nixos: Initial netbooting installer

2024-06-24 00:08:55 +01:00
137 changed files with 1753 additions and 2839 deletions
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -6,11 +6,11 @@ on:

 jobs:
  check:
-    name: Check, build and cache nixfiles
+    name: Check, build and cache Nix flake
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v27
+      - uses: cachix/install-nix-action@v23
        with:
          # Gitea will supply a token in GITHUB_TOKEN, which this action will
          # try to pass to Nix when downloading from GitHub
@@ -18,30 +18,22 @@ jobs:
          extra_nix_config: |
            # Make sure we're using sandbox
            sandbox-fallback = false
-            # Big C++ projects fill up memory...
-            cores = 6

-            extra-substituters = https://nix-cache.nul.ie
-            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
+            extra-substituters = https://nix-cache.nul.ie/main
+            extra-trusted-public-keys = main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8=
+      - name: Set up attic
+        run: |
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+            login --set-default colony https://nix-cache.nul.ie "${{ secrets.NIX_CACHE_TOKEN }}"

      - name: Check flake
-        run: nix flake check --no-build
-
-      - name: Build (and cache) the world
+        run: nix flake check
+      - name: Build the world
        id: build
-        env:
-          HARMONIA_SSH_KEY: ${{ secrets.HARMONIA_SSH_KEY }}
        run: |
-          nix eval --json --apply "builtins.attrNames" .#ci.x86_64-linux | jq -cr '.[]' | while read job; do
-            echo "::group::Build $job"
-            nix build --no-link .#ci.x86_64-linux."$job"
-            echo "::endgroup::"
-
-            echo "::group::Cache $job"
-            ci/push-to-cache.sh "$(nix eval --raw .#ci.x86_64-linux."$job")"
-            echo "::endgroup::"
-          done
-
-          echo "Building and caching CI derivation"
-          nix build --no-link .#ciDrv.x86_64-linux
-          UPDATE_PROFILE=1 ci/push-to-cache.sh "$(nix eval --raw .#ciDrv.x86_64-linux)"
+          path=$(nix build --no-link .#ci.x86_64-linux --json | jq -r .[0].outputs.out)
+          echo "path=$path" >> "$GITHUB_OUTPUT"
+      - name: Push to cache
+        run: |
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+            push main ${{ steps.build.outputs.path }}
--- a/.gitea/workflows/installer.yaml
+++ b/.gitea/workflows/installer.yaml
@@ -14,20 +14,22 @@ jobs:
        uses: https://github.com/actions/setup-go@v4
        with:
          go-version: '>=1.20.1'
-      - uses: cachix/install-nix-action@v27
+      - uses: cachix/install-nix-action@v23
        with:
          github_access_token: ${{ secrets.GH_PULL_TOKEN }}
          extra_nix_config: |
            # Make sure we're using sandbox
            sandbox-fallback = false

-            extra-substituters = https://nix-cache.nul.ie
-            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
-
-      - name: Set up vars
+            extra-substituters = https://nix-cache.nul.ie/main
+            extra-trusted-public-keys = main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8=
+      - name: Set up attic
        id: setup
        run: |
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+            login --set-default colony https://nix-cache.nul.ie "${{ secrets.NIX_CACHE_TOKEN }}"
          echo "short_rev=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+
      - name: Build installer ISO
        run: |
          nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.iso
@@ -37,7 +39,7 @@ jobs:
        run: |
          nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.netbootArchive
          ln -s "$(readlink result)" \
-            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar.zst
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar

      - name: Create release
        uses: https://gitea.com/actions/release-action@main
@@ -46,4 +48,4 @@ jobs:
          api_key: '${{ secrets.RELEASE_TOKEN }}'
          files: |
            jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
-            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar.zst
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar
--- a/.keys/harmonia.pub
+++ b/.keys/harmonia.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXRXkYnBf2opIjN+bXE7HmhUpa4hyXJUGmBT+MRccT4 harmonia
--- a/ci/known_hosts
+++ b/ci/known_hosts
@@ -1 +0,0 @@
-object-ctr.ams1.int.nul.ie ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8
--- a/ci/push-to-cache.sh
+++ b/ci/push-to-cache.sh
@@ -1,31 +0,0 @@
-#!/bin/sh
-set -e
-
-REMOTE_STORE=/var/lib/harmonia
-SSH_HOST="harmonia@object-ctr.ams1.int.nul.ie"
-SSH_KEY=/tmp/harmonia.key
-STORE_URI="ssh-ng://$SSH_HOST?ssh-key=$SSH_KEY&remote-store=$REMOTE_STORE"
-
-remote_cmd() {
-  ssh -i "$SSH_KEY" "$SSH_HOST" env HOME=/run/harmonia NIX_REMOTE="$REMOTE_STORE" "$@"
-}
-
-umask_old=$(umask)
-umask 0066
-echo "$HARMONIA_SSH_KEY" | base64 -d > "$SSH_KEY"
-umask $umask_old
-
-mkdir -p ~/.ssh
-cp ci/known_hosts ~/.ssh/
-path="$1"
-
-echo "Pushing $path to cache..."
-nix copy --no-check-sigs --to "$STORE_URI" "$path"
-
-if [ -n "$UPDATE_PROFILE" ]; then
-  echo "Updating profile..."
-  remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
-
-  echo "Collecting garbage..."
-  remote_cmd nix-collect-garbage --delete-older-than 60d
-fi
--- a/devshell/commands.nix
+++ b/devshell/commands.nix
@@ -77,12 +77,7 @@ in
      name = "build-n-switch";
      category = "tasks";
      help = "Shortcut to nixos-rebuild for this flake";
-      command = ''
-        # HACK: Upstream changes in Git + Nix makes this necessary
-        # https://github.com/NixOS/nix/issues/10202
-        doas git config --global --add safe.directory "$PWD"
-        doas nixos-rebuild --flake . "$@"
-      '';
+      command = ''doas nixos-rebuild --flake . "$@"'';
    }
    {
      name = "run-vm";
@@ -120,17 +115,29 @@ in
      help = "Build home-manager configuration";
      command = ''nix build "''${@:2}" ".#homeConfigurations.\"$1\".activationPackage"'';
    }
+    {
+      name = "update-inputs";
+      category = "tasks";
+      help = "Update flake inputs";
+      command = ''
+        args=()
+        for f in "$@"; do
+          args+=(--update-input "$f")
+        done
+        nix flake lock "''${args[@]}"
+      '';
+    }
    {
      name = "update-nixpkgs";
      category = "tasks";
      help = "Update nixpkgs flake inputs";
-      command = ''nix flake update nixpkgs-{unstable,stable,mine,mine-stable}'';
+      command = ''update-inputs nixpkgs-{unstable,stable,mine,mine-stable}'';
    }
    {
      name = "update-home-manager";
      category = "tasks";
      help = "Update home-manager flake inputs";
-      command = ''nix flake update home-manager-{unstable,stable}'';
+      command = ''update-inputs home-manager-{unstable,stable}'';
    }
    {
      name = "update-installer";
@@ -138,15 +145,5 @@ in
      help = "Update installer tag (to trigger new release)";
      command = ''git tag -f installer && git push -f origin installer'';
    }
-    {
-      name = "deploy-multi";
-      category = "tasks";
-      help = "Deploy multiple flakes at once";
-      command = ''
-        for f in $@; do
-          deploy "$O" $f
-        done
-      '';
-    }
  ];
 }
--- a/devshell/default.nix
+++ b/devshell/default.nix
@@ -11,7 +11,7 @@ in

    NIX_USER_CONF_FILES = toString (pkgs.writeText "nix.conf"
      ''
-        experimental-features = nix-command flakes ca-derivations
+        experimental-features = nix-command flakes ca-derivations repl-flake
        connect-timeout = 5
        fallback = true
        ${lib.my.c.nix.cache.conf}
@@ -24,10 +24,10 @@ in
    coreutils
    nixVersions.stable
    rage
-    wireguard-tools
    (pkgs.writeShellScriptBin "deploy" ''
      exec ${deploy-rs.deploy-rs}/bin/deploy --skip-checks "$@"
    '')
    home-manager
+    attic-client
  ];
 }
--- a/flake.lock
+++ b/flake.lock
@@ -8,14 +8,14 @@
          "ragenix",
          "nixpkgs"
        ],
-        "systems": "systems_7"
+        "systems": "systems_8"
      },
      "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1707830867,
+        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
        "type": "github"
      },
      "original": {
@@ -24,10 +24,36 @@
        "type": "github"
      }
    },
+    "attic": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "nixpkgs-stable": [
+          "nixpkgs-stable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1711742460,
+        "narHash": "sha256-0O4v6e4a1toxXZ2gf5INhg4WPE5C5T+SVvsBt+45Mcc=",
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "rev": "4dbdbee45728d8ce5788db6461aaaa89d98081f0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "type": "github"
+      }
+    },
    "boardie": {
      "inputs": {
        "devshell": "devshell",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
@@ -50,17 +76,17 @@
    "borgthin": {
      "inputs": {
        "devshell": "devshell_2",
-        "flake-utils": "flake-utils_5",
+        "flake-utils": "flake-utils_6",
        "nixpkgs": [
          "nixpkgs-mine"
        ]
      },
      "locked": {
-        "lastModified": 1732994213,
-        "narHash": "sha256-3v8cTsPB+TIdWmc1gmRNd0Mi0elpfi39CXRsA/2x/Oo=",
+        "lastModified": 1692446555,
+        "narHash": "sha256-Uzl8TiGKVBCjwYhkprSwbcu8xlcQwnDNIqsk9rM+P9w=",
        "owner": "devplayer0",
        "repo": "borg",
-        "rev": "795f5009445987d42f32de1b49fdeb2d88326a64",
+        "rev": "44a3dc19b014ebc8d33db0b3e145ed7bfc9a0cb7",
        "type": "github"
      },
      "original": {
@@ -70,12 +96,39 @@
      }
    },
    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "attic",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1725409566,
-        "narHash": "sha256-PrtLmqhM6UtJP7v7IGyzjBFhbG4eOAHT6LPYOFmYfbk=",
+        "lastModified": 1702918879,
+        "narHash": "sha256-tWJqzajIvYcaRWxn+cLUB9L9Pv4dQ3Bfit/YjU5ze3g=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "7e4586bad4e3f8f97a9271def747cf58c4b68f3c",
+        "rev": "7195c00c272fdd92fc74e7d5a0a2844b9fadb2fb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "crane_2": {
+      "inputs": {
+        "nixpkgs": [
+          "ragenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1708794349,
+        "narHash": "sha256-jX+B1VGHT0ruHHL5RwS8L21R6miBn4B6s9iVyUJsJJY=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "2c94ff9a6fbeb9f3ea0107f28688edbe9c81deaa",
        "type": "github"
      },
      "original": {
@@ -109,18 +162,18 @@
    },
    "deploy-rs": {
      "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1727447169,
-        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
+        "lastModified": 1715699772,
+        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
+        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
        "type": "github"
      },
      "original": {
@@ -131,7 +184,7 @@
    },
    "devshell": {
      "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
        "nixpkgs": "nixpkgs"
      },
      "locked": {
@@ -150,7 +203,7 @@
    },
    "devshell-tools": {
      "inputs": {
-        "flake-utils": "flake-utils_9",
+        "flake-utils": "flake-utils_11",
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
@@ -169,7 +222,7 @@
    },
    "devshell_2": {
      "inputs": {
-        "flake-utils": "flake-utils_4",
+        "flake-utils": "flake-utils_5",
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
@@ -188,16 +241,17 @@
    },
    "devshell_3": {
      "inputs": {
+        "flake-utils": "flake-utils_7",
        "nixpkgs": [
          "nixpkgs-unstable"
        ]
      },
      "locked": {
-        "lastModified": 1728330715,
-        "narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
+        "lastModified": 1713532798,
+        "narHash": "sha256-wtBhsdMJA3Wa32Wtm1eeo84GejtI43pMrFrmwLXrsEc=",
        "owner": "numtide",
        "repo": "devshell",
-        "rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
+        "rev": "12e914740a25ea1891ec619bb53cf5e6ca922e40",
        "type": "github"
      },
      "original": {
@@ -207,6 +261,22 @@
      }
    },
    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1673956053,
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
      "flake": false,
      "locked": {
        "lastModified": 1696426674,
@@ -223,6 +293,90 @@
      }
    },
    "flake-utils": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_10": {
+      "inputs": {
+        "systems": "systems_9"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_11": {
+      "inputs": {
+        "systems": "systems_10"
+      },
+      "locked": {
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_12": {
+      "inputs": {
+        "systems": "systems_11"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_13": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
      "inputs": {
        "systems": "systems"
      },
@@ -240,40 +394,7 @@
        "type": "github"
      }
    },
-    "flake-utils_10": {
-      "inputs": {
-        "systems": "systems_10"
-      },
-      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_11": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
+    "flake-utils_3": {
      "inputs": {
        "systems": "systems_2"
      },
@@ -291,7 +412,7 @@
        "type": "github"
      }
    },
-    "flake-utils_3": {
+    "flake-utils_4": {
      "inputs": {
        "systems": "systems_3"
      },
@@ -309,7 +430,7 @@
        "type": "github"
      }
    },
-    "flake-utils_4": {
+    "flake-utils_5": {
      "locked": {
        "lastModified": 1642700792,
        "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
@@ -324,7 +445,7 @@
        "type": "github"
      }
    },
-    "flake-utils_5": {
+    "flake-utils_6": {
      "locked": {
        "lastModified": 1667395993,
        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
@@ -339,31 +460,16 @@
        "type": "github"
      }
    },
-    "flake-utils_6": {
+    "flake-utils_7": {
      "inputs": {
        "systems": "systems_6"
      },
      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_7": {
-      "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
        "type": "github"
      },
      "original": {
@@ -374,7 +480,7 @@
    },
    "flake-utils_8": {
      "inputs": {
-        "systems": "systems_8"
+        "systems": "systems_7"
      },
      "locked": {
        "lastModified": 1710146030,
@@ -391,15 +497,12 @@
      }
    },
    "flake-utils_9": {
-      "inputs": {
-        "systems": "systems_9"
-      },
      "locked": {
-        "lastModified": 1709126324,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
        "type": "github"
      },
      "original": {
@@ -437,16 +540,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1732466619,
-        "narHash": "sha256-T1e5oceypZu3Q8vzICjv1X/sGs9XfJRMW5OuXHgpB3c=",
+        "lastModified": 1716729592,
+        "narHash": "sha256-Y3bOjoh2cFBqZN0Jw1zUdyr7tjygyxl2bD/QY73GZP0=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "f3111f62a23451114433888902a55cf0692b408d",
+        "rev": "2c78a57c544dd19b07442350727ced097e1aa6e6",
        "type": "github"
      },
      "original": {
        "id": "home-manager",
-        "ref": "release-24.11",
+        "ref": "release-23.11",
        "type": "indirect"
      }
    },
@@ -457,11 +560,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1732884235,
-        "narHash": "sha256-r8j6R3nrvwbT1aUp4EPQ1KC7gm0pu9VcV1aNaB+XG6Q=",
+        "lastModified": 1717097707,
+        "narHash": "sha256-HC5vJ3oYsjwsCaSbkIPv80e4ebJpNvFKQTBOGlHvjLs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "819f682269f4e002884702b87e445c82840c68f2",
+        "rev": "0eb314b4f0ba337e88123e0b1e57ef58346aafd9",
        "type": "github"
      },
      "original": {
@@ -471,11 +574,11 @@
    },
    "impermanence": {
      "locked": {
-        "lastModified": 1731242966,
-        "narHash": "sha256-B3C3JLbGw0FtLSWCjBxU961gLNv+BOOBC6WvstKLYMw=",
+        "lastModified": 1708968331,
+        "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=",
        "owner": "nix-community",
        "repo": "impermanence",
-        "rev": "3ed3f0eaae9fcc0a8331e77e9319c8a4abd8a71a",
+        "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30",
        "type": "github"
      },
      "original": {
@@ -508,7 +611,7 @@
    },
    "nixGL": {
      "inputs": {
-        "flake-utils": "flake-utils_7",
+        "flake-utils": "flake-utils_9",
        "nixpkgs": [
          "nixpkgs-unstable"
        ]
@@ -545,11 +648,11 @@
    },
    "nixpkgs-mine": {
      "locked": {
-        "lastModified": 1732985787,
-        "narHash": "sha256-6rSJ9L4QywpHLi/xvpOHdTuPm6/eOJcXxnYzDbP3U1k=",
+        "lastModified": 1717628902,
+        "narHash": "sha256-qMAW+oKis3F8jXTjX9Ng02/LzZd+7YOK05Qa33h9yqY=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "a28c46933ef5038fb7a2dd483b85152a539c7969",
+        "rev": "3e0ee08114e1563b1a0fd6a907563b5e86258fb4",
        "type": "github"
      },
      "original": {
@@ -561,11 +664,11 @@
    },
    "nixpkgs-mine-stable": {
      "locked": {
-        "lastModified": 1732985894,
-        "narHash": "sha256-YYuQQCcSF6KjgtAenZJiBmqt5jqP3UvYgC424VQ+22s=",
+        "lastModified": 1717245305,
+        "narHash": "sha256-LrIS3+Aa4F2VmuJPQOASRd3W+uToj878PoUKSLVw/vE=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "e0a3f4e2bbc5f7b681e344b389dcbab23f2e92a8",
+        "rev": "17a50249712512f600eced89bebcc3252b5f630f",
        "type": "github"
      },
      "original": {
@@ -577,26 +680,26 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1732824227,
-        "narHash": "sha256-fYNXgpu1AEeLyd3fQt4Ym0tcVP7cdJ8wRoqJ+CtTRyY=",
+        "lastModified": 1716991068,
+        "narHash": "sha256-Av0UWCCiIGJxsZ6TFc+OiKCJNqwoxMNVYDBChmhjNpo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "c71ad5c34d51dcbda4c15f44ea4e4aa6bb6ac1e9",
+        "rev": "25cf937a30bf0801447f6bf544fc7486c6309234",
        "type": "github"
      },
      "original": {
        "id": "nixpkgs",
-        "ref": "nixos-24.11",
+        "ref": "nixos-23.11",
        "type": "indirect"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1732758367,
-        "narHash": "sha256-RzaI1RO0UXqLjydtz3GAXSTzHkpb/lLD1JD8a0W4Wpo=",
+        "lastModified": 1716948383,
+        "narHash": "sha256-SzDKxseEcHR5KzPXLwsemyTR/kaM9whxeiJohbL04rs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "fa42b5a5f401aab8a32bd33c9a4de0738180dc59",
+        "rev": "ad57eef4ef0659193044870c731987a6df5cf56b",
        "type": "github"
      },
      "original": {
@@ -671,7 +774,7 @@
    },
    "poetry2nix": {
      "inputs": {
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_4",
        "nix-github-actions": "nix-github-actions",
        "nixpkgs": "nixpkgs_2",
        "systems": "systems_4",
@@ -694,35 +797,35 @@
    "ragenix": {
      "inputs": {
        "agenix": "agenix",
-        "crane": "crane",
-        "flake-utils": "flake-utils_8",
+        "crane": "crane_2",
+        "flake-utils": "flake-utils_10",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1731774781,
-        "narHash": "sha256-vwsUUYOIs8J6weeSK1n1mbZf8fgvygGUMsadx0JmG70=",
-        "owner": "devplayer0",
+        "lastModified": 1709831932,
+        "narHash": "sha256-WsP8rOFa/SqYNbVtYJ/l2mWWOgyDTJFbITMV8tv0biI=",
+        "owner": "yaxitech",
        "repo": "ragenix",
-        "rev": "ec4115da7b67c783b1091811e17dbcba50edd1c6",
+        "rev": "06de099ef02840ec463419f12de73729d458e1eb",
        "type": "github"
      },
      "original": {
-        "owner": "devplayer0",
-        "ref": "add-rekey-one-flag",
+        "owner": "yaxitech",
        "repo": "ragenix",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
+        "attic": "attic",
        "boardie": "boardie",
        "borgthin": "borgthin",
        "deploy-rs": "deploy-rs",
        "devshell": "devshell_3",
-        "flake-utils": "flake-utils_6",
+        "flake-utils": "flake-utils_8",
        "home-manager-stable": "home-manager-stable",
        "home-manager-unstable": "home-manager-unstable",
        "impermanence": "impermanence",
@@ -737,17 +840,21 @@
    },
    "rust-overlay": {
      "inputs": {
+        "flake-utils": [
+          "ragenix",
+          "flake-utils"
+        ],
        "nixpkgs": [
          "ragenix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1725675754,
-        "narHash": "sha256-hXW3csqePOcF2e/PYnpXj72KEYyNj2HzTrVNmS/F7Ug=",
+        "lastModified": 1708740535,
+        "narHash": "sha256-NCTw235XwSDbeTAtAwg/hOeNOgwYhVq7JjDdbkOgBeA=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "8cc45e678e914a16c8e224c3237fb07cf21e5e54",
+        "rev": "9b24383d77f598716fa0cbb8b48c97249f5ee1af",
        "type": "github"
      },
      "original": {
@@ -758,7 +865,7 @@
    },
    "sbt": {
      "inputs": {
-        "flake-utils": "flake-utils_11",
+        "flake-utils": "flake-utils_13",
        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
@@ -778,22 +885,22 @@
    "sharry": {
      "inputs": {
        "devshell-tools": "devshell-tools",
-        "flake-utils": "flake-utils_10",
+        "flake-utils": "flake-utils_12",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
        "sbt": "sbt"
      },
      "locked": {
-        "lastModified": 1720592125,
-        "narHash": "sha256-vR89LefkY8mBPWxDTQ8SNg6Z7/J6Yga80T4kSb6MNdk=",
-        "owner": "eikek",
+        "lastModified": 1710796573,
+        "narHash": "sha256-23fLZFNacZU/skc8i7JExHfD//Mpkslhga6f5ATTqBA=",
+        "owner": "devplayer0",
        "repo": "sharry",
-        "rev": "604b20517150599cb05dbe178cd35cd10659aa4c",
+        "rev": "4e7a87880ba0807afd5d21706ce383b8b8727990",
        "type": "github"
      },
      "original": {
-        "owner": "eikek",
+        "owner": "devplayer0",
        "repo": "sharry",
        "type": "github"
      }
@@ -828,6 +935,21 @@
        "type": "github"
      }
    },
+    "systems_11": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
--- a/flake.nix
+++ b/flake.nix
@@ -7,18 +7,17 @@
    devshell.inputs.nixpkgs.follows = "nixpkgs-unstable";

    nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "nixpkgs/nixos-24.11";
+    nixpkgs-stable.url = "nixpkgs/nixos-23.11";
    nixpkgs-mine.url = "github:devplayer0/nixpkgs/devplayer0";
    nixpkgs-mine-stable.url = "github:devplayer0/nixpkgs/devplayer0-stable";

    home-manager-unstable.url = "home-manager";
    home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    home-manager-stable.url = "home-manager/release-24.11";
+    home-manager-stable.url = "home-manager/release-23.11";
    home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";

    # Stuff used by the flake for build / deployment
-    # ragenix.url = "github:yaxitech/ragenix";
-    ragenix.url = "github:devplayer0/ragenix/add-rekey-one-flag";
+    ragenix.url = "github:yaxitech/ragenix";
    ragenix.inputs.nixpkgs.follows = "nixpkgs-unstable";
    deploy-rs.url = "github:serokell/deploy-rs";
    deploy-rs.inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -31,10 +30,14 @@
    nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";

    # Packages not in nixpkgs
-    sharry.url = "github:eikek/sharry";
+    # sharry.url = "github:eikek/sharry";
+    sharry.url = "github:devplayer0/sharry";
    sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
    borgthin.url = "github:devplayer0/borg";
    borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
+    attic.url = "github:zhaofengli/attic";
+    attic.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    attic.inputs.nixpkgs-stable.follows = "nixpkgs-stable";
  };

  outputs =
@@ -49,7 +52,7 @@
      ...
    }:
    let
-      inherit (builtins) mapAttrs replaceStrings elem;
+      inherit (builtins) mapAttrs replaceStrings;
      inherit (lib) mapAttrs' filterAttrs nameValuePair recurseIntoAttrs evalModules;
      inherit (lib.flake) flattenTree eachDefaultSystem;
      inherit (lib.my) mkDefaultSystemsPkgs flakePackageOverlay;
@@ -93,6 +96,7 @@
            inputs.ragenix.overlays.default
            inputs.deploy-rs.overlay
            (flakePackageOverlay inputs.home-manager-unstable system)
+            inputs.attic.overlays.default
          ];
        }))
        pkgsFlakes;
@@ -104,16 +108,6 @@
            pkgsLibOverlay
            myPkgsOverlay
          ];
-
-          config = {
-            # RMS forgive me...
-            # Normally this is set modularly, but sometimes we need to use other pkgs
-            allowUnfreePredicate = p: elem (lib.getName p) [
-              "widevine-cdm"
-              "chromium-unwrapped"
-              "chromium"
-            ];
-          };
        }))
        pkgsFlakes;

@@ -122,9 +116,9 @@
        nixos/installer.nix
        nixos/boxes/colony
        nixos/boxes/tower
+        nixos/boxes/castle
        nixos/boxes/home/stream.nix
        nixos/boxes/home/palace
-        nixos/boxes/home/castle
        nixos/boxes/britway
        nixos/boxes/kelder

@@ -204,9 +198,8 @@
        systems' = mapAttrs' (n: v: nameValuePair "system-${n}" v) systems;
        packages' = mapAttrs' (n: v: nameValuePair "package-${n}" v) packages;
      in
-        homes' // systems' // packages' // {
+        pkgs.linkFarm "ci" (homes' // systems' // packages' // {
          inherit shell;
-        };
-      ciDrv = pkgs.linkFarm "ci" ci;
+        });
    }));
 }
--- a/home-manager/modules/common.nix
+++ b/home-manager/modules/common.nix
@@ -199,20 +199,17 @@ in
          file
          tree
          pwgen
-
-          minicom
          iperf3
          mosh
          wget
+          hyx
          whois
          ldns
+          minicom
          mtr
-
-          hyx
          ncdu
          jq
          yq-go
-          nix-tree
        ];

        sessionVariables = {
--- a/home-manager/modules/gui/default.nix
+++ b/home-manager/modules/gui/default.nix
@@ -1,6 +1,6 @@
-{ lib, pkgs', pkgs, config, ... }:
+{ lib, pkgs, config, ... }:
 let
-  inherit (lib) genAttrs mkIf mkMerge mkForce mapAttrs mkOptionDefault;
+  inherit (lib) genAttrs mkIf mkMerge mkForce;
  inherit (lib.my) mkBoolOpt';

  cfg = config.my.gui;
@@ -39,11 +39,10 @@ in
      {
        home = {
          packages = with pkgs; [
-            xdg-utils
-
            font.package
-            nerd-fonts.sauce-code-pro
-            nerd-fonts.droid-sans-mono
+            (nerdfonts.override {
+              fonts = [ "DroidSansMono" "SourceCodePro" ];
+            })
            noto-fonts-emoji

            grim
@@ -63,8 +62,6 @@ in
            neofetch
            cmatrix
            doomsaver
-
-            xournalpp
          ];
        };

@@ -79,7 +76,7 @@ in
          alacritty = {
            enable = true;
            settings = {
-              general.import = [ ./alacritty-xterm.toml ];
+              import = [ ./alacritty-xterm.toml ];

              font = {
                size = font.size;
@@ -95,10 +92,9 @@ in
            enable = true;
            inherit font;
            settings = {
-              background_opacity = "0.65";
+              background_opacity = "0.8";
              tab_bar_edge = "top";
              shell_integration = "no-sudo";
-              font_features = "${font.name} -liga";
            };
          };

@@ -164,19 +160,6 @@ in
              };
              Install.RequiredBy = [ "sway-session.target" ];
            };
-
-            activate-linux = {
-              Unit = {
-                Description = "Linux activation watermark";
-                After = "graphical-session.target";
-                PartOf = "graphical-session.target";
-              };
-              Service = {
-                Type = "simple";
-                ExecStart = "${pkgs.activate-linux}/bin/activate-linux";
-              };
-              Install.RequiredBy = [ "graphical-session.target" ];
-            };
          };
        };

@@ -186,7 +169,6 @@ in
            wl-clipboard
            wev
            wdisplays
-            swaysome

            pavucontrol
            libsecret
@@ -196,11 +178,10 @@ in
          ];

          pointerCursor = {
-            package = pkgs.posy-cursors;
-            name = "Posy_Cursor";
-            size = 32;
+            package = pkgs.vanilla-dmz;
+            name = "Vanilla-DMZ";
+            size = 16;
            gtk.enable = true;
-            x11.enable = true;
          };
        };

@@ -209,36 +190,9 @@ in
        xsession.preferStatusNotifierItems = true;
        wayland = {
          windowManager = {
-            sway =
-            let
-              cfg = config.wayland.windowManager.sway.config;
-              mod = cfg.modifier;
-
-              renameWs = pkgs.writeShellScript "sway-rename-ws" ''
-                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
-                focused_num="$(jq -r ".num" <<< "$focused_ws")"
-                focused_name="$(jq -r ".name" <<< "$focused_ws")"
-                placeholder="$(sed -E 's/[0-9]+: //' <<< "$focused_name")"
-
-                name="$(rofi -dmenu -p "rename ws $focused_num" -theme+entry+placeholder "\"$placeholder\"")"
-                if [ -n "$name" ]; then
-                  swaymsg rename workspace "$focused_name" to "$focused_num: $name"
-                fi
-              '';
-              clearWsName = pkgs.writeShellScript "sway-clear-ws-name" ''
-                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
-                focused_num="$(jq -r ".num" <<< "$focused_ws")"
-                focused_name="$(jq -r ".name" <<< "$focused_ws")"
-
-                swaymsg rename workspace "$focused_name" to "$focused_num"
-              '';
-            in
-            {
+            sway = {
              enable = true;
              xwayland = true;
-              extraConfigEarly = ''
-                set $mod ${mod}
-              '';
              config = {
                input = {
                  "type:touchpad" = {
@@ -253,95 +207,31 @@ in

                modifier = "Mod4";
                terminal = "kitty";
-                keybindings = mapAttrs (k: mkOptionDefault) {
-                  "${mod}+Left" = "focus left";
-                  "${mod}+Down" = "focus down";
-                  "${mod}+Up" = "focus up";
-                  "${mod}+Right" = "focus right";
+                keybindings =
+                  let
+                    cfg = config.wayland.windowManager.sway.config;
+                    mod = cfg.modifier;
+                  in
+                  lib.mkOptionDefault {
+                    "${mod}+d" = null;
+                    "${mod}+l" = "exec ${doomsaver}/bin/doomsaver";
+                    "${mod}+x" = "exec ${cfg.menu}";
+                    "${mod}+Shift+x" = "exec rofi -show drun";
+                    "${mod}+q" = "kill";
+                    "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
+                    "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
+                    "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
+                    "${mod}+Shift+e" = "exec rofi -show emoji";
+                    # Config for this doesn't seem to work :/
+                    "${mod}+c" = ''exec rofi -show calc -calc-command "echo -n '{result}' | ${pkgs.wl-clipboard}/bin/wl-copy"'';

-                  "${mod}+Shift+Left" = "move left";
-                  "${mod}+Shift+Down" = "move down";
-                  "${mod}+Shift+Up" = "move up";
-                  "${mod}+Shift+Right" = "move right";
-
-                  "${mod}+b" = "splith";
-                  "${mod}+v" = "splitv";
-                  "${mod}+f" = "fullscreen toggle";
-                  "${mod}+a" = "focus parent";
-
-                  "${mod}+s" = "layout stacking";
-                  "${mod}+w" = "layout tabbed";
-                  "${mod}+e" = "layout toggle split";
-
-                  "${mod}+Shift+space" = "floating toggle";
-                  "${mod}+space" = "focus mode_toggle";
-
-                  "${mod}+1" = "workspace number 1";
-                  "${mod}+2" = "workspace number 2";
-                  "${mod}+3" = "workspace number 3";
-                  "${mod}+4" = "workspace number 4";
-                  "${mod}+5" = "workspace number 5";
-                  "${mod}+6" = "workspace number 6";
-                  "${mod}+7" = "workspace number 7";
-                  "${mod}+8" = "workspace number 8";
-                  "${mod}+9" = "workspace number 9";
-                  "${mod}+0" = "workspace number 10";
-
-                  "${mod}+Shift+1" =
-                    "move container to workspace number 1";
-                  "${mod}+Shift+2" =
-                    "move container to workspace number 2";
-                  "${mod}+Shift+3" =
-                    "move container to workspace number 3";
-                  "${mod}+Shift+4" =
-                    "move container to workspace number 4";
-                  "${mod}+Shift+5" =
-                    "move container to workspace number 5";
-                  "${mod}+Shift+6" =
-                    "move container to workspace number 6";
-                  "${mod}+Shift+7" =
-                    "move container to workspace number 7";
-                  "${mod}+Shift+8" =
-                    "move container to workspace number 8";
-                  "${mod}+Shift+9" =
-                    "move container to workspace number 9";
-                  "${mod}+Shift+0" =
-                    "move container to workspace number 10";
-
-                  "${mod}+Shift+minus" = "move scratchpad";
-                  "${mod}+minus" = "scratchpad show";
-
-                  "${mod}+Return" = "exec ${cfg.terminal}";
-                  "${mod}+r" = "mode resize";
-                  "${mod}+d" = null;
-                  "${mod}+l" = "exec ${doomsaver}/bin/doomsaver";
-                  "${mod}+q" = "kill";
-                  "${mod}+Shift+c" = "reload";
-                  "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
-
-                  # rofi
-                  "${mod}+x" = "exec ${cfg.menu}";
-                  "${mod}+Shift+x" = "exec rofi -show drun";
-                  "${mod}+Shift+e" = "exec rofi -show emoji";
-                  # Config for this doesn't seem to work :/
-                  "${mod}+c" = ''exec rofi -show calc -calc-command "echo -n '{result}' | ${pkgs.wl-clipboard}/bin/wl-copy"'';
-                  "${mod}+Shift+r" = "exec ${renameWs}";
-                  "${mod}+Shift+n" = "exec ${clearWsName}";
-
-                  # Screenshots
-                  "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
-                  "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
-
-                  "XF86MonBrightnessDown" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
-                  "XF86MonBrightnessUp" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set +5%";
-
-                  "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
-                  "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
-                  "XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play";
-                  "XF86AudioPause" = "exec ${pkgs.playerctl}/bin/playerctl pause";
-                  "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
-                  "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
-                };
+                    "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
+                    "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
+                    "XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play";
+                    "XF86AudioPause" = "exec ${pkgs.playerctl}/bin/playerctl pause";
+                    "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
+                    "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
+                  };
                keycodebindings = {
                  # keycode for XF86AudioPlayPause (no sym for some reason)
                  "172" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
@@ -350,9 +240,6 @@ in
                menu = "rofi -show run";
                bars = mkForce [ ];
              };
-              extraConfig = ''
-                include ${./swaysome.conf}
-              '';

              swaynag = {
                enable = true;
@@ -403,7 +290,6 @@ in
            diff-so-fancy.enable = true;
            userEmail = "jackos1998@gmail.com";
            userName = "Jack O'Sullivan";
-            lfs.enable = true;
            extraConfig = {
              pull.rebase = true;
            };
@@ -411,13 +297,11 @@ in

          waybar = import ./waybar.nix { inherit lib pkgs config font; };
          rofi = {
-            package = pkgs.rofi-wayland;
            enable = true;
            font = "${font.name} ${toString font.size}";
-            plugins = with pkgs; (map (p: p.override { rofi-unwrapped = rofi-wayland-unwrapped; }) [
+            plugins = with pkgs; [
              rofi-calc
-            ]) ++ [
-              rofi-emoji-wayland
+              rofi-emoji
            ];
            extraConfig = {
              modes = "window,run,ssh,filebrowser,calc,emoji";
@@ -432,7 +316,7 @@ in

          chromium = {
            enable = true;
-            package = (pkgs'.unstable.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
+            package = (pkgs.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
              buildCommand = ''
                ${old.buildCommand}

--- a/home-manager/modules/gui/stop-nixos.png
+++ b/home-manager/modules/gui/stop-nixos.png
--- a/home-manager/modules/gui/swaysome.conf
+++ b/home-manager/modules/gui/swaysome.conf
@@ -1,66 +0,0 @@
-# Use (un)bindcode or (un)bindsym, depending on what you used in your main sway config file.
-# The `--no-warn` setting is only added to shortcuts that exist in the default config. You may want to add or remove
-# that flag on some bindings depending on your config.
-
-
-# Change focus between workspaces
-bindsym $mod+Alt+1 exec "swaysome focus 1"
-bindsym $mod+Alt+2 exec "swaysome focus 2"
-bindsym $mod+Alt+3 exec "swaysome focus 3"
-bindsym $mod+Alt+4 exec "swaysome focus 4"
-bindsym $mod+Alt+5 exec "swaysome focus 5"
-bindsym $mod+Alt+6 exec "swaysome focus 6"
-bindsym $mod+Alt+7 exec "swaysome focus 7"
-bindsym $mod+Alt+8 exec "swaysome focus 8"
-bindsym $mod+Alt+9 exec "swaysome focus 9"
-bindsym $mod+Alt+0 exec "swaysome focus 0"
-
-# Focus workspace groups
-bindsym --no-warn $mod+1 exec "swaysome focus-group 1"
-bindsym --no-warn $mod+2 exec "swaysome focus-group 2"
-bindsym --no-warn $mod+3 exec "swaysome focus-group 3"
-bindsym --no-warn $mod+4 exec "swaysome focus-group 4"
-bindsym --no-warn $mod+5 exec "swaysome focus-group 5"
-bindsym --no-warn $mod+6 exec "swaysome focus-group 6"
-bindsym --no-warn $mod+7 exec "swaysome focus-group 7"
-bindsym --no-warn $mod+8 exec "swaysome focus-group 8"
-bindsym --no-warn $mod+9 exec "swaysome focus-group 9"
-bindsym --no-warn $mod+0 exec "swaysome focus-group 0"
-
-# Move containers between workspaces
-bindsym $mod+Alt+Shift+1 exec "swaysome move 1"
-bindsym $mod+Alt+Shift+2 exec "swaysome move 2"
-bindsym $mod+Alt+Shift+3 exec "swaysome move 3"
-bindsym $mod+Alt+Shift+4 exec "swaysome move 4"
-bindsym $mod+Alt+Shift+5 exec "swaysome move 5"
-bindsym $mod+Alt+Shift+6 exec "swaysome move 6"
-bindsym $mod+Alt+Shift+7 exec "swaysome move 7"
-bindsym $mod+Alt+Shift+8 exec "swaysome move 8"
-bindsym $mod+Alt+Shift+9 exec "swaysome move 9"
-bindsym $mod+Alt+Shift+0 exec "swaysome move 0"
-
-# Move containers to other workspace groups
-bindsym --no-warn $mod+Shift+1 exec "swaysome move-to-group 1"
-bindsym --no-warn $mod+Shift+2 exec "swaysome move-to-group 2"
-bindsym --no-warn $mod+Shift+3 exec "swaysome move-to-group 3"
-bindsym --no-warn $mod+Shift+4 exec "swaysome move-to-group 4"
-bindsym --no-warn $mod+Shift+5 exec "swaysome move-to-group 5"
-bindsym --no-warn $mod+Shift+6 exec "swaysome move-to-group 6"
-bindsym --no-warn $mod+Shift+7 exec "swaysome move-to-group 7"
-bindsym --no-warn $mod+Shift+8 exec "swaysome move-to-group 8"
-bindsym --no-warn $mod+Shift+9 exec "swaysome move-to-group 9"
-bindsym --no-warn $mod+Shift+0 exec "swaysome move-to-group 0"
-
-# Move focused container to next output
-bindsym $mod+Alt+Right exec "swaysome next-output"
-# Move focused container to previous output
-bindsym $mod+Alt+Left exec "swaysome prev-output"
-
-# Move focused workspace group to next output
-bindsym $mod+Shift+Alt+Right exec "swaysome workspace-group-next-output"
-# Move focused workspace group to previous output
-bindsym $mod+Shift+Alt+Left exec "swaysome workspace-group-prev-output"
-
-# Init workspaces for every screen
-exec "swaysome init 1"
-
--- a/lib/constants.nix
+++ b/lib/constants.nix
@@ -27,7 +27,7 @@ rec {

  kernel = {
    lts = pkgs: pkgs.linuxKernel.packages.linux_6_6;
-    latest = pkgs: pkgs.linuxKernel.packages.linux_6_12;
+    latest = pkgs: pkgs.linuxKernel.packages.linux_6_9;
  };

  nginx = rec {
@@ -98,10 +98,10 @@ rec {
  nix = {
    cache = rec {
      substituters = [
-        "https://nix-cache.${pubDomain}"
+        "https://nix-cache.${pubDomain}/main"
      ];
      keys = [
-        "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+        "main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8="
      ];
      conf = ''
        extra-substituters = ${concatStringsSep " " substituters}
@@ -135,9 +135,6 @@ rec {
        v4 = subnet 8 3 all.v4;
        v6 = subnet 4 3 all.v6;
      };
-      qclk = {
-        v4 = subnet 8 4 all.v4;
-      };

      cust = {
        v4 = subnet 8 100 all.v4; # single ip for routing only
@@ -173,10 +170,6 @@ rec {
      jam-ctr = host 3 prefixes.cust.v4;
    };

-    qclk = {
-      wgPort = 51821;
-    };
-
    firewallForwards = aa: [
      {
        port = "http";
@@ -227,23 +220,6 @@ rec {
        dst = aa.simpcraft-oci.internal.ipv4.address;
        proto = "udp";
      }
-
-      {
-        port = 15636;
-        dst = aa.enshrouded-oci.internal.ipv4.address;
-        proto = "udp";
-      }
-      {
-        port = 15637;
-        dst = aa.enshrouded-oci.internal.ipv4.address;
-        proto = "udp";
-      }
-
-      {
-        port = qclk.wgPort;
-        dst = aa.qclk.internal.ipv4.address;
-        proto = "udp";
-      }
    ];

    fstrimConfig = {
@@ -267,7 +243,7 @@ rec {
      "stream"
    ];
    routersPubV4 = [
-      "109.255.31.155"
+      "188.141.14.7"
      "109.255.252.63"
    ];

@@ -317,8 +293,6 @@ rec {
        v6 = host ((1*65536*65536*65536) + 65535) prefixes.as211024.v6;
      };
    };
-
-    roceBootModules = [ "ib_core" "ib_uverbs" "mlx5_core" "mlx5_ib" ];
  };

  britway = {
@@ -383,7 +357,6 @@ rec {
    deploy = ../.keys/deploy.pub;
    rsyncNet = ../.keys/zh2855.rsync.net.pub;
    mailcowAcme = ../.keys/mailcow-acme.pub;
-    harmonia = ../.keys/harmonia.pub;
  };
  sshHostKeys = {
    mail-vm = ../.keys/mail-vm-host.pub;
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -5,7 +5,7 @@ let
    genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
    mkOption mkOverride mkForce mkIf mergeEqualOption optional
    showWarnings concatStringsSep flatten unique optionalAttrs
-    mkBefore toLower;
+    mkBefore;
  inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -248,37 +248,10 @@ rec {
  in
  {
    trivial = prev.trivial // {
-      release = "24.12:u-${prev.trivial.release}";
-      codeName = "Epic";
+      release = "24.06:u-${prev.trivial.release}";
+      codeName = "Carbrain";
      revisionWithDefault = default: self.rev or default;
      versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
    };
  };
-
-  netbootKeaClientClasses = { tftpIP, hostname, systems }:
-  let
-    testIPXE = "substring(option[user-class].hex, 0, 4) == 'iPXE'";
-  in
-    (mapAttrsToList (name: mac: {
-      name = "nixos-${name}";
-      test = "(${testIPXE}) and (hexstring(pkt4.mac, ':') == '${toLower mac}')";
-      next-server = tftpIP;
-      server-hostname = hostname;
-      boot-file-name = "http://${hostname}/systems/${name}/menu.ipxe";
-    }) systems) ++ [
-    {
-      name = "ipxe";
-      test = testIPXE;
-      next-server = tftpIP;
-      server-hostname = hostname;
-      boot-file-name = "http://${hostname}/boot.ipxe";
-    }
-    {
-      name = "efi-x86_64";
-      test = "option[client-system].hex == 0x0007";
-      next-server = tftpIP;
-      server-hostname = hostname;
-      boot-file-name = "ipxe-x86_64.efi";
-    }
-  ];
 }
--- a/nixos/boxes/britway/default.nix
+++ b/nixos/boxes/britway/default.nix
@@ -106,7 +106,7 @@ in
                  {
                    matchConfig.Name = "as211024";
                    networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                      {
                        Destination = lib.my.c.colony.prefixes.all.v4;
                        Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -123,7 +123,7 @@ in
                        Table = "ts-extra";
                      }
                    ];
-                    routingPolicyRules = [
+                    routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                      {
                        IncomingInterface = "tailscale0";
                        To = lib.my.c.colony.prefixes.all.v6;
--- a/nixos/boxes/britway/nginx.nix
+++ b/nixos/boxes/britway/nginx.nix
@@ -80,7 +80,7 @@ in
              };
            };

-            "hs.${pubDomain}" = {
+            "ts.${pubDomain}" = {
              locations."/" = {
                proxyPass = "http://localhost:${toString config.services.headscale.port}";
                proxyWebsockets = true;
--- a/nixos/boxes/britway/tailscale.nix
+++ b/nixos/boxes/britway/tailscale.nix
@@ -5,20 +5,18 @@ let
  inherit (lib.my.c.britway) prefixes domain;

  # Can't use overrideAttrs because we need to override `vendorHash` within `buildGoModule`
-  headscale' = (pkgs.headscale.override {
+  headscale = pkgs.headscale.override {
    buildGoModule = args: pkgs.buildGoModule (args // rec {
-      version = "0.23.0-alpha12";
+      version = "0.23.0-alpha2";
      src = pkgs.fetchFromGitHub {
        owner = "juanfont";
        repo = "headscale";
        rev = "v${version}";
-        hash = "sha256-kZZK0cXnFARxblSMz01TDcBbTorkHGAwGpR+a4/mYfU=";
+        hash = "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=";
      };
-      patches = [];
-      vendorHash = "sha256-EorT2AVwA3usly/LcNor6r5UIhLCdj3L4O4ilgTIC2o=";
-      doCheck = false;
+      vendorHash = "sha256-u9AmJguQ5dnJpfhOeLN43apvMHuraOrJhvlEIp9RoIc=";
    });
-  });
+  };

  advRoutes = concatStringsSep "," [
    lib.my.c.home.prefixes.all.v4
@@ -41,20 +39,19 @@ in
    services = {
      headscale = {
        enable = true;
+        package = headscale;
        settings = {
          disable_check_updates = true;
          unix_socket_permission = "0770";
-          server_url = "https://hs.${pubDomain}";
-          database = {
-            type = "sqlite3";
-            sqlite.path = "/var/lib/headscale/db.sqlite3";
-          };
+          server_url = "https://ts.${pubDomain}";
+          db_type = "sqlite3";
+          db_path = "/var/lib/headscale/db.sqlite3";
          noise.private_key_path = "/var/lib/headscale/noise_private.key";
-          prefixes = with lib.my.c.tailscale.prefix; { inherit v4 v6; };
-          dns = {
+          ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ];
+          dns_config = {
            # Use IPs that will route inside the VPN to prevent interception
            # (e.g. DNS rebinding filtering)
-            nameservers.split = {
+            restricted_nameservers = {
              "${domain}" = pubNameservers;
              "${lib.my.c.colony.domain}" = with allAssignments.estuary.base; [
                ipv4.address ipv6.address
@@ -68,6 +65,7 @@ in
            };
            magic_dns = true;
            base_domain = "ts.${pubDomain}";
+            override_local_dns = false;
          };
          oidc = {
            only_start_if_oidc_is_available = true;
@@ -87,7 +85,7 @@ in
        interfaceName = "tailscale0";
        extraUpFlags = [
          "--operator=${config.my.user.config.name}"
-          "--login-server=https://hs.nul.ie"
+          "--login-server=https://ts.nul.ie"
          "--netfilter-mode=off"
          "--advertise-exit-node"
          "--advertise-routes=${advRoutes}"
--- a/nixos/boxes/home/castle/0001-drm-amd-display-fix-flickering-caused-by-S-G-mode.patch
+++ b/nixos/boxes/home/castle/0001-drm-amd-display-fix-flickering-caused-by-S-G-mode.patch
--- a/nixos/boxes/home/castle/default.nix
+++ b/nixos/boxes/home/castle/default.nix
@@ -1,8 +1,7 @@
 { lib, ... }:
 let
  inherit (lib.my) net;
-  inherit (lib.my.c) networkd;
-  inherit (lib.my.c.home) domain vlans prefixes vips roceBootModules;
+  inherit (lib.my.c.home) domain vlans prefixes;
 in
 {
  nixos.systems.castle = {
@@ -16,7 +15,7 @@ in
        ipv4 = {
          address = net.cidr.host 40 prefixes.hi.v4;
          mask = 22;
-          gateway = vips.hi.v4;
+          gateway = null;
        };
        ipv6 = {
          iid = "::3:1";
@@ -36,7 +35,7 @@ in
          cpu = {
            amd.updateMicrocode = true;
          };
-          graphics.extraPackages = with pkgs; [
+          opengl.extraPackages = with pkgs; [
            intel-media-driver
          ];
          bluetooth.enable = true;
@@ -48,7 +47,7 @@ in
            timeout = 10;
          };
          kernelPackages = lib.my.c.kernel.latest pkgs;
-          kernelModules = [ "kvm-amd" "dm-snapshot" ];
+          kernelModules = [ "kvm-amd" ];
          kernelParams = [ "amd_iommu=on" "amd_pstate=passive" ];
          kernelPatches = [
            # {
@@ -58,40 +57,27 @@ in
            # }
          ];
          initrd = {
-            availableKernelModules = [
-              "thunderbolt" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sd_mod"
-              "8021q"
-            ] ++ roceBootModules;
-            systemd.network = {
-              netdevs = mkVLAN "lan-hi" vlans.hi;
-              networks = {
-                "10-et100g" = {
-                  matchConfig.Name = "et100g";
-                  vlan = [ "lan-hi" ];
-                  linkConfig.RequiredForOnline = "no";
-                  networkConfig = networkd.noL3;
-                };
-                "20-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
-              };
-            };
+            availableKernelModules = [ "thunderbolt" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sd_mod" ];
          };
-
-          binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
        };

        fileSystems = {
+          "/boot" = {
+            device = "/dev/disk/by-partuuid/8ce4248a-3ee4-f44f-801f-064a628b4d6e";
+            fsType = "vfat";
+          };
          "/nix" = {
-            device = "/dev/nvmeof/nix";
+            device = "/dev/disk/by-partuuid/2da23a1d-2daf-d943-b91e-fc175f3dad07";
            fsType = "ext4";
          };
+
          "/persist" = {
-            device = "/dev/nvmeof/persist";
+            device = "/dev/disk/by-partuuid/f4c80d4f-a022-e941-b5d1-fe2e65e444b9";
            fsType = "ext4";
            neededForBoot = true;
          };
-
          "/home" = {
-            device = "/dev/nvmeof/home";
+            device = "/dev/disk/by-partuuid/992a93cf-6c9c-324b-b0ce-f8eb2d1ce10d";
            fsType = "ext4";
          };
        };
@@ -134,7 +120,7 @@ in
        virtualisation.libvirtd.enable = true;

        networking = {
-          inherit domain;
+          domain = "h.${lib.my.c.pubDomain}";
          firewall.enable = false;
        };

@@ -154,14 +140,11 @@ in

        nix = {
          gc.automatic = false;
-          settings = {
-            experimental-features = [ "recursive-nix" ];
-            system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" "recursive-nix" ];
-          };
        };

        systemd = {
          network = {
+            wait-online.enable = false;
            netdevs = mkMerge [
              (mkVLAN "lan-hi" vlans.hi)
            ];
@@ -178,20 +161,29 @@ in
                matchConfig.PermanentMACAddress = "24:8a:07:a8:fe:3a";
                linkConfig = {
                  Name = "et100g";
-                  MTUBytes = toString lib.my.c.home.hiMTU;
+                  MTUBytes = "9000";
                };
              };
            };
            networks = {
-              "30-et100g" = {
+              "50-lan" = {
+                matchConfig.Name = "et2.5g";
+                DHCP = "no";
+                address = [ "10.16.7.1/16" ];
+              };
+
+              "50-et100g" = {
                matchConfig.Name = "et100g";
                vlan = [ "lan-hi" ];
                networkConfig.IPv6AcceptRA = false;
              };
-              "40-lan-hi" = mkMerge [
+              "60-lan-hi" = mkMerge [
                (networkdAssignment "lan-hi" assignments.hi)
-                # So we don't drop the IP we use to connect to NVMe-oF!
-                { networkConfig.KeepConfiguration = "static"; }
+                {
+                  DHCP = "yes";
+                  matchConfig.Name = "lan-hi";
+                  linkConfig.MTUBytes = "9000";
+                }
              ];
            };
          };
@@ -225,7 +217,6 @@ in
                    HDMI-A-1 = {
                      transform = "270";
                      position = "0 0";
-                      bg = "${./his-team-player.jpg} fill";
                    };
                    DP-1 = {
                      mode = "2560x1440@170Hz";
@@ -247,19 +238,11 @@ in
          };

          #deploy.generate.system.mode = "boot";
+          deploy.node.hostname = "castle.box.${config.networking.domain}";
          secrets = {
            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlVuTzKObeaUuPocCF41IO/8X+443lzUJLuCIclt2vr";
          };
-          netboot.client = {
-            enable = true;
-          };
-          nvme = {
-            uuid = "2230b066-a674-4f45-a1dc-f7727b3a9e7b";
-            boot = {
-              nqn = "nqn.2016-06.io.spdk:castle";
-              address = "192.168.68.80";
-            };
-          };
+          nvme.uuid = "2230b066-a674-4f45-a1dc-f7727b3a9e7b";

          firewall = {
            enable = false;
--- a/nixos/boxes/colony/default.nix
+++ b/nixos/boxes/colony/default.nix
@@ -252,10 +252,10 @@ in
                  };
                  ipv6Prefixes = [
                    {
-                      Prefix = prefixes.vms.v6;
+                      ipv6PrefixConfig.Prefix = prefixes.vms.v6;
                    }
                  ];
-                  routes = [
+                  routes = map (r: { routeConfig = r; }) [
                    {
                      Destination = prefixes.ctrs.v4;
                      Gateway = allAssignments.shill.routing.ipv4.address;
@@ -264,12 +264,10 @@ in
                      Destination = prefixes.ctrs.v6;
                      Gateway = allAssignments.shill.internal.ipv6.address;
                    }
-
                    {
                      Destination = allAssignments.shill.internal.ipv4.address;
                      Gateway = allAssignments.shill.routing.ipv4.address;
                    }
-
                    {
                      Destination = lib.my.c.tailscale.prefix.v4;
                      Gateway = allAssignments.shill.routing.ipv4.address;
@@ -278,11 +276,6 @@ in
                      Destination = lib.my.c.tailscale.prefix.v6;
                      Gateway = allAssignments.shill.internal.ipv6.address;
                    }
-                    {
-                      Destination = prefixes.qclk.v4;
-                      Gateway = allAssignments.shill.routing.ipv4.address;
-                    }
-
                    {
                      Destination = prefixes.jam.v6;
                      Gateway = allAssignments.shill.internal.ipv6.address;
@@ -327,10 +320,10 @@ in
                };
                ipv6Prefixes = [
                  {
-                    Prefix = prefixes.mail.v6;
+                    ipv6PrefixConfig.Prefix = prefixes.mail.v6;
                  }
                ];
-                routes = [
+                routes = map (r: { routeConfig = r; }) [
                  {
                    Destination = prefixes.mail.v4;
                    Scope = "link";
@@ -350,10 +343,10 @@ in
                };
                ipv6Prefixes = [
                  {
-                    Prefix = prefixes.darts.v6;
+                    ipv6PrefixConfig.Prefix = prefixes.darts.v6;
                  }
                ];
-                routes = [
+                routes = map (r: { routeConfig = r; }) [
                  {
                    Destination = prefixes.darts.v4;
                    Scope = "link";
--- a/nixos/boxes/colony/vms/default.nix
+++ b/nixos/boxes/colony/vms/default.nix
@@ -29,9 +29,6 @@
    };
  in
  {
-    # Kernel Same-Page Merging to attempt memory usage reduction
-    hardware.ksm.enable = false;
-
    systemd = {
      network = {
        links = {
@@ -133,7 +130,7 @@

              (vm.lvmDisk "media")
              (vm.lvmDisk "minio")
-              (vm.lvmDisk "nix-cache")
+              (vm.lvmDisk "nix-atticd")
              (vm.lvmDisk "jam")
            ]);
          };
--- a/nixos/boxes/colony/vms/estuary/default.nix
+++ b/nixos/boxes/colony/vms/estuary/default.nix
@@ -164,9 +164,11 @@ in
                    };
                    wireguardPeers = [
                      {
-                        PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
-                        AllowedIPs = [ allAssignments.kelder.estuary.ipv4.address ];
-                        PersistentKeepalive = 25;
+                        wireguardPeerConfig = {
+                          PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
+                          AllowedIPs = [ allAssignments.kelder.estuary.ipv4.address ];
+                          PersistentKeepalive = 25;
+                        };
                      }
                    ];
                  };
@@ -276,51 +278,47 @@ in
                    };
                    ipv6Prefixes = [
                      {
-                        Prefix = prefixes.base.v6;
+                        ipv6PrefixConfig.Prefix = prefixes.base.v6;
                      }
                    ];
-                    routes = flatten ([
-                      {
-                        Destination = prefixes.vip1;
-                        Gateway = allAssignments.colony.routing.ipv4.address;
-                      }
-                      {
-                        Destination = prefixes.vip3;
-                        Gateway = allAssignments.colony.routing.ipv4.address;
-                      }
-                      {
-                        Destination = prefixes.darts.v4;
-                        Gateway = allAssignments.colony.routing.ipv4.address;
-                      }
-                      {
-                        Destination = prefixes.cust.v6;
-                        Gateway = allAssignments.colony.internal.ipv6.address;
-                      }
+                    routes = map (r: { routeConfig = r; }) (flatten
+                      ([
+                        {
+                          Destination = prefixes.vip1;
+                          Gateway = allAssignments.colony.routing.ipv4.address;
+                        }
+                        {
+                          Destination = prefixes.vip3;
+                          Gateway = allAssignments.colony.routing.ipv4.address;
+                        }
+                        {
+                          Destination = prefixes.darts.v4;
+                          Gateway = allAssignments.colony.routing.ipv4.address;
+                        }
+                        {
+                          Destination = prefixes.cust.v6;
+                          Gateway = allAssignments.colony.internal.ipv6.address;
+                        }

-                      {
-                        Destination = lib.my.c.tailscale.prefix.v4;
-                        Gateway = allAssignments.colony.routing.ipv4.address;
-                      }
-                      {
-                        Destination = lib.my.c.tailscale.prefix.v6;
-                        Gateway = allAssignments.colony.internal.ipv6.address;
-                      }
-
-                      {
-                        Destination = prefixes.qclk.v4;
-                        Gateway = allAssignments.colony.routing.ipv4.address;
-                      }
-                    ] ++
-                    (map (pName: [
-                      {
-                        Gateway = allAssignments.colony.routing.ipv4.address;
-                        Destination = prefixes."${pName}".v4;
-                      }
-                      {
-                        Destination = prefixes."${pName}".v6;
-                        Gateway = allAssignments.colony.internal.ipv6.address;
-                      }
-                    ]) [ "vms" "ctrs" "oci" ]));
+                        {
+                          Destination = lib.my.c.tailscale.prefix.v4;
+                          Gateway = allAssignments.colony.routing.ipv4.address;
+                        }
+                        {
+                          Destination = lib.my.c.tailscale.prefix.v6;
+                          Gateway = allAssignments.colony.internal.ipv6.address;
+                        }
+                      ] ++
+                      (map (pName: [
+                        {
+                          Gateway = allAssignments.colony.routing.ipv4.address;
+                          Destination = prefixes."${pName}".v4;
+                        }
+                        {
+                          Destination = prefixes."${pName}".v6;
+                          Gateway = allAssignments.colony.internal.ipv6.address;
+                        }
+                      ]) [ "vms" "ctrs" "oci" ])));
                  }
                ];

@@ -329,7 +327,7 @@ in
                  {
                    matchConfig.Name = "as211024";
                    networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                      {
                        Destination = lib.my.c.home.prefixes.all.v4;
                        Gateway = lib.my.c.home.vips.as211024.v4;
@@ -341,8 +339,10 @@ in
                  matchConfig.Name = "kelder";
                  routes = [
                    {
-                      Destination = allAssignments.kelder.estuary.ipv4.address;
-                      Scope = "link";
+                      routeConfig = {
+                        Destination = allAssignments.kelder.estuary.ipv4.address;
+                        Scope = "link";
+                      };
                    }
                  ];
                };
@@ -407,7 +407,6 @@ in
                      ip6 daddr ${aa.valheim-oci.internal.ipv6.address} udp dport { 2456-2457 } accept
                      ip6 daddr ${aa.waffletail.internal.ipv6.address} udp dport 41641 accept
                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} udp dport 25565 accept
-                      ip6 daddr ${aa.enshrouded-oci.internal.ipv6.address} udp dport { 15636-15637 } accept
                      return
                    }
                    chain filter-routing {
--- a/nixos/boxes/colony/vms/estuary/dns.nix
+++ b/nixos/boxes/colony/vms/estuary/dns.nix
@@ -153,7 +153,6 @@ in
            simpcraft IN AAAA ${allAssignments.simpcraft-oci.internal.ipv6.address}
            simpcraft-staging IN A ${assignments.internal.ipv4.address}
            simpcraft-staging IN AAAA ${allAssignments.simpcraft-staging-oci.internal.ipv6.address}
-            enshrouded IN A ${assignments.internal.ipv4.address}

            mail-vm IN A ${net.cidr.host 0 prefixes.mail.v4}
            mail-vm IN AAAA ${net.cidr.host 1 prefixes.mail.v6}
--- a/nixos/boxes/colony/vms/git/gitea-actions.nix
+++ b/nixos/boxes/colony/vms/git/gitea-actions.nix
@@ -35,11 +35,6 @@ in
          ];
          url = "https://git.${pubDomain}";
          tokenFile = config.age.secrets."gitea/actions-runner.env".path;
-          settings = {
-            runner = {
-              timeout = "8h";
-            };
-          };
        };
      };
    };
--- a/nixos/boxes/colony/vms/shill/containers-ext.nix
+++ b/nixos/boxes/colony/vms/shill/containers-ext.nix
@@ -47,10 +47,10 @@ in
        };
        ipv6Prefixes = [
          {
-            Prefix = prefixes.jam.v6;
+            ipv6PrefixConfig.Prefix = prefixes.jam.v6;
          }
        ];
-        routes = [
+        routes = map (r: { routeConfig = r; }) [
          {
            Destination = prefixes.jam.v4;
            Scope = "link";
@@ -64,8 +64,8 @@ in

        serviceConfig = {
          CPUQuota = "400%";
-          MemoryHigh = "infinity";
-          MemoryMax = "4G";
+          MemoryHigh = "4G";
+          MemoryMax = "4.5G";
        };

        wantedBy = [ "machines.target" ];
--- a/nixos/boxes/colony/vms/shill/containers/chatterbox.nix
+++ b/nixos/boxes/colony/vms/shill/containers/chatterbox.nix
@@ -50,6 +50,11 @@ in
                  group = "matrix-synapse";
                };

+                "chatterbox/syncv3.env" = {
+                  owner = "matrix-syncv3";
+                  group = "matrix-syncv3";
+                };
+
                "chatterbox/mautrix-whatsapp.env" = {
                  owner = "mautrix-whatsapp";
                  group = "mautrix-whatsapp";
@@ -75,21 +80,32 @@ in
              matrix-synapse.extraGroups = [
                "mautrix-whatsapp"
              ];
+              matrix-syncv3 = {
+                isSystemUser = true;
+                uid = uids.matrix-syncv3;
+                group = "matrix-syncv3";
+              };
+            };
+            groups = {
+              matrix-syncv3.gid = gids.matrix-syncv3;
            };
-            groups = { };
          };

          systemd = {
            network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
-            services = { } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
+            services = {
+              matrix-sliding-sync.serviceConfig = {
+                # Needs to be able to read its secrets
+                DynamicUser = mkForce false;
+                User = "matrix-syncv3";
+                Group = "matrix-syncv3";
+              };
+            } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
              # ffmpeg needed to convert GIFs to video
              path = with pkgs; [ ffmpeg ];
            }));
          };

-          # TODO/FIXME: https://github.com/NixOS/nixpkgs/issues/336052
-          nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
-
          services = {
            netdata.enable = true;
            matrix-synapse = {
@@ -177,10 +193,20 @@ in
                app_service_config_files = [
                  "/var/lib/heisenbridge/registration.yml"
                  config.age.secrets."chatterbox/doublepuppet.yaml".path
+                  "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
                ];
              };

            };
+            matrix-sliding-sync = {
+              enable = true;
+              createDatabase = false;
+              environmentFile = config.age.secrets."chatterbox/syncv3.env".path;
+              settings = {
+                SYNCV3_BINDADDR = "[::]:8009";
+                SYNCV3_SERVER = "http://localhost:8008";
+              };
+            };

            heisenbridge = {
              enable = true;
@@ -259,12 +285,10 @@ in
                      avatar = "mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak";
                    };
                  };
-                  network = {
-                    mode = "messenger";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
-                  };
+                  meta.mode = "messenger";
                  bridge = {
                    username_template = "fbm2_{{.}}";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
                    personal_filtering_spaces = true;
                    delivery_receipts = true;
                    management_room_text.welcome = "Hello, I'm a Messenger bridge bot.";
@@ -307,12 +331,10 @@ in
                      avatar = "mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv";
                    };
                  };
-                  network = {
-                    mode = "instagram";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
-                  };
+                  meta.mode = "instagram";
                  bridge = {
                    username_template = "ig_{{.}}";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
                    personal_filtering_spaces = true;
                    delivery_receipts = true;
                    management_room_text.welcome = "Hello, I'm an Instagram bridge bot.";
--- a/nixos/boxes/colony/vms/shill/containers/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/default.nix
@@ -8,6 +8,5 @@
    ./object.nix
    ./toot.nix
    ./waffletail.nix
-    ./qclk
  ];
 }
--- a/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
@@ -94,14 +94,6 @@ in
          };
        };

-        nixpkgs.config.permittedInsecurePackages = [
-          # FIXME: This is needed for Sonarr
-          "aspnetcore-runtime-wrapped-6.0.36"
-          "aspnetcore-runtime-6.0.36"
-          "dotnet-sdk-wrapped-6.0.428"
-          "dotnet-sdk-6.0.428"
-        ];
-
        services = {
          netdata.enable = true;

--- a/nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix
+++ b/nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix
@@ -71,12 +71,14 @@ in
              RouteTable = routeTable;
            };
            wireguardPeers = [
-              # AirVPN NL
              {
-                Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
-                PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
-                PresharedKeyFile = config.age.secrets."${pskFile}".path;
-                AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                # AirVPN NL
+                wireguardPeerConfig = {
+                  Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
+                  PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
+                  PresharedKeyFile = config.age.secrets."${pskFile}".path;
+                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                };
              }
            ];
          };
@@ -92,7 +94,7 @@ in
              matchConfig.Name = "vpn";
              address = [ "10.182.97.37/32" "fd7d:76ee:e68f:a993:735d:ef5e:6907:b122/128" ];
              dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = [
+              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                {
                  Family = "both";
                  SuppressPrefixLength = 0;
--- a/nixos/boxes/colony/vms/shill/containers/middleman/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/default.nix
@@ -239,9 +239,6 @@ in
              ];

              recommendedTlsSettings = true;
-              recommendedBrotliSettings = true;
-              # Uh so nginx is hanging with zstd enabled... maybe let's not for now
-              # recommendedZstdSettings = true;
              clientMaxBodySize = "0";
              serverTokens = true;
              resolver = {
--- a/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
@@ -2,7 +2,7 @@
 let
  inherit (builtins) mapAttrs toJSON;
  inherit (lib) mkMerge mkDefault genAttrs flatten concatStringsSep;
-  inherit (lib.my.c) pubDomain home;
+  inherit (lib.my.c) pubDomain;
  inherit (lib.my.c.nginx) proxyHeaders;
  inherit (config.networking) domain;

@@ -35,6 +35,7 @@ let
      # For clients
      (mkWellKnown "matrix/client" (toJSON {
        "m.homeserver".base_url = "https://matrix.nul.ie";
+        "org.matrix.msc3575.proxy".url = "https://matrix-syncv3.nul.ie";
      }))
    ];
  };
@@ -144,7 +145,7 @@ in

      "pass.${pubDomain}" =
      let
-        upstream = "http://vaultwarden-ctr.${domain}:8080";
+        upstream = "http://vaultwarden-ctr.${domain}";
      in
      {
        locations = {
@@ -181,6 +182,10 @@ in
        ];
        useACMEHost = pubDomain;
      };
+      "matrix-syncv3.${pubDomain}" = {
+        locations."/".proxyPass = "http://chatterbox-ctr.${domain}:8009";
+        useACMEHost = pubDomain;
+      };

      "element.${pubDomain}" =
      let
@@ -201,8 +206,7 @@ in
          # Currently it seems like single quotes aren't escaped like they should be...
          conf = {
            brand = "/dev/player0 Matrix";
-            show_labs_settings = true;
-            default_country_code = "IE";
+            showLabsSettings = true;
            disable_guests = true;
            default_server_config = {
              "m.homeserver" = {
@@ -210,8 +214,9 @@ in
                server_name = "nul.ie";
              };
            };
-            room_directory.servers = [
+            roomDirectory.servers = [
              "nul.ie"
+              "netsoc.ie"
              "matrix.org"
            ];
          };
@@ -391,28 +396,6 @@ in
        };
        useACMEHost = pubDomain;
      };
-
-      "pront.${pubDomain}" = mkMerge [
-        {
-          locations."/" = mkMerge [
-            {
-              proxyPass = "http://stream-hi.${home.domain}:5000";
-              proxyWebsockets = true;
-              extraConfig = proxyHeaders;
-            }
-            (ssoLoc "generic")
-          ];
-          locations."~* ^/webcam/(.*)" = mkMerge [
-            {
-              proxyPass = "http://stream-hi.${home.domain}:5050/$1$is_args$args";
-              extraConfig = proxyHeaders;
-            }
-            (ssoLoc "generic")
-          ];
-          useACMEHost = pubDomain;
-        }
-        (ssoServer "generic")
-      ];
    };

    minio =
@@ -424,13 +407,10 @@ in
        ignore_invalid_headers off;
      '';

-      nixCacheableRegex = ''^\/(\S+\.narinfo|nar\/\S+\.nar.*|serve\/.+)$'';
+      nixCacheableRegex = ''^\/(\S+\.narinfo|nar\/\S+\.nar\.\S+)$'';
      nixCacheHeaders = ''
        add_header Cache-Control $nix_cache_control;
        add_header Expires $nix_expires;
-
-        brotli on;
-        brotli_types application/x-nix-archive;
      '';
    in
    {
@@ -472,11 +452,9 @@ in

      "nix-cache.${pubDomain}" = {
        locations = {
-          "/" = {
-            proxyPass = "http://${host}:5000";
-          };
+          "/".proxyPass = "http://${host}:8069";
          "~ ${nixCacheableRegex}" = {
-            proxyPass = "http://${host}:5000";
+            proxyPass = "http://${host}:8069";
            extraConfig = nixCacheHeaders;
          };
        };
--- a/nixos/boxes/colony/vms/shill/containers/object.nix
+++ b/nixos/boxes/colony/vms/shill/containers/object.nix
@@ -31,13 +31,6 @@ in
    {
      config = mkMerge [
        {
-          fileSystems = {
-            "/var/lib/harmonia" = {
-              device = "/mnt/nix-cache";
-              options = [ "bind" ];
-            };
-          };
-
          my = {
            deploy.enable = false;
            server.enable = true;
@@ -55,7 +48,6 @@ in
                  group = config.my.user.config.group;
                };
                "object/atticd.env" = {};
-                "nix-cache.key" = {};
                "object/hedgedoc.env" = {};
                "object/wastebin.env" = {};
              };
@@ -66,7 +58,6 @@ in
                9000 9001
                config.services.sharry.config.bind.port
                8069
-                5000
                config.services.hedgedoc.settings.port
                8088
              ];
@@ -77,26 +68,14 @@ in
            };
          };

-          users = with lib.my.c.ids; mkMerge [
-            (let inherit (config.services.atticd) user group; in {
-              users."${user}" = {
-                isSystemUser = true;
-                uid = uids.atticd;
-                group = group;
-              };
-              groups."${user}".gid = gids.atticd;
-            })
-            {
-              users = {
-                harmonia = {
-                  shell = pkgs.bashInteractive;
-                  openssh.authorizedKeys.keyFiles = [
-                    lib.my.c.sshKeyFiles.harmonia
-                  ];
-                };
-              };
-            }
-          ];
+          users = with lib.my.c.ids; let inherit (config.services.atticd) user group; in {
+            users."${user}" = {
+              isSystemUser = true;
+              uid = uids.atticd;
+              group = group;
+            };
+            groups."${user}".gid = gids.atticd;
+          };

          systemd = {
            network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
@@ -114,9 +93,7 @@ in
                  MINIO_BROWSER_REDIRECT_URL = "https://minio.nul.ie";
                };
              };
-
              sharry = awaitPostgres;
-
              atticd = mkMerge [
                awaitPostgres
                {
@@ -127,15 +104,6 @@ in
                  };
                }
              ];
-              harmonia = {
-                environment.NIX_REMOTE = "/var/lib/harmonia";
-                preStart = ''
-                  ${config.nix.package}/bin/nix store ping
-                '';
-                serviceConfig = {
-                  StateDirectory = "harmonia";
-                };
-              };
            };
          };

@@ -215,8 +183,8 @@ in
            };

            atticd = {
-              enable = false;
-              environmentFile = config.age.secrets."object/atticd.env".path;
+              enable = true;
+              credentialsFile = config.age.secrets."object/atticd.env".path;
              settings = {
                listen = "[::]:8069";
                allowed-hosts = [ "nix-cache.${pubDomain}" ];
@@ -235,14 +203,6 @@ in
              };
            };

-            harmonia = {
-              enable = true;
-              signKeyPaths = [ config.age.secrets."nix-cache.key".path ];
-              settings = {
-                priority = 30;
-              };
-            };
-
            hedgedoc = {
              enable = true;
              environmentFile = config.age.secrets."object/hedgedoc.env".path;
--- a/nixos/boxes/colony/vms/shill/containers/qclk/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/qclk/default.nix
@@ -1,115 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.colony) domain prefixes qclk;
-in
-{
-  nixos.systems.qclk = { config, ... }: {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    rendered = config.configuration.config.my.asContainer;
-
-    assignments = {
-      internal = {
-        name = "qclk-ctr";
-        inherit domain;
-        ipv4.address = net.cidr.host 10 prefixes.ctrs.v4;
-        ipv6 = {
-          iid = "::a";
-          address = net.cidr.host 10 prefixes.ctrs.v6;
-        };
-      };
-      qclk = {
-        ipv4 = {
-          address = net.cidr.host 1 prefixes.qclk.v4;
-          gateway = null;
-        };
-      };
-    };
-
-    configuration = { lib, pkgs, config, assignments, ... }:
-    let
-      inherit (lib) concatStringsSep mkMerge mkIf mkForce;
-      inherit (lib.my) networkdAssignment;
-
-      apiPort = 8080;
-
-      instances = [
-        {
-          host = 2;
-          wgKey = "D7z1FhcdxpnrGCE0wBW5PZb5BKuhCu6tcZ/5ZaYxdwQ=";
-        }
-      ];
-      ipFor = i: net.cidr.host i.host prefixes.qclk.v4;
-    in
-    {
-      config = {
-        environment = {
-          systemPackages = with pkgs; [
-            wireguard-tools
-          ];
-        };
-
-        my = {
-          deploy.enable = false;
-          server.enable = true;
-
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC1kcfvahYmSk8IJKaUIcGkhxf/8Yse2XnU7Qqgcglyq";
-            files = {
-              "qclk/wg.key" = {
-                group = "systemd-network";
-                mode = "440";
-              };
-            };
-          };
-
-          firewall = {
-            udp.allowed = [ qclk.wgPort ];
-            extraRules = ''
-              table inet filter {
-                chain input {
-                  iifname management tcp dport ${toString apiPort} accept
-                }
-                chain forward {
-                  iifname host0 oifname management ip saddr { ${concatStringsSep ", " lib.my.c.as211024.trusted.v4} } accept
-                }
-              }
-              table inet nat {
-                chain postrouting {
-                  iifname host0 oifname management snat ip to ${assignments.qclk.ipv4.address}
-                }
-              }
-            '';
-          };
-        };
-
-        systemd = {
-          network = {
-            netdevs."30-management" = {
-              netdevConfig = {
-                Name = "management";
-                Kind = "wireguard";
-              };
-              wireguardConfig = {
-                PrivateKeyFile = config.age.secrets."qclk/wg.key".path;
-                ListenPort = qclk.wgPort;
-              };
-              wireguardPeers = map (i: {
-                PublicKey = i.wgKey;
-                AllowedIPs = [ (ipFor i) ];
-              }) instances;
-            };
-            networks = {
-              "30-container-host0" = networkdAssignment "host0" assignments.internal;
-
-              "30-management" = networkdAssignment "management" assignments.qclk;
-            };
-          };
-        };
-
-        services = { };
-      };
-    };
-  };
-}
--- a/nixos/boxes/colony/vms/shill/containers/vaultwarden.nix
+++ b/nixos/boxes/colony/vms/shill/containers/vaultwarden.nix
@@ -83,7 +83,7 @@ in
                DOMAIN = "https://pass.${lib.my.c.pubDomain}";

                ROCKET_ADDRESS = "::";
-                ROCKET_PORT = 8080;
+                ROCKET_PORT = 80;

                SMTP_HOST = "mail.nul.ie";
                SMTP_FROM = "pass@nul.ie";
@@ -99,8 +99,6 @@ in
            };

            borgbackup.jobs.vaultwarden = {
-              readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];
-
              paths = [ vwData ];
              repo = "zh2855@zh2855.rsync.net:borg/vaultwarden2";
              doInit = true;
--- a/nixos/boxes/colony/vms/shill/containers/waffletail.nix
+++ b/nixos/boxes/colony/vms/shill/containers/waffletail.nix
@@ -86,7 +86,7 @@ in
            interfaceName = "tailscale0";
            extraUpFlags = [
              "--operator=${config.my.user.config.name}"
-              "--login-server=https://hs.nul.ie"
+              "--login-server=https://ts.nul.ie"
              "--netfilter-mode=off"
              "--advertise-exit-node"
              "--advertise-routes=${advRoutes}"
--- a/nixos/boxes/colony/vms/shill/default.nix
+++ b/nixos/boxes/colony/vms/shill/default.nix
@@ -94,8 +94,8 @@ in
                device = "/dev/disk/by-label/minio";
                fsType = "xfs";
              };
-              "/mnt/nix-cache" = {
-                device = "/dev/disk/by-label/nix-cache";
+              "/mnt/atticd" = {
+                device = "/dev/disk/by-label/atticd";
                fsType = "ext4";
              };
            };
@@ -140,10 +140,10 @@ in
                    };
                    ipv6Prefixes = [
                      {
-                        Prefix = prefixes.ctrs.v6;
+                        ipv6PrefixConfig.Prefix = prefixes.ctrs.v6;
                      }
                    ];
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                      {
                        Destination = lib.my.c.tailscale.prefix.v4;
                        Gateway = allAssignments.waffletail.internal.ipv4.address;
@@ -152,11 +152,6 @@ in
                        Destination = lib.my.c.tailscale.prefix.v6;
                        Gateway = allAssignments.waffletail.internal.ipv6.address;
                      }
-
-                      {
-                        Destination = prefixes.qclk.v4;
-                        Gateway = allAssignments.qclk.internal.ipv4.address;
-                      }
                    ];
                  }
                ];
@@ -211,12 +206,11 @@ in
                  object = {
                    bindMounts = {
                      "/mnt/minio".readOnly = false;
-                      "/mnt/nix-cache".readOnly = false;
+                      "/mnt/atticd".readOnly = false;
                    };
                  };
                  toot = {};
                  waffletail = {};
-                  qclk = {};
                };
              in
              mkMerge [
--- a/nixos/boxes/colony/vms/whale2/default.nix
+++ b/nixos/boxes/colony/vms/whale2/default.nix
@@ -52,7 +52,6 @@ in
      valheim-oci = 2;
      simpcraft-oci = 3;
      simpcraft-staging-oci = 4;
-      enshrouded-oci = 5;
    };

    configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -67,7 +66,6 @@ in

          ./valheim.nix
          ./minecraft
-          # ./enshrouded.nix
        ];

        config = mkMerge [
--- a/nixos/boxes/colony/vms/whale2/enshrouded.nix
+++ b/nixos/boxes/colony/vms/whale2/enshrouded.nix
@@ -1,35 +0,0 @@
-{ lib, config, allAssignments, ... }:
-let
-  inherit (lib) concatStringsSep;
-  inherit (lib.my) dockerNetAssignment;
-in
-{
-  config = {
-    virtualisation.oci-containers.containers = {
-      enshrouded = {
-        image = "sknnr/enshrouded-dedicated-server@sha256:f163e8ba9caa2115d8a0a7b16c3696968242fb6fba82706d9a77a882df083497";
-
-        environment = {
-          SERVER_NAME = "UWUshrouded";
-          # SERVER_IP = "::"; # no IPv6?? :(
-          TZ = "Europe/Dublin";
-        };
-        environmentFiles = [ config.age.secrets."whale2/enshrouded.env".path ];
-
-        volumes = [
-          "enshrouded:/home/steam/enshrouded/savegame"
-        ];
-
-        extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "enshrouded-oci"}''
-        ];
-      };
-    };
-
-    my = {
-      secrets.files = {
-        "whale2/enshrouded.env" = {};
-      };
-    };
-  };
-}
--- a/nixos/boxes/colony/vms/whale2/minecraft/default.nix
+++ b/nixos/boxes/colony/vms/whale2/minecraft/default.nix
@@ -123,7 +123,6 @@ in
          within = "12H";
          hourly = 48;
        };
-        readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];

        # Avoid Minecraft poking the files while we back up
        preHook = rconCommand "save-off";
--- a/nixos/boxes/home/castle/his-team-player.jpg
+++ b/nixos/boxes/home/castle/his-team-player.jpg
--- a/nixos/boxes/home/palace/default.nix
+++ b/nixos/boxes/home/palace/default.nix
@@ -94,7 +94,7 @@ in
            extraOptions = [ "-A /var/log/smartd/" "--interval=600" ];
          };
          udev.extraRules = ''
-            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="4"
+            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="3"
          '';
        };

@@ -188,13 +188,6 @@ in
                  VLANId=${toString vlans.hi}
                  LinkState=yes
                  MACAddress=52:54:00:ac:15:a9
-
-                  # sfh bridge
-                  [SR-IOV]
-                  VirtualFunction=3
-                  VLANId=${toString vlans.hi}
-                  LinkState=yes
-                  MACAddress=52:54:00:90:34:95
                '';
              };
              "60-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
--- a/nixos/boxes/home/palace/vms/cellar/default.nix
+++ b/nixos/boxes/home/palace/vms/cellar/default.nix
@@ -66,7 +66,6 @@ in
            ];

            services = {
-              fstrim.enable = true;
              netdata.enable = true;
            };

--- a/nixos/boxes/home/palace/vms/cellar/spdk.nix
+++ b/nixos/boxes/home/palace/vms/cellar/spdk.nix
@@ -129,12 +129,6 @@ in
            hostnqn =
              "nqn.2014-08.org.nvmexpress:uuid:2230b066-a674-4f45-a1dc-f7727b3a9e7b";
            serial = "SPDK00000000000002";
-          }) ++ (nvmfBdev {
-            bdev = "NVMeRaidp3";
-            nqn = "nqn.2016-06.io.spdk:sfh";
-            hostnqn =
-              "nqn.2014-08.org.nvmexpress:uuid:85d7df36-0de0-431b-b06e-51f7c0a455b4";
-            serial = "SPDK00000000000003";
          });
        };
      };
--- a/nixos/boxes/home/palace/vms/default.nix
+++ b/nixos/boxes/home/palace/vms/default.nix
@@ -2,7 +2,6 @@
  imports = [
    ./cellar
    ./river.nix
-    ./sfh
  ];

  nixos.systems.palace.configuration = { lib, pkgs, config, systems, allAssignments, ... }:
@@ -58,11 +57,11 @@

    systemd.services =
    let
-      awaitVM = system: {
-        after = [ "vm@${system}.service" ];
-        bindsTo = [ "vm@${system}.service" ];
+      awaitCellar = {
+        after = [ "vm@cellar.service" ];
+        bindsTo = [ "vm@cellar.service" ];
        preStart = ''
-          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.${system}.hi.ipv4.address} 22; do
+          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.cellar.hi.ipv4.address} 22; do
            sleep 1
          done
        '';
@@ -82,13 +81,13 @@
        vtapUnit = "sys-subsystem-net-devices-vm\\x2det1g0.device";
      in
      mkMerge [
-        (awaitVM "cellar")
+        awaitCellar
        {
          requires = [ vtapUnit ];
          after = [ vtapUnit ];
        }
      ];
-      "vm@sfh" = (awaitVM "river");
+      "vm@sfh" = awaitCellar;
    };

    my = {
@@ -183,10 +182,6 @@
                index = 0;
                hostBDF = "44:00.3";
              };
-              et100g0vf3 = {
-                index = 1;
-                hostBDF = "44:00.4";
-              };
            };
          };
        };
--- a/nixos/boxes/home/palace/vms/river.nix
+++ b/nixos/boxes/home/palace/vms/river.nix
@@ -10,7 +10,18 @@
    let
      inherit (lib.my) networkdAssignment mkVLAN;
      inherit (lib.my.c) networkd;
-      inherit (lib.my.c.home) vlans domain prefixes roceBootModules;
+      inherit (lib.my.c.home) vlans;
+
+      lanLink = {
+        matchConfig = {
+          Driver = "mlx5_core";
+          PermanentMACAddress = "52:54:00:8a:8a:f2";
+        };
+        linkConfig = {
+          Name = "lan";
+          MTUBytes = toString lib.my.c.home.hiMTU;
+        };
+      };
    in
    {
      imports = [
@@ -19,17 +30,29 @@

      config = {
        boot = {
-          kernelModules = [ "kvm-amd" ];
+          kernelModules = [ "kvm-intel" ];
          kernelParams = [ "console=ttyS0,115200n8" ];
          initrd = {
            availableKernelModules = [
              "virtio_pci" "ahci" "sr_mod" "virtio_blk"
-              "8021q"
-            ] ++ roceBootModules;
-            kernelModules = [ "dm-snapshot" ];
+              "ib_core" "ib_uverbs" "mlx5_core" "mlx5_ib" "8021q"
+              "rdma_cm" "iw_cm" "ib_cm" "nvme_core" "nvme_rdma"
+            ];
+            kernelModules = [ "dm-snapshot" "nvme-fabrics" ];
            systemd = {
+              extraBin = with pkgs; {
+                dmesg = "${util-linux}/bin/dmesg";
+                ip = "${iproute2}/bin/ip";
+              };
+              extraConfig = ''
+                DefaultTimeoutStartSec=50
+                DefaultDeviceTimeoutSec=50
+              '';
              network = {
-                # Don't need to put the link config here, they're copied from main config
+                enable = true;
+                wait-online.enable = true;
+
+                links."10-lan" = lanLink;
                netdevs = mkVLAN "lan-hi" vlans.hi;
                networks = {
                  "20-lan" = {
@@ -47,6 +70,9 @@

        hardware = {
          enableRedistributableFirmware = true;
+          cpu = {
+            intel.updateMicrocode = true;
+          };
        };

        fileSystems = {
@@ -70,7 +96,6 @@
            boot.thin.enable = true;
            dmeventd.enable = true;
          };
-          fstrim.enable = true;
        };

        systemd.network = {
@@ -89,16 +114,7 @@
              };
            };

-            "10-lan" = {
-              matchConfig = {
-                Driver = "mlx5_core";
-                PermanentMACAddress = "52:54:00:8a:8a:f2";
-              };
-              linkConfig = {
-                Name = "lan";
-                MTUBytes = toString lib.my.c.home.hiMTU;
-              };
-            };
+            "10-lan" = lanLink;
          };

          # So we don't drop the IP we use to connect to NVMe-oF!
@@ -118,14 +134,6 @@
            };
          };

-          netboot.server = {
-            enable = true;
-            ip = assignments.lo.ipv4.address;
-            host = "boot.${domain}";
-            allowedPrefixes = with prefixes; [ hi.v4 hi.v6 lo.v4 lo.v6 ];
-            instances = [ "sfh" "castle" ];
-          };
-
          deploy.node.hostname = "192.168.68.1";
        };
      };
--- a/nixos/boxes/home/palace/vms/sfh/containers/default.nix
+++ b/nixos/boxes/home/palace/vms/sfh/containers/default.nix
@@ -1,5 +0,0 @@
-{
-  imports = [
-    ./unifi.nix
-  ];
-}
--- a/nixos/boxes/home/palace/vms/sfh/containers/unifi.nix
+++ b/nixos/boxes/home/palace/vms/sfh/containers/unifi.nix
@@ -1,65 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.home) domain prefixes vips hiMTU;
-in
-{
-  nixos.systems.unifi = { config, ... }: {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    rendered = config.configuration.config.my.asContainer;
-
-    assignments = {
-      hi = {
-        name = "unifi-ctr";
-        inherit domain;
-        mtu = hiMTU;
-        ipv4 = {
-          address = net.cidr.host 100 prefixes.hi.v4;
-          mask = 22;
-          gateway = vips.hi.v4;
-        };
-        ipv6 = {
-          iid = "::5:1";
-          address = net.cidr.host (65536*5+1) prefixes.hi.v6;
-        };
-      };
-    };
-
-    configuration = { lib, config, pkgs, assignments, ... }:
-    let
-      inherit (lib) mkMerge mkIf mkForce;
-      inherit (lib.my) networkdAssignment;
-    in
-    {
-      config = {
-        my = {
-          deploy.enable = false;
-          server.enable = true;
-
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdgcziQki/RH7E+NH2bYnzSVKaJ27905Yo5TcOjSh/U";
-            files = { };
-          };
-
-          firewall = {
-            tcp.allowed = [ 8443 ];
-          };
-        };
-
-        systemd = {
-          network.networks."80-container-host0" = networkdAssignment "host0" assignments.hi;
-        };
-
-        services = {
-          unifi = {
-            enable = true;
-            openFirewall = true;
-            unifiPackage = pkgs.unifi8;
-            mongodbPackage = pkgs.mongodb-6_0;
-          };
-        };
-      };
-    };
-  };
-}
--- a/nixos/boxes/home/palace/vms/sfh/default.nix
+++ b/nixos/boxes/home/palace/vms/sfh/default.nix
@@ -1,157 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.home) domain prefixes vips hiMTU roceBootModules;
-in
-{
-  imports = [ ./containers ];
-
-  config.nixos.systems.sfh = {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    home-manager = "mine";
-
-    assignments = {
-      hi = {
-        inherit domain;
-        mtu = hiMTU;
-        ipv4 = {
-          address = net.cidr.host 81 prefixes.hi.v4;
-          mask = 22;
-          gateway = vips.hi.v4;
-        };
-        ipv6 = {
-          iid = "::4:2";
-          address = net.cidr.host (65536*4+2) prefixes.hi.v6;
-        };
-      };
-    };
-
-    configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
-    let
-      inherit (lib) mapAttrs mkMerge;
-      inherit (lib.my) networkdAssignment;
-      inherit (lib.my.c) networkd;
-      inherit (lib.my.c.home) domain;
-    in
-    {
-      imports = [
-        "${modulesPath}/profiles/qemu-guest.nix"
-      ];
-
-      config = {
-        boot = {
-          kernelModules = [ "kvm-amd" ];
-          kernelParams = [ "console=ttyS0,115200n8" ];
-          initrd = {
-            availableKernelModules = [
-              "virtio_pci" "ahci" "sr_mod" "virtio_blk"
-            ] ++ roceBootModules;
-            kernelModules = [ "dm-snapshot" ];
-            systemd = {
-              network = {
-                networks = {
-                  "20-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
-                };
-              };
-            };
-          };
-        };
-
-        hardware = {
-          enableRedistributableFirmware = true;
-        };
-
-        fileSystems = {
-          "/nix" = {
-            device = "/dev/main/nix";
-            fsType = "ext4";
-          };
-          "/persist" = {
-            device = "/dev/main/persist";
-            fsType = "ext4";
-            neededForBoot = true;
-          };
-        };
-
-        networking = { inherit domain; };
-
-        services = {
-          lvm = {
-            boot.thin.enable = true;
-            dmeventd.enable = true;
-          };
-        };
-
-        systemd.network = {
-          links = {
-            "10-lan-hi" = {
-              matchConfig = {
-                Driver = "mlx5_core";
-                PermanentMACAddress = "52:54:00:ac:15:a9";
-              };
-              linkConfig = {
-                Name = "lan-hi";
-                MTUBytes = toString lib.my.c.home.hiMTU;
-              };
-            };
-            "10-lan-hi-ctrs" = {
-              matchConfig = {
-                Driver = "mlx5_core";
-                PermanentMACAddress = "52:54:00:90:34:95";
-              };
-              linkConfig = {
-                Name = "lan-hi-ctrs";
-                MTUBytes = toString lib.my.c.home.hiMTU;
-              };
-            };
-          };
-
-          networks = {
-            "30-lan-hi" = mkMerge [
-              (networkdAssignment "lan-hi" assignments.hi)
-              # So we don't drop the IP we use to connect to NVMe-oF!
-              { networkConfig.KeepConfiguration = "static"; }
-            ];
-            "30-lan-hi-ctrs" = {
-              matchConfig.Name = "lan-hi-ctrs";
-              linkConfig.RequiredForOnline = "no";
-              networkConfig = networkd.noL3;
-            };
-          };
-        };
-
-        my = {
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAAaav5Se1E/AbqEXmADryVszYfNDscyP6jrWioN57R7";
-          };
-          server.enable = true;
-
-          netboot.client = {
-            enable = true;
-          };
-          nvme = {
-            uuid = "85d7df36-0de0-431b-b06e-51f7c0a455b4";
-            boot = {
-              nqn = "nqn.2016-06.io.spdk:sfh";
-              address = "192.168.68.80";
-            };
-          };
-
-          containers.instances =
-          let
-            instances = {
-              unifi = {};
-            };
-          in
-          mkMerge [
-            instances
-            (mapAttrs (n: i: {
-              networking.macVLAN = "lan-hi-ctrs";
-            }) instances)
-          ];
-        };
-      };
-    };
-  };
-}
--- a/nixos/boxes/home/routing-common/default.nix
+++ b/nixos/boxes/home/routing-common/default.nix
@@ -227,7 +227,7 @@ in
                  networkConfig = networkd.noL3;
                  extraConfig = ''
                    [CAKE]
-                    Bandwidth=490M
+                    Bandwidth=235M
                    RTTSec=50ms
                    PriorityQueueingPreset=besteffort
                    # DOCSIS preset
@@ -251,7 +251,7 @@ in
                    extraConfig = ''
                      [CAKE]
                      Parent=root
-                      Bandwidth=48M
+                      Bandwidth=24M
                      RTTSec=50ms
                    '';
                  }
@@ -276,7 +276,7 @@ in
                  {
                    matchConfig.Name = "as211024";
                    networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                      {
                        Destination = lib.my.c.colony.prefixes.all.v4;
                        Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -301,7 +301,7 @@ in

              {
                "60-lan-hi" = {
-                  routes = [
+                  routes = map (r: { routeConfig = r; }) [
                    {
                      Destination = elemAt routersPubV4 otherIndex;
                      Gateway = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
@@ -401,6 +401,11 @@ in
                }
              '';
            };
+            netboot.server = {
+              enable = true;
+              ip = vips.lo.v4;
+              host = "boot.${domain}";
+            };
          };
        };
      };
--- a/nixos/boxes/home/routing-common/dns.nix
+++ b/nixos/boxes/home/routing-common/dns.nix
@@ -170,9 +170,9 @@ in
              hostname = "${otherName}.${config.networking.domain}";
              server = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
            }}
-            ${elemAt routers 0} IN AAAA ${allAssignments."${elemAt routers 0}".as211024.ipv6.address}
-            ${elemAt routers 1} IN AAAA ${allAssignments."${elemAt routers 1}".as211024.ipv6.address}
-            boot IN CNAME river-hi.${config.networking.domain}.
+            ${elemAt routers 0} IN AAAA ${net.cidr.host 1 prefixes.hi.v6}
+            ${elemAt routers 1} IN AAAA ${net.cidr.host 2 prefixes.hi.v6}
+            boot IN CNAME router-hi.${config.networking.domain}.

            @ IN NS ns1
            @ IN NS ns2
@@ -199,7 +199,7 @@ in
            shytzel IN A ${net.cidr.host 12 prefixes.core.v4}

            wave IN A ${net.cidr.host 12 prefixes.hi.v4}
-            ; wave IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
+            wave IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
            vibe IN A ${net.cidr.host 13 prefixes.hi.v4}
            vibe IN AAAA ${net.cidr.host (65536+4) prefixes.hi.v6}

--- a/nixos/boxes/home/routing-common/kea.nix
+++ b/nixos/boxes/home/routing-common/kea.nix
@@ -1,7 +1,7 @@
-index: { lib, pkgs, config, assignments, allAssignments, ... }:
+index: { lib, pkgs, config, assignments, ... }:
 let
  inherit (lib) mkForce;
-  inherit (lib.my) net netbootKeaClientClasses;
+  inherit (lib.my) net;
  inherit (lib.my.c.home) domain prefixes vips hiMTU;

  dns-servers = [
@@ -63,14 +63,7 @@ in
              always-send = true;
            }
          ];
-          client-classes = netbootKeaClientClasses {
-            tftpIP = allAssignments.river.lo.ipv4.address;
-            hostname = "boot.${domain}";
-            systems = {
-              sfh = "52:54:00:a5:7e:93";
-              castle = "c8:7f:54:6e:17:0f";
-            };
-          };
+          client-classes = config.my.netboot.server.keaClientClasses;
          subnet4 = [
            {
              id = 1;
--- a/nixos/boxes/home/routing-common/keepalived.nix
+++ b/nixos/boxes/home/routing-common/keepalived.nix
@@ -36,6 +36,10 @@ let
    virtualRouterId = routerId;
    virtualIps = vrrpIPs family;
    trackScripts = [ "${family}Alive" ];
+    extraConfig = ''
+      notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
+      notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
+    '';
  };
 in
 {
@@ -62,12 +66,7 @@ in
      };
      vrrpInstances = {
        v4 = mkVRRP "v4" 51;
-        v6 = (mkVRRP "v6" 52) // {
-          extraConfig = ''
-            notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
-            notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
-          '';
-        };
+        v6 = mkVRRP "v6" 52;
      };
      # Actually disable this for now, don't want to fault IPv4 just because IPv6 is broken...
      # extraConfig = ''
--- a/nixos/boxes/home/stream.nix
+++ b/nixos/boxes/home/stream.nix
@@ -43,38 +43,6 @@
          };
        };

-        services = {
-          mjpg-streamer = {
-            enable = true;
-            inputPlugin = "input_uvc.so";
-            outputPlugin = "output_http.so -w @www@ -n -p 5050";
-          };
-          octoprint = {
-            enable = true;
-            host = "::";
-            extraConfig = {
-              plugins = {
-                classicwebcam = {
-                  snapshot = "/webcam/?action=snapshot";
-                  stream = "/webcam/?action=stream";
-                  streamRatio = "4:3";
-                };
-              };
-              serial = {
-                port = "/dev/ttyACM0";
-                baudrate = 115200;
-              };
-              temperature.profiles = [
-                {
-                  bed = 60;
-                  extruder = 215;
-                  name = "PLA";
-                }
-              ];
-            };
-          };
-        };
-
        systemd.network = {
          netdevs = {
            "25-lan" = {
--- a/nixos/boxes/kelder/containers/acquisition/default.nix
+++ b/nixos/boxes/kelder/containers/acquisition/default.nix
@@ -26,7 +26,7 @@ in

      config = {
        # Hardware acceleration for Jellyfin
-        hardware.graphics = {
+        hardware.opengl = {
          enable = true;
          extraPackages = with pkgs; [
            vaapiIntel
@@ -78,14 +78,6 @@ in
          };
        };

-        nixpkgs.config.permittedInsecurePackages = [
-          # FIXME: This is needed for Sonarr
-          "aspnetcore-runtime-wrapped-6.0.36"
-          "aspnetcore-runtime-6.0.36"
-          "dotnet-sdk-wrapped-6.0.428"
-          "dotnet-sdk-6.0.428"
-        ];
-
        services = {
          transmission = {
            enable = true;
--- a/nixos/boxes/kelder/containers/acquisition/networking.nix
+++ b/nixos/boxes/kelder/containers/acquisition/networking.nix
@@ -73,12 +73,14 @@ in
              RouteTable = routeTable;
            };
            wireguardPeers = [
-              # AirVPN IE
              {
-                Endpoint = "146.70.94.2:1637";
-                PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
-                PresharedKeyFile = config.age.secrets."${pskFile}".path;
-                AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                # AirVPN IE
+                wireguardPeerConfig = {
+                  Endpoint = "146.70.94.2:1637";
+                  PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
+                  PresharedKeyFile = config.age.secrets."${pskFile}".path;
+                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                };
              }
            ];
          };
@@ -95,7 +97,7 @@ in
              matchConfig.Name = "vpn";
              address = [ "10.161.170.28/32" "fd7d:76ee:e68f:a993:b12d:6d15:c80a:9516/128" ];
              dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = [
+              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                {
                  Family = "both";
                  SuppressPrefixLength = 0;
--- a/nixos/boxes/kelder/default.nix
+++ b/nixos/boxes/kelder/default.nix
@@ -121,7 +121,8 @@ in

            samba = {
              enable = true;
-              settings = {
+              enableNmbd = true;
+              shares = {
                storage = {
                  path = "/mnt/storage";
                  browseable = "yes";
@@ -130,8 +131,6 @@ in
                  "directory mask" = "0775";
                };
              };
-
-              nmbd.enable = true;
            };
            samba-wsdd.enable = true;

@@ -181,10 +180,12 @@ in
                  };
                  wireguardPeers = [
                    {
-                      PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
-                      Endpoint = "${allAssignments.estuary.internal.ipv4.address}:${toString lib.my.c.kelder.vpn.port}";
-                      AllowedIPs = [ "0.0.0.0/0" ];
-                      PersistentKeepalive = 25;
+                      wireguardPeerConfig = {
+                        PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
+                        Endpoint = "${allAssignments.estuary.internal.ipv4.address}:${toString lib.my.c.kelder.vpn.port}";
+                        AllowedIPs = [ "0.0.0.0/0" ];
+                        PersistentKeepalive = 25;
+                      };
                    }
                  ];
                };
@@ -212,7 +213,7 @@ in
                  address = with assignments.estuary; [
                    (with ipv4; "${address}/${toString mask}")
                  ];
-                  routingPolicyRules = [
+                  routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                    {
                      Family = "both";
                      SuppressPrefixLength = 0;
--- a/nixos/boxes/tower/default.nix
+++ b/nixos/boxes/tower/default.nix
@@ -14,7 +14,7 @@
          cpu = {
            intel.updateMicrocode = true;
          };
-          graphics.extraPackages = with pkgs; [
+          opengl.extraPackages = with pkgs; [
            intel-media-driver
          ];
          bluetooth.enable = true;
@@ -177,7 +177,7 @@
              programs = {
                fish = {
                  shellAbbrs = {
-                    tsup = "doas tailscale up --login-server=https://hs.nul.ie --accept-routes";
+                    tsup = "doas tailscale up --login-server=https://ts.nul.ie --accept-routes";
                  };
                };
              };
--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -35,7 +35,7 @@ let
      system = null;

      # Put the inputs in specialArgs to avoid infinite recursion when modules try to do imports
-      specialArgs = { inherit self inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
+      specialArgs = { inherit inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };

      # `baseModules` informs the manual which modules to document
      baseModules =
--- a/nixos/installer.nix
+++ b/nixos/installer.nix
@@ -61,8 +61,8 @@
          };

          networking = {
-            # Will be set dynamically, but need something to satisfy `/etc/os-release` stuff
-            hostName = "installer";
+            # Will be set dynamically
+            hostName = "";
            useNetworkd = false;
          };

@@ -82,8 +82,6 @@
                ${pkgs.gawk}/bin/awk '{ print $1 }')"
            '';

-          boot.supportedFilesystems.nfs = true;
-
          environment.systemPackages = with pkgs; [
            dhcpcd
            lm_sensors
--- a/nixos/modules/build.nix
+++ b/nixos/modules/build.nix
@@ -52,9 +52,9 @@ let
      ({ pkgs, config, ... }: {
        boot = {
          loader.grub.enable = false;
+          kernelParams = [ "console=ttyS0,115200n8" ];
          initrd = {
            kernelModules = [ "nbd" ];
-            availableKernelModules = [ "igb" "igc" ];

            systemd = {
              storePaths = with pkgs; [
@@ -68,8 +68,8 @@ let
                nbd-client = "${nbd}/bin/nbd-client";
              };
              extraConfig = ''
-                DefaultTimeoutStartSec=20
-                DefaultDeviceTimeoutSec=20
+                DefaultTimeoutStartSec=10
+                DefaultDeviceTimeoutSec=10
              '';

              network = {
@@ -178,8 +178,18 @@ let
            }
          ];
          netbootArchive = pkgs.runCommand "netboot-${config.system.name}.tar.zst" { } ''
-            export PATH=${pkgs.zstd}/bin:$PATH
-            ${pkgs.gnutar}/bin/tar --dereference --zstd -cvC ${config.system.build.netbootTree} -f "$out" .
+            add() {
+              ${pkgs.gnutar}/bin/tar --dereference --zstd -rvC "$1" -f "$out" "$2"
+            }
+
+            add "${config.system.build.kernel}" "${config.system.boot.loader.kernelFile}"
+            add "${config.system.build.initialRamdisk}" initrd
+
+            tmpdir="$(mktemp -d rootImage.XXXXXX)"
+            ln -s "${config.system.build.rootImage}" "$tmpdir"/rootfs.ext4
+            add "$tmpdir" rootfs.ext4
+
+            add "${config.system.build.netbootScript}" boot.ipxe
          '';
        };
      })
--- a/nixos/modules/common.nix
+++ b/nixos/modules/common.nix
@@ -1,4 +1,4 @@
-{ lib, pkgsFlake, pkgs, pkgs', self, inputs, config, ... }:
+{ lib, pkgsFlake, pkgs, pkgs', inputs, config, ... }:
 let
  inherit (lib) mkIf mkDefault mkMerge;
  inherit (lib.my) mkDefault';
@@ -12,6 +12,7 @@ in
    inputs.impermanence.nixosModule
    inputs.ragenix.nixosModules.age
    inputs.sharry.nixosModules.default
+    inputs.attic.nixosModules.atticd
  ];

  config = mkMerge [
@@ -40,7 +41,6 @@ in

      nix = {
        package = pkgs'.mine.nix;
-        channel.enable = false;
        settings = with lib.my.c.nix; {
          trusted-users = [ "@wheel" ];
          experimental-features = [ "nix-command" "flakes" "ca-derivations" ];
@@ -127,9 +127,6 @@ in
        };
      };

-      environment.etc = {
-        "nixos/flake.nix".source = "/run/nixfiles/flake.nix";
-      };
      environment.systemPackages = with pkgs; mkMerge [
        [
          bash-completion
@@ -145,10 +142,7 @@ in
        fish.enable = mkDefault true;
        # TODO: This is expecting to look up the channel for the database...
        command-not-found.enable = mkDefault false;
-        vim = {
-          enable = true;
-          defaultEditor = true;
-        };
+        vim.defaultEditor = true;
      };

      services = {
@@ -215,35 +209,14 @@ in
            # python.d plugin script does #!/usr/bin/env bash
            path = with pkgs; [ bash ];
          };
-
-          nixfiles-mutable = {
-            description = "Mutable nixfiles";
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-            };
-
-            path = with pkgs; [ util-linux ];
-            script = ''
-              nixfilesDir="${self}"
-
-              mkdir -p /run/nixfiles{,/.rw,/.work}
-              mount -t overlay overlay -o lowerdir="$nixfilesDir",upperdir=/run/nixfiles/.rw,workdir=/run/nixfiles/.work /run/nixfiles
-              chmod -R u+w /run/nixfiles
-            '';
-            preStop = ''
-              umount /run/nixfiles
-              rm -rf /run/nixfiles
-            '';
-
-            wantedBy = [ "multi-user.target" ];
-          };
        };
      };
    }
    (mkIf config.services.kmscon.enable {
      fonts.fonts = with pkgs; [
-        nerd-fonts.sauce-code-pro
+        (nerdfonts.override {
+          fonts = [ "SourceCodePro" ];
+        })
      ];
    })
  ];
--- a/nixos/modules/containers.nix
+++ b/nixos/modules/containers.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, options, config, systems, ... }:
 let
-  inherit (builtins) attrNames attrValues all hashString toJSON any;
+  inherit (builtins) attrNames attrValues all hashString toJSON;
  inherit (lib)
    groupBy' mapAttrsToList optionalString optional concatMapStringsSep filterAttrs mkOption mkDefault mkIf mkMerge;
  inherit (lib.my) mkOpt' mkBoolOpt';
@@ -98,7 +98,6 @@ let
      };
      networking = {
        bridge = mkOpt' (nullOr str) null "Network bridge to connect to.";
-        macVLAN = mkOpt' (nullOr str) null "Network interface to make MACVLAN interface from.";
      };
    };
  };
@@ -116,17 +115,13 @@ in
          assertion = config.systemd.network.enable;
          message = "Containers currently require systemd-networkd!";
        }
-        {
-          assertion = all (i: i.networking.bridge == null || i.networking.macVLAN == null) (attrValues cfg.instances);
-          message = "Only bridge OR MACVLAN can be set";
-        }
      ];

      # TODO: Better security
      my.firewall.trustedInterfaces =
        mapAttrsToList
          (n: _: "ve-${n}")
-          (filterAttrs (_: c: c.networking.bridge == null && c.networking.macVLAN == null) cfg.instances);
+          (filterAttrs (_: c: c.networking.bridge == null) cfg.instances);

      systemd = mkMerge (mapAttrsToList (n: c: {
        nspawn."${n}" = {
@@ -159,8 +154,6 @@ in
          };
          networkConfig = if (c.networking.bridge != null) then {
            Bridge = c.networking.bridge;
-          } else if (c.networking.macVLAN != null) then {
-            MACVLAN = "${c.networking.macVLAN}:host0";
          } else {
            VirtualEthernet = true;
          };
--- a/nixos/modules/gui.nix
+++ b/nixos/modules/gui.nix
@@ -12,7 +12,7 @@ in

  config = mkIf cfg.enable {
    hardware = {
-      graphics.enable = mkDefault true;
+      opengl.enable = mkDefault true;
    };

    systemd = {
@@ -53,8 +53,6 @@ in
          SUBSYSTEM=="usb", ATTR{idVendor}=="057e", MODE="0664", GROUP="wheel"
          # FT
          SUBSYSTEM=="usb", ATTR{idVendor}=="0403", MODE="0664", GROUP="wheel"
-          # /dev/player0
-          SUBSYSTEM=="usb", ATTR{idVendor}=="6969", MODE="0664", GROUP="wheel"
        '';
      };
    };
--- a/nixos/modules/l2mesh.nix
+++ b/nixos/modules/l2mesh.nix
@@ -44,8 +44,10 @@ let
      toString (mesh.baseMTU - overhead);

      bridgeFDBs = mapAttrsToList (n: peer: {
-        MACAddress = "00:00:00:00:00:00";
-        Destination = peer.addr;
+        bridgeFDBConfig = {
+          MACAddress = "00:00:00:00:00:00";
+          Destination = peer.addr;
+        };
      }) otherPeers;
    };
  };
--- a/nixos/modules/netboot/default.nix
+++ b/nixos/modules/netboot/default.nix
@@ -1,23 +1,14 @@
-{ lib, pkgs, config, ... }:
+{ lib, pkgs, config, systems, ... }:
 let
-  inherit (lib) mkMerge mkIf mkForce genAttrs concatMapStringsSep;
+  inherit (lib) mkMerge mkIf mkForce mkOption;
  inherit (lib.my) mkOpt' mkBoolOpt';

  cfg = config.my.netboot;

-  ipxe = pkgs.ipxe.overrideAttrs (o: rec {
-    version = "1.21.1-unstable-2024-06-27";
-    src = pkgs.fetchFromGitHub {
-      owner = "ipxe";
-      repo = "ipxe";
-      rev = "b66e27d9b29a172a097c737ab4d378d60fe01b05";
-      hash = "sha256-TKZ4WjNV2oZIYNefch7E7m1JpeoC/d7O1kofoNv8G40=";
-    };
-  });
  tftpRoot = pkgs.linkFarm "tftp-root" [
    {
      name = "ipxe-x86_64.efi";
-      path = "${ipxe}/ipxe.efi";
+      path = "${pkgs.ipxe}/ipxe.efi";
    }
  ];
  menuFile = pkgs.runCommand "menu.ipxe" {
@@ -25,89 +16,31 @@ let
  } ''
    substituteAll ${./menu.ipxe} "$out"
  '';
-
-  bootBuilder = pkgs.substituteAll {
-    src = ./netboot-loader-builder.py;
-    isExecutable = true;
-
-    inherit (pkgs) python3;
-    bootspecTools = pkgs.bootspec;
-    nix = config.nix.package.out;
-
-    inherit (config.system.nixos) distroName;
-    systemName = config.system.name;
-    inherit (cfg.client) configurationLimit;
-    checkMountpoints = pkgs.writeShellScript "check-mountpoints" ''
-      if ! ${pkgs.util-linuxMinimal}/bin/findmnt /boot > /dev/null; then
-        echo "/boot is not a mounted partition. Is the path configured correctly?" >&2
-        exit 1
-      fi
-    '';
-  };
 in
 {
  options.my.netboot = with lib.types; {
    client = {
      enable = mkBoolOpt' false "Whether network booting should be enabled.";
-      configurationLimit = mkOpt' ints.unsigned 10 "Max generations to show in boot menu.";
    };
    server = {
      enable = mkBoolOpt' false "Whether a netboot server should be enabled.";
      ip = mkOpt' str null "IP clients should connect to via TFTP.";
-      host = mkOpt' str config.networking.fqdn "Hostname clients should connect to over HTTP / NFS.";
-      allowedPrefixes = mkOpt' (listOf str) null "Prefixes clients should be allowed to connect from (NFS).";
+      host = mkOpt' str config.networking.fqdn "Hostname clients should connect to over HTTP.";
      installer = {
        storeSize = mkOpt' str "16GiB" "Total allowed writable size of store.";
      };
      instances = mkOpt' (listOf str) [ ] "Systems to hold boot files for.";
+      keaClientClasses = mkOption {
+        type = listOf (attrsOf str);
+        description = "Kea client classes for PXE boot.";
+        readOnly = true;
+      };
    };
  };

  config = mkMerge [
    (mkIf cfg.client.enable {
-      systemd = {
-        services = {
-          mount-boot = {
-            description = "Mount /boot";
-            after = [ "systemd-networkd-wait-online.service" ];
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-            };
-            path = with pkgs; [ gnused ldns nfs-utils ];
-            script = ''
-              get_cmdline() {
-                sed -rn "s/^.*$1=(\\S+).*\$/\\1/p" < /proc/cmdline
-              }
-
-              host="$(get_cmdline boothost)"
-              if [ -z "$host" ]; then
-                echo "boothost kernel parameter not found!" >&2
-                exit 1
-              fi
-
-              until [ -n "$(drill -Q $host)" ]; do
-                sleep 0.1
-              done
-
-              mkdir -p /boot
-              mount.nfs $host:/srv/netboot/systems/${config.system.name} /boot
-            '';
-
-            wantedBy = [ "remote-fs.target" ];
-          };
-        };
-      };
-
-      boot.supportedFilesystems.nfs = true;
-      boot.loader = {
-        grub.enable = false;
-        systemd-boot.enable = false;
-      };
-      system = {
-        build.installBootLoader = bootBuilder;
-        boot.loader.id = "ipxe-netboot";
-      };
+      # TODO: Implement!
    })
    (mkIf cfg.server.enable {
      environment = {
@@ -118,23 +51,16 @@ in
      };

      systemd = {
-        tmpfiles.settings."10-netboot" = genAttrs
-          (map (i: "/srv/netboot/systems/${i}") cfg.server.instances)
-          (p: {
-            d = {
-              user = "root";
-              group = "root";
-              mode = "0777";
-            };
-          });
-
        services = {
          netboot-update = {
            description = "Update netboot images";
            after = [ "systemd-networkd-wait-online.service" ];
-            serviceConfig.Type = "oneshot";
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
            path = with pkgs; [
-              coreutils curl jq zstd gnutar
+              coreutils curl jq gnutar
            ];
            script = ''
              update_nixos() {
@@ -161,7 +87,7 @@ in
              cd /srv/netboot

              ln -sf ${menuFile} boot.ipxe
-              ln -sf "${pkgs.edk2-uefi-shell}/shell.efi" "efi-shell-${config.nixpkgs.localSystem.linuxArch}.efi"
+              ln -sf "${pkgs.edk2-uefi-shell}/efi-shell-${config.nixpkgs.localSystem.linuxArch}.efi"
              update_nixos
            '';
            startAt = "06:00";
@@ -210,15 +136,6 @@ in
            };
          };
        };
-
-        nfs = {
-          server = {
-            enable = true;
-            exports = ''
-              /srv/netboot/systems ${concatMapStringsSep " " (p: "${p}(rw,all_squash)") cfg.server.allowedPrefixes}
-            '';
-          };
-        };
      };

      my = {
@@ -226,6 +143,22 @@ in
          "/srv/netboot"
          { directory = "/var/cache/netboot"; mode = "0700"; }
        ];
+        netboot.server.keaClientClasses = [
+          {
+            name = "ipxe";
+            test = "substring(option[user-class].hex, 0, 4) == 'iPXE'";
+            next-server = cfg.server.ip;
+            server-hostname = cfg.server.host;
+            boot-file-name = "http://${cfg.server.host}/boot.ipxe";
+          }
+          {
+            name = "efi-x86_64";
+            test = "option[client-system].hex == 0x0007";
+            next-server = cfg.server.ip;
+            server-hostname = cfg.server.host;
+            boot-file-name = "ipxe-x86_64.efi";
+          }
+        ];
      };
    })
  ];
--- a/nixos/modules/netboot/netboot-loader-builder.py
+++ b/nixos/modules/netboot/netboot-loader-builder.py
@@ -1,280 +0,0 @@
-#! @python3@/bin/python3 -B
-# Based on `nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py`
-import argparse
-import datetime
-import glob
-import os
-import os.path
-import shutil
-import subprocess
-import sys
-import json
-from typing import NamedTuple, Dict, List
-from dataclasses import dataclass
-
-BOOT_MOUNT_POINT = '/boot'
-STORE_DIR = 'nix'
-
-# These values will be replaced with actual values during the package build
-BOOTSPEC_TOOLS = '@bootspecTools@'
-NIX = '@nix@'
-DISTRO_NAME = '@distroName@'
-SYSTEM_NAME = '@systemName@'
-CONFIGURATION_LIMIT = int('@configurationLimit@')
-CHECK_MOUNTPOINTS = "@checkMountpoints@"
-
-@dataclass
-class BootSpec:
-  init: str
-  initrd: str
-  kernel: str
-  kernelParams: List[str]
-  label: str
-  system: str
-  toplevel: str
-  specialisations: Dict[str, 'BootSpec']
-  sortKey: str
-  initrdSecrets: str | None = None
-
-class SystemIdentifier(NamedTuple):
-  profile: str | None
-  generation: int
-  specialisation: str | None
-
-def copy_if_not_exists(source: str, dest: str) -> None:
-  if not os.path.exists(dest):
-    shutil.copyfile(source, dest)
-
-def generation_dir(profile: str | None, generation: int) -> str:
-  if profile:
-    return f'/nix/var/nix/profiles/system-profiles/{profile}-{generation}-link'
-  else:
-    return f'/nix/var/nix/profiles/system-{generation}-link'
-
-def system_dir(i: SystemIdentifier) -> str:
-  d = generation_dir(i.profile, i.generation)
-  if i.specialisation:
-    return os.path.join(d, 'specialisation', i.specialisation)
-  else:
-    return d
-
-def entry_key(i: SystemIdentifier) -> str:
-  pieces = [
-    'nixos',
-    i.profile or None,
-    'generation',
-    str(i.generation),
-    f'specialisation-{i.specialisation}' if i.specialisation else None,
-  ]
-  return '-'.join(p for p in pieces if p)
-
-def bootspec_from_json(bootspec_json: Dict) -> BootSpec:
-  specialisations = bootspec_json['org.nixos.specialisation.v1']
-  specialisations = {k: bootspec_from_json(v) for k, v in specialisations.items()}
-  systemdBootExtension = bootspec_json.get('org.nixos.systemd-boot', {})
-  sortKey = systemdBootExtension.get('sortKey', 'nixos')
-  return BootSpec(
-    **bootspec_json['org.nixos.bootspec.v1'],
-    specialisations=specialisations,
-    sortKey=sortKey
-  )
-
-bootspecs = {}
-def get_bootspec(profile: str | None, generation: int) -> BootSpec:
-  k = (profile, generation)
-  if k in bootspecs:
-    return bootspecs[k]
-
-  system_directory = system_dir(SystemIdentifier(profile, generation, None))
-  boot_json_path = os.path.realpath(f'{system_directory}/boot.json')
-  if os.path.isfile(boot_json_path):
-    boot_json_f = open(boot_json_path, 'r')
-    bootspec_json = json.load(boot_json_f)
-  else:
-    boot_json_str = subprocess.check_output([
-      f'{BOOTSPEC_TOOLS}/bin/synthesize',
-      '--version',
-      '1',
-      system_directory,
-      '/dev/stdout',
-    ],
-    universal_newlines=True)
-    bootspec_json = json.loads(boot_json_str)
-
-  bs = bootspec_from_json(bootspec_json)
-  bootspecs[k] = bs
-  return bs
-
-def copy_from_file(file: str, dry_run: bool = False) -> str:
-  store_file_path = os.path.realpath(file)
-  suffix = os.path.basename(store_file_path)
-  store_dir = os.path.basename(os.path.dirname(store_file_path))
-  dst_path = f'/{STORE_DIR}/{store_dir}-{suffix}'
-  if not dry_run:
-    copy_if_not_exists(store_file_path, f'{BOOT_MOUNT_POINT}{dst_path}')
-  return dst_path
-
-MENU_ITEM = 'item {gen_key} {title} Generation {generation} {description}'
-
-BOOT_ENTRY = ''':{gen_key}
-kernel ${{server}}/systems/{system_name}{kernel} {kernel_params} boothost=${{boothost}}
-initrd ${{server}}/systems/{system_name}{initrd}
-boot
-'''
-
-def gen_entry(i: SystemIdentifier) -> (str, str):
-  bootspec = get_bootspec(i.profile, i.generation)
-  if i.specialisation:
-    bootspec = bootspec.specialisations[i.specialisation]
-  kernel = copy_from_file(bootspec.kernel)
-  initrd = copy_from_file(bootspec.initrd)
-
-  gen_key = entry_key(i)
-  title = '{name}{profile}{specialisation}'.format(
-    name=DISTRO_NAME,
-    profile=' [' + i.profile + ']' if i.profile else '',
-    specialisation=f' ({i.specialisation})' if i.specialisation else '')
-
-  kernel_params = f'init={bootspec.init} '
-
-  kernel_params = kernel_params + ' '.join(bootspec.kernelParams)
-  build_time = int(os.path.getctime(system_dir(i)))
-  build_date = datetime.datetime.fromtimestamp(build_time).strftime('%F')
-
-  return MENU_ITEM.format(
-    gen_key=gen_key,
-    title=title,
-    description=f'{bootspec.label}, built on {build_date}',
-    generation=i.generation,
-  ), BOOT_ENTRY.format(
-    gen_key=gen_key,
-    generation=i.generation,
-    system_name=SYSTEM_NAME,
-    kernel=kernel,
-    kernel_params=kernel_params,
-    initrd=initrd,
-  )
-
-def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
-  gen_list = subprocess.check_output([
-    f'{NIX}/bin/nix-env',
-    '--list-generations',
-    '-p',
-    '/nix/var/nix/profiles/' + ('system-profiles/' + profile if profile else 'system')],
-    universal_newlines=True)
-  gen_lines = gen_list.split('\n')
-  gen_lines.pop()
-
-  configurationLimit = CONFIGURATION_LIMIT
-  configurations = [
-    SystemIdentifier(
-      profile=profile,
-      generation=int(line.split()[0]),
-      specialisation=None
-    )
-    for line in gen_lines
-  ]
-  return configurations[-configurationLimit:]
-
-def remove_old_files(gens: list[SystemIdentifier]) -> None:
-  known_paths = []
-  for gen in gens:
-    bootspec = get_bootspec(gen.profile, gen.generation)
-    known_paths.append(copy_from_file(bootspec.kernel, True))
-    known_paths.append(copy_from_file(bootspec.initrd, True))
-  for path in glob.iglob(f'{BOOT_MOUNT_POINT}/{STORE_DIR}/*'):
-    if not path in known_paths and not os.path.isdir(path):
-      os.unlink(path)
-
-def get_profiles() -> list[str]:
-  if os.path.isdir('/nix/var/nix/profiles/system-profiles/'):
-    return [x
-      for x in os.listdir('/nix/var/nix/profiles/system-profiles/')
-      if not x.endswith('-link')]
-  else:
-    return []
-
-MENU = '''#!ipxe
-# Server hostname option
-set boothost ${{66:string}}
-set server http://${{boothost}}
-
-:start
-menu {distro} boot menu
-item --gap -- Generations
-{generation_items}
-item --gap -- Other
-item --key m main Main netboot menu
-choose --timeout 5000 --default {menu_default} selected || goto cancel
-goto ${{selected}}
-
-:cancel
-shell
-goto start
-
-:error
-echo Booting failed, dropping to shell
-shell
-goto start
-
-:main
-chain ${{server}}/boot.ipxe || goto error
-'''
-
-def write_menu(gens: list[SystemIdentifier], default: SystemIdentifier) -> None:
-  gen_menu_items = []
-  gen_cmds = []
-
-  for g in gens:
-    bootspec = get_bootspec(g.profile, g.generation)
-    specialisations = [
-      SystemIdentifier(profile=g.profile, generation=g.generation, specialisation=s) for s in bootspec.specialisations]
-    for i in [g] + specialisations:
-      mi, cmds = gen_entry(i)
-      gen_menu_items.append(mi)
-      gen_cmds.append(cmds)
-
-  menu_file = f'{BOOT_MOUNT_POINT}/menu.ipxe'
-  with open(f'{menu_file}.tmp', 'w') as f:
-    f.write(MENU.format(
-      distro=DISTRO_NAME,
-      generation_items='\n'.join(gen_menu_items),
-      menu_default=entry_key(default),
-    ))
-
-    print(file=f)
-    print('\n\n'.join(gen_cmds), file=f)
-
-  os.rename(f'{menu_file}.tmp', menu_file)
-
-def install_bootloader(args: argparse.Namespace) -> None:
-  os.makedirs(f'{BOOT_MOUNT_POINT}/{STORE_DIR}', exist_ok=True)
-
-  gens = get_generations()
-  for profile in get_profiles():
-    gens += get_generations(profile)
-
-  gens = sorted(gens, key=lambda g: entry_key(g), reverse=True)
-
-  remove_old_files(gens)
-
-  for g in gens:
-    if os.path.dirname(get_bootspec(g.profile, g.generation).init) == os.path.realpath(args.default_config):
-      default = g
-      break
-  else:
-    assert False, 'No default generation found'
-
-  write_menu(gens, default)
-
-def main() -> None:
-  parser = argparse.ArgumentParser(description=f'Update {DISTRO_NAME}-related netboot files')
-  parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help=f'The default {DISTRO_NAME} config to boot')
-  args = parser.parse_args()
-
-  subprocess.check_call(CHECK_MOUNTPOINTS)
-
-  install_bootloader(args)
-
-if __name__ == '__main__':
-  main()
--- a/nixos/modules/nvme/default.nix
+++ b/nixos/modules/nvme/default.nix
@@ -5,15 +5,7 @@ let

  cfg = config.my.nvme;
  nvme-cli = pkgs.nvme-cli.override {
-    libnvme = pkgs.libnvme.overrideAttrs (o: rec {
-      # TODO: Remove when 1.11.1 releases (see https://github.com/linux-nvme/libnvme/pull/914)
-      version = "1.11.1";
-      src = pkgs.fetchFromGitHub {
-        owner = "linux-nvme";
-        repo = "libnvme";
-        rev = "v${version}";
-        hash = "sha256-CEGr7PDOVRi210XvICH8iLYDKn8S9bGruBO4tycvsT8=";
-      };
+    libnvme = pkgs.libnvme.overrideAttrs (o: {
      patches = (if (o ? patches) then o.patches else [ ]) ++ [ ./libnvme-hostconf.patch ];
    });
  };
@@ -41,43 +33,24 @@ in
      etc = etc "";
    };

-    boot = mkIf (cfg.boot.nqn != null) {
-      initrd = {
-        availableKernelModules = [ "rdma_cm" "iw_cm" "ib_cm" "nvme_core" "nvme_rdma" ];
-        kernelModules = [ "nvme-fabrics" ];
-        systemd = {
-          contents = etc "/etc/";
-          extraBin = with pkgs; {
-            dmesg = "${util-linux}/bin/dmesg";
-            ip = "${iproute2}/bin/ip";
-            nvme = "${nvme-cli}/bin/nvme";
-          };
-          extraConfig = ''
-            DefaultTimeoutStartSec=20
-            DefaultDeviceTimeoutSec=20
-          '';
+    boot.initrd.systemd = mkIf (cfg.boot.nqn != null) {
+      contents = etc "/etc/";
+      extraBin.nvme = "${nvme-cli}/bin/nvme";

-          network = {
-            enable = true;
-            wait-online.enable = true;
-          };
+      services.connect-nvme = {
+        description = "Connect NVMe-oF";
+        before = [ "initrd-root-device.target" ];
+        after = [ "systemd-networkd-wait-online.service" ];
+        requires = [ "systemd-networkd-wait-online.service" ];

-          services.connect-nvme = {
-            description = "Connect NVMe-oF";
-            before = [ "initrd-root-device.target" ];
-            after = [ "systemd-networkd-wait-online.service" ];
-            requires = [ "systemd-networkd-wait-online.service" ];
-
-            serviceConfig = {
-              Type = "oneshot";
-              ExecStart = "${nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn}";
-              Restart = "on-failure";
-              RestartSec = 10;
-            };
-
-            wantedBy = [ "initrd-root-device.target" ];
-          };
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn}";
+          Restart = "on-failure";
+          RestartSec = 10;
        };
+
+        wantedBy = [ "initrd-root-device.target" ];
      };
    };
  };
--- a/nixos/modules/tmproot.nix
+++ b/nixos/modules/tmproot.nix
@@ -147,15 +147,6 @@ in
            "/var/lib/systemd"

            { directory = "/root/.cache/nix"; mode = "0700"; }
-            # Including these unconditionally due to infinite recursion problems...
-            {
-              directory = "/etc/lvm/archive";
-              mode = "0700";
-            }
-            {
-              directory = "/etc/lvm/backup";
-              mode = "0700";
-            }
          ];
          files = [
            "/etc/machine-id"
@@ -269,6 +260,18 @@ in
        my.tmproot.persistence.config.files =
          concatMap (k: [ k.path "${k.path}.pub" ]) config.services.openssh.hostKeys;
      })
+      (mkIf config.services.lvm.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/etc/lvm/archive";
+            mode = "0700";
+          }
+          {
+            directory = "/etc/lvm/backup";
+            mode = "0700";
+          }
+        ];
+      })
      (mkIf (config.security.acme.certs != { }) {
        my.tmproot.persistence.config.directories = [
          {
@@ -520,37 +523,6 @@ in
          group = "mautrix-meta";
        }) (filterAttrs (_: i: i.enable) config.services.mautrix-meta.instances);
      }
-      (mkIf config.services.unifi.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/unifi";
-            mode = "0750";
-            user = "unifi";
-            group = "unifi";
-          }
-          {
-            directory = "/var/cache/unifi";
-            mode = "0750";
-            user = "unifi";
-            group = "unifi";
-          }
-        ];
-      })
-      (persistSimpleSvc "octoprint")
-      (mkIf (config.services.borgbackup.jobs != { }) {
-        my.tmproot.persistence.config.directories = [
-          "/var/lib/borgbackup"
-          "/var/cache/borgbackup"
-        ];
-
-        services.borgbackup.package = pkgs.borgbackup.overrideAttrs (o: {
-          makeWrapperArgs = o.makeWrapperArgs ++ [
-            "--set-default BORG_BASE_DIR /var/lib/borgbackup"
-            "--set-default BORG_CONFIG_DIR /var/lib/borgbackup/config"
-            "--set-default BORG_CACHE_DIR /var/cache/borgbackup"
-          ];
-        });
-      })
    ]))
  ]);

--- a/nixos/modules/user.nix
+++ b/nixos/modules/user.nix
@@ -82,10 +82,6 @@ in
      # NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
      # passed to it
      home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
-
-      systemd.services.nixfiles-mutable.script = ''
-        chown -R ${user'.name} /run/nixfiles
-      '';
    }
    (mkIf (cfg.passwordSecret != null) {
      my = {
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -7,7 +7,8 @@ in
  monocraft' = callPackage ./monocraft.nix { };
  vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
  librespeed-go = callPackage ./librespeed-go.nix { };
-  # modrinth-app = callPackage ./modrinth-app { };
+  modrinth-app = callPackage ./modrinth-app { };
+  glfw-minecraft = callPackage ./glfw-minecraft { };
  chocolate-doom2xx = callPackage ./chocolate-doom2xx { };
  windowtolayer = callPackage ./windowtolayer.nix { };
  swaylock-plugin = callPackage ./swaylock-plugin.nix { };
--- a/pkgs/glfw-minecraft/default.nix
+++ b/pkgs/glfw-minecraft/default.nix
@@ -0,0 +1,6 @@
+{ lib, glfw-wayland-minecraft, ... }:
+glfw-wayland-minecraft.overrideAttrs (o: {
+  patches = [
+    ./suppress-wayland-errors.patch
+  ];
+})
--- a/pkgs/glfw-minecraft/suppress-wayland-errors.patch
+++ b/pkgs/glfw-minecraft/suppress-wayland-errors.patch
@@ -0,0 +1,43 @@
+diff --git a/src/wl_window.c b/src/wl_window.c
+index 7c509896..db9a6451 100644
+--- a/src/wl_window.c
+++ b/src/wl_window.c
+@@ -2115,25 +2115,21 @@ void _glfwSetWindowTitleWayland(_GLFWwindow* window, const char* title)
+ void _glfwSetWindowIconWayland(_GLFWwindow* window,
+                                int count, const GLFWimage* images)
+ {
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the window icon");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window icon\n");
+ }
+ 
+ void _glfwGetWindowPosWayland(_GLFWwindow* window, int* xpos, int* ypos)
+ {
+     // A Wayland client is not aware of its position, so just warn and leave it
+     // as (0, 0)
+-
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not provide the window position");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not provide the window position\n");
+ }
+ 
+ void _glfwSetWindowPosWayland(_GLFWwindow* window, int xpos, int ypos)
+ {
+     // A Wayland client can not set its position, so just warn
+ 
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the window position");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window position\n");
+ }
+ 
+ void _glfwGetWindowSizeWayland(_GLFWwindow* window, int* width, int* height)
+@@ -2359,8 +2355,7 @@ void _glfwRequestWindowAttentionWayland(_GLFWwindow* window)
+ 
+ void _glfwFocusWindowWayland(_GLFWwindow* window)
+ {
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the input focus");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the input focus\n");
+ }
+ 
+ void _glfwSetWindowMonitorWayland(_GLFWwindow* window,
--- a/secrets/britway/bgp-password-vultr.conf.age
+++ b/secrets/britway/bgp-password-vultr.conf.age
@@ -1,10 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBrMXND
-Zm1ma0FoNE5lWTFNTGlyeUQzdUZxMkxyVlU0cWdrcTJEakhDVXg4ClkyczJDR1FL
-eXE3QWFTM0wyeDNvL1gvcmx6eGE4elNuZW9wRHhJZ3Aya2cKLT4gWDI1NTE5IDhO
-S2JWNDhlclpERFFUTktyUG5HbnNxcVQvWmphOGp1cmNpK0NGZWVTejQKN0dybHl5
-eHhicFNpUHQ3WFZDQS90NG5VZW5zVm8rcUxCdkZkOFVqdVFzRQotPiBBLWdyZWFz
-ZSBaIDMiRCBYO1g6IF9EawpJZwotLS0geXhWb1FORm00RVJoMm4zQjhBT0hERyt3
-ekM1YXNzdTgzUTVMeHNsNDUwbwqSjgIVhg9bqtIydYC1FCA4ly2gurTcb1SUCMG8
-XA9WAx1jv05xje+U97tRTTongJEW5vw=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBJYzdr
+b1d2aEtVd3lVb3NBamRwVFpTaTRjZFlCczk4MVIwQUoxWklwN0NrCmFFekpPYUlO
+YlgvVlQ2WDR6amZDN0ZSY0Q3WWtTME5pUmhQeks1c3dGOVUKLT4gWDI1NTE5IHVK
+bUZvUVAvL0NmQzFkY3BuYm1wMjcwbFpLRUNpZjJCaW15SEVDUDV0REkKRXFMQ2d1
+NlFBejBvTlJrcUtCYWZxSDBkbmxIdExBNTU0aC8zRW5OVWllVQotPiBDLWdyZWFz
+ZSBkeC4oTFUgO0FtJG9+RyB2IF1QXGhxVwpJS213MXBRMWY1cXlHZwotLS0gRUF2
+ZkswNlhvcDhTc2tybCs1dldwa2l6SDZZVmNkNUNjNGlkV1ZVa09pOAp88dxHGxVU
+vuFQO6JcroY9MF5Te/YV+wMc3hVxksibMnH1TWGh207prwcOWNOEz2iEkZY=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/britway/cloudflare-credentials.conf.age
+++ b/secrets/britway/cloudflare-credentials.conf.age
@@ -1,17 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBjQmZr
-VDl4TVlzK0lCc0YwdFM3TEptU3Q3cWZ1d0FJQUI4Q1g1TVNyOENFCkU4NE5lYVhI
-d3B0amFJT1A1RTRSaUdUSmZ1WmU1SkVhTU9sdFZJR0p6UXcKLT4gWDI1NTE5IG5O
-RG1SQnZtSUk0SThNYkRpOHFPS29kbjdUenZyYjBBSTJKdXNUaGpYMG8KME8waXJ0
-NWR2NHoyUkN1UUJoaVRxYXVMZlNvTHZqRmYvS2h4QjZpZm5NZwotPiBPclJULlkt
-Z3JlYXNlIEVdKEBXIDUgXTBzIi58TwpweFJEcUFpR0x2WWhiVDlOTFArenhjNXBB
-dVo2d1JQWEJyVHlTRnUzdUlFUE45RWlLU3ZRS0c4UWs5Nm1qVHorCko1RVdqOVdz
-aVAwY09KOUx4WktIVFBQclFXdFJZMTNVWHNKcTZFbDU5Q0xLaExvNVdlZ0pTczUr
-SkVDTzhDUysKCi0tLSA2VGJMM2lrNkViaU0wcnArSG9PemJrQ3lrUFNnRDRVeE1p
-V3lxeG1iN3I4Ckf36lD/b7agsT0qW8eGDnxsVor8hEmLBSa35/eeAxqMd0xPvQko
-REzIxPuEHRQM5dE4s4H/mySTC/AVsiwfcMrnOXInm4o3MNAC9PREcef4NBOP3IMl
-Mcoifar27EXs21XdXw/lLOVNDX7oDKZh1zXVX4lFTcRW0v8abbwchvuTiayKePMG
-DrcyFsj4jiwpJ5MmY/Q+n0lZmoAlAJkeTHRUptJxGMq+pWVEGMa8p1vUdrVwWq7G
-YYO5lPlms01BFJfUsysh07HY1HPkOyFHeEkviZtt4N8hopx0pP4fyAZYYdrBAIdt
-CLpQFQ==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBLVlg2
+ZUdtUlFUQXBLT3B5YmkycWJnMXJyKzltbyt6K2dJK1RBUm5ydWwwCmRUdjJFSEYz
+Wnp4cGtzTXZwc0s0SUJQUjRlOUJlQUoyQ3BETXZmY0ppWG8KLT4gWDI1NTE5IGR5
+QUJzeG1DQTRLUmRwNnNSRUJRSFFtUDl5VjB0clVLYUp3R1g4TEVKaTgKb09tVlhF
+R0tmcmIxMHVHcG80RGxRTEhBcngvT3MrdnNPbmpCTlRyZW5xQQotPiA6RzEtZ3Jl
+YXNlCldSUlN2ejB0MGpyUHYzNS9OQmJTK3MvcXRDakdBVlhuUEt6SFE4QmhnWVN0
+V1JMOE1oaEp5QQotLS0gYW1OMTcxNWJrUndmR2h0ZmRDWk5CYnJjc29pSERUMnNk
+d2VhTGdpOW4yUQrEeH2E9m0YycuW60QrdlRetO1kNU5FaKXRQt46iA9lACIWD4rC
+Cx6WxhCBgz3hvm9x6iuYiiQxZzgJNK7qXcV2MBeQdivazeEbC7blAKVPhwD/dl+b
+PzBDXRXG3c3jMjeZFT69fIBGJfZrrLGKpTALVE4dTVXmQmVVQDTp19IC+jUXHBti
+Pj6Dpc7452s8zPkzZyRbasO9b4PYTwq8IHT6X7ITwbzZZm8gexDYe2SzRZ5VcPz3
+El+yoULZ92WbXPSQIP/Slx4BEZjmsQS+sm0N8AnBRNZkWVbHPF9IZRg3VjDAn2i8
+F3un5js=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/britway/oidc-secret.txt.age
+++ b/secrets/britway/oidc-secret.txt.age
@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBETE9p
-VVVHeThGT3daNW1xZjBDblFwQWozQ2VSUmR3NlJVak12YXdWUDNNCitTWnBHd1Mv
-L2ViUWJvR0dtckpTQnRNMWZtazZHQ0tON0RhM0Z3cTlYVUUKLT4gWDI1NTE5IGhV
-ZEFqcW9CcHUya0s5dmgxc1JqUWRicmpXTllIckxaWjhtYzMrOFp0R2MKNUcxVllk
-WWJ2cEkzdXdiVFNDQVN2cUVNRnlMQ1BZWEx0QTI2M0FKSHE1ZwotPiBHaCJASk9u
-LWdyZWFzZSBsIFxuClVieGM0alFSdmttVjVsNDZIT2hjSTdWc1Z2VXRIUC9BbXNL
-MXArcHI2eDM4QWwyeXhtMU41cEtLQ2tkVllJdjkKTjMvNENSNXd1UjV2bGQzbnJx
-U3RubVRxQXVSSzJXbG5uQmcKLS0tIFFIeEVhR29qY3FBaUlJd1M4K3FvdDNybHZB
-MmVMZGxyYUYxVDNydjZLbXMKiPpxBn4WtzaH2iTFfjayYgNFPa0Mi6tIH0LOqkAj
-RyHNF/6vgWlmnivbhP+74dVaqR8IwUdFQN7S8/fx7eW/7qvtlg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyAyMWox
+cEFDWWUrVzJSM1o2azJqei9HV2xFY25oQXV5SzM3akxEaUJiN1J3CjkrQVhjWHY5
+Uk01eGp5Q0RKNVREVXJVZytndTM0SXNZSGIvUVp1TnRiNXMKLT4gWDI1NTE5IFZn
+WjAyR1RMajEyMnFSYnNGT2EyekROVWNoakFJQVZxaFc0YThOMHVyanMKWldrdlAv
+cVg0OTFHL2loeGJ3RHA0MnlnckN3czF4RUgyc1NjYXVOSXF5cwotPiBvTFQtZ3Jl
+YXNlIDRsSDp6eikgT1ojIGEzOFZMIFc3MUZGCkttZ3ZLNGxucnlJc01kRXFZTGpC
+eCsvRzl5WnFUMUIyTWNVWGk4SjQyN3V0bXQ4VzFuM1RjSzVMcDJkaW1JYXMKQkE4
+YWI1Mmg3MkpjdVpVYWJkczJQMnM1SVMvNkZhOXBDVEZPCi0tLSB3SVIyU3M5RHBE
+VFRtMFU4OUFLbkNjbkJmVmhlc2VsYzdsd0pFaFkrUmkwCs+h2KlXoyZ8U++A9wmV
+kh4N2YyI/a84yPGDNoFdSlXaU8jxUzolnadImXSXyB4CroqQLvGEbkZZlWqPLVfh
+Iav7Ja8=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/doublepuppet.yaml.age
+++ b/secrets/chatterbox/doublepuppet.yaml.age
@@ -1,33 +1,31 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBSS3E0
-YWsxbHZXQXo1R3BzL1BDdERxN3d2ek5acFZWK3F6andTeGVacVNVCnhPR3I4dXFV
-dFd0N2lsTU5NOCtsM3Z1YUdIaER4YjlrdkNXT1g4dGZXNFkKLT4gWDI1NTE5IDBQ
-cHBYSG04eHA1ZG9KN1Q5bFk0eXk0T0o4c2pLVUdNbEtWaDdwckdJVmcKd3lkZmVY
-cDc3dGdXSWViNGlMVW9jZENUWXd5MVNheStiVU1adG5MNEpnNAotPiBfJWZ0eWtP
-LWdyZWFzZSA/VGRDTT5kSCB4QH05QF96eyAtfUpxQ1ggZU5FQEhZbGMKa2xDUlMw
-Wml2QldxcS96YXVJT0hPVStqelhmUEd4K2R3ZDM4Uk83MXV6VlVoKzRiMWhxVlJx
-Ykg4ZTJ6SSswTQpTdjYzUkhMWjFwblhzRWV4bFZOVnRjRGMveDFaUTJWM3diK3lj
-MUE3dFlhUEVENAotLS0gd2lKQ05PRUF1b1RzZEs0ckY0eFlPaFFBNHRQZ01rZzBV
-SW01L0VzUUpYSQrJxWuL6pjjZs+hCS0f6DTNwW6HSD33bUwdBpyTCLeLMyDT646H
-4pjAhrVjVH1kgBFmuCjTP+SrD2bie/WhkQPSYrG7qygcmXbdNXlJn1tluEedDLzK
-djbOaSuohlgneGw9Z00Zkm8rz//2NSB89+WiWuT5/6Pm/d6763FteRI1LsPOyWx2
-vmTZMIcuclmrGn611T1kKR87R5AkaZ6xyhkOrOvWrb7BktmA69Kd9r5fXyxnLRZD
-W6vPm4EJLo0b1a4DWlnIvFTy5I6e2fFT9h2+rU1qITn5fwQD5aAYdL8W8ELIEJ98
-zYNxpbepHY5fBpHOGvOKM4AAO/R2pjaDaK7DRIFhSx/1RJLJvigXFd7YKl0WWn3w
-PGK/YxXnhtxnZngEPrnwf3JPj+zQ3RwKDx/v12s+KTbfQu6sGvw3MhDwYsFrRn+J
-T/jqlcZ/RodnxDngMnJCzc+YPkCJ/yAiot1DthVdpW0mWFiPsZvzN3co7t+6nopR
-WYnSjp5igjHbO/E3zXQ8qRlOvXSp6zspOIv9AETq49felAxXF7uz28lMnBeCReVq
-4hzBII+wDTR1Y/itKcOGm5mTdyvLF4qKRZFJFiJ3ATGZDEYh2dCrO2juaL4VczCl
-+qwt9gYF+pOgY4ekOtW6BpvOGZ591LHTMWoP52O0MnZADU8GHkh66AvMDemQGumj
-7qI6kI49Rwr5CoDMds5XlUBKlzeLgZLSo46FJghWOOQaiFiXWVQ+jYZpZPkgGjkU
-wDkrnbdglkdPO93bT2drkNbPWziHRkV505lGk1s4zCvsUPMH0D6KYkA6o/hCum4B
-IK8Sj215CmjQv5LYBwzHTNRusksXDu/+Ud5FpKCNw34aKblLIEPJNSk1BWLwyLzM
-oCNTiI490ZBh3vcnXpHZorS1Hxzb536SW03l0Z6q1Izn/vfzhZ7HbFY4qS9Qe+je
-Cvx+upRzt+mIQt8edbhrC1twfo/6whuvpT1HqGQDUr62+4zqVJ3lbccmXRX6uOAq
-sfK9if7qo0wkfWqa4RutO008ocVSKt0JjDOUpGHHP9Z95NRMyKJiOlv7dgVwWEid
-J8YMxexAgkmjByzwt1CBC7XizEHl09ZyjJrzN420NMRzaG3C6PY82cnKdbXNfEM2
-0dlN/xUTaOG1dAjdlgr2oMA5o0jFptr3hTFcoOQ/va1zkkNDHvfgjzri9HSID0bP
-kE0Akj6H9457cyo+xI+gD+2CtJW37TR/A7GLrzc+BDdDNZWtJz8t7oU0STL38h0d
-rfHgC8uFj7Ozh0nvsPbviwHCw6F+Z3lOT2qaFjzWKMuhnB8s3C//vmMFCfY2XglJ
-Tmcz+A==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB5WDhJ
+U3BNdEFYR2xVb21wQmhuM3h2TWpwSm40aW5ycjJJZ0NQNjNEdDBNCllpZlRtcjFM
+UE1TbE02ZStsMk44YVZ2T1piZmh3REFlV0Q0RWVGMERaRkEKLT4gWDI1NTE5IFRz
+T1grT3ZMRmVUaWhFU1BJbnpDTDYvRUUwUTZYUFQ2OXhQbS9KeTlUWHMKQU9UaThT
+bHFaYXM4VWhPU0xBZFI1WDkzdzlQUGlJNStjT2UwblZ0S1V4VQotPiBbbGBjW3wt
+Z3JlYXNlICUgRiVYCk4rMVEzMnVMSTg4VHpPcTIvRkZZd20yMVlJbXdTK3UyTkVn
+V3B1OFZiNCs1R0F0WmFYc3BDaW5FajNCUgotLS0gajBSMklJUDgzZlNFTlFkZTFm
+amNxblljWkVsc2w5NUVZM0x4VGl2NWZDNApDqGhViG2eQSuIEEwEh2rxVBAVkCBj
+EXUYBqrcqlRFRT+cN8EM+aT6ppUeVuuOv3aTYx+tM2M2yzjWvrckeVj0fr5GwpIT
+vZaj2yceTl/6M/Z7fK5AT7SqFp/sxSJZcDWInPcPc3MfvcSC5ca7UFcTd/iqtpgD
+gSkiDlYrZKV3PtLrp/WO06q9zrBAiJbeBLvHM/Ym8ctSl4w/SjETDmhm3LzbX+Ow
+uk/hSuk9m+pTeBPJ6CWrUVHVLitcyk2YwLwLRLvGQAQF6xQgEtL3M/pGsQp3Q6TA
+ju17Kmh+kIdkgEDj9PzA8Q7QfxU3WdC6RoIXEuQQHVcJd8IAT8i3ZuuI312sXeX3
+7+2Rav480GIF+5bHQGJkvBTvxj3OFGUuyREFO8nXaGwUrcdCfmkhuSs1TGZj6qZQ
+xVUnp+k9X6gH5xYjka/c3Ov5rTKE7CGqJ1VBdZAcuIjhH4D33RmaVmTg7SquXZc8
+cHqaoYcB/s273Wxv5qZUEfEz9ssJCxCqEOG7uQIeXgLsp7O5VtvEJfCo6Q7boN3h
+Qom+6LJfnNMew2mwLQS4jV8abrVXTcmH9cA4OdtLtTO/m123AlamJc7Dmv+EDYLV
+qu9jm2Dk6hz+jgJ5ruDFPyAaxcfQqEBFbKI0eB3D6qu3YcN49q8+JI05aTDyf4T3
+8Mv9oe0Jlv7Gf3JqORw6dhDatyRzc2FrbkpF7mwxtLTDPKsgCBFNIfVitZdXFxN/
+adu1nSBl6APznPJJZ4Xb6HmJHb/mDCeWmwt4fDwQlg0d6G8EFGYexSZOjA8yxXlr
+vwhaPYldJsxlkL24nRu4wUFi3jkEepU/KsBbYMgAp2+DIzluzKErvZh2WUAr96AH
+dMWdNlbmhNKwM/vfkzonZ1jSFIuad7c67cWo8nUFVxKU3tAjMFTgrasHzPyLK2HC
+WJnEpmMvQsji/blPVR7AOEAzNXwpOj0N/erPCtWp2v5Vyfs/ej/sLGp6tfCdZeUv
+13aNG8pYtQbHgT8qekVKRsjRlCyVYWd1lFEd3rqldtX6z8oT4cIj/c6QYzC1Rwxp
+aNPqMA3e3da9t4kkHol05grDPy+5fQ7/5B5kfbidHIjCoA9DVUEh70QYuNi4JlgM
+54Jh1v3N3+525YmavPbuwgDGsRkz6Sh5padEWFQ2Xw6B58Vgm6flA1ZSXNSp8bK1
+3g3lyCJSimFT6B7Q8gyf6gNJVpZuHrAEexCed3qhK+Ijl2SIvsTFCWLSokOPeX/F
+cy7xQ94GuLZqPedDvZ8wVOQ3X1/E46lWoY1w3qzD5l1OHuDUqJcW1ae8lXTmh8Z0
+kxRFPfNaJA1y1NaD33t+gis7SA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/mautrix-instagram.env.age
+++ b/secrets/chatterbox/mautrix-instagram.env.age
@@ -1,14 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBBTHhU
-TVdvcWhvb0c3NjlTT1JBWlRaRXBYSlFySFJhQVZHRUsxcTFVT1ZzCmVaZW1ucTRG
-MVN0VnZEWndlVS9iclNhRlB2dkZPT241dHRxcjBRc1BpVncKLT4gWDI1NTE5IGh1
-aitYSmVudUZPS0FHbUliUjFCWXJaTWI1RzRlK1Q0ZlpQNmRwN0haemcKaHhQS1JO
-UVYxYUU1OTR0dXJhTm1EMGdER0hYUXVRd2VmNURwTEdVV09tVQotPiAnbHAtZ3Jl
-YXNlIH0gLCJ9IDwhIEB2QW0lfSkKMUJLd21ubDVQdWJOR1VvCi0tLSB3N2dJV2o1
-WGF2TENYNE8vSzI2UzVPZW01RzRtK1VCaUVKemN1RzVhaGlvChPEVtylQsq+EWK4
-X6HxFl3JY+M9clfpicNlSqUjPcB3roEMpD9BmGcG46nVSZVDguVjPzwTltAGE72Q
-Q4RP8/yhssA2rrLEuWz+JKcaASF/yEmu9QBILrWBIWz0rQyHfTRvBC9d83MdHS5f
-DQl1abC7Lv8imVm0pJ9vthvB56mXlGgm16fnsd/UhgMQSWZuVLSitaoDEFCz/LWi
-QAUKYTRVL2UcomgHsQqMx+2g3HT0RYQu1Ud3M5rT9eMSSqPG7IzyjNA3HmH5dw/4
-EdnilIaW7c6k1RAYMFY270E6qlxqdQ==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBhVkhZ
+azNHVFdNUnJ6MVpJaGo0T0h0L3ZMbHB3RG9Ic2ZZajQ4amt1S3dVCmo0YnZxL0p3
+Y2RHVWFUSVlySTNDNThYMks0aGdOdHdGQjdrRTZZdTFpdlUKLT4gWDI1NTE5IGxZ
+elhYTEtMUHR6VlR2b0VwM01XNnFNR0tuK2hFenlhWTIwS3hSMlVIR0kKbVNLWFRZ
+c0ZrK3YraTdhR1IzL3FxMEFQYndsYm5NUmpDd3M4Sm43aUJ3VQotPiBuZ0BNPnxi
+Ny1ncmVhc2UgUHIgJ0hvbT0oCmMwcmVHR2dTd3VaSFpHUWh1ajA5M1FUTS9WQkNQ
+UzZqK0JETmlUOU44eFQ4emw0Ci0tLSBhT01BQ3VVdHBQK29GdmN0VEtoazNCcFpY
+WFhIeTh4VTlHeDBhcG1lNUhrCmxtBrEH3ornrPQi4eIIOskkKMTDs1Ow3Z70WuEd
+FyXGsYXFwpibxFxAWWLwAYiq7cMTEE0GmYRlNYt7bWwJn12Kv5LVZCL8HXTNXCLl
+xf0za7pHvXF8XWaZwU2eMMZRdkzE6HNnbLt+DB0TKS9vf33i7tmwduqJ8oiUtTRD
+XTm5IPyULH2rikDuDm0aAvaZhSFlzPIe1MKr93ZaHGrvcnbzhADyt5DRmmDuYSk4
+SSSrhHP3P0LB0OoMGVU8DM9O7QNVwScs07T7ll238Jc/JG/KHj1kT2K9LYAiNl4Q
+JfhOOA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/mautrix-messenger.env.age
+++ b/secrets/chatterbox/mautrix-messenger.env.age
@@ -1,15 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB1QUhX
-dTlNY3h2SElIMytCTGlmY2syMmlTL1VMeDFnanN2UE9QK3RvRlUwCkVMM3ZKMU52
-ZmIrZ1VxUDNWZm1lU2MrWnpkUzBLcDB5cUFCSXZmQ3RXR0UKLT4gWDI1NTE5IE5W
-cE5uSlpRd3dIRXEyRnpSZ0VHZ253OE1ZVTd1OTJQYkZVd1NRdnh2aE0KNTFTaHJM
-OE9tc0VkMHFHUGN2dFZVSGFBdTh5Tzk0TGU4SWwzYTBOb3FtdwotPiB9WnwtZ3Jl
-YXNlIHZVYHxaIEBSbmZ9XiAhfF52YCNwCld0K0RCTFlQamNLeitWM0kwUnVJdXFV
-QjNFcEYxWFBkVjJ3QlAwTGVvTE1GTkxCTEdDcmlZMC9xbUcrSHp2V3cKdzJLb011
-aEM3a0V4eXBTMjhnCi0tLSBOWHozZTRjRldrOXBmM05BZ1lPRDYwaDFCcHBPNHhQ
-SzlaWGM2RXY1THI4Cj4RzG3G1yGkmDyqxCBciqMNPAQYge4mXOib7mqOuyIbkT+k
-qrJ8fLnW7Jbnb7+Rzr7BAEC5/dpOfjkyY9JPeg0FRutlkKyPIhRMAEhSsNvUFzXg
-uwNbnSBI+9Str6nTKI5c9IWT5eT/8zsKwtK1/pr39mApRY/y6NlA5X7ZRIFeku3K
-6I/bCI5cT0qhIMJbF5D0KiCnMCnMdmRLrwLzM2zcJoisxRAvj4dNfLktsUQOauZ+
-Gta96qQkAewvrdfz8Z4lTYJQmEqeOs1vTA6sAMf4iLp5EhPE0jN0n6D8v7Lq7+2b
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBOb1dR
+V1hVcGZMRm1yeUtKTUdBdkVjazJsS3l1aHR1Zzc4VGx1SmVyNHhZCkxZY2RLNW1m
+eFVzRG00eGN3eGNoOGh0ZHhNZWZhcmxoVzV5elM4bGdxUTAKLT4gWDI1NTE5IGw3
+ZThQM1JESU1lZk9Pc1ljanU4dVUwb0xuZENWSFcrZ01vejhRT3E5ZzQKTXZ4Q0Zn
+OWFHb0xoZi9UL1NSUWNEQytmd0dqVXFydUduYnZGVGhKK0JVTQotPiBPc0RaXl5+
+Wi1ncmVhc2UKYUtBRGZhVlY2MlAzRjJ5YQotLS0gSllJbHVXbDZtZGFac1JqN1I4
+bUdyNSs4c3VLSEJUVmo5VkpZVmkzRzlHOAow5ki6UNCCQQt0YXMr6OGjsDg9yYkH
+ssU+hO1wKXepVj6QSROZubLLTyV4Cm5rHWESMiSGTV3rcGNDUuphrS1va+stkJqK
+O7ZHP68QmCPLdlu1ghNXw7etm0K+BqqQTpPfgrusW9emUV8gIY5/SWmK6hDQLR/T
+ibC6GqP+ZCEQOL5OgB59PUCKwEjia6O6xFKPHVLNzfhg4ZmMCNNS70gqpTFRyN/E
+s9HMiwYVuvKjEODV9kM2jhfTTD3Ri10SmHurBqdbpzWhOoLz3oMTQTyW206Air/G
+8RoM1RYcVS3DI69rNg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/mautrix-whatsapp.env.age
+++ b/secrets/chatterbox/mautrix-whatsapp.env.age
@@ -1,14 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBJbWVs
-bkt4a1RBaU14cjJzRm9KUGhydnZlWGU0NGVYK0NmWXRsclpjVUU0CmNiVDJTODFw
-TnloNW1LMUliVmlnUGt0SFFzWmxVTWxZQ3crNWVHVy9IL0EKLT4gWDI1NTE5IDcw
-TUQva3UxN3o1MXJ5QmVmQWVmeTFLejVwOVdQZks3a0dVQUJTdUdZdzgKajBFK2dX
-R1NNR3l5d010MnJGUktNWldwVjY2cDIwbU1laEMwOWJITEg0NAotPiBeLS1ncmVh
-c2UgJjhQIF0pcSB4Ci90SVhIZzRGVlcrd0hRCi0tLSBKdVgwZ0pidC93aEFscm9w
-Mm5GbEc3RDdZRDRpeTdONHpWN0xHYXkvVU5zCjjFfwumbetHbq8MKrBIx18YXmny
-z+0ifVbksJhYLYk7hViSUDy+F3RRad23dSPvDdd7JCEpj+2PvcezBLkwfUkFdQe7
-uQhUJJ9c62oKSX7PMbQeW1tyX10SVkt/P20z6HPXvBlY715lsXspjZERi+DheZk0
-ZDc3dPYMeyoAIWicf40ZxH8C6rWl5HOLIaTMbCOKwpD+wPjpzeZHat605YWReFxR
-Yd3cKCRqSb2QdAdtZ0XUDSPl7HVwkw0xobCsvtPzmObA3YbLopBq7Dvrvh7XW5ns
-BPlTaI8WnrI03CplGP00
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBTZGdy
+cnNwTkkzOHBlcngzYTZycE11RlljK1RtSCthVkxSa1B0SllGZW1jCk1RbzVSMldJ
+SFg4ZlFnT3ZJTTlsM0lWYlRTRkdMZU5YS2FpTmxCaVNSOGcKLT4gWDI1NTE5IFRU
+RVF0NXV4bFB2ektiQVN0SkFvOXN3MGZFeDdHK25NQXBqelBvaVg3alkKaWhCRTkz
+S2o5bjFWQ0VuZzZxTGpsOXBRajlGSmt3bURQN254SXhyRm8zNAotPiB7MFM0TDEr
+Si1ncmVhc2UgJG0gNkggLAppL0RJQnJRQ09yb3IzaTNiQTBBOGlrbjEzNjhBNWdU
+Z0VFZ1o1OEI5M3lOaHg3eW0xQlUvbVBGOEpwRXdDZlZXCjB1SSsvZmZtSlU2RzhY
+ak5lcy9FbjVlZlVmMFUKLS0tIG5ZMXZhMDYrMU1DOThYNEZxTnI1d0I0TXlNeDU3
+ZkFoWnBVOEx1WjRmTncKZcV/oJCkeY+Tp4Xwdy5s+vuMpnhy0cndBUE4KrfkX7xd
+NXTWQ1mQdy9W5MII8s1aFtxYoShZPsoNTikzZIAqxhTMHloUqKaAG0XKCKj1ZzcV
+WMj8+IOnPD1y7uwETg7l0lw0u/L2bb37zrlvrf6JjA5b4iO79+wg9AvJigdbkNou
+gfNFyZuxaIwM7FOakVWV8hKhKPYd1X0y3cUQCSb0/oiogHT+9KREXsL5Jt8hVoQ0
+r0asxVOASXxVRkEDQDe9RHnEMEo3+UOBtAB0DVSeGOa4LEt8SEoCfas5vo+LqMZs
+fDA=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/nul.ie.signing.key.age
+++ b/secrets/chatterbox/nul.ie.signing.key.age
@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USAwa1k3
-S3dka3ZjcVdIQ2hSN0xsb0hTNEhneXFYS3BXNWZDVlBNc2toQ25vCldqSlMrT0hB
-Rkg2aDZUYlY4U1E4Y2djMVdwT1VsbGdpUm12Z3gzditmMncKLT4gWDI1NTE5IG13
-YXF4WWdmNFRPR1JDWkk4OFZkSjdzRS9BbXVzSC9YNG5FRnpqUXJZVk0KV0tOSG9N
-c2VVWE10WkxUZXpqZjBZZUQyWE14TUFsdStMeWVlcFdJaTRVUQotPiBWaHxWdCYt
-Z3JlYXNlIDYgdDsgcW97Ii5yIE95Clhqa3RVUmJENngwTDNoR3BCNjlaTkVYc2JR
-ZWQwb2FOVy9sc2d5MmtkeUhkajJBOFE3TWJTOWViWVlJSTkxWQotLS0gN01aNGdm
-VjR0ai96VzRqb3QzYU4yRzVCby8ycVhXVlpubVptam5mYldoOAoZnbsXB5we9BQ5
-AXQ08mXmMxRMg9iH7qgyCVc1ywR/uo5Fcefhuw23TyluRkYt7tZ9yiuFJIx5Znsr
-QEqaBioL1UfePVyDLi8LcBvUgnnx5uN05hUvTOt6gqaE
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USB2WFY2
+MzFnVFYvb0wzc3grRDBrUi9teW1tNmx5dVBIRVc5OUdlcjdvTDJFCmpJL2tlYXND
+bVJKbzd2S3JkSFVMdG40MS84V0lPTVJSNHVBQlNXSkN1eTAKLT4gWDI1NTE5IFBM
+ZGo3L2VlNUZqOEE1UHBuMHdqc1pyYlQ3R29ucE9pajU0bHMzamlXRDAKcG1Qdmw2
+cUlncDFWNXBOWnpIeDNZSFA3d1E1bjNaVVpKU3lMRjRaSHNtMAotPiB2XUh8eF4t
+Z3JlYXNlICUrO0cxIH4gaTRoIF81SEpTN0Q5CnpWdEZpb1hZa2t5YkE5RnJFMHVZ
+WkhkQ2o0eWtyOE9ueDJkeGd2aUhmLzRUUGs1aUc1NURIOTYxczZhOEVmT0EKd2xk
+TXFHN051d25PQmtNUVZkVEFGUVliZjdmZDF3RWFkaEhNTzd3ZVd5N3dlNzQKLS0t
+IGZDR1Mxd24zOW05bitzQnN5WWVOOGtCNEc5aXIraEF4eXFUQm5CZUdCV2MKd44C
+/Trgg0OEZ89/jqbj56z/Hia1Ka3ZsEv6bXPI/kcRvFDBFTgtvG3KWCgMBtTUHXzY
+TKBPoQqrUf7plH7a/mTx3KR+4Y+yF+1i86s7TzYjD8d1xfFH3BsVtg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/synapse.yaml.age
+++ b/secrets/chatterbox/synapse.yaml.age
@@ -1,28 +1,30 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBvdjZT
-WWFyNzdXVENweXlVT1kxNElaUDFUSG1DSGMybTZlN3VKVDNNMGdBCklDRk9oaXdT
-MEhrR1VTcGE2NWwzdW9NQklwcGFsd1BWSXBpa1YzREdTUUUKLT4gWDI1NTE5IFN4
-Nlg1OXFNMjVzbDlRME01WW5iMTZvU05hUTExNnB4MFpUQ1QreXFXbmMKb3BzamRT
-OVM0TWZIdkJnYlByRjRQUXNtQWtXS1FXRVlFTkpSNHFVTWV3OAotPiBpQy1ncmVh
-c2UgJT9RYi1YewpadEZzVUpqc3F4U09zUQotLS0gWkg5ZWlxYUJGMUVDd2o0TTJT
-OTk0WlJ2aE96Z3FGNmQrNEx6Z3N5UkRxbwrp1nF8mtgoTEYfQ/aE7KgzFOei1PVt
-cLAh3v7wo7C3lxhBOL0v8ToIAVgSoGP6cj9/4k7+9GngpOgot0IOdoXsThVdcg7w
-soDjArsSWDYn6Th0yZf+trSXfA24BKIS5qQnAMT2ivQQtO9Kqxko2Zj6+wZO4LEj
-DEr7cqRCWVFfvPLJurkfbCRjGlW2rKMlJotnLMYTE+Ot5SlSwVic5Nu3inGx1U/a
-gKjCPfWw1h0Gus6PKXpSq8wGrGp+ov4ocpDmumbgh/E0D82JtBBPoWojxuGSFzrm
-UDKrgx7MObGbjwkj5Xd+SDdKytjNqV+9g8GdRYVGhIr3muLn2JJlKKw/eD4Now86
-tPB3ms/E1N0HR/LoQ/Y65WeuHKgv55CZMWauC/1ECxVS/jDAXnQ2lAqFlzmU1ItQ
-4EefV7FRWxgMeMOIVKOCus03Js4yZp+5byjJ7+O3MRrOED9/M60B60zXhvPDtwb3
-D5sFtC0ZBZT1+d4pUnEnLzSjM8DTf9as1uoNSuzh6ASiSiepAhdKMNtS8xzo85bf
-Yw2WxiXQfSyN2xWWjSH/YQUXKZRBNATxB0FRMaa1TOFKo0dDYOAu83bY7wwAwSvZ
-zCZ1QepCCjiWe7ujd9HMPWDgnvd47c8teSYgjX0T4nCEk7EbNpUcrDXcz78ZKAlm
-VNuu8C5oi5Lk7972SBLj6yLpj27FDMagSvX30k1sMoHcKGiKnkSkdw56B+yHwLYL
-Iic2mxklXggIYLo1gNq0tQskp/I0dFGUzAF1AblLw0b9Gqj/fHwHtkx/Q5n+NE82
-jSVVRTI444cMlXKnyk2sVKKOWR60WXQWs/GdH5Oln42tmFT6yZk8OV7RopLPUXx2
-4jwwWvVOrAMhmTwJDbzUwEIm/nfay7wzJinjNod67u0muq79OP9k0pRB6u3mSYZ4
-ZX3RhRoIYiYHCDrw0e8eWKjlhzaA7tI+diHdC62SR1cUbYbRrLiXrU+ZPjG2qDTI
-eAI8/wUMSHNyXdBejLRZHy7l38LKzAG3SSWBtNuCpAiP/QWCFL4UyEMlQ3Fmmzp/
-FDgNLldzhOMDK8eqGAgG+qVRaK+30SJc2/ydjilg2H/KxK8C4F7Q+ul3QV+p66KF
-D0h1JpWxSRhK5St01FdtFigSsA2QBg4kP87gGFmI/y05jbj/XjG7D3BQtBbRnKVG
-uQ==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBuQjBY
+K1ZTUzR0SmFoYUZLdzUzNUt2M1B4RFdPZzFkcW8rMWJLUjVHOUN3Cjd3ZHdMSzdp
+OWswditVWUhYNjZCdjV6M1d6U3pNak5hUlZjTHNqSkZPSk0KLT4gWDI1NTE5IGNG
+ZytHazJQWTExMjNkZWV2aDUwcnZjUGcwcXRkZWl0M0F2R2JpUVlJekUKWTFlbkEz
+YlN6dkgrMmFFcmlZMjQ0b2oySjlEMC85cUF5QlA4NGF3blBKRQotPiA8M1hbWS1n
+cmVhc2UgOmlZJFYmJgo3UExzUHhSVi9lbVRjNW4xTnVaUTVGSGVDNzRUNlJ2TnVu
+U0wrWU5kd3dyR2phcUNVUHJCYjdzeWhjNVFOV011CmZMOVN0WDk5eUg3ajhwbStQ
+aHExT0EwblpreTBXVHh6Zk1HRkhzcmFQNnoyVUlaeStMUkgKLS0tIG1aY3Zadko3
+V3pDMGswSDZCeit4SVhSRCsrZVRVZVkvQkNsQWN1MXFMUGcKcK74YULWqWw9VvkI
+NH38VHfDPW5ueSiyHHKn8MI9YosPr/TmkwgKd/DOIMVB74ahPalo1QUeg+eaBVnq
+Uncsbx5ecW3JswthkAhiktWHcdHmioGD6hCcgbWtfA3VvbAYc2gtAF2plfDVH6BD
+c8veai3B15ZmDmq3b62sgVA9JUgbFaB1eRqcaPXmNgQJR4c8J+CZWXGQ/TKMqtAg
+chCDuczjLX8IxhMPF1gdCggSt5GtMhY47fpZJRbBUw01l8koqjm63KvEeg2ejFGU
+tXonI4jm2JUxlDTqmNSrVpmAgtPoEPszHc+GsnyNjAz4IXMm5UrQAZyDPgxtwQW
+ZAn0IdOB8rSL/AnRGUpPrecuauINQjONe8CapijjJPQK7g1AHscfxr+OJD1j2eV3
+O6TNlz8vKW4t/V7CUf46ykxxExhA0mKJ53ksaXy2+HWoro2+c4nao/bEld5gt08U
+uCpJtjPKB64X6vdzbY21/l87VRDyxbb3poENfrXlawqS0Z7i2gAbHN5EuiMv+35o
+sBaR0BfcbTn6VagC3i8HEEOO964FrW65pkqmGJcJMgUdcZSl+Y7gHMjWyodqGPOY
+evT6xj4iyeM49vXynV2vrJRu5rr02hOS/8rPphV9c9q9ju5n8xbhS6IiybAelPwt
+sa+xM+w0n+fxVksiXeFj7qD1LDN4+kwqhYP9SlzbA4fT3AkYYrxthTww4IFAweyQ
+IJkpVL0/IZEIEfRzpr0lWLprAaoyPc64pecl0z/gBJDgz1kSG6iEh6K4qx7ahGde
+kBBpS2I2ZsdBkvmQxDSM7tYYBzPxcUNZlSFOIeUy3Xl+OGPlKgtMofbnjV8AFqUf
+tOpgKpLUEkTgXbGUKBxHLj+8pbw7zOFp4sJ00i48ZzLP5D9jom+jS19wGshRc7cH
+dK92CctvrfndQ85yO0vqlyOdMTqjh/z3P2KmhL5SW6P51q5mseTvj7FNM7331DTs
+rq7XWaBLE61eWWQ/dZKnqh5YbkSlU1+08Rl6H/vCU5hTC8fht3KTQSWPofkrP+5f
+We/Pe62LyhV/MbLRA0nmU7Sf4IAnpHfa4kLtlYeB3xiqKd0McM//qzjuk5NoIgE4
+nL0T8YXdGt8K01w+nt+j5bo5gFoRz5+1/ZZ9BgN2DOo4SClYnJWQ/x80X061yJ33
+0SGv4eAC3vFi6xE=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/syncv3.env.age
+++ b/secrets/chatterbox/syncv3.env.age
@@ -0,0 +1,16 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USA3MEFh
+YURySHY5RjVQa1c0QmMvTkZtZElNd1BIeDFpR1U1YXZ5dndnclUwClA2M0ZYMk90
+RmlCZHVISkxZQTZXeEhZVUROSVRGRVg4TmZKZytSL05FcTgKLT4gWDI1NTE5IFY2
+V2k3S0VQdGlQZ0hkU2ZoSWdOUG9rQ0p5Ukg3ZHU3MXVvNHlWYVN5VVUKcWtoWDJh
+LzRwcktWUGQ1bnJvRzVBVlpHU3NhdzYwUDBPTmx3MFNrdWNQYwotPiBKQil6Km0t
+Z3JlYXNlIFdlRTlUU2cgVlxLIzUgJlVyQiJ8Cng3NzF2b3d6MnlEdURQWHgrSFJv
+Y1BMUkZyelJSdDJvUUUwY1k5R3ZBMnJaa1R4NWxlUll2azNseW5MQlpvVWUKYUdN
+d1ZscXVxd1dxSGpzMjBYeWhhYyt5ZlNkSjhmV1ZTTDBTCi0tLSBBTG45VUJOSXZv
+N3lYNVlyZldMVkpZdUMvS21NdSswVmU3VThZK2M2eis4CjwfWWJVR9Ty5dBXEr5s
+U+QrifXvyMJJvqOKEfMYYomFLpt/VtbDAUwNlqLnFIk1VZ2xPUBisXPtReiCK3gq
+P+i6bUONSmPYvmF82VgiuKDuz/kmWqVGg2iSBPIXAGLNIEojndQwmhnrsN9ex4Xy
+lBHkvVsN8EamUJwZ+FEZe4+PjA5yEnANWpeTELOt2gA92/jwwnNIsr07eVTlkh8X
+UmQ2owGwktXP7it6//NV3C7sAdazs2bX65WSnog2E8WPNAorKWI8RCYs33CshVFt
+zzclZ4hRmlAmqMHYqFY=
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/colony/borg-pass.txt.age
+++ b/secrets/colony/borg-pass.txt.age
@@ -1,13 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBmSkJo
-UzFYMVBiNTRBbnliRHh1OXBpME05dUpyYjg1ZVY4WStxRXg4VTF3CkpGQ0Fia1Ew
-RnBsLzNJZEZMaER0emt2TFVSWHBGcEo5MnYzVDlvOEFrUVkKLT4gWDI1NTE5IHh3
-UC80K1piWEdneVExSmQydHRqMFdTL1djd24wL2pDNFc3bjNxc3hZekkKTlI3Umh1
-SmdBM0Ziak5GRm12K0pMckZ3UGZXZTNPMm5hZ3lTV0NFVlYwMAotPiBHLWdyZWFz
-ZSBddkFIRWdHIyBjOXwkT3MgJiBOcUkqRwp6VUMva2JWd0J5ZjBpemFFM2djTzNC
-RW5POHIzOUZFOG1zRElPMkZZZUxmbklpY1V2R3lqNUtOYnFlSUVMZXlrCnB6REdz
-ZHFzbmRjMm5mM0RGU3NzeUl2bHBhTEx5MjhXRTJBLzJZRWgyUQotLS0gV1VlUkRD
-N1ZTZnMwTWN5SXEvQnJaK1NmcEUzMEJ6UVcvb2ptK3VYZU5zNAqgntLnLkQABERv
-HpNr21t8+KR56PZ8nQS8xALzw/FzdexGvlt4Pzx6o0daBeh4aZx4mgcyG641PsRc
-eDs4tJm8gmznr6y7B+WNC6WGrWPPIC3pHKU4g9PWzyEZcTEpL8Fp
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBoYlRq
+ckk2c21uMVZSR05SdlJpck5MT0FZeUpLTmpTRVN2WDkxWWxmVTBvCjlHZWtEQ2Jh
+YUdybjJLWkNsZkxabTVIR0JnMno5YlMvVmhodDU1bktrSzgKLT4gWDI1NTE5IFZT
+Um9lWXhqRFFLTWdNaTR3Sm1acmY4N0l6WE1FSW54ZEtQcEE5RHBRRHcKcE5KYmp1
+WVdCVk0wMHZ2SCtUR0xKWU10N0xETXlXZmgxcmZZOFBXYWtBawotPiBlRm1gKGxU
+LWdyZWFzZSAqXF8gOkU8Tm96IGA4IC1TCjY3NUgKLS0tIDhjaTNrbG1iQ05iTWRS
+UzIvNzA5TmVGS2ozZmYrYjlBY3J4Z1RRUGRNeWcKUTIEhWqr0fOODu86MDll7k3U
+ThgmS9nlcUY3fMgXzZLtpHIJ/4ZSI+miu8RmLMaeC61qv6xNThGdx+MvU4tMBWKA
+Hv3XGi2MYL1jdHh2KYg5PgdqchYuHrFuBPS7c/tQow==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/colony/rsync.key.age
+++ b/secrets/colony/rsync.key.age
@@ -1,80 +1,82 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBtVUdX
-WWlWOU5Pck0zSWFETUhMZVI5bjNUUk9pc0dRVC83TEJIN0V6aHlBCjJvWkxSaGNq
-WmxJSEhFekRLSE56K0pDTkxNRlJhOGZTWC9RdEZ4ZGJQNkkKLT4gWDI1NTE5IHNy
-S2lZdjFYM1M0dksvZlZ1NkFENkhLdHFRVm1rM3B2YmJ3REZEa3poUk0KSURPMW9F
-T0pWVHh5MnBjNThRcE9WY0E0Z3JtMko4eDFiS1k4L2RBa2wxNAotPiBgWn4tZ3Jl
-YXNlIFdRamBzSyBlP1wKSHpqbmFWZGpJbkhyRENTZlZtdFgKLS0tIENud0RDdjRt
-bFhpbVhQbkxXZXJRSHpDZWovUEowUWJxaUkwNGN2aVU3ZVUKlXMwhyxmFiFHHHDQ
-FDtswK4HmApIhnW3TORhJyKIG6WBKFE1wDN5cDLppbjLdWAZecQbw0Qe8UQP50CM
-iSZOYSSpS4J6jo2kFCIQELXjXMi7YhmkIa+Svz7kcr+vVROOikBdTr37ZOXp51Dy
-O+Ygl8rPaDkTV1elWCgwX/Y5KM9wvS/OEVBSKyc5vz83i0lsHMTOgb0QxMrqiAUC
-cmYk7crzAXmKU8VeKw97dA0ZOrzdEh80M9JVpc6k3ydliXUO1b3seKlocB5cAtnE
-9OcsJV2byI0dOvRp9IZLHv3EsHw3sa5MFlw60KBHYZE1NoN2Uo5EqBc/Iz/4T2Do
-zpQ5YwK8d2fK1tMU/FH/RWxkCXOjiShKsJXSiccHkzXskHU4uP1Y7s+KtFYxAttD
-IusDOGuvKKpRuYMjRQYSm6ZHDAZc9yZsPqlKmhYg7IWlCd9lTk8p4mGoAe5b37f4
-JwACx8asE3lZjNLo+1cwdjhARG535qmOt4i+e0t0x5XoUkenWhbq3Nr2x9fkzt0I
-4S0l5IxnxXXO9Flc7g0E+9HNZXTixG7UvhTcLH0BcK2C9CZq8WQmYdLXcbQBJdq9
-yfLKzEBdbzPT0qjMw7hua0ceBwc6SF4gzkRVwhSw2kVERPhto15Flr0ybpDIF+tI
-irSwhTwi9BKJn8XpzgErS9K/Y5Zd7GENY3BdZNzHH37VXK/cEyjWXYmW4sAL0QzQ
-BA/wujUhOjHrdYKb3QdVZJnym6ErOqzrg5EJ6eXI6nFLWer+2xDRouaXJsQplcyy
-5Hr+L/K84/1+s+0ecNqm2XCjgCge/9dFM8Xvb+cBo/yOL5J8Nynv55WfUb3sjVel
-pTXH33APtzX4wdqsZ3KlB+OgjW9fc4vI+rWyT+Ia1ZxfP3Q6sgznspaIM1BHRW3S
-ZKTsH1wkSQKmLMZSUCNzpCmKY2bvZMQY4i8VP0GKbEqGjItknCPp4KM15QTOWgap
-08T3+WX1uBaHITZKIOIbKfAUd3QAoKvHQBRZalhA+0+Rlq3tu/cEcsgyMnKppCuM
-my41LOgtjtGi3IRnKYDsVnvu72KsbWzBBn0d/J2ZejwLoAECJN5OaLpIpWCCwody
-bHWkCYF8eymXncuTbtF0EcGeu+sl+YaATwkEHmPC0Dy6S49BCCfWMK512JE+7WfV
-pxI2VZ2ncr8te4ki4iZPIncx0uYGTt7Q5WoMoBlave5AemYKr7MgAK9sZx+3VP0V
-CXcLzQ9GznWxj30U5cro578/3DbvTRrvgD9kifTQZPDhLliqgc0Eiee+2O3LMVuS
-GBjeyUcIjF2tQ7C6AeZ/qjNZTQK6/zIjd6jwVwO8UDoxLZV4w8rCNEdu7zMUMYYy
-nhLbrdAcNgBnDT2XRT+JXXZZ2YJmJFczd7tHPpmP8mAPXiypu+VSc4M+a/A+dGyo
-K8r2p47L6dNbMnJG/lke9V3NbK+5Cqg07KNkBEbFq9e9i3RyEs4KSq9SqqRGKYKt
-uQ7wRu0u3O7vMsw8gagpSRXeVaEtxJTq2eA6eJWCj6l6ceZ+/nlNPMXudvbD1JlD
-rt397ucz5ih5NpRFzTWG4iT91hXvZO5yhctCxBlmhLgsfoz9TK90fnmkeWMr/i76
-cU+F+v1wYwiZ275occmyR3LxFBT2d8Isz4BbC/yFJ+afTMbAGM+WbUHeYSA/Pq7A
-YgEhFSLULlM3ChmHm1otOMyyv6bbos5SvtegUtHewWZSx54ETN80kW9bsUBZgY9w
-XIOG3vW6dFVjpJpAGwcDG2XJpKs31F4eLnX0zq1PJXdp1UYo0H98U/CdP7OCfdT/
-AY6eKzdhEMTxEaWAfZvTdbX8p9shoVu1K5TEjQNTHTsIKoVnLbpjq5/iAwn30GIQ
-dQVBDsU2wTTsdi3HZKEqwbGW/iwqZEhfeTgIv0P5VgcnUa5uQvApxud0y+qf4M1A
-t6IOfzM7toUNsUGL/PQD7LcpJLwdKjFKPrQl4GyIplQCB1+bIU6JyE9Rr6hfeOTG
-pbbX1J7dfM/LN4yfdAdod+xTS5VU/4htKOzviZoVfHHoi5s6BuxT57BSseucJbX6
-4wEUBk9wEzTrGRZSrUI9DHkmMTxJ3qORtt2P0ht9GVCFbtAg/Mgg3v1BGlQTTgtw
-y6/iBgWxTO5OqiBW4EXQCFyfh85vPegvutX4o2oXU7Mz5QRITYDaObxMhyL32rBC
-wkEf0euFCKabLeutQm6bh0W15IAW/a2SO2knXJmWuP9GRxfFqzF76ZmHWE+cswal
-/FXJ9BA/IEkbJr+kX87+RhgH5RgsmsFsDXY/jwgUoW4gZR78yB8bq/uQubIMhhAM
-HLDtYIaOT1Hwrf1v6IGDeFR31zrWudt3kHH6uZBAH77Y2O6C+TuN9a0IhHwLec2S
-4AIVTZEm6ZT5o7xQTVzjaxLWAdXtENrW8rArf6TH+JIruznbaeuYT6aeY4KlWlYu
-rVH/s1wBTWwhecdt9EHauLftK51Uy3GrZhQ1RTvb/DB/cbXM3yz7MbSsu7uqayiG
-g4+0at+1nk+4sFiM505FVtBVb6qL6HQIr+g65WcAnTUGj+DgYUBAmh38uu3jJbhd
-TMq/LqoPVyXy1CizKPIcLXTEec7Bh6HwXkn5LMU1HPdrjk9OSwzS4HgcOVR6Blhj
-fmoDMwuVkzyD0jJ1vRF+uH2krZu3NbBNA4W90XIpZy2FtyFePaTRJQuiZGXx9eGV
-AlUv8e6SV47vctqRZA2pKSPrmYLOgeHTcB3YehiOghyXnVfC4vBCoaujK6ToQ8aP
-i4R7Q/9g8xC6oZBtaBMoiVAkL6flDXanYcMQak5x/nPQvyyld+3gSqVVkta0uYg9
-1V54EEiB0TgviF7Gt+7/+UXXEx1dGygRzIV0LdX9dza9VarQmrN5JNhqPePzHiex
-k5ITcrEWbRc59BTH54s3nYRmqH6V43g4IRmu8VKRZ1QQdl59TWkwZ9gjrw1qZObM
-5m9mSeHGd4Hs0h4kpzrhiq+p16q78SAifEIK8D/MKPisL+co3A2nkHPBlhKV3M4V
-Md23894sXGjMUJUq7lIrfChBdolwLvOqOQmLkWasn+QQ2bSixc1C+AxypTbQNgTD
-I548k4nDAgvMsd6uyftUR0rjIe85N/xbgD4uEXUx9J/u8C49AprGoMdqe6q4GdTv
-lwyKsZSPwUV989d6g2C0J8ptt0+5lB9f7H15Da/BemKUeccUZGAjVe55J6hXYkJD
-xUbYq4yEL+6BcaIo/D7jRSJSXY2xbUgkise/99fH/rdOHZQDamvI+yh2yYXVbsGR
-bpd2qtc1OGGA3LRQjz68TS3LBq1iXcQXe+/B3ANus/d/YUGm/pjAb56k3+4z6b9U
-HsXKdEjZ+XCkjmlvlTuCGl0TL8TLn3kOcxJyrTG9MuJ6p55i+QM44ef1Dc2hrnt+
-qVPQLxMQMQ++JOJvW0U4YYoA4eP+HggIx3rZ93Im8tnj07/bCtLkFfNvo0O42Opx
-Kxf8W3d67NyNkA1l3XL58m9/VdfBPjc44wwdMKBy6A4VhNmxvf7Z6A45sihmUAGy
-nCLO0dG9tIM8njEhaXJBcT3YHQKO2xxaHXWmvR5VssOhP4Ewnup2xJioiP3FweYJ
-N4Yv3eVGHLYeDH77Yqq4R9q0He1R2iCwAzFlxOahtX03CANh+vUaKhruw7jNY+L2
-WbrnNPYkjeiU/hFeVSBVgTeVkSQJPiQFK37E9NUo4T6dibGh9VT/5TEoskeUVmfU
-W17FzFwjBGQXaZzvChJFbKPbIE/j6ve7RrjdOBk6IBgi1LTib/rTOcGZbDhOTvIm
-G+1ze435mQVoBK/1MRgpfE4cpssF2TTEeJqs6PfYbqpx/o7cwZG/At3Jra+nKNhq
-WZs6TjIvNGvO7NUUZmfj2QPktLBRKADjym3YqJy4kGUQAZey5yeDWonMhEV9llAK
-LUC40BK6XY7ySw5vTmmGR6nnWo1ltT+71XDj3nZtfGF3TTCkNxZKlsX5HBhfXB/E
-+8PNg6Ova5jyH+IO9Lu7JLqYTh6St6NfVflD7i8ENFLf6X1CiJh6rRseb3TmM2ve
-aj+LypLV8FJ1N7OklFseZy+gqZ7AYCknoOK3z20zL3KMilw7TwTwwfGe41qIhAHu
-LLa7dA0EB58T8isNdBp36H2+oQENGHAIi0kxF0HlE1x9NUoFXvoUhyVEGjEj2zcy
-Rqjb5iSCyELMRJ7qiKyD0e8auH2bQQeHoMmJlCk2E7BXTUUY67eJnNXNrD7ZQg/k
-Yt7OAinFP24nKn4SY2Bwm35JE60iHZ3USoYnrD4twPBbig62fUSYUqqDoNYc5L2g
-AtR5C2SbDOsEG7qbehziw8NLp7zbf/FAashRULc5GLTcFoC2YJHEawhb/lWjo1Az
-nLqXfTB7jXHVbqgjpghJ5vO7PZ+FGg8ylTdUC4aQ/lUWuSeJnjkHDkHFFIfNC4S5
-NYRpQIAYMdDRAP80tdAHeOG5BC1OoA51jBKqBi843tCxu8RUQxDlB5/3AYKB5ndC
-S3Pp6kYXW8wcFAFRluM+LCFzO9VFnZ8BEh5nDX4=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGo2N0ZYUSBZVkFh
+RDNNZCtySlNQTTZFbzJvZmF2TEZKVUM5VjFjQWNSeHlNc1JNZ2hNClVac2pEdWdw
+OVpOTmhWWklVRDA3UzZWWk9QVG1ySUFmTzRSVlFReVdFVFEKLT4gWDI1NTE5IDVD
+eWN2S29aWVNVTTdldXFxZG1vWUNYK2RrajI0OGNGaklzdFByTzlPUkUKTmsvdTE3
+ZFBvalZsdENxR0VnV3FVSnFxTitBRlFWR1BzcjJWd1h0U3hpYwotPiAyOkUlJC1n
+cmVhc2UgIWFOMiogVDc8IFZETk9BSDVTIHEKQ01rc1ZoNXQxUDdtWGRQUlRCV3k1
+djNZeEtOaUl6Tkl5TDA1S2ZXWTFQZEFiV2pWMDJpZ2dkYXdBOGhSTVA2ego4UnBz
+ZGhXcklMd0NVWlhsc0Voem1wUzMyREViUllCRAotLS0gMU5GQjdJaVdlUFJGMG82
+YnZCUm05ak9qcmVyUVJSS0tHaWRRTld3ZkNPMArRgojrBQvlyjMhChn8jgUNDysj
+9Nh3BVqf44fiUNMKARTrFTz3wVMlioo6MmKRzJ/yj0fWkZ2h80X68Nq3rQvy+0UK
+4PNPRbwY5ib0nf7n3itFKjehrYr8HnOjreQps4it52bT5re2TWIC9ogZhNKBLRvB
+qv14HjcF5bGnia8TgSU/8nUZJuIaLwHvS5sc9GOtmV4lDwiSTEJQEtGh716Jzuvs
+XxQLPEVVufAjZUKLp+jWUhXGkvUEeY5bxE2aOLuB8kLfHPC/5p2rl/n2sW3oEDFn
+Fw+XcNnCHWBzk3DlzKZFXwIaZL6Ocqrt+p8CBpWoNhbssuKyOtEbWQOmJxX3UPMt
+sBFNdKSKFhoBQ4ukqkKDhgcm0i+8wG4eBbNIMIDwzPBxK0QiVriwlPQHl7RS2M/J
+LgGeS7qrKC3SgmLu57CdUVUlnogJ4oOg7FPh6x+jQBIIv7gtYCzJb040TUZWZWvi
+cfKWBBwLqLa+7Y6kEhcosLUgw2c9Et5P4rvNjU598q7qrZq7uK6Mr+PMwD3Pd66O
+SQyT4nYhhXBnaIsLXZfima2nRzPocaBmfsuXQwlnLJC8JB6yzqEViK0xYKfl0fIi
+jxuYBw/8Y+MWQhIkF1pP8z+Kw51QdK4CIV33mlLBJnGjlizewsjj04EIgpzQ0+3I
+ZRyee/SzFmGBBk/pMGN0DizA8LS9yZ9DRGrc13rYVUTN6G5xT5AT1eEtFbQ6DH/n
+q13Tur4QJ8AqJmwv1cnX+faH61dXahfbinveXWqB5S95/HE3OGnZfAiS5bs1jW4U
+D3BLaBiFMYD+ccPedg5MLXRgEryVaOWlQ5wuXxqmaCG0KS6YLxl8o0bRR3lKXNZP
+B7Ye0Px69aYtOs58dTOq0Peu039Fi5iNC0beocdKOjig4tZ6p41uz0jPGMUoDebZ
+MYHax+a7Qpi5M6ZVGVpF1ieW2hqnm0lfb18cEYHuXjoI/YlgVhFPCGSzHJpuNiDU
+qJSfOuD8HUB2iXFeEgAi+V3EKTsyjlS+R1zWxkr2awqAk7Uf3svLGWZNINHNoJRe
+CPPANHzTSHlNPSelQ1CyOhl0W/eMCEJuJ9/6kZsmUC3zvzxEMGofG+Ub9RRBW/+/
+TkrVvMrQv7/Va/4dxMPCqrdOQ+3/LkVzGX7qg6tQR76Su0q7aqh38Ki9qWY47bTm
+lq5I2EcQApt/O1cGQJTFowdXVJXx/qQv436p/jL1mymQ8241iQ6XX3DUjbnqdI33
+4XcPa/B7naRkgSG1Z55Vv+IIBOzcjzUMzeQVP/WM3SFRNYT79mJnV0SsKvUFtUOM
+1OxMGEx+ZxfNIZqdp+qo0+uIU00ciokldh4URo9u8EIHjFVcV3Eyb7EbbCxzDiU9
+iwoAAaJjwBlyaRQFWYsKhY2J3NEay142WAyAiHmnNBNhZM9TKkCpjton4ehxeRUC
+hoXpzh4J2lMhdcmXXZ675C3MYiLDpajgLS1dwRp+mAUXwjvQG5rmJd7UWdgpbdpJ
+K6wABNkl601XgKv3/nV9touE0KQjHg1fzo9vzmf8zVEViTgXxH3NECZHctObwgoo
+SlbUOW8vihCi2HU9G3tqH7dwkUsgB2a22JFovgwwW8ePKJQpdvwAV/jyFMLL6jyj
+6Tf0Gsc/Iut6Mh5TYiTWJdCzvEBjcybOVnppj2zR32/A/vAXUrJQaq0kwKkCwG+e
+TL0hAQuA2Su27qTR9Xy2QKpQ5NppRH7V9YxCpjGfcLbcCh7XH7AEZaYfrrX8NoP5
+zPalFA+7E1IuDRtT29wFNRVb3lAet9t5q0LUHf3x+Qk23dQ7Mdq2JIf9RIo5xZ6X
+nsKa9eBQ0O5OAv1VGWVvbrVCMpmyiklYV2rcIT+dbrhrgiTu/BvODSvtmeANIkhC
+uF112/+QW1UNPCENioYq9OWPcEwby+s9JkQf5nTub2o/0lTFKJxNgXa1QBcKKVyC
+9aTCRhcxXsfuR7YzbCXRcK2hUW203iS8+UgAfZBVe5GhskOd0ZR0WSkse+jGzPqI
+tnH5F0yQgLn9emebpL6dNFUVvssjpiMlvkijXFJv1tWSKLb3TxJd2BE/w5Zj7Haz
+iv7Wz6o5+bY4v2YL2Ev7hGzfSaef+ip7/BYZ9TGuzSoZEHMYa7dNT8kRR18IhfXv
+Y3wa2xlOhB+WE3AjtYy1oTi2c6Vmd9UKASZy/Eb++j1MSPtxZQLNaj+svCmqqfvO
+/gElVfGlgkomYwc2EfJvR1lt9u9YGepxKrafPsgvjR6bYPwLF7eHKkKyEiqGCYnW
+mcNJz/B0egxhFjoGd0U17tNuZcYRD/Tsj9ugGF+4/q+IaEV2YzZTdGzupI3lW17o
+Q4H+EksxkWYDr0WRlYKn7VT1gTThuggEz77JskjNP4jK29EOIEO9IqGMh39tXsud
+mhL2Z6XMX6sgxSjSkYxLpFnS1mRZ6uQnSptxHTfnG6jYhq//MTjGX7xmYBj5EoTC
+duHuaCqjRXc3yHWoNm8jepkpbe1PPbwEbL6RDK16G3g0WVREjZopj+66C2xlY8Bq
+ZCmHhud22QHs+5r1LLSIynsUlGIOvq30DZ0F2/f9Gm7uayIYbp8gA4z7M7RjmHoZ
+XHYSPc4kH4a3T9MucQQGzJMl1k/bifBAWLbu9uPcDUe7Cglfz0wHnPemOu8HZXY
+6qS1n6PAHyyGlqX/pNWxR2vQrHJRksdTCvjl4g6256PhaMDop3QAHuQj9meYKIqP
+MiZexiuOW3KjPJ30Gx1Q7PnUc+w3SjjsKaZEvRgeWKa37rvj1ICTnBQUPq2HV6y8
+zaGnJcfd0ENAmFnRaCIbdU6TRonnIAAuSfE2gtLni/PJbmUpznuq82W//kxvH1tR
+oPx6LuM2+hRncMoyXUTWSUVO1DAUPXgZA+j7fkkwmosi14d/5xe3wO4U3dGZ6wAY
+D+zlzhq4d/4vIvLIL0NoBcp8yM+xWxPTtvj7HUJ7BOVV06ICnilUlv2wjR+dZLZK
+DyjWhMoqk8r2TDZbAQr8MNX+sSlp1JxQEgBijpqBvRdF/ulqraF/GFDFRLcEi7D+
+AkHPg4TrmaNB5ixsj72j0xruFJxgQJGj8fwQtemJGu8QcuJbCvJ74TI3vu0Pac/C
+MRov1TAVJB7+iVvVNEgCMlzimJCSCUYh1Zgk5Ci2CDFMFRAEcGoHywIW6v5V8j5o
+v30mJKZCVFc4Yibivjj1aGhQVO72vgiog4L++i7CeXHIu6Fe1Jmlve5iuxrQA2aM
+9vjCbFJIi8k5vQTVcKPRcsto7/qbyxvWvahKBBbHl53XnSb0WtLUyTEaXJ+0l5gy
+Epxfl6ZRNkt+YBYBqCZL9aK6TNpCR+zTC7OhrKcZntqFYCeRB25YEfc1z0lTH4SE
+TPymGSMOeUX8YEIr+XNYG0H/I7ZtEdNGBEXaUrC4YUNrvojpq3PS9bhfLhAf5D11
+wmI2tS9cqxAuS2zkaBr9Qo5xNEVsyGNFd1K0q0JJosiMnVZDzOA4wJTYhOw5gwcW
+T1Kh/LDvK4RE0CV0jRqN81YO8V6Jq+/c2kgtwTLzrx1GCcdHRsY2kPhCEWOTLKb8
+Jn5nyyvOOjMIkAEYYqoRRxl05UbNWNS9SuO2g9HF6JpNJmw0cmzT8erIIjVvaUs5
+dd0Bd5EgkkLq3RMPNTiidQCyIy8QtoElmxYfM11mbf+JMgxsB3sDcRGN4lauUhho
+JlayuFUfrQEwtHFwyULiJwUC55faVqOQzyvcQ8C9AJezDXS7//ku1kvEgbzK0nFm
+3bCCiuog7pG9XlldSReYvlJtnqTmp6E5+m9YaP+yB2E+swKBORHkbCfBu1CuX6R+
+aryBYIDeLaIiJs5GWJN//37TT0hVUCipY9QISfTiZ5tIy0aNKRu9syjWphcoTJuv
+YBaRxKNdZs81ppFTa3sXB824+QXwzRJJPjBndXOtyX/a2U68NK3dqau/A5190VAn
+bn7jnJ68rhcL9ewwydQRm72qwyxBbRHFXnEXpkJhzYRw6fosglqbOJMxFiy36HWD
+RkVluvTInw8Em/DhhWgn+UrxLlQN6JnVdpkT9hwrlFWooiM56UKAPO2a1FM2XKXe
+TqsolY07uWnA+ouiljqIpsaFlVDBcz/sGZWqy4aKKPBTcZlreW88PMsS0c9nixVi
+nKnmI00HuzeL85zVHGo0IKYfktVVjuZNPzJ6+w18XpKIi8TxHpxELC9M2kVOCnuy
+uwuntJlRty+GpXVvx2VLi1wBKyLpXUxhyg1tSi2sZyjIdVt4yEOKfajZYOp73JZx
+IcInD7Cby9olkMsa25YhloljY8YELfW8EWutF13m8tsjGP9c6aOuMIXhrrpwLgYy
+E27iFh9tHq0mjCMibwQnHld7Ccd4OqO4AKfPofHDxWoY9+ivArOBAXjsCxhxWWWp
+aLqLJz+JH+idcsVDlw8jJzFW6pQFbM3VxXObvCg9ou5+P+Pc5XYyALJzIlmoOrN+
+ns5Z+U/2XKGyySQASUyFXUNml6csSrTd+ejz1QvEX9POU1nLmvS1+aojgnptgdpn
+sAtksQHMt1Njo1oRug3+/0iC6XWEig==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/dhparams.pem.age
+++ b/secrets/dhparams.pem.age
@@ -1,33 +1,35 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBqaFcw
-aURxK3cvaktEVkJIQ2dOOEtqbVVGRDN0SXpXdGI3NzhQV3FmaEJrCmVtclBDY2Zr
-cVMvUld4dDNybnJ4bHZOODFpNGpJVXdRaDJKY1ZxMy8yMjQKLT4gc3NoLWVkMjU1
-MTkgakk4UkFnIEtDRTNkdi9VdGFnNkQvdE1UdHQyRmJXR1RtR21HTXMwa2hiK2xM
-Ym9xa2sKYTFVQmVCNmJId2pPQk4wd3g4N3pOc1lHcjg3YlBEa0FsQlVsb0RKRjYw
-RQotPiBzc2gtZWQyNTUxOSBnU3hQMFEgOVM3K2NwalE0Vk1rbWdSL2srbXg2bkF2
-MTduekNpMFA1QkFBNHJidERpYwpCbWQreWk4cTllUnluWHZaMXZWREpqZnlwL1Ex
-R3k0cWhHSGg2SkJPSkNZCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBwdS9CeklwWmpt
-TkxWYnhTTjVxNVREOFBqQXhRWHlza3FLY202K0wxM1RNCi93YVFOTGJGNmYzZzhF
-WkpFMDd6V1JIcjR6ZXcwUys5UkE1ejdFOW91MWMKLT4gWDI1NTE5IEk0aGh0c09n
-T3B0ZkNSc3NTa2doUGs2c0NKTTVMOENPRjJ6KzlodnBxR1EKUnB6azR1V3NHUnRR
-WmNrWHArZ2dmMUdEaGovYUdndDVNNlB2UW5VaVdnOAotPiAsLWdyZWFzZSAlUSA1
-WX0gJwpCMG1tNjBPMVJRMGRlQ25KLzJsblFzZkN2LzNDOGcwWEdSSXlBUjNwCi0t
-LSAyY2hHNFNmWFBQWEsvb2hxTUxVUXdKL2p3ZkZWSHRDdFlkREJyaWJrVDg0Cis5
-gfdBAb92J5/DuoXUt8OirgM7bXucabAp8/U5Az0nmRkGawpSZidB9ecPYHfcdUGp
-VIv8roO6P0RbbfYXh3szT1YmEMyOXMHFM0+Yunq3u1ca1EHCZDV6Feb+i+lXIBJU
-GST4oupwMET+ChVT1/yg7A9o4FY68+FgLjGwE1qeHN8gQr6aMz6/yml/z1WzBEXW
-XEv5fVxGj39eBiq08Z/kCgt5zVDod8RxEq3S3kt1KX5JD+mpGYn2z5CMGhn7fclM
-mj37LaVbcKfyVnwRlLPoN19NeqR+ltM3mu6ibjC7cOQ0E1D/zjQMIxtzNzmZRFgB
-l/BEOsX25Zv5vJgLZBU9rMfybNVAjDroG5V1cCVDRR76TP6HVJIXSriyOW5xSFCy
-Li/VyhWaUXRboGq0Nt4vXWuOTlU/tenlBnBc+d48x35VCExi9IEFpIHj1fUwM/0V
-dgOfY2WRH9C2cObUc6W51FIARkp777uPXRbT4ZXRDjV18vb18CmwLQQwYupQYnZk
-c0hZHvoxDwg5QirWxPhuO3bWDqIvHiKy1LYgRrlvr4Wpcb1l0lAYSGX2r1+QVj8z
-tA+zJcUaPkjUSpaqF4LNVWXrTWEN330gQrVk1knWqPl+hFPoyFEHP50PNYr3yxS0
-VxbSpg46cXyxi89ghwlXBqI4LRtWlheUoIOuNyLxvXZECwCI2kmt+XBFph5lbG7F
-UQaH+ve+trb3oYkkG8ZprCljUC7HvSyt31UIRF3l4sLsULQKHqWwVD/2M4B0N5wQ
-IzIJkiuWBBE8IX/tI5vUlGx+QWSxmKdHD2mMb/GeMsbo7lOY51cWe8oxe9WcYPhB
-m4h1xPm4FLo0vHCnWIkXy2o8JYr6fmpjzslC++wYMEbIH3gRBKUVjgUGHywVIXSa
-uwzRULUiD8uXFNT3cZ+YDnAvZkuYz528DBKjd5jNen4akah35wQ+oYoGuIhUKkGL
-K59+hTyctWyEGi+fCl1gah2JJ6aF1CXK69ON11YkCEVCI1SK1o1no/0NZj2XtepU
-MgXln0Pz+pOTZzcjCWhYTO/dNl+Xj6EeeSjjWHqDYg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyB3QTU1
+TEdvbFNaUmE4U1lCNzI1dlloVDBTNXdURjZ2akRMV0R6dm5ST0FNCk9YclRSakhT
+NlV2UVJwak9Fa3dQNTNBK0xKWGlkNXdwZTBEMm4xZzc3azQKLT4gc3NoLWVkMjU1
+MTkgakk4UkFnIGNBMHNrdG84cUQxd1lqQmJIczlScU1jNk52Y3BtR2tXeDNWdWRX
+cEFCR0UKVU5vem5MZUFPbGhoQzJTYnF4OTd3OW9jYTRkazdocVJkZ0pRRGNLek93
+cwotPiBzc2gtZWQyNTUxOSBnU3hQMFEgQ2RUaEUyV1ZGbGRtZnlIUEtTQXk5MUZF
+djYxZ0hBUThlV2tXTHNvdXpVSQpMdiswMy9QNUtCb1hkbGRqR0Nia3FXTzE1ajZL
+UXljSTZqM2YvbzVuWUFzCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBYL1NrRjRaRnFn
+RlNLdWJ3cThteDM3WmNaY210d3RmZzhCYmNpVXBwVGlVCjBkM0IzZC9zNjhmTTZV
+R25ySkVoQWxQQ252WWFlWWZFMlc5dWtUN3VvVTgKLT4gWDI1NTE5IE8yUU1pWGFr
+NzUvZVpwalB6aklkWmJGWUQzTnJiRjNzdzY2MUp6MkY5M1UKR1VIWDVyTFpxem5F
+TmRNWE9zZStLanRTdlU5d0NOSEJKdWhDUjBCdy9vOAotPiBTJCd2NyFYey1ncmVh
+c2UgfE4mYSBXfms0TC5FPiBiYmx8IGRFV35mciNoCjVZdHRiVUtMMWxEMlJ4b1F1
+TGgxY01XTlZpTEtndkg0T0hRVjlqVUJGMUpSaE5tVlZWR3VGenpkUXY2eXJtbmkK
+ZCtqRVN4dnZENXdoYkpjNHRWYXkvN2laY1p4YjV0WQotLS0gOHlEVTVOSmlNemNQ
+TW5ISk1DeDlEM1RoQ2JtUFlyTXRKQjdnT0hiend2VQqrUFvr+76sKn0ldBmZMlEW
+U2k85DLo2KU+/+GtbkZwVXxxIZHMLpoJgghHk9ptdalUgLGcl0X15x9jVaw8aeta
+hbeOHotRHY7bC3z0S74riTk3xDMR1eT0QGhDMWHjfo8SkCftOYBlFfhTftevdep3
+pKMZsuQMwH9JzxgUfcxIcWE975cZzrEJ85nfWMGvdSjcg51KNxP/UUPRxDlcbCEf
+9XX5apSzNsTI3ibGD1n6Qwq8bdVYDMHmy5pAhw4l8L+SdoU1tGdw7JOA16sMCJbx
+T4bV0ky/PGRonjJuCyDBj8oe9vMe1ZI1O/ITtktekS+wocxBs6QXlY7pIZMlGUn2
+6m59ZEEaf7R4/MdnmBDNDkQuyXaKc7SaTc6h5sKWzXdYScGUKvgUQ7U/WJ2ItUTC
+N/Xq07GkZZMt5MYBlyEr+/mKWlcy+ylJPGb7EswvQWaHoeM1QF0XLZ1v+W/Xsso0
+seIoz+geSu9a02kwfsa8WvWXdIAT5X2pNGPClVNzjQ23pfQfQuW8ZQrGmIFR4g5A
+58T1K+vGLdShqqVGyJFMVrSuOzqX5FVmZalu7/++1IQfiRGUlrHKoPlKWnCfFEOu
+AYjaPeEFX2ByxcqfMK1YVPvUufdISUQeaQOO7mXGE3FqB0oUqmRIUiWZATwhq3Pw
+p5QdcySTnmMpD/w05hvwski77kCdmYuHlMlLZez/kfhTnIGXris+Vwi/V19bsZ8G
+zwaZ/Xr6WNC+df5JqSfTGREnXZPFRDkaTt3ri5/eEm6BqliuYjGbuiKsDECi4+JX
+bHpH6LBBoKQ6ms7jCAn0Ls4cUKF37PcjGAOuWnzCSBU+REht1EDfHzx4C7hNiP8X
+87NjEqJbwE9lORho0hQJRTn8uriQcidlVoB3se2SYKbMy8UA4NNnxN9PTj0TuQjL
+OD3LtqHBElqNPbGNyyEAAJmMBmmkUvPPXlGQ0D99b1+jIdHzYSRtOLshBFykqWYQ
+LJD61duhGqcQqcLx4+JdQ+oVcfAI2nG7YINnHB0OmS2DOZvvwqQ7ASScSujUWIjA
+LNQxu3ruMz+bw/G0tYZBBiE=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/kelder-wg.key.age
+++ b/secrets/estuary/kelder-wg.key.age
@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBvL0hp
-WUs1VWxPVlpydU01cjd3Qk9qd3hvWVdvK1VMaUZNT1YzQ1BjdWhvCmJlSDRDSFBj
-ZGVmVGV3Vmp5YitGbm50aU56VDZCc1hTdjJmSGhEa2dvZWcKLT4gWDI1NTE5IEsy
-RHVVT1F5d0kxN2VBMG56NnJWYTlEeFFXaHg2VnNqdlJKTHhoR052akEKZjNObUtk
-RCt4Q2l2R055TnJCSDBrY1lWaUZibk5iUDhnMlhvZkxRRkhpOAotPiB2LWdyZWFz
-ZSBMdUErIHQpI01mVENmICFrK2dRdjBbIFU5UyI+KjQjCitmdU4ySDhJMDRlbklD
-aUcvREFqdVNtb1lFZWwxZWo5VXdNUGZQWGt6SVRKaUI4cTcrWEx3NThWZ3VORkor
-cy8KbG9EaGV1dGVDQQotLS0gQlFJdWpudnkrcmQvbEhpOUM5Y3RCWWRGMEQ2TUV5
-eTBFSnBkd0xnYjUrUQrxdaCf14h8hqRfdnMorggnbuCDMRHY7nAnGQ1ET4CBlCog
-/Rp52aNZHfLh+BFFZazenI7qrvVvEaaB2ZVKa0Z/F8adsGHSGSwz+saqWw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBEcDNm
+ajc3a0gwYmVSdkowak1aakJ3VWZ1Rk50S1JIS0ExVktVSW9OVWljCjJqbUEySlNK
+a0xyT3NPK1BBMjZzN0RrLzhwVitvS0pzQ25iSnJSc3FmM0EKLT4gWDI1NTE5IHk0
+M2pkWHgyMHR1WHc5bE4xWTFDTndKdkhRdTg5bzZIWEU2cm02UDZBQjgKUUY3dS9p
+U3h1L1ZvTkFPdURLZ2tSYXJXOGNZZ21KVGdIbXdhSUJrd2puYwotPiAoL0RtO0lH
+OS1ncmVhc2UKVGthN0ZSU0ZFTTg5YW9UOXMwa3RnSzFlMjE2VTN3Ci0tLSBwMEMx
+Q0tQckd3SzBwUUE4SndMV01kUjVrOTdDWmxlcWs2Zy9TZk5yMzhvCrBXyLBZGuSD
+dJodNI13obTM3UvX6hSgQ8Su+J3fOKr5NibkhQ0Auvlr2tUXhhDm2WOUlHjqVTq+
+jWLSyhioDlIEyBgk8Zrl7KGeDzBi
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/netdata/powerdns.conf.age
+++ b/secrets/estuary/netdata/powerdns.conf.age
@@ -1,13 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrVktQ
-Y05RdDFyeUhGNDBiK3VHNzlrMVhKWlBJQnhodkUvTTlINUZ5K1hVCjJ5bXo2cTd1
-a3FCaHJTNVNaL1ZRcDhuTENuZVlhWlpJUUVndVErbDVoR2cKLT4gWDI1NTE5IEVj
-VTErMFVTdHBoVmtMY2R5SmJSdHV0aTJ2SWZNc1hrN0h5S2dKUnFxRFUKTHpyaHV6
-WWFYME5xNndlSklvNU9GSEFrTFpnc1cya0NMQUlqc1Fhd0hNNAotPiBoRSMmKiNW
-Pi1ncmVhc2UKZDQrM2piclMxdExSdUZqcmhVV3l1K3RHVFlOcFZzN1IycnU0d09k
-V1dwREZDaEcreDQ0enJYd1FXMDd3d3BVNAowYlpwK1EKLS0tIEwrL09nY0FpSTlq
-bFhQTUtHOWt2NWV0TDArRy9iaFRFTEIxbms4SmI0ejgKmJRGof5FAIPpGn+u6PDh
-xSQMKrpFnGvjKs2FicG7K3C19YGVwvMds9XGYzLLdugvZgykzZhq13XK/mSk2b9r
-9xkhAvCQ0p1ikQDyX6SuLwJzsJpa7V7wHbEF5HJXQ5NrJUOFwftzxSqYodtP29L4
-LiA8sxPzNeqhFYT/C8Ea4lDzgnXCjoWtMcZCpfWMMtOJh8fLLw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBzaEo5
+RzNndHBLMUl3Z2txdVZoOVJBbWsrTVJwY01WeHQ0VTBaSm5VclY0CnJLYStYNEI5
+VTN3dEQ0ZjBKaU1PZSt3d0lldkE5VC9wNHdWazNWV2F6WWMKLT4gWDI1NTE5IEJ5
+amlzTDhCOFF0TllPd2RsME5Cb1lRQUZPTGNvOEZnL1J2Wlpnb29GblUKT2t1NFZy
+blNZSHdxZjlHTlZmaTFYT0laQ1IwOCtDZ21vTjhxM0owdTAvawotPiBLYS1ncmVh
+c2UgRX0nVGtpSCUgNVNDWCVwIDBuPjM3MwplK2cwc2htQ2RLcFhUZ0RSc21uQlFV
+Y1QwSStOK3lKYmVVQ0J5RXA3Zytaa0JoMWtlWU9qMHBLNktFZWxtbFpDCnJyS0JJ
+WEcwbndYbERreFhLZlRyQ3E0czB5NkREancxZk5BTGdWRkR6N2NrZmFrbnhSYlZZ
+NElHNEEKLS0tIGVLdXAxU0ZaZVkxaHV4dEZNNUVuc2J4N3VRMzZzTktSMDY3bDVB
+bWtmUVkKigIZ3J0s23vNzmbzJGjSMGBXK6o6xnsA9HXeQZ13VgKv5Qv+UHu+Z0g2
+TeKdQSrHbDB3ydIxaiXsi2ivULdrIMCyd96rEJFxrkVuVqSZE0ehG5j+o8lKk4OU
+PDe70slbZrVYDSu+OOUOCVRSopZreCURlYn2Pc4rjvrMAn5r1r+/AxjZMdkmmQZ0
+l0wMBTus5zZzKg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/netdata/powerdns_recursor.conf.age
+++ b/secrets/estuary/netdata/powerdns_recursor.conf.age
@@ -1,13 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA3enI5
-NkVZMkxncHRiSFkzRm9seGdwdGNPM2ZFckRoWkZFNlV3Rkl4U0UwClJ0bUZlUlFs
-MVNsNmZ6aFFYRjJSQmNWdjJMc3F4cTNrejMyME1YRGdQVU0KLT4gWDI1NTE5IHlR
-VlI3eGVMcS96a0ozWkx2b29wTWtIbFFCcDJEa0g4dWJvdnhGQWFwMUkKZjQ0MzlQ
-VDlGdkdxNG91bDV2MFZXazM5SlIrUmduYTJacGtXQitnTXU4UQotPiBNQktGOG4t
-Ky1ncmVhc2UgZzddIElDKW0KZTFiNlIvcEt6aHUvY3h5VFVtb29ZQ0RGODBtTUF1
-TS9Ta2lZZDJJUFNyOGp0aU9LCi0tLSAxa0ZNWnM2b2loNzNFMmd4U1V4NUFnZ2RO
-SVRaUDVpNHVHMUFSczNOcVZzCiJKbkbVr3dPswaIeb/dlP5REMZW0NoxMluj8R73
-AcCimbLRWY2KAOx5XU/ci2auvMqjlqMExlp608OwaGHcpmoijNZQsKgTAW8Z4z28
-9UbAMOmSWByLfgAzhoN4Xob5/40JjI2f3wFYwsAf0f/j6dLc2lmqxkhd+Zcj76Yj
-t2WbVgPlBMqPQIoFd6TtwJweqzzGmLI=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBoZUI4
+bEdWSW1pcDdMYVRJLzdQOWhsdTlZMmlyZjRVeEFwU3Z3NzVFa3lBCkxRZ1FYeU9D
+L2dramp4WFFlREZ3NTFnWUs3clVEcnBhLzExclVac1M2SG8KLT4gWDI1NTE5IHVZ
+bk9QYy94Tk50c1dVanNvNzhpYWNqeFMzVVR0eTQ5OXozMmp2VFlad2cKaEdvUnR5
+ZjhsQ1FRaittQXFkbnRZei85MmtWb3pXRVFsc0RzNzBPMXFMWQotPiAzSXJZb0RE
+LWdyZWFzZSBudCBGIDklTWIjVnwgM3YvCjRVYUd2TForc0gycnRBR05MbU90QmNu
+dXlmQVB2bnZyME5heXlyMUdGTmR6SVd5SHcrTThrZEJYRlpnUmdmWnkKU1lyNjQ3
+T0J6b3NPQ1FYZnhxTjFrYmN1UUJzMjEwcDBwSTJkTnlmeHl3WmFFTXB4eUVMWm9i
+NExUZzM2SHlLLwpiZjQKLS0tIHdqakpMSUNOdnlBcVA4RGJHR2d5QnJNT2dVclZN
+djd4WXBLSUhORktzZ2sKzMjxqL3UPrtGmXDijdfu0AwxLJooK7ZKauYvXWSuZUrR
+vl5i1QPMEEBYEl+NaZIFgxAFqWpAXHQ1VxSijMWxNjKUd1Chq0tbLrpbh9wXJflK
+SW19Wyqc9eTb8BnFoOSYWpDvAs2Lbyr2kJkOj2TNrwMv8nDJdOB8XIPlV5drCj1q
+Dx/1zWqm6NMYxsep6eZkv4AzxA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/auth.conf.age
+++ b/secrets/estuary/pdns/auth.conf.age
@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA0N01m
-Z1RiUHFFbmlDVVgwTWQ5Nmw3WU1NckVFcWQ1SGVsQlZLdGIxSFJzCnZpL3dmRWdY
-UlVaOW0yT1ZmUXU0VkFHNmRzbFk4cEt3dW91MHdnR240eVEKLT4gWDI1NTE5IGtC
-RTg1eThyRHlSZ0VsUEVzUm1EYVFIVHZZaHNvY21mOS9mTnlRbW03aEkKQjIraStT
-WE5sRUx3S29CcTRobHZVQXJDQTQ1YXg4Z2c4cS9zSVhVVElXcwotPiBoM09vUG0t
-Z3JlYXNlIF4nRnwkeSEgKTRZIHIKT2FXTWZmbW9jSnkrYmp0WWVDVTZHdFFxcXJt
-Rkg3S08xVGZ0TVVjTHQwaExFbkh3WDB6bWJkVEFKYXpQUDEvSQpGNXY0ZS94SVY5
-anViSzJ3NlNOUmp0eUliYms1Smd0RUVXVGhxdlV6TkFNVkpzcwotLS0gQnc2Y0ZS
-aGNtL2RwUjVxZE9uYlpBeVMwd2M4RTNsdW0wVWpDd2hLLzJSWQq07wZpB40EpZog
-fW3t5Uokt7EZL4V4RX9PFyd48SaEd/xR1FiEL7jg8IJp0dY7hdfnzObQbueCwUOi
-lWOfF3n8XpzS8uo5TgLWLtY=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBrd0pM
+TGw1anJNaGoyQ3lMUis1cHVtRWFPcFFNZk9Cdm9TMEh1QTdKc25ZCm9VNzVQcUxE
+Njh2Wi80RWszSU5NczRNcHpVYXpRMzJNcDRsdGxyWVZsUDgKLT4gWDI1NTE5IFpT
+MEJVUkcycVFJaVFOUURoL29VT3R0MVJCWW04NXVRVEpKY3hlY1lWRkEKcENya1Jx
+VnBCMVBrZkc4VDkvMnZoTllCL09vQ0VOZytuMnRvYVQxL2FldwotPiAzLWdyZWFz
+ZSBCNX0gIiB7InIsfCAkOT9uM2UKUWpSYTZ1dUo3SHNaUlFibTl0UDhTaFh5Mk1n
+bFp2cjM5RGhqU0s0Qm50Zk1pUVZmT0R6ZjBoUG1EUGlKbHFzVwozQ2t1cWVDVVAv
+Q21QTjF3NW5UdTBZRldnL0RmSlV3QndHcDB0d0lvZ1RHTTByS1ZwNkNVQnU3WmVn
+ZwotLS0gb0Fxb2FsYzgwRjJwSUF3ei9hZVR2Vk1ORDlIMWoyZ2RTd09hUmtvMWpD
+cwrEjdaYfoGZ9i/S97xL9QvA/yii+sJLeuUzzv7a3DE661eQ5ezurV8Qz1tIhxWG
+RsOppaaj1podFx3U1x7QQbLO6zQbJA458RMjYgc=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/recursor.conf.age
+++ b/secrets/estuary/pdns/recursor.conf.age
@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA4bGQr
-dzJZbU4reWI1Sk45QTR3UkRoc0NvaDBFcUwrVWlCYWUrcWtYZGpNCm1PWjVzRVlt
-UDFKY2ZSZTg4S2pVZ0pDNzR1WklYQ3pEclJZLy9kKzdGTGsKLT4gWDI1NTE5IHFO
-TXVRK2d3azg2cHpRanhUNXp6YnRsZW1MUDJqc3l1bnNYNUhHaTIzMVkKWXp1M09H
-TnJIazRmb0tOSnE1Q0E1dERiaHZCQkh2YzE1cS9zRUhwaEovMAotPiBzPj5nLWdy
-ZWFzZQozSThRWnJCcVFFRHpoSi9tZnZMdnJoRlFud2VISHBHSThMem9qZVVWdS9C
-VFBDVEVzbUVCdFU2Qy9PaGdyc0FaCmk3UFZma2ZiR3hmWG1sa053bDBnY04yZ1VZ
-TW9jZwotLS0gMDVSaE5aakxHenFPVXpXa1JxczlWQ2x2VGNuQzdwaWZFTTFTaUp6
-cnRmZwoomylfwjD5A3N21/mk1Wtt8f4bsK747iZz7KT34kqmoX597rbGYxyip5lg
-VLZV6CY4LLRjnnSKoC2hIXU0dgudAmvxhztuaQ42fOc=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyBHNWg0
+WGRGZnlTdEhsRm96T0ZMOWx4UUxkTitJa3hMWDE1dVkreEtEa0RVClpvR2I5NGpz
+aUF0N1VZU05oWXUzTEI1TVBLYlVVang3Zzgwbi9teDVlQlEKLT4gWDI1NTE5IG4v
+OXRIbzhaZEdXc1pjTnRRWHVxc2ZTcmozSlJkY3lyOGtvd1BVeGprVUkKdUNqSW94
+SUIyOWtsNU83cnVOTUxNR1BvWHJPczdzUWc4aGp1MjlpZm5ESQotPiA2KSV2PVx5
+LWdyZWFzZSBqezVxOHc9biA+aD4tP20mXwpwRCtMUDhmcVhGNXpCZlFmSllpdDVp
+SmFZelNhZnJlR25DS2l2MlQ3ZGFtdGxkZEdEWVNrRlk1VEZBRm9GMHBFCkVlQ1hp
+WnhOTGl2R2s5RDRKN0p5TmF6Y0cyN3ZlR2pDZlhMVjQ1c0FJN3hCbFEKLS0tIEFT
+bjFiRStXMmJueHdsRm1nU084dDRpS0tBT21ENzZFclJXbE11NWJETm8KyMHU+tZY
+QELtZCbXKWnP8QC6V84JIFAxoRslACwsIJZpogcZO/IFIV2RGunGjCJk6QBmhOPV
+kJXRcGO/ndYjWfuU0U3+9HtPocnO
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/actions-runner.env.age
+++ b/secrets/gitea/actions-runner.env.age
@@ -1,13 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBzc05k
-SWtwMW9tdzAvL1hYenU4Wm9MTGF5MDIzS1Q1eHR5TDNlRHkzWEVBCjBWa1IyaHFr
-MW1Xb0dSU2tVTlhuT09rTUF1Tnp0Um1EdExGSjk0ejJJSDAKLT4gWDI1NTE5IG55
-M1RVRy9YK1dhZnRFMWdpakptVkNmaXJyOWJxSUlLcHV3a2NHa0N3RWcKQ00wUmhY
-UExuTXZ0bWhjQllQOVB3WnAwbnk5WjlURDdpQ0pqNjVvMExjbwotPiBPfj14Slot
-LWdyZWFzZSBEPyB1O3spbCBYPCx0b0RQIFtTUmJUOAovelJwVUZibjBibWp0MmZ6
-WFNVMDZkbFJOMExlaEFUbFBBWnROWVVtMkNvR29ham9pV1dHVDV6M1BVWjBldU1L
-CkptRVEyWjNBc3dXdkFWN0NlTld4M3lnCi0tLSByMk13SzY1L3R0NlRCVG9lcVor
-NVVmT1hxdnpSL0QrU0k2RWxlRUY5SldvCiBWgIk3pt8hcWFRsH6oleoX56bT+nz8
-BZx959QwOE0of9n8Prfnviq15L9Uan8yL/CadSS+0kyir8AHhl3sV/VLFe9nlZZ6
-Zg81EdhQXSQ=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBOZ1RV
+VVpOZ0Jhd2x4YklMOHdkNkd0MEM4ekZiYXFKMjRIdXlZVDFkOTFZCkRreDZlK3Bo
+WmJ1MDBxSU5UYzRuUDMvdnpVc0prNFF4MjM0M1FaZmg4V1EKLT4gWDI1NTE5IEkz
+THNsVDVCbU9KYWpXL010OVRmNjBVVmVyVzhRZW5McVFJcnA3ZWJvZzQKOE1lQnVX
+Nk1rWVAvS1lpbDEzb2ViUUE4RlB5NnJOZmNoUGdUMGNuMk1iMAotPiBuYVwtZ3Jl
+YXNlIHdYXzh3MSB0TyREIGpdTjheeQpJZ2pYUyt6UC9vVmRNZU1uaDdvR2ZUNG0K
+LS0tIHNCRno2V21tZU9XV1UwR2IvZDdkWEMzZDI4V25Yb0lvdmJadXNEZFV6TEEK
+81uT8S3QJNe+mVadi/VpXSPEP0Ygzm0/+1pB5qqYlSQEWTHqS55gCyFCwu+sjaDq
+DpYTSm1JAk5ql9NRj4fJvCS53lJZ4zo+5c0iJKmuRg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/db.txt.age
+++ b/secrets/gitea/db.txt.age
@@ -1,10 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA3TXZY
-OTBpcmd0WmplOWFEbmMwTjVidC9BSFh2OUVqZXo1bzRvcEFvS3hvCkx0NytPaE1Y
-NDliWk93SnNxb3lOdlV6em04bllsVmZuVllwYnZ0SytLZlUKLT4gWDI1NTE5IHFu
-bTgzM1NLWXZmWFVqVTQ0em5XajVEbkQvV1JxSXp3anZFc3EzeTdHQVEKYTc3eTVv
-cUFyYjU0UGErc01GclRhU0xtUWNzQ1F1cm45d2NVdHdDNWNWOAotPiBvWFhMLWdy
-ZWFzZSBQMV9mNiBrdzVuNSBOOSkKOU9BZE5WUzdIbncKLS0tIGplTzYyQVNBR1g2
-N3VUUHRCVjY4cjBGYTV4akpEbGNPUm9SRXhvUzRzcDQKhBEb7xKAjU3SMSgsVxBa
-8KA0Rh6lgJ0HOLgfBI8cZTzHcNXeIOgOTae1GmStyVjUkw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBBOVJi
+SXdGVDlXWmVGZUM0OTJPUWFYem5qZzAwZWxhNzhpT2t1VjdZU0ZrCjYxWUE2VW5o
+cGFLZ3g3Y3BpUWlWOUtUYTg4MGZXVHZvdVV3eU9iZW0ybE0KLT4gWDI1NTE5IDIw
+QmxaWTY0WjJFZUd6TUxqaHhRelpRQ1hGZVBEcm43d3JYUVhpTWp4aGcKVzhJdFFu
+SEhUUUZVNVk1N2tzekpzUS9RazRCcFBhb2xxbkhRNEwzVys5cwotPiBkeE19PHEm
+LWdyZWFzZQpwR0xsb05JVlFXQTZZQkJSWHY0akNRdjh1eXFnbmFDWUlCM0xLWXBi
+QkVuanloRQotLS0gZTkrT212MXdsZy9Kb1AwMkFHU3VsTElweGNlYkZ2UWVXRzkr
+dnB0SHRnYwrveLSY6SdUDO+QH7WGniLIOPcECTQ7CiTj9lwD5Hm0rYLdvizolb33
+CsGX/kSEI2bD
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/mail.txt.age
+++ b/secrets/gitea/mail.txt.age
@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBsOXZu
-WENWTnkzdzgxVDVFY3BXSTBOUGgwY2xyMm1EQklDTG45V3JraEZrCmk1TjFMbGg3
-WHB5b2s2WEZjV0lIT2pGci9TbC8rbUY4eVhhZVFDdVpHWkUKLT4gWDI1NTE5IG0w
-RGpobG1sNXFBOSttVUdEd0RjSHpORm5tTVBLSG5iMnlHeDd3MVJ6MjgKNktpT0N2
-RDg5S3A4clR0RmltNmZ6bVdBYklONGwycU00ZnFQMTJmcEhpYwotPiA0bFlqMi1n
-cmVhc2UgU3ZAOyArVndDWCB7RmZiIVd6YQp2dnlBOExZQ204TEpuVy9vOHVNc1ND
-d3dQc0ZPTUJaWXJJVFFjRzhqMWt0UTBzMzZ5elhiRTd2dE1qRFpBa0EyCgotLS0g
-K2FnWmJNampDL1hiR1diR1lKNEdtR1NGanhGZEtpVkN5Ynk4QnlLNDNzbwoKzCe8
-S+esi+100HykYeL6bKhoa3tuo05x8qCn2d/fAehnJDecPEnpqYdDXWOWc/3x
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBrTW1E
+ZDFSRXIwbXZXUlNJbHZCVjFzMzRxTmdtbDQ5eWVOWWp3SEdSUERrClVMeFRLOGUx
+U0dmT2ZUUXlCSGhJdE5ibkZLMmZ2VmZFWU9PQXpGZFRPQkkKLT4gWDI1NTE5IDIw
+VXd5N2EwTVdhdkRYeVF3c201SnV3TmxnUGpOZWY5bFJaQWRWMWxQVmMKR2RNc2pE
+aUs4ZW1XSGU1RzM4bHZYQks2cHZWUkhZN1hob2d1QnM3cCtlMAotPiB0XENxMSct
+Z3JlYXNlIC5LIEIoJ1w6Ci93eE5lMUxDQjE3dWI4a05wUE5sV2dWN21ZN2lFRThv
+YVJGNXNWaEtmbjVMaXhnemVuTXhOMXFtNkQvbGNuS3oKalZ6bEtGdHcxYnZNb0Zy
+YnlGTDdoVVdyeTJpYjJjZkc3alUyV2ZGa0taeEFIYTdiRnZmYmRjR3BzNUp2Ci0t
+LSBROCtSMzFNR3hTK1p5NVhGcFpqM0U0L0MwbWpzNUNTUWUyNEVXbzFFMGpjCnot
+A6mYbp+jhpoyjZidXQfzLVcu6y34WqAfJZsfT6l5SJONVfSvSw+iP7XXW2T5OnE=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/gitea/minio.txt.age
+++ b/secrets/gitea/minio.txt.age
@@ -1,12 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyBOd0ZS
-aUp4RW1DaWxTOUtrbEtUaGRyNVYyb2hXMWdmN1pqd2poSXM3ZFE4Cm0zMCszMGpK
-Tks2UjBFZnhGVnhWYnBEcDhYakE4Q1d0aythcnhTWHlxMUkKLT4gWDI1NTE5IFlI
-Vmw1eWxPRHg3REhrOXlORURiSzJJcXAzYTF1KzZLYXlNSGUyR2RTbTgKNS9nZGZT
-MkZIalVGc3dLMUN4VmtxZSt2NEV0ZTc4KzgzSTlXelNlNWR1cwotPiBIL09daUJh
-fi1ncmVhc2UgNmVkIwpOOFQrV2FNS1Y3RVUrQjB3cWJWZ2xBU1ZEUmg5UElMVEtC
-Yi9hR3dJWW9QZDl6UDNXSVVFMFBUTHVqY2lJL2IyCjRlNWd6b2RETXhGMUxiTnVR
-amtYCi0tLSByclhCU2VUK2lqTmdQRUhZUEdCV3RoYlpLRXVtUWZpT0R0WXBiaml6
-aUdJCnhOnafCdWyJ8JDkXonlnrNbq6oJfkwA9eaksl8otOfQ0pfplHq1/EMtNH3Q
-AWkX50A=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGpJOFJBZyA3dDEx
+SUw4QVh5T3QySHFFemo2N1JWTjNCSGRiS1lmRTkxVEQ3S1NKR2dNClZNM1Vwc3dF
+elB0Unk1OWpUb1RQMVpSTUpJUDNrZzFMWkhKK0l1dXVBYlkKLT4gWDI1NTE5IGRF
+TTZlMjdaamlwTUJzYlVkcVIxbmtybkFwakVtK2craXVBNVZraGZ1VlEKN2VvaU5r
+VjNRS2I5WE9kVDhES2dWTUV2cEVJaXZxNzRUcFo5blhGTDBaawotPiAxXCJQemxa
+dS1ncmVhc2UgcDphKHFVTGUgIUonYydBPgowQnc2Wk5yS0E1bVBCWmpOc25MWWs2
+UTR1dVlJbnNXYUVJSkx5bWFIcmtpT1lPSVE3b2Zpd0JaTGZWcEtjelFDCitQcy83
+bEVvM3FNTEhyWVVFS21tS0VQWG5OOHFza28KLS0tIEZZeUZwVGxUdEdtQTZuYk5K
+SHJaUDhHZ0JqbGNFSjJCaVlQTVo0OStkMWcKz/w0SnoHxnw71gr5DbXgMl59Kgjy
+SW4tzNGeRcX2j4YdRjr77TP5UAzpQE30tEcrtw==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/home/ddclient-cloudflare.key.age
+++ b/secrets/home/ddclient-cloudflare.key.age
@@ -1,14 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyA5dnBy
-YkRENmpNaSt4Y3lOKzhkSm9DbUM5RjQySzZHWms4QXYxNXdLSjFzCkM4M2djbmxt
-NG5lZlh6V3JNVVpaWjZHOHhadWRlWUl3L2xHK0Y0YjFCYncKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIEU3TzM2cXBXVDZYVUN1Q0E0eGxyZVJQTm1sMTJtRnJ5dGNsMUcz
-WTcvMGMKQkJaVDUwQXEwVWhHUW5IRW5veGIxLzRmUHpEay9LNU5QYjd4TkJDTmU5
-VQotPiBYMjU1MTkgNTVKMGZnV2ttMjArV1hYZUEwV1YyZVRMcmxuOFpZbXY5QlI5
-UElFRld3RQp3OHA3czM3UnVMdlo1L09VQW1IMlBodCtueHE5RjV3cFllSGxndUdN
-Sm1RCi0+IE5YTiMray1ncmVhc2UgWEQzbDsgO1A7YCV8PjAgNTpiODp9IFVZCmJh
-c2VsZFBZOVAxRHVQajlielI3WkFrVzRTSU1HOTMxZmcKLS0tIENiSUsxc3E5Q3I2
-UlFvMGJBaFd1SUtad2dzVVB1bkcvQUU5OTdQYldNVlUKo5ZSBZdm7MMSTJrX7RdF
-p3+z1XKPeVBpaQmH4593iCVgxF1OTv6bOL3vS0EwtduRT/htoBbXJmgUeUpTfEUo
-IY3DkohGqSbCVg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBNalB5
+RUZRNE1CTUJsbW1kSkxBSWVIcG1RUnBKd1gvcnRQVkZCUXFOQmhvClJUN2ltbnNk
+T1grdVJSTzIyNTBTTGVEckVGQXdYNHdwOU5NbW1md3lGM0kKLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIHZ4bFZSS0huWFBDbUhNcTd2MFhvV0lOY1l3d3ZXNU4vT3dwMmlI
+emhoV0kKcDF4M0FPK0JpclI5Q3Q5WGxpZWVYbHVWbkNWdTArclZsN09XK3VJSXc1
+awotPiBYMjU1MTkgRjRCNVZmcXVnQnJ4KzZoM1ZkdWxYUkJTM1JuK3ZlRWJYdkFR
+WXpFSmR4NApTbU5qR3ZuN0ZmbzIvMTFsMkdNSGJXSVlrVmZPdnZvcHFiZW45SW9I
+endJCi0+IDEoIjlcJi1ncmVhc2UgJUE4IWl5ODkgfGVdLihEfT4gWCAreSduPS4K
+bkI2Wm9LRGJXdW11aDl2VgotLS0gTENqYjZEUUZaWVZEcWQvWW5yTzJEdHRLeDJm
+QUl5aytXdDE5QVMwVHZVSQo+aDbaGNOrz+hTSUQ4IAjDC9EfNwrlXDZtBqw8HkRv
+1/Rr737scjrM7Bgt9zuKn6CB0zdeHTW5u685V2hCW/3aTy1eppWMWj3r
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/home/pdns/auth.conf.age
+++ b/secrets/home/pdns/auth.conf.age
@@ -1,14 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBhd2dJ
-UllxNVZpK3M1R1FwYmM3OWs3VVpSZzhSeGVudnE0WFdlbDVET2p3Cm9BSy83SERa
-cHQ1a05kVnJiODIvdVE3eFZ5SGJ1VU9xQjd2RDVKLzg2eEEKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIE5hUVpyQ1h1Nm9EWmJ1cEZCK3hVTHcwV3hRQnRZTS9ucUptQS9h
-Vmc4VWsKYzhGenphTjFSalY2blJzVUIwQmNkTnVhTjczWk1ka2d5eGlVcll0Z2dp
-QQotPiBYMjU1MTkgT1VnMFY2MHhYaVBRV0hVYU1STW5ETTZaZU5zUHJhMFJ1alJj
-emVuQWozWQpHR1NQeDgzZDdGRVBGaEZ1bGl1bnBnZnFyM0NEL2E1eWx4cm1NbEsz
-bnFNCi0+ICstZ3JlYXNlIEsofSRTLz8KQzZuTW5taUNCaWs2NHNFNHBoYkxhKzI3
-ZWJGUWdmWExMbUtnalhHWWEyUjBTNzlhVFd0aUo4cU5xc2ZoeDVWTQoKLS0tIFJn
-SjJleTVGU1o3YXhQZ1dWZHFIVm9FSE80VWdyZTg5dmhLWlhINmVWTUEKD84LkcH4
-FE9srKKG3yPpq//XXR+dsm3bIUd5rYZazszxqV8XyNqKHD44azPYTqyXwfBWeEoV
-2vn/iMIpyCCMlSUDzDsyNvrFX48s
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBFb2hL
+MCt6c0I4Nm5SMFhEaWNZRTRtNkpYeVQvVGFVZzVqd0E3L2dZdzFBCiszUXZSVENo
+cmxqdVFwMFA0elpFOGZoM3B6SW80MEhCNlJoRXV0WXpUeG8KLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIHQxR2MrakZmRFJMcjhabGFON2xQU2RBSDNvRCtuV3NwNGJ2bjZF
+b2lCQVUKcFNzM3paS1ZnWk8xY1VzVmdTWndMK0JCTU14bUJvM3E2bjR2TmlTY2tF
+NAotPiBYMjU1MTkgY1MrT3ZkN1pUd0JVb0JWSDByNUNRd1NUd2ZiNVJrc0JCb0J5
+NENrU0MySQp0bFpwRXRZcHRVdnN3eitkNHlWc0c0a0NmUjVYSVFXSVNFVHI0b0ZB
+U3kwCi0+IHQmKm9ERFdfLWdyZWFzZSBJIFkvRG5JIC9ZI002bmkgNX1hQHcKc2l4
+S0N4YzgvK2xqZm1YVkl4ZlF1REVOTGRWOVZRQm80R2NnczlsdFlhTEd1RmVoNjZa
+KzlkVXNpbGZsNTRybAp4RDlIWmRqR0t3VjF6WVlSeTJ4aGZBd1dDNEpMTUhZenZS
+WjZCK0FZcXJORkJwc1piS1FvSlkzc3R5T2s3Vk0KLS0tIDFPODlkZ1BSWEhHUHJK
+QjdZOE1KcFNvcUYxYlFkL1FLNVJETTkySVNYRTgKOipmWGTV9SvGE4KVqgQqGw4e
+CLP4PYlgdSmOATTIg32G/GVTM8NlvaII3q2GNS0Enx7Y8YwnwS2dGkYKVN3Da3b2
+WJwMiBZRu/PC
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/home/pdns/recursor.conf.age
+++ b/secrets/home/pdns/recursor.conf.age
@@ -1,14 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBlODZr
-RHpJcFdFaVNYM0x1d3QxVmhKTFBkMndrakFYS3FxWk00YWxXejNzCkFqWFlCWUt2
-cGluRGtxODQzbElhRWt1TGFVeTE1UU5SSkdZejJzNVdhZ3cKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIFRpeVNsT2Jqc2I4dzB3cEFWK2ZEZlpJQklWSnhJM3o0Ukhsc1lz
-REZ0VFkKWWJPckVSNlZHREJIVVgwNVNBSkpSbHRPcUxIWVo4ZTlyVkovTGRpZThL
-MAotPiBYMjU1MTkgUGxhR2d3TVh1dnJwQjNoY0pjV09halZKZFhybVk3Vjk3Tmwr
-bDd5ckp6MApBcW8zbUl1SnhmOXZwOFRNUG1EZUNacDlXdXJSbWFUeG5GNjM3eXJo
-RmR3Ci0+IDstZ3JlYXNlICRoICVbfmU2fQpFYzNyZXBxVU5jT3JSY1NFMGEzUnVF
-WFQ2MmR2SGQ0Vnd6V0VxQlp5bE5LZ2NML2hyd09LOEVPL2lGREdLR3FMCmVGN09J
-OUNscVh1d0VSdwotLS0gbTB1NnZ4Q3B6WE1KVzJjbmVwL2dEVjc4WnRXZTlYbFBG
-T3htUHBWang2awr0OgkUO6XPZji5ZBNpqGwOlwpa605t38QCmFSXvPQhvT4Gj/0+
-rUvg7zWf5Yb4c86EDD05CsqGEUQTOKEz08z0lewN5kuFfZmrYQY=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBjbUF2
+VXYyVkRud3JFU0tDQThjQlVMTTFaaW5uTkt3K2dmd1pleTFOQm5jCkNUeEVqSXVX
+RGUxcU14Z04zMlRubVIxV0VwazhlZlFtTCtXT2dVS3l4b2MKLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIG5SRTFOWWVIMU5yK3VTdkVtc0VYNnFkRXFrdEpiNTJIRHBvVnky
+OHRyWEUKVXVvZlBBR0dsUXFMa2dSZ1FWVWpvZGlwcHJ3YXRscnBoaU1FWlVFYTdt
+dwotPiBYMjU1MTkgMWlBWCtSU0I4Q1I0T0JrZ1ErYzlHRTZsUHhZQkpYQVJGNnFy
+U3ZPeU9RTQoxaGZDYnRaNjBRRGQzMGNsTmZwcjhBRXdLeEFqVWxoT3hNNHk5cU9C
+Qk00Ci0+ICF8Q0EuPSIhLWdyZWFzZSBKcCp6MgpaTXQwdEllbmhRVDhOQTdpb0RU
+T1VGZmdZK1VEMWdPUXduYWQ2YWx5aDFTQ3ZzRnRWbFRGN0lWUU5iQWdPakpZCnl6
+MnI0SE5sS0x2MUZibW96SllDQVVOK2grRldPOWo0VSs3SkFUN1dqS3RqTTdPZG1M
+eHI0T1BHK1F1cWlINAotLS0gckFnWkoydklhWHZhZHBkSkN5ZmdadVdiMU1QOUZW
+VkJENWlHVWNXcEVsWQqYscIBmSi//ev3IN2ax0Ei7p8Atu4nYQui7yoY/1fiyGQL
+DB5+R9Dm4YUNHt3bjrBYclLohDGdLUnOB00BXUqNmlLm4psL4Ey5Go8=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/airvpn-privkey.age
+++ b/secrets/jackflix/airvpn-privkey.age
@@ -1,11 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyByTFRp
-NHZMQ3BJMmt6cUhYRFMxVWNaNDc5SytSelBLMnZJZmJzLzhpSXdFCkkycmZqUzMz
-VXFGM2QvenFUQWtrQUdCc2lmbFVyZEQxNHFWeDVpR1E3WGsKLT4gWDI1NTE5IDdV
-Zis5U3F4MjlsOHI3WHlSczNKbHkrbzJ4bzByL0ZoMC80dkV2MXpUd2cKblI0VjNE
-bktDV1VXa1d4SGQ3Z1ZPaXo3a3hLNHFZeXMxVHIxWFluTXlPMAotPiBvQXpvLWdy
-ZWFzZSBuIFF7SnwKaHhzbXNZNXpHcXJhSytHSGdJQnNwNUkyOFEKLS0tIFZxWEFp
-RUZBbi9XRXRBdjZsbGFneXI2cnZzM3hNZDJhSDZHbWRGbG9ScFUKB2WtnELEus7i
-27VmQAnoUhEGgVjC8tDqeDMljeXNeAU1UiZ5DcehmR4Gm2hdLoZenqWT9z/D8WcY
-eQwvOK6QDikhccYA41KQ5MH0iuk=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB1N0V0
+UW5ZKzQrSlFUMnR5QUE5N2Mzd0FvK3JCeFM2RVRtUklVQkNkU0dNCnJuUUxjQjcw
+NURFOFRWRG5WSnBPT1dOVjFNQWZVUjJUSU9WVTExeS9XZkEKLT4gWDI1NTE5IHdq
+eDhJSTZKN1lQRXNaZzNIWEx4NTZINzZpdFRPZWJGcys5SUV6bmc0Q1EKeGlqTjF6
+b3Y3ZWNhcjF4WlpOcXh1OHBucmNCZmp6VTI1MXRjN1FlNlA3VQotPiBtQ01Dey8t
+Z3JlYXNlCnFKKys4Y0I3RkE3bzl2NDJ2aDNMeTRTUUU4dFFwelV3SjVReExnCi0t
+LSA1QSthdHR0cVE4bXhiczZqUTNJdzkzdnZ2TEpESWwwQ3BWNnoyNmp4ZXdrCl1g
+oNwCvlTrPx5b5l0OUymxMo1HMCV9fsQ9zyaoJoPFN1hv7l4hjjX5oVoj/IdTJbbe
+ZMs1yqa7YbR4+HG9GG8nPhU36hchSN2whoz8
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/airvpn-psk.age
+++ b/secrets/jackflix/airvpn-psk.age
@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB5QkR2
-d0dCdmd5ZUhXYWNRemRyYkJVUzA1eDE3Y1c5NFR6MzhMUzJDN1g4Clk5cjhXaGxE
-SHFzeUt3TUlCMFBBamQ4MTRxYVlHK2NNS2ZEa1M1U3dkNGcKLT4gWDI1NTE5IEhL
-dG9vdW1VKzlteHVuQU9sdGlvV3c4OWxiK1RpVXNZUVpnU2RjSmlmQ00KRFh2ZURH
-NE9UbnViWXFISlUrMjdsZVNjV1pCU09vSlVndHFyaWw3cnFTZwotPiB+LG83XWM9
-MC1ncmVhc2UgJFcgdXIxSSBPClIxQlY0MUpMQjhHb3V5TzJ3NTBlbE1GWjNKbGhS
-YnhuNlRtVFpFTVFuQ1dXTG4vV0crRmV5WWxsOWRicEh4UHoKUjRqVGduQ1NHRE14
-OUl5clVtdFlVVnlobGtrMUx3Ci0tLSBzcnVhRGlzaVJ3anNBTTR6NVNQd2ZOZUlL
-TzgzSDZxaDZRRVFHRFFVZExvChMoRTQYrv8kdYqs3Ko7LzBRt17H5ljK0GIAMYNx
-Gvrdv6HgzLq8gG6J4Rm/du8oyTKRjsHDS0yFuqKdbUjmckTcZurzW/qU57dNepnH
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyB6dGZN
+VDF3ME9IWWJMQUVrbmlKeXhZbzE1THUwVWhBc2ZBQXdUUkpod0FzCkVncGlyTXVv
+bmxPN0F3ODdvUmw3Sit1cERNTXN6YWZlU2IvYUhoUThER3cKLT4gWDI1NTE5IGQ2
+RzdCWUw2N1BHWVhiOGhvNEdzQVlUanR3emdDV3FUTFRXUDB3RDdrMmsKZDkvWWgv
+MFZhbHZtVDVQSWVEQ2NxQUZrOXFMVmYxbEU0STFJTVBzZm16ZwotPiB+Ty1ncmVh
+c2UgMnpCPlV9ClY2TzJGcnBrbUJTU3lyNVlrNDdwYTd3Ci0tLSBHaU9ZVnZoUkx5
+QnE4UXhMdEg1elE1dDRoQWx4bDhBMHNwS1BlQkRaUm93CspT9YnuzfpKxC9y6SWJ
+JRyT8aFEJTjoDEqN2I/DBwRikSxKyspHi7grCwFaoofylqJzsP/In7Xlf91xbMXz
+njjXbBQQP9PG3Z2c0OHk
 -----END AGE ENCRYPTED FILE-----
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXRXkYnBf2opIjN+bXE7HmhUpa4hyXJUGmBT+MRccT4 harmonia`
				`@@ -1 +0,0 @@`
				`object-ctr.ams1.int.nul.ie ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8`