I should commit more frequently

checks/default.nix

@@ -26,7 +26,7 @@
     build = _: nc: nc.config.system.build.toplevel;
   in {
     x86_64-linux = lib.mapAttrs build {
-      inherit (self.nixosConfigurations) thinkpad mothership;
+      inherit (self.nixosConfigurations) picard;
     };
     aarch64-linux = {
       inherit (self.nixosConfigurations) rock5b; #pbp;

flake.nix

@@ -4,7 +4,7 @@
   inputs = {
     flakeParts.url = "github:hercules-ci/flake-parts";
     nixpkgsUnstable.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgsStable.url = "github:NixOS/nixpkgs/nixos-23.05";
+    nixpkgsStable.url = "github:NixOS/nixpkgs/nixos-23.11";
     nixosHardware.url = "github:NixOS/nixos-hardware";
     homeManager = {
       url = "github:nix-community/home-manager";
@@ -28,47 +28,13 @@
     };
     nur.url = "github:nix-community/NUR";
     agenix.url = "github:ryantm/agenix";
-    comma.url = "github:nix-community/comma";
     rock5b.url = "github:aciceri/rock5b-nixos";
     ccrEmacs.url = "github:aciceri/emacs";
     # ccrEmacs.url = "/home/ccr/.config/emacs";
-    colmena = {
-      url = "github:zhaofengli/colmena";
-      inputs = {
-        nixpkgs.follows = "nixpkgsUnstable";
-        stable.follows = "nixpkgsStable";
-      };
-    };
-    nix-serve-ng = {
-      url = "github:aristanetworks/nix-serve-ng";
-      inputs.nixpkgs.follows = "nixpkgsUnstable";
-    };
-    nixos-generators = {
-      url = "github:nix-community/nixos-generators";
-      inputs.nixpkgs.follows = "nixpkgsUnstable";
-    };
-    # hydra.url = "github:NixOS/hydra";
-    nixos-vscode-server.url = "github:msteen/nixos-vscode-server";
-    helix.url = "github:helix-editor/helix";
-    nil.url = "github:oxalica/nil";
-    nixd.url = "github:nix-community/nixd";
-    nom.url = "github:maralorn/nix-output-monitor";
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgsUnstable";
     };
-    statix = {
-      url = "github:nerdypepper/statix";
-      inputs.nixpkgs.follows = "nixpkgsUnstable";
-    };
-    deadnix = {
-      url = "github:astro/deadnix";
-      inputs.nixpkgs.follows = "nixpkgsUnstable";
-    };
-    alejandra = {
-      url = "github:kamadorueda/alejandra";
-      inputs.nixpkgs.follows = "nixpkgsUnstable";
-    };
     hercules-ci-effects.url = "github:hercules-ci/hercules-ci-effects";
     dream2nix.url = "github:nix-community/dream2nix";
   };

hmModules/email/default.nix

@@ -3,28 +3,14 @@
   secrets,
   ...
 }: {
-  # home.packages = with pkgs; [mu];
+  programs.mbsync.enable = true;
-  # programs.mbsync.enable = true;
+  programs.msmtp.enable = true;
-  # programs.msmtp.enable = true;
+  programs.notmuch = {
-  # programs.notmuch = {
+    enable = true;
-  #   enable = true;
+    hooks.preNew = "mbsync --all";
-  #   hooks = {
+  };
-  #     preNew = "mbsync --all";
+  services.mbsync.enable = true;
-  #   };
-  # };
-  # services = {
-  #   mbsync = {
-  #     enable = false;
-  #     # FIXME this requires `pass` every 5 minutes that run `pinentry`
-  #     frequency = "*:0/15";
-  #     preExec = "${pkgs.isync}/bin/mbsync -Ha";
-  #     # First time run: mu init --maildir ~/.mail --my-address andrea.ciceri@autistici.org
-  #     # TODO Nixify this
-  #     postExec = "${pkgs.mu}/bin/mu index";
-  #   };
-  # };
   accounts.email = {
-    # maildirBasePath = ".mail";
     accounts.autistici = {
       address = "andrea.ciceri@autistici.org";
       gpg = {
@@ -35,12 +21,12 @@
         host = "mail.autistici.org";
         port = 993;
       };
-      # mbsync = {
+      mbsync = {
-      #   enable = true;
+        enable = true;
-      #   create = "maildir";
+        create = "maildir";
-      # };
+      };
-      # msmtp.enable = true;
+      msmtp.enable = true;
-      # notmuch.enable = true;
+      notmuch.enable = true;
       primary = true;
       realName = "Andrea Ciceri";
       signature = {

hmModules/firefox/default.nix

@@ -1,4 +1,8 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  username,
+  ...
+}: {
   programs.firefox = {
     enable = true;
     package =
@@ -9,19 +13,14 @@
       })
       .override {
         cfg = {
-          enableTridactylNative = true;
+          nativeMessagingHosts.packages = [pkgs.trydactyl-native pkgs.fs-cast-bridge];
-          enableBrowserpass = true;
-          enableFXCastBridge = pkgs.system == "x86_64-linux";
         };
       };
-    profiles.ccr = {
+    profiles.${username} = {
       extensions = with pkgs.nur.repos.rycee.firefox-addons; [
         privacy-badger
         ublock-origin
         tridactyl
-        browserpass
-        # bypass-paywalls-clean
-        ghosttext # or edit-with-emacs?
       ];
       settings = {
         "browser.startup.homepage" = "https://google.it";
@@ -31,29 +30,15 @@
         "general.useragent.locale" = "it-IT";
         "browser.bookmarks.showMobileBookmarks" = true;
         "browser.download.folderList" = 2;
-        "browser.download.lastDir" = "/home/ccr/downloads/";
+        "browser.download.lastDir" = "/home/${username}/Downloads/";
         "browser.shell.checkDefaultBrowser" = false;
       };
       search.force = true;
-      search.default = "Google";
       search.engines = {
         "Searx" = {
           urls = [
             {
-              template = "https://search.privatevoid.net/search";
+              template = "https://search.aciceri.dev/search";
-              params = [
-                {
-                  name = "q";
-                  value = "{searchTerms}";
-                }
-              ];
-            }
-          ];
-        };
-        "Google IT" = {
-          urls = [
-            {
-              template = "https://www.google.it/search";
               params = [
                 {
                   name = "q";

hmModules/git-workspace/default.nix

@@ -1,4 +1,8 @@
-{age, ...}: {
+{
+  age,
+  username,
+  ...
+}: {
   services.git-workspace = {
     enable = true;
     frequency = "04:00:00";
@@ -9,7 +13,7 @@
           {
             provider = "github";
             name = "aciceri";
-            path = "/home/ccr/projects";
+            path = "/home/${username}/projects";
             skips_forks = false;
           }
         ];
@@ -19,7 +23,7 @@
           {
             provider = "github";
             name = "mlabs-haskell";
-            path = "/home/ccr/projects";
+            path = "/home/${username}/projects";
             skip_forks = false;
           }
         ];
@@ -29,7 +33,7 @@
           {
             provider = "github";
             name = "EthereansOS";
-            path = "/home/ccr/projects";
+            path = "/home/${username}/projects";
             skip_forks = false;
           }
         ];

hmModules/git/default.nix

@@ -1,4 +1,8 @@
-{pkgs, ...}: let
+{
+  pkgs,
+  username,
+  ...
+}: let
   config = {
     name = "Andrea Ciceri";
     email = "andrea.ciceri@autistici.org";
@@ -15,7 +19,7 @@ in {
       rebase.autostash = true;
       github.user = "aciceri";
 
-      user.signingKey = "/home/ccr/.ssh/id_rsa";
+      user.signingKey = "/home/${username}/.ssh/id_rsa";
       gpg.format = "ssh";
       commit.gpgsign = true;
 
@@ -24,14 +28,10 @@ in {
 
     userName = config.name;
     userEmail = config.email;
-    # signing = {
-    #   signByDefault = true;
-    #   key = config.email;
-    # };
 
     extraConfig.url = {
       "ssh://git@github.com/".insteadOf = "https://github.com/";
-      # Workaround: https://github.com/rust-lang/cargo/issues/3381#issuecomment-1193730972
+      # Workaround for https://github.com/rust-lang/cargo/issues/3381#issuecomment-1193730972
       "https://github.com/rust-lang/crates.io-index".insteadOf = "https://github.com/rust-lang/crates.io-index";
       "https://github.com/RustSec/advisory-db".insteadOf = "https://github.com/RustSec/advisory-db";
     };
@@ -53,6 +53,4 @@ in {
 
     diff-so-fancy.enable = false;
   };
-
-  home.packages = with pkgs; [delta];
 }

hmModules/helix/default.nix

@@ -1,8 +1,4 @@
 {
-  config,
-  lib,
-  ...
-}: {
   programs.helix = {
     enable = true;
     settings = {
@@ -18,6 +14,4 @@
       };
     };
   };
-  # home.sessionVariables.EDITOR = lib.mkForce "${config.programs.helix.package}/bin/helix";
-  # programs.nushell.environmentVariables.EDITOR = lib.mkForce config.home.sessionVariables.EDITOR;
 }

hmModules/hyprland/default.nix

@@ -88,9 +88,7 @@ in {
              }
            }
 
-           monitor = DP-2, 2560x1440, 1200x320, 1
+           monitor = HDMI-A-1, 2560x1440, 0x0, 1
-           monitor = eDP-1, 1920x1080, 3760x230, 1
-           # monitor = DP-1, 1920x1080, 0x0, 1, mirror, eDP-1
 
            bindl=,switch:off:Lid Switch,exec,${switchMonitorScript} open
            bindl=,switch:on:Lid Switch,exec,${switchMonitorScript} close

hmModules/hyprland/hyprpaper.nix

@@ -6,5 +6,6 @@ in {
     wallpaper = eDP-1,${wallpaper}
     wallpaper = DP-1,${wallpaper}
     wallpaper = DP-2,${wallpaper}
+    wallpaper = HDMI-A-1,${wallpaper}
   '';
 }

hmModules/password-store/default.nix

@@ -1,15 +1,13 @@
 {
-  config,
-  lib,
   pkgs,
+  username,
   ...
 }: {
   programs.password-store = {
     enable = true;
     settings = {
-      PASSWORD_STORE_DIR = "/home/ccr/.password-store";
+      PASSWORD_STORE_DIR = "/home/${username}/.password-store";
     };
-    package = pkgs.pass.withExtensions (e: with e; [pass-otp]);
+    package = pkgs.pass.withExtensions (e: [e.pass-otp]);
   };
-  services.password-store-sync.enable = false; # FIXME this requires `pass` every 5 minutes that run `pinentry`
 }

hmModules/shell/default.nix

@@ -119,7 +119,6 @@
     '';
     shellAliases = {
       "cat" = "bat";
-      "em" = "TERM=wezterm emacsclient -nw";
     };
   };
 

hmModules/wezterm/default.nix

@@ -3,6 +3,7 @@
     enable = true;
     extraConfig = ''
       return {
+        enable_wayland = false; -- https://github.com/wez/wezterm/issues/4483
         font = wezterm.font_with_fallback {
           {
             family = 'Iosevka Comfy',

hmModules/wine/default.nix

@@ -1,23 +1,6 @@
 {pkgs, ...}: {
   home.packages = with pkgs; [
-    # ...
-
-    # support both 32- and 64-bit applications
-    # wineWowPackages.stable
-
-    # support 32-bit only
-    # wine
-
-    # support 64-bit only
-    # (wine.override { wineBuild = "wine64"; })
-
-    # wine-staging (version with experimental features)
-    # wineWowPackages.staging
-
-    # winetricks (all versions)
     winetricks
-
-    # native wayland support (unstable)
     wineWowPackages.waylandFull
   ];
 }

hosts/default.nix

@@ -5,279 +5,89 @@
   inputs,
   ...
 }: {
-  options.fleet = {
+  imports = [./module.nix];
-    hosts = lib.mkOption {
+
-      description = "Host configuration";
+  fleet.hosts = {
-      type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
+    # thinkpad = {
-        options = {
+    #   extraModules = with inputs; [
-          name = lib.mkOption {
+    #     nixosHardware.nixosModules.lenovo-thinkpad-x1-7th-gen
-            description = "Host name";
+    # 	buildbot-nix.nixosModules.buildbot-master
-            type = lib.types.strMatching "^$|^[[:alnum:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
+    # 	buildbot-nix.nixosModules.buildbot-worker
-            default = name;
+    #   ];
-          };
+    #   extraHmModules = with inputs; [
-          system = lib.mkOption {
+    #     ccrEmacs.hmModules.default
-            description = "NixOS architecture (a.k.a. system)";
+    #     {
-            type = lib.types.str;
+    #         # TODO: remove after https://github.com/nix-community/home-manager/pull/3811
-            default = "x86_64-linux";
+    #       imports = let
-          };
+    #         hmModules = "${inputs.homeManagerGitWorkspace}/modules";
-          colmena = lib.mkOption {
+    #       in [
-            description = "Set colmena.<host>";
+    #         "${hmModules}/services/git-workspace.nix"
-            type = lib.types.attrs;
+    #       ];
-            default = {};
+    #     }
-          };
+    #   ];
-          secrets = lib.mkOption {
+    #   overlays = [inputs.nil.overlays.default];
-            description = "List of secrets names in the `secrets` folder";
+    #   secrets = {
-            type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
+    #     "thinkpad-wireguard-private-key" = {};
-              options = {
+    #     "cachix-personal-token".owner = "ccr";
-                owner = lib.mkOption {
+    #     "autistici-password".owner = "ccr";
-                  type = lib.types.str;
+    #     "git-workspace-tokens".owner = "ccr";
-                  default = "root";
+    #     "chatgpt-token".owner = "ccr";
-                };
+    #   };
-                group = lib.mkOption {
+    # };
-                  type = lib.types.str;
+    # rock5b = {
-                  default = "root";
+    #   system = "aarch64-linux";
-                };
+    #   extraModules = with inputs; [
-                file = lib.mkOption {
+    #     disko.nixosModules.disko
-                  type = lib.types.path;
+    #     rock5b.nixosModules.default
-                  default = "${self.outPath}/secrets/${name}.age";
+    #   ];
-                };
+    #   secrets = {
-                mode = lib.mkOption {
+    #     "rock5b-wireguard-private-key" = {};
-                  # TODO improve type
+    #     "hercules-ci-join-token".owner = "hercules-ci-agent";
-                  type = lib.types.str;
+    #     "hercules-ci-binary-caches".owner = "hercules-ci-agent";
-                  default = "0440";
+    #     "cachix-personal-token".owner = "ccr";
-                };
+    #     "home-planimetry".owner = "hass";
-              };
+    # 	"cloudflare-dyndns-api-token" = {};
-            }));
+    #       # "nextcloud-admin-pass".owner = "nextcloud";
-            default = {};
+    #       # "aws-credentials" = {};
-          };
+    #   };
-          enableHomeManager = lib.mkOption {
+    #   colmena.deployment.buildOnTarget = true;
-            description = "Enable home-manager module";
+    # };
-            type = lib.types.bool;
+    # pbp = {
-            default = true;
+    #   system = "aarch64-linux";
-          };
+    #   extraModules = with inputs; [
-          overlays = lib.mkOption {
+    #     nixosHardware.nixosModules.pine64-pinebook-pro
-            description = "Enabled Nixpkgs overlays";
+    #     disko.nixosModules.disko
-            type = lib.types.listOf (lib.mkOptionType {
+    #   ];
-              name = "nixpkgs-overlay";
+    #   extraHmModules = [
-              description = "nixpkgs overlay";
+    #     inputs.ccrEmacs.hmModules.default
-              check = lib.isFunction;
+    #   ];
-              merge = lib.mergeOneOption;
+    #   secrets = {
-            });
+    #     "pbp-wireguard-private-key" = {};
-            default = [];
+    #     "cachix-personal-token".owner = "ccr";
-          };
+    #     "chatgpt-token".owner = "ccr";
-          extraModules = lib.mkOption {
+    #   };
-            description = "Extra NixOS modules";
+    # };
-            type = lib.types.listOf lib.types.deferredModule;
+
-            default = [];
+    picard = {
-          };
+      extraModules = [
-          extraHmModules = lib.mkOption {
+        inputs.disko.nixosModules.disko
-            description = "Extra home-manager modules";
+      ];
-            type = lib.types.listOf lib.types.deferredModule;
+      extraHmModules = [
-            default = [];
+        inputs.ccrEmacs.hmModules.default
-          };
+        "${inputs.homeManagerGitWorkspace}/modules/services/git-workspace.nix"
-          extraHmModulesUser = lib.mkOption {
+      ];
-            description = "User for which to import extraHmModulesUser";
+      secrets = {
-            type = lib.types.str;
+        "chatgpt-token".owner = "ccr";
-            default = "ccr";
+        "cachix-personal-token".owner = "ccr";
-          };
+        "hercules-ci-join-token".owner = "hercules-ci-agent";
-        };
+        "hercules-ci-binary-caches".owner = "hercules-ci-agent";
-        config.overlays = with inputs;
+        "git-workspace-tokens".owner = "ccr";
-          [
+      };
-            agenix.overlays.default
-            comma.overlays.default
-            helix.overlays.default
-            nur.overlay
-          ]
-          ++ config.fleet.overlays;
-      }));
-      default = {};
-    };
-    _mkNixosConfiguration = lib.mkOption {
-      description = "Function returning a proper NixOS configuration";
-      type = lib.types.functionTo (lib.types.functionTo lib.types.attrs); # TODO improve this type
-      internal = true;
-      default = hostname: config:
-        inputs.nixpkgsUnstable.lib.nixosSystem {
-          inherit (config) system;
-          modules =
-            [
-              ({lib, ...}: {
-                networking.hostName = lib.mkForce hostname;
-                nixpkgs.overlays = config.overlays;
-                networking.hosts =
-                  lib.mapAttrs' (hostname: ip: {
-                    name = ip;
-                    value = ["${hostname}.fleet"];
-                  })
-                  (import "${self}/lib").ips;
-              })
-              "${self.outPath}/hosts/${hostname}"
-            ]
-            ++ (lib.optionals (config.secrets != []) [
-              inputs.agenix.nixosModules.default
-              ({lib, ...}: let
-                allSecrets = lib.mapAttrs' (name: value: {
-                  name = lib.removeSuffix ".age" name;
-                  inherit value;
-                }) (import "${self.outPath}/secrets");
-                filteredSecrets =
-                  lib.filterAttrs
-                  (name: _: builtins.hasAttr name config.secrets)
-                  allSecrets;
-              in {
-                age.secrets =
-                  lib.mapAttrs' (name: _: {
-                    name = builtins.baseNameOf name;
-                    value = {
-                      inherit (config.secrets.${name}) owner group file mode;
-                    };
-                  })
-                  filteredSecrets;
-              })
-            ])
-            ++ (lib.optionals config.enableHomeManager (let
-              user = config.extraHmModulesUser;
-              extraHmModules = config.extraHmModules;
-            in [
-              inputs.homeManager.nixosModule
-              ({config, ...}: {
-                home-manager.users."${user}" = {
-                  imports = extraHmModules;
-                  _module.args = {
-                    age = config.age or {};
-                    fleetFlake = self;
-                  };
-                };
-              })
-            ]))
-            ++ config.extraModules;
-          specialArgs = {
-            fleetModules = builtins.map (moduleName: "${self.outPath}/modules/${moduleName}");
-            fleetHmModules = builtins.map (moduleName: "${self.outPath}/hmModules/${moduleName}");
-            fleetFlake = self;
-          };
-        };
     };
   };
 
-  # TODO Add per host:
+  flake.nixosConfigurations =
-  # - apps to run as VMs
+    lib.mapAttrs
-  # - checks
+    config.fleet._mkNixosConfiguration
-  # - deploy scripts (`nixos-rebuild`)
+    config.fleet.hosts;
-
-  config = {
-    fleet.hosts = {
-      thinkpad = {
-        extraModules = with inputs; [
-          nixosHardware.nixosModules.lenovo-thinkpad-x1-7th-gen
-        ];
-        extraHmModules = with inputs; [
-          ccrEmacs.hmModules.default
-          {
-            # TODO: remove after https://github.com/nix-community/home-manager/pull/3811
-            imports = let
-              hmModules = "${inputs.homeManagerGitWorkspace}/modules";
-            in [
-              "${hmModules}/services/git-workspace.nix"
-            ];
-          }
-        ];
-        overlays = [inputs.nil.overlays.default];
-        secrets = {
-          "thinkpad-wireguard-private-key" = {};
-          "cachix-personal-token".owner = "ccr";
-          "autistici-password".owner = "ccr";
-          "git-workspace-tokens".owner = "ccr";
-          "chatgpt-token".owner = "ccr";
-        };
-      };
-      rock5b = {
-        system = "aarch64-linux";
-        extraModules = with inputs; [
-          disko.nixosModules.disko
-          rock5b.nixosModules.default
-        ];
-        secrets = {
-          "rock5b-wireguard-private-key" = {};
-          "hercules-ci-join-token".owner = "hercules-ci-agent";
-          "hercules-ci-binary-caches".owner = "hercules-ci-agent";
-          "cachix-personal-token".owner = "ccr";
-          "home-planimetry".owner = "hass";
-          # "nextcloud-admin-pass".owner = "nextcloud";
-          # "aws-credentials" = {};
-        };
-        colmena.deployment.buildOnTarget = true;
-      };
-      pbp = {
-        system = "aarch64-linux";
-        extraModules = with inputs; [
-          nixosHardware.nixosModules.pine64-pinebook-pro
-          disko.nixosModules.disko
-        ];
-        extraHmModules = [
-          inputs.ccrEmacs.hmModules.default
-        ];
-        secrets = {
-          "pbp-wireguard-private-key" = {};
-          "cachix-personal-token".owner = "ccr";
-          "chatgpt-token".owner = "ccr";
-        };
-      };
-      # hs = {};
-      mothership = {
-        extraModules = with inputs; [
-          disko.nixosModules.disko
-          # nix-serve-ng.nixosModules.default
-          # hydra.nixosModules.hydra
-        ];
-        extraHmModules = [
-          inputs.ccrEmacs.hmModules.default
-          {
-            # TODO: remove after https://github.com/nix-community/home-manager/pull/3811
-            imports = let
-              hmModules = "${inputs.homeManagerGitWorkspace}/modules";
-            in [
-              "${hmModules}/services/git-workspace.nix"
-            ];
-          }
-        ];
-        overlays = [inputs.nil.overlays.default];
-        secrets = {
-          "mothership-wireguard-private-key" = {};
-          "cachix-personal-token".owner = "ccr";
-          "git-workspace-tokens".owner = "ccr";
-          "magit-forge-github-token".owner = "ccr";
-          # "hydra-admin-password".owner = "root";
-          # "hydra-github-token".group = "hydra";
-          # "cache-private-key".owner = "nix-serve";
-          "hercules-ci-join-token".owner = "hercules-ci-agent";
-          "hercules-ci-binary-caches".owner = "hercules-ci-agent";
-          # "minio-credentials".owner = "minio";
-          # "aws-credentials" = {};
-          "chatgpt-token".owner = "ccr";
-        };
-      };
-    };
-
-    flake.nixosConfigurations =
-      lib.mapAttrs
-      config.fleet._mkNixosConfiguration
-      config.fleet.hosts;
-
-    flake.colmena =
-      {
-        meta = {
-          nixpkgs = inputs.nixpkgsUnstable.legacyPackages.x86_64-linux;
-          nodeNixpkgs = builtins.mapAttrs (name: value: value.pkgs) self.nixosConfigurations;
-          nodeSpecialArgs = builtins.mapAttrs (name: value: value._module.specialArgs) self.nixosConfigurations;
-        };
-      }
-      // builtins.mapAttrs (name: host:
-        lib.recursiveUpdate {
-          imports = self.nixosConfigurations.${name}._module.args.modules;
-          deployment.targetHost = "${name}.fleet";
-        }
-        host.colmena)
-      config.fleet.hosts;
-  };
 }

hosts/module.nix

@@ -0,0 +1,168 @@
+# TODO Add per host:
+# - apps to run as VMs
+# - checks
+# - deploy scripts (`nixos-rebuild`)
+{
+  self,
+  lib,
+  config,
+  inputs,
+  ...
+}: {
+  options.fleet = {
+    hosts = lib.mkOption {
+      description = "Host configuration";
+      type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
+        options = {
+          name = lib.mkOption {
+            description = "Host name";
+            type = lib.types.strMatching "^$|^[[:alnum:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
+            default = name;
+          };
+          system = lib.mkOption {
+            description = "NixOS architecture (a.k.a. system)";
+            type = lib.types.str;
+            default = "x86_64-linux";
+          };
+          colmena = lib.mkOption {
+            description = "Set colmena.<host>";
+            type = lib.types.attrs;
+            default = {};
+          };
+          secrets = lib.mkOption {
+            description = "List of secrets names in the `secrets` folder";
+            type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
+              options = {
+                owner = lib.mkOption {
+                  type = lib.types.str;
+                  default = "root";
+                };
+                group = lib.mkOption {
+                  type = lib.types.str;
+                  default = "root";
+                };
+                file = lib.mkOption {
+                  type = lib.types.path;
+                  default = "${self.outPath}/secrets/${name}.age";
+                };
+                mode = lib.mkOption {
+                  # TODO improve type
+                  type = lib.types.str;
+                  default = "0440";
+                };
+              };
+            }));
+            default = {};
+          };
+          enableHomeManager = lib.mkOption {
+            description = "Enable home-manager module";
+            type = lib.types.bool;
+            default = true;
+          };
+          overlays = lib.mkOption {
+            description = "Enabled Nixpkgs overlays";
+            type = lib.types.listOf (lib.mkOptionType {
+              name = "nixpkgs-overlay";
+              description = "nixpkgs overlay";
+              check = lib.isFunction;
+              merge = lib.mergeOneOption;
+            });
+            default = [];
+          };
+          extraModules = lib.mkOption {
+            description = "Extra NixOS modules";
+            type = lib.types.listOf lib.types.deferredModule;
+            default = [];
+          };
+          extraHmModules = lib.mkOption {
+            description = "Extra home-manager modules";
+            type = lib.types.listOf lib.types.deferredModule;
+            default = [];
+          };
+          extraHmModulesUser = lib.mkOption {
+            description = "User for which to import extraHmModulesUser";
+            type = lib.types.str;
+            default = "ccr";
+          };
+        };
+        config.overlays = with inputs;
+          [
+            nur.overlay
+          ]
+          ++ config.fleet.overlays;
+      }));
+      default = {};
+    };
+    _mkNixosConfiguration = lib.mkOption {
+      description = "Function returning a proper NixOS configuration";
+      type = lib.types.functionTo (lib.types.functionTo lib.types.attrs); # TODO improve this type
+      internal = true;
+      default = hostname: config:
+        inputs.nixpkgsUnstable.lib.nixosSystem {
+          inherit (config) system;
+          modules =
+            [
+              ({lib, ...}: {
+                networking.hostName = lib.mkForce hostname;
+                nixpkgs.overlays = config.overlays;
+                networking.hosts =
+                  lib.mapAttrs' (hostname: ip: {
+                    name = ip;
+                    value = ["${hostname}.fleet"];
+                  })
+                  (import "${self}/lib").ips;
+              })
+              "${self.outPath}/hosts/${hostname}"
+            ]
+            ++ (lib.optionals (config.secrets != []) [
+              inputs.agenix.nixosModules.default
+              ({lib, ...}: let
+                allSecrets = lib.mapAttrs' (name: value: {
+                  name = lib.removeSuffix ".age" name;
+                  inherit value;
+                }) (import "${self.outPath}/secrets");
+                filteredSecrets =
+                  lib.filterAttrs
+                  (name: _: builtins.hasAttr name config.secrets)
+                  allSecrets;
+              in {
+                age.secrets =
+                  lib.mapAttrs' (name: _: {
+                    name = builtins.baseNameOf name;
+                    value = {
+                      inherit (config.secrets.${name}) owner group file mode;
+                    };
+                  })
+                  filteredSecrets;
+              })
+            ])
+            ++ (lib.optionals config.enableHomeManager (let
+              user = config.extraHmModulesUser;
+              extraHmModules = config.extraHmModules;
+            in [
+              inputs.homeManager.nixosModule
+              ({
+                config,
+                pkgs,
+                ...
+              }: {
+                home-manager.users."${user}" = {
+                  imports = extraHmModules;
+                  _module.args = {
+                    age = config.age or {};
+                    fleetFlake = self;
+                    pkgsStable = inputs.nixpkgsStable.legacyPackages.${pkgs.system};
+                  };
+                };
+              })
+            ]))
+            ++ config.extraModules;
+          specialArgs = {
+            fleetModules = builtins.map (moduleName: "${self.outPath}/modules/${moduleName}");
+            fleetHmModules = builtins.map (moduleName: "${self.outPath}/hmModules/${moduleName}");
+            fleetFlake = self;
+          };
+        };
+    };
+  };
+}

hosts/mothership/default.nix

@@ -22,7 +22,7 @@
     "cgit"
     "docker"
     # "minio"
-    "proxy"
+    "mothership-proxy"
     "binfmt"
     "xdg"
     # "remote-xfce"

hosts/picard/default.nix

@@ -0,0 +1,94 @@
+{
+  fleetModules,
+  lib,
+  config,
+  ...
+}: {
+  imports =
+    fleetModules [
+      "common"
+      "ssh"
+      "ccr"
+      "nix"
+      "networkmanager"
+      "bluetooth"
+      "dbus"
+      "docker"
+      "fonts"
+      "qmk-udev"
+      "mosh"
+      "udisks2"
+      "xdg"
+      "pipewire"
+      "nix-development"
+      "waydroid"
+      "virt-manager"
+      "ssh-initrd"
+      "hercules-ci"
+    ]
+    ++ [
+      ./disko.nix
+    ];
+
+  ccr = {
+    enable = true;
+    autologin = true;
+    modules = [
+      "git"
+      "git-workspace"
+      "helix"
+      "shell"
+      "element"
+      "emacs"
+      "firefox"
+      "gpg"
+      "mpv"
+      "password-store"
+      "slack"
+      "hyprland"
+      "udiskie"
+      "xdg"
+      "spotify"
+      "lutris"
+      "wine"
+      "cura"
+    ];
+    extraGroups = [];
+  };
+
+  boot.kernelParams = ["ip=dhcp"];
+  boot.initrd.kernelModules = ["amdgpu"];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+    "r8169"
+  ];
+  boot.kernelModules = ["kvm-amd"];
+
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot = {
+    enable = true;
+    configurationLimit = 20;
+  };
+
+  networking.hostId = "5b02e763";
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.enableRedistributableFirmware = lib.mkDefault true;
+
+  hardware.opengl = {
+    enable = true;
+    driSupport = true;
+    driSupport32Bit = true;
+  };
+
+  # TODO move away from here (how can the interface name be retrieved programmatically?)
+  networking.interfaces.enp11s0.wakeOnLan = {
+    enable = true;
+    policy = ["broadcast" "magic"];
+  };
+}

hosts/picard/disko.nix

@@ -0,0 +1,72 @@
+{
+  disko.devices = {
+    disk = {
+      nvme = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            zfs = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+          mountpoint = "none";
+        };
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options = {
+              mountpoint = "none";
+              encryption = "aes-256-gcm";
+              keyformat = "passphrase";
+              keylocation = "prompt";
+            };
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/rock5b/default.nix

@@ -20,8 +20,13 @@
       # "nextcloud"
       "home-assistant"
       # "immich"
-      "adguard-home"
+      # "adguard-home"
       # "mount-hetzner-box"
+      "cloudflare-dyndns"
+      "rock5b-proxy"
+      "invidious"
+      "searx"
+      "rock5b-samba"
     ]
     ++ [
       ./disko.nix
@@ -29,6 +34,8 @@
 
   ccr.enable = true;
 
+  networking.firewall.enable = lib.mkForce false;
+
   services.rock5b-fan-control.enable = true;
 
   nixpkgs.hostPlatform = "aarch64-linux";

hosts/thinkpad/default.nix

@@ -33,6 +33,7 @@
       "nix-development"
       "clamav"
       "waydroid"
+      "buildboot-nix"
       # "gnome-keyring"
     ];
 
@@ -45,6 +46,7 @@
       "digikam"
       "discord"
       "element"
+      "email"
       # "nheko"
       # "thunderbird"
       # "aerc"
@@ -54,7 +56,7 @@
       "gpg"
       "gnome-keyring"
       "helix"
-      "mopidy"
+      # "mopidy"
       "mpv"
       "openscad"
       "password-store"
@@ -79,7 +81,6 @@
     ];
     packages = with pkgs; [
       comma
-      dolphin-emu-beta
       sc-controller
       libreoffice
     ];
@@ -218,4 +219,6 @@
     Sunshine
     KERNEL=="uinput", GROUP="input", MODE="0660", OPTIONS+="static_node=uinput"
   '';
+
+  services.teamviewer.enable = true;
 }

hosts/thinkpad/zfs.nix

@@ -1,6 +1,7 @@
 {
   config,
   pkgs,
+  lib,
   ...
 }: {
   boot.supportedFilesystems = ["zfs"];
@@ -22,6 +23,7 @@
     mount /boot/efi
   '';
   boot.loader.grub.extraInstallCommands = ''
+    export PATH=$PATH:${lib.makeBinPath [pkgs.coreutils]}
     ESP_MIRROR=$(mktemp -d)
     cp -r /boot/efi/EFI $ESP_MIRROR
     for i in /boot/efis/*; do

lib/default.nix

@@ -11,6 +11,7 @@
       mothership = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFlepPWHE9GvQIBcAQBQPd80oiePSPxGDnMdqpdEqx6I";
       rock5b = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDlpd0GhZv0NyDQBTJ130JfC5/r+PvdkHIOaGssm8cPG";
       pbp = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFF05LScu9m5BXMlFAT1g+g/AkAi7kvq1dY6W3Rzqq3f";
+      picard = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ1+1z1IsLVJ6aGarMgzw3NbmFKcpYVgdUjl7xDsewxT";
     };
   };
   ips = {

modules/adb/default.nix

@@ -1,4 +1,4 @@
 {
   programs.adb.enable = true;
-  users.users.ccr.extraGroups = ["adbusers"];
+  ccr.extraGroups = ["adbusers"];
 }

modules/bluetooth/default.nix

@@ -3,4 +3,5 @@
   hardware.pulseaudio.enable = true;
   hardware.bluetooth.enable = true;
   services.dbus.packages = with pkgs; [blueman];
+  ccr.extraGroups = ["bluetooth"];
 }

modules/ccr/default.nix

@@ -5,55 +5,74 @@
   fleetHmModules,
   fleetFlake,
   ...
-}: {
+}: let
+  cfg = config.ccr;
+  inherit (lib) types;
+in {
   options.ccr = {
-    enable = lib.mkOption {
+    enable = lib.mkEnableOption "ccr";
-      type = lib.types.bool;
+
-      default = false;
+    username = lib.mkOption {
+      type = types.str;
+      default = "ccr";
+    };
+
+    description = lib.mkOption {
+      type = types.str;
+      default = "Andrea Ciceri";
+    };
+
+    shell = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.fish;
     };
 
     modules = lib.mkOption {
-      type = with lib.types; listOf str;
+      type = types.listOf types.str;
       default = [];
     };
 
     packages = lib.mkOption {
-      type = with lib.types; listOf package;
+      type = types.listOf types.package;
       default = [];
     };
 
     autologin = lib.mkOption {
-      type = lib.types.bool;
+      type = types.bool;
       default = false;
     };
 
     authorizedKeys = lib.mkOption {
-      type = with lib.types; listOf str;
+      type = types.listOf types.str;
       default = builtins.attrValues (import "${fleetFlake}/lib").keys.users;
     };
 
     hashedPassword = lib.mkOption {
-      type = lib.types.str;
+      type = types.str;
       default = "$6$JGOefuRk7kL$fK9.5DFnLLoW08GL4eKRyf958jyZdw//hLMaz4pp28jJuSFb24H6R3dgt1.sMs0huPY85rludSw4dnQJG5xSw1"; # mkpasswd -m sha-512
     };
 
     extraGroups = lib.mkOption {
-      type = with lib.types; listOf str;
+      type = types.listOf types.str;
-      default = ["wheel" "fuse" "networkmanager" "dialout"];
+      default = {};
+    };
+
+    extraModules = lib.mkOption {
+      type = types.listOf types.deferredModule;
+      default = [];
     };
   };
 
-  config = lib.mkIf config.ccr.enable {
+  config = lib.mkIf cfg.enable {
-    ccr.extraGroups = ["wheel" "fuse" "networkmanager" "dialout"];
+    # FIXME shouldn't set these groups by default
+    ccr.extraGroups = ["wheel" "fuse" "video" "dialout" "systemd-journal" "camera"];
     ccr.modules = ["shell" "git" "nix-index"];
 
-    users.users.ccr = {
+    users.users.${cfg.username} = {
+      inherit (config.ccr) hashedPassword extraGroups description;
       uid = 1000;
-      inherit (config.ccr) hashedPassword;
-      description = "Andrea Ciceri";
       isNormalUser = true;
-      inherit (config.ccr) extraGroups;
+      shell = cfg.shell;
-      shell = pkgs.fish;
       openssh.authorizedKeys.keys = config.ccr.authorizedKeys;
     };
 
@@ -61,22 +80,24 @@
 
     services.getty.autologinUser =
       if config.ccr.autologin
-      then "ccr"
+      then cfg.username
       else null;
 
     home-manager.useGlobalPkgs = true;
     home-manager.useUserPackages = true;
-    home-manager.users.ccr = {
+    home-manager.users.${cfg.username} = {
       imports =
-        fleetHmModules config.ccr.modules
+        fleetHmModules cfg.modules
         ++ [
           {
             _module.args = {
               inherit (config.age) secrets;
+              inherit (cfg) username;
             };
           }
-        ];
+        ]
-      home.packages = config.ccr.packages;
+        ++ cfg.extraModules;
+      home.packages = cfg.packages;
       home.stateVersion = config.system.stateVersion;
     };
   };

modules/cloudflare-dyndns/default.nix

@@ -0,0 +1,15 @@
+{config, ...}: {
+  services.cloudflare-dyndns = {
+    enable = true;
+    ipv4 = true;
+    ipv6 = true;
+    domains = [
+      "sevenofnix.aciceri.dev"
+      "home.aciceri.dev"
+      "torrent.aciceri.dev"
+      "search.aciceri.dev"
+      "invidious.aciceri.dev"
+    ];
+    apiTokenFile = config.age.secrets.cloudflare-dyndns-api-token.path;
+  };
+}

modules/common/default.nix

@@ -7,13 +7,10 @@
     "nix"
   ];
 
+  hardware.i2c.enable = true;
   system.stateVersion = lib.mkForce "22.11";
   time.timeZone = lib.mkDefault "Europe/Rome";
-  networking.useDHCP = lib.mkDefault true;
   users.mutableUsers = false;
-  # TODO remove
-  users.users.root.password = "password";
   i18n.defaultLocale = "en_US.UTF-8";
-
+  nixpkgs.config.allowUnfree = true; # Forgive me Mr. Stallman :(
-  nixpkgs.config.allowUnfree = true;
 }

modules/dbus/default.nix

@@ -1,4 +1,4 @@
 {pkgs, ...}: {
-  services.dbus.packages = with pkgs; [dconf];
+  services.dbus.packages = [pkgs.dconf];
   programs.dconf.enable = true;
 }

modules/docker/default.nix

@@ -1,14 +1,13 @@
 {
-  config,
-  lib,
   pkgs,
+  config,
   ...
 }: {
-  virtualisation.docker.enable = true;
   virtualisation.podman.enable = true;
-  users.users.ccr.extraGroups = ["docker"];
+  users.users.${config.ccr.username}.extraGroups = ["docker"];
   environment.systemPackages = with pkgs; [
     docker-compose
     podman-compose
   ];
+  ccr.extraGroups = ["docker"];
 }

modules/fonts/default.nix

@@ -1,6 +1,6 @@
 {pkgs, ...}: {
   fonts = {
-    fonts = with pkgs; [powerline-fonts dejavu_fonts fira-code fira-code-symbols iosevka iosevka-comfy.comfy emacs-all-the-icons-fonts nerdfonts joypixels etBook];
+    packages = with pkgs; [powerline-fonts dejavu_fonts fira-code fira-code-symbols iosevka iosevka-comfy.comfy emacs-all-the-icons-fonts nerdfonts joypixels etBook];
     fontconfig.defaultFonts = {
       monospace = ["DejaVu Sans Mono for Powerline"];
       sansSerif = ["DejaVu Sans"];

modules/fprintd/default.nix

@@ -1,4 +1,4 @@
-{pkgs, ...}: {
+{
   services.fprintd = {
     enable = false; # temporarily disable
   };

modules/home-assistant/default.nix

@@ -69,7 +69,7 @@ in {
       default_config = {};
       http = {
         use_x_forwarded_for = true;
-        trusted_proxies = ["10.100.0.1"];
+        trusted_proxies = ["127.0.0.1" "::1"];
       };
       # ffmpeg = {};
       # camera = [

modules/invidious/default.nix

@@ -0,0 +1,3 @@
+{
+  services.invidious.enable = true;
+}

modules/mothership-proxy/default.nix

@@ -1,13 +1,6 @@
 {config, ...}: {
   imports = [../nginx-base];
   services.nginx.virtualHosts = {
-    "bubbleupnp.mothership.aciceri.dev" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://rock5b.fleet:58050";
-      };
-    };
     "home.aciceri.dev" = {
       forceSSL = true;
       enableACME = true;
@@ -27,6 +20,14 @@
         proxyPass = "http://rock5b.fleet:9091";
       };
     };
+    "sevenofnix.aciceri.dev" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://thinkpad.fleet:8010";
+        proxyWebsockets = true;
+      };
+    };
     "photos.aciceri.dev" = {
       forceSSL = true;
       enableACME = true;

modules/networkmanager/default.nix

@@ -0,0 +1,5 @@
+{lib, ...}: {
+  networking.networkmanager.enable = true;
+  ccr.extraGroups = ["networkmanager"];
+  networking.useDHCP = lib.mkDefault true;
+}

modules/nix/default.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   fleetFlake,
   ...
 }: {
@@ -12,61 +11,47 @@
       auto-optimise-store = true;
       trusted-users = [
         "root"
-        "ccr"
+        config.ccr.username
         "@wheel"
       ];
       netrc-file = "/etc/nix/netrc";
-      # Disabled all the substituters, this should be managed at flakes level
-      # trusted-public-keys = [
-      #   "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
-      #   "mlabs.cachix.org-1:gStKdEqNKcrlSQw5iMW6wFCj3+b+1ASpBVY2SYuNV2M="
-      #   "aciceri-fleet.cachix.org-1:e1AodrwmzRWy0eQi3lUY71M41fp9Sq+UpuKKv705xsI="
-      #   "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-      # ];
-      # substituters = [
-      #   "https://cache.iog.io"
-      #   "https://mlabs.cachix.org"
-      #   "https://aciceri-fleet.cachix.org"
-      #   "https://nix-community.cachix.org"
-      # ];
     };
 
     extraOptions = ''
       experimental-features = nix-command flakes ca-derivations
+      builders-use-substitutes = true
     '';
 
     gc = {
       automatic = true;
       dates = "weekly";
-      options = "--delete-older-than 30d";
+      options = "--delete-older-than 180d";
     };
 
-    # buildMachines = [
-    #   {
-    #     hostName = "rock5b.fleet";
-    #     system = "aarch64-linux";
-    #     maxJobs = 6;
-    #     speedFactor = 1;
-    #     supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
-    #     mandatoryFeatures = [];
-    #     # sshKey = "/var/lib/hydra/queue-runner/.ssh/id_rsa";
-    #     sshUser = "root";
-    #   }
-    # ];
-    distributedBuilds = true;
-
     registry = lib.mkForce {
       nixpkgs.to = {
         type = "path";
         path = fleetFlake.inputs.nixpkgsUnstable;
       };
+      nixpkgsUnstable.to = {
+        type = "path";
+        path = fleetFlake.inputs.nixpkgsUnstable;
+      };
+      nixpkgsStable.to = {
+        type = "path";
+        path = fleetFlake.inputs.nixpkgsStable;
+      };
       n.to = {
         type = "path";
         path = fleetFlake.inputs.nixpkgsUnstable;
       };
       nixfleet.to = {
         type = "path";
-        path = "/home/ccr/projects/aciceri/nixfleet";
+        path = "/home/${config.ccr.username}/projects/aciceri/nixfleet";
+      };
+      fleet.to = {
+        type = "path";
+        path = "/home/${config.ccr.username}/projects/aciceri/nixfleet";
       };
     };
   };

modules/pipewire/default.nix

@@ -0,0 +1,3 @@
+{
+  services.pipewire.enable = true;
+}

modules/rock5b-proxy/default.nix

@@ -0,0 +1,98 @@
+{config, ...}: {
+  imports = [../nginx-base];
+  services.nginx.virtualHosts = {
+    localhost.listen = [{addr = "127.0.0.1";}];
+    "home.aciceri.dev" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${builtins.toString config.services.home-assistant.config.http.server_port}";
+        proxyWebsockets = true;
+      };
+      extraConfig = ''
+        proxy_set_header    Upgrade     $http_upgrade;
+        proxy_set_header    Connection  $connection_upgrade;
+      '';
+    };
+    "torrent.aciceri.dev" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${builtins.toString config.services.transmission.settings.rpc-port}";
+      };
+    };
+    "search.aciceri.dev" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:8888";
+      };
+    };
+    "invidious.aciceri.dev" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${builtins.toString config.services.invidious.port}";
+      };
+    };
+    "sevenofnix.aciceri.dev" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://10.1.1.2:${builtins.toString config.services.buildbot-master.port}";
+        proxyWebsockets = true;
+      };
+    };
+  };
+
+  # services.oauth2_proxy = {
+  #   enable = true;
+  #   provider = "oidc";
+  #   reverseProxy = true;
+  #   # replaces following options with .keyFile
+
+  #   clientID = "shouldThisBePrivate?";
+  #   clientSecret = "thisShouldBePrivate";
+  #   cookie.secret = "thisShouldBePrivate00000";
+
+  #   email.domains = [ "*" ];
+  #   extraConfig = {
+  #      # custom-sign-in-logo = "${../../lib/mlabs-logo.svg}";
+  #      # scope = "user:email";
+  #      # banner = "MLabs Status";
+  #      # whitelist-domain = ".status.staging.mlabs.city";
+  #     oidc-issuer-url = "http://127.0.0.1:5556/dex";
+  #   };
+  #   # redirectURL = "https://status.staging.mlabs.city/oauth2/callback";
+  #   # keyFile = config.age.secrets.status-oauth2-secrets.path;
+  #   # cookie.domain = ".status.staging.mlabs.city";
+  #   nginx = {
+  #     virtualHosts = [
+  # 	"search.aciceri.dev"
+  #     ];
+  #   };
+  # };
+
+  # services.dex = {
+  #   enable = true;
+  #   settings = {
+  #     issuer = "http://127.0.0.1:5556/dex";
+  #     storage = {
+  # 	type = "postgres";
+  # 	config.host = "/var/run/postgresql";
+  #     };
+  #     web = {
+  # 	http = "127.0.0.1:5556";
+  #     };
+  #     enablePasswordDB = true;
+  #     staticClients = [
+  # 	{
+  # 	  # id = "oidcclient";
+  # 	  # name = "client";
+  # 	  # redirecturis = [ "https://login.aciceri.dev/callback" ];
+  # 	  # secretfile = "/etc/dex/oidcclient"; # the content of `secretfile` will be written into to the config as `secret`.
+  # 	}
+  #     ];
+  #   };
+  # };
+}

modules/rock5b-samba/default.nix

@@ -0,0 +1,42 @@
+{
+  services = {
+    samba-wsdd = {
+      enable = true;
+      workgroup = "WORKGROUP";
+      hostname = "rock5b";
+      discovery = true;
+    };
+
+    samba = {
+      enable = true;
+      securityType = "user";
+      extraConfig = ''
+        workgroup = WORKGROUP
+        server string = rock5b
+        netbios name = rock5b
+        security = user
+        map to guest = bad user
+        vfs objects = recycle
+        recycle:repository = .recycle
+        recycle:keeptree = yes
+        recycle:versions = yes
+      '';
+      shares = {
+        torrent = {
+          path = "/mnt/hd/torrent";
+          comment = "torrent";
+          "force user" = "ccr";
+          browseable = "yes";
+          writeable = "yes";
+          "guest ok" = "yes";
+          "read only" = "no";
+        };
+      };
+    };
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [139 445];
+    allowedUDPPorts = [138];
+  };
+}

modules/searx/default.nix

@@ -0,0 +1,10 @@
+{pkgs, ...}: {
+  services.searx = {
+    enable = true;
+    package = pkgs.searxng;
+    settings = {
+      server.secret_key = "secret";
+      search.formats = ["html" "json"];
+    };
+  };
+}

modules/ssh-initrd/default.nix

@@ -0,0 +1,24 @@
+{config, ...}: {
+  # For unlocking the disk connect using ssh and type
+  # systemctl start initrd-nixos-activation
+  boot.initrd = {
+    network = {
+      enable = true;
+      ssh = {
+        enable = true;
+        ignoreEmptyHostKeys = true;
+        extraConfig = ''
+          HostKey /ssh_initrd_host_ed25519_key
+        '';
+      };
+    };
+    systemd = {
+      enable = true;
+      storePaths = ["${config.programs.ssh.package}/bin/ssh-keygen"];
+      services.sshd.preStart = ''
+               ${config.programs.ssh.package}/bin/ssh-keygen -t ed25519 -N "" -f /ssh_initrd_host_ed25519_key
+        chmod 600 /ssh_initrd_host_ed25519_key
+      '';
+    };
+  };
+}

modules/ssh/default.nix

@@ -5,11 +5,9 @@
     fail2ban = {
       enable = true;
       maxretry = 10;
-      ignoreIP = [
-        "88.198.49.106"
-        "10.100.0.1/24"
-      ];
     };
   };
+
+  # This makes sense only because I'm the only user for these machines
   users.users.root.openssh.authorizedKeys.keys = builtins.attrValues (with (import "${fleetFlake}/lib"); keys.users // keys.hosts);
 }

modules/virt-manager/default.nix

@@ -0,0 +1,6 @@
+{config, ...}: {
+  programs.virt-manager.enable = true;
+  virtualisation.libvirtd.enable = true;
+  users.users."${config.ccr.username}".extraGroups = ["libvirtd"];
+  virtualisation.libvirtd.qemu.swtpm.enable = true;
+}

modules/wireguard-client/default.nix

@@ -6,6 +6,7 @@
   networking.firewall = {
     allowedUDPPorts = [51820];
   };
+  networking.firewall.trustedInterfaces = ["wg0"];
   networking.wireguard.interfaces = {
     wg0 = {
       ips = ["${(import "${fleetFlake}/lib").ips."${config.networking.hostName}"}/32"];

modules/xdg/default.nix

@@ -3,14 +3,13 @@
     portal = {
       enable = true;
       extraPortals = with pkgs; [
-        xdg-desktop-portal-wlr
         xdg-desktop-portal-gtk
+        xdg-desktop-portal-hyprland
       ];
+      config.common.default = "*";
     };
   };
 
-  services.pipewire.enable = true;
-
   environment.sessionVariables = {
     GTK_USE_PORTAL = "1";
   };

packages/default.nix

@@ -18,14 +18,7 @@
       type = lib.types.listOf overlayType;
       default = with inputs; [
         agenix.overlays.default
-        comma.overlays.default
         nur.overlay
-        deadnix.overlays.default
-        statix.overlays.default
-        nil.overlays.default
-        nixd.overlays.default
-        alejandra.overlays.default
-        colmena.overlays.default
         (final: _: {
           inherit (disko.packages.${final.system}) disko;
           inherit (self.packages.${final.system}) deploy;
@@ -53,6 +46,8 @@
         value = pkgs.callPackage "${self}/packages/${name}" {
           pkgsStable = inputs.nixpkgsStable.legacyPackages.${system};
           dream2nix = inputs.dream2nix;
+          projectRoot = self.outPath;
+          packagePath = "packages/${name}";
         };
       })
       (lib.filterAttrs

packages/llm-workflow-engine/default.nix

@@ -1,6 +1,8 @@
 {
   pkgs,
   dream2nix,
+  projectRoot,
+  packagePath,
   fetchFromGitHub,
   ...
 }: let
@@ -24,9 +26,8 @@
     version = "0.18.2";
 
     paths = {
-      projectRoot = ./.;
+      inherit projectRoot;
-      projectRootFile = "flake.nix";
+      package = packagePath;
-      package = ./.;
     };
 
     mkDerivation = {

packages/llm-workflow-engine/lock.json

@@ -2,9 +2,9 @@
   "fetchPipMetadata": {
     "sources": {
       "aiohttp": {
-        "sha256": "df72ac063b97837a80d80dec8d54c241af059cc9bb42c4de68bd5b61ceb37caa",
+        "sha256": "5ed1c46fb119f1b59304b5ec89f834f07124cd23ae5b74288e364477641060ff",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/3e/f6/fcda07dd1e72260989f0b22dde999ecfe80daa744f23ca167083683399bc/aiohttp-3.8.5-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/4c/b8/5c5efbb1d3cb1da3612b8e309e8e31b602ee9c5cca8e41961db385fc9d00/aiohttp-3.8.5-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "3.8.5"
       },
       "aiosignal": {
@@ -62,9 +62,9 @@
         "version": "2023.7.22"
       },
       "cffi": {
-        "sha256": "e4108df7fe9b707191e55f33efbcb2d81928e10cea45527879a4749cbe472614",
+        "sha256": "7b78010e7b97fef4bee1e896df8a4bbb6712b7f05b7ef630f9d1da00f6444d2e",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/c9/7c/43d81bdd5a915923c3bad5bb4bff401ea00ccc8e28433fb6083d2e3bf58e/cffi-1.16.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/9b/89/a31c81e36bbb793581d8bba4406a8aac4ba84b2559301c44eef81f4cf5df/cffi-1.16.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "1.16.0"
       },
       "chardet": {
@@ -74,9 +74,9 @@
         "version": "5.2.0"
       },
       "charset-normalizer": {
-        "sha256": "193cbc708ea3aca45e7221ae58f0fd63f933753a9bfb498a3b474878f12caaad",
+        "sha256": "246de67b99b6851627d945db38147d1b209a899311b1305dd84916f2b88526c6",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/a4/65/057bf29660aae6ade0816457f8db4e749e5c0bfa2366eb5f67db9912fa4c/charset_normalizer-3.2.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/bc/85/ef25d4ba14c7653c3020a1c6e1a7413e6791ef36a0ac177efa605fc2c737/charset_normalizer-3.2.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "3.2.0"
       },
       "colorclass": {
@@ -152,15 +152,15 @@
         "version": "0.45.0"
       },
       "frozenlist": {
-        "sha256": "6918d49b1f90821e93069682c06ffde41829c346c66b721e65a5c62b4bab0300",
+        "sha256": "261b9f5d17cac914531331ff1b1d452125bf5daa05faf73b71d935485b0c510b",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/1e/28/74b8b6451c89c070d34e753d8b65a1e4ce508a6808b18529f36e8c0e2184/frozenlist-1.4.0-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/e6/7e/74b176a5580e1a41da326d07cf47a0032923fb3eeec9afbd92bb5c6457df/frozenlist-1.4.0-cp311-cp311-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "1.4.0"
       },
       "greenlet": {
-        "sha256": "d75209eed723105f9596807495d58d10b3470fa6732dd6756595e89925ce2470",
+        "sha256": "3a06ad5312349fec0ab944664b01d26f8d1f05009566339ac6f63f56589bc1a2",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/6e/11/a1f1af20b6a1a8069bc75012569d030acb89fd7ef70f888b6af2f85accc6/greenlet-2.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/86/8d/3a18311306830f6db5f5676a1cb8082c8943bfa6c928b40006e5358170fc/greenlet-2.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "2.0.2"
       },
       "idna": {
@@ -200,9 +200,9 @@
         "version": "1.1.5"
       },
       "lxml": {
-        "sha256": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76",
+        "sha256": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/3c/d2/11533f0bc47ff4d828a20cfb702f3453fe714bd5b475fcdc8cec6e6b7dcf/lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/ed/62/ffc30348ae141f69f9f23b65ba769db7ca209856c9a9b3406279e0ea24de/lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl",
         "version": "4.9.3"
       },
       "mako": {
@@ -218,9 +218,9 @@
         "version": "3.0.0"
       },
       "markupsafe": {
-        "sha256": "65c1a9bcdadc6c28eecee2c119465aebff8f7a584dd719facdd9e825ec61ab52",
+        "sha256": "bfce63a9e7834b12b87c64d6b155fdd9b3b96191b6bd334bf37db7ff1fe457f2",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/12/b3/d9ed2c0971e1435b8a62354b18d3060b66c8cb1d368399ec0b9baa7c0ee5/MarkupSafe-2.1.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/fe/21/2eff1de472ca6c99ec3993eab11308787b9879af9ca8bbceb4868cf4f2ca/MarkupSafe-2.1.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "2.1.3"
       },
       "marshmallow": {
@@ -242,9 +242,9 @@
         "version": "5.1.1"
       },
       "multidict": {
-        "sha256": "36c63aaa167f6c6b04ef2c85704e93af16c11d20de1d133e39de6a0e84582a93",
+        "sha256": "11bdf3f5e1518b24530b8241529d2050014c884cf18b6fc69c0c2b30ca248710",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/56/b5/ac112889bfc68e6cf4eda1e4325789b166c51c6cd29d5633e28fb2c2f966/multidict-6.0.4-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/9d/5a/34bd606569178ad8a931ea4d59cda926b046cfa4c01b0191c2e04cfd44c2/multidict-6.0.4-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "6.0.4"
       },
       "mypy-extensions": {
@@ -260,15 +260,15 @@
         "version": "0.3.0"
       },
       "numexpr": {
-        "sha256": "cb2f473fdfd09d17db3038e34818d05b6bc561a36785aa927d6c0e06bccc9911",
+        "sha256": "11121b14ee3179bade92e823f25f1b94e18716d33845db5081973331188c3338",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/2d/03/de1341ec86bbdf1e4a7ad34d95af4762be8a3efab01d5f96922f1228da3e/numexpr-2.8.7-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/6a/3e/fa33d67bc4f5ee05f5bc2ce65fd1a796211f0b759cec3f60ded2763013b9/numexpr-2.8.7-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "2.8.7"
       },
       "numpy": {
-        "sha256": "767254ad364991ccfc4d81b8152912e53e103ec192d1bb4ea6b1f5a7117040be",
+        "sha256": "e062aa24638bb5018b7841977c360d2f5917268d125c833a686b7cbabbec496c",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/9b/5a/f265a1ba3641d16b5480a217a6aed08cceef09cd173b568cd5351053472a/numpy-1.26.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/c4/36/161e2f8110f8c49e59f6107bd6da4257d30aff9f06373d0471811f73dcc5/numpy-1.26.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "1.26.0"
       },
       "olefile": {
@@ -314,9 +314,9 @@
         "version": "20221105"
       },
       "pillow": {
-        "sha256": "85ec677246533e27770b0de5cf0f9d6e4ec0c212a1f89dfc941b64b21226009d",
+        "sha256": "8d935f924bbab8f0a9a28404422da8af4904e36d5c33fc6f677e4c4485515625",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/25/6b/d3c35d207c9c0b6c2f855420f62e64ef43d348e8c797ad1c32b9f2106a19/Pillow-9.5.0-cp310-cp310-manylinux_2_28_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/3d/59/e6bd2c3715ace343d9739276ceed79657fe116923238d102cf731ab463dd/Pillow-9.5.0-cp311-cp311-manylinux_2_28_x86_64.whl",
         "version": "9.5.0"
       },
       "prompt-toolkit": {
@@ -332,9 +332,9 @@
         "version": "2.21"
       },
       "pydantic": {
-        "sha256": "1740068fd8e2ef6eb27a20e5651df000978edce6da6803c2bef0bc74540f9548",
+        "sha256": "e31647d85a2013d926ce60b84f9dd5300d44535a9941fe825dc349ae1f760df9",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/e0/2f/d6f17f8385d718233bcae893d27525443d41201c938b68a4af3d591a33e4/pydantic-1.10.13-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/d2/16/2edfe3e52de9d46fee81d9b9ace90fd7a49a86e7a36d7fc280183f77515a/pydantic-1.10.13-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "1.10.13"
       },
       "pydantic-computed": {
@@ -374,9 +374,9 @@
         "version": "0.6.22"
       },
       "pyyaml": {
-        "sha256": "ba336e390cd8e4d1739f42dfe9bb83a3cc2e80f567d8805e11b46f4a943f5515",
+        "sha256": "d2b04aac4d386b172d5b9692e2d2da8de7bfb6c387fa4f801fbf6fb2e6ba4673",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/29/61/bf33c6c85c55bc45a29eee3195848ff2d518d84735eb0e2d8cb42e0d285e/PyYAML-6.0.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/7b/5e/efd033ab7199a0b2044dab3b9f7a4f6670e6a52c089de572e928d2873b06/PyYAML-6.0.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "6.0.1"
       },
       "red-black-tree-mod": {
@@ -386,9 +386,9 @@
         "version": "1.20"
       },
       "regex": {
-        "sha256": "551ad543fa19e94943c5b2cebc54c73353ffff08228ee5f3376bd27b3d5b9800",
+        "sha256": "14dc6f2d88192a67d708341f3085df6a4f5a0c7b03dec08d763ca2cd86e9f559",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/d1/df/460ca6171a8494fcf37af43f52f6fac23e38784bb4a26563f6fa01ef6faf/regex-2023.8.8-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/2c/8d/3a99825e156744b85b031c1ea966051b85422d13972ed7cd2cd440e0c6c4/regex-2023.8.8-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "2023.8.8"
       },
       "requests": {
@@ -440,9 +440,9 @@
         "version": "3.10.0"
       },
       "sqlalchemy": {
-        "sha256": "7ca38746eac23dd7c20bec9278d2058c7ad662b2f1576e4c3dbfcd7c00cc48fa",
+        "sha256": "44ac5c89b6896f4740e7091f4a0ff2e62881da80c239dd9408f84f75a293dae9",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/99/f4/5c7868896285b0d95b6b3f0310850c6cf50b965569417c2959d2bd6a115d/SQLAlchemy-2.0.21-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/54/c2/c51f040038859732f781f25907e01ee980987d24fa0747884e6073363a14/SQLAlchemy-2.0.21-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "2.0.21"
       },
       "tenacity": {
@@ -459,9 +459,9 @@
         "version": "1.7.0"
       },
       "tiktoken": {
-        "sha256": "e4c73d47bdc1a3f1f66ffa019af0386c48effdc6e8797e5e76875f6388ff72e9",
+        "sha256": "426e7def5f3f23645dada816be119fa61e587dfb4755de250e136b47a045c365",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/f4/2e/0adf6e264b996e263b1c57cad6560ffd5492a69beb9fd779ed0463d486bc/tiktoken-0.5.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/94/2f/0cc8fb3436d421d8fa2da370aca0283201f1b99e88a0f6e742bd8eef397d/tiktoken-0.5.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "0.5.1"
       },
       "tqdm": {
@@ -513,9 +513,9 @@
         "version": "3.1.5"
       },
       "yarl": {
-        "sha256": "891c0e3ec5ec881541f6c5113d8df0315ce5440e244a716b95f2525b7b9f3608",
+        "sha256": "159d81f22d7a43e6eabc36d7194cb53f2f15f498dbbfa8edc8a3239350f59fe7",
         "type": "url",
-        "url": "https://files.pythonhosted.org/packages/c9/d4/a5280faa1b8e9ad3a52ddc4c9aea94dd718f9c55f1e10cfb14580f5ebb45/yarl-1.9.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+        "url": "https://files.pythonhosted.org/packages/ee/8d/55467943a172b97c1b5d9569433c1a70f86f1f9b0f1c6574285f8ad02fc2/yarl-1.9.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
         "version": "1.9.2"
       }
     },
@@ -600,7 +600,6 @@
         ],
         "langchain": [
           "aiohttp",
-          "async-timeout",
           "dataclasses-json",
           "langsmith",
           "numexpr",
@@ -748,5 +747,5 @@
       }
     }
   },
-  "invalidationHash": "b3b6f67a971aa3a6e3bd95ecfa314757128c8d889d0bdeecb79b6792531f1818"
+  "invalidationHash": "7af0c6dd72cba5fb9fa7e4fae080dbcda28fe3cbc3f5ac8115ba305ab4e81156"
 }

secrets/autistici-password.age

@@ -1,31 +1,32 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-aS9Ti/0v9SdXOtvJmfC+nqUpHnvKAmoqQBX4PfsYvdyVNyehILsvLtITFTZu8paw
+Gh0leGCwMkwOqTla53XrKRsIQ4pRabbqpK69bqKy6V0WVxDwSqc5hFchE23+rbWw
-9gHWs31+i0cEKEZb7O+ei76qwT3o8fH+jFwVsytC9+f8f2Q+0y/K383w2f5AFLNL
+2MZ6PMWntA+G8PwZ0d3Ypv0+neLhq9s9EowzLGPV8QkVjoWUumhKT0PkQXE2Ibr+
-+xj9BtU3/p3A6aPjewMDChhx7WAfUS+zHStgSv3ne2lOS2oa6C7FqBCoWkyOLKQF
+hA2B1n9w+0LU8FWOP9IWNEcV1RJoq3g6a8wC8+7mCdQHUGxmMSTMrn/NBpafgZ8O
-fzNaNSGj5A0CpzO29e/ww5R26DZfm4Wpd5c9ZevQWdVK5QYW/Ro8t3kAmIp4VE4N
+TUHVE+JZxHH5ubuQWR4txcEKTo5O/vA8aNwM7XYBZTb1zUkiZkeU8oy7AGNkqQy/
-7PnIfp5Ebl+WnxD8prfr53bqmhDLkjEF7QcShWQH3FtISDu9IliDRU1MiItRBUP1
+jwGwAZSGaZ1qZwMNHHa3efytYQq8/y9xHR+WhhPBmsGQGZvR80rvyjEWVTngpAoL
-vKUG8CEiDACzoCXQVph8R0jSe8NEoKhYBEBj8T66s/Mi+vFTYEfMZUC6qbr4Xrhm
+KjTgVK6DC1et4cZTK3qL9YBnb2p/iKSYw92Gy/byqQMzjZvsLpCZnxRN5dMHLJCQ
-y5z0C8BgZDejzdsRmSaNr4MgXj/zajmyhCIKg/gbbuovnuM+qFmuKNEoa6unUnvE
+eeaH9iKYTXWm9eexKj81/K6f+3BK8h545oeS/9SZSzBLPE+8Ax+6WpR70DQKxoMf
-Q7zhn5bUeeM8nUMGWb692+NoM3hJmoAY25yYXhb/YuNaJKSwdPJan9Ua/Qvk+rGD
+7NEfAMLQmYSbpB8hLJdnx0EnmjrzaKIuU3UDG93gaTj02haEe1uftJr4cklYiD4T
-mXVPYGG8bYf0vssI6lQ8fWS3b/cvbIDUZ3NWW/NY8H4ng2joBHx9z59iu9zyvV57
+6Ed/c1n0lgsMw6+0HDKY3e/1jgAy81JZY7tc/O95VZXwI7LATqLzmCq4/EpSakll
-/K9dtyvWo1Ya77NcypiZlBL5MSTCKeBKhRJPieBkYaWxm1sq9g04O/EQS1UOsyAQ
+w941XiQn0UQVu4+QdrFFiucZYzGCrXns7hdQa8j3+UnJPnDrRn0ywdqhboQguJ0m
-kPKllVtTiWqSLOciw4AfqvjIOZxp/ZhqS6M+d+Aa0tQ
+NamG0DmKbVNlKFHTMtCAzoJA8XiXVtsFCD0DA6mCg2A
 -> ssh-rsa QHr3/A
-AjIIyAKoy5b2Qs4c5T+sP85pWk5trHHEOYXTehLv2seBspny7o0f/Q3oJPRfCx3J
+UzI15HwKuQw+mDMnchKybYlb2yddnSXJ9BuRmocuNaD9TTi3DukWNT63QlPVsemO
-BFhDmWE3iXknprSEiaOu6bmUB5XtkmQcs/JMPh5wDgMe/Xu6uLvpelVuxdaI/K1O
+bMXd+lKYDrncGm5JiVsfCcPQTVmKPOlBZWeQqqV/aGozgEo8DpxCgMJqjIjsQhNY
-yqU1DKY9EBUWUTscUofzoGg7nO7yPvOYkzDei578bMo3tDTkwiPkFDuSgWkKjlsq
+PF08BCoLEpaK2NQdDscXRhKvMB9hU7cdKkA2fVIGJ1K3h53EvehIcp8bdM4YqjVy
-R+JDG8nhbGb/70FH6YFYAqAb+JcKkI5qpPvC9Uzgtv7F0AS3+DPhxRA5eOx920HI
+6vXAKEOwTe8fidZDJ8AeQeQii94tCKeeS9L7SfNfukiLC9dH4bHNVH5nTQL02NY5
-zEaGdSMxbcJCzN+/1K1Q4olQu6HQAC0tEWgZqbqNEnLHp/bUTSoF1IFWDSREn/iE
+6GKUcp1LHbFZCjYPQJ8m067625TPKkPaLEqMTmsyS1py4oX3gW1g77/e7ceiACTj
-7xp6+ObmWh+XRFof/AW3H/YCvkd8La0d51Coo2rgKHd8Py//rJgcAYpd1b1ZXfXe
+G9NS/MZLc5IJB5q54A8AvqBWkZLqK5K3Vfwmclwa1CkzkvJCx4JVuX2HR3WjyNgS
-2FBG6VVO/Ysjksz1/cNpjuYXvldSGejszPCuJ67KMEIgkvSX2cdPUu+98HGRAQCN
+biT5mRu8wFzdmPGl2KwKU9vJuwPJIqFGEL8c/C/pk3scnfj25Lgotes+CvEjeblD
-Awj9ahybqFUuBySAkqGYD93yovWWS8yTIKJ80qCWMeEYANEc9mOWso8ANOgR2T+A
+rT+O3v9U5YZ1tM8i2z1h+d5Bouq1UVm4x5A6h2llUgSE5KNoPr0txaiwUCZj19Xb
-76rltP+jU3Eh1dlmT+/VAJUixhBK2r9OPmI1eQru1z+Ccr5OzX4ButQZatfEISC8
+2VUJL2HuJvwyB44yS9d+QQiap+9Zhb5gV6uxbf7m+EJcVDS8/K2tv4hi0Y8ghWyF
-cPYX5pkWkAchU75k1deOZj/3ErMRkZZCEDKHGez1q5PaOsTgqnnesIRRp71FVxza
+f7H9RVF7EGoyE8NjdR45fTzraf0CUvsD3TNNS+xWugf9WlZN2wSv+iIJ2CbwTZKh
-wG/cKo/FOJtv/wr6jDMUiWMYf4D3pfEfTMzIaoq5ABQ
+uDiCJr4JyCBEVpC9NZpZEpCcF5AZw+4DCtOhBkFWGfM
--> ssh-ed25519 GVMLQg 2r++M77tFpBoc+CBj1tMhFcxj6jkIlEkE+zTd1uUs0c
+-> ssh-ed25519 GVMLQg 4rHsfVEOaan8wjl1CLoh/T7snu+p4j/AQpHmBauRp18
-9uoJGBOWr6mH0brInDOkfQenNf43ELaIl5HcmicV2L4
+KFMhuAJ22muuCPtDIkFjpnTggbB/ehS8oc151ITA4M8
--> |Mk0]-grease ]^Tr
+-> ~,4kT(-grease a_> sE
-I6N2f7msrKzeNxvWZw4MLWpoWJY06HVxgN8nYqr7k+mLoeBf
+JisIrZsTiXCFTG89naOuCiWA4NWW6cxEQunfhdL5wwgXCg0F1G74pnTdTF1kRjun
---- 4wowM7vo2hhlH0YW6rH2gMstxiWSD93M5lUPK7pNoYo
+5ODv+6l4bx0
-<EFBFBD>½SÁxÔ@ž-F(‘»y•?±)…íµ-ö<12>Ô¿Ú†á>ÍR¡Ûþ2¨.
+--- i7QnCQWxCbq0WAHP3v98FdtGCPJF+FS9vZzEKtQxOqw
+ãê'%Ìüº+#ÚÐÆ-ŸQÈX«Hëÿ@jQ3]'–µ ÈB¹ðÓ‚¾Ù-f²

secrets/cache-private-key.age

@@ -1,33 +1,34 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-TmvWn7orYJaNAyKdQuewLNrtebcKvnUp8gcC3T1fcuwEc21I3D1pq4S8la7vk6qs
+FM5clIWm/SZVtZWaPjSHWhqcK5ReSA9kP82WzYKNmyGBAW06ZzYYO4iju/4HVaAw
-HogakEgRVu3zbcHA/97JRZZrehm8WQ/DjI4NduUl0VkCcnp4QsESVaKCBKiAxOwa
+q28y+mOJY6JPkhClNGvIfRFITPSTULvxEkZOhlPmQ5wOpahvpKtBepQU5KVzGzuV
-bZ1UhNJroKGYh8358HS2ijgxvvaKzV2snxUrsnb/jrr3DO1oNg6WOmXRG/MceqMk
+qjuFSiLDZ5i3FC5NXlnXeD4C1pA1L9ccKF3L0xqEfzER1S5wGzIpY86EfeYuPwZe
-+3/0jg5rTL2vCkrrKEgAxmDvYuMyK7PKDVx8Acjkk2JgOEwoXOzINzlu+TRvhDJb
+kMYkKcXrnh0TjLrwXH/VA2Py7sDd45tVf2rMMYv1lCJCpGNMzp+OhTcySeT1SbOZ
-ZJTW5u6EYZjPDQVRF8lqox99wnkaw+PnlcjunJH4GnheC/K4+ueEy9W/gYt+pm/+
+fL8DphIu6nYr28gnEoXQOYklcukVL8Py1yFRpDle6K0/c72DMp8gtfLy7p2ENQBl
-ytWycU8zJOgee6Ru3cHuDHQzqmdnGhNJsn4OVQ0+Mqix82eTVR2NqrU5H7bw6e17
+Dxm56/ZJnFqvWWu4rkre3jlZ1H78QwKvduNKkjRPiT3zWM/KMtT3JObnPwsLj2lu
-V9FnDF8oKU8Kd/CyIuYGv+PVDOA8Xxl3whrS7N1kMtqnn9tGieinbA4Afpha5tPv
+sj4KdoGwSaR8YPw4qS7dtf0i0ztUpt7EaXF//21qG1t5fI9sTLqChvhST6hWeaWl
-OB+7S+ExsO1K1h3dJjmQSlD2ikWtdBUnXaivnNAhEKFj+Nsr+9X+XF+qX48TziUJ
+vdr0lGS+3zYM78DjIchXzy3kOWZHbANiuOulConGp7BIGKJhGS8yJD6Z7naVGGfY
-0QlYwUxs4+nDjDIbIBhXKIQf4LekOtfI+pTYZORnDk7apH040m8KsOrdN8VcvWQ3
+2GiphUohgDEesatuE3/QMELsZmuTztYaR8NQxuue6R+hEiea0eCwYN8jHI3v43NM
-k/JcrqYxYKfL9CmMx0oHuAWg+qknJzpvGk1X5u6MPuq/qERZC9IvUuNLz5uy7Vvw
+PgImhq0Yp97Sak3/0yG8ezSdcCJ9AKt+ScCwkDBDIg5fFSoMPj/eZLNPvGK2tWUm
-S7/HYnqlz/iJuHdho9MJFh3VN/VcDvD4UYeWfvqdhjc
+FYmCwXUG8pb02qDzg26JlDJPu4B4Jkfe2GXCYJrewko
 -> ssh-rsa QHr3/A
-cdoTXvV5UCBkt/ht5CaxOweUZFllPZMrweMBEXlfgtavgJB2NhHsoQe6FTf/O1hX
+mqZ0oOXQI4+lX4TfjmQl6k/ng41X+Cs3wFcE+SrhHlr/OKpSCPwKVUt4CTC6vEXy
-HyYTKpE3EA9SfjEZIyaahGrmi5j1sz+KWD8zVkEADoULM0Y3k57M3yz9mWA9YLSR
+xPHQfw6zKi3Z5O1MHd1Y/+i4PfyyXBiDbdLuJtg0mT2ulwj6g5fIsOgONk6KbGYt
-H9hte3vseqQ9/uJwS+RlNRoimzoqeeXa+Sf8firSagwdFnaZwRk+qMQXJyeTIWIJ
+3Y4Db0KcenfGrH+Yxpi8KMSO33smpoSI3ywqhWfBXaetF2rkNWHupf56hsEKxj7n
-reYRHia3BI85E1YA/Znq9IYZ8r/4J6yN1JtfcbCkPsesoOf0+l8ilG4hGuvQHuhd
+DZF4AbyLIm0WrFQaBLtLZPt9rk92cY242YNyXHGayBOiPvp9Y0TIrogcaDY6KmUO
-4IminfF4QNVKii0ePoKltdlUTT/HciGKzZbUFC8iC/azW6mXcYtotsGvCpHJnkpK
+bEXjKDF6yduj3HJ/B/QVj4u+xpy3aWqP/pN5brC43XlnG7pUzWxAY9EuciIDfIsH
-XBLq06s0c6FKd4/zgyvK4Eshq4se410PMUFq5awj2j64J1mU2BL8Aj4iWcddo0G0
++VEAg2Y4bIxa+5qimNslhNP5R8de0DuHEda4WEr97jGklnvj3j3Ff/4s/SEn6IXA
-9gppn8zQmgvwVAAhpD8LNDz1DpVpmZvGNoYRGqI0SMxOBsRSWlQQvZG5TwOJm15v
+GuAABYXlsxhFM86kcQNtGh6oCFzoDF03u2sSrI2S5ntg275QhbL9btyBQiJIVbiH
-+CBdyVe6yJC42m5lhNgwhCnHNYXle9QE9gadB6ardNTG2kMrC2LfYL7jYnMI6HZy
+etG+efEtumuhRw60ygirA8wUaLssLLfGhUocq0Lax6/SlCRVtDm0rip9FQIeesT0
-Pf6hgCiMtuqHCDRGEsa1bnSRYu7D5edFeolx2NA+6UQ9abUY0YA21lJzduLXJwAs
+ZGoHqvdEizbAviG5qp1A5bh1cCr0VzPWNP4MSpb+Fs4k9bZttPJb32NsbD9uREab
-EOZ5H8O0ZtD194h6Kd41I/xtpuvSGzkK2LYnYe1BYD/yWBD3q4xRuYn2yVQlxYj+
+5mEXMmEX9QpBxhBJbNFaxfLPSQ8jNP8/siBsuvxwvy5BGwhDEsR86CUzP3WFOFXu
-/875uVa0SCifU57Z+IHHArKwbJj9thpSVz7cwkW6JeY
+KnfzBn1DbwNhrpCqiiI6ROP2Co2vmIWe0l9D718mHRI
--> ssh-ed25519 q+UPnA tN88kSc8LRqVpXAkIzp3KWbSS0T1wTUco+D25wwUHDo
+-> ssh-ed25519 q+UPnA v1/eUkeuoMdt4UKbWYVJkH3A7XIgLaj9uZ/hQhljQW8
-t81EY5m7h37mqYrl0H+llakO/On8iqAFPxAkeJ2JrOk
+RfKYL2+ixPSRwmAA1dbTBLyIHJJqy4UwHYDjB9uyTiU
--> so-grease [)&pY^ .MX8"~n0 ED(Z6W
+-> -Q4-grease
-AIL61IYE4FXiv0IRWeFpLyHcGtL2Do8aAq2nmXvWxhzsXR7/bdTiHiV4VduU/hrn
+/Ikxwi4xyEJd6OUW70MDxwtmRBGaccx+yfgizKRkyHvJ7xG7JbNgDLUah2lEUYTu
-+Z6KT69seMi6tMpIKy50r/4mZ7+FGb1NrGNFZX4832ZU
+equZ6jpqbqnQqoDbr1CvrTVhKXVfBWONE6B4
---- oRil5Z4drCQPYqMHhnV8lF/PiJMiIKnUgsejqgII58I
+--- ejgbOviO+63Je17DM7LrFpoerdoNAkDZKI3UxsczYic
-%,ûŠVÔñáçY!Ög
*éúÆŠa”SÓãå°Ëy=¯d3d	k&¤ÄÚ
çgvûUZJ'©Jðà&SòÜq?NiÅf*Ü·²ÊÓbAù)
+˜øO2ÆvíœR:ô^(Ïú9Kô6õ¿Jl´Í™ÓuÂGØŸˆ	õû<>d»<07>·ñ>%{žt´+ªòGñÞ¼c8¹×
”éॲ
-Ì÷'DÊH=n·BC1ppMr<Kïåì'>
ó{<7B>‹´7g-:s ÃWµq3‘Çó+ªj¸.
e¿£-Vð|
+eˆräWù~F¯gn¡µÕ}Äßy2?~
+R-™pzoYŒªU5ó´”È~ÓDÉ8}‚vßÜfXú8L

secrets/default.nix

@@ -3,20 +3,21 @@ let
 in
   with keys.hosts;
   with keys.users; {
-    "cachix-personal-token.age".publicKeys = [ccr-ssh ccr-gpg mothership thinkpad rock5b pbp];
+    "cachix-personal-token.age".publicKeys = [ccr-ssh ccr-gpg mothership thinkpad rock5b pbp picard];
     "magit-forge-github-token.age".publicKeys = [ccr-ssh ccr-gpg mothership thinkpad];
-    "git-workspace-tokens.age".publicKeys = [ccr-ssh ccr-gpg mothership thinkpad];
+    "git-workspace-tokens.age".publicKeys = [ccr-ssh ccr-gpg mothership thinkpad picard];
     "hydra-admin-password.age".publicKeys = [ccr-ssh ccr-gpg mothership];
     "hydra-github-token.age".publicKeys = [ccr-ssh ccr-gpg mothership];
     "cache-private-key.age".publicKeys = [ccr-ssh ccr-gpg mothership];
     "autistici-password.age".publicKeys = [ccr-ssh ccr-gpg thinkpad];
-    "hercules-ci-join-token.age".publicKeys = [ccr-ssh ccr-gpg mothership rock5b];
+    "hercules-ci-join-token.age".publicKeys = [ccr-ssh ccr-gpg mothership rock5b picard];
-    "hercules-ci-binary-caches.age".publicKeys = [ccr-ssh ccr-gpg mothership rock5b];
+    "hercules-ci-binary-caches.age".publicKeys = [ccr-ssh ccr-gpg mothership rock5b picard];
     "minio-credentials.age".publicKeys = [ccr-ssh ccr-gpg mothership];
     "aws-credentials.age".publicKeys = [ccr-ssh ccr-gpg mothership rock5b];
     "nextcloud-admin-pass.age".publicKeys = [ccr-ssh ccr-gpg rock5b];
     "home-planimetry.age".publicKeys = [ccr-ssh ccr-gpg rock5b];
-    "chatgpt-token.age".publicKeys = [ccr-ssh ccr-gpg thinkpad mothership];
+    "chatgpt-token.age".publicKeys = [ccr-ssh ccr-gpg thinkpad mothership picard];
+    "cloudflare-dyndns-api-token.age".publicKeys = [ccr-ssh ccr-gpg rock5b];
 
     # WireGuard
     "thinkpad-wireguard-private-key.age".publicKeys = [ccr-ssh ccr-gpg thinkpad];

secrets/hercules-ci-binary-caches.age

@@ -1,35 +1,37 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-V2hZsL5V2EUNURZUsV6sz5pe7424sQD1hPrx+afkHtdln0DuDNyAWil3vD+WzT/b
+pIudzcWvMeCDGMBOvmL+eBGVp+SXyKzXRI0AUHbq+5Vk4IIVF3mllHSUhh3D1BbA
-pjBPiL+j+NAIUr78MLTXjUL/lBzGaW0r4+6sisnPPLkxJDl0jyMQC2JkPRlw4qi8
+iT3omkCmDGw1iToLHA2nrJEHa52uYttQamsgg2PZAc5pB/Sw39Pl5FUG1OHj1q5d
-pjSskAIy0ijMYHFSJte8nIv7aHUoFbWPO+4MTXPtU9VL2Ezkvs93OcHxTER20Qyf
+TW4dmQdwdeV0Mt9d17G3aQRYpa85M+2OH+7xPTruqj3A/LL/DKZWfk2acSEK9hxa
-t2WheCoADIdAow7PFWzP4wmDGG3+WTksvAAee6xPQRjw/5k2iZejFkdi99aLlGlZ
+kB/JR9z0Df8z7hsU34dtWnm9MycytpFdRxixPD1G9bsIgEMeGLbk+hQ4e5SQGpon
-clhoEHhGJ8ZqEj5DAQTZBicexaEcz1Qx2om8CfEwoaR2iZmhnGV2PqZ3Burskp/X
+R7sAMK0k1EC7owT7r7AA/namKyMJGM4mELjPnPdChFrcxqc6gVLzfJhIPZAXFdAZ
-LWJID1eRG5SaSKDg0AtqdQv1GUYixQq6wt7AAftj3X7YLFocHWq5uQfttV0sM1Wk
+a5fEY2cmVhmTVQ3XOLUiPFKvwJ8jk4+RsWnNRLrGK725D36187HjfiyoHc7lO8tL
-7l1A2WFd+p7LBzQqqTqYfAqCgP8TFVmNds+99ElTSSZaajX/qnIQ+KjobCM+Rzxu
+3EklUmNtPsjolWpxXPkIGChQ8HY5ndexcsmCivffDJXJrD07BNENHdzqXPhIaMbi
-Jl7XXr5lb3hKEcyVpao1Q5CusXhAPxn5EipHF9jN9wPJjpMqw0252MqOaOaevwmA
+YEum85pLmxmODIhd4go8MA8jJG7SCiBreNLxYZazzWz+dWISCqYqthusSXbhYqEQ
-tuEZ3aNYKsT0TWVqx/mBe8VgzNXWeCl/j5c+62bhfOpcoamj2yHAyxx3Iyph0nnj
+8DNNJ6B9gYlIv0wmSXgG+sJxR5rJoZhCrtoFNVaegrD2BYRPuL5sVrqSDR3MFDig
-w+2MASWpV6YaK+V+zyZYAOn4N7JuHPv0ty3p6PbQ8TeGvD0HjoZBHrk/n7Od1a7o
+hqPt4/+SasSh0GSNxaOl13ZUOAUuR+YuEpScfGfksB/+5CRJL5zC69xwaPvPza7Y
-mBWqcELxIF2A5eEmB6suk4znzy/kiJNsVpU4X4KAsr4
+3GX6NoLmKnDX43oRiNWHH/AX/seOuOVCStWnjpWNAQg
 -> ssh-rsa QHr3/A
-XU7aK44KXhlKNmAwqGJMniwcnmbhG37/MmKkyqO4waD8fsYjlkaYIpE4tZknyBsQ
+b/M47E06dpdPaPZy7UtnVeP3g6MJyZfD3vDcfHi+i0FahZS7dioKJV5FTyyMVZFE
-kgEWuKDJP6mspMh/6GrT9RnCJ1jb3j7TKA+tDJ6h9Z9adiJZwJqZV2ERww2PuCA1
+B38UPY8a2E70XIlXBJIJIhHRJNCNAipsXtTBiTyy0zD0kMFxC840MfDEvTd7o+KH
-kyR9zS6qEQz2xesvKVO+w+wu5+ING/N/K/bvzzFHcLJTy1ro5DRF+wcu7U5uKIkU
+FtuJvwGmu3jCKN48DksNSkPscrqIwK9s3JB1xIBmeujR8mIB2nDPgzDJj6a8ytkb
-p10fq/cY8BTJ8AxMjuBeKw5XDhq9kxufmkK27TpwF72xZxhnO8VWT01Jn285pbPt
+pMTD8KzryzQ+KOWk0VFDUnnsNEtQZlG3tRyT80qs6an+W4Y2c95BZxy2vhwleRSA
-9SO8Mt1sbWAhloN5C6psi5GWQjBO+K3+HA4LaO0trPwXpfBcG3GQ0Xn2yPxuPKKa
+eulNOXQWYoUNE5m4Ys2oZ62WOJMT/2bGCaPDVQVrDHICN5595GZzenXtrr0YBXGm
-RcjxBQCBwMaHSK+xwmDZjoJzyBVg7xi2e7QapVMFy9hWM/lgGKiHAo8Kzfww7qY4
+dqu4JQIKL/BNT/Rb/MQcb2vkegJojbYtS6SFERqkQP9tlzdEFARrYtxOgLQfN95t
-GTE2oZogSkwxq7T4i5YCOjK0YX3MDguqHWfE70Rs7OQ7Nh8CXhGkYj9mbKFCMkoT
+EG97j8hNWpjj+pR3CRN/lRcTUgFn4hS2BgM+pd22Zu+Gd0tZoaYjDDXXALcaJdOS
-mIsg+4eMt/Th3WCugHrPslPv+NidJaVqAzXdQ/+M62JrbGw7jZdH3MroEsHJ/Hdb
+X6cOqZKBsl7v6HAFcS6md6Vaf8yilWMAHJH4sNSTF2aw1EDxPNKK/ok64m6qx6j4
-+dBKSOgYPQ0Q4FmPtOvToReU9SVdUJS47/fFVTsbK67pEUBiyf8kPUTHJvBCCEBC
+dXhfYdVrzvDlv0Y6TNtITL9nEZ+ic4AHczlcjhJOIaH8r0rEhj9PvSHAM+vN5Ugn
-qeDV9t6+5rHVXX34edYz3aFoSPDBGAudvaTCLEt46uT4Bq0qc7211KCRiIew1HbA
+NW6AywsFlK6rAGmDBhEIroG7WB3VLSRSMy4kVl/G9xaOoZu0Duwt7FYU+v/OO0nD
-HlsI/Q6SGZQir3LNJDFB786UusOcLjrHPMZMifglhSc
+D+AQyjJ3ruA7BXtYhRuB/jWUyEzlGBY34wlsUmu0dZo
--> ssh-ed25519 q+UPnA P7HFhjs8rzPoeHGmprpuKXqv14bf5s6PHiyF5n8UiR8
+-> ssh-ed25519 q+UPnA l/ncevAF4GZQtBf8X8djN7QqDogFs4UjvAKXgRtUrSA
-BTchCbQJcBpH62D1ZpDIKFrDHp+RYQpWUPjfWu8SRJE
+ThTG2uLnuinFWc0ASNTY9JifZLi6FwUq3iv7CvYqwT0
--> ssh-ed25519 OgJHCw vQYQeTrvXLlbxWuzPlrhzMAipw5kBvHoohG9sy/g1iQ
+-> ssh-ed25519 OgJHCw brwV1nNAOY/0FVruei9pyOteQI6VrU9sgWw+CFgLNDY
-TY2ooJ8+LvBTsNsfcHvx6NG/hQx4F/pHGDAJLjLRRJg
+yRRVbBGo/a/H7lJ73ZrWXuN4cvorrBA5go7hrKWEWCM
--> h^1tYt-grease yB=&. x|
+-> ssh-ed25519 /WmILg 8TKQoc9aaA99BLdq/ejYh9aSOZ3t7schbCgQ7tQRh3Q
-GOaqRdZIdtwHtpl4MmuNgj2oOXVW4U5mi6wdPxxcshLOOzFxmBoHj7sDsWW/nVWv
+ILEIUSHAPRE6vt/psFPfrunRC9UrotWrZ/RIBGk/Tzg
-02x5
+-> W-grease 9/2L _j
---- K8sQGrxU/xSSsQ7psXtaZK6XmwIaOLG/kEj+jri27XU
+XnecaYinknI47Hwwlw3iyPdULdIliiB9s8PP5kbDrJFMY/A/KHElYIe/tWkV0o2Z
-”g-ó(ÎJÜäMe3?ݼ£<C2BC>º<EFBFBD>
+HrQV+l53L+6tZ6GEs3wt6bFUM39mx+nj9lqHiM63MxKyNGDm2pZYmw
-¹Wæ#éa+’œs·„À¦÷
+--- mQ1yc2y65CJo0siCJwqqer2wkhYDVK1tbhiNfA/SNsw
+6ÞÒÇS2òÏþxõŸå½†dÑ<PUÅÀöY
+'k$®

secrets/hydra-admin-password.age

@@ -1,32 +1,31 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-FHdI55lBKPWpfa1nazpLNP2X15IQ6DxUCHHNZqjpmpUdZyV4nO+KYcaiUsrksHWm
+L1cSJCAuifjtAo8Zl314goNZN4gVXpJNcMschToZ+82lRCufU9vKAgLja3Nct9aW
-cFnlJQ6z7TGI81SR89eah+BmhfhkPJSLkgNMp62bMs+o4oLpYigYStRBpOjNj/EX
+khKy6QRVBl01ZUf3RVaN0d14ePIAwc/8pTbDlpAj37mMJhv2zqjCKqFT17SZCgJM
-J0e4Hq3YBirYyQam431/6KifuFkvxKQSeZGYMoPUqbDvNdIw/98M/QOVHfdWLzU9
+kksVMq0T4RNOhEcap7hLCghGdHggNBTHppqkVfoFClEBCwzaPdKiSLEUYowUMbrD
-F8lF8hr6JbXdB7NvTTA+dMfm9rT1RDUuVJNbNMlPAfwftP1uuQ5356JMrZ4LfwO5
++67m1voF6UzWIpBmn+PM8Hb+L04ln5tNpSFyxaC3lmBY6p/kIYSSToeJ9hTZxIS2
-tU5rGEXM90d6pG2O64iFZD5TwcAs9BQd3JFgZUsnpBVS678Jrd1TNYTYKtlCbSpc
+QwXun2THO/CGw6dgcRvgH9YZaEl4QG2kGF6cYsGW88d+lJJwFvuUiOMntYBu8F2x
-N7W7TXLlHLwrlyVhQ1jy56v3p2u1LTUxMqUZFgF0Ygi/MtoqiC3Y6N8wDB+unPDy
+EaCxxNh7yJaFbXpjEZRCILPhThIJPawNLe/ZYqbh0bAMUQbyaujHcasOED79JS6A
-nfUIifEJXOM4wcUpzZxHhruibd8MwUK+gALZSLivJvxBCJ7C2lzijCvvYh6s0R09
+vVFtp2RdF7kpxp8/rSFr309tklVnmLGCdk3K645vn62oJmNmi/RAdzC8tfjubOSW
-7gNFRlma97Km1Xx40Gjdnjr8LfZy8Ti5gd7nVMbwb9R3OQO35GfwejHdXycyuoZZ
+d1BsWpazRzJAoTff8ys5ZUXdONx5wzh9gomS5zvadYlHmm88PPL1QSFNWynbHOw0
-xHik+7ttivbF+sjlLQ3mxGKI0efAfooLdOkO4xTCZILKLMD8E4tfI2qRA2kpOf0B
+vIR9mRMUlj34cDr15UzIBsPDGBWRw1pLWHra6ReQ3M4nTIQpyuG5ql6XasSAt4wb
-4jhMmMo4dwfyfHkcQlS+hyyljXr1JHuZEA4wTfXDD48RVeIiytaAUkRBsWYKGH1V
+YArO3ZoHXT1DchNyriAfr6S3jBzebBEr1hQM26aW0zfFUSwP9jRMvfMnhYir3pfS
-FUCoD4iUKB1ERLUoe9GOoxtNxlLNyN9nIh3maBcSut8
+Ny0wp4v2QwlHOddEaKdhk47XpLSKB2ttJt4CMtUUysw
 -> ssh-rsa QHr3/A
-ndR4+Jg8KOTNQHbYTEgRQVDyPQnG31SKePhRcPONCbQGbge9Qb4DWxCxrOxW+mmR
+mdnSOUzP0BZ4/Yl0DuSGQxOqVtDnBXFiazrHVYIE5gTVeLGTQ/6pAA6c1w81lhwV
-axAZAn1xOCJPKj+O9ugVh0Wcph+ejBPX185JUdT98/gB84khZuxxIbPj70Ui+BjA
+f0Fc1VudcZuvPDWuKsLzopaqHVkhc869RTWVJd3cNM+09r3XMQXP35Ci9OWG2xqL
-GchWkcZaffpmEytdO/sf012JhgwEZvcFKYyLmLIXPV6DMNNDYZu+lHuqCTHX4nIn
+1xDFp4sHnKGAJDl7W2Q18XbOSfl17iphldrYA7w2UHBDtSjrcUNt5FY9GPfyTnh/
-9ZeqE6Jzct/12dzP/Ki7Qk/scTr4yMlg+2NU0sXvcx/pC0//ww7TNdNbeElZU+26
+Lxyz/C/XKw4oagmCSPCCieJPiBM0xF/VnFEo01bCzJM5xK8WIzeUTUlWsvm7RtSM
-177cr8DFoKh2Amrcj6Uc55LkIkRkKubSI7rP1VQe4NiJv6HrVSrUbRUz0+XRg4g/
+iwzu4fd82ki3oZcxIAnPPwq8IaDF2wVDMUve9KRTwVwj8ei//iQnuQ24xsHfYHVl
-oaCravQ/M1KEsNJLwiy3dH8/IRiy+91yTJpy/RdHHYp49N3SYjRIK+0MAn/v2DDY
+zKBS0rUTA3WvPjEGYwDRjILBk9IaGmZ2Id1K0KcaYTqlHI26mpzITJjhhq4vKqdY
-wpNqR1kqNDxTIus7olNWaJ8yV07rlBSZpqoyDlM3E7mV011jQUqHDKJCH8tQ+rfs
+lIlGEbeZAqh3/LKRyJKyUAagqTcnlzInVPR+VElWWjgR1V/krqw8yUl+vG70Pxdg
-gZve3R7RUPn0YXa83F3YRdm8bg6xHvHPKlO1URD5P1ZQHPWCPxOQ0KrH5ZzlgpNJ
+AXZCbiAkxZfJ0UIuHb/2ribZjSMryNHotMRlNVaWRPg5QOaGeZlN7jIORdJE3TK2
-wlTyHSXfqfw4c/yeHOFPfpg3HZdg52Tzyint6XqfRQD6AXbqA8L5TJBFNGpelf+6
+GXyiV5d8Ij/MzjZeKRV90G39SY2JRX4yoVcwPRNbwjjXqP8KDsGjh8TbTP68Dtm6
-P+TKpVVOuOUVzo4pZxu5KoVyHhFbvl4B+DFI/hXGELYQC4ONi5coi0h7DcCk2UtU
+ybiO7rh1MTnAd7zRG3vavky/E0vvJmUdQVU4sKzJC2Kd/BcLM0XwJA3KgQi7v5aL
-PNZV2gGtOpPrGOIeEaDC6OAuUkxYae1J04yU5Hj2pOU
+VnP2cyrYYJiJtH2A2oZg0pMLj07pzWjOEeiK+atiusE
--> ssh-ed25519 q+UPnA BdC5QON4rq3PlOFtkBAfKNojgEf2BCG/dBhSbrTZdTQ
+-> ssh-ed25519 q+UPnA 94Gwdb3vLJXqJPgZwbgWqOfi14MvNzI1Lcenmn8T2Gw
-GmQuSUjdP43NAAMte58tLaP+WHq6qiJg/72AQU4u0rE
+qinCcI4Vf0AasldKYBdwSdXIrB3aqUCTcSVesq146C8
--> c&-grease _L<OD{|. 9h?^t f;~
+-> '=Y5L-grease nA6!27L *c4}=l<? %v
-42PCNtDbN8/nXBqcFnC2rsWq1RZs69YfIAADmlOLnA/8udHwoVaaBIaxvSy4DM9v
+gE4V2aTts4Aeq09UKHuw
-At+NO79T9nFcmFceo3O4hHQ
+--- OGoNu2O4zMtlp1b1+KeaVFHTlJCEcC6bUBdAj3GF8yc
---- bgUK8r4meLjZbso6SgsYKLBM7OXBTH3id00+6mX4ui8
+"«ÖËʾ
Ñ×133â>B!•ÇE_/D€RKû-—æÉ]ƒ™»n‚
-?ê‡æe‚\jƒ~’Û¾¥/}
6/üßf´Ïû6Q<36>ÒmÒJ‰e\°…

secrets/magit-forge-github-token.age

@@ -1,34 +1,33 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-hDnwQqzQ+uptsDWja/YWKNt4qiSbrDL9ouiEnpKSYQB5Urw+DUd4al1O62gD+bJi
+cj/Iky8CB32qj1+9i6iMD9a0hEJZa6SdMAlFNYOqV2DQs3LvPCzhTQeBisLCB+Ux
-7Ubl29uTthuhvHJ8RGkL29ShbWFM44FZnV5YgLEmoa9flTTcmqyiv0wEY7R9vFdQ
+3E006kmWlk/s5QhsMZXCtUHHeaLOX/7jOGe7wSUqp57rbcf1wcfsmUNXdL25JVbH
-QlNusq6zw+ddxtYJvZMNFkbidkjt9sZ0zlX1ynPS6grV2wBnMtvHpb3Tkyn18MJW
++zIDQA0o0f8MxoZF0Gy3ddYMKXQDGQB+Y28eRe6b863ppq7tkfAIh9NUyrivP/h7
-YAFJUaD9wFU7eNWH2o9XKyE1iudtkvVg98jXOFt/m2PAAml8LmBPb9T29DR16zNt
+slGWk+lHsXwN8P5tB5Z1rX1wcWhAO/cMmnN8R3723TE8ZVu4/9XCSAbkSm7UGN3l
-yyT9Ak5DVb3YyfkXwVAk6AcUQKqTmxwNApciyLvt7zmIVJOHuOwD5lfpTpyWNTMz
+CRXcWimX03O6Pal4TPFt1EenZiWGO7ZbYn0743Y9T29GRcAgg12PfRRpPDzbathX
-pY1rrWm8yBL58tnoher+i3Jsb2eNXEW24+HP2VzJpY1UQ6/C173BvUU842P5erMZ
+zLSxoV6XYV/s/j4nkyk+YiL9lpfdZPKN1V77fipCrqMN4SLucKAix8QNdD9BwaUP
-jpy+ix9BWlDU7W7to8xPpaZ8cvqpBGpZhvqZdssIr6BGdHCQQaucEpRlrYPPiDyU
+dx1HapdMRHM5lj9EyWYPa+dSH1wbHTEPsRJuP5mVwDoLvEbeuh8dwWdGdpWiDN1x
-MyGSbZDN2cU7qAa/Si2N/yzPVQIaOwgEoLCXdHnLCL29kDoZZEdq7ymskPwY7kGf
+0elInu1AL5lzIYf9sUVA7soriv2aSVgSpmVJcwCf6OoX5clm+lwovw/Mbtb5LoOV
-Yz28fp2Oe803itZHGXsmDIFefIXTUlyfU7EE3plC5idmLMOvM68aRcRL6UXXd34W
+RD54p3NfB96ffL3+9sVG5o7gcTdoO3yEmlzfSuuVq1Ha8yXyViLYsN9uo8Ra4ZGP
-FZw+iYfETOzcyIt8VFIkYNA3BcyPCSATE6xrbV1/nMF4LvNhu4wqCrQgDjZbU8Hu
+WyNSLO9cqWIpqvf/D0wZyunosK/ffRlMggDYNgVU7TZt43iXkbnzobjQHieCY7TP
-JfLzpqobEwSMh3u3Xyut04x7hKqe1KuHDtPTa2PWgdo
+to/oiOhJxYD8PGy4ErdxYqVX4NjO9YLIunBbcUcf69o
 -> ssh-rsa QHr3/A
-dls4yMUJb4pPrPYrQvtW4LbLEVdbuSNZ2E+N58nSfIgepVq8MfX5MX+ehcIULwnQ
+PmxkiaGbBIhxCg6ZweCCoZzGln813FFNVDn87ayNDu783perZF+J/Q+jXq/fJ/mi
-uwY15/wH5I2jBCSaJwK5HJdq4lnVpTbvggsH5fvYopcKKFZE2xHo4uGabqAjen8I
+HhFxnaN1hsywh39ch5sMV2FN9g4EjsUnCy1/04yq0ioGAh76D20f6/bq/68DDZS+
-pKd3eKlASbKiyjyJAKLlmeqm2diY3FR8nnbU+/en1ZkLE0v5aX0sVh4weH3K7i1a
+KtJrMsm3a3JJ2dzdcvnTNCOHLaHzGinb1WsFMnv5rmcmGomQi4nsJ338x9Ad3WbY
-D73p9wB69FwzhLZ5yenBd0TeXne8kCR23kXz+kdAbzdzoB0/uzafn5+lwkFyS5L2
+KoeDMBhCgZCQilGLSNxtSfGU57L6ZVyRv91B06uKcPSLd/P7WnUeEBxBWiDtC03q
-o+zO1sKml2BtpjbrEXQmekhmtk39C510bO9Ra7Blah7NlrDUNxIX5DgJHKCDO/OZ
+RxDgXIed+MlfYQkSs0AZ/7eNWC5olAe5UJoItbOmdzzyKCvmvuFOyzMpO7a56aLf
-9IPoUU5MrFbAiZmo/W6RB8+USNV72KCidEZmuwzpGJhZIqpJqAeqam3MQ8aZsX7D
+zpAMggvxXFhiGalvpC7ANQp3R3kI3iyFoNCt7Ee9zIagl1ip8ydR1sA+wyyJb5oW
-wxPUh0lXUuQ/mRZWj39YQf+jhs1prKqUNTlWsMcEGp9LoUu9oIPUgfpp8jWoTnX2
+f+tVd0v1614VDg2lVCL0FqMtp4/R80lWK0PMfpLlOXjLeoS3uZ2/Ux4nRxt1Ine9
-ObX3G2UQlqqCAea36gG8XqI/fKzxF3463xyrgR6LOwdZvJEIHxJF7jYFz7GxI3OX
+4Gyz6s/7j6EeU1xFXkN4RF4YPwaV1G0qxAeE53bWuCXnTs3Ei4IXgHWqm9pCre/W
-DQ8eqLvEv+AICLujlfgkpKa8XOQTdyWAdUNYBVsJe0ktKKud22/ZIdIF5By0Goll
+Y7TDkepumvzJUGMTwYyoN7Tss6lDhojcEZqbna0M7NcC3uTqjy6a9rMWmtKWCV2w
-zs91Z2KfFOb4AcPiclxEYBvDMDtpS7FPlWTZ369UI6pZ/21/XQlWZnqTzY7fw7mx
+Fpc0DzHA/gn40CrKGW7PKMPCkT9nGHmpCMxCO8L4UAbd3EZKwnGbkupeEUD4Ovps
-Ja0lB5rg423xcDPJ6EwGDR//nGQaAPseTHDlZOI9Yrg
+gOsEG7ZFK2tBYWkb5hKHAHsShp852MET+uloCJO38kI
--> ssh-ed25519 q+UPnA 65lL377SASnqr9+zRJStGaT9pR3KBXsfd5JqBFDYXEE
+-> ssh-ed25519 q+UPnA zlWIiF2CJCTMAI6i3JAiDZcIXYoXFCD4b6tOmutD8w0
-1k2wrNfKuyN5ftCZK43ryAEMZ7w7r4O4HX/oePySEHs
+jcWTGOHZqQYS40AHc52HHvOtRGRTM+fAJ1e7KczM+3s
--> ssh-ed25519 GVMLQg dEQCA/OH1bdlxy291HF/9fssVfbhpB16SNhGbHo1hBQ
+-> ssh-ed25519 GVMLQg oSGbFsJIvpXFhNGOE8vJ82HafTIFm+3FKUqbqyBDMEU
-OZRec4iya52T4Mgrf/ohjG21+GqEqV6TjrbqhLi0sVM
+0J86gnb2g094MM6DPP6LbxnsW5yyKuIS8q1euB5iFJo
--> 4S5C5-grease
+-> E%*-grease q)+8FfM
-ifXfPk9kYuYEwTnwymgBYPrk290Ybh83sDp/uRYwYY1zEkFrPMsrXsYB0Y5X2v1J
+zM8yh+Aepwaehxiw78d+p0IAnbi+CPOjJCzbgKwCs9jP2cls1+4B
-dzwsfcAkIJdkf9+zL0aq5FHh
+--- BFu9OhpbWLGTX9QNTetLEpQcaJkgXa9OCrLIUNuURHg
---- t3eNoQ23LPk/vfksvAl3mzWvheBBEUf6JajlySyVZ1Y
+±ÍӬƇ´·Œ_òEð"ºÔ2òªñaR”4mÙjkXxAFÕU:ô`‰è™±)#¤o³
ߊyú$æÒ÷à{çõpÈ>¼n 
-A<13>2X词z<E8AF8D>痻.P*錆R荫gzT\^躋~*(矴璤熚 墓瓏<E5A293>a<EFBFBD>)襩禹楙╠7B輕醫:崋鶘d<E9B698>

secrets/minio-credentials.age

@@ -1,31 +1,31 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-oqBMmNmDeWMJrfn2OpLmKGEPtwTq7G//cBtz1SwLYZ5ziJnjnRv4MsKSdkzmKqXI
+akRJLZBpnYKOJS89dkx6Mk9IdkmaVmqzOMNWfBCubl7okR7H4RfQG3k7CSaSqmCK
-4/FYxOJVx4dTa1nrZVcPlGhxDwqpU4ujW7GI5d0ppdrEkY1c+pdfY9zACp3qlu7Z
+5FRCqiRbZoCBjVIFERFfDjJ8YvPqhRC6rH+50838J7n4A7VsHpFfmazRQWGw4J6h
-4ZoUMVnTt2Kd16GusjvN4V3+sbIGRmsLAxMxg2T9cF4cLOPoGyuAEdkdckPGnvy6
+IbN7a1ae1yOnm5wBM67ulUyzuDAD4Sc8XNRAaEjrmKEjfVJl1uJA1u3lRBNO61eG
-7nqNqFdcclbTuokc7euq3rw0ra88Pvv9Xk/jvj1BR8A1JEU3/lTSbBINt5A601km
+4EKd4BgvkeTNZQsurdeqkdhZf2XuKxJhAgzQPev03uDQmKCv/JiBFztgTJt5IFsd
-pvDUh4Ak83sFJ0U2B3C3hMWgP6hQ9YCfEjEVKi5nrm5q0q3vZ1wamvMLd93qqPIx
+4XcBhUyf8Cxd5R7OnCkzJPikWrWEc+G8Tpqr4WTA2M5QIShOYYA+rtdmw9lHakJG
-1MGeAmvfrL0QjhF33/tcuZk1cOjQToKmKh8v+0EGVcZ883QImJMWBk+42nQW+dCh
+ANbH1s6ojk5uXhG/l7J7gD0RNscCxJZplOFUZmoIbBr43HHT82FLN/wHlOW9Xbla
-hcAhZWIu5gbEGybnvUhyMgym+qMzp80Lgpc6v+1Ylrkyjp0qwzOyOGxKTZxN1xf+
+TjaQb5shwG7LlX31uKpe98je/jekXUzhnBPH62y/2clx4WbduT1q5QIQqdqXzTbE
-PVawONSr+eL2UFD9bYB0jhdnNYKghaUIHLOc13yTKeM72OIwab5z0hIyKuqNL2ru
+5ZfsAKsywPY0gHFROUXR3IUDudVBpuPiYzlwIyhoatNwkSgXBd/xT50hQJ8ZJFvy
-yCYj22XJCs6pgSmCYDcVrnn1qpWhQl9t7emnAckPauqkVtTw70/owx3WP1Ut1SaO
+Rfg9olUC1S3cqj3HjGxael1fheGKJ5Mma6nshKLkOqskMrihnoUY6s6z8pKmxKU0
-58x/ZSj73aDa5TNmBMNbpGm48WDn6xTI6sAi1fpQDgzIEFvmmJMf09vYoZbZiNf9
+1TszvrVUu310mcUKnZD9rHWzUkvSLSP4BO100Yo0vkyByMYUZebW8u7A+1pY0V6u
-u7ZPndNA36PIDgjMsVaIQW3lcKq1etEwDVAlIqofUjc
+9JYI8X0uEWbdnt2VyDTKULu1wfhJWiNzkn328vUfyWY
 -> ssh-rsa QHr3/A
-t2d2CHMfa/Q6NMd8vvT+s8+O3zEhWjLPW0K0tnOUv+E8SK4TU2S0Jyj+uYSVDtED
+Id8/pMuEM3XYK3K/EjFNm/uoOMegVk8Jszq2vkBJkGcBP+RazAu09KOvAN05dogu
-UR41J8bYuLAJ2Yrm/rj7hFZNUY4Sa4B1raZtHAF+G7wkIQNNoDH2IjZegzphIper
+6NyhcpS+mdFQpLVypg9oRo1wPfi57+xdxVx5Fe5wiz3HZJKgNgnwmr6Kw5c7L33Y
-/zoqpHDw/5mIJ9h2roZAfUyVtY1mVeGzDWJZ30/8+AlQkHaT9NlcYLA507LowDaV
+7SWcALwPa136naVRjIXdSZeLy5V2V3KAegGfQ+o2AZ43wAkKOYZcSxr8C6lmDbxV
-qZOG9HVtJEVaeBgJE0RdJ9NgtmdMXMJi4XAeKY2IXKcyEXdznmGaMqaqymNDm3Bg
+7Ar3U4f2A8/e4v/DOT2Is02e5aEjShshLLXHDSBYUWk32IosMHhcTR+mOiNHVmwD
-v6D5fCN2CQiCahhHTj2jFL0iHfojsY1O4U+rpfHRVSsRG1gfbdUCMJ26yz5g4k1y
+B5JYVKX4o4MBwZB1NO2ttXo7masF8WDyKNitMRd3UmqAhD6MyR/6vZLSXpX445Nl
-DUlcTl45P29d4EWzpqHCGyjQQeWRrL+Nizz6HnxutH86zKgs+V7+ehrqNL0+H+63
+pBVYZC3kJa0XjUTeXFAXYi1wOSVeiLMv49sgY8Rj4QiyAF5MmD2Okqo9NiB/n5QT
-VYg3NOgTxvyvNd8lWf2yH2kuIY1G5wc1k0ZTWJ8HgAhlScU/qVQSjd+43TwGXu9R
+i2NlVmmH5hEdgc2kMfwSul2pfx/RJ7pDjyZKcgcKPS0UfJPsNcUZ2knmNaKDS5N2
-tTsOfFoBkGT60F8XJe/LJe5UQ1eaJMF0B4ZDFWMYG90TrsGCvYYqTKCDCa5NWIeO
+jCNcLPtYI7S1hPaWyBzcug+WmJ1Sa9t2XFSZ6XUioXhlupb+dN9D07nUZSMXhYNh
-JXze0PNFIviAR3eWFTkKtNn+MeNGNaF+SkupDkfAiXbWXvHoOw6x+ieAFyOgYFrb
+zrxwfQhTreIo1JIVfhT4TtobQO3egOpqwRLqYQ89mx9w4fF5log9KBG6dUbp/F11
-APV0OOL8S5rBvgeemmr2OsxXoJShbZTFIEdkfJQSCwGkmKTuupI6JfEf0bjSsk8d
+wkZwF+m+ETeWIE7NJNIXllkCT3KwDWRtXHEd/xuGnXMfXkbj3icLfWA3tLvmn8IH
-EmsYABmV1kk9ihrxE3Du+f1NS24/wFlCPy+ihsji5Ao
+0+gFnJUWQsR1w2JGDYuM2FoJIrkWx1uUPgx8uIrt420
--> ssh-ed25519 q+UPnA wWMw2+bnm7/W3N4fAzk9uOky+5eNO1vd+6FcfCMdEg0
+-> ssh-ed25519 q+UPnA LpPQyr5i+emmN3Y14C0my6COJSFYxfwLJ/sVN3WtVV8
-cXGMteYw2Z8ZHCger/MgkC9Y1fShkftAx64Tt+wf3Kk
+UY8DH5UXXAMTl6oqAo29Y9ByCzmWhaOOIgaAgeKUSIQ
--> b<h1w8h*-grease B?2
+-> /|$)Y3-grease fjTe K[M4l87/ jwCK%DK: fQb*`.Y
-+VfNymUiwE6KSEVipg44lBSLPQtFu1Pe+uV+x4UMGmEx
+MtqTRCytB3fFDuj4iSvoDeB5DVc8
---- JYZ8HuDQpdU0u0T4zXYFR/1uKom1bkRAlEoFyniHLtM
+--- jZ9P7IQqQ+Co2y7+ngM2OnWRLBOSZlTsWc0XCLkM93s
-ĚÓ=‹ťGBřVˇifÇ}qśloU;Ý#ňmšX<6·ó‹Żhż_÷9G’Ű9ŮR'Ě°‘ţďxaĄ2㊥FNÔ˙ĺHĹ
ac«ÖťLňzš4ąC
+<EFBFBD>ÏêºP^WªÍ:7EËÔP¹·¨gj[èp‘È¿vÕU´.Ô]˜âX¼Œ5`Š”¶Š¶|Æ'qVtô<74>‰J$Æ5”H§^zn±PXÏ°$ò6¬WŸb

secrets/nextcloud-admin-pass.age

@@ -1,31 +1,32 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-oydkeCda2TCzArA5zfB1J29tsofcd9x180RkMUzYC8hvH52JiIgI6230AdUA39sT
+aJuyARF6DxtmBwrVRygnBESG3lowiWgxt4Fuk2EjngnQGEfPF/VwIzg8Cht6Q2CP
-FNTGQCOHl8Y05TfHmSWGXtw3UwCP/kPpR6M2zdH2pjVHTJzRfepPQg095rWdYP0G
+BUnofodxysQ7gfe1Sw89ta5DBrLwFwIZz5LUPekdem4YMJ2wf4FRzJyQiKW6Vd8n
-NINxappjAOyVMMjwt7urI2phNq9SLBTc3bbBdE816ccvchUg1VXc0E4WkZaRNyjp
+o7GO/eOxo8PJhJ3qVKTw7ZgE10phhQmeEsFFFv61blR5KRPEsmFQidMKZ7ip0EMM
-1oeVn/gR8yUEbxHRs3EiXsJ00YYe3X7BwYf263eudpup0tHb6dSWJSRNFFxntJbA
+cY0P04epT0EsbEfaqnkHro3i/VDFCwM8Htk+GejoUNOG+Q0Qq1LlDxDrXrBU8pTc
-JvNX6gZPe3WnRtudktE98lvw2exnKm8u9geeJ825QAESQA8HZ309kAS5NYvhZdSS
+2gODuVIiHDMOI1zYHA8rEGCa3kiGejqpIUiPkAAiy9fDGdX7fFLQa44TzGsc+Voy
-vX/RR13b0511blAic53GyUeEWUUB3fA8Qdo3GIc+omTZ5qSplKAsjjBfyAmD2RuY
+X2Vd2IbR4j5p/3cYmN/ouSr1DmWzb+lVR/OQrSsActiYjRFcHXMoveUVEOY3MOKz
-ov/vivyc/CoEQtjFtDmvLWI19NFDO72AzAxUrPmmblI0lM2022muG8BQoy35BQTa
+qCZRljzMxPXB/n9zv+cXS2R7FwZv453/uvT/vwuIofGEHEjse6aTZwkfly652qg7
-zyqmgBrKfASw/e0detceNPeEcgWJvQr0sSNakFVwoqEUk4W9YYz3NS3iyhDQyGVw
+jd2Xr5y1KRZxXfCfN7XRdcsOyBBWiWbZzn8vI4UGEN77BMAmEu+WkDh2VjMRyvmU
-kNw/0UytDYokhk3RnE+Z+xFzMQUJCS1K4NAO8cMrMwM4NmTUlNxPbGdHUJD4tvpC
+aGKm3DrzlpUdfTUXizGTEGBHzRXD7ebLVfXHBEZeu8ATwyMfUtkDKB3hFdjCcmuH
-mcjEUncrl7pJBJ+7AZ+64tC3GNQM72wp9vPENzw+seArgIR8yL6m9nFVWSfPYfqz
+Wy7RbtHqfoPBFDdZPQFXxZsBfyH+8M5ZhNBTX9ZbCNVeAOvTnZEO8+67oAMuJdrF
-+TxF0Gr1x/nOET4jdlbUAbip5flwWaJYigcJbAaIrxA
+nppcIsQl2rM43JwiIVeacq4+G6MvFQp59f7VeDnDzLQ
 -> ssh-rsa QHr3/A
-TeumQg/mKgPxyGp3J9QnV4yQQxdkf/scau3bmOJafGJElT58uQnYDIZafwcO14Ix
+MObBANiTnRF8tImMqgHPxLBubBOJ7w5109T2aU5etYM79CKuIFrTYhHTOZbaTuMp
-vvVPvnkTH+yXJdysm6oNfBzr6cV9e/I5FDBwFl7Q+z1GkZ2f11CgszdLpDVOBTux
+r42OkhEohJlWTPY4/122SQDdYfUjHUmCQe8QJRKJEPjWVHxFOHxA0F/WxM3p4560
-tc158KJdSKANSGgJ8pikP4gnLadYxewmVfVC5zCx2xuSY7SNUZ3STixbZuF/eRJ5
+2zWZ/BHNm78of1kvQ+KF7TJF/TYHS3qkljWqhVLEZLMG3D9qX7yQ75yNarevEcyx
-rfYQilYGsH3empx7PQ2rbS4LQiKFu9w2H0FHmtOhzaVMf6bmmnB6IZ2SOEhqUvdc
+FsR8IBIxxKpyl0ZCy/elzmV28CYVBliCqfNdXQ4MZiU3AA6uMJ3YjvJ7SUAqXB2Y
-y2HTja9rxmAllnCkbWijPJT/xfuD02txbkAgl8Tg9VmiwuUKV/QxQMvsadZGcdQw
+ZtZYGpBDtMElbTSCFZ669zfqX/1Uz9uMLgvAdFS36bO6oOYnk9U3MK7tmnUdXKlU
-eEJ7MrcD9CO8EXc+SSnImtvWS9m4v+QEPcNBl3Rs01Yhu4LrLoXlgE/ZCNsWMZAx
+ZzbfWGkAjRRJ+DmICgo1GTbXoQAKmfjaKIeLZbxS3YS8rIhWkbraeJG6nFGj2LL4
-3b3qPn69mLjGfUqn3lmUDiRNfVV6uD/K8SRUUOK7q7x5cTCygs1XWS2xUCkGV91U
+bwR6iOiwH9tdchy3lJGC3T7ARCEnddh6THTBpJP/3RDroY+9EvV56/O+dbnEtxa1
-2F9dHHNQRQ7FB9QzuVADRCTeX5Qj54GQbVddsduJFH6moYiTo3TpNkWlg9Z2FPoa
+4EyotXitgkuE/iDSIiLpYGEVIC3ENWqjYBdaob3KbZDUp31VJkKprwpBxJz/NWCy
-oRSgsJ5as25oRp7MZyrbPJIiIXZ/yVXI5MzKmxkVNlwQtQYnc618F4v3n9P24DdR
+EMYU3pR3rBAFWZstQigKY6pPoQjBO8IYS1eoAsBNS7KsPBbD7PhMA8OZmjsL63R8
-uRNKnYmVgSbexgoXjuhE9ZpGpU9BCZm9UUP323XanWCWGQRbZpPxGvZ+lZgtTtqd
+5ONMUBai05Jda2jLAF5bww6GT7IjHq46zxkermjcr+uP2EaZVhRMIYnisxoolzbZ
-YikOEj69pw78fP4gOCrIO6pPsvsfgiAfA7ce5LjLNVg
+LCUY/EUmM5Qkdd9dJYg47UUQDHRd/okSUqAuGjoZCvw
--> ssh-ed25519 OgJHCw AasGFP6CTch//oLhqphGiR+13XRzDI9BsNp5F2mUCwc
+-> ssh-ed25519 OgJHCw lFJ/N1ngRnQoRik7R/cgYu9TLAw1dsCL7DZWlVVRGw0
-pu6jS6b+vwhuwlOdMmykX6F+vt0lHr8GG3gZwR86VrQ
+TsxsqnBliw9DcQKuzhz7dnsSSg3uaFgNYxntzdKJMto
--> 4-grease Z}-t\"i "1{0; %4XUV{ yuP}3'
+-> qRf-grease
-H6qmbf6GvJiy6JNC6zMTzZI+9t8DktDsGKo
+jJ10w3tHtFHX5MNZUPKdULgUx8hBr5Piiw3ZSHJg1C3Ghrjsq+1O2CRFt6yfiCJO
---- +Gz7VBCIWqSGLtGcRd4LUzE18v5eFapd4wJtIWDqtqk
+YexR7ZU9
-öñÑg5ä1®y¯ú~ÑÎÈl¨(Ô·ÈŸ†”$ÄÊ<C384>¢a</91
+--- V6P2RwkyRhs+kIs+5RvfgvqcTbmTpqP0jB6KmVvXE7c
+)RºÚ‡,ÒOÖ‡’œ*”•‹º<E280B9>uÕòä ‚ŸíK+QE}<1F>Ô¸È+å!

shell/default.nix

@@ -15,6 +15,7 @@
         disko
         deploy
         colmena
+        nixos-anywhere
       ];
       shellHook = ''
         export RULES="$(git rev-parse --show-toplevel)/secrets/default.nix";