6Qu9cr378Os35zHKQ7+VUugqtv5tkzxZQrpF/dcrYnJRLvMFfKWX4u
+VNuu8C5oi5Lk7972SBLj6yLpj27FDMagSvX30k1sMoHcKGiKnkSkdw56B+yHwLYL
-2UctW1zmbwKaIvvo8Rwh2tZS/RazdSV3X2bYESk3x+ozZg+Oo2uRavm7qpYa+ASX
+Iic2mxklXggIYLo1gNq0tQskp/I0dFGUzAF1AblLw0b9Gqj/fHwHtkx/Q5n+NE82
-YtAsG5j9NngFTOVH+hN7Py5rppNgHVS9kKAB5rflTvPQ8nk5KMdSxEDaq50z7vY8
+jSVVRTI444cMlXKnyk2sVKKOWR60WXQWs/GdH5Oln42tmFT6yZk8OV7RopLPUXx2
-lZinF59SjN2vIyrIyybU/b+KeatSeLNoT1XPqTDi2xyPYlhn8nU/J33/4QWsqufG
+4jwwWvVOrAMhmTwJDbzUwEIm/nfay7wzJinjNod67u0muq79OP9k0pRB6u3mSYZ4
-WaROcQ7elAEdyp9R/ioAB5EK2rUONlZy7ijPvXOmkc9c9z9x0RfoF4FkoN4MyUPH
+ZX3RhRoIYiYHCDrw0e8eWKjlhzaA7tI+diHdC62SR1cUbYbRrLiXrU+ZPjG2qDTI
-8AlrW4m47K/jw+17eqZ5iZfLYQzQrhjC5eBWIuhCHy5Qr2VpwLk+Z2pdwQRA4OR3
+eAI8/wUMSHNyXdBejLRZHy7l38LKzAG3SSWBtNuCpAiP/QWCFL4UyEMlQ3Fmmzp/
-8WSMRf+a4qFpAcCoe0nBNFHyqMq+5r7DvHm+eFzjJ1hBU1Jzes42a9T9IlBHKZPr
+FDgNLldzhOMDK8eqGAgG+qVRaK+30SJc2/ydjilg2H/KxK8C4F7Q+ul3QV+p66KF
-WUTyu8Z/ndt3moJpFUIHEVxbSXLqqsO23W9hhNeg1dYg//LGs+VMM0O10WZQmsIb
+D0h1JpWxSRhK5St01FdtFigSsA2QBg4kP87gGFmI/y05jbj/XjG7D3BQtBbRnKVG
-uj3YyOwdMA==
+uQ==
 -----END AGE ENCRYPTED FILE-----

secrets/chatterbox/syncv3.env.age

@@ -1,14 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USA0cXhJ
-U0R6cW9KM2xwY1V3Y1VKVVBmcEFmTEFQRk5rdy8vZWhRZU1CclRzClJsc3ZablBL
-ZW1Va3N5aEtyMUJmWkZaOHExdjBmRDJPcVlvanM1dFMvMVEKLT4gWDI1NTE5IG9I
-UGc2RkNsNmcwL3NLdkRXZVE5UFI5eGZuSExocmEvMXJ0YkZaNzhsbHcKcWw1MTJR
-cUJCTC9SR3pNRmcvT0ZGdHBwdU9OZVJoK0dacVF1SkdmQjlkZwotPiA8LWdyZWFz
-ZSBRW3hICkc1Qk13QzBkRUwxQ0dkQ3UwNU85L3E2M3ppTjVSUnNaNExYTU04dEd0
-c2FlVStOLzRLQQotLS0gWVgzSDFUUDd6RzJjaTJUOTgxSUR4aFF4YjB4RW5xZW0z
-ZFFnR3czTU9vRQokL7wsRHEdFXrihqXGE/XPNNJ1qgHskz4bJI1Vj6dAsvT9CRkS
-GT7ZtnRwYxL+E37f+MXCQdCbfsL07wVcLrVE3wLSyc5i33/tBvMW2jhFmCVwkwDd
-aLpI26s6p5HbFniJK4G3zFhc+UXdSYfjxa0fSL06f+lmcqSol01nUu1gyiMrVMQn
-RjxhKdgyoNE6xAUD10e7KbnjLgKSe1lXaapcuoIXIELf7cCbZpi7f2AE0H0hc0Nt
-b0iBFTN+zN45tvOiTA9qRRVlBjf4ZKMDKWGXIkq8F8VXThGCO/bk
------END AGE ENCRYPTED FILE-----

secrets/colony/borg-pass.txt.age

@@ -1,11 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBSUzJ4
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBmSkJo
-VCt1bmtmL3dPTDg5YVo3a1JtOGsyRGZuSktadlJGbG9SeFNpbWgwCkRtUjI3TjhU
+UzFYMVBiNTRBbnliRHh1OXBpME05dUpyYjg1ZVY4WStxRXg4VTF3CkpGQ0Fia1Ew
-MUtjUi9VTU5Mb2piNTFvWForZmZHZWhmZE1QeEp1cG9rVUUKLT4gWDI1NTE5IC9D
+RnBsLzNJZEZMaER0emt2TFVSWHBGcEo5MnYzVDlvOEFrUVkKLT4gWDI1NTE5IHh3
-RnZjdDBCbFVqaC9BKy9lMjhrOFlkTEhtQTdFMVVNY2dnTDRlYVUxRGsKWU9icGRw
+UC80K1piWEdneVExSmQydHRqMFdTL1djd24wL2pDNFc3bjNxc3hZekkKTlI3Umh1
-UDRjQmUzdjZqTkFjMGFNblFvM1pEOGZqc1o1TlpqNEc4VHZxNAotPiBMJFxgOU4h
+SmdBM0Ziak5GRm12K0pMckZ3UGZXZTNPMm5hZ3lTV0NFVlYwMAotPiBHLWdyZWFz
-Jy1ncmVhc2UgUSl6c1lYb2sKS0hIOUZZajJmczlyYlZZeAotLS0ga2hSYU1wU0I2
+ZSBddkFIRWdHIyBjOXwkT3MgJiBOcUkqRwp6VUMva2JWd0J5ZjBpemFFM2djTzNC
-NlY4V2hFRytnOHlIZVBaUFk2VXdmNnNsTVJJK2ZwWnFiRQqNbSwUc4uw8BIFGgAW
+RW5POHIzOUZFOG1zRElPMkZZZUxmbklpY1V2R3lqNUtOYnFlSUVMZXlrCnB6REdz
-jiH2RF9iQXxjbl5n0leegyOs6ViBwDdIQ97sdA/QcEUDPMc3+j22uIIvHF74rvPO
+ZHFzbmRjMm5mM0RGU3NzeUl2bHBhTEx5MjhXRTJBLzJZRWgyUQotLS0gV1VlUkRD
-v8572JDMAb0mPutee/CzkJZOiHscGhV6FCRH43QX0rjQ+zpZ
+N1ZTZnMwTWN5SXEvQnJaK1NmcEUzMEJ6UVcvb2ptK3VYZU5zNAqgntLnLkQABERv
+HpNr21t8+KR56PZ8nQS8xALzw/FzdexGvlt4Pzx6o0daBeh4aZx4mgcyG641PsRc
+eDs4tJm8gmznr6y7B+WNC6WGrWPPIC3pHKU4g9PWzyEZcTEpL8Fp
 -----END AGE ENCRYPTED FILE-----

secrets/colony/rsync.key.age

@@ -1,81 +1,80 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBSOE9m
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBtVUdX
-UWdwRWZGdzRObTJuSzI2QWxZSWtYNHFCbGZtVHNaY3dPeUg3OGpJCndQbzVVTWtV
+WWlWOU5Pck0zSWFETUhMZVI5bjNUUk9pc0dRVC83TEJIN0V6aHlBCjJvWkxSaGNq
-aXlwb0pWK0g0ZFl1MElOWWFDMnc1cVBZTDV0b0NMTmxTVmcKLT4gWDI1NTE5IDQv
+WmxJSEhFekRLSE56K0pDTkxNRlJhOGZTWC9RdEZ4ZGJQNkkKLT4gWDI1NTE5IHNy
-dktPREtiKzEzUi9UNkptK1JESWgwU0k2TFcxWkhQMkdxdjMwQnI3Uk0KWU5KKzZT
+S2lZdjFYM1M0dksvZlZ1NkFENkhLdHFRVm1rM3B2YmJ3REZEa3poUk0KSURPMW9F
-RzJmK0RRREJ5QjgyZ0lpeGF1UE9IRjZoTFlkNTlQYzU2VVk2ZwotPiB4LWdyZWFz
+T0pWVHh5MnBjNThRcE9WY0E0Z3JtMko4eDFiS1k4L2RBa2wxNAotPiBgWn4tZ3Jl
-ZQpNSm5jdDRuU3pCQ0Y3QVNMZisvZHk3NEp4dXAxS2JvRGZlU2htZWVCRXYxWXkz
+YXNlIFdRamBzSyBlP1wKSHpqbmFWZGpJbkhyRENTZlZtdFgKLS0tIENud0RDdjRt
-Sm1nN3laeUJPTnJJZGlHWjNyCndKRlRmaDlQSVFwLy9JUQotLS0gL1NEWWw1MnFO
+bFhpbVhQbkxXZXJRSHpDZWovUEowUWJxaUkwNGN2aVU3ZVUKlXMwhyxmFiFHHHDQ
-V2pDcDFIdVIxZ1ZHQXQ4aEN6TDA2LzNVNFdsdml5QXY0TQokgptIWQ47Gd9dI/lZ
+FDtswK4HmApIhnW3TORhJyKIG6WBKFE1wDN5cDLppbjLdWAZecQbw0Qe8UQP50CM
-j4aoLl/OrydZBlq3cu9bLw+N9pdZsFjWBXT7+k1UwbpE5LgCrq+4ybgNyWHBxiko
+iSZOYSSpS4J6jo2kFCIQELXjXMi7YhmkIa+Svz7kcr+vVROOikBdTr37ZOXp51Dy
-DRuKVWQ0gwHpQ3WzQ0Jp3ftwHWJvm5n71AQ9EWDwg2UdlHbNcF0A7wGu6S93lKZV
+O+Ygl8rPaDkTV1elWCgwX/Y5KM9wvS/OEVBSKyc5vz83i0lsHMTOgb0QxMrqiAUC
-I9zNRXlAPfwfLn/xhUiWoImh9nrhs9segV4gnDrrLT3lPLf+sOVEAUp+MTaZDZPt
+cmYk7crzAXmKU8VeKw97dA0ZOrzdEh80M9JVpc6k3ydliXUO1b3seKlocB5cAtnE
-UhEtVIjxAf/z8B2+M3FFsMLkD68KjK55JxpkZ/1sIMquz7hcgXQfkOAz7NF7AvDG
+9OcsJV2byI0dOvRp9IZLHv3EsHw3sa5MFlw60KBHYZE1NoN2Uo5EqBc/Iz/4T2Do
-EyMnKGFoWgVAxtRy5zkBgc3svT9tRLaFe1ZjcUNJ4dd2ZeaUhKalCvJBFgUgOp1s
+zpQ5YwK8d2fK1tMU/FH/RWxkCXOjiShKsJXSiccHkzXskHU4uP1Y7s+KtFYxAttD
-a4Yxz6LuwVd/CgoquB78NOp5kiF5HCGzstKo6Z7ROeY6tGcYb7KZr7gmIikgnNhR
+IusDOGuvKKpRuYMjRQYSm6ZHDAZc9yZsPqlKmhYg7IWlCd9lTk8p4mGoAe5b37f4
-1YG/FkxQ3N3p3RqFHzbgTVWoCNBdT7wIvjpnL/R88VvssO6O4OeTaJlax6CwhS3x
+JwACx8asE3lZjNLo+1cwdjhARG535qmOt4i+e0t0x5XoUkenWhbq3Nr2x9fkzt0I
-szWJWEnbGctzBXIGgrXlG3gp14U9dt4GJCpJEcqdhqD3Psc4dzdbXpRW66EW8+sE
+4S0l5IxnxXXO9Flc7g0E+9HNZXTixG7UvhTcLH0BcK2C9CZq8WQmYdLXcbQBJdq9
-ZJDOTDRdGAr3Ds+ZTZAHwyQ18WLk2S8M2pNVrgXKB2iYhMaElLwN9QMno2gptajK
+yfLKzEBdbzPT0qjMw7hua0ceBwc6SF4gzkRVwhSw2kVERPhto15Flr0ybpDIF+tI
-YrBelPfAwBdnWL5yG9kmQ/mxOKQCNLzZqqsED3tw+VxDXs4d0nPU030ipu+Yh7YH
+irSwhTwi9BKJn8XpzgErS9K/Y5Zd7GENY3BdZNzHH37VXK/cEyjWXYmW4sAL0QzQ
-LcmSjyoBVMt4ziGGoijvzP4vpgYGBt54dnPYiByrRM1K/qoZoDAN49+89qWk+t8l
+BA/wujUhOjHrdYKb3QdVZJnym6ErOqzrg5EJ6eXI6nFLWer+2xDRouaXJsQplcyy
-VYfznyzfFUISxPna/T7+smIECjlFQbw2H9c6Fq1nZGrW5a+A58JqxKcwLZNHM6fj
+5Hr+L/K84/1+s+0ecNqm2XCjgCge/9dFM8Xvb+cBo/yOL5J8Nynv55WfUb3sjVel
-SzPcC3n+v7noQqO62aYpUKTNVyRxbhpxxG6XZCiU+KU9zMPBwkDnDgf9+VQYAPLS
+pTXH33APtzX4wdqsZ3KlB+OgjW9fc4vI+rWyT+Ia1ZxfP3Q6sgznspaIM1BHRW3S
-FuKyBrkXL4gkHR9j8gg377rdWhHXR6Uu8xEZY1tFrESVm6LJIr27dXTdhKFvds0M
+ZKTsH1wkSQKmLMZSUCNzpCmKY2bvZMQY4i8VP0GKbEqGjItknCPp4KM15QTOWgap
-AU1BMgAbugibLpBSguWMp0Vr59WqyeczHuHk4iru/4hD6GkeAGVX0bB7Fq8EWJwL
+08T3+WX1uBaHITZKIOIbKfAUd3QAoKvHQBRZalhA+0+Rlq3tu/cEcsgyMnKppCuM
-Mv7ELAJOCUN4SyjW4BWKL3WRQkz3acp3abvENx1Zw737JFrwvzOi7Pqj597JGH+A
+my41LOgtjtGi3IRnKYDsVnvu72KsbWzBBn0d/J2ZejwLoAECJN5OaLpIpWCCwody
-HN5H8j5nizyoHMhpHZ80L+G7v5NV9Cj0c43phh86SdVB0Ow4uibL1kVr+m4YMd2B
+bHWkCYF8eymXncuTbtF0EcGeu+sl+YaATwkEHmPC0Dy6S49BCCfWMK512JE+7WfV
-W8aARDUWHhUhcf51BzlEkEuAh3Lg9BGFWjRra47RNOmlqyTEM6YGRIVKFR6uh2A8
+pxI2VZ2ncr8te4ki4iZPIncx0uYGTt7Q5WoMoBlave5AemYKr7MgAK9sZx+3VP0V
-+UUC7ERGGBgBsZdrK8ufz1xdRS1ASzPcY+ZSMnhDVtMbF4V2qvOOgfq5DWz98veA
+CXcLzQ9GznWxj30U5cro578/3DbvTRrvgD9kifTQZPDhLliqgc0Eiee+2O3LMVuS
-wc4Y8FgfPXWrPNrv1+u+BiZt7oVBpYCIFRxfWZd8+tIQCZ7n+LbyEs/qZlSCbZ+O
+GBjeyUcIjF2tQ7C6AeZ/qjNZTQK6/zIjd6jwVwO8UDoxLZV4w8rCNEdu7zMUMYYy
-YxB3o078LOlb0njhny6TPAUxhyPlGrpTDruzj9NFwA7b3M+saZ1BgFSBTz/6q+2f
+nhLbrdAcNgBnDT2XRT+JXXZZ2YJmJFczd7tHPpmP8mAPXiypu+VSc4M+a/A+dGyo
-t8mnF/4isKywvAK3Lc8/glytLUMrtZn8ZzgqR7X+NFmA61LLFt97BomLKnIqYtss
+K8r2p47L6dNbMnJG/lke9V3NbK+5Cqg07KNkBEbFq9e9i3RyEs4KSq9SqqRGKYKt
-22A4V4EwO+yMBkbBgz+Xxo51WJt+6Qd0WX70VBhk8BdCSlY36O2kvFFTZtmVXm13
+uQ7wRu0u3O7vMsw8gagpSRXeVaEtxJTq2eA6eJWCj6l6ceZ+/nlNPMXudvbD1JlD
-d6ScDZWa4KDtsQ18lbly4uw9G3JfJ5UlYhwExxvmes4Ny/XmRsvKlbc3T2rQICsd
+rt397ucz5ih5NpRFzTWG4iT91hXvZO5yhctCxBlmhLgsfoz9TK90fnmkeWMr/i76
-HiJjfv+tSAjsvm80ygP4v7izkzXSssiswn29rAyR8GsV9gOQxqjsVloSeKXEEKik
+cU+F+v1wYwiZ275occmyR3LxFBT2d8Isz4BbC/yFJ+afTMbAGM+WbUHeYSA/Pq7A
-/2PKTYITR5tsSYSg5lZ6KHKmVpYPBqYF49mH6gDNK2+HHpulfNV+zm0MWRCT6qtX
+YgEhFSLULlM3ChmHm1otOMyyv6bbos5SvtegUtHewWZSx54ETN80kW9bsUBZgY9w
-pzhmDEwB+E5GWFoITx7TGvy9PwobdpBToUTu61wTXKnrndp8PYFv2mpgzXVDjeZS
+XIOG3vW6dFVjpJpAGwcDG2XJpKs31F4eLnX0zq1PJXdp1UYo0H98U/CdP7OCfdT/
-JzClaWc42aLeoeXq6/kwWlXTzk2ZVDYYMErRYHhg+bt1EWOTrC9Trk0n6o/1lXH1
+AY6eKzdhEMTxEaWAfZvTdbX8p9shoVu1K5TEjQNTHTsIKoVnLbpjq5/iAwn30GIQ
-gTT3ACSg5JVrMwRNY4a3QriNYgjaWEyzgXXDcDPj2Bb2s2XXusfekt+JMew0mvoA
+dQVBDsU2wTTsdi3HZKEqwbGW/iwqZEhfeTgIv0P5VgcnUa5uQvApxud0y+qf4M1A
-aWe5u3Iptr/OGjRu7K1jIycnBgcKBcTA2Sh1QMF9opud1snnA5m4OBZ4aeAquvkj
+t6IOfzM7toUNsUGL/PQD7LcpJLwdKjFKPrQl4GyIplQCB1+bIU6JyE9Rr6hfeOTG
-N0mp8ihIuTRWtLxK158gxXUPGihUAhCFO4pL3f/HPtVMgc3xByaERfFl6lK5g0cQ
+pbbX1J7dfM/LN4yfdAdod+xTS5VU/4htKOzviZoVfHHoi5s6BuxT57BSseucJbX6
-esT5p+GrpXwe/x7doG7QalYICZTuBPAd6A0zhOVkcj/+wKPPMPM+yj+twPupJ+qw
+4wEUBk9wEzTrGRZSrUI9DHkmMTxJ3qORtt2P0ht9GVCFbtAg/Mgg3v1BGlQTTgtw
-ywaHkm8e5u/zL0ee82J++wF1MMLOWA/TFkSeZ1nQ1J14BQMakIt/VdSOWkJtC81u
+y6/iBgWxTO5OqiBW4EXQCFyfh85vPegvutX4o2oXU7Mz5QRITYDaObxMhyL32rBC
-fAdt7akkmQYCI4KusKP+c4TVgc2MxGS4vLEDdJyEI6F4vnxjySDr4XgfZPX4orpx
+wkEf0euFCKabLeutQm6bh0W15IAW/a2SO2knXJmWuP9GRxfFqzF76ZmHWE+cswal
-n2tuk8OOZak9G7VcM1N0AXLiTA3LSDmEA79uzqwkW/q8tIyZ181BQXaTDiUFnEzX
+/FXJ9BA/IEkbJr+kX87+RhgH5RgsmsFsDXY/jwgUoW4gZR78yB8bq/uQubIMhhAM
-B7UYlSapjv+qDk/7tPUJM94wZXzNbZZrb71lipRiq69vqMGNjzBzCgaYLITgj+XH
+HLDtYIaOT1Hwrf1v6IGDeFR31zrWudt3kHH6uZBAH77Y2O6C+TuN9a0IhHwLec2S
-PGvHM3CLQdAsJ01evTHKlUmWpBM775+1O2Of0v0XohuEWTLlnRz+x03BsvSxHfnc
+4AIVTZEm6ZT5o7xQTVzjaxLWAdXtENrW8rArf6TH+JIruznbaeuYT6aeY4KlWlYu
-i+T4hF9YwOvD6IWXb+y5/xcED7zZojD1f2PJsE9AUHSykRjFBUq1umUKOTeCNtRS
+rVH/s1wBTWwhecdt9EHauLftK51Uy3GrZhQ1RTvb/DB/cbXM3yz7MbSsu7uqayiG
-1C+U/QJOVls93nVtp7KkBQM8m+0lEMukWP6wq3Hx9l919Eqa2FWOCGrBTZpCrnjI
+g4+0at+1nk+4sFiM505FVtBVb6qL6HQIr+g65WcAnTUGj+DgYUBAmh38uu3jJbhd
-mQyayY1ib/Zds9ZIkzbJtvse5EB7u4kvBs9mWwe0fQikczy+b/OcWJ5GzJElEo6O
+TMq/LqoPVyXy1CizKPIcLXTEec7Bh6HwXkn5LMU1HPdrjk9OSwzS4HgcOVR6Blhj
-hB2bS+0ebjRYBWdw/hzFyhzlSIoPTpNwNcLyS9R071Xkgj9WnmuoK4hhKySw0zdm
+fmoDMwuVkzyD0jJ1vRF+uH2krZu3NbBNA4W90XIpZy2FtyFePaTRJQuiZGXx9eGV
-T04Z8ve0LTXvpCyzQDlT/FQbp6CfEmroR5sqw+KZoI3BMdZrjRtHERz1mVEIEvXc
+AlUv8e6SV47vctqRZA2pKSPrmYLOgeHTcB3YehiOghyXnVfC4vBCoaujK6ToQ8aP
-wVqygonuf1iFY9y3ueAbjA0xn7waEJ1AuCV6u+58+IFsvUoA7g1fO6/m2VQBOf1i
+i4R7Q/9g8xC6oZBtaBMoiVAkL6flDXanYcMQak5x/nPQvyyld+3gSqVVkta0uYg9
-XCQVIY8NmwB8z5IZeXnCrA/cqa977HFNJmWKsEgmKO5oGwEdmOed/+kKi6ebGCeC
+1V54EEiB0TgviF7Gt+7/+UXXEx1dGygRzIV0LdX9dza9VarQmrN5JNhqPePzHiex
-c7YNIFf2yLfs/jNvctmgfmYTlgwcNI2PAjfw6N3OQDlRc8LoUVclfiyOxLJd+Lng
+k5ITcrEWbRc59BTH54s3nYRmqH6V43g4IRmu8VKRZ1QQdl59TWkwZ9gjrw1qZObM
-X1si9PvcN61tnVIu8N8RDErr71x+W6gN7lsD0o/tdaUEjbadqtBukaws+fJsL+Yb
+5m9mSeHGd4Hs0h4kpzrhiq+p16q78SAifEIK8D/MKPisL+co3A2nkHPBlhKV3M4V
-ulcfntIbhqNQJRAyc4b6PW0l6l4wj3vgipcGoWBFLMzhXcI9VENLQ6RYZU9hV7gb
+Md23894sXGjMUJUq7lIrfChBdolwLvOqOQmLkWasn+QQ2bSixc1C+AxypTbQNgTD
-iyfGs3Z7P2wPkolzxvvORT89PWPyIidJVCKmz3Jef7D8itqsiduWw+XUmxECNq3t
+I548k4nDAgvMsd6uyftUR0rjIe85N/xbgD4uEXUx9J/u8C49AprGoMdqe6q4GdTv
-jhvNJjrrsEk/u0V5jPIwJRPJNGiofq3LktU8vRs/MUxj+HKU+/Rs0EioPS937VGE
+lwyKsZSPwUV989d6g2C0J8ptt0+5lB9f7H15Da/BemKUeccUZGAjVe55J6hXYkJD
-ug+Q5/RLiNdK6HqbUbGuYYRWb59jKNrxSN/T2M6p2Q5qa0e2nOzmTn/JKEJblJGw
+xUbYq4yEL+6BcaIo/D7jRSJSXY2xbUgkise/99fH/rdOHZQDamvI+yh2yYXVbsGR
-5oAUJQjEeGztLaJm2hBpbSoHkdbHlL6UCulD35MweTNnnwhwHq/lYScvZMMqNB3C
+bpd2qtc1OGGA3LRQjz68TS3LBq1iXcQXe+/B3ANus/d/YUGm/pjAb56k3+4z6b9U
-m0VURvfgKuSstm4DYMFC879SOHjYyY3qAfQaViu8UShw/xTuKYw/0g7KnZf0y02h
+HsXKdEjZ+XCkjmlvlTuCGl0TL8TLn3kOcxJyrTG9MuJ6p55i+QM44ef1Dc2hrnt+
-0NMANaT6RtvZ+VXUdCYlPzCCo1IyqVgu9mZauGZ+yRPf1SMPKPxH1vjY+WbFZUJp
+qVPQLxMQMQ++JOJvW0U4YYoA4eP+HggIx3rZ93Im8tnj07/bCtLkFfNvo0O42Opx
-EUDuonWLwnRxDx3sXNiYd4rOSHpWKrSYqmM96827GYEqidG/E+5mnZj9WeRFSrqv
+Kxf8W3d67NyNkA1l3XL58m9/VdfBPjc44wwdMKBy6A4VhNmxvf7Z6A45sihmUAGy
-eS8go0nh0ONZ8Wep8rzQHMQ2G1Et9s760BrjO+oQl0ORr2+vCahumdLsJfC7g5PQ
+nCLO0dG9tIM8njEhaXJBcT3YHQKO2xxaHXWmvR5VssOhP4Ewnup2xJioiP3FweYJ
-52Y4+uvYvgQtpSjXABcBR46In83psdOzLHATCogvAioGqC1WSBLjaypNpuUuVT/n
+N4Yv3eVGHLYeDH77Yqq4R9q0He1R2iCwAzFlxOahtX03CANh+vUaKhruw7jNY+L2
-ZMcCT0XohrFi19MSbdKasV0aADlyarwpliCl/B77aKE2oHGQbn0QqBtjjqmp4FpB
+WbrnNPYkjeiU/hFeVSBVgTeVkSQJPiQFK37E9NUo4T6dibGh9VT/5TEoskeUVmfU
-W3LANTYgVzoBUDZAehsiCIY+yBQEoV6F1xebHGZdIxRCDBaPwpu/vi8nPDp7G+Wx
+W17FzFwjBGQXaZzvChJFbKPbIE/j6ve7RrjdOBk6IBgi1LTib/rTOcGZbDhOTvIm
-FgyOkxazZkwg/IhUWNGWAQ/wUZqxGw/BmAmjCjhvh24sI4z+S1+82vxhlts1iwZe
+G+1ze435mQVoBK/1MRgpfE4cpssF2TTEeJqs6PfYbqpx/o7cwZG/At3Jra+nKNhq
-z1CZyPd4BkVpn2hyok3u+kcvdqxcOnKkQdg8rdO1ZQ/dibCdpMIZv4zLJoXiu+qg
+WZs6TjIvNGvO7NUUZmfj2QPktLBRKADjym3YqJy4kGUQAZey5yeDWonMhEV9llAK
-a0XYzat67imK4CleOTlj/kUqeyGKFE/LQ6V3BAwYilU6nkfl2kGmCbtiBP2x4jZW
+LUC40BK6XY7ySw5vTmmGR6nnWo1ltT+71XDj3nZtfGF3TTCkNxZKlsX5HBhfXB/E
-gg3peGaD/AYgfxBEkmtDdct5WvxvlhLjk0nBT6ppS40yMdf02sOCKEFZ13KfPYP0
++8PNg6Ova5jyH+IO9Lu7JLqYTh6St6NfVflD7i8ENFLf6X1CiJh6rRseb3TmM2ve
-kuYQ9gSRuuoYQjMoEB31u8/uUpM2RjkiP3C0zlPDsjCC5wQhTaDFyHeG6E4na1o0
+aj+LypLV8FJ1N7OklFseZy+gqZ7AYCknoOK3z20zL3KMilw7TwTwwfGe41qIhAHu
-q2mcCfAwmXKfqtd4Ijs5qXdxB0C0n7Zrw0NQ1DUQ3sfR5I85x0bi9oz4HjmjcNQx
+LLa7dA0EB58T8isNdBp36H2+oQENGHAIi0kxF0HlE1x9NUoFXvoUhyVEGjEj2zcy
-naVOIoMELJtFPZXBCUkEhH8H4m1fG/BqI6fIvX79boQVhzU0P4j6M++tmfymrIi8
+Rqjb5iSCyELMRJ7qiKyD0e8auH2bQQeHoMmJlCk2E7BXTUUY67eJnNXNrD7ZQg/k
-nKKTcf1a1RiEhmsTZvGY7rlJ2ukMtotY+APXjQA4UaeAZEjp5wJgrvo3U8T8MbLg
+Yt7OAinFP24nKn4SY2Bwm35JE60iHZ3USoYnrD4twPBbig62fUSYUqqDoNYc5L2g
-fyNP17MM/9CtEBMK4Xym1eRG/27sXXotd6TQdKONXY3Ag8mYgXAraKqobEwL93EQ
+AtR5C2SbDOsEG7qbehziw8NLp7zbf/FAashRULc5GLTcFoC2YJHEawhb/lWjo1Az
-1pchSMUaGKi1EzrFZV3NjAd8wN+M2ExxrOHXKIQ+j2XSlp+kWeV/fU4hNbBMnRsp
+nLqXfTB7jXHVbqgjpghJ5vO7PZ+FGg8ylTdUC4aQ/lUWuSeJnjkHDkHFFIfNC4S5
-QWoYK56boMt1mqlEk8JHqTxkuSUwjm8utz1/emMSjDuYSRMB8RqOwNnop1ucEcdT
+NYRpQIAYMdDRAP80tdAHeOG5BC1OoA51jBKqBi843tCxu8RUQxDlB5/3AYKB5ndC
-Ia1MyM+jTpKFE40zizOxOZ0NaVkB7zFGGzSgp4QvzN2Cy2SEoPWxzCCIcxCprQVt
+S3Pp6kYXW8wcFAFRluM+LCFzO9VFnZ8BEh5nDX4=
-1q8rx6T3AzqyJngzClYUTFe9EOLNwTlovhYyTw==
 -----END AGE ENCRYPTED FILE-----

secrets/dhparams.pem.age

@@ -1,33 +1,33 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAyMHdi
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBqaFcw
-VHdHcE1uY3plMmE0VHd2bXF5S09aSy9XSXgwNVhIUUcwaytkc21zCmRXbEZRRHVm
+aURxK3cvaktEVkJIQ2dOOEtqbVVGRDN0SXpXdGI3NzhQV3FmaEJrCmVtclBDY2Zr
-T2p3N3ZTNnA2M1lZdnNlaTZNS2Rka2h5MWE5bWxMN2QyQU0KLT4gc3NoLWVkMjU1
+cVMvUld4dDNybnJ4bHZOODFpNGpJVXdRaDJKY1ZxMy8yMjQKLT4gc3NoLWVkMjU1
-MTkgakk4UkFnIDRtMDJJTm5WSUh5S1ZtZXljNmt1c2JhdERuOTA4WU1iWC9QWVl6
+MTkgakk4UkFnIEtDRTNkdi9VdGFnNkQvdE1UdHQyRmJXR1RtR21HTXMwa2hiK2xM
-ZSs5VFkKSDd3RE9hK3RMRm9qclVySDNGUXFjVFh1cnFKUXpmaHo3QlRqY3MyTHJu
+Ym9xa2sKYTFVQmVCNmJId2pPQk4wd3g4N3pOc1lHcjg3YlBEa0FsQlVsb0RKRjYw
-SQotPiBzc2gtZWQyNTUxOSBnU3hQMFEgNXFDdUsxTHZMUmlQcFdUOXpSMGZlaEpP
+RQotPiBzc2gtZWQyNTUxOSBnU3hQMFEgOVM3K2NwalE0Vk1rbWdSL2srbXg2bkF2
-em85NGNoMjlpbjh5M1VHYWFIQQo0RG1DTzBQUmpQMGs5VTJvbEF6c2o4ZlBkOVYy
+MTduekNpMFA1QkFBNHJidERpYwpCbWQreWk4cTllUnluWHZaMXZWREpqZnlwL1Ex
-S2Z6Wm9GM29lT2F2enVNCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBzNVZaUkljK1oz
+R3k0cWhHSGg2SkJPSkNZCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBwdS9CeklwWmpt
-RS8rRldsc0ZuQ3hpa3R3L2RISWpQdGgzQ2RuTzE2Wm5FCmZ1U213SWcrQ0ZPZGhF
+TkxWYnhTTjVxNVREOFBqQXhRWHlza3FLY202K0wxM1RNCi93YVFOTGJGNmYzZzhF
-R3YraTg4U3lBdVNnZzFmL2N3aEQ0eWV4Z2xETUkKLT4gWDI1NTE5IEFVVjRJck9h
+WkpFMDd6V1JIcjR6ZXcwUys5UkE1ejdFOW91MWMKLT4gWDI1NTE5IEk0aGh0c09n
-WkNBN3JVbGZQV1lHUWllejZRY1VMSkwzY3Btb2V0NFNCbncKYWhXOEFvYjc2cEZp
+T3B0ZkNSc3NTa2doUGs2c0NKTTVMOENPRjJ6KzlodnBxR1EKUnB6azR1V3NHUnRR
-RnRnSlpRWThDdlpNQ1VxMWdMM0pCVTNPczlhWDh3WQotPiB2LikwTzMhLWdyZWFz
+WmNrWHArZ2dmMUdEaGovYUdndDVNNlB2UW5VaVdnOAotPiAsLWdyZWFzZSAlUSA1
-ZSBeJSAmZlYqIEBgK2w6fDBWCkV0OGIrTXIzb1piLzl2Mlk2OTQKLS0tIERzdG1k
+WX0gJwpCMG1tNjBPMVJRMGRlQ25KLzJsblFzZkN2LzNDOGcwWEdSSXlBUjNwCi0t
-dUFOcmJjL25MNHo3MDhRS2lCVGxzRnZnQUZDZ2JManpJTTlXcTgKpmHNMXWNS6I9
+LSAyY2hHNFNmWFBQWEsvb2hxTUxVUXdKL2p3ZkZWSHRDdFlkREJyaWJrVDg0Cis5
-QIuY1L705kkDEGlHghiRfciV6+vK/FxeEQpqDjR9NXLUtPCsgzlcqAjg6w4CAsdm
+gfdBAb92J5/DuoXUt8OirgM7bXucabAp8/U5Az0nmRkGawpSZidB9ecPYHfcdUGp
-2wxVD3FPutB0uZQSWdRSPZ9zG2UiwfV3cIMhZn/0OU4DqLVo/xlapiOImO3GyQRd
+VIv8roO6P0RbbfYXh3szT1YmEMyOXMHFM0+Yunq3u1ca1EHCZDV6Feb+i+lXIBJU
-ILWBnu9a9WPsSDbqp5zSgwqcpzbERurADl+J+9f7HqRSCMlA8BlpVS24wdiC8Ruf
+GST4oupwMET+ChVT1/yg7A9o4FY68+FgLjGwE1qeHN8gQr6aMz6/yml/z1WzBEXW
-rB5rQ5qIzZ8YS5GVD5EHzekywnK4PbgmnXi4Gin+E68Irkwhtxqp22VnJFABsHDJ
+XEv5fVxGj39eBiq08Z/kCgt5zVDod8RxEq3S3kt1KX5JD+mpGYn2z5CMGhn7fclM
-o4ZhM5UiJXXAnqlQfd14BUi4u8UhvY6sC3XD7NT2zz0giSP49aSBkdcv0L+vvRkv
+mj37LaVbcKfyVnwRlLPoN19NeqR+ltM3mu6ibjC7cOQ0E1D/zjQMIxtzNzmZRFgB
-xtLRv8M16d+2Kzlgc9ii6jAlewuCV2ElARgdgNMizCiVgQEPHaXA5/ESmI1e76vA
+l/BEOsX25Zv5vJgLZBU9rMfybNVAjDroG5V1cCVDRR76TP6HVJIXSriyOW5xSFCy
-3GqdgAn86/6fbZrquQzf5jsrLF1VIzwxmUGzjDpJPZm50TSPrXX/7GsuSfhWzeEj
+Li/VyhWaUXRboGq0Nt4vXWuOTlU/tenlBnBc+d48x35VCExi9IEFpIHj1fUwM/0V
-6FBCgwb8+WZkwl51BFVrQpMs7m1yvMn/69ttEfg87V0nu9o063rfVgEh5TVCfTqx
+dgOfY2WRH9C2cObUc6W51FIARkp777uPXRbT4ZXRDjV18vb18CmwLQQwYupQYnZk
-39o1HeThkonLAYKoiYAQFjsJ7i28AvcUM6m65tOBB6+QFDqGo75mptpf0iyQ7hpf
+c0hZHvoxDwg5QirWxPhuO3bWDqIvHiKy1LYgRrlvr4Wpcb1l0lAYSGX2r1+QVj8z
-jc4XY3IpWekOzaub7AXkLHhVFPes3JTknqF5f8dogk6bMi56DXAfYpoxlmvA8vxA
+tA+zJcUaPkjUSpaqF4LNVWXrTWEN330gQrVk1knWqPl+hFPoyFEHP50PNYr3yxS0
-Ucc7NvzF0MRjIy/+d6gnDaF4lrepvF4JgSW0jtP6AzghFttILTKO17tY9fZadFfa
+VxbSpg46cXyxi89ghwlXBqI4LRtWlheUoIOuNyLxvXZECwCI2kmt+XBFph5lbG7F
-jd30GZ/sKtYbvfwZL1yIO3Uey1+JKrQNd24+3VZnv9vbBPRSkh1KGTIMd9/OgeZ/
+UQaH+ve+trb3oYkkG8ZprCljUC7HvSyt31UIRF3l4sLsULQKHqWwVD/2M4B0N5wQ
-nh3KncUA5pVdf22kloNf8APm3q0ueBVCdMik9wc4vDt+dmjb/BVkjeqI/gpQ53sE
+IzIJkiuWBBE8IX/tI5vUlGx+QWSxmKdHD2mMb/GeMsbo7lOY51cWe8oxe9WcYPhB
-o11OuVn53trLNisG5pxLZsEchUo87mkDrvD2c8TdE8N46GF/CyI/d6MS/OO8kwmR
+m4h1xPm4FLo0vHCnWIkXy2o8JYr6fmpjzslC++wYMEbIH3gRBKUVjgUGHywVIXSa
-cCy4Mnw5sP8Q+ZOgfJI7ri2dAtuJnx4CvXVXaqL0dXICJHIaRMHgjKbuxsbm9pXc
+uwzRULUiD8uXFNT3cZ+YDnAvZkuYz528DBKjd5jNen4akah35wQ+oYoGuIhUKkGL
-QfBZMQRyWmWxc23jEKfbWQ4Lm5d5+vT+uTprOUQTkViuqYcWh/jdIPBfzKnwzmuu
+K59+hTyctWyEGi+fCl1gah2JJ6aF1CXK69ON11YkCEVCI1SK1o1no/0NZj2XtepU
-1m+YZvbOcxdGmARmHKRWu4KTqhzRzF5U
+MgXln0Pz+pOTZzcjCWhYTO/dNl+Xj6EeeSjjWHqDYg==
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/kelder-wg.key.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBCWDl3
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBvL0hp
-eTdyK2EvaVZNWWl6UmMyOXdGZ3I4M0U2dTZvZzg1SEc4MXpuTUVJClRWVjFobzh2
+WUs1VWxPVlpydU01cjd3Qk9qd3hvWVdvK1VMaUZNT1YzQ1BjdWhvCmJlSDRDSFBj
-N1VWeDA3eW5lcHR3TW5QUWZXbmpPTmxTdzJKa1hnTXNkOU0KLT4gWDI1NTE5IHJ2
+ZGVmVGV3Vmp5YitGbm50aU56VDZCc1hTdjJmSGhEa2dvZWcKLT4gWDI1NTE5IEsy
-ODVMYUw3NkhjWWgyck9TOEFMdlBiU1U0T1JFY1lHWkFyYXlmckg3bVUKd2xmQU5r
+RHVVT1F5d0kxN2VBMG56NnJWYTlEeFFXaHg2VnNqdlJKTHhoR052akEKZjNObUtk
-d1FjQ1ZiMEF4VjkrL1hiamNhYVowRFd6ZDdVWkVvSjRVeTM4VQotPiB0YH1CQS1n
+RCt4Q2l2R055TnJCSDBrY1lWaUZibk5iUDhnMlhvZkxRRkhpOAotPiB2LWdyZWFz
-cmVhc2UKTlBTeVpKRkpRc2pqMWprMVVIcElhRjJFQVIxN05iaS9EZkFwR2FkRG80
+ZSBMdUErIHQpI01mVENmICFrK2dRdjBbIFU5UyI+KjQjCitmdU4ySDhJMDRlbklD
-dmtMNTcxaHgrZml4N1pCZ0J3M3ZHcgoKLS0tIEY1THAvVm9jc0VXT1l2dkgwSmln
+aUcvREFqdVNtb1lFZWwxZWo5VXdNUGZQWGt6SVRKaUI4cTcrWEx3NThWZ3VORkor
-QTlKbGs1MnZaL0lYL0I0Y0N6Y2Y5UDQKQ1Xo41y8MDzUvkrgJHFkrAAgVTQ/tPr1
+cy8KbG9EaGV1dGVDQQotLS0gQlFJdWpudnkrcmQvbEhpOUM5Y3RCWWRGMEQ2TUV5
-pDfzNqSn0NZY8rba44wDFNLv69e9fxecolA6SQ9LpKg15BS9MdRINULUKn1ZW3VD
+eTBFSnBkd0xnYjUrUQrxdaCf14h8hqRfdnMorggnbuCDMRHY7nAnGQ1ET4CBlCog
-P1oYmXs=
+/Rp52aNZHfLh+BFFZazenI7qrvVvEaaB2ZVKa0Z/F8adsGHSGSwz+saqWw==
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/netdata/powerdns.conf.age

@@ -1,14 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrR0Q0
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrVktQ
-SE5jV0c3Sm1Gcks3OUFZeDc5QzR4cFZqbkp4WVNZVDhWOWozQWx3CkZjQlc3RW4r
+Y05RdDFyeUhGNDBiK3VHNzlrMVhKWlBJQnhodkUvTTlINUZ5K1hVCjJ5bXo2cTd1
-cG4zLzFnNHpjdUs3NE5WZXk4NmxiSzJ6eEVXOXEwY2I1YjAKLT4gWDI1NTE5IDA2
+a3FCaHJTNVNaL1ZRcDhuTENuZVlhWlpJUUVndVErbDVoR2cKLT4gWDI1NTE5IEVj
-dzd5MFd0b3dSUmpiMzNwdDA3dWhwOEorWU5veDN0YXk2NUFUV3JTWGMKck5jdlJT
+VTErMFVTdHBoVmtMY2R5SmJSdHV0aTJ2SWZNc1hrN0h5S2dKUnFxRFUKTHpyaHV6
-eiswR1VqTlZOQzVtTGVOUzlWS2xkMll2Q054enY0cUJxOXlvTQotPiA6biFtSjRm
+WWFYME5xNndlSklvNU9GSEFrTFpnc1cya0NMQUlqc1Fhd0hNNAotPiBoRSMmKiNW
-LWdyZWFzZSB+MCApaEsgR1gpYiUlIH5IRWAKVURzVndnSUphTzdoWmhZSjFZNURS
+Pi1ncmVhc2UKZDQrM2piclMxdExSdUZqcmhVV3l1K3RHVFlOcFZzN1IycnU0d09k
-a0lOSTg5NThOemR2VC9jSVVMTmk1K0MyRnRQdUhVNzViS0ZqQmV0ZkxQMQoycXIy
+V1dwREZDaEcreDQ0enJYd1FXMDd3d3BVNAowYlpwK1EKLS0tIEwrL09nY0FpSTlq
-a2JyZGptN0FaT3kzendKUlRoOFBJNTAKLS0tIFNmUlFrM3U2T0lTd1IrTzUwdVl0
+bFhQTUtHOWt2NWV0TDArRy9iaFRFTEIxbms4SmI0ejgKmJRGof5FAIPpGn+u6PDh
-S0FWMXRxV2h4SC9pdWpUSTVySWNydDAKt5pyhC3SbNgPEwRfxE2vHpiGoIOej1sL
+xSQMKrpFnGvjKs2FicG7K3C19YGVwvMds9XGYzLLdugvZgykzZhq13XK/mSk2b9r
-ar5C3X1RZFv2uDzH/Km7TWkhsqqRoOvtbxoLcZTAlKzNIG0KEwcFjpJRas86gd1+
+9xkhAvCQ0p1ikQDyX6SuLwJzsJpa7V7wHbEF5HJXQ5NrJUOFwftzxSqYodtP29L4
-eZYjm3QtixvrLp2doXtTHfl3RLW/dLMVGFFn96tWlvecUPm7hwTy8ehR3xPVblY1
+LiA8sxPzNeqhFYT/C8Ea4lDzgnXCjoWtMcZCpfWMMtOJh8fLLw==
-5vFRZTnsh1V/9NRkFjBOwkfXdJtU7Hf1iRpgwg==
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/netdata/powerdns_recursor.conf.age

@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyAzVGNn
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA3enI5
-YUNPRm45VTQ1YWJja0wrNDZnUis0UDFpQ2NvVm5zWWxWcjBXdkNZCk9OdDczR3pq
+NkVZMkxncHRiSFkzRm9seGdwdGNPM2ZFckRoWkZFNlV3Rkl4U0UwClJ0bUZlUlFs
-TkVYVmZ5N0JMZVE4eWV6Si9qOFN0di9JWDc2OFE1L2p6TkUKLT4gWDI1NTE5IEJx
+MVNsNmZ6aFFYRjJSQmNWdjJMc3F4cTNrejMyME1YRGdQVU0KLT4gWDI1NTE5IHlR
-Ky8zWjhLcXVQVWprVnJMQnlMR3hxRmVHTXgwZ3dhcmxwUWtoTjBPVkUKaG0rQU1k
+VlI3eGVMcS96a0ozWkx2b29wTWtIbFFCcDJEa0g4dWJvdnhGQWFwMUkKZjQ0MzlQ
-YzBmQW13MlFqVGJ3YUpLMTI0U24rbjZxL3ZYbFlJdVlqOGhvVQotPiB+LWdyZWFz
+VDlGdkdxNG91bDV2MFZXazM5SlIrUmduYTJacGtXQitnTXU4UQotPiBNQktGOG4t
-ZSAoQl5NRDcKRHhzCi0tLSBRbmNGdDBxa0p4S2NKclVNSjlKOWF2dW9XMHA3K3B3
+Ky1ncmVhc2UgZzddIElDKW0KZTFiNlIvcEt6aHUvY3h5VFVtb29ZQ0RGODBtTUF1
-bmVCK0s2WldDeU5vChTZYjN3rWDIVs9tkiMrdqWjcFBFJnoHZJd6Xqd9gAXVOBdE
+TS9Ta2lZZDJJUFNyOGp0aU9LCi0tLSAxa0ZNWnM2b2loNzNFMmd4U1V4NUFnZ2RO
-tNPc3n5Am9kJqNER2jcJCuVMuoYiqVqCElWq1JNYHzzL1+jPDy03blfytPU6nkL4
+SVRaUDVpNHVHMUFSczNOcVZzCiJKbkbVr3dPswaIeb/dlP5REMZW0NoxMluj8R73
-g7DkAFUyzlpar4Q8tEgjWLG5fVPvmdxTXU+pcvzwFxDa7dJqMh1Lp/1AniY9fENu
+AcCimbLRWY2KAOx5XU/ci2auvMqjlqMExlp608OwaGHcpmoijNZQsKgTAW8Z4z28
-GLK25GqhzdzYakdnEsWWdUY=
+9UbAMOmSWByLfgAzhoN4Xob5/40JjI2f3wFYwsAf0f/j6dLc2lmqxkhd+Zcj76Yj
+t2WbVgPlBMqPQIoFd6TtwJweqzzGmLI=
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/pdns/auth.conf.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBPaWFI
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA0N01m
-eUNkNTNuYTRLTjA2akFybkNLQzdaOXNCSWZFaGEyTmRFUE5iU25zCkhtZEFzU0FU
+Z1RiUHFFbmlDVVgwTWQ5Nmw3WU1NckVFcWQ1SGVsQlZLdGIxSFJzCnZpL3dmRWdY
-RDk1SmRtOGpQWlgyTUVGcG8yY3pnWnhXSjhMTzFxdytZNUUKLT4gWDI1NTE5IEZQ
+UlVaOW0yT1ZmUXU0VkFHNmRzbFk4cEt3dW91MHdnR240eVEKLT4gWDI1NTE5IGtC
-bGkyWjdZZU1XZFo1WTk1dVA4UHNXWXhITjVxODFjY3BLZk5mdkM1eU0KbjVKMzgx
+RTg1eThyRHlSZ0VsUEVzUm1EYVFIVHZZaHNvY21mOS9mTnlRbW03aEkKQjIraStT
-MEJzY2poekV3SXdLazdjVUR3elFSeUo2N01RUnp1VXdpbVc2awotPiBYaXctZ3Jl
+WE5sRUx3S29CcTRobHZVQXJDQTQ1YXg4Z2c4cS9zSVhVVElXcwotPiBoM09vUG0t
-YXNlIGEgaCEsTD1xCmtZRDZjN1JwK2pZVlBrQTJVRW13NGdRSzZSNXV2cG93UzlR
+Z3JlYXNlIF4nRnwkeSEgKTRZIHIKT2FXTWZmbW9jSnkrYmp0WWVDVTZHdFFxcXJt
-YUhsKzBlZmFmdVBGNzhiV0VvSUlNV0FmMmR0ZzcKcloxeURaQXkrVFAvUjcrQjly
+Rkg3S08xVGZ0TVVjTHQwaExFbkh3WDB6bWJkVEFKYXpQUDEvSQpGNXY0ZS94SVY5
-aDZWQk9ETjJscEdPeSsvUWZ3UW1FOUZ6UGswLzRHbmxQalB0MWFiK0dBNFFVCi0t
+anViSzJ3NlNOUmp0eUliYms1Smd0RUVXVGhxdlV6TkFNVkpzcwotLS0gQnc2Y0ZS
-LSBZcEQ3WTZJdXB2VTdWdVl2RFZEM09VSFZ2OVdRQU9CZjY3MTlyVU1hTjBVCm+z
+aGNtL2RwUjVxZE9uYlpBeVMwd2M4RTNsdW0wVWpDd2hLLzJSWQq07wZpB40EpZog
-D0JiEYoHVIfMwIFjA3ZWLGjNqaKfkgHyaeuBaMVu/+hSq/kToIESepC/WdX2Bg78
+fW3t5Uokt7EZL4V4RX9PFyd48SaEd/xR1FiEL7jg8IJp0dY7hdfnzObQbueCwUOi
-MdDauw3Ne6cWCukv8uAkgznK/G92W6UXKg==
+lWOfF3n8XpzS8uo5TgLWLtY=
 -----END AGE ENCRYPTED FILE-----

secrets/estuary/pdns/recursor.conf.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBoSzZC
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA4bGQr
-cDN3UEllRTZKVWcvWExMTlJOcTJIbG9LZVcyQ1R6MVd3amdwVXlJClNKUGZKdjN5
+dzJZbU4reWI1Sk45QTR3UkRoc0NvaDBFcUwrVWlCYWUrcWtYZGpNCm1PWjVzRVlt
-a01LQnNOL1lOekNCcjRuUTc5OHhHT3lVY1o1ZWRUWlhDMmsKLT4gWDI1NTE5IG4w
+UDFKY2ZSZTg4S2pVZ0pDNzR1WklYQ3pEclJZLy9kKzdGTGsKLT4gWDI1NTE5IHFO
-dUdFOTB6YjVnOStUYXdBM21TZ3ZiSi9sT09oV3cwOWt6VFZvYTJpeEkKeVNFVkJJ
+TXVRK2d3azg2cHpRanhUNXp6YnRsZW1MUDJqc3l1bnNYNUhHaTIzMVkKWXp1M09H
-b2lNSXNSRDdXbVg1RjlFT2x3dW9WYnNQNWVib2J6Tzl1cWlrVQotPiBdLWdyZWFz
+TnJIazRmb0tOSnE1Q0E1dERiaHZCQkh2YzE1cS9zRUhwaEovMAotPiBzPj5nLWdy
-ZSBJOG17b0Q3NiBWUDFrd1NZcCBEIFtRSiQKd2V0RVlRUnRad3lGV0daT25hTkpO
+ZWFzZQozSThRWnJCcVFFRHpoSi9tZnZMdnJoRlFud2VISHBHSThMem9qZVVWdS9C
-M01kZVZvUVhyZjBQTHUyd3I0UktoRHVER3g4Ci0tLSB1SSt0bkxKWUl3bUh4d3BO
+VFBDVEVzbUVCdFU2Qy9PaGdyc0FaCmk3UFZma2ZiR3hmWG1sa053bDBnY04yZ1VZ
-Z01reWl3RVpMdmo2RDZUUnEvNzVJSzVyRTVnCsL5btAUdWO+ru0ROIgNVrbIOysH
+TW9jZwotLS0gMDVSaE5aakxHenFPVXpXa1JxczlWQ2x2VGNuQzdwaWZFTTFTaUp6
-gfnbLNYgF/S/kH+ahA9Q4zbjq4y4R+C4zYeCVDinOXExLXqsKk/gvOKp99tVCLor
+cnRmZwoomylfwjD5A3N21/mk1Wtt8f4bsK747iZz7KT34kqmoX597rbGYxyip5lg
-4AFK6Ol6tg==
+VLZV6CY4LLRjnnSKoC2hIXU0dgudAmvxhztuaQ42fOc=
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/actions-runner.env.age

@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBIMEZW
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBzc05k
-aFY1bk9JZEY5YTN1eHNLNzh2STdnVUlFaXlqNlZNQVlSZWhkblZRCmhVa1BROTFo
+SWtwMW9tdzAvL1hYenU4Wm9MTGF5MDIzS1Q1eHR5TDNlRHkzWEVBCjBWa1IyaHFr
-S0JNcVdzVTMyK0pNTUhlQmpDaks3MG1naHdHdGpySGl6R0UKLT4gWDI1NTE5IGVC
+MW1Xb0dSU2tVTlhuT09rTUF1Tnp0Um1EdExGSjk0ejJJSDAKLT4gWDI1NTE5IG55
-VnFwNFMzWHdIZFB3K0Z4aVNTSXFaaUJpREdxZEc3N05JL21vemp6MVUKSDJEOUx0
+M1RVRy9YK1dhZnRFMWdpakptVkNmaXJyOWJxSUlLcHV3a2NHa0N3RWcKQ00wUmhY
-MzZUVVY2bGwvQjc5Z3BWOUdFZ1o5ZDBlYXZHeG82VVpHZDRLMAotPiBmLWlSentR
+UExuTXZ0bWhjQllQOVB3WnAwbnk5WjlURDdpQ0pqNjVvMExjbwotPiBPfj14Slot
-LWdyZWFzZSAoNjkiU2BtdAoxMVZSeEdmM1Brelk0cnJSV2ZWSVRBK28xNDY1R2VK
+LWdyZWFzZSBEPyB1O3spbCBYPCx0b0RQIFtTUmJUOAovelJwVUZibjBibWp0MmZ6
-enJGeDI1eHFURFZJdEJwdE9XaEtqVDJsanVFUFlOY1UxCkhCQVpUc1hkM285cmo5
+WFNVMDZkbFJOMExlaEFUbFBBWnROWVVtMkNvR29ham9pV1dHVDV6M1BVWjBldU1L
-TzNUcHcxL1U1WUdjTQotLS0gb1lIVnNWUUN5SVVLQkxPc0ZJWnF4K21TMDZ0OUlp
+CkptRVEyWjNBc3dXdkFWN0NlTld4M3lnCi0tLSByMk13SzY1L3R0NlRCVG9lcVor
-ak5rZjR2bTdlVEZJSQqtDNO7Rm9G+7rOSLYzqOuiel0fCWGHPslkLj95g6L/Yckd
+NVVmT1hxdnpSL0QrU0k2RWxlRUY5SldvCiBWgIk3pt8hcWFRsH6oleoX56bT+nz8
-vC/+s5Il9crZEJoCFO/7DDHe3KgQXcMMIKnTbgxtNqh9R+MI63CarYtoujq3
+BZx959QwOE0of9n8Prfnviq15L9Uan8yL/CadSS+0kyir8AHhl3sV/VLFe9nlZZ6
+Zg81EdhQXSQ=
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/db.txt.age

@@ -1,12 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBuVkFm
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA3TXZY
-akZuLzFFQk55cGdzRk5MM1dDWTlwQktnREpScUpkbFlFMHh2QkE0CmxjK1ZQd240
+OTBpcmd0WmplOWFEbmMwTjVidC9BSFh2OUVqZXo1bzRvcEFvS3hvCkx0NytPaE1Y
-RXZ4V2VsYjFURndVTnJCbGVkM2R6WjkrN3ZSQ09nL0xPM1kKLT4gWDI1NTE5IFNO
+NDliWk93SnNxb3lOdlV6em04bllsVmZuVllwYnZ0SytLZlUKLT4gWDI1NTE5IHFu
-NEJYVDVzVFFhWkFkcUJ1alZnL0w3MUFwM1JDM003Zm5Kb1QxRW83UkUKR3lkSFAy
+bTgzM1NLWXZmWFVqVTQ0em5XajVEbkQvV1JxSXp3anZFc3EzeTdHQVEKYTc3eTVv
-TjZDOW5lM0MzNWlYZ0NyRUd2VHhuenRXdzhINEk0cUxGN3hoawotPiAkPWgtZ3Jl
+cUFyYjU0UGErc01GclRhU0xtUWNzQ1F1cm45d2NVdHdDNWNWOAotPiBvWFhMLWdy
-YXNlIE9yRSA3TlFnLVFTYwptWEJCalNTdXIzai8zTUpFNjBKOTZXRFJPSUVuVWVJ
+ZWFzZSBQMV9mNiBrdzVuNSBOOSkKOU9BZE5WUzdIbncKLS0tIGplTzYyQVNBR1g2
-bVN5cC9nVkhnL1BXNWVTV3ZNOVRrMmNXSzZPUXZuZVlxCksvS1hsd3dJR2VuR3J3
+N3VUUHRCVjY4cjBGYTV4akpEbGNPUm9SRXhvUzRzcDQKhBEb7xKAjU3SMSgsVxBa
-cDBaM1B5MG02bStRWnJFUndva0EKLS0tIGlWMko3bHR3NGdCSFU3L1R1a1p5aVV6
+8KA0Rh6lgJ0HOLgfBI8cZTzHcNXeIOgOTae1GmStyVjUkw==
-T2FrTmE1OWxwd0dkeGJMWHE2MUUK8hoazoNI4HD1S2GC2NRb41ZF9yf25Qr3YsZE
-ivkpLPzXy8kjC18JwwDmGez2QJV87w==
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/mail.txt.age

@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBBTDB4
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBsOXZu
-aitJOHhDS0liamE2aVJPN2t5YlpudGpLWGtZOE9qVGFvalNwWFY0ClFHSzFENE1D
+WENWTnkzdzgxVDVFY3BXSTBOUGgwY2xyMm1EQklDTG45V3JraEZrCmk1TjFMbGg3
-QlIwZGVJUlhlWmhxdW1wRFlIRTdGTGZ3T2d0LzdFUnNsaE0KLT4gWDI1NTE5IDVR
+WHB5b2s2WEZjV0lIT2pGci9TbC8rbUY4eVhhZVFDdVpHWkUKLT4gWDI1NTE5IG0w
-S2E4bFVLekJZbmczVnVGUjF4RCtRMWVoOE5INWVDTUFaa3JDK0htQzAKZGY0UUZa
+RGpobG1sNXFBOSttVUdEd0RjSHpORm5tTVBLSG5iMnlHeDd3MVJ6MjgKNktpT0N2
-dDBucTZCRnBYbHAxTkZtbzF1OEhvalFuTkR5MHZzYmJ5cVl3NAotPiA/WUM7Qy1n
+RDg5S3A4clR0RmltNmZ6bVdBYklONGwycU00ZnFQMTJmcEhpYwotPiA0bFlqMi1n
-cmVhc2UKeStlMFRNQm8xYzk1UDR4cTJxSEEzUEJyQkdRREoxbzdLZmhpZGwvMFJM
+cmVhc2UgU3ZAOyArVndDWCB7RmZiIVd6YQp2dnlBOExZQ204TEpuVy9vOHVNc1ND
-RnYwYUVHUFRNQVJjZGdnbU1Ea1EKLS0tIGdjb29GNVErTHMzWHUwckJzYmd5ZjUy
+d3dQc0ZPTUJaWXJJVFFjRzhqMWt0UTBzMzZ5elhiRTd2dE1qRFpBa0EyCgotLS0g
-ditNZGxiRGdXWTJ2bG15QlVvRmMKbW6LYZpRKW8IyATjS56cL3io4FGo9LP9Qv1F
+K2FnWmJNampDL1hiR1diR1lKNEdtR1NGanhGZEtpVkN5Ynk4QnlLNDNzbwoKzCe8
-wXSJ//BMnY6u5+eFyO6xqYK2C8pfBw==
+S+esi+100HykYeL6bKhoa3tuo05x8qCn2d/fAehnJDecPEnpqYdDXWOWc/3x
 -----END AGE ENCRYPTED FILE-----

secrets/gitea/minio.txt.age

@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBDNzl5
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBOd0ZS
-NjlaOWJ3K1FlZ3JCN0JSb3N4K1VvdFVJbURuNjM5QUZYdjdkN1dNCnVKT3p5WXFZ
+aUp4RW1DaWxTOUtrbEtUaGRyNVYyb2hXMWdmN1pqd2poSXM3ZFE4Cm0zMCszMGpK
-aENNVXozMEZ3TTNzbXJpamlrL0s0cXljbys1RmsyVzRBMDAKLT4gWDI1NTE5IDAz
+Tks2UjBFZnhGVnhWYnBEcDhYakE4Q1d0aythcnhTWHlxMUkKLT4gWDI1NTE5IFlI
-dUwwRGhGREJiQTJNSGRqTXpFR3JuSGR4allyOTdNL2o5WWxacldMaWcKRkZ6VWgy
+Vmw1eWxPRHg3REhrOXlORURiSzJJcXAzYTF1KzZLYXlNSGUyR2RTbTgKNS9nZGZT
-Z3I0T2hTa01xQWdWQTBwNldDV1FBSXJrL1hGN29BMVlEa2t4bwotPiAhQUVXLWdy
+MkZIalVGc3dLMUN4VmtxZSt2NEV0ZTc4KzgzSTlXelNlNWR1cwotPiBIL09daUJh
-ZWFzZSAnJgpYeVMreGxSUExWa0JuUFNHR3QvWnJIeDBycUVwVEZJTlpWakdxaCtm
+fi1ncmVhc2UgNmVkIwpOOFQrV2FNS1Y3RVUrQjB3cWJWZ2xBU1ZEUmg5UElMVEtC
-ckd4VkMyb3E5c3NsR0lnYm1Ia0Q4TVZ3CnMrTVRmTGV3VUM3ampPUUtmcVNhbk5q
+Yi9hR3dJWW9QZDl6UDNXSVVFMFBUTHVqY2lJL2IyCjRlNWd6b2RETXhGMUxiTnVR
-aXVuUjZya1h0dG5nCi0tLSBFZlZyUEZKSG92MTBqOXhYMWkyM1l2QzJZck82WWd3
+amtYCi0tLSByclhCU2VUK2lqTmdQRUhZUEdCV3RoYlpLRXVtUWZpT0R0WXBiaml6
-Rm9wQzhxZ3lNQTVrCoIaIO18v+FQdXXdTqp73b0F7E3xASNBXE0jmZ2GxvNAVIad
+aUdJCnhOnafCdWyJ8JDkXonlnrNbq6oJfkwA9eaksl8otOfQ0pfplHq1/EMtNH3Q
-hW4NcZTNQBvrsZKGk/8=
+AWkX50A=
 -----END AGE ENCRYPTED FILE-----

secrets/home/ddclient-cloudflare.key.age

@@ -1,13 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBaVlB5
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyA5dnBy
-Ky9mc05ZTjZ1Y3grOTV3R0QzR2xKNWZhUjJjTVhWenpkdmRBRWtVCng2MmJMZjIx
+YkRENmpNaSt4Y3lOKzhkSm9DbUM5RjQySzZHWms4QXYxNXdLSjFzCkM4M2djbmxt
-aFEwcGRFTG1YTkhQWkVuT2xMbnZtbWdMazlEUDRzVjhTbzAKLT4gc3NoLWVkMjU1
+NG5lZlh6V3JNVVpaWjZHOHhadWRlWUl3L2xHK0Y0YjFCYncKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIHlyN2liK3pWeGRIdXVmOWcxUzBSRVJTSlJhcUdaWi9TRXdqZUNB
+MTkgcytxUmZnIEU3TzM2cXBXVDZYVUN1Q0E0eGxyZVJQTm1sMTJtRnJ5dGNsMUcz
-YTg3eGMKYmVyM0ZOTEV3RENiUWk3TEhmM1hqNTRJVVIwZDBpaUx0aHRSNitEdHdo
+WTcvMGMKQkJaVDUwQXEwVWhHUW5IRW5veGIxLzRmUHpEay9LNU5QYjd4TkJDTmU5
-awotPiBYMjU1MTkgemRaS2xzTTNiTFpWeWIyRnFEZGkvTktJaGIvN1pqVmxyYjUw
+VQotPiBYMjU1MTkgNTVKMGZnV2ttMjArV1hYZUEwV1YyZVRMcmxuOFpZbXY5QlI5
-WWcxSEhIbwpJTStRUzZyUHF3cU5PZmNqUFdvYUhuZXAzNFRrWHB6L2d6VzE2R2tR
+UElFRld3RQp3OHA3czM3UnVMdlo1L09VQW1IMlBodCtueHE5RjV3cFllSGxndUdN
-VkZFCi0+IFhmLWdyZWFzZSBSciFXQVhXUwpQcXFqVEpKMVgxNGFXcVhlNlpGSmRk
+Sm1RCi0+IE5YTiMray1ncmVhc2UgWEQzbDsgO1A7YCV8PjAgNTpiODp9IFVZCmJh
-ejIwVVNCV2ZQNSt6ZTFVdwotLS0gU1JSZis0TWZ2U2hDRnZ2L2pjTi9vQkVQM3ho
+c2VsZFBZOVAxRHVQajlielI3WkFrVzRTSU1HOTMxZmcKLS0tIENiSUsxc3E5Q3I2
-YWFObG5OSW9ub2hYSXU1YwpRT/yTLKhFr2QDaxL/Qu9uBB1yXyN66zG9wqBpNEHc
+UlFvMGJBaFd1SUtad2dzVVB1bkcvQUU5OTdQYldNVlUKo5ZSBZdm7MMSTJrX7RdF
-2Eg96I4hBN1+TkF0HXvvhrJiQ38CDYgERniCa2+6T4qx9F+Sn6OHNM1I
+p3+z1XKPeVBpaQmH4593iCVgxF1OTv6bOL3vS0EwtduRT/htoBbXJmgUeUpTfEUo
+IY3DkohGqSbCVg==
 -----END AGE ENCRYPTED FILE-----

secrets/home/pdns/auth.conf.age

@@ -1,13 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBEdGdu
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBhd2dJ
-Rlg5UG1IRFRGNXpyT25LaldEMzVtRFlqU2ZGcVN1UytVbTlwaENvCmdEaGM2R1hw
+UllxNVZpK3M1R1FwYmM3OWs3VVpSZzhSeGVudnE0WFdlbDVET2p3Cm9BSy83SERa
-UTA4SjBlY056NE9ha1BvZHFtcnpGbVQwWXRoNVM0YTBTV28KLT4gc3NoLWVkMjU1
+cHQ1a05kVnJiODIvdVE3eFZ5SGJ1VU9xQjd2RDVKLzg2eEEKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIHFPc2VaS05pK0RkR3RxU3F1YkZGanZOUHc0dkplVmE2V3RaNUZt
+MTkgcytxUmZnIE5hUVpyQ1h1Nm9EWmJ1cEZCK3hVTHcwV3hRQnRZTS9ucUptQS9h
-RjdYaWcKTFRndDVoN3hoWTRjWE1qOU9DZ1hMMzBUTjVGdmhuWUhYNFluaExETi8v
+Vmc4VWsKYzhGenphTjFSalY2blJzVUIwQmNkTnVhTjczWk1ka2d5eGlVcll0Z2dp
-YwotPiBYMjU1MTkgM2oxaHRUeVZQeVBLRE1kNTJwWXgwcmh2YXNRZnBKc1hvRHNG
+QQotPiBYMjU1MTkgT1VnMFY2MHhYaVBRV0hVYU1STW5ETTZaZU5zUHJhMFJ1alJj
-OXFLdG1XRQpuY3NwWUx1WE9SY2h0RDk4WG5Ba01oWXpuQ3BuNGdVeC9uanhjWEF5
+emVuQWozWQpHR1NQeDgzZDdGRVBGaEZ1bGl1bnBnZnFyM0NEL2E1eWx4cm1NbEsz
-YUlRCi0+IE1LZHotZ3JlYXNlICZAJmhqKGoKCi0tLSBCMktCWkY5N3lGTG9BQ0tK
+bnFNCi0+ICstZ3JlYXNlIEsofSRTLz8KQzZuTW5taUNCaWs2NHNFNHBoYkxhKzI3
-TFhlbUZhUHJBOEZ2ZG84YXlITWtMdHNVSEJBChdTeXiW23QUC7Am0fsto/YKrU95
+ZWJGUWdmWExMbUtnalhHWWEyUjBTNzlhVFd0aUo4cU5xc2ZoeDVWTQoKLS0tIFJn
-GPix08xVSBgsguBWE9N0BUAqzhXSW6etfHloXx7UsIgjCKCOb5WV5G82WGFVB7oL
+SjJleTVGU1o3YXhQZ1dWZHFIVm9FSE80VWdyZTg5dmhLWlhINmVWTUEKD84LkcH4
-Peie/FJEaA==
+FE9srKKG3yPpq//XXR+dsm3bIUd5rYZazszxqV8XyNqKHD44azPYTqyXwfBWeEoV
+2vn/iMIpyCCMlSUDzDsyNvrFX48s
 -----END AGE ENCRYPTED FILE-----

secrets/home/pdns/recursor.conf.age

@@ -1,15 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBCb2cz
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBlODZr
-VXdzRUNLVDRZT0VqbjQ3VlllWk5ZYWtxY2RENXpDT0NhMDU4elFRCjhrVzQ0Y0Z0
+RHpJcFdFaVNYM0x1d3QxVmhKTFBkMndrakFYS3FxWk00YWxXejNzCkFqWFlCWUt2
-OEFuOHM4OEo3K3pvWjVxanZDR08wTDJieVNEeXFNQm9Lc0UKLT4gc3NoLWVkMjU1
+cGluRGtxODQzbElhRWt1TGFVeTE1UU5SSkdZejJzNVdhZ3cKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIEw3K01RS2t6NDk1Q2w4UTN3cE9qdkdZLzEwUUVOcGtBdVZ5YWRu
+MTkgcytxUmZnIFRpeVNsT2Jqc2I4dzB3cEFWK2ZEZlpJQklWSnhJM3o0Ukhsc1lz
-clEwZ28KTHZWQjhMa0t4dkMvVzlFcW0zWXl4UVpibjFFc21LeHlnTXU1MjQrcXhj
+REZ0VFkKWWJPckVSNlZHREJIVVgwNVNBSkpSbHRPcUxIWVo4ZTlyVkovTGRpZThL
-RQotPiBYMjU1MTkgVzZUcW5tOGdqZlJiWDN0WjNqMFJGVnl4SUVNZC8rRG5kTVJn
+MAotPiBYMjU1MTkgUGxhR2d3TVh1dnJwQjNoY0pjV09halZKZFhybVk3Vjk3Tmwr
-dVA0QUhHRQp6UkRaWVowNWFwQ3J6UTlJTlFVTk92ZERVN3ZkRnRUR3d0ck1HWlIw
+bDd5ckp6MApBcW8zbUl1SnhmOXZwOFRNUG1EZUNacDlXdXJSbWFUeG5GNjM3eXJo
-VlhNCi0+IFhyMVgidTwtZ3JlYXNlIEN+N1IgbApxS2tENktCWFRGdVdYRC9VSU8v
+RmR3Ci0+IDstZ3JlYXNlICRoICVbfmU2fQpFYzNyZXBxVU5jT3JSY1NFMGEzUnVF
-anNFMlJFQVAvbzlrcktkVnJ4WFVxb0VWaHI2a1l3dmFMcmNDVUh5L1U4SEZJCjdx
+WFQ2MmR2SGQ0Vnd6V0VxQlp5bE5LZ2NML2hyd09LOEVPL2lGREdLR3FMCmVGN09J
-bys2dWk2aFdUQnBxcUlwS2FxYUxqZmVJTDAvZW4wVlU2T0lJYnR6YjVkVWw1bzdC
+OUNscVh1d0VSdwotLS0gbTB1NnZ4Q3B6WE1KVzJjbmVwL2dEVjc4WnRXZTlYbFBG
-Z0kvSXFhWUJ3UEdqaWEKVis4Ci0tLSBxZFhjSEUvbTc5dTNycFluUDN1SjhkRis2
+T3htUHBWang2awr0OgkUO6XPZji5ZBNpqGwOlwpa605t38QCmFSXvPQhvT4Gj/0+
-YkZnWlVBWWRrUmh6T1Q4RU1vCvVxHQ/uIqakQa8Mn9Eq7WfdXzApmNAcnGIHN92c
+rUvg7zWf5Yb4c86EDD05CsqGEUQTOKEz08z0lewN5kuFfZmrYQY=
-O+LKqQ4Mfv5QTzYtzvUJN2jz/SDmeZczTCO9e7iOqQ1i7TrAe26SjzzjVqq1RQ==
 -----END AGE ENCRYPTED FILE-----

secrets/jackflix/airvpn-privkey.age

@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBYTVly
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyByTFRp
-aGgyRHlKdEpVTXRRR1Y4QU1yN1BnbnJPVm16Q2Z3MlBwM3VycFhVCklGTHFtcHIz
+NHZMQ3BJMmt6cUhYRFMxVWNaNDc5SytSelBLMnZJZmJzLzhpSXdFCkkycmZqUzMz
-Qnd4RUMrRGl5RDd3Rk8vaEI0Z1lIQVF2bmY2WldCdEpTR2MKLT4gWDI1NTE5IFhz
+VXFGM2QvenFUQWtrQUdCc2lmbFVyZEQxNHFWeDVpR1E3WGsKLT4gWDI1NTE5IDdV
-b1AzTzZmcXhrdUkyS0E5L0doZ09ld1JZVzVCcjhNQzMyakFjS2plUkEKU0tEQnl5
+Zis5U3F4MjlsOHI3WHlSczNKbHkrbzJ4bzByL0ZoMC80dkV2MXpUd2cKblI0VjNE
-eDZZajV5RloxYWs0NThwOXZHVjBtampQLzRNUlhzQUVUWFNKcwotPiBjLWdyZWFz
+bktDV1VXa1d4SGQ3Z1ZPaXo3a3hLNHFZeXMxVHIxWFluTXlPMAotPiBvQXpvLWdy
-ZQpwaVNVcXI4eUErZm5STkxRVVh0MFFPOFY1bWhPOFVHcVo1QmRwUVRWNUhjYmJ2
+ZWFzZSBuIFF7SnwKaHhzbXNZNXpHcXJhSytHSGdJQnNwNUkyOFEKLS0tIFZxWEFp
-RXFMV2xsQ2dFCi0tLSBSS0xlK0R4OGN4Mm1CYUJ5TmNJQzBVSFFyL3ZZKy8vQXZy
+RUZBbi9XRXRBdjZsbGFneXI2cnZzM3hNZDJhSDZHbWRGbG9ScFUKB2WtnELEus7i
-N01OMHFjalR3CqeMysLSZi1iWQ5U86rNMUC2BR8Y17cBq/ZjMBs+6laXxjYrLcQh
+27VmQAnoUhEGgVjC8tDqeDMljeXNeAU1UiZ5DcehmR4Gm2hdLoZenqWT9z/D8WcY
-+M6PEjYQuYE1WM3l9Wq9OJDxBKbCE4i7uI27C/XlhCkwpGjTCdvQ
+eQwvOK6QDikhccYA41KQ5MH0iuk=
 -----END AGE ENCRYPTED FILE-----

secrets/jackflix/airvpn-psk.age

@@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB5a1VF
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB5QkR2
-WC83NDBzTVdVWGVpdy9oS3dVWnZYMENIMU1BNjJrWWtEU1UzNGw4CjF3WEVDZEs3
+d0dCdmd5ZUhXYWNRemRyYkJVUzA1eDE3Y1c5NFR6MzhMUzJDN1g4Clk5cjhXaGxE
-Ulg2ZDFrTjVXRmI1VU5oRlptQWIvU0R2ZzF0VldMeDNySVUKLT4gWDI1NTE5IFVU
+SHFzeUt3TUlCMFBBamQ4MTRxYVlHK2NNS2ZEa1M1U3dkNGcKLT4gWDI1NTE5IEhL
-dkVKdHBjbVJaVTZWZjcrUk5aajVyS1dEM0YwVHBLZU4yZ3laQm8yVlEKNlI3WVNX
+dG9vdW1VKzlteHVuQU9sdGlvV3c4OWxiK1RpVXNZUVpnU2RjSmlmQ00KRFh2ZURH
-N200Rld3bkZNYStUQVFWZi9ybDk0L1B1cXY5NUhyMUNCRzBrcwotPiBKMEw4LWdy
+NE9UbnViWXFISlUrMjdsZVNjV1pCU09vSlVndHFyaWw3cnFTZwotPiB+LG83XWM9
-ZWFzZQpiNWxxQk95Qnp4T0dsakpzWGdLajhESCtTbUFrMGJzRG40WGZoYzNNME9v
+MC1ncmVhc2UgJFcgdXIxSSBPClIxQlY0MUpMQjhHb3V5TzJ3NTBlbE1GWjNKbGhS
-VlVRNjhlWlEyM0tSa1RLSEZycUNNCjVGZWdCZlh6QnlpVjJjY2NSY0ZFaXBpS1FH
+YnhuNlRtVFpFTVFuQ1dXTG4vV0crRmV5WWxsOWRicEh4UHoKUjRqVGduQ1NHRE14
-QzVxR05xbFpENFBlc1UxR0lWWHZ1OVU1YU9US1pwVVE5MHJIZC8KCi0tLSB0dnha
+OUl5clVtdFlVVnlobGtrMUx3Ci0tLSBzcnVhRGlzaVJ3anNBTTR6NVNQd2ZOZUlL
-ZlhkZUY0ckwwN0dpQUJxbVg3dzNYTkFPQmR1MzR3VS9vS2dmNU5BCpfV2N/8Bkci
+TzgzSDZxaDZRRVFHRFFVZExvChMoRTQYrv8kdYqs3Ko7LzBRt17H5ljK0GIAMYNx
-HDA0vQv0/AZnglUxqXKnQXN3+Ipf1mBIYKlA5ZZdFGChh6Ro+LcI+b1BJdRcEgIi
+Gvrdv6HgzLq8gG6J4Rm/du8oyTKRjsHDS0yFuqKdbUjmckTcZurzW/qU57dNepnH
-gM1CN7Yph1Aj7b1lcadD8t0u4WCO
 -----END AGE ENCRYPTED FILE-----

secrets/jackflix/photoprism-pass.txt.age

@@ -1,11 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBoWmM0
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyBRTmVW
-NktTeDViMGZETVdwRFdCY1hmZWg0cy84WGVzdWxuQkI3NkpFL0cwClF0cHF3RFNt
+eWQrZkVhWktxeVE2aEhqb1pKWm44QWNubXQzb1FOTG9tbFRTYmtJCk5rSWtQZWJZ
-OHZORjVrOFVXdllMdGR6UWtpTDN4Uml3ZEhxSFZzb0xKNUkKLT4gWDI1NTE5IDE2
+MjhJWk4za0IwVXQra2RFZlJaQ3R1R3lRcU1GVU9PdlZ5a2sKLT4gWDI1NTE5IDVo
-R08za1huaWZSTGtzYkR6cVNLbEtJQVhkcDJEemRMbTdkS3JzbVZaekEKdFprd0h5
+YmR6dytYUms1Q09nVXJTcjUrYkVSbmhXaWo1cE12SDAvYkV0eUVPVHMKU1ZhZTQ1
-eVo3WkJlb3Uza3JzMmNmZ01qWUtIaXpOcVQ1Y2w0MEZxandBbwotPiBNLWdyZWFz
+VE1JYlpjeEU5eWFUQ3hNSDhmNVhmWUIrK0JqSFdRVWlYcm1abwotPiA6JC1ncmVh
-ZSAtYDU/NXUtIE4vaTlBJTwwIF1fUD8gcU41ClUzQ09ITjR2K1dTOTNUNVczblBm
+c2UKCi0tLSBmSkl6TEtFd1JsMmdNRXJocVIxMFR3MjBlTmxPczRDVzhJZDRPZ0NM
-Q29zL1NUSkU5b1RmQ1EKLS0tIGI4UFlxakRta2drNmYxK1BCOUFzZmdGMlNKTFdh
+Mm1nCs9UuAmgl0vlE2nUz4ZN3yFbeMkyQ/3S7Gs0pKUAj1zc2cGLbuOKdfs3KukY
-Nk80cXA5NU85NWhrMUEKnWC+dGL2xPeu7dzg5xKdOoEC2Se8uSOZnvP7ioF5QKRK
+/1GrlBws24k=
-RLeI9lmOOt4zUR6mYWCCPQNIAg==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/acquisition/airvpn-privkey.age

@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBMZm8x
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBPd1NG
-RzAzWXRlQytFSUxRRTk0OEtVOVlnK2ZaU3Y4TER3TmtYcDdCcDBZCm9wbXRlaDZx
+R0VuSUtyaWRrSm9QZ2dwOC9qM0RnZDRyUG1BaDZOdFFpY3p4RUZnClpWOXNTbmhq
-UlVkRzcvVW5EQUFsMVdYamY2aHU5SUN3T0tQOXU1Q2grQjgKLT4gWDI1NTE5IFNW
+dXpjQ0RKa0xmMG9Pc1ZQbkt0Qzl6Tm5IZGFtRzZQNFdRZVUKLT4gWDI1NTE5IE8z
-UUlmdFNBMTJWcllXS1lUWlZJZ2k4UE15V2NXeEtjaGlocjZPOXJheGcKbERWck1a
+L0NBenRCZ2swY3NnSU1TN3BFaG5ZWWc4K0hqQytsUnQ0RVk0QlhMd3cKNGZ2Wk1I
-L21ISnlCeU43YjdSSWp2ZEFyMGxBUnVjU1RSbzFPN21rQmpJZwotPiBrUT84LWdy
+aEFkQUpIY0U3Y3hPcW9jZVJVMDFxTFF1YTRzZWwvbzlzY08xWQotPiBcOyInfkAt
-ZWFzZSBTOCB0bU4/OApLNFRZVTVHTFdSMEYvNlIxMnhXLzJXZkF2V2pVS3ZLRGRM
+Z3JlYXNlIG5SL2IgdiF2OFwgRzR0T3RZQApxWGRURnZCc3RBODBhYVVPcUdYZzNY
-SHJUekJRakRtZUZTdndwazV3ZEw5TkdWVGc5Q0N6CjUxdnpmY1JTCi0tLSBPNklL
+OUExMkVFQ0I3SXcrWk1MUVpRVjBWKzV1Rm9rL3EwY0o2SlZoQlI5U3g1ClU4ZjVm
-WDE1cmR0ejZZTG9FUlUzWG4zS0V0ZlNTdU1QU2xHdFpNVHFlS3FNCs1z1hVkviH+
+UEVYMEtPZVpmSG05VzFvZHZkVURkRGFZUGNiR2NGQWNUSFBWZDZDL092K1Q2UVpI
-1d1Wqu0s0Lt0xEWX2xk+xpJ4QAP9E8P6GdoMBT+bzGxfakRuwDWUtng6dd6SK41A
+UDlmCi0tLSA2TTQ4U0hEOEZMc1NlSGlpM1J2TllwNjNMOVd1ejN0QUVjcURoQkk4
-aIIAjWxFfdgh4XcVuZ0vpGls/Hmf
+WFhFCqernu9Mh9m1dk1JYsaXxOywwZHsjQsg0+hew0FiYAEjIVUu0PAgjSVt+7nd
+r6LD77ziFOGn1cgu02Lkbiu9QgWwrD5422TNNM2Yr4hf
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/acquisition/airvpn-psk.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSBnVWow
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSAxbThh
-SHJzNi83TGFQMDhqMnpBd0RrVldSSzZjMWh6VG01ajgyOWJzNTNJCmFTR3pUeWxH
+M3VNWndYRFZha1BNSDZxWlFzMFpFazNjbHQ3ZWlBcTkzMW1rV2hJCnRHeDc0VHIz
-dHpWYzlqZENheFFHay91OTJVYWR5clRKU3ZiNm4ycXdwZW8KLT4gWDI1NTE5IGJx
+TEZrUmtUU0YwRmRKanI0elpjVVF1NGdOMzdmMS9NWnhVYnMKLT4gWDI1NTE5IEhB
-amx4c0tVQlcvdVJneU9hazQrZXFjbmt5T1d0US9jMzAzUkR5VlJEQ1EKR2UvRTBQ
+RG1KNHRLOUUwUU05U1picENzWUFLSUpLZGRnMHhVQ2VQTlMwa0NHMkkKOStlYjgw
-dlBqcldaVk05dmNhK3AwRk1iM1l3TnEwNVA2emtDVStibFBHZwotPiB5Xi1ncmVh
+OWNpY3hmTGJZeDNNZ0dvY2RHWS8vakZkR0tkSUNFRlZON2txSQotPiBnWU9yLWdy
-c2UgRE4gMXstKDpnZH0gVSlMbSJcOkogUgpaZXcwdHdxVEpXSTgwZ2oxd0NaczNY
+ZWFzZSBYb0ggRmI9TDBrKiBUKiY3bSBjdgp4M1pCM0txRWx4N1RLU2ZuTkt5R0lr
-eXlPOWxpNGxHMEdJclJnNGd0dWlwa29Bdk0rZG83OWxyRytlSGRGOXF2CmVLUWs2
+RDlYdXVkVzFqUzVYRkRsR1hWTlZsSHk2WmFHYjNrQ1M3eFB2YldRa3owCmZvNFVk
-WFV6TVRaLzNGZGsvY3pJcmlqTm1vVUNwMEJVVExVNnNLWTV4K0RweC9rZi9HVUI0
+WnBZdzhKWGdITzVZbEFJcFQ0TkF2R3hZUFQ5YXZZSHhWVWJacS9uRDBJZWRvcXZ5
-Rnl0NEx2N0htazkKb2cKLS0tIGtZbFdSTTRia1RjWm9pM3RGekRhWTJXVGpmWk9H
+UQotLS0gWE5yV0VJNks2S09MQUNFSFB3ZGlBTkNQK0xFT3hOcWdkTWdNclZ1UXhN
-azZ4UUhjbjZEZm5XVXcKiJfvO6GgQkA+EOJGrZtidms+p4plupP9w7P/Ukgh3Dl+
+cwrslsRNWoX4sPRrT+iiGhWQ5pV/9bqk2j6a4OPunrFGDWkXxfbv99hsLSn/tQtF
-y60gpsB3Ibpm0JlKSan2TO97g2VvmBZmP8o7NBHSM7w9SsU5E5igeKjJdLU=
+dXLcGTCWDbFrwCItDnta4rN6dGWMOPoBmRME+2L+0g==
 -----END AGE ENCRYPTED FILE-----

secrets/kelder/cloudflare-credentials.conf.age

@@ -1,16 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBMOFFx
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGdTeFAwUSBSUGFp
-WXlGdk1vVSt5TmpKakNjM2lsOWpwem1BcVNFdTFIYnBobDNxV1gwCjBWZ3J1ODhp
+ZnpLNmdIekk4TytEQWU3NGU1aUV2M0Z2enp2bXIvM0d5NWVQY1dBCk9XVG5IcmFr
-NEZucWppYWw5TmRXREtVU0krQ2FGdmZadVNxZE5lNTV3MTAKLT4gWDI1NTE5IGRi
+VGM5NlVQVXdMZ0ZmUDBqTUVSQWgwUzZtQ2llNkhOUDN3TWMKLT4gWDI1NTE5IE0x
-bXhPNjlOZ0lVK09UR1VmUlIvaWxiVnlJMGVhU0c1YnRGNFdQNnA0a3MKQ3Zra2sv
+V2RNSHFiRTVoSnNwa2xaaG9DVHc3MHVlWU9HeEkzYk8rRFVsa2FCZ0EKUmJaZEZK
-dGpMSFZDNWk5aGc3YWVNei9XV2tnMk1zTnhZdnd0UmRQSFpVawotPiBOayUtZ3Jl
+SGZneDZpL1YvZ0dTdm5wemMxNzl0azhPbHJNYW1tYUVITmk3RQotPiB0Zjg3LF4t
-YXNlCnJLSmQ4dE9SakhJcUhGbys4UlBTdFJSNkkyVmdKZmJpbnRjdTduemFmVlV2
+Z3JlYXNlCnBGdWYxREtsTGhLWm5iV24ybHQrTnJSMTNEdwotLS0gRmdYV3FCcGFE
-UHh6c0poMUNSTGphRW1xZWpHbGYKRENFRDdUYUFFSnByQXhhc1I1Qy9VRzJVdzZK
+MHFxSFBETEhBd1dEcHhLc28wdVc5K3N2MThqeUNoVk9RMArSeIqcmZ5LP3AIXcTV
-akRZOEFpUlB5VEhZVjVzYjJXekZNaGJiSmZCNThld3NBQVEKLS0tICt2RkJkaGQ4
+wbqhAW7IFOTHFAuU7skQCA1vvIyRTLrOWiLGk3uJM/yDcYqfx5y58vtFwt1uKaYe
-TXJ3N3oram5HQVZNSStGelowSTJHb2FrK2FMTW4wQWtPT2cKIMU6vOUPEWb94/pv
+B6pTW502JsHwtDbZVNKT+J0kIamD36ZtxfQuh+IjeaHAnuiqf5Kb1QXxii1ezOG9
-lmGsbgnc12mgeygKea54H5u0vdOanxEAzd6OpKhlfhZCMjYYPcQAn8q4PJtsyX9Z
+oSxc72Rdo6O2vyV680bREUVBPR+E9n3GACExhK3ZNrN+SSZjFMNyxHXS0zJwuy2J
-3sO0lHC3FlmIs5LKsruNK7J8FoCh/cfsc3CbmHghogRDQ+Or3H7fLz0v1eJiOQJF
+f/nZxWFM7t0QNgFUAIbOROtKttqpF4EZ9xPFkh0XZhi5TJGR6FDTcWT81EBmEvpW
-DGL9Lv3+t51JmZZf46AaLIJLE5YBRy1wYmo+YIIcPJsxJTly5r7lSLvGrOHQDFfq
+WbI2X1sfQiBBNOXmVCIRyBi5Bf15uwEwewpkMlU=
-IAAqSFzROE02zKWeAOhC1rtpa+tGhsS2l+nldWIO3lTOH1yjzWKXqwPjyDgtWEaJ
-mp86FQbuyiNdYMx1dhh82yfP8sLsFcz/r8WskxAl
 -----END AGE ENCRYPTED FILE-----