Refactor Wireguard to make it use sisko as server

2023-12-13 13:55:27 +01:00 · 2023-12-13 13:55:27 +01:00 · f05c12545a
commit f05c12545a
parent 0d3c1aae46
29 changed files with 430 additions and 418 deletions
--- a/hosts/default.nix
+++ b/hosts/default.nix
@ -7,99 +7,117 @@
 }: {
  imports = [./module.nix];
-  fleet.hosts = {
+  fleet = {
-    # thinkpad = {
+    hosts = {
-    #   extraModules = with inputs; [
+      # thinkpad = {
-    #     nixosHardware.nixosModules.lenovo-thinkpad-x1-7th-gen
+      #   extraModules = with inputs; [
-    # 	buildbot-nix.nixosModules.buildbot-master
+      #     nixosHardware.nixosModules.lenovo-thinkpad-x1-7th-gen
-    # 	buildbot-nix.nixosModules.buildbot-worker
+      # 	buildbot-nix.nixosModules.buildbot-master
-    #   ];
+      # 	buildbot-nix.nixosModules.buildbot-worker
-    #   extraHmModules = with inputs; [
+      #   ];
-    #     ccrEmacs.hmModules.default
+      #   extraHmModules = with inputs; [
-    #     {
+      #     ccrEmacs.hmModules.default
-    #         # TODO: remove after https://github.com/nix-community/home-manager/pull/3811
+      #     {
-    #       imports = let
+      #         # TODO: remove after https://github.com/nix-community/home-manager/pull/3811
-    #         hmModules = "${inputs.homeManagerGitWorkspace}/modules";
+      #       imports = let
-    #       in [
+      #         hmModules = "${inputs.homeManagerGitWorkspace}/modules";
-    #         "${hmModules}/services/git-workspace.nix"
+      #       in [
-    #       ];
+      #         "${hmModules}/services/git-workspace.nix"
-    #     }
+      #       ];
-    #   ];
+      #     }
-    #   overlays = [inputs.nil.overlays.default];
+      #   ];
-    #   secrets = {
+      #   overlays = [inputs.nil.overlays.default];
-    #     "thinkpad-wireguard-private-key" = {};
+      #   secrets = {
-    #     "cachix-personal-token".owner = "ccr";
+      #     "thinkpad-wireguard-private-key" = {};
-    #     "autistici-password".owner = "ccr";
+      #     "cachix-personal-token".owner = "ccr";
-    #     "git-workspace-tokens".owner = "ccr";
+      #     "autistici-password".owner = "ccr";
-    #     "chatgpt-token".owner = "ccr";
+      #     "git-workspace-tokens".owner = "ccr";
-    #   };
+      #     "chatgpt-token".owner = "ccr";
-    # };
+      #   };
-    # rock5b = {
+      # };
-    #   system = "aarch64-linux";
+      # rock5b = {
-    #   extraModules = with inputs; [
+      #   system = "aarch64-linux";
-    #     disko.nixosModules.disko
+      #   extraModules = with inputs; [
-    #     rock5b.nixosModules.default
+      #     disko.nixosModules.disko
-    #   ];
+      #     rock5b.nixosModules.default
-    #   secrets = {
+      #   ];
-    #     "rock5b-wireguard-private-key" = {};
+      #   secrets = {
-    #     "hercules-ci-join-token".owner = "hercules-ci-agent";
+      #     "rock5b-wireguard-private-key" = {};
-    #     "hercules-ci-binary-caches".owner = "hercules-ci-agent";
+      #     "hercules-ci-join-token".owner = "hercules-ci-agent";
-    #     "cachix-personal-token".owner = "ccr";
+      #     "hercules-ci-binary-caches".owner = "hercules-ci-agent";
-    #     "home-planimetry".owner = "hass";
+      #     "cachix-personal-token".owner = "ccr";
-    # 	"cloudflare-dyndns-api-token" = {};
+      #     "home-planimetry".owner = "hass";
-    #       # "nextcloud-admin-pass".owner = "nextcloud";
+      # 	"cloudflare-dyndns-api-token" = {};
-    #       # "aws-credentials" = {};
+      #       # "nextcloud-admin-pass".owner = "nextcloud";
-    #   };
+      #       # "aws-credentials" = {};
-    #   colmena.deployment.buildOnTarget = true;
+      #   };
-    # };
+      #   colmena.deployment.buildOnTarget = true;
-    # pbp = {
+      # };
-    #   system = "aarch64-linux";
+      # pbp = {
-    #   extraModules = with inputs; [
+      #   system = "aarch64-linux";
-    #     nixosHardware.nixosModules.pine64-pinebook-pro
+      #   extraModules = with inputs; [
-    #     disko.nixosModules.disko
+      #     nixosHardware.nixosModules.pine64-pinebook-pro
-    #   ];
+      #     disko.nixosModules.disko
-    #   extraHmModules = [
+      #   ];
-    #     inputs.ccrEmacs.hmModules.default
+      #   extraHmModules = [
-    #   ];
+      #     inputs.ccrEmacs.hmModules.default
-    #   secrets = {
+      #   ];
-    #     "pbp-wireguard-private-key" = {};
+      #   secrets = {
-    #     "cachix-personal-token".owner = "ccr";
+      #     "pbp-wireguard-private-key" = {};
-    #     "chatgpt-token".owner = "ccr";
+      #     "cachix-personal-token".owner = "ccr";
-    #   };
+      #     "chatgpt-token".owner = "ccr";
-    # };
+      #   };
      # };
-    picard = {
+      picard = {
-      extraModules = [
+        vpn = {
-        inputs.disko.nixosModules.disko
+          ip = "10.100.0.2";
-      ];
+          publicKey = "O9V2PI7+vZm7gGn3f9SaTsJbVe9urf/jZkdXFz/mjVU=";
-      extraHmModules = [
+        };
-        inputs.ccrEmacs.hmModules.default
+        extraModules = [
-        "${inputs.homeManagerGitWorkspace}/modules/services/git-workspace.nix"
+          inputs.disko.nixosModules.disko
-      ];
+        ];
-      secrets = {
+        extraHmModules = [
-        "chatgpt-token".owner = "ccr";
+          inputs.ccrEmacs.hmModules.default
-        "cachix-personal-token".owner = "ccr";
+          "${inputs.homeManagerGitWorkspace}/modules/services/git-workspace.nix"
-        "hercules-ci-join-token".owner = "hercules-ci-agent";
+        ];
-        "hercules-ci-binary-caches".owner = "hercules-ci-agent";
+        secrets = {
-        "hercules-ci-secrets-json".owner = "hercules-ci-agent";
+          "picard-wireguard-private-key" = {};
-        "git-workspace-tokens".owner = "ccr";
+          "chatgpt-token".owner = "ccr";
          "cachix-personal-token".owner = "ccr";
          "hercules-ci-join-token".owner = "hercules-ci-agent";
          "hercules-ci-binary-caches".owner = "hercules-ci-agent";
          "hercules-ci-secrets-json".owner = "hercules-ci-agent";
          "git-workspace-tokens".owner = "ccr";
        };
      };
      sisko = {
        system = "aarch64-linux";
        vpn = {
          ip = "10.100.0.1";
          publicKey = "bc5giljukT1+ChbbyTLdOfejfR3c8RZ4XoXmQM54nTY=";
        };
        extraModules = with inputs; [
          disko.nixosModules.disko
          rock5b.nixosModules.default
        ];
        secrets = {
          "sisko-wireguard-private-key" = {};
          "hercules-ci-join-token".owner = "hercules-ci-agent";
          "hercules-ci-binary-caches".owner = "hercules-ci-agent";
          "hercules-ci-secrets-json".owner = "hercules-ci-agent";
          "cachix-personal-token".owner = "ccr";
          "home-planimetry".owner = "hass";
          "cloudflare-dyndns-api-token" = {};
        };
      };
    };
-    sisko = {
+    vpnExtra = {
-      system = "aarch64-linux";
+      oneplus6t = {
-      extraModules = with inputs; [
+        ip = "10.100.0.4";
-        disko.nixosModules.disko
+        publicKey = "O6/tKaA8Hs7OEqi15hV4RwviR6vyCTMYv6ZlhsI+tnI=";
        rock5b.nixosModules.default
      ];
      secrets = {
        "sisko-wireguard-private-key" = {};
        "hercules-ci-join-token".owner = "hercules-ci-agent";
        "hercules-ci-binary-caches".owner = "hercules-ci-agent";
        "hercules-ci-secrets-json".owner = "hercules-ci-agent";
        "cachix-personal-token".owner = "ccr";
        "home-planimetry".owner = "hass";
        "cloudflare-dyndns-api-token" = {};
      };
    };
  };
--- a/hosts/module.nix
+++ b/hosts/module.nix
@ -8,7 +8,9 @@
  config,
  inputs,
  ...
-}: {
+}: let
  cfg = config.fleet;
 in {
  options.fleet = {
    hosts = lib.mkOption {
      description = "Host configuration";
@ -24,6 +26,16 @@
            type = lib.types.str;
            default = "x86_64-linux";
          };
          vpn = {
            ip = lib.mkOption {
              description = "Wireguard VPN ip";
              type = lib.types.str;
            };
            publicKey = lib.mkOption {
              description = "Wireguard public key";
              type = lib.types.str;
            };
          };
          secrets = lib.mkOption {
            description = "List of secrets names in the `secrets` folder";
            type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
@ -84,10 +96,25 @@
          [
            nur.overlay
          ]
-          ++ config.fleet.overlays;
+          ++ cfg.overlays;
      }));
      default = {};
    };
    vpnExtra = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          ip = lib.mkOption {
            description = "Wireguard VPN ip";
            type = lib.types.str;
          };
          publicKey = lib.mkOption {
            description = "Wireguard public key";
            type = lib.types.str;
          };
        };
      });
      default = {};
    };
    _mkNixosConfiguration = lib.mkOption {
      description = "Function returning a proper NixOS configuration";
      type = lib.types.functionTo (lib.types.functionTo lib.types.attrs); # TODO improve this type
@ -100,12 +127,6 @@
              ({lib, ...}: {
                networking.hostName = lib.mkForce hostname;
                nixpkgs.overlays = config.overlays;
                networking.hosts =
                  lib.mapAttrs' (hostname: ip: {
                    name = ip;
                    value = ["${hostname}.fleet"];
                  })
                  (import "${self}/lib").ips;
              })
              "${self.outPath}/hosts/${hostname}"
            ]
@ -156,6 +177,7 @@
            fleetModules = builtins.map (moduleName: "${self.outPath}/modules/${moduleName}");
            fleetHmModules = builtins.map (moduleName: "${self.outPath}/hmModules/${moduleName}");
            fleetFlake = self;
            vpn = cfg.vpnExtra // (lib.mapAttrs (_: host: host.vpn) cfg.hosts);
          };
        };
    };
--- a/hosts/picard/default.nix
+++ b/hosts/picard/default.nix
@ -27,6 +27,7 @@
      "hercules-ci"
      "printing"
      "pam"
      "wireguard-client"
    ]
    ++ [
      ./disko.nix
--- a/hosts/sisko/default.nix
+++ b/hosts/sisko/default.nix
@ -8,7 +8,7 @@
      "common"
      "ssh"
      "ccr"
-      "wireguard-client"
+      "wireguard-server"
      # "minidlna"
      "mediatomb"
      "transmission"
--- a/lib/default.nix
+++ b/lib/default.nix
@ -14,12 +14,4 @@
      picard = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ1+1z1IsLVJ6aGarMgzw3NbmFKcpYVgdUjl7xDsewxT";
    };
  };
  ips = {
    mothership = "10.100.0.1";
    thinkpad = "10.100.0.2";
    oneplus6t = "10.100.0.3";
    sisko = "10.100.0.4";
    pbp = "10.100.0.5";
    babbo = "10.100.0.6";
  };
 }
--- a/modules/cloudflare-dyndns/default.nix
+++ b/modules/cloudflare-dyndns/default.nix
@ -9,7 +9,7 @@
      "torrent.aciceri.dev"
      "search.aciceri.dev"
      "invidious.aciceri.dev"
-      "wireguard.aciceri.dev"
+      "vpn.aciceri.dev"
    ];
    apiTokenFile = config.age.secrets.cloudflare-dyndns-api-token.path;
  };
--- a/modules/wireguard-client/default.nix
+++ b/modules/wireguard-client/default.nix
@ -1,27 +1,26 @@
 {
  config,
-  fleetFlake,
+  vpn,
  ...
 }: {
-  networking.firewall = {
+  imports = [../wireguard-common];
    allowedUDPPorts = [51820];
  };
  networking.firewall.trustedInterfaces = ["wg0"];
  networking.wireguard.interfaces = {
    wg0 = {
      ips = ["${(import "${fleetFlake}/lib").ips."${config.networking.hostName}"}/32"];
      listenPort = 51820;
-      privateKeyFile = config.age.secrets."${config.networking.hostName}-wireguard-private-key".path;
+  networking.wireguard.interfaces.wg0 = {
-
+    ips = ["${vpn.${config.networking.hostName}.ip}/32"];
-      peers = [
+    # TODO having two peers like this a good idea? (they are the same host)
-        {
+    peers = [
-          publicKey = "O9V2PI7+vZm7gGn3f9SaTsJbVe9urf/jZkdXFz/mjVU=";
+      {
-          allowedIPs = ["10.100.0.0/24"];
+        publicKey = vpn.sisko.publicKey; # FIXME hardcoding `sisko` here
-          endpoint = "mothership.aciceri.dev:51820";
+        allowedIPs = ["10.100.0.0/24"];
-          persistentKeepalive = 25;
+        endpoint = "vpn.aciceri.dev:51820";
-        }
+        persistentKeepalive = 25;
-      ];
+      }
-    };
+      {
        publicKey = vpn.sisko.publicKey; # FIXME hardcoding `sisko` here
        allowedIPs = ["10.100.0.0/24"];
        endpoint = "10.1.1.2:51820";
        persistentKeepalive = 25;
      }
    ];
  };
 }
--- a/modules/wireguard-common/default.nix
+++ b/modules/wireguard-common/default.nix
@ -0,0 +1,21 @@
 {config, ...}: {
  networking.firewall.interfaces.wg0 = {
    allowedUDPPortRanges = [
      {
        from = 0;
        to = 65535;
      }
    ];
    allowedTCPPortRanges = [
      {
        from = 0;
        to = 65535;
      }
    ];
  };
  networking.wireguard.interfaces.wg0 = {
    privateKeyFile = config.age.secrets."${config.networking.hostName}-wireguard-private-key".path;
    listenPort = 51820;
  };
 }
--- a/modules/wireguard-server/default.nix
+++ b/modules/wireguard-server/default.nix
@ -1,61 +1,22 @@
 {
  pkgs,
  config,
  fleetFlake,
  lib,
  vpn,
  ...
 }: {
  imports = [../wireguard-common];
  networking.nat.enable = true;
  networking.nat.externalInterface = "enp5s0"; # mothership network interface, shouldn't be hardcoded here
  networking.nat.internalInterfaces = ["wg0"];
  networking.firewall = {
    allowedUDPPorts = [51820];
    interfaces.wg0 = {
      allowedUDPPortRanges = [
        {
          from = 0;
          to = 65535;
        }
      ];
      allowedTCPPortRanges = [
        {
          from = 0;
          to = 65535;
        }
      ];
    };
  };
-  networking.wireguard.interfaces = {
+  networking.firewall.allowedUDPPorts = [config.networking.wireguard.interfaces.wg0.listenPort]; # FIXME move this to wireguard-server
    wg0 = {
      ips = ["10.100.0.1/24"];
-      listenPort = 51820;
+  networking.wireguard.interfaces.wg0 = {
-
+    ips = ["${vpn.${config.networking.hostName}.ip}/24"];
-      postSetup = ''
+    peers =
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+      lib.mapAttrsToList (hostname: vpnConfig: {
-      '';
+        publicKey = vpnConfig.publicKey;
-
+        allowedIPs = ["${vpnConfig.ip}/32"];
-      postShutdown = ''
+      })
-        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+      vpn;
      '';
      privateKeyFile = config.age.secrets."${config.networking.hostName}-wireguard-private-key".path;
      peers = let
        publicKeys = {
          thinkpad = "g8wId6Rl0olRFRtAnQ046ihPRYFCtMxOJ+/Z9ARwIxI=";
          oneplus6t = "O6/tKaA8Hs7OEqi15hV4RwviR6vyCTMYv6ZlhsI+tnI=";
          rock5b = "bc5giljukT1+ChbbyTLdOfejfR3c8RZ4XoXmQM54nTY=";
          pbp = "jvfAfQ2ykBndpnoLQTBJzDOhpjMOtIyCufEw+BxMxSc=";
          babbo = "mb1BsvGurWVA6s3uXP1hdEi3YPpzM0vtXD/7Vfsw2HI=";
        };
        mkPeer = hostname: {
          publicKey = publicKeys."${hostname}";
          allowedIPs = ["${(import "${fleetFlake}/lib").ips."${hostname}"}/32"];
        };
      in
        builtins.map mkPeer (lib.mapAttrsToList (hostname: _: hostname) publicKeys);
    };
  };
 }
--- a/secrets/autistici-password.age
+++ b/secrets/autistici-password.age
@ -1,32 +1,32 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-YsoaL7f0r0WgKsEt5ccj7Jy9MpSm7rdC9WnQeP5PP4kEk/C45mT8xLPw802v7Hlj
+hSjManBdQDw/fGMby9/jrAdcLt7YbFrW9aeVRzaGH6LvZRU0nL04NGoDoKI0ARcC
-oWOhCJ3YsHAhEqKzpwBXr6LKSBhJXAs8eCbjy6cfhbTPati26NyD9BUjC4UaRHa8
+PVLn5EyLxmjMx11Dr5eRlz6FiWQ+qSt6H748bMcGhAQPl9zYQIwB2Nk9uuuB3FFZ
-7RUPfuIOt59YJo4ydDNET0y0+e1HJlEo7Xk5BI4SAkkrVMjizi1KPaqNMD40VvVy
+Hw3EJpshnIr5NmegMZADHWEY7R2wxKZm0R/eCBd6fGfc/pLTBN/ougkARcKCjcfh
-NsHmn9ddGPLCFQWbqBVXkugU0d8e8Zz08tdOG/JteQ/Ku8X5p5zBz83fNqLFIAXQ
+MmFt/jt3PkBGozy5Q2TEkuxqQHOJFED+DhZ7qQMHF3vbG3jZjkrKbVACE7cWhscZ
-kWrtaoFG4qqzKws97khOC2sg8CiqjLX08iuuqWXMuiNITtPVLSdbhE6/u4KcXoEv
+hSNNomlYgAM1yuvoN2LcGBvJMTIlBpSNzKDHCsKKodwbKm1FleLgY4A5huuYifZ8
-+IVluXgE9W3DtwzKGla9N3zIwlKwQ3iLg6hPddaTT7XnNhucxp6vMS0oHTssD7u6
+ff5kLV0EiU2QXKCEGZBthkKlWkQ+RSYgRPHSlnpfbDZX1NMjjImnFlOIa/4MESR8
-Dm2OVkXpBbgdeE64xq6xRGZA51kEC+Cdd6/V0dVnxwNmrJ05cYDgbDmzfbEk8G5i
+FGQTEMSQwaIK5EKBFyG2+Er/7+7J6iQwE8EnCHeCq+QI8gz9tStZShSzAADKe7QX
-Ho2qTCAJlPztxWMr9uyd3N26IRR1wpLRZdNqviUZn3pDKj2naqYXMd8AckpkzytA
+8w6pj1IJnjq4aWfahgOY2qdn0S0avTPjNEv6NShn2XYyKW6s7cD0nzpxfA4gdlwa
-cvMr6hNIUbjjvqsbIyM77hyKa01VqvCXNj8rG9kVuzJOCjT2wbZUJcC7yFj0G9tt
+DNC23tijtAAvGCxOuQZ27x2pgq2SHxeGhtDBgxsTbmUkCs9PWiFNEDxepCWlpjww
-MEEOq4RHGOMYORqF6/uKT6eN2Xs6+k2W+FF3nbfDGr4o9nt/R4M1DzQTk6sydRkY
+xYY5DqnbB/xWURjuzTj52BW9d75C7S74ziJDwdJwiUBUBzN0aXa9mWxwv03OgtLk
-i//Kg7IPzDUYuBGkJFbdLBQ3cdXZl3oGnDyjPC3LB5k
+GpDU2Y5LnXwhP6ySSMbbrnWVPPdjy5fV71Odmsy7Gg0
 -> ssh-rsa QHr3/A
-kQTUWj4djXW64WfWKA11ipRnrkiY8u0w71Wjhzoe1Z1NTqVrbUSQUhcFJM5lt5zB
+oc3jOBnZNJaM13AZenexnTbOaSvSvZ2MpaDAAAOKwKGhOnkmjnKdyK8Ym1VhQJDJ
-trOYBpfOtOQRaLTQEjTKdx3S0rKkZHDDhoJcBs5NkvOwtK5c8+v3yPV1Ql47Epvy
+WR3M5JNh3nHvbszx8izYWcfgUn7BDx17KJ1t3c+vIIITZOLvnGGlcTB59RhwxsKl
-dJAgN7K8s7915Rbrf2Ijl1ftoHvr9j0axvV3krS1xemWwr/nmQdADD6HJFup0Gy4
+3VFISPjyWQeOOdSmrfkmeyc8w4uf5cjZFNVUTUk+u8WbUB41X5ykqix45a06Wp/N
-CT+H1y8cDg3Xoj9pm7goWsKVj6tobociIENkMmwU9ASgRah7VIBWV1lxyyf+pgxA
+PnXNnH3I/Xwd7GHJvAPUCwQshcxLkw1tP1Tysns409yNt6kLn4lmK8xArJsZEC2w
-97yR7k7IjuehdqhBWG63ESaAx7arPMfRwek2op4+odPgfocMDtE+qHbekFTtylRP
+U3dPIPxiT1NMSDESYDW/aN6ASqjQa3rKqgRPYTld203UOyh5dsVLtjP+llO2n5cg
-0jlYoetL5LfnHjJ3z0QDVyPXLxtmCufbJd2B+avnLhZb6CdLYSMtz0Ne6LSAKawj
+HOlvXipWHfhvQMNQm0rqgeqguVQLnsY87/n56VGjd5JUE7cJgrL/w8Z6UFN5Aoyy
-eBtotgKRxhhbHWO8qN4rf+SxdeQntGdDWpVWvjJQqIjvcK+HwwSfx4bsPYVNAMlC
+GHRiIVNATv4P7FsMfscZrzKhEGpvUix/o6LxA8v7wVKmzeeHe3DOxDiywQJXY00q
-6RvfvmxW8395wV1/DnuwMAYA/HFVm2V2uyi6w+bE3qMoVLAvoGAYlOR3rLjmkUY+
+2ZS4h3IQirbWZR+uk8Z4N6t7PU/T+kuFwPuXOuU5q34WqV/moR+cltEGQm/eZTsh
-LERZsRcQgQZIHGS58LA8pvzG6a48ORUfQ2Oag2iSF2p/gsBwqUJSA1rHpU9oI2Yd
+Vu6Oxqyvj4+97EMqmNCntlZTR8ahup6jLmYVGQC1ylNGQZ15brob/5fots3hqwLX
-iIY8/DNVuvmBu7iqeHzUZZAkK5gm9i5ukRcKMKcIU6YLkiaesD7iGzHS4Bpx108w
+/C/lRrl5ciNfqVsFX/RC7pIruQjrj/ODtwW6AceZj3/zVFuLuPd8/dJYQwncG5DT
-lSXJe+bI0U6cWrkOA/I7r1s2AAZVDKMrYUifPO2SpkU
+QLD3HZVCVxmiBWPWOCDkah2B4rq1INUq2R0gkb9ZYIw
-> ssh-ed25519 GVMLQg g6aTNMaMbO+K7yGRwq2P36PgNxBZYa9ofCx3WExvX1E
+-> ssh-ed25519 GVMLQg 9vXd7WVTS2f7tXHfqDKMnhJGloUtsOhCgXRUz5Zznzo
-MFo8yDawcaGyueXj/THhiOKcoXZAAcmDnC1JJOc+fXI
+QO/PEZcDwRWwtkgAp1E/lCYza9mwSbvd0dD4UfjYpiI
-> bP^G0608-grease d&f= Mhb Z G<.1Eur
+-> )-grease } ^Hl q$tb|_
-rZ+0MWT8rTXOfcROmMRc/sXtCqn7SmK8aILgEFygLeyEsBK0iAe4Tj6Ft5LmDxH4
+PuHpeMvZmcetuq7fKvVUdyjhaKB01qYirYmDPAXBay/gcyd3Sa4Q2xpXpHz8sCxP
-y8EVuKM6BOgDo8xIcNGVbdsQhdXgwmRFTDG98t9vOCCA3m4
+qEihk1TX7q+YxuFC8g
--- meliYUsrwlpnkaUKScBfb2XRT/q5HdrJnAD/bRS8izg
+--- 25Mv5mnGjUwmmdC1k9gFOCoCALp12bljyfy8rAjSKlA
-è½NˆÄ˜5XÞ<uCýÐCÃ÷<C383>§)[më7 ŸðÖN>ù£Ãã”Ñ–»R
+ÚˆfËé2ûYœS38ýK,–Ò£“§¼8vdÓ8Ýÿ–Ä+¨øq Kÿ¸›Ð
--- a/secrets/aws-credentials.age
+++ b/secrets/aws-credentials.age
--- a/secrets/cache-private-key.age
+++ b/secrets/cache-private-key.age
--- a/secrets/cachix-personal-token.age
+++ b/secrets/cachix-personal-token.age
--- a/secrets/chatgpt-token.age
+++ b/secrets/chatgpt-token.age
--- a/secrets/cloudflare-dyndns-api-token.age
+++ b/secrets/cloudflare-dyndns-api-token.age
@ -1,31 +1,31 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-UWM96Et1JhFUZxSocmYvb6TYO7XSTcvK25De7wmknqhpofVhNSmCj2y6vVqJHrmY
+FHrAZJnQV6lSSvPB8NqW/FNxFYL+u+aIpSUMuVABhf5s4iOl4zs4PdlEbc4uhikd
-8x2td5jYhhSye6GczOeBf7YINKftqRaPJMIz2kDMujzttu9QrlyN0J96hjAjNmuK
+7WgCknAMq7t+Kw/nauZ60RcFb3QMZJpQl0AxeQ5H078dBRPRzCYMeYhD6l9uTvNu
-SwY7ZMw7vRgf9LKoaRi5IjWKxeQwqax1NfIWxKuzY9Muk59Ema3X+6HvGHI/PiHn
+nkEqsli6SJARafQde7emcE1dZGi6+FLrltgsnGk8tUAJD/lQPSa1MlW1gTIg+D+f
-NSqvrhPUbroeG/59ksors5VhWE5DorPWH/1wk9q9mZmBKWrqjB6YMbAmjqLxWVZF
+VZfUe9iDc11v3ZALJw5Eu3+iHfyiUtyBYoOLTHGKj1ZAz2FK7cLzu4zXRGJF642Q
-uNd7Y/cU28fgsVibzNyux3Jy1V+l86qKcGfHGJ9dPAyvdwDQg5FihBh0pssNeefo
+lZu6shrWLmjGgn86rCj/g14m35PVioJvV/f2H4YkaAAMkoZUV+xjHjUXUnwsz1Of
-au/hORoCS/XfHajy8oPSmxgMw/nGm3qKUwFkJ1uYRoynkMEM8iIxqQWIr2iMM2tp
+BTN8vlv68FUycw5Bbu3PHB1qCkRsoBnGN/IkkpARnRxAcNS/KQ3+hZm2KwWtUN05
-0Tu8L7Ty24w03e2s963jxiBRPtTHfxK1sFXoS3fzZ/mIZtuwCvWu8HTjvxScRSYw
+HeF3PMFY1+YCcINrCxgxV7XyQComLt3uB6YHH06U+sRA3uBIM0flzY/N0oasVE/8
-zJCVxUphXI/JxT84wvXEvtzBQw82cgCths2KtbGU3+0xdEGDEQhZwgt2JwHpJfHO
+LIuvFO8J6gS1QiKfBq3tw2RDFvfrpAO0FriFt6oPdEsJLwyC1GnYf1itP2AGOs5/
-koKSW2iwTj0NyMvjMTB0F9tq6vRYkYHakHjx/wf1pIBdgmG4xDgnVMrtju2ybpF/
+AvuAjw2ywH0dc6y2UbwBVPaZxsSepFWVuMm+BePstYUAO6Pheekopr9MLnODGbz2
-vJUALnifJFMAOvXpH1CvBZZnLi0u1fJqJprmbU1Opm69n36ozI9fQrt6TNGwW6Z9
+8M0BHCFKo53yrarYwUhzldd/cffVopN1/+jPx8RUmdSQFT8ulDcngN4qrQYnCPXJ
-japEd5afOti+9YPxI/jnPFiLhhkuUQyWx0my9xvhyUA
+QFWGJgJ8XoOlptnSyfQgeLP4Q66MXqcl63kcYkFnTLQ
 -> ssh-rsa QHr3/A
-dy3fESlOz/oM4sNZjfTHTJlYwo0AoesePHGjuwn3kJJVPygku6bE5jdrjLInk1Am
+OcKEwRhy/JbEyCUNcjdrREaSo7pqRwVxRSh1ff/PrhXOVXdawaiKodxRbZJTPujC
-w4BjnqPEMKtiryvt/pxty9u8rJW/nMezXirXrVLuMNSXyKMcfBr34mQLwloIxdEv
+P37o24BsfzW8OQsi2JooHSAk+d1vSuCImOhTSfiMHSi3/OG4CaaR0tH60lYx8yPO
-IdziO/E/aKGNvLYgiZt+fmA+mcssB7NhJOBKjYqyg4xgi4N+mR52+DE5bg8WGu5A
+utu1bR6XVU63+NPuc1sMjE7Ra13Nz89xu+VLzaO67BHrvQpxSYkJ+D83keMDAppy
-aiGRj8Lp0NblAYTm5Wlq9dgkujrsbL7edh5DXbjF2azpTPP1sxfLD+m3m8t68fsH
+p7JDqtF7JK1+3QyB6Nicca4IFDuVhb4YiZEouKX2Y4NmUDJ3AEFWlwAv/i3PtaLW
-NMlKq0VaJNjpfcprTtL6MhtlJGvbQbhzV/qOQgmlM7VirhIWN81QENttVxvgnbMX
+1Jti6Kse13Sh0P2ELQaXkX+2rtA0BGtmLWYXhl/ofUavacJh0Kz6O7gxvHkxnkQW
-9HC4ymBzLhFz6aYdqO7PbfncLGs9EWpjwT3GSzfmIWzTuZoGdmx1odJ1URoJ/FwW
+iJyyJAE80k++waRnlXPPwsD2llyLyLsvnZ35ztRr8QRrhhGLSxNPKADWTdLWUQqJ
-I6Irx8pLRV2JlmcaDUP0naoP86mTVysg8sQ4BzRPgD4NNKoa0TPDlIj5c2oxhmr7
+WCxyR7dpOf9pZnRW4w9g9qcWNRfjXkcWWiQG5WRc66Vm+jiADxJVIP8Ijy38AvCO
-cQKNRtamXMH6dBOVMBJQJX2vTrn7uGwvFQWnRs9gqUpa06f0fUNLUCnHFRr1yaQf
+RPk6Hn/m1q9yIfi7ETBb35YKSfXdtxfNuVlOSFuP3NpRWxW28QliMRAPUmqW8exD
-omBPbCeEk9yzY3smkLLkGlI8jBlohXAEEGqtArZ8RzvaO6Apgj/lluO/XROxByLJ
+X38NtfBdfevpM2KwY32PHlikGE2qZCtN7ie2at73wpCabLThuSK+aNWfStM3XHOs
-ntG4HzjHMjOBI1l1NxubWxYBIESsHmXLAHDa2PVKdrr3JtoPRURQ8KUT9YQoni4o
+d7TOwMjyReCHZLH3ZUO5HWg18IlSb71SuGsoWp4vSSKACn9lfNcPsWQRk8AU3SQT
-a5yUWWAKTo4en1Q3onlR8nXZRamUBTE36lziHq4p7aM
+PXEjz4EmDRe6wZZbYmBg1ibrIcGuANPZAhCohAs4nXE
-> ssh-ed25519 OgJHCw H3aAsbR4T/qRxCcqZ9JzfnSuxce8UEiIvdEZRcYAez0
+-> ssh-ed25519 OgJHCw twb94BR4BtJJjPB5bZNOfcut/61eMtFh9fDJOhfCUFg
-WnfzbTWfhbji5lvEw+RItCaoWcs+uVE3eHspg5eOIWY
+fz8yWonvz/WaLmTfLXKvDHdRTtw8Z+Y/hUDk7udpJfE
-> l`8R:0Pl-grease NKV(z*Ni
+-> ~OOZt4-grease Sn >~K{W
-N45b7TiO0LXPb4YsK4MYPM8q1JCmhijglQ
+wa5SC+VyADualG7umKxvFiyF1eD+uBwukeMkVFKBCLXMoWw
--- bO3XmNFv7kugKsUvwmoW0lvg3a8ziPAtbuzI0WL5Owo
+--- 20fKv+Gb6zI82TTV1z1iurWbUMw7A4tUYhble0Hqrzc
-Iþ¡ØøV¾ƒ5F¹ø¢Ÿpƒ6Ýz®6G‰(NŠJ—'ÍAD'%¨™z³äa@Gü{é4cl_ý$88¿´u{ÇU}_öÙfhº®5Ã¢›Õõ¬Ù»õY…Î23
+B\8yZm›¸¸!µn•*OýŒ1(SX•ÅFÕÂa}™õ0*|("<22>å4Ž¬þ`ñåM¢sÇÔwA¢Ál½YÏñè\yZ¼ƒÄ¥³š7uE»ÎÜhµ[€MæÄk
--- a/secrets/default.nix
+++ b/secrets/default.nix
@ -21,8 +21,6 @@ in
    "cloudflare-dyndns-api-token.age".publicKeys = [ccr-ssh ccr-gpg sisko];
    # WireGuard
-    "thinkpad-wireguard-private-key.age".publicKeys = [ccr-ssh ccr-gpg thinkpad];
+    "picard-wireguard-private-key.age".publicKeys = [ccr-ssh ccr-gpg picard];
    "mothership-wireguard-private-key.age".publicKeys = [ccr-ssh ccr-gpg mothership];
    "sisko-wireguard-private-key.age".publicKeys = [ccr-ssh ccr-gpg sisko];
    "pbp-wireguard-private-key.age".publicKeys = [ccr-ssh ccr-gpg pbp];
  }
--- a/secrets/git-workspace-tokens.age
+++ b/secrets/git-workspace-tokens.age
--- a/secrets/hercules-ci-binary-caches.age
+++ b/secrets/hercules-ci-binary-caches.age
@ -1,35 +1,37 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-ayCm0piIyEf9C9lWdvqOTD5RlFCKgzgFxuwZiRERyCpnvs4KaYZ4Fg993ywppg2F
+auKwY2INFG71SwQ9C/3mPVb7sNTezGDai9u7ACSy93dMmeIFogjS/HJhO0f7JICJ
-oXG+p8CtRW+mqNIStLd7/R9IhIo5E4dEI/zZIqArcE9rliX3+ietNSZxVh3CZ4HL
+eT1EcXREeqbxc2DuFFUAKw/1VumZI2+D0LLI/LEOzBveZ11E2DxIBDTm7UbGLHyz
-g67/XQhGf5HIPCrZw2uLNYNf0x03VLROLOAaBEGVm5vamSlFDSr8rlJaxXPbcfCp
+4oQ6J1ZDymMB2x4EjoYdaxU1lANbquPHxZ8Q6AkEFqs6vcJ8YLqVpUP6ubFs1AkR
-Y/7XAiQvYPiulYHd9TSlSmXKuwPTCpwFtGG5xndFlz6HtzSYypYQggvFhmUdcF2y
+QQ9eBcxa3jWd9Wv4/LoGiRu+5ftCfpw80al3MEBZWpGAO8fEFs+hLyRN+uLew2WG
-xB+B9bpYm0AAvIWkr/OqSqU92Ln2S6XhHnPIeVcNlQv6sw5nip93q0ZO68M62YzE
+vIB7myYtupC0pHsfTBl9PRCz24cfeZInTYZ682BW1LQWyyBTtPSdiQ7JR2g08E2D
-qBpZmLLuDSycR4Ih0Z1loNwJfBVvDkmHzFogmvA5TmhkYf6e9saimVDAGB9TbO45
+uRrk+QsxfqXQ3MjhUrBDHL2v3fXxtXntJtgqfAgW2RM77hiB3S7dG9MyVn+Nr8rE
-DLOKojnE6tYkzRhSCegtbk9CzzjAD502edzZGx6AMr4h7itV2ZmIGNmlvW1vIAZL
+9ZTVZPTG2VTBLE/KkbiFAWzU6UCu1lGE9GB8t2L2BXAlrtRwknDzz+0LfiDylsY5
-6XzUh9+KJWX8EXWFjockOeBdbR+R7AgbZXEO8uNK0A8V4iMM93/vkLpptOXUl0y8
+ZpuWT/4xNIbyYH4klV7S8E1a4niTE+2ndxkL1UEc50uubVfqsLwfs3zWvUkdXNVc
-qlWM6pbHJInBJXMqhAd1fE008aAzJIVX8HLcKPSZK9iDY2kuJ2OpSq3Wi++19Rdc
+3e9a6uHcbkZeWnxJFg7Zm7KLJl++/ARnCOEmaO94vH4GV9i3Xlsm6goRIRwdWPwM
-Vwmv2k9AmwQMy/BViABIHWiDZUH8GpWDTLanvRcCRa9SHnvc8JhG6m9a9/yU218X
+6rg19Gh7OnOc0SQdUEYrH8iMZ8fdwQNDy2TnTa9rLmveBbftRpMcOKJqmHvHpb54
-CXRrZ+0XZu0dRSkp0dmwL7gO5vrAfXf6V2bMstidqz8
+eDIgVE9+zmjpdGNz8+jdyxBMVKd/re1KHdigxnVutWs
 -> ssh-rsa QHr3/A
-gSgpgcLHPm1+AqJ6mfXw/tGi6nOn3pa3TOmF0e8a6KEG85IMfMgaf10i0VwD++n/
+G61uoWoqGqry/yJMl8Y8Hj3TW1JEB6hmfQRy+0GI+0qRMKfF77yVDmvBlFBV5G17
-BcwFEz/xkbOX8z9YVD0/y+u4BdzvSPISv0kPaTMJWsiqlaKRdHOAnp3egY3U7kCR
+Fe4N18EAM1T8TOFFLanUhp4uE8DnaX3AhhhdShZ6QUDZfC1NkSzWN1DJtlwWuRh1
-4wI1i42CJqSbMXX1xBYDMPBMk16uWgNzH3PaTFFnIu3VHmSHH2pBqy1lqoGPObgB
+rKqBQGB7mL4Tni6rRPDrF99luGYLhetwUg1M2Ut6fAEIC0PdAZhQgT2qs1mpEEuG
-Nfa21bqFjjObcYQ7nWAyinGckd4jlMOYg65duHNuXWp/j9rKwDyeu4Pn/sMe3fHw
+FsRk7vx4Ky6mmXjwVg7zLxO4BLYI0osUBhZnGmTqIkfoTukmxDL1aCn2Ga3nbcqL
-1SLpKCubqU3ZBsZHa7WUqcMlxLSi/0vTaSb2QP27teQVmbpN7o3AZixnUwqbar8U
+FNtyVQoMBVFxZyxmmn9w1JNo39D3+4jKU+lRhCg8VM9dRYKkmqHwRcU5GhT47GoQ
-qmY4aN3Xa/eXjEwrk1DTX94s577NPeu5pNaO18jgCEAJAF1aJjo+HQD/PK2i+hQc
+5C6Vaf/tSB/3lxS6wa4ipMOkza3v5T5z2lDxM/0i/fKSRJKMfev4s2XSF4s9JHqv
-142e+ovjyv1gsqGEQOvFMhkAOHRp8ve99Pi9uoJb2v07q756SoULh3RETU9U1KUM
+y7tp1j8PaZVGCP2VN13eR16q9URDZOZMQp7MfTaNuCsUe9y8sTO9mUxnb+OgfUmH
-ig/ha8zkX3fYbgG5iTMt4WamxPPA0T/0smi5wkygEUMnEGhRcLKua1FXOx32/Xc0
+8CAF4N/Nu1ypsCcZhSbFS7j3IA3XMs0Hv2tMPeatxndDYClNai/J8lmhT85MzvY0
-Or0si/i7YEQJe0q5QUdQzsUWz0F6i2FcaWjfVuqlMv2Y6dvUUxdMmD6Fbkrwl8Bh
+IV7iL1OWYUxZe4clkYAg8y+RPd8YgR71dkxgRX3vNEEYxn4jLCDcQ/0y8C/OUmFY
-V/gry48OQUV7mbWm8NmDZC0PZyhwZO2Nsi+4hbF91TCGMoV9CMWlSOeMgish71go
+8ykAkEzMuQUeh31YZPfc3onmrwSxi2V+8+xTQmKTKCOjBijc2j5sWCmOOvwFeI1F
-Sovf5zj2x5j9f7Sa3F+bYoLrSf/elpq4uhepsUQ2MpI
+A/84JeeOSNnJ4qsaCYIBF3LGeBz+iQWjZYKLv0/BW70
-> ssh-ed25519 q+UPnA isOn9LBB1IYVXVs8BZvFom+/0evzKp0uSIMIXNGngEc
+-> ssh-ed25519 q+UPnA juuyyJNpEwOi2ZtT5ENoZMtBF8F8vFiinfbEXhU6Uwo
-ksyNpIAd9uweNbpRiyj+Lvlue0hHmiyGQ/D3Xm3uQ4U
+ypxA2FHqKcaJxFKh6qS+fD7YTIeaB25savx8S0XO2tk
-> ssh-ed25519 OgJHCw 5j6YL31bWLsaSH1fZVXhJ4AJwUG3IW/Fz7Fh60vMf1g
+-> ssh-ed25519 OgJHCw oDWS4E9MbE1dJ2O+BgWq9REnXs42XsT48NW95bo1dxI
-iDvcC6fltkwTXwTd6jVWh6LsSomvnTK19MlLmNxv6u4
+vC5v09czAaEiVGAjuXd7WdaXIVxEeq21j2H2Kv6i9nc
-> ssh-ed25519 /WmILg r6rBB2g1Z/cEbT682CIRLqkMxDwIFbcUyQVszpSyygk
+-> ssh-ed25519 /WmILg JFMI3/9pWnMeOuk6KWWbYr+ZnC6J3NL86wNmgCICqik
-/xTY67cqw9ija5Ga/AkQfKOtrI2zF4KHfck7FQ6Qutc
+N2u7XZNnoHo8ZQ8qvl0eFxAc8xFf5GYRkJLy43iYZBg
-> [-grease 5l^AU@# $~e
+-> BX)wAQ&-grease x#C. Lr
-mbVBgprCjkEUAJvJ0Z6bZ5hs/90TVjrovLbuleZuF9/7Gw
+4JKQUfEMM5eihB7FphaS/Jfmkedd2/Xn7vbPEcoQwLw8SfnlqyGYqEXcvBCd4Vq3
--- iEaa0eQkeGJ3Gq4LDhxWLDTg+nHXvVexfut4AUGATqY
+ewgR8FOSUSmUq7HIf5/73zwdHQLB5Vd/oDieiupWZM50NfrCgiYC3QCD4XVUSfVx
-õ;Ì1YéŸ½À]Ø¾{	ã€ååÑm´oÔx†WÜMÛf‚‚
+cabB
 --- rCkgqDAheawNSxhSF4egoq5aq6RysT9ZoGsmlj2Yuvo
 ß?n IC’û²1]…®¼%<25>Kaâ˜ÉŠ«v¸ÐÉI…<49>‚
--- a/secrets/hercules-ci-join-token.age
+++ b/secrets/hercules-ci-join-token.age
--- a/secrets/hercules-ci-secrets-json.age
+++ b/secrets/hercules-ci-secrets-json.age
@ -1,35 +1,36 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-oRsGL7IBIFlc29ZCFDmYma7/c288Rq2wRGeEjnDxvq74LlQnxqjgkexQjOEyqLMQ
+lkskSBlacOLuVlKAlYen4RwVDVlDnesdzHgOPkriife626RWlVvca1sVtpKpmUuU
-oMhM881eRsdN7EsNyVAQKzP6BcXPwGoH8qnieoALcDwnD1cD4erdQLxaNkYvfy/5
+dV2JgRG7MPqGumT4UX1wTpqiYTMuJ/2s44/qniy88J4HyJV1dn2a0GOk0WYcTFJU
-EytZEl9Ol83XMtuF51goi34+J2rYtHDXNqOzbJXOAvwKZy6om21NKeWh6JNZZ207
+85tPEZQB1in/07Scpq96zrOAfyMNZGH43V1SmFNW2Tk3ki9JIRhe/v1InOjxlaS7
-fsDRt5+eR/CQOWNm33Jp1cXTFe4atP2hPsOIuX8NHu1BL0S+ei5vtYlU0xZmj0hq
+1Ik77EeSSa0UZJdyThbRHvsKZYHjTpQM0WvEL5FOnqm5fIKGaOlwPLs82GiELU+X
-Z8JhV+eZ3wEyHTraijQw0TcOXh6ZeUrSlunFPkhZLR82CihlCKHgN7onxnKgaW+R
+9qpZu6GhWI6Nt9Barkx3zuBdkz1Y31FphyJDSGLLo5ZgxxqMnNzqVpXGeNzttIyR
-pgY9PBobIDKsDllA8l0L57FFk/hAS/tI6NfyzaWWIQwv5ano3HGaX9qVeyzcqBFU
+zXZI6iOuarHguIljPBaDBI6ZCYOHpBkkYRJQS3eHqqV7bIj1ga03ehfG3ayDwQZf
-eLd6aAda3AgJlzCJCcEBhJUCpVcnKGWyjfAH/2iTCmih793cqAFkX/6eA92SYzw0
+OV6cVG8W52iSfPRigabU0DjDsi48rO+bpQ9S8Kx0S/1DZFKyPiMZU7S3HI8baT3F
-bW1c019JlXFNkZGddjm3VdM5Gd3lebfHncKxPXmhkBHVkZKK0AkHcK+DNNI84hFc
+F9HukqRurjPCBSMPMfZGhlngb33beuqcgR2uTofgjHNU6iBvUaIhDzXzihmO3u7R
-9s1KTgdqggNzLn6+suenB1jZspqB6YOSS1Tg3lNNWWh83Qdgfyc6XsjJJFJIKDCJ
+tekg5qfjHomU+j6C6YYrw8Xo/Dk9bJkRPdHtlR4SWgDvwZn910uE5zpq+06wx+75
-kn1FVn6RtGhM1uXCwZ4oGfzSD+f7OyqdY+87DeyG68VNFa3kOjxe1fMdnf9+PK6u
+2a/IxK0N6xZnliZrKsBaF9EdDVtTS3Upi5nG482UZzHjmzbyD6l2LlWJX6GG3644
-Oke3pT/wc1A6BlsU/ZjdQ4o6Td1MgWSOEEml2b2t1WY
+0Ck+HWpNyHVD0We+VUiRfC1sv/Sz5pL6n2Lps3X1p1Q
 -> ssh-rsa QHr3/A
-hd+wVyRTQrBMvHFpYZOPgfDyAj0XbBGLowDQ/9vKT5W3B2DeEJczxnSyihlTt8JO
+eH/P4d67+bjpyt/rdQO5xXJfxF/gek2ZHLeZDVp/WBvJiZTRfWN5XXXFFlmcz6Uo
-TNxzroHnzoaIZ8t2rNzlQG1Wh6OkXX7+YfT/Zn9si8G6jNmhnWPFse6gByKZrK5d
+XNtJXYHYKgRsbO9HJSOlyleDZCokTWWqttMDAILQ4R9vhziBUcKPxWy5f+sVAT5z
-D9qMCbPGdSaEHjQ/+TopXG1kQLrgng48c+tH2s8C7WUdWDXCjqyDIu8bQz9PiHMJ
+PPXnIPSCV+1ED5xINQZO+arFjhUAFOOryv0Wr7xrPUq7F3oWGytJq+8uq5C2ZbIM
-wMrV9Jkerc2K89TtMH4t4/ezfXmzGz2RHTRYKYB9R2ItNkM1HeLsRWM6rfhOApOq
+tkTlzDk0rgmsZxWdz6UPnTRyLLXDwFOxlIs9wPDoIThkV9R0B6C+8FUNs8qnRlvJ
-/htIri/8IrsfLNvlxPDETY9LMlO3yra6QzWiuXqhp79/QpO+xV2UMnL7MZGvfMgS
+2y925vvfpNORAuojtCOb+kWG3UsWyayzWOQLNQNFvNArb7LXxZyUItvb0dEl2xU4
-lk2/saGGtVwHJjxNvE4kkTfd8qSNIP7iNIw05MRK6f0JQ0ODRXKDrXAKqYNXr+lQ
+iHe2FKRaD4xLtDWSEQvbll6SB3iJ2YuAdo5xFFxd2EzCAMGR/bseWIWr1wyR1DIk
-Z71sWltmrSQV8yJcRTYV2olx0jDUzmg/sIDApMlAf+bg9tyulnNAZRLn7kX005KO
+JuCU4kn35C7SKcttwVr7OLHXccxTXIsIe7jPThIv3DkXrNiZvcUYPZx1LkKxWlLH
-wQ77ZBIU1xhxB44MMm0vywdlTgvGoltgHzpkF6KTVTQdwWb6KcrXGzJEYJx5kk7X
+QS2ns4EA562hcV1tDtlHDsm09Y4x0LRVmE7A1RNqos40UGYCWPChNFu9flmXoy8Z
-OFJzzNxkix2uME5SMpH7pPl+2He7Jb89OW9tgCgBivn/TptNk7+PXpawz8R/aTp8
+ziLt73aGEj0QYBDa1wHM/TU/hwEQQL5M2L4cyJzPx8yyAUO8jcJQ4l7w5RijTJaI
-Ll6VBdmEeor4vLVGGhA+SW/x783uzQG2wcuf+6b5XUn0JMGnydCenyqEGRKn4UEr
+Ujz061IJUt9/RI4LSOcOea4AG7/AJftf0jEwRYR11Sw+R0URpGSQMkxJfNqdmA6s
-bKD5dTPCuA9dyIr6ZturqeHFKJEv11wU/Q8TzFjL0BU
+c1SSWlVjXDdthVyF1efON9LNZ4s0RXhzJsQAp2FIsc4
-> ssh-ed25519 q+UPnA zlnFLU7vKIAegBrdRRDoFt+EanoCnz+tXMKGsxXVjwM
+-> ssh-ed25519 q+UPnA YGgJfYKduHM2aFUTt9CVDSa69DMpnLZ17KGScdTpUgk
-y56Lp85kYL8na6tGOu7YlNeXsjN0zyK7JMhZ8SipYyI
+MTu0WbLrTBRT/Nmo69UpsMo3YR8pymQNBAEuU2yEtwM
-> ssh-ed25519 OgJHCw NGtO6cAdSEv6mnelPz1drx/0ynAuaTOSd5VlshR5ABw
+-> ssh-ed25519 OgJHCw i52PPZe+THdu5+eXqMmVaTZA34f85kPeIE95q9tuX2c
-+DiypwDtpVM/eTKmM+Hu9juxzapdR4S2PqBnFrC6VAE
+e4CtklXq7b7jDwkMiW78Nli/CK9PNm0rxk42LPIInk
-> ssh-ed25519 /WmILg 5nIOSdVz1KtYxOko8g6XR3LzQ6pGhg8adaTUbGyP5hQ
+-> ssh-ed25519 /WmILg N+4lILj8bF+fVzaZauAQo4qchqzj3ZfoR4HyYq3hBF4
-QqctJfuFWgh3ajoVQAawhyQ0h8CE26e9UssSB54fY78
+etrbyUXMGbzMJa9vLMzft/U5NQrUhCc9nEU57gWhMIc
-> .FW{-grease 9 /U{OqV +=>}
+-> W-grease H { b2i~[H2C H"G
-mA
+Cz19j9Z++6+Lj+IaZOGTZvuvpyI9mUtWATs6ygXuuutbieCG+ZnBTnKpHOK2RCXJ
--- LrzlHQVF4/UtmAii4YCIVZTC4ZMmX9Uw5LS82wZQqxM
+WbntkxpLO9WIVTdWHkV/tAP+A4BzQC94KgWGQ2brgFx9BShXn3j8SqDWVn0d6g
-ë…Í‹\¼_<C2BC>—öC°çÈ^#¢<>|›ˆ¶r3ÛD=G·žóþ6ƒ
+--- ej6JOmaUyCGl+8Ycj1vWSDQcJ7f6ODUXl9Lm8bfZd8c
 ¸:`³Î‘Fê2ug<}d*°ñEÂ9{ž`µ×ÐÑ§7k±J«
--- a/secrets/home-planimetry.age
+++ b/secrets/home-planimetry.age
--- a/secrets/hydra-admin-password.age
+++ b/secrets/hydra-admin-password.age
@ -1,32 +1,31 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-obw0cD3mvb2C+/oG0W0RN9fKLoS/tpmzphCaEqMluM2y1csBcipprKRTL78p1cFI
+pXdcgzIaFUlBstpezspNR9+HAbT/PspwwEY0kE16bmoDqqDB6zYg8/phQv4A1FvL
-CKOphSo5LlgIS+CsCPtWoIn55WCRxuI89sJmShsncdtU2jAM+If3s94b1rgL0Nr7
+IyR9YggsUlhNHafMPcr93V6mg/OYRseqcB5jVOK4pXiVlNgm4gzi24ZArSfokhTK
-nR1ABD7vBUGVsUBeo7aY8N7ZHIXWd6yOy0/QQS/8iK1t4eIOBy+HImodiWS5Ffz/
+1APDSzgKSo1Heh8nFxFqUk3a4FQixGnVyx/M3IYxjU6sr8wxMFHGXTU+OZ7VIKoO
-xwkciFsGTgRyND6McnWNg2DH7acJue0WCOa6NfRkMlWyufHU05CUljqIP6EJWLID
+our3O/ORiPTtSyy8ZVvh0OhO7Wm2kForMMuJoPdqMg395YIvZYv5arW+S9O1gVlP
-EXm5NtCP+evI1OxziT1KzxxFW/EIDy6MfG6Mglm1i8y3Q7/QviEaUSB7YjsbXj2d
+23lWYaEexfYskRg6W/wzY2lcy275Nbgq0iO6InO8Hc4E0bVOiD3IsdLd/I3xTRXv
-YEvzydtcTYFJaJ6xbLrSlSMIU7yJHnYGcp7VgvKRU9/bVzCyVq1HDTDcC7vJgJuM
+LiGg9ffxizlBJBbe/HJW+3GOtnA4hEXSf+WoUCGWFstr8ShOsx2akMzj0HYg+OXi
-XQOT0TcZx54lqUCgvxf4HnGw2dN2G6c/8Vedh312mUspIgB1lM3bl7Py+7FH4cEl
+Ac2DZEdGF8l6t9PVLsJ5D1ImLNqERJKYcJp8DO4ih3C8J9yO7DgQ3c47GOjTfFP3
-YHuG4k43Xys4amUiMzgaPvO3UR2Yp4A6mJ6JHuXVyA2TTqinGp2Zr+DGxi1lDNTo
+bZcYloR0z7N0s0tePMsah3W6Z1HF7c4DvfPNlCPlEb8PRSbo6qEbh4sd3hxSKsBm
-LWOpLwqO1eq1jTv/JZ2pgufUAROvCU1S7wyVRnmOzGUHFTAyNUUNBhkS1mH+Yktq
+LpUNBTO9EHdFD7kduDmYm/UBGI4QE5v+f6Gtw0pMsdrliFF0NmyNHN0S7X/KqkDI
-aU/31r5EYr5a2f3rWsxU7UuBrFc7WMn3cnz74c6BYrniCISJAaxLPA2ZWk14Bh27
+Mi5DVnM/Z7RFfpuUWFbJUJ4M5ecjTjozcEMWzCAjc8/63b9e0RJLxsD5yJsouqSf
-JZY4miO8e6rzUSdW3YintPLkT0v6jQ6ffNMgaGDwBas
+Ko6uDTWJkgEAVhfu3i9552pvTDrtU7G3P3UNq3vB1DA
 -> ssh-rsa QHr3/A
-e2V3fGjEms85PJbQ5Kss7eJkcoYzRFoxTLny0VQX/OG/M+D8LhKnLPnMk+DUTCJA
+GJBRW5RS43nIL7eJKzi/LHVFYq1LFJIsSzIgbHKcsfWc3mnPwGZNIwjKNcyulKsa
-mBda9fpGtDZy2ilg/EN4mZSqd0AM4NA3PUWOqt4cdsOQ8fv71d9naJ1PlfvMuKbC
+mgXBWH9ms/lvwTlwd1Vxm2BnOTwOVECieXDehaYQ+N07l3uHXE+FqIgxgh/AC2zs
-7Z9Mjbyg5mkShYZKXLB8ryjkAPQ9zNx2V4tajJlmfmo2/tHMx8NWKT9f3p1QfdL9
+R9tjc7rC6qXvTEjvRVWQI0Ctt2+5JwGDrJhVQS+wnbj/zbTcCFsN64LrAMuLbDtv
-LoAhurmvIaoCPVCe7OZC7PZSFJMPWbZIe1kTWZc9ETu05C9yYIC43+BjDcS+01AQ
+nBojiV4XhGvblkZXPiszSdlWnJQeJp91S94JFCjsVqwCXovNztfiOJQvUR/qn/YS
-e9zu/2imX6evoWm2ume5wNc6kSm9lganf6lTEOw2/5YC/oYkPimNSlljiXchelsV
+cvDl6cwvqa+gblputWG8G1SM32CiBAG5xu0B8TpmZsNotLJfXUEfnVHIW8i3AYsl
-N0FnkigkjxbpCvihbFOrR7Vgi3+kuU3E774EabZeY0BwU9ZgTk6GpiJxfklBQKf8
+6lkENXUgaeXRiFFoxQiorEfvOH3ILcGgPr+DM65jg+rLA3nao74aiCYMrvqtsrJL
-H6OYpULcMQN/+k4WYR6CQ3HoVXZk87XGsGelPpW5nvWDp70sn9PnmwJSKPSUZE4s
+pKUQ0StYU3lwyQ3OcggjeeAmtIMFYbfW1BVyRDQTY4l6GS14rjreVdu0H9DTqz9n
-eCq5aGegfKw8lornNm9Ucis2ELr+FBiB0zbZyovf4IlvVimja9BBQ8/3bGBsLEag
+8CKdxPs+CUeUvmjSb0lip8UeHSETOsadSwTB80W7TOd/7P0sy2x3PqhyLv3E4LoL
-k12YzN8N0epUJX8xkTXx8mny9uu/o8mUBJOXTkADDceSnNY2J2Y4S+EVtCI6fVwO
+mvJIKgepNWZt2ibgkigba3R0o/cuPSRAodSLgjzs9T6/b99UkdSukqACpkatc971
-FhU4tGFRN8xzpo+V32E+W3kEXw3BgTja+zeryPy0FoteOV4RIIW3Fop67tVCwvS4
+C3EOegmMkZdw4b1qNc5rJaU1DST2097+MKwpgbbm8icFiRdzSqRUehs1XHmFsZfh
-V6AqQIP7taertvRWmN8mhCYDTt1cI0GDEUF6fo6649s
+3jMR1D78B4v3Ocm5ghkjv9ZCovom4rEeArgSDpz78Zg
-> ssh-ed25519 q+UPnA FIeRJz1yAr8iGB46kciPyQFeDoA6qp2+eh32U+ieZGc
+-> ssh-ed25519 q+UPnA okQAcFTmmeIEzGiP/GmjfxB/aSEoZltaAcvBZvNxlTo
-wef0aJC95oGXUZH+A1e654v1xyVOMa/CN99I0K4U8mg
+5fMO8yIvCzJ2O+p5xp4dfDH11/enF48jpnnX4aDT0Fo
-> ;XDZ-grease
+-> rg]p`wI-grease o Z
-Mh6S40w+nkAJsOSPuof+UC8QNKEYl9RxplrBXR6k12olLPjP5+/Ffoy04X7lKq7T
+Z7g+eameMAZruJuGR1vSjAPIFTywc+hBk11pUg
-KUrCXRZt7/kibUiIvYAO+jHe4ul8o9sJa6q2toj8MfN6tMdGH140ab6V3jc
+--- IJM940bc9WcjHaBcNxa2ZUSO2rXuBLDce0gjRrc/pMg
--- JO78fBi0ZpibGqWn+BSkXLeoiBKPxkF67T8KgBEKbc0
+'ﾑｧB@gﾀ.<2E>4ﾔｶｨ5ﾏ<>ﾐ<19>ｿZqdﾈ･mwﾝb<EFBE9D>C3ｩｭﾞ
 µ`u3‡ Ø¥{#ßÃ«ûÿqÅ!9òâYé‰1ú‡R·a¦Yßï@»_ºÕ‘]
--- a/secrets/hydra-github-token.age
+++ b/secrets/hydra-github-token.age
@ -1,31 +1,32 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-db68MtAOhF7DeHTvL2RME6oDae9BgjznaVoMGqwaFlBzKifdbwC3aqoa0sjMS1b1
+iDmynSSmIkU1DB7QwjhsyMR8RlyrTA80WljbokSKTojwZDC8vAbVoHwDAjqjC8TB
-XPQRTuuJjP6q1vAGVUXq58oeK0eAl8ggVMgd3AG6kf9a3Ibq5p+SAAp4v/KK2QTD
+flOOtSit9fg/z1thuWTBRMWWsPtBxaDvSLvZUGlG784DojKsbVRrtEHyq7VNGFos
-F1HODsWvVFXBUEMUXIT4/RLmYotw771hOMql4lzhioaQgnhkJKDNzOfxE+kam6CT
+yusseHkUuuAc5i8DsyPnEF9KzyOI2n/4GByjA4aXHCKXv7lRPpv8Ih93x9RtQ8fB
-tWH4N/Z6usT1HzuxzbBJgrBOX4WTO8Nbrjve2t0eL4YgWTgxJl7ZeZodseX9nU3Y
+KRTPv8hopYl6uGJXSYY5t/AcONtJFO+fzgzSptU9i1o6gHEjdEBFp1YlxPb2IxfU
-ElK39Lc1lVJqSOnfUgW2zFSMrb6LSs6PXkM+Q1Z7Ta4Qz8P30N5rWt9c5TNAJstu
+oPgGe87Ee+pdaN+LVsOUg8uAe84u4Am8IETiCnPJfjEuvdA/G0/51LDPrRHeI/Kl
-OW4R6oJCk8mhABoIcTnhSgAah6x/IbwXz9wqBxjD0IBVS3F9fUDO1z8rVgFW1Nl/
+9rCFVjWEerG2cIZBduuAn9kRUfDwxOT+xUMeMKpRxhdVjmV9DuGQucI3vD3/3/QJ
-CEPYgsfSQ5MlU7i1dO48kXp56pviKzdwZjuX9kQnfNBlNUnr1tSKK2ChOdrHLbjI
+V5sh1lFi+aM+SaZPMKAGVHW7KWzaXsVyJ/Uyg4xX3xEiFdfdqBDCke7Ek20klOQA
-r+Ka0wE9T2sFqAEoylCHfJjF52af3nS0zFwIa2MNuHEOpLOPhRSH8FLOYF1ow4To
+bhHzPz2UgbUxpUHJJLwsq47NHywLQLJQTmSPQEa7vJOSO3BQRqDEnGoVZP1BG4MC
-mqi39LUfqo6et/llWhHb3hYOw43ur29DGxnfzcXJeNOMqegGjGPHUD5j2Jb0ea5G
+mdQDW4RYaJqJGnHBwes8+OAJs5KmgDms+4nnjhmzJhxuCNEr7ZAG02Sbq4MdNvc1
-KXxQx7GnGKCiJj625YJkE/+8TyQB+9IjhIYdLlMQcASxb6E0JpG3uMmEluZlnEMw
+urhZIHzha4bVGP4eiDkpW6syxrT8qUMKUjsWdk1a9QEXw5JsBoNgUIHWQsReBDCK
-5sSBF5TxGk2TPyCB1WwpCM5RkLWn3oDQJQ7pjwYJml8
+gGpLjpJXDfqPdCwYkoZFPElOt0/iSK8LcJEvvig7+i0
 -> ssh-rsa QHr3/A
-L2M9zi5qFuEeUlsePVcAaTJCJg55ObpS0Q9APHtDdVvxJvKaGCpLaZ1ms6ecWSiA
+cdMAZp8BYgJl/obn5eAnxxzhrF8Y/Ch71Mtyvq7WYzoL5FNVXMA86lFroiPlmJnn
-HHIAGCWqwBEnWMJ53ralQLLMFXodLV9zyw5d6ZkWM4eRoxMiKFk4FZjQGcVVqIPO
+JmXc3Vea7DCwMKeTZKWWkw2QJbxayPzbAEr7MjoiwBr0UaZT+kI3k0ptsRKabQQz
-EGESFswc9MGfpgGnWJsHt3v94xLMshQVLK0Kmt8HXbXoBu3gcKcRgrqp3kyjgABp
+4z9Ejo31hIoyTK1hJww2e9gdxmR7fDyqaZVOHIrz7hI/c3e1S/WOK8C3L0I29rGc
-ttHuFG353d5TGIBAxJMboo9znMkZph2KmS8Y7BsXR+tYlZJpSI8+WGLWy2YniMke
+seORt5Mr6Yc1AC922m6n83vNBXztX8qbK/qTsX8r7O5RYhjCjzwm7Pb9OfEvY7zB
-h7Dgbdzg5nm5cE+/dxR1S+Vl1alN913fdmEXv8tmO+MtJiAkDMkszDJaRjZCMWZk
+ODsYy9Z1zUCjTWnwMruCd5KEig7m0NO5mJqzZBjNRL89NW7YogLtoa7kzMH+PQiR
-YeQnvdm3tuHKoaMFBKMZJqbs921X4LJTKbHDLpzDetK27sscrwMQYzWAh+eNKNWf
+oAcPviDRzF+FjxU69CWy8Ri1amIiEsU5VGsi0K1r71oy4TmecppMvv3w06DZAS8r
-kjE8BrkFUV84+Ds513dMW9pPOEDMfFfqx5PhT4yLzCuXq5o3nBCBtvW1TpoOUqge
+5T0Ld9hbxcFMttrSQAxFfkWLLQVNjQyXc/zCRZkvnPS92Zl/2O6xZsvDxtc5Um2j
-vnfFludmPSFJvIqbmzIjKHuSt3XpIiTLeYguwqrxSanzKZbbS8++/NvwmSghtVHK
+kX74hPPPwPV6TQVL5wNLWMVY7+LeDvT2hA+wS5Svu/5GF+j6Tv1kcLWimIWpJo5K
-vUythwF7eRzDWndnbjcR8kXyteo1lAnAHhdmdRjwzr0deIBinvgP0LOV9ElRLCP6
+PcrLVrjiey3CHbYhVLKL48GvZhqDaQRH0ZRMTyVV5ImmHKoLXc+q5luzlhvxLr9/
-z/q+hsVD1+UIwSdULDdMFiW/CMSUQGE0oidw3U0kh3qRmdH2m0cxkZ5fSApWTOwc
+D6SEswLF1NGe8yKbYqyMPGNq/fq4f0vkve6oOHpki9JUbEFjTxdx7TAuvv+8M3LK
-+zmVCTUDE1h/Y+4G7JXXDlb8PtnysVdTr1/47YIhwRE
+G4I+PskKPQj34JVuXw1iExiVaFEJjy0c0dHN+SjGkzQ
-> ssh-ed25519 q+UPnA lqv3fHLSCUTbUwTe6N5ihb3a0tUQ3qrZBBsop49mxgA
+-> ssh-ed25519 q+UPnA +7fHwrNggu9vzPM3vQK5cbdCLelxsNUJ85D8vCobYyE
-fG4fN8kI6MD/i5mCHADm7jNqglSG7nMqzFjI15FZ96I
+8mZi1U3FILP+EfPY3K8e1PkuNaVvUbJQjqkuQomIR7M
-> WR-grease <5+*; m 7D<Prg:3 tgs"fJ
+-> 6-grease e|$xV qX>Rrgov
-4rQ4IUaNDOB33eGjOA
+gKP44D/7tVOkXrGziZ6D+m3mPaVCgw7DIl44weoUUA
--- Z07MbLdDSKMndkjs+haEeNtm9YOdKzIhg4m6SPbRJPY
+--- 7p7pF0thwJb95BBtme+6i+MgiaqHFnhMs34eksYYJEE
-Dd&“’¿R‡ê¹©ÛÚœ; ÔèÔœ¾o;)<29>O ìàaô åQKœ–äq(oãýôcŠ=¹-!®òºîÌæ¢’PÅÂLýŒ‹Ï½¹û–O1÷dê%·Ì–?B
+ÇÌ…R èeZ"Úêö7Ì•|ÙâŒÿœ‘ð†þn’9urçïÓæ¥©aÁxìŽ"/¦#·üº_¨"
 ½¼1§Nøò‰úSXL°A<C2B0>d<EFBFBD>¼Èˆ+2$UA<55>Àu_:–
--- a/secrets/magit-forge-github-token.age
+++ b/secrets/magit-forge-github-token.age
--- a/secrets/minio-credentials.age
+++ b/secrets/minio-credentials.age
@ -1,32 +1,31 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-Zs2jQaKSf2/HlFrjlEZ+n57jQl2+E+zORJ0Q/7N31+Zmz1bG1T/lSVBwtGQ0DrnJ
+d2aEWj4npgkE/IvgEkcXdXbVtRqC6d6mdcoNgLIupoCCA2zEQFZ2WaxrKCBASDYV
-UX0+u3/BivHh8754DEw/jvB2gqe3Kmnnuyh40UfDw8Mp1q2n4DJfi+GUYui4Th4E
+6LDYNKKxqOKMUv3gj8rbkgXYlBMDpKvScS10x/ae0mWrJx/zKqHdvnebzGFuxVVl
-OGxjSVwZXgtk2/nipuuuoAEdh7coJ8fSsvlxvIvTF8QUWmtTjlrL5yAZzN29UVVz
+xwEf5auZVoBfc2yP444GbjNabLUZ6mwWWkTPy+yPsEIriAiglLSUiMnRa+SPXdA9
-OQgo/NQ/LMKjxNYAmFgHlxqKLeczJ9mCkYxsloEx6DFFGyWNIU6Sudg2Km4UCdET
+joW3EgN/gZ3j4GrS0jU6as2T3mPT/ROAXsClgcBwOveZy9hle2f9JkaYrmqjaiw
-i17A4b+1vmjmEuMQMTGbl0ziUnQjVSxqNxt37NA79MKg8nWfYb/MPSTesl4hww3e
+f72vjAm/dMaDCO9LBrArF0ZuVVpyDstN22/+vLjuXYmcL1FQF/8GF2wn+lsXFglg
-idjlZhm1Z3IABbH35KY3ksBgEbOcq1ATK3Q2yhMK3cO4Moc9gkMCuGk3z1a1lRDJ
+Nu5H3TA5yNOlT+V/K0UPUSWqvEIjBpLQddLeLwQl5tY3oFB1MtxUZNpPYN/CCKhG
-ZWLiDHcf5FUO5FqpRJ1EC4tzzDZgz2e9VX5GX49i2LP/AU70FTjD+dykH9ysfWo2
+olWtxorV7yDax5x7mVx8wMFDJg9wJFtr3ATAf6gKCYm8YiCiOuz8wcQOz2+K9fq5
-38iek8O0+prCnXjvpksOgnNx+Y0U82rxplILGU71Qf30Tl7rjkMDZaBcWLqJHR5I
+5XFujxk1aJHH0qro7x8R1T1IyymUeZiDXNeh0isryyyIxrC7i/cYQzmKPiFOeZP5
-M5hAeotYH9K/6Abo9JPv3vPFn0f0A14qpyN8CQZXJOSAaBw1Gv4cj0636ePN0eyl
+Hr/sz/ZRGfeeCOVcQPoINTmoJhsTNLtm9lh5KP6s21HkIjIuSYPVwUhqcdBj2cGv
-TECuxVx5TsvnRE5uvOzFvBChh3S5f8rd+qSGCSXGTow/XXIxs5NOXiU/70De+MDS
+jSlO8w/k/7pdWFjo2gyyCQrkrspJXUdQtvC/tRF8Y4l3MFBeEJK0yjw0mLYchU08
-d1K+wS8+ARoIXwKIGOHmfJlo6WXFRK/hg1Px2M11B/Y
+yR4a8izLcQcR04FTGH5Op7AenkZAFesbSbiB7791Jzw
 -> ssh-rsa QHr3/A
-B8+y8HLrePDMPu2oefwJ6toq3AjKXpEhttv/g5dBTIiwdDEUGKOB8Zvt1nikMrYk
+J12bjPI8LqKrlOK4g8lkR3knip6Cn6UOJViZkkyI+OffFQ/NRwUcVUasSwkF+eVw
-p3FdwKPcvedHzZdTKw61stoONuXXl8FZzK82Q93IZNmLBg5wU6fnU9LTetMRz5zR
+u92vfKhywa4nx4GVPyLxUWe0Xb1qV9A983tib2995muldVRMT2Wpre2KgzCh6UpD
-gC81UoeOz8V3l8IKF1R5PfmGeD9SWrbeTWkY8Rd8C4xHhGtiKEYTzmOQ9bcX3X21
+3gP8nAO4EW0fz7Ww+h+jPYHt0LWK47IDshT1FwPGy7V+8VG66HpSHMtYctnvZKva
-KMCq7rgSf2LRxInuxZA8ZNC3W1zpvT4unzDhCskFBYEvEXVNQnHnTSYb7IgC4Bp2
+CEfzvWQoOBjlHQblz8pclcWlG/jxxrxatQrBaEvAio4KrssVntirRqmyFxWxiC5d
-F1ZpMbUCzwXweLS3ptTe163sArAQkKIM3t5QeCcz2z8taZYtyGU4bqdG10bSY/Ka
+GTPbiVA9x/xl3MqnyO/ofX5pSe0Mr8rEQe2OfeDCnRb0T9eO1bZtzG3BnJ3T4+er
-OkDwbqrCA9swQ8yt6FwgOTqb04TSIJNseeHMuNOLBVuN+309qwf2q5r6lpmAYbNM
+od02By7ajSUQre2cGoY3gz3tEsKWdK//9swJFcHJSNSBqqsvUmdHXodAHGpkGu9V
-UeinaQJ6B+44hMdPcqKarnSL5EG5HrqiiWvpBU2nQn5W5e/gucAUMONqKF/0tZwd
+yS1aBaHgHyDI3sfGEdu/D1vZJNUuikmdkMl4Z8QKeWW0GP3bWBZdhAdtyxKzEFcE
-NV2G/AYbx/mLBm4/p2qLrJIddIt6Op7fksXAAHHIQ2jsVG8HadSJIHd0AVISRqSd
+ViR3PbbYKbTcDKVipBffjeSePd8+/VfUKDCjjhmFdZ22xAGKndZX7lISCJ7uYqXN
-R1EyqT7luMy2hROBVnTPL1Fjs/2hOZoD/wA0ZkMLGljTxiZ6i314eGPimA+cbxxo
+zhfyRopZaKqY/IhE/pCIPi7TmXC0yGUoIKyOxQrFD/GkHqKG+j+CJKAO6Y7qZM5p
-9ybKmNbSbaurCXC3hG/t4DWgym0BH0Uk6l8YiuOuEHRyHEX5gHEzZ8wjQwCg3cAx
+ayrjdv4tUdWblJGZYRZOjlWs01Lp02LMcAPCIOXV3eD7TC+C333uA9glZmjbTbDv
-/8KSv0bymLctCWV8iUt2y1Qv8IQqor0lkIVebo/38+Y
+OEmfcvc0ss9vhZ7tZ31Io502ClVdbUx7dtGRb35W9yE
-> ssh-ed25519 q+UPnA RPaq5TdvP7buLtOPxlQzeH/Eqxk13vPA4sIVInK5WQA
+-> ssh-ed25519 q+UPnA hsSbag2r725/VKNwdx4vPDMkaiRuQbWHG/QAuD657mk
-tXfhnUuoS7BdnjPRRugKf7c0Bt4Evi0UGLUnUzfFexs
+p/YvP++XCjkMSLl8wm7oNI6upbzSDbZbbMJ+LDcolp0
-> :-grease CoBX\K-B gLKAQ
+-> Gdq-grease hXFH xS(nR
-6Wj+TUNLcAC9nbijg9N1XASPCbBhx3AxkvV895eKH7Gb5GBJLmBAMzSnhtcVmauy
+q/a+u7PI5RAyoQJwqDffVWHvUQsmkFsprLOtOA/H63wl
-+Uy8golcLy7rJzntyD3sewTHkYNQQ/K+0hCWhSi9LsOoKZ2V/VvJJf4U8w
+--- Ajn3II823tsMjPBRfJ2NK3xQLo1RPZl0C+zS5QJexLc
--- CaYHlayrim3H+gF88uFPYe0oel/kzodvMvYGekQ1CfM
+kS{6/ť–ťÔúnŕŞPÚ®¦ŇîŇ¨M/ŞD$)°OÜ…@˘#{Ě˙Q‹6|rYĂ"…ęMç‚–Ő`mßŘu„#`ĆµŔä%íĐc"ĽôąÜ‘–<E28093><7F>
 GØÄíK¹gª€ òÕÕ¶Þ#•FÌ-Z$èqÌ@¼C¤í¾[Â.3Ü!J(ôÌ½Q»ø¸Iï£Š´â|9äœð "Ææö«š§ôe´Ðk4
--- a/secrets/mothership-wireguard-private-key.age
+++ b/secrets/mothership-wireguard-private-key.age
--- a/secrets/nextcloud-admin-pass.age
+++ b/secrets/nextcloud-admin-pass.age
@ -1,33 +1,31 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-WRVa7vfQdhcCIpCQG/jY5yYezpooSYlnRYW+aY/cpVTM4E+5pjV8S4IF1eJUdmzP
+BDKRWMTrI5RGLCFTn6qY1AtcNRxdDxXGZbA87sNa6jl/nG9nC4f1gwKJsMPtbT7L
-DwauI0E3iszN2n/3mNPAgBsTVtt3PCEsFkFxBGI7c+U21WSXRS+wMGtem4n8WngR
+A4Hi8fM2AIifX38xZ1zuJgoRpTeaxBRlDbpu5aqEppUH5NB4oduf+/rTsMVYK7tG
-bNgw+ctZwuMjgf1lN7CQUsZhXZ3elXOAVofeUiuZwI/tB7MriURj5WxRm9Xo3R1x
+OBkcgkBohbrnJpCRufXywNmfgD13WBSaBLcb/tHwIKXFmBXTumebXQRf04tDS/Z4
-x9F9oFLFXuCpna9wAHZ7z0UFBHASRbsgzVHjYSXn9LFNoqSsnH6aww3KW9SH6oBE
+sFrrA2ExbuR3m8LCsp+GYU3lwKxYMvta0zoIuFSofM+iMkwfUMDoFoTwK20moSnq
-TVqDbqy3K9oIlViKCHU6Ex2hWN5kXV5o8xTmqOg9nw598zXGKqKSXi13snbvwQUG
+uVSzTvpFrkxawbAs/g+Da4MN2E869Vm3f0dtN+sa5C/d+11uStbQPgp8kgJZCVaF
-d2MoSj7AXUVNDiimt2vpqdFdK8DvsnN9xDefQfy67FlMQ0zlERVUnaCviOlwJcun
+EkESOoyw+y7yAS0QTw4GAlBBKrOG34rWrXO+CPuZycQtKASM7y8cPk78eT+iOeEA
-MpOcPlwi4GtrQwKkm+7O7xSubigBMaC0JwGokfPT4efnX0ez+ETWRTXjcPINqfY5
+CgarwyxS+xrpd6a9OFutzv87CnCv5m0h9n3AhhdRHEavuARxe9XADJXnIfJubq72
-suk3nmczWN9NN02EtRXtCndTxOE+D8mooFwFKKVp//8E8EAuVstqa/JdDhyCwsN5
+lb3eCM/mzVtujjqRcxhI77biIkiCsiBS1Oj4eg5IkuNn0+fbmUAVc13pIDsTiEpH
-9VMQippe9ckx+UXABu12rLufDG5Y59QisEfph2tbTSozb1ptUeGCw8dpOvGsRBmC
+xqztkd+xVNv4yOhqbRq4g2GdRFdUfuAvDbRFLD0cy2VbOwZPf6NozpCaDofBJ+JY
-XrPD3c8OoH6bye5wPeq/xp17Nt9au6D+exL1qxi5PxbX2n2CsN0KnJCzU6v6e/36
+at2vCgQIjvYZF2+xiRZjQPubDDU0htrg0dQiu0eFRmvCfDH9Vqp/zkRWwGeEktp9
-n80u8PD6HpraYJnSUxTbukZTOPahl9deOTmXIauVSws
+jGgB/1XhOrydYkUnUA53FUS56FiiiulAJotm2zDyoiI
 -> ssh-rsa QHr3/A
-QhEooc6477s/+A6xM7I+1CTGaeXSG4Av8eTEQSyJd4MckWVSoJuSG9BOEHm/XGFC
+FxaX/2SaXm7GaC11m6+kYAtAdy+ijZOJ4pOEut+yS0Q4Zx2PBelVjv0tVyHk1pjx
-3zkbSZ0nmrVLYTS4yYO2wA7hKzGtQcsInctS09xb1ERbNOMoBVCh6Lw1yIqry/TE
+Z0KG3oSJpJGTyLoQsy6cT+BbedN/lnHCSu9k+so7OzQIwa6obpSwSdQmMS79lxBf
-9erNDXRMIt37I7adSfpmljOrlufWs5nE5AoIAwzBIjkOUakvXeJ9dilguQBCUpyt
+IJB7tEJd/qN5e9Yv9W+e2n0ORD7EUwpAuTqK2Eyss52cBSENq76cA3rOZRk2X/Pf
-dhVUeNzRt/sOy+yfIf026Ys+OXp2e8JBgKBDqW8JuzyvhCyBkmhXLF1EJfiMk4ff
+4u0qDY+F5fXHcoDkrNI485UXUlM6RGR3oV/Qkuw01RX7McqjW/zlj6MwSkCSAcl8
-S7tvPu8gQ0uMJZpiM0AlMb6Xlz1onGoPFNOozJGYJYzEQh36CUF1aS9iEFiuSg5H
+i76LtrVMVc04EMB0LStxuuFQjv3wM7pX0DHRQrr2H4lTb0bgUX7K8Md3q1B5rpgv
-7y44DoLJt9z+C9erXJXlGnw8jL4Ux3TLtFNU146n7T+ZU/hRuWv0UhxGHxUmmaUa
+lpKrywM+CCJMtKS6JObEsKEstWQkEBQOlbWbVGSp9MPZ29c2oXkE3xCRIOUp1OUP
-o3Ho6WrhR88CPTOdskJpajj2qRNpeF+B8DMi8xDq9YaIjleLFFAQ3Ui8dzZXWKhP
+UI9g7jCeqQ8L4B+is4XyYr2QX48NGneJ5ypkVrqVn/EqStIZu/yG08GAmxZWdhk8
-qFLcgKIobw3h8MHxweN8JDUUfN5l4T1S1oGcX/QJkCCHPGIv3y4OgY22D2pzSXCV
+2eihJLRZdhgae2IXv3LkzI3M6QrWQeniGXarTCFgAunt4XHyMbOUiE2leBrNgk8t
-oBfdUKHORH9epxnxB1YYaMXmzbX4t+aTLZ6LsZnOrGgepjxxiYJ+LzwtYCK10+77
+qiEm4NtoMg8hrE8kt8DHiC0uCZ1g2SSqOry1uq+jaRw1idPzMAYHyvZAW/FYFImV
-UVvVrqrZJ/8hyOZ1Q9E7mj15DsF96R+oQ6OnzfRCRgDqmqrvuu6VDO1bzHaxzeWK
+rzmKirgp0dBRLpDwjtE6TRdU+gakNy5OtMOs/vFGZOOHOj+LcgFaTrZJQK6V+sMR
-FH8n/fZkOQdhtiLssRRxeg1/yg1j0Jf819vEKR9xYKw
+nQtTF4Bm3/pZbgR4uXJqvVk5qg2abzuYXCprVHder5c
-> ssh-ed25519 OgJHCw 5C9AOJ3b1AfhPc4zDf18vYA3N54IZVR6mcKtB6UgcSA
+-> ssh-ed25519 OgJHCw Nqz70nETE9uynpyO6jTMJ466hm36zrl8ItT7KZ05KyY
-bDBm2Q1HiSR2YtAmB7IUmajmywSHuG4jz8BFc4wS9+4
+d8ZiZDYqiPm89xm9Fd2hgvYVcIGipdaW9ckOSB3o1Us
-> 5J-grease wc>$i? ]N%>$= 6RgSs
+-> >{?QA-grease
-bKCTIwWP8ej2mGqr/4s0UcsHRyvARv003U7DqLJ0WZNGGxQQ7PYSddebre9DXgae
+lkNoctWemnxfIQL8IhowM/3v+W1CoA
-MQT0X+5X+yq2vHfgxoNcuyjqbX2cYtWPOj1d/ujIbMyD3IcCyCZY7yx1n8lqiHVK
+--- NMP6qWoC1k1sT/SP8WOu4+RKR7fySE6euMlrIEi0+7I
-9Q
+©ë¾“Î·gzŽ4&êÇô1ãh³Öävïà ¦ÄÏìCõŸaä
 --- nYnhVy/qVe8B3n0KO0V5O+OiyZ+AwvVwwZ8xUeENlV8
 OÚ^f3KišÜ½ý‘Þþz¾y€™K± #sÇ	?¾Ý3Pª<15>Ü¨
--- a/secrets/picard-wireguard-private-key.age
+++ b/secrets/picard-wireguard-private-key.age
--- a/secrets/sisko-wireguard-private-key.age
+++ b/secrets/sisko-wireguard-private-key.age