Enable tor-browser, monero and kicad for picard

Enable emails for forgejo
Fix home-assistant packaging tuya-device-sharing-sdk
2024-03-14 19:10:59 +01:00 · 2024-03-14 19:10:09 +01:00 · 2024-03-14 19:09:46 +01:00 · 2024-03-14 19:09:31 +01:00 · 2024-03-14 19:09:16 +01:00 · 2024-03-14 19:09:03 +01:00
62 changed files with 1301 additions and 575 deletions
--- a/flake.lock
+++ b/flake.lock
@ -8,11 +8,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1703433843,
-        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
+        "lastModified": 1707830867,
+        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
+        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
        "type": "github"
      },
      "original": {
@ -33,20 +33,21 @@
        "extra-package-notmuch-notify": "extra-package-notmuch-notify",
        "flake-parts": "flake-parts",
        "hercules-ci-effects": "hercules-ci-effects",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": [
+          "ccrEmacs",
+          "emacs-overlay",
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1706523465,
-        "narHash": "sha256-AKlrSRyoMLRUlN2fGWSWWr1nj46JUgjWDPAG/CdPZhQ=",
-        "owner": "aciceri",
-        "repo": "emacs",
-        "rev": "9ad27b6ea82ebaa3dfd635ccc0ce618d9a5ec006",
-        "type": "github"
+        "lastModified": 1710278059,
+        "narHash": "sha256-OMmXmA4sDBxxhZBdV0BUr7/x8lRZiSsmJ1YmIOb3k44=",
+        "path": "/home/ccr/.config/emacs",
+        "type": "path"
      },
      "original": {
-        "owner": "aciceri",
-        "repo": "emacs",
-        "type": "github"
+        "id": "ccrEmacs",
+        "type": "indirect"
      }
    },
    "darwin": {
@ -78,11 +79,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1706491084,
-        "narHash": "sha256-eaEv+orTmr2arXpoE4aFZQMVPOYXCBEbLgK22kOtkhs=",
+        "lastModified": 1710169806,
+        "narHash": "sha256-HeWFrRuHpnAiPmIr26OKl2g142HuGerwoO/XtW53pcI=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "f67ba6552845ea5d7f596a24d57c33a8a9dc8de9",
+        "rev": "fe064a639319ed61cdf12b8f6eded9523abcc498",
        "type": "github"
      },
      "original": {
@ -93,16 +94,16 @@
    },
    "dream2nix": {
      "inputs": {
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_4",
        "purescript-overlay": "purescript-overlay",
        "pyproject-nix": "pyproject-nix"
      },
      "locked": {
-        "lastModified": 1706083796,
-        "narHash": "sha256-tDmoPA3gukJPfjR/pKl6hNcRP7cuEGw6ruoguHS4szo=",
+        "lastModified": 1710268378,
+        "narHash": "sha256-O61PtxUHbmwI6Ltjn9jY3QY2hRPPz7pe3BHhIYK4QkU=",
        "owner": "nix-community",
        "repo": "dream2nix",
-        "rev": "16f2c654c6673a2b72225c81fb73af830139e33c",
+        "rev": "cd782df677aad08f7193c97376d615943c3cd4c9",
        "type": "github"
      },
      "original": {
@ -118,11 +119,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1706519192,
-        "narHash": "sha256-xnlbEJxtRR6hjmRJopRe2TBAWIvEB/S/w1V6613u9Nk=",
+        "lastModified": 1710061621,
+        "narHash": "sha256-C9+Yw5pxK1+0a5KxMoKocVZOfkj+V/6TSHasS2h6Zgg=",
        "owner": "nix-community",
        "repo": "emacs-overlay",
-        "rev": "380a2b909774bc47385dfa9556f28f243ea87c71",
+        "rev": "1cdd60ae31faea0bc68251429f64589978415b4b",
        "type": "github"
      },
      "original": {
@ -166,11 +167,11 @@
    "extra-package-combobulate": {
      "flake": false,
      "locked": {
-        "lastModified": 1695673560,
-        "narHash": "sha256-oLxJfHN50GWlXZYmZP7ZGqyvwEG3h0HreLAfBqoWfBg=",
+        "lastModified": 1709362419,
+        "narHash": "sha256-LDjwiDlEIpWVxLFi8Cay1P3LNh1pl4GC17lNKK7QTyo=",
        "owner": "mickeynp",
        "repo": "combobulate",
-        "rev": "c7e4670a3047c0b58dff3746577a5c8e5832cfba",
+        "rev": "abc2be2a47edd2d108ce0dbe1d11e0cd2fe6796d",
        "type": "github"
      },
      "original": {
@ -182,28 +183,27 @@
    "extra-package-copilot": {
      "flake": false,
      "locked": {
-        "lastModified": 1704184504,
-        "narHash": "sha256-Vt+3OZM89dyLKjFnODWNHLDwrURXAtY5MFugyfEMbho=",
+        "lastModified": 1709987182,
+        "narHash": "sha256-BLIyJ9z4yI2Iv5eqrmULJ5VXoGnlXSVJx+5lVQyIoO8=",
        "owner": "zerolfx",
        "repo": "copilot.el",
-        "rev": "1542d76909636bf8804dd9c770f28818a897cfdc",
+        "rev": "4e203efaa1f4047c800a026ba496d3bda8b67119",
        "type": "github"
      },
      "original": {
        "owner": "zerolfx",
        "repo": "copilot.el",
-        "rev": "1542d76909636bf8804dd9c770f28818a897cfdc",
        "type": "github"
      }
    },
    "extra-package-indent-bars": {
      "flake": false,
      "locked": {
-        "lastModified": 1706410940,
-        "narHash": "sha256-8qi7RVjQvOJnt1ziBVPK7vQhlx93nRkomu8rEcW3Pp0=",
+        "lastModified": 1710117442,
+        "narHash": "sha256-0p3PW2hbzGeUIVkUWow6OWpL3OspbId+yqEPV909g4k=",
        "owner": "jdtsmith",
        "repo": "indent-bars",
-        "rev": "269774df6d5030832d04c5cf067d7a3a2568a46f",
+        "rev": "4583e3e9f507143cd4241131b77fc5e8b1722bbf",
        "type": "github"
      },
      "original": {
@ -282,11 +282,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1704982712,
-        "narHash": "sha256-2Ptt+9h8dczgle2Oo6z5ni5rt/uLMG47UFTR1ry/wgg=",
+        "lastModified": 1709336216,
+        "narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "07f6395285469419cf9d078f59b5b49993198c00",
+        "rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2",
        "type": "github"
      },
      "original": {
@ -324,11 +324,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1704982712,
-        "narHash": "sha256-2Ptt+9h8dczgle2Oo6z5ni5rt/uLMG47UFTR1ry/wgg=",
+        "lastModified": 1709336216,
+        "narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "07f6395285469419cf9d078f59b5b49993198c00",
+        "rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2",
        "type": "github"
      },
      "original": {
@ -361,6 +361,63 @@
      "inputs": {
        "nixpkgs-lib": "nixpkgs-lib_3"
      },
+      "locked": {
+        "lastModified": 1698882062,
+        "narHash": "sha256-HkhafUayIqxXyHH1X8d9RDl1M2CkFgZLjKD3MzabiEo=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "8c9fa2545007b49a5db5f650ae91f227672c3877",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_6": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_4"
+      },
+      "locked": {
+        "lastModified": 1701473968,
+        "narHash": "sha256-YcVE5emp1qQ8ieHUnxt1wCZCC3ZfAS+SRRWZ2TMda7E=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "34fed993f1674c8d06d58b37ce1e0fe5eebcb9f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_7": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixThePlanet",
+          "hercules-ci-effects",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1696343447,
+        "narHash": "sha256-B2xAZKLkkeRFG5XcHHSXXcP7To9Xzr59KXeZiRf4vdQ=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "c9afaba3dfa4085dbd2ccb38dfade5141e33d9d4",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-parts",
+        "type": "indirect"
+      }
+    },
+    "flake-parts_8": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_5"
+      },
      "locked": {
        "lastModified": 1678379998,
        "narHash": "sha256-TZdfNqftHhDuIFwBcN9MUThx5sQXCTeZk9je5byPKRw=",
@ -380,11 +437,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
        "type": "github"
      },
      "original": {
@ -416,11 +473,11 @@
        "nixpkgs-lib": "nixpkgs-lib_2"
      },
      "locked": {
-        "lastModified": 1706569497,
-        "narHash": "sha256-oixb0IDb5eZYw6BaVr/R/1pSoMh4rfJHkVnlgeRIeZs=",
+        "lastModified": 1709336216,
+        "narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "60c614008eed1d0383d21daac177a3e036192ed8",
+        "rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2",
        "type": "github"
      },
      "original": {
@ -470,14 +527,14 @@
      "inputs": {
        "flake-parts": "flake-parts_3",
        "haskell-flake": "haskell-flake",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
-        "lastModified": 1706307588,
-        "narHash": "sha256-t46dB7XCBwj2FOwhFWyMOfriGny1bEOgak24fylo5j4=",
+        "lastModified": 1709701475,
+        "narHash": "sha256-3hJ9jQD3hBlW0evtgPbafQs/lc2EKpknT3HpuRfIIqQ=",
        "owner": "hercules-ci",
        "repo": "hercules-ci-agent",
-        "rev": "f01ae96b022bb12d35d7223548a0b05623a55ddf",
+        "rev": "5ac8a664284001c49bd5ab30c2df20d9c6672e31",
        "type": "github"
      },
      "original": {
@ -492,11 +549,11 @@
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1704029560,
-        "narHash": "sha256-a4Iu7x1OP+uSYpqadOu8VCPY+MPF3+f6KIi+MAxlgyw=",
+        "lastModified": 1708547820,
+        "narHash": "sha256-xU/KC1PWqq5zL9dQ9wYhcdgxAwdeF/dJCLPH3PNZEBg=",
        "owner": "hercules-ci",
        "repo": "hercules-ci-effects",
-        "rev": "d5cbf433a6ae9cae05400189a8dbc6412a03ba16",
+        "rev": "0ca27bd58e4d5be3135a4bef66b582e57abe8f4a",
        "type": "github"
      },
      "original": {
@ -508,14 +565,33 @@
    "hercules-ci-effects_2": {
      "inputs": {
        "flake-parts": "flake-parts_4",
+        "nixpkgs": "nixpkgs_6"
+      },
+      "locked": {
+        "lastModified": 1710270110,
+        "narHash": "sha256-DSByMaY4UKPv7UhObH0GwJ2D0ay6CBqMWTRn4wcIb2s=",
+        "owner": "hercules-ci",
+        "repo": "hercules-ci-effects",
+        "rev": "3e81b3a33980f6596aafbe308abd78daea0bfa7d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "hercules-ci-effects",
+        "type": "github"
+      }
+    },
+    "hercules-ci-effects_3": {
+      "inputs": {
+        "flake-parts": "flake-parts_7",
        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
-        "lastModified": 1704029560,
-        "narHash": "sha256-a4Iu7x1OP+uSYpqadOu8VCPY+MPF3+f6KIi+MAxlgyw=",
+        "lastModified": 1701009247,
+        "narHash": "sha256-GuX16rzRze2y7CsewJLTV6qXkXWyEwp6VCZXi8HLruU=",
        "owner": "hercules-ci",
        "repo": "hercules-ci-effects",
-        "rev": "d5cbf433a6ae9cae05400189a8dbc6412a03ba16",
+        "rev": "31b6cd7569191bfcd0a548575b0e2ef953ed7d09",
        "type": "github"
      },
      "original": {
@ -552,11 +628,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1706473109,
-        "narHash": "sha256-iyuAvpKTsq2u23Cr07RcV5XlfKExrG8gRpF75hf1uVc=",
+        "lastModified": 1710273215,
+        "narHash": "sha256-AfVYEQIhOK6vaYVndgqFV4Vb5REXG9R0ylv83QInsT0=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "d634c3abafa454551f2083b054cd95c3f287be61",
+        "rev": "a500de54b2e3067201a40cefa5f210f719423ddf",
        "type": "github"
      },
      "original": {
@ -593,11 +669,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1693438012,
-        "narHash": "sha256-lna00DqThxBf8tPHK9MTvDpA1wMNwKzSKkZ2dWHEu+c=",
+        "lastModified": 1707140227,
+        "narHash": "sha256-jxBa7cOsmYFV14XOqKF87iIxrf966ARucllEoYRVmdE=",
        "owner": "rhoriguchi",
        "repo": "home-manager",
-        "rev": "095b525475e0ef0d5d5767014dc7755ce34963d9",
+        "rev": "cc5f4fcff60e4b8f3da3ca7743061130262603f2",
        "type": "github"
      },
      "original": {
@ -624,13 +700,79 @@
        "type": "github"
      }
    },
+    "nix-fast-build": {
+      "inputs": {
+        "flake-parts": "flake-parts_5",
+        "nixpkgs": [
+          "nixpkgsUnstable"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1709911523,
+        "narHash": "sha256-XNutwbRI6h57ybeKy0yYupfngWYcfcIqE0b0LgXnyxs=",
+        "owner": "Mic92",
+        "repo": "nix-fast-build",
+        "rev": "692fe3e98f36b60c678d637235271b57910a7f80",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "nix-fast-build",
+        "type": "github"
+      }
+    },
+    "nixDarwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgsUnstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1710255615,
+        "narHash": "sha256-DFooGP2D6cNfOj35qkptUgG0r+VxuI38QgNAoYxmVE0=",
+        "owner": "LnL7",
+        "repo": "nix-darwin",
+        "rev": "c7ae5dc969b93f3221f5c228f0ec3de3e2b8084e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "LnL7",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nixThePlanet": {
+      "inputs": {
+        "flake-parts": "flake-parts_6",
+        "hercules-ci-effects": "hercules-ci-effects_3",
+        "nixpkgs": [
+          "nixpkgsUnstable"
+        ],
+        "osx-kvm": "osx-kvm"
+      },
+      "locked": {
+        "lastModified": 1708168451,
+        "narHash": "sha256-loWlwexnfQGFsEHeJbXpWbnmeDFkBwZB38+4BkUcGhM=",
+        "owner": "aciceri",
+        "repo": "NixThePlanet",
+        "rev": "e8c91035d01f5082ccf30e351dcd993a5b480a72",
+        "type": "github"
+      },
+      "original": {
+        "owner": "aciceri",
+        "ref": "nix-in-darwin",
+        "repo": "NixThePlanet",
+        "type": "github"
+      }
+    },
    "nixosHardware": {
      "locked": {
-        "lastModified": 1706182238,
-        "narHash": "sha256-Ti7CerGydU7xyrP/ow85lHsOpf+XMx98kQnPoQCSi1g=",
+        "lastModified": 1710123225,
+        "narHash": "sha256-j3oWlxRZxB7cFsgEntpH3rosjFHRkAo/dhX9H3OfxtY=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "f84eaffc35d1a655e84749228cde19922fcf55f1",
+        "rev": "ad2fd7b978d5e462048729a6c635c45d3d33c9ba",
        "type": "github"
      },
      "original": {
@ -674,11 +816,11 @@
    "nixpkgs-lib": {
      "locked": {
        "dir": "lib",
-        "lastModified": 1703961334,
-        "narHash": "sha256-M1mV/Cq+pgjk0rt6VxoyyD+O8cOUiai8t9Q6Yyq4noY=",
+        "lastModified": 1709237383,
+        "narHash": "sha256-cy6ArO4k5qTx+l5o+0mL9f5fa86tYUX3ozE1S+Txlds=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b0d36bd0a420ecee3bc916c91886caca87c894e9",
+        "rev": "1536926ef5621b09bba54035ae2bb6d806d72ac8",
        "type": "github"
      },
      "original": {
@ -692,11 +834,11 @@
    "nixpkgs-lib_2": {
      "locked": {
        "dir": "lib",
-        "lastModified": 1703961334,
-        "narHash": "sha256-M1mV/Cq+pgjk0rt6VxoyyD+O8cOUiai8t9Q6Yyq4noY=",
+        "lastModified": 1709237383,
+        "narHash": "sha256-cy6ArO4k5qTx+l5o+0mL9f5fa86tYUX3ozE1S+Txlds=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b0d36bd0a420ecee3bc916c91886caca87c894e9",
+        "rev": "1536926ef5621b09bba54035ae2bb6d806d72ac8",
        "type": "github"
      },
      "original": {
@ -708,6 +850,42 @@
      }
    },
    "nixpkgs-lib_3": {
+      "locked": {
+        "dir": "lib",
+        "lastModified": 1698611440,
+        "narHash": "sha256-jPjHjrerhYDy3q9+s5EAsuhyhuknNfowY6yt6pjn9pc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0cbe9f69c234a7700596e943bfae7ef27a31b735",
+        "type": "github"
+      },
+      "original": {
+        "dir": "lib",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_4": {
+      "locked": {
+        "dir": "lib",
+        "lastModified": 1701253981,
+        "narHash": "sha256-ztaDIyZ7HrTAfEEUt9AtTDNoCYxUdSd6NrRHaYOIxtk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e92039b55bcd58469325ded85d4f58dd5a4eaf58",
+        "type": "github"
+      },
+      "original": {
+        "dir": "lib",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_5": {
      "locked": {
        "dir": "lib",
        "lastModified": 1678375444,
@ -727,11 +905,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1706373441,
-        "narHash": "sha256-S1hbgNbVYhuY2L05OANWqmRzj4cElcbLuIkXTb69xkk=",
+        "lastModified": 1710021367,
+        "narHash": "sha256-FuMVdWqXMT38u1lcySYyv93A7B8wU0EGzUr4t4jQu8g=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "56911ef3403a9318b7621ce745f5452fb9ef6867",
+        "rev": "b94a96839afcc56de3551aa7472b8d9a3e77e05d",
        "type": "github"
      },
      "original": {
@ -743,11 +921,11 @@
    },
    "nixpkgsStable": {
      "locked": {
-        "lastModified": 1706515015,
-        "narHash": "sha256-eFfY5A7wlYy3jD/75lx6IJRueg4noE+jowl0a8lIlVo=",
+        "lastModified": 1710162809,
+        "narHash": "sha256-i2R2bcnQp+85de67yjgZVvJhd6rRnJbSYNpGmB6Leb8=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "f4a8d6d5324c327dcc2d863eb7f3cc06ad630df4",
+        "rev": "ddcd7598b2184008c97e6c9c6a21c5f37590b8d2",
        "type": "github"
      },
      "original": {
@ -759,11 +937,11 @@
    },
    "nixpkgsUnstable": {
      "locked": {
-        "lastModified": 1706371002,
-        "narHash": "sha256-dwuorKimqSYgyu8Cw6ncKhyQjUDOyuXoxDTVmAXq88s=",
+        "lastModified": 1709961763,
+        "narHash": "sha256-6H95HGJHhEZtyYA3rIQpvamMKAGoa8Yh2rFV29QnuGw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "c002c6aa977ad22c60398daaa9be52f2203d0006",
+        "rev": "3030f185ba6a4bf4f18b87f345f104e6a6961f34",
        "type": "github"
      },
      "original": {
@ -773,13 +951,29 @@
        "type": "github"
      }
    },
-    "nixpkgs_2": {
+    "nixpkgsUnstableForSisko": {
      "locked": {
-        "lastModified": 1706191920,
-        "narHash": "sha256-eLihrZAPZX0R6RyM5fYAWeKVNuQPYjAkCUBr+JNvtdE=",
+        "lastModified": 1708475490,
+        "narHash": "sha256-g1v0TsWBQPX97ziznfJdWhgMyMGtoBFs102xSYO4syU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ae5c332cbb5827f6b1f02572496b141021de335f",
+        "rev": "0e74ca98a74bc7270d28838369593635a5db3260",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0e74ca98a74bc7270d28838369593635a5db3260",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1709703039,
+        "narHash": "sha256-6hqgQ8OK6gsMu1VtcGKBxKQInRLHtzulDo9Z5jxHEFY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9df3e30ce24fd28c7b3e2de0d986769db5d6225d",
        "type": "github"
      },
      "original": {
@ -807,27 +1001,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1706191920,
-        "narHash": "sha256-eLihrZAPZX0R6RyM5fYAWeKVNuQPYjAkCUBr+JNvtdE=",
+        "lastModified": 1710252211,
+        "narHash": "sha256-hQChQpB4LDBaSrNlD6DPLhU9T+R6oyxMCg2V+S7Y1jg=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ae5c332cbb5827f6b1f02572496b141021de335f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1702272962,
-        "narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
+        "rev": "7eeacecff44e05a9fd61b9e03836b66ecde8a525",
        "type": "github"
      },
      "original": {
@ -837,13 +1015,29 @@
        "type": "github"
      }
    },
-    "nixpkgs_6": {
+    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1705856552,
-        "narHash": "sha256-JXfnuEf5Yd6bhMs/uvM67/joxYKoysyE3M2k6T3eWbg=",
+        "lastModified": 1709479366,
+        "narHash": "sha256-n6F0n8UV6lnTZbYPl1A9q1BS0p4hduAv1mGAP17CVd0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "612f97239e2cc474c13c9dafa0df378058c5ad8d",
+        "rev": "b8697e57f10292a6165a20f03d2f42920dfaf973",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1703637592,
+        "narHash": "sha256-8MXjxU0RfFfzl57Zy3OfXCITS0qWDNLzlBAdwxGZwfY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "cfc3698c31b1fb9cdcf10f36c9643460264d0ca8",
        "type": "github"
      },
      "original": {
@ -855,11 +1049,11 @@
    },
    "nixpkgs_7": {
      "locked": {
-        "lastModified": 1703637592,
-        "narHash": "sha256-8MXjxU0RfFfzl57Zy3OfXCITS0qWDNLzlBAdwxGZwfY=",
+        "lastModified": 1697723726,
+        "narHash": "sha256-SaTWPkI8a5xSHX/rrKzUe+/uVNy6zCGMXgoeMb7T9rg=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "cfc3698c31b1fb9cdcf10f36c9643460264d0ca8",
+        "rev": "7c9cc5a6e5d38010801741ac830a3f8fd667a7a0",
        "type": "github"
      },
      "original": {
@ -887,11 +1081,11 @@
    },
    "nur": {
      "locked": {
-        "lastModified": 1706643926,
-        "narHash": "sha256-GOBRsUCZ3a9GgaLvbm2wpmsnZGY41IvEp9C3rQLXaTI=",
+        "lastModified": 1710276687,
+        "narHash": "sha256-S53VF0PA1pTz87oi3NKID7BnOqUFrKOflLXA/9DL46M=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "68b210c7240de86b3639cf9542df9dcb9c504914",
+        "rev": "b221a8e8493458bf33a754d86970bc656fdc43cc",
        "type": "github"
      },
      "original": {
@ -900,6 +1094,22 @@
        "type": "github"
      }
    },
+    "osx-kvm": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1701316418,
+        "narHash": "sha256-Sk8LYhFovoMX1ln7DWYArJQphW2a4h8Xg7/ZEZXwZv4=",
+        "owner": "kholia",
+        "repo": "OSX-KVM",
+        "rev": "09daff670a7eb9ff616073df329586c5995623a9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kholia",
+        "repo": "OSX-KVM",
+        "type": "github"
+      }
+    },
    "panfork": {
      "flake": false,
      "locked": {
@ -929,11 +1139,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1706424699,
-        "narHash": "sha256-Q3RBuOpZNH2eFA1e+IHgZLAOqDD9SKhJ/sszrL8bQD4=",
+        "lastModified": 1708018599,
+        "narHash": "sha256-M+Ng6+SePmA8g06CmUZWi1AjG2tFBX9WCXElBHEKnyM=",
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
-        "rev": "7c54e08a689b53c8a1e5d70169f2ec9e2a68ffaf",
+        "rev": "5df5a70ad7575f6601d91f0efec95dd9bc619431",
        "type": "github"
      },
      "original": {
@ -984,13 +1194,13 @@
    "rock5b": {
      "inputs": {
        "fan-control": "fan-control",
-        "flake-parts": "flake-parts_5",
+        "flake-parts": "flake-parts_8",
        "kernel-src": "kernel-src",
        "nixpkgs": "nixpkgs_8",
        "nixpkgs-kernel": "nixpkgs-kernel",
        "panfork": "panfork",
        "tow-boot": "tow-boot",
-        "treefmt-nix": "treefmt-nix"
+        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
        "lastModified": 1685695782,
@ -1018,13 +1228,17 @@
        "homeManager": "homeManager",
        "homeManagerGitWorkspace": "homeManagerGitWorkspace",
        "homeManagerSwayNC": "homeManagerSwayNC",
+        "nix-fast-build": "nix-fast-build",
+        "nixDarwin": "nixDarwin",
+        "nixThePlanet": "nixThePlanet",
        "nixosHardware": "nixosHardware",
        "nixpkgsStable": "nixpkgsStable",
        "nixpkgsUnstable": "nixpkgsUnstable",
+        "nixpkgsUnstableForSisko": "nixpkgsUnstableForSisko",
        "nur": "nur",
        "pre-commit-hooks": "pre-commit-hooks",
        "rock5b": "rock5b",
-        "treefmt-nix": "treefmt-nix_2"
+        "treefmt-nix": "treefmt-nix_3"
      }
    },
    "slimlock": {
@ -1112,6 +1326,27 @@
      }
    },
    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-fast-build",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1698438538,
+        "narHash": "sha256-AWxaKTDL3MtxaVTVU5lYBvSnlspOS0Fjt8GxBgnU0Do=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "5deb8dc125a9f83b65ca86cf0c8167c46593e0b1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
      "inputs": {
        "nixpkgs": [
          "rock5b",
@ -1132,18 +1367,18 @@
        "type": "github"
      }
    },
-    "treefmt-nix_2": {
+    "treefmt-nix_3": {
      "inputs": {
        "nixpkgs": [
          "nixpkgsUnstable"
        ]
      },
      "locked": {
-        "lastModified": 1706462057,
-        "narHash": "sha256-7dG1D4iqqt0bEbBqUWk6lZiSqqwwAO0Hd1L5opVyhNM=",
+        "lastModified": 1710278050,
+        "narHash": "sha256-Oc6BP7soXqb8itlHI8UKkdf3V9GeJpa1S39SR5+HJys=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "c6153c2a3ff4c38d231e3ae99af29b87f1df5901",
+        "rev": "35791f76524086ab4b785a33e4abbedfda64bd22",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -4,6 +4,7 @@
  inputs = {
    flakeParts.url = "github:hercules-ci/flake-parts";
    nixpkgsUnstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgsUnstableForSisko.url = "github:NixOS/nixpkgs/0e74ca98a74bc7270d28838369593635a5db3260";
    nixpkgsStable.url = "github:NixOS/nixpkgs/nixos-23.11";
    nixosHardware.url = "github:NixOS/nixos-hardware";
    homeManager = {
@ -34,9 +35,7 @@
    nur.url = "github:nix-community/NUR";
    agenix.url = "github:ryantm/agenix";
    rock5b.url = "github:aciceri/rock5b-nixos";
-    # ccrEmacs.url = "ccrEmacs";
-    ccrEmacs.url = "github:aciceri/emacs";
-    # ccrEmacs.url = "/home/ccr/.config/emacs";
+    ccrEmacs.url = "ccrEmacs";
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgsUnstable";
@ -44,6 +43,18 @@
    hercules-ci-effects.url = "github:hercules-ci/hercules-ci-effects";
    dream2nix.url = "github:nix-community/dream2nix";
    hercules-ci-agent.url = "github:hercules-ci/hercules-ci-agent";
+    nix-fast-build = {
+      url = "github:Mic92/nix-fast-build";
+      inputs.nixpkgs.follows = "nixpkgsUnstable";
+    };
+    nixThePlanet = {
+      url = "github:aciceri/NixThePlanet/nix-in-darwin";
+      inputs.nixpkgs.follows = "nixpkgsUnstable";
+    };
+    nixDarwin = {
+      url = "github:LnL7/nix-darwin";
+      inputs.nixpkgs.follows = "nixpkgsUnstable";
+    };
  };

  outputs = inputs @ {flakeParts, ...}:
@ -60,6 +71,4 @@
      ];
      systems = ["x86_64-linux" "aarch64-linux"];
    };
-
-  nixConfig = {};
 }
--- a/hmModules/btop/default.nix
+++ b/hmModules/btop/default.nix
@ -0,0 +1,6 @@
+{
+  programs.btop = {
+    enable = true;
+    settings.update_ms = 100;
+  };
+}
--- a/hmModules/git-workspace/default.nix
+++ b/hmModules/git-workspace/default.nix
@ -28,6 +28,16 @@
          }
        ];
      };
+      mlabs-ai = {
+        provider = [
+          {
+            provider = "github";
+            name = "mlabs-ai";
+            path = "/home/${username}/projects";
+            skip_forks = false;
+          }
+        ];
+      };
      ethereansos = {
        provider = [
          {
--- a/hmModules/git/default.nix
+++ b/hmModules/git/default.nix
@ -47,7 +47,7 @@ in {
    };

    difftastic = {
-      enable = true;
+      enable = false; # it gives problem with `magit-todos` in emacs
      background = "dark";
    };

--- a/hmModules/hyprland/default.nix
+++ b/hmModules/hyprland/default.nix
@ -55,7 +55,7 @@ in {
  };

  services.kanshi = {
-    enable = false;
+    enable = true;
    systemdTarget = "hyprland-session.target";
    profiles = {
      undocked = {
--- a/hmModules/kicad/default.nix
+++ b/hmModules/kicad/default.nix
@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  home.packages = [pkgs.kicad-small];
+}
--- a/hmModules/monero/default.nix
+++ b/hmModules/monero/default.nix
@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  home.packages = [pkgs.monero-gui];
+}
--- a/hmModules/shell/default.nix
+++ b/hmModules/shell/default.nix
@ -204,7 +204,6 @@
    comma
    # carapace # used by nushell
    nil # TODO probably not best place
-    nixd # TODO probably not best place
    terraform-lsp # TODO probably not best place
    python3Packages.jedi-language-server # TODO probably not best place
    nodePackages.typescript-language-server # TODO probably not best place
--- a/hmModules/tor-browser/default.nix
+++ b/hmModules/tor-browser/default.nix
@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  home.packages = [pkgs.tor-browser];
+}
--- a/hmModules/wezterm/default.nix
+++ b/hmModules/wezterm/default.nix
@ -3,7 +3,6 @@
    enable = true;
    extraConfig = ''
      return {
-        enable_wayland = false; -- https://github.com/wez/wezterm/issues/4483
        font = wezterm.font_with_fallback {
          {
            family = 'Iosevka Comfy',
--- a/hosts/archer/#default.nix#
+++ b/hosts/archer/#default.nix#
@ -0,0 +1,26 @@
+{pkgs, ...}: {
+  # $ nix-env -qaP | grep wget
+  environment.systemPackages =
+    [ pkgs.vim
+    ];
+
+  # # Auto upgrade nix package and the daemon service.
+  # services.nix-daemon.enable = true;
+  # # nix.package = pkgs.nix;
+
+  # # Necessary for using flakes on this system.
+  # nix.settings.experimental-features = "nix-command flakes";
+
+  # # Create /etc/zshrc that loads the nix-darwin environment.
+  # programs.zsh.enable = true;  # default shell on catalina
+  # # programs.fish.enable = true;
+
+  # # # Set Git commit hash for darwin-version.
+  # # system.configurationRevision = self.rev or self.dirtyRev or null;
+
+  # # Used for backwards compatibility, please read the changelog before changing.
+  # # $ darwin-rebuild changelog
+  # system.stateVersion = 4;
+
+  # # The platform the configuration will be used on.
+}
--- a/hosts/archer/default.nix
+++ b/hosts/archer/default.nix
@ -0,0 +1,13 @@
+{pkgs, ...}: {
+  environment.systemPackages = [
+    pkgs.vim
+  ];
+
+  nix.settings.experimental-features = "nix-command flakes";
+
+  programs.fish.enable = true;
+
+  services.nix-daemon.enable = true;
+
+  # nixpkgs.localSystem = "x86_64-darwin";
+}
--- a/hosts/default.nix
+++ b/hosts/default.nix
@ -8,6 +8,9 @@
  imports = [./module.nix];

  fleet = {
+    darwinHosts.archer = {
+    };
+
    hosts = {
      # thinkpad = {
      #   extraModules = with inputs; [
@ -99,6 +102,7 @@
        };
        extraModules = [
          inputs.disko.nixosModules.disko
+          inputs.nixThePlanet.nixosModules.macos-ventura
          # inputs.hercules-ci-agent.nixosModules.agent-service
        ];
        extraHmModules = [
@ -117,11 +121,14 @@
          "autistici-password".owner = "ccr";
          "restic-hetzner-password" = {};
          "aws-credentials".owner = "hercules-ci-agent";
+          "forgejo-runners-token".owner = "nixuser";
+          "forgejo-nix-access-tokens".owner = "nixuser";
        };
      };

      sisko = {
        system = "aarch64-linux";
+        nixpkgs = inputs.nixpkgsUnstableForSisko; # using more recent `nixpkgsUnstable` it fails to restart
        vpn = {
          ip = "10.100.0.1";
          publicKey = "bc5giljukT1+ChbbyTLdOfejfR3c8RZ4XoXmQM54nTY=";
@ -144,6 +151,8 @@
          "aws-credentials".owner = "hercules-ci-agent";
          "hass-ssh-key".owner = "hass";
          "matrix-registration-shared-secret".owner = "matrix-synapse";
+          "matrix-sliding-sync-secret".owner = "matrix-synapse";
+          "autistici-password".owner = "forgejo";
        };
      };
    };
@ -160,4 +169,9 @@
    lib.mapAttrs
    config.fleet._mkNixosConfiguration
    config.fleet.hosts;
+
+  flake.darwinConfigurations =
+    lib.mapAttrs
+    config.fleet._mkDarwinConfiguration
+    config.fleet.darwinHosts;
 }
--- a/hosts/kirk/default.nix
+++ b/hosts/kirk/default.nix
@ -1,6 +1,7 @@
 {
  fleetModules,
  lib,
+  pkgs,
  ...
 }: {
  imports =
@ -28,6 +29,7 @@
      "restic"
      "greetd"
      "syncthing"
+      "mount-rock5b"
    ]
    ++ [
      ./disko.nix
@ -74,6 +76,8 @@
    "kvm-intel"
  ];

+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_7;
+
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.systemd-boot = {
    enable = true;
--- a/hosts/module.nix
+++ b/hosts/module.nix
@ -8,10 +8,46 @@
  config,
  inputs,
  ...
-}: let
+} @ flakePartsArgs: let
  cfg = config.fleet;
 in {
  options.fleet = {
+    darwinHosts = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
+        options = {
+          name = lib.mkOption {
+            description = "Host name";
+            type = lib.types.strMatching "^$|^[[:alnum:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
+            default = name;
+          };
+          system = lib.mkOption {
+            description = "NixOS architecture (a.k.a. system)";
+            type = lib.types.str;
+            default = "x86_64-darwin";
+          };
+          nixpkgs = lib.mkOption {
+            description = "Used nixpkgs";
+            type = lib.types.anything;
+            default = inputs.nixpkgsUnstable;
+          };
+          extraModules = lib.mkOption {
+            description = "Extra NixOS modules";
+            type = lib.types.listOf lib.types.deferredModule;
+            default = [];
+          };
+          overlays = lib.mkOption {
+            description = "Enabled Nixpkgs overlays";
+            type = lib.types.listOf (lib.mkOptionType {
+              name = "nixpkgs-overlay";
+              description = "nixpkgs overlay";
+              check = lib.isFunction;
+              merge = lib.mergeOneOption;
+            });
+            default = [];
+          };
+        };
+      }));
+    };
    hosts = lib.mkOption {
      description = "Host configuration";
      type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
@ -183,8 +219,29 @@ in {
            fleetHmModules = builtins.map (moduleName: "${self.outPath}/hmModules/${moduleName}");
            fleetFlake = self;
            vpn = cfg.vpnExtra // (lib.mapAttrs (_: host: host.vpn) cfg.hosts);
+            inherit (flakePartsArgs.config.allSystems.${config.system}.allModuleArgs.config._module.args) inputs';
          };
        };
    };
+    _mkDarwinConfiguration = lib.mkOption {
+      description = "Function returning a proper Darwin configuration";
+      type = lib.types.functionTo (lib.types.functionTo lib.types.attrs); # TODO improve this type
+      internal = true;
+      default = hostname: config:
+        inputs.nixDarwin.lib.darwinSystem {
+          modules = [
+            ({
+              lib,
+              pkgs,
+              ...
+            }: {
+              networking.hostName = lib.mkForce hostname;
+              nixpkgs.overlays = config.overlays;
+              nixpkgs.hostPlatform = config.system;
+            })
+            "${self.outPath}/hosts/${hostname}"
+          ];
+        };
+    };
  };
 }
--- a/hosts/picard/default.nix
+++ b/hosts/picard/default.nix
@ -34,6 +34,11 @@
      "greetd"
      "syncthing"
      "hass-poweroff"
+      "forgejo-runners"
+      "teamviewer"
+      # "macos-ventura"
+      # "sunshine"
+      "mount-rock5b"
    ]
    ++ [
      ./disko.nix
@ -65,6 +70,9 @@
      "email"
      "digikam"
      "dolphin"
+      "tor-browser"
+      "kicad"
+      "monero"
    ];
    extraGroups = [];
    backupPaths = [];
@ -92,6 +100,8 @@
    configurationLimit = 20;
  };

+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_7;
+
  networking.hostId = "5b02e763";

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
@ -105,6 +115,11 @@
    driSupport32Bit = true;
  };

+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+  };
+
  # TODO move away from here (how can the interface name be retrieved programmatically?)
  networking.interfaces.enp11s0.wakeOnLan = {
    enable = true;
--- a/hosts/sisko/default.nix
+++ b/hosts/sisko/default.nix
@ -1,7 +1,7 @@
 {
  fleetModules,
  pkgs,
-  lib,
+  config,
  ...
 }: {
  imports =
@ -10,14 +10,10 @@
      "ssh"
      "ccr"
      "wireguard-server"
-      # "minidlna"
      "mediatomb"
      "transmission"
      "hercules-ci"
-      # "bubbleupnp"
-      # "nextcloud"
      "home-assistant"
-      # "immich"
      "adguard-home"
      "cloudflare-dyndns"
      "rock5b-proxy"
@ -28,7 +24,8 @@
      "restic"
      "syncthing"
      "minio"
-      "matrix"
+      # "matrix"
+      "forgejo"
    ]
    ++ [
      ./disko.nix
@ -36,21 +33,23 @@

  # FIXME why is this needed?
  nixpkgs.config.permittedInsecurePackages = ["openssl-1.1.1w"];
-
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_testing;
  # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_testing;
-  boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux_testing.override {
-    argsOverride = {
-      src = pkgs.fetchFromGitLab {
-        domain = "gitlab.collabora.com";
-        owner = "hardware-enablement/rockchip-3588";
-        repo = "linux";
-        rev = "b07290444a7fb5cf56a5200d2bad7f927e77e8b8";
-        sha256 = "sha256-ruD9+vRwFQOXf5PWB+QxtA8DWfOcIydD0nSekoQTqWw=";
-      };
-      version = "6.7";
-      modDirVersion = "6.7.0";
-    };
-  });
+  # boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux_testing.override {
+  #   argsOverride = {
+  #     src = pkgs.fetchFromGitLab {
+  #       domain = "gitlab.collabora.com";
+  #       owner = "hardware-enablement/rockchip-3588";
+  #       repo = "linux";
+  #       rev = "b07290444a7fb5cf56a5200d2bad7f927e77e8b8";
+  #       sha256 = "sha256-ruD9+vRwFQOXf5PWB+QxtA8DWfOcIydD0nSekoQTqWw=";
+  #     };
+  #     version = "6.7";
+  #     modDirVersion = "6.7.0";
+  #   };
+  # });
+
+  system.stateVersion = "24.05";

  powerManagement.cpuFreqGovernor = "schedutil";

@ -63,10 +62,21 @@
  swapDevices = [];

  boot.loader = {
-    grub.enable = false;
-    generic-extlinux-compatible.enable = true;
+    systemd-boot.enable = true;
+    efi.canTouchEfiVariables = false;
  };

+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+  ];
+
+  boot.kernelParams = [
+    "console=tty1"
+    "console=ttyS0,1500000"
+  ];
+
  # fileSystems."/mnt/film" = {
  #   device = "//ccr.ydns.eu/film";
  #   fsType = "cifs";
--- a/hosts/sisko/disko.nix
+++ b/hosts/sisko/disko.nix
@ -1,5 +1,6 @@
 let
-  emmc = "/dev/mmcblk0";
+  emmc = "/dev/disk/by-id/mmc-SLD64G_0xf6be3ba0";
+  ssd = "/dev/disk/by-id/ata-CT240BX300SSD1_1739E1042F3C";
  # hd1 = "/dev/disk/by-id/ata-WDC_WD10EADS-22M2B0_WD-WCAV52709550";
  # hd2 = "/dev/disk/by-id/ata-WDC_WD10EADX-22TDHB0_WD-WCAV5V359530";
  hd = "/dev/disk/by-id/ata-WDC_WD10EADS-22M2B0_WD-WCAV52709550-part1";
@ -7,114 +8,34 @@ let
 in {
  disko.devices = {
    disk = {
-      emmc = {
+      ssd = {
+        device = ssd;
        type = "disk";
-        device = emmc;
        content = {
-          type = "table";
-          format = "gpt";
-          partitions = [
-            {
-              start = "32.8kB";
-              end = "12.6MB";
-              name = "uboot";
-              bootable = true;
-            }
-            {
-              name = "NIXOS_ROOTFS";
-              start = "13.6MB";
-              end = "100%";
-              flags = ["legacy_boot"];
+          type = "gpt";
+          partitions = {
+            ESP = {
+              label = "ESP";
+              type = "EF00";
+              size = "1G";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            root = {
+              label = "root";
+              size = "100%";
              content = {
                type = "filesystem";
                format = "ext4";
                mountpoint = "/";
              };
-            }
-          ];
+            };
+          };
        };
      };
-      # hd = {
-      #   type = "disk";
-      #   device = hd;
-      #   content = {
-      #     type = "table";
-      #     format = "gpt";
-      #     partitions = [
-      #       {
-      #         name = "hd";
-      #         start = "0%";
-      #         end = "100%";
-      #         content = {
-      #           type = "filesystem";
-      #           format = "ext4";
-      #           mountpoint = "/mnt/hd";
-      #         };
-      #       }
-      #     ];
-      #   };
-      # };
-      # hd1 = {
-      #   type = "disk";
-      #   device = hd1;
-      #   content = {
-      #     type = "table";
-      #     format = "gpt";
-      #     partitions = [
-      #       {
-      #         name = "primary";
-      #         start = "0";
-      #         end = "100%";
-      #         content = {
-      #           type = "mdraid";
-      #           name = "raid1";
-      #         };
-      #       }
-      #     ];
-      #   };
-      # };
-      # hd2 = {
-      #   type = "disk";
-      #   device = hd2;
-      #   content = {
-      #     type = "table";
-      #     format = "gpt";
-      #     partitions = [
-      #       {
-      #         name = "primary";
-      #         start = "0";
-      #         end = "100%";
-      #         content = {
-      #           type = "mdraid";
-      #           name = "raid1";
-      #         };
-      #       }
-      #     ];
-      #   };
-      # };
    };
-
-    # mdadm = {
-    #   raid1 = {
-    #     type = "mdadm";
-    #     level = 1;
-    #     content = {
-    #       type = "table";
-    #       format = "gpt";
-    #       partitions = [
-    #         {
-    #           name = "primary";
-    #           start = "0";
-    #           end = "100%";
-    #           content = {
-    #             type = "filesystem";
-    #             format = "ext4";
-    #             mountpoint = "/mnt/raid";
-    #           };
-    #         }
-    #       ];
-    #     };
-    #   };
-    # };
  };
 }
--- a/lib/default.nix
+++ b/lib/default.nix
@ -9,7 +9,7 @@
    hosts = {
      kirk = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAH49KzayIro3L1bteR7nwupMM/vKlDh05t5/DFD9/uz";
      mothership = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFlepPWHE9GvQIBcAQBQPd80oiePSPxGDnMdqpdEqx6I";
-      sisko = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDlpd0GhZv0NyDQBTJ130JfC5/r+PvdkHIOaGssm8cPG";
+      sisko = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKPBaKPx0HsJpGmMT//vo2GXvGh4ULoItq49ltCMzVw4";
      pbp = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFF05LScu9m5BXMlFAT1g+g/AkAi7kvq1dY6W3Rzqq3f";
      picard = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ1+1z1IsLVJ6aGarMgzw3NbmFKcpYVgdUjl7xDsewxT";
    };
--- a/modules/auto-upgrade/default.nix
+++ b/modules/auto-upgrade/default.nix
@ -5,7 +5,7 @@
  ...
 }: {
  system.autoUpgrade = {
-    enable = true;
+    enable = false;
    flake = "github:aciceri/nixfleet#${config.networking.hostName}";
    flags =
      lib.lists.optional
--- a/modules/ccr/default.nix
+++ b/modules/ccr/default.nix
@ -71,7 +71,7 @@ in {
  config = lib.mkIf cfg.enable {
    # FIXME shouldn't set these groups by default
    ccr.extraGroups = ["wheel" "fuse" "video" "dialout" "systemd-journal" "camera"];
-    ccr.modules = ["shell" "git" "nix-index"];
+    ccr.modules = ["shell" "git" "nix-index" "btop"];

    backup.paths = cfg.backupPaths;

--- a/modules/cloudflare-dyndns/default.nix
+++ b/modules/cloudflare-dyndns/default.nix
@ -13,6 +13,7 @@
      "vpn.aciceri.dev"
      "cache.aciceri.dev"
      "matrix.aciceri.dev"
+      "syncv3.matrix.aciceri.dev"
    ];
    apiTokenFile = config.age.secrets.cloudflare-dyndns-api-token.path;
  };
--- a/modules/docker/default.nix
+++ b/modules/docker/default.nix
@ -10,5 +10,5 @@
    docker-compose
    podman-compose
  ];
-  ccr.extraGroups = ["docker"];
+  ccr.extraGroups = ["docker" "podman"];
 }
--- a/modules/fonts/default.nix
+++ b/modules/fonts/default.nix
@ -1,6 +1,6 @@
 {pkgs, ...}: {
  fonts = {
-    packages = with pkgs; [powerline-fonts dejavu_fonts fira-code fira-code-symbols iosevka iosevka-comfy.comfy emacs-all-the-icons-fonts nerdfonts joypixels etBook];
+    packages = with pkgs; [powerline-fonts dejavu_fonts fira-code fira-code-symbols iosevka iosevka-comfy.comfy emacs-all-the-icons-fonts nerdfonts joypixels etBook vegur];
    fontconfig.defaultFonts = {
      monospace = ["DejaVu Sans Mono for Powerline"];
      sansSerif = ["DejaVu Sans"];
--- a/modules/forgejo-runners/default.nix
+++ b/modules/forgejo-runners/default.nix
@ -0,0 +1,210 @@
+# heavily based on https://discourse.nixos.org/t/gitea-nix-actions-runner-setup/35279
+{
+  config,
+  inputs',
+  pkgs,
+  lib,
+  ...
+}: let
+  storeDeps = pkgs.runCommand "store-deps" {} ''
+    mkdir -p $out/bin
+    for dir in ${toString [pkgs.coreutils pkgs.findutils pkgs.gnugrep pkgs.gawk pkgs.git pkgs.nix pkgs.bash pkgs.jq pkgs.nodejs inputs'.nix-fast-build.packages.nix-fast-build pkgs.curl pkgs.tea]}; do
+      for bin in "$dir"/bin/*; do
+        ln -s "$bin" "$out/bin/$(basename "$bin")"
+      done
+    done
+
+    # Add SSL CA certs
+    mkdir -p $out/etc/ssl/certs
+    cp -a "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" $out/etc/ssl/certs/ca-bundle.crt
+  '';
+  numInstances = 1;
+  pushToCache = pkgs.writeScript "push-to-cache.sh" ''
+    #!/bin/sh
+    set -eu
+    set -f # disable globbing
+    export IFS=' '
+
+    echo "Uploading paths" $OUT_PATHS
+    exec nix copy --to "s3://cache?profile=default&region=eu-south-1&scheme=https&endpoint=cache.aciceri.dev" $OUT_PATHS
+  '';
+in
+  lib.mkMerge [
+    {
+      # everything here has no dependencies on the store
+      systemd.services.gitea-runner-nix-image = {
+        wantedBy = ["multi-user.target"];
+        after = ["podman.service"];
+        requires = ["podman.service"];
+        path = [config.virtualisation.podman.package pkgs.gnutar pkgs.shadow pkgs.getent];
+        # we also include etc here because the cleanup job also wants the nixuser to be present
+        script = ''
+          set -eux -o pipefail
+          mkdir -p etc/nix
+
+          # Create an unpriveleged user that we can use also without the run-as-user.sh script
+          touch etc/passwd etc/group
+          groupid=$(cut -d: -f3 < <(getent group nixuser))
+          userid=$(cut -d: -f3 < <(getent passwd nixuser))
+          groupadd --prefix $(pwd) --gid "$groupid" nixuser
+          emptypassword='$6$1ero.LwbisiU.h3D$GGmnmECbPotJoPQ5eoSTD6tTjKnSWZcjHoVTkxFLZP17W9hRi/XkmCiAMOfWruUwy8gMjINrBMNODc7cYEo4K.'
+          useradd --prefix $(pwd) -p "$emptypassword" -m -d /tmp -u "$userid" -g "$groupid" -G nixuser nixuser
+
+          echo -n "access-tokens = " > etc/nix/access-tokens
+          cat ${config.age.secrets.forgejo-nix-access-tokens.path} >> etc/nix/access-tokens
+
+          cat <<NIX_CONFIG > etc/nix/nix.conf
+          accept-flake-config = true
+          experimental-features = nix-command flakes
+          post-build-hook = ${pushToCache}
+          include access-tokens
+          NIX_CONFIG
+
+          cat <<NSSWITCH > etc/nsswitch.conf
+          passwd:    files mymachines systemd
+          group:     files mymachines systemd
+          shadow:    files
+
+          hosts:     files mymachines dns myhostname
+          networks:  files
+
+          ethers:    files
+          services:  files
+          protocols: files
+          rpc:       files
+          NSSWITCH
+
+          # list the content as it will be imported into the container
+          tar -cv . | tar -tvf -
+          tar -cv . | podman import - gitea-runner-nix
+        '';
+        serviceConfig = {
+          RuntimeDirectory = "gitea-runner-nix-image";
+          WorkingDirectory = "/run/gitea-runner-nix-image";
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+      };
+
+      users.users.nixuser = {
+        group = "nixuser";
+        description = "Used for running nix ci jobs";
+        home = "/var/empty";
+        isSystemUser = true;
+        # extraGroups = [ "podman" ];
+      };
+      users.groups.nixuser = {};
+    }
+    {
+      # Format of the token file:
+      virtualisation = {
+        podman.enable = true;
+      };
+
+      # virtualisation.containers.storage.settings = {
+      #   storage.driver = "zfs";
+      #   storage.graphroot = "/var/lib/containers/storage";
+      #   storage.runroot = "/run/containers/storage";
+      #   storage.options.zfs.fsname = "zroot/root/podman";
+      # };
+
+      # virtualisation.containers.containersConf.settings = {
+      #   # podman seems to not work with systemd-resolved
+      #   containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
+      # };
+    }
+    {
+      systemd.services = lib.genAttrs (builtins.genList (n: "gitea-runner-nix${builtins.toString n}") numInstances) (name: {
+        # TODO: systemd confinment
+        serviceConfig = {
+          # Hardening (may overlap with DynamicUser=)
+          # The following options are only for optimizing output of systemd-analyze
+          AmbientCapabilities = "";
+          CapabilityBoundingSet = "";
+          # ProtectClock= adds DeviceAllow=char-rtc r
+          DeviceAllow = "";
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          UMask = "0066";
+          ProtectProc = "invisible";
+          SystemCallFilter = [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~@swap"
+            # needed by go?
+            #"~@resources"
+            "~@privileged"
+            "~capset"
+            "~setdomainname"
+            "~sethostname"
+          ];
+          RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK"];
+
+          # Needs network access
+          PrivateNetwork = false;
+          # Cannot be true due to Node
+          MemoryDenyWriteExecute = false;
+
+          # The more restrictive "pid" option makes `nix` commands in CI emit
+          # "GC Warning: Couldn't read /proc/stat"
+          # You may want to set this to "pid" if not using `nix` commands
+          ProcSubset = "all";
+          # Coverage programs for compiled code such as `cargo-tarpaulin` disable
+          # ASLR (address space layout randomization) which requires the
+          # `personality` syscall
+          # You may want to set this to `true` if not using coverage tooling on
+          # compiled code
+          LockPersonality = false;
+
+          # Note that this has some interactions with the User setting; so you may
+          # want to consult the systemd docs if using both.
+          DynamicUser = true;
+        };
+      });
+
+      services.gitea-actions-runner = {
+        package = pkgs.forgejo-actions-runner;
+        instances = lib.genAttrs (builtins.genList (n: "nix${builtins.toString n}") numInstances) (name: {
+          enable = true;
+          name = "nix-runner";
+          # take the git root url from the gitea config
+          # only possible if you've also configured your gitea though the same nix config
+          # otherwise you need to set it manually
+          url = "https://git.aciceri.dev";
+          # use your favourite nix secret manager to get a path for this
+          tokenFile = config.age.secrets.forgejo-runners-token.path;
+          labels = ["nix:docker://gitea-runner-nix"];
+          settings = {
+            container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
+            # the default network that also respects our dns server settings
+            container.network = "host";
+            container.valid_volumes = [
+              "/nix"
+              "${storeDeps}/bin"
+              "${storeDeps}/etc/ssl"
+            ];
+          };
+        });
+      };
+    }
+  ]
--- a/modules/forgejo/default.nix
+++ b/modules/forgejo/default.nix
@ -0,0 +1,54 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  services.forgejo = {
+    enable = true;
+    stateDir = "/mnt/hd/forgejo";
+    settings = {
+      DEFAULT = {
+        RUN_MODE = "prod"; # set to prod for better logs (worse performance)
+        APP_NAME = "git.aciceri.dev";
+      };
+      service.ENABLE_NOTIFY_MAIL = true;
+      session.COOKIE_SECURE = true;
+      service.DISABLE_REGISTRATION = true;
+      server = {
+        HTTP_PORT = 3002;
+        ROOT_URL = "https://git.aciceri.dev";
+      };
+      mailer = {
+        ENABLED = true;
+        PROTOCOL = "smtp+starttls";
+        SMTP_ADDR = "smtp.autistici.org";
+        SMTP_PORT = 587;
+        FROM = "andrea.ciceri@autistici.org";
+        USER = "andrea.ciceri@autistici.org";
+      };
+      other = {
+        SHOW_FOOTER_VERSION = false;
+      };
+    };
+    mailerPasswordFile = config.age.secrets.autistici-password.path;
+    dump.enable = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${config.services.forgejo.stateDir} 770 forgejo forgejo"
+  ];
+
+  backup.paths = [
+    config.services.forgejo.stateDir
+  ];
+
+  imports = [../nginx-base];
+
+  services.nginx.virtualHosts = {
+    "git.aciceri.dev" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}";
+    };
+  };
+}
--- a/modules/hercules-ci/default.nix
+++ b/modules/hercules-ci/default.nix
@ -4,7 +4,8 @@
    settings = {
      concurrentTasks = "auto";
      clusterJoinTokenPath = config.age.secrets.hercules-ci-join-token.path;
-      binaryCachesPath = config.age.secrets.hercules-ci-binary-caches.path;
+      # binaryCachesPath = config.age.secrets.hercules-ci-binary-caches.path;
+      binaryCachesPath = builtins.toFile "binary-caches.json" "{}";
      secretsJsonPath = config.age.secrets.hercules-ci-secrets-json.path;
    };
  };
--- a/modules/home-assistant/default.nix
+++ b/modules/home-assistant/default.nix
@ -21,6 +21,47 @@
    rev = "9a40a2fa09b0f74aee0b278e2858f5600b3487a9";
    hash = "sha256-i+82EUamV1Fhwhb1vhRqn9aA9dJ0FxSSMD734domyhw=";
  };
+  tuya-device-sharing-sdk = ps:
+    ps.callPackage (
+      {
+        lib,
+        buildPythonPackage,
+        fetchPypi,
+        requests,
+        paho-mqtt,
+        cryptography,
+      }: let
+        pname = "tuya-device-sharing-sdk";
+        version = "0.2.0";
+      in
+        buildPythonPackage {
+          inherit pname version;
+
+          src = fetchPypi {
+            inherit pname version;
+            hash = "sha256-fu8zh59wlnxtstNbNL8mIm10tiXy22oPbi6oUy5x8c8=";
+          };
+
+          postPatch = ''
+            touch requirements.txt
+          '';
+
+          doCheck = false;
+
+          propagatedBuildInputs = [
+            requests
+            paho-mqtt
+            cryptography
+          ];
+
+          meta = with lib; {
+            description = "Tuya Device Sharing SDK";
+            homepage = "https://github.com/tuya/tuya-device-sharing-sdk";
+            license = licenses.mit;
+            maintainers = with maintainers; [aciceri];
+          };
+        }
+    ) {};
 in {
  services.home-assistant = {
    enable = true;
@ -59,6 +100,7 @@ in {
        # used by pun_sensor
        holidays
        beautifulsoup4
+        (tuya-device-sharing-sdk python3Packages) # remove after https://github.com/NixOS/nixpkgs/pull/294706/
      ];
    config = {
      default_config = {};
--- a/modules/macos-ventura/default.nix
+++ b/modules/macos-ventura/default.nix
@ -0,0 +1,14 @@
+{fleetFlake, ...}: {
+  services.macos-ventura = {
+    enable = true;
+    cores = 8;
+    threads = 8;
+    mem = "8G";
+    vncListenAddr = "0.0.0.0";
+    extraQemuFlags = ["-nographic"];
+    sshPort = 2021;
+    installNix = true;
+    stateless = true;
+    darwinConfig = fleetFlake.darwinConfigurations.archer;
+  };
+}
--- a/modules/matrix/default.nix
+++ b/modules/matrix/default.nix
@ -4,7 +4,10 @@
  pkgs,
  ...
 }: let
-  clientConfig."m.homeserver".base_url = "https://matrix.aciceri.dev";
+  clientConfig = {
+    "m.homeserver".base_url = "https://matrix.aciceri.dev";
+    "org.matrix.msc3575.proxy".url = "https://syncv3.matrix.aciceri.dev";
+  };
  serverConfig."m.server" = "matrix.aciceri.dev:443";
  mkWellKnown = data: ''
    default_type application/json;
@ -33,16 +36,22 @@ in {
  services.postgresql = {
    enable = true;
    initialScript = pkgs.writeText "synapse-init.sql" ''
-           CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-           CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-             TEMPLATE template0
-      LC_COLLATE = "C"
-             LC_CTYPE = "C";
+      CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+      CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+        TEMPLATE template0
+        LC_COLLATE = "C"
+        LC_CTYPE = "C";
    '';
  };

+  systemd.tmpfiles.rules = [
+    "d ${config.services.matrix-synapse.dataDir} 770 matrix-synapse matrix-synapse"
+  ];
+
  services.matrix-synapse = {
    enable = true;
+    dataDir = "/mnt/hd/matrix-synapse";
+    configureRedisLocally = true;
    settings = {
      server_name = "aciceri.dev";
      public_baseurl = "https://matrix.aciceri.dev";
@ -66,7 +75,7 @@ in {
  };

  backup.paths = [
-    "/var/lib/matrix-synapse"
+    config.services.matrix-synapse.dataDir
    "/var/backup/postgresql/matrix-synapse.sql.gz"
  ];

@ -74,4 +83,18 @@ in {
    enable = true;
    databases = ["matrix-synapse"];
  };
+
+  services.matrix-sliding-sync = {
+    enable = true;
+    environmentFile = config.age.secrets.matrix-sliding-sync-secret.path;
+    settings = {
+      SYNCV3_SERVER = "http://localhost:8008";
+    };
+  };
+
+  services.nginx.virtualHosts."syncv3.matrix.aciceri.dev" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/".proxyPass = config.services.matrix-sliding-sync.settings.SYNCV3_SERVER;
+  };
 }
--- a/modules/nix/default.nix
+++ b/modules/nix/default.nix
@ -2,11 +2,14 @@
  config,
  lib,
  fleetFlake,
+  pkgs,
  ...
 }: {
  nix = {
    optimise.automatic = true;

+    package = pkgs.nixUnstable;
+
    settings = {
      auto-optimise-store = true;
      trusted-users = [
@ -15,12 +18,12 @@
        "@wheel"
      ];
      netrc-file = "/etc/nix/netrc";
-      substituters = [
-        "s3://cache?profile=default&region=eu-south-1&scheme=https&endpoint=cache.aciceri.dev"
-      ];
-      trusted-public-keys = [
-        "cache.aciceri.dev~1:nJMfcBnYieY2WMbYDG0s9S5qUhU+V4RPL+X9zcxXxZY="
-      ];
+      # substituters = [
+      #   "s3://cache?profile=default&region=eu-south-1&scheme=https&endpoint=cache.aciceri.dev"
+      # ];
+      # trusted-public-keys = [
+      #   "cache.aciceri.dev~1:nJMfcBnYieY2WMbYDG0s9S5qUhU+V4RPL+X9zcxXxZY="
+      # ];
    };

    extraOptions = ''
@ -65,25 +68,24 @@
      };
    };

-    distributedBuilds = true;
-    buildMachines =
-      (lib.lists.optional (config.networking.hostName == "picard") {
-        hostName = "sisko.fleet";
-        system = "aarch64-linux";
-        maxJobs = 4;
-        supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
-        protocol = "ssh-ng";
-        sshUser = "root";
-        sshKey = "/home/${config.ccr.username}/.ssh/id_rsa";
-      })
-      ++ (lib.lists.optional (config.networking.hostName == "picard") {
-        hostName = "mac.staging.mlabs.city";
-        system = "x86_64-darwin";
-        maxJobs = 4;
-        supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
-        protocol = "ssh-ng";
-        sshUser = "root";
-        sshKey = "/home/${config.ccr.username}/.ssh/id_rsa";
-      });
+    distributedBuilds = false;
+    buildMachines = lib.lists.optional (config.networking.hostName == "picard") {
+      hostName = "sisko.fleet";
+      system = "aarch64-linux";
+      maxJobs = 4;
+      supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
+      protocol = "ssh-ng";
+      sshUser = "root";
+      sshKey = "/home/${config.ccr.username}/.ssh/id_rsa";
+    };
+    # ++ (lib.lists.optional (config.networking.hostName == "picard") {
+    #   hostName = "mac.staging.mlabs.city";
+    #   system = "x86_64-darwin";
+    #   maxJobs = 4;
+    #   supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
+    #   protocol = "ssh-ng";
+    #   sshUser = "root";
+    #   sshKey = "/home/${config.ccr.username}/.ssh/id_rsa";
+    # });
  };
 }
--- a/modules/paperless/default.nix
+++ b/modules/paperless/default.nix
@ -1,9 +1,7 @@
 {config, ...}: {
-  networking.firewall.allowedTCPPorts = [config.services.paperless.port]; # TODO remov
  services.paperless = {
    enable = true;
    address = "0.0.0.0";
-    user = config.ccr.username;
    passwordFile = builtins.toFile "paperless-initial-password" "paperless";
    mediaDir = "/mnt/hd/paperless/media";
    consumptionDir = "/mnt/hd/paperless/consume";
@ -16,4 +14,8 @@
      };
    };
  };
+
+  backup.paths = [
+    config.services.paperless.dataDir
+  ];
 }
--- a/modules/syncthing/default.nix
+++ b/modules/syncthing/default.nix
@ -18,7 +18,7 @@
            ];
          };
          sisko = {
-            id = "NGNL7PC-RBSW33U-OQIQDHJ-K2MHEDW-4RJ6H47-CV3YLFZ-VMIMC6A-KHQWSQN";
+            id = "L5RAQXR-6U3ANNK-UJJ5AVN-37VKQRB-UK6HXSU-NN3V6HF-JNZEVA5-NI6UEAP";
            addresses = [
              "tcp://sisko.fleet"
            ];
@ -41,6 +41,16 @@
              .${config.networking.hostName};
            devices = ["picard" "sisko" "kirk"];
          };
+          sync = {
+            path =
+              {
+                picard = "/home/${config.ccr.username}/sync";
+                sisko = "/home/${config.ccr.username}/sync";
+                kirk = "/home/${config.ccr.username}/sync";
+              }
+              .${config.networking.hostName};
+            devices = ["picard" "sisko" "kirk"];
+          };
        };
      };
    };
--- a/modules/teamviewer/default.nix
+++ b/modules/teamviewer/default.nix
@ -0,0 +1,4 @@
+{pkgs, ...}: {
+  services.teamviewer.enable = true;
+  ccr.packages = [pkgs.teamviewer];
+}
--- a/modules/transmission/default.nix
+++ b/modules/transmission/default.nix
@ -21,15 +21,15 @@

      upload-slots-per-torrent = 1000;

-      alt-speed-up = 1000; # 1MB/s
-      alt-speed-down = 2000; # 3MB/s
+      alt-speed-up = 300000; # 300MB/s
+      alt-speed-down = 500000; # 500MB/s
      alt-speed-time-enabled = true;
      alt-speed-time-begin = 540; # 9AM, minutes after midnight
      alt-speed-time-end = 1380; # 11PM
      alt-speed-time-day = 127; # all days, bitmap, 0111110 is weekends and 1000001 is weekdays

      ratio-limit-enabled = true;
-      ratio-limit = 2;
+      ratio-limit = 100; # I am a generous god
    };
  };

--- a/secrets/autistici-password.age
+++ b/secrets/autistici-password.age
--- a/secrets/aws-credentials.age
+++ b/secrets/aws-credentials.age
--- a/secrets/cache-private-key.age
+++ b/secrets/cache-private-key.age
--- a/secrets/cachix-personal-token.age
+++ b/secrets/cachix-personal-token.age
--- a/secrets/chatgpt-token.age
+++ b/secrets/chatgpt-token.age
--- a/secrets/cloudflare-dyndns-api-token.age
+++ b/secrets/cloudflare-dyndns-api-token.age
@ -1,30 +1,30 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-YDmSD81XSRq4Uq7fllx/GKHclsrKuO/QiH/BMiiWhsxGoGF31lB2R/V9WgIxacun
-NduLiCMKzxJ+hAKhiTFXXx8OHXststs0qwwAI5bK9bfH8WFUKmLarjJovBWhyfN3
-lI+8edJhbWWdCuDw5GZsWLmGp1UVVUdvlYxhMvEWqWRIYq4dmMm5lozYUtxgXoh1
-6+oNV5ierqZLkTnI7FKcLKAcApvVLDVrC33ucDfzHtQjlm/auO/eX0jZTYC7/YfR
-GEYn9ctMntew3N6rGU9g1XMTDn016TE1eALmKeWHlL94ji9L4voTfiEIxYP/Xdiv
-UGQPneng5Uf+p1DdVCCyJoIRCbtQlcEda4F+R+x/kanmKZm0CYC+HvE6+wPMFlr1
-mZdexI5HVNDTcQ0LkjDp3pw7KmWLA6oHfC9NvVQ9c7jisW2vTEDdIBFsucxbwqIa
-k4hM2CiG+bikhiT7Tc8GwMWxUmm2sWAobweF+1r5Rx+HmGFNzG12fzdaLt9oeNWE
-yobEMidx/xanzKaCedGbkasyVZNoQtezUF2K++2gUaP41pp6m1x13vd8IT6yTsMe
-83KTwAnjPeDc8UyHvXE8kUwQLKSMNpK+zZqVYc3otsTvGgC/D5Iz+h1mckLlI/lx
-Tm31sHkPxpkYY7k09xeU3vm7pYF9CnNj08id6aapwks
+GUZxWUXT8fTjT55D1hf93Juw4BUEGxhmvWbHhY0GqEmxaT5KGDppEKm5PEg2dEvY
+9lVvJ5gOgzgINPPekNOnMdxX1YVKgppgvKEA/dVY/5u8qSNuOIsi2O7F4x+olEUB
+28W5QsBtJjmpwR5C+vVAfKlvoMxvA7dtsRz+DhqvZHauyCGfSKRPWztGFRdwFC54
+EvQygYy4GsEQiRsmE9zBdSKm8h26PRvPnwbfNCR9GvKWLElNCCHuVO3KXIOE5SLb
+qOWhsS/c7uTzd2TjJ7K5x6VUWabQfMRORtD2O/7TkI5aTwR6iTEY0G8++U7FAs5O
+VtN5Tr7Da3n7Zt186/zy0qpG26QCQcqA4UhHwY5nZn5YzxeqV9SfyEF8cOoNgN2+
+XiuWUS302BS6yecT0Z3xvQ1q5k4W21rhU+ANMhvASmaB/sHnzO8N6sTWrWYSgSE6
+05ig226JIM3HA32nGtGL0KRQBf5J5WvhfzpMs3iuHIXfuxlFv6s5T8sYLJvbXUwY
+I/m9Sq5Qp7x0/gSYqzrChlajrrTSDdBeJM2nRiCRL1mBq3REJGkQyTOk4GqIiol2
+LYRpZHiwANQtRvlJNHjFyKnXXuGE8H51xj6EXCh0xRUc5NEW10nObfnU3Y510fhm
+vxcAlLhOywpGHkJQVa4MpO+9Z9FSIofFRd6OYdMTzI0
 -> ssh-rsa QHr3/A
-YBCcOmZM3OnN2nLKWWz7Y9ksI9HvLQRiqZUmVdoQb6sKxxWNf2v/pfxRA+p4yQft
-RrM3hGontaQSQuy3kJOruXOSz260/t7NZdU+nAPcMJM/J8CSkZBuHHYsSKs7OYDb
-u7oDeBg0zkZYaxbeuqEZKOf6n68Mee6qRmwKE4EGPRuh7Ah/3YiWhl5l61Kt+rPu
-hD80dz/czIBil2yeQURV7O3GJ9d5EYiuWKGkdK9EUw6E0im8kdebSDcrDSVebmRG
-BTaGK7WpF7PRSlqwb+nbHfTtu17s4K3Ukdk/BOmRN0icnjF+dph/Oam4CNjm7lg8
-M21hjwrbQmK+vWt/ZI3axEqxrEPSrheHtfej+wEUeg15ASX+8wNTO8C11rF46qs5
-rLUS1SMf8I3LUQP8lcHfSKe+nYBuzEDOSNdtES5JjKrLBLOJanr0UNFYIEo15u0c
-giioZLK4UKuenTgQXzOWPP3Wb8kmsBbskABzjbK9EpubVovR6Hv83tHqalUfOMwG
-hJV7DF6rkiG/UbnIV208TgzMJkaY52IRZbz0R8we/w8NKN5GCLM3zEDDHEtAILZx
-hLTRsiBssF7qCzoG/n20FHP0iL+SqsnxnRgNfuQZrhSuE0XVeqwK/e5QMiEVwFc3
-/cxRhUceOLBdGhRnRZn0O9dhhsDW+K7Fr98EEW8eArc
-> ssh-ed25519 OgJHCw VIZqz/x6nnQsIk7HsWBv4y21XfkulQG2qfJOxF6B/hs
-Nwc4SIym0J3D3s5DOzU5bo90Z6m2zO8F4ghy/BjkWAQ
--- 3TRFKturOJla77s07ehKIMvGqdsoYiI/OxlIYXWB2ws
-ëJ(Z»(äí Jñ¡ÕiFF>òásNàƒV‚„¯Ê×"só›<C3B3>I;x
-pŒþ1ËbŠ¦cæ4¨Lµp8øPšÐ.y.&‚>UCÌ«½)]ÅüÃ4`<60>Âoç–
+Q9qWQOU6J4Olx4087MMpEKV0sMcNeGAqSSOTJYuTPDepxRxdkrV5yBq/c6nc7lO8
+QVrSzQLfco+E7i3uFnBoeGa7REJSgcluU5mLu0IyRoqEMA5SPn4ODlTymO7qEAoB
+lX25wYREL3wR2GbmnBfigzYVVXXoiiD4L/jKDVsLZbCA1tInkLo0NDffwgxBJvoG
+thgAo06Y9sw8fTdhB1p2DyA0HGfF2WHoT4YqlLwhJ8UUEHNat5a57hUgvfPAtZ2c
+9E12C3pl/HA3G15NZ/DvPV74byAJrf1CTKSJvsxkDBjS1+2bDdehEAyY+nrLf+1K
+bsX0RBhQYmuWJCpRISlC+vKU2DXjz0/TztUNQEL+Srtyxj/D4BzXGau1oEpDMd5Q
+4NHw57nwM/YQiUm6nupwCk/wCOPL5BpzQ3KAr4/IVL+lBMGWrLzEv866LG187FHf
+cqliry6kdub/bfagReBJwRNW14GSrC1jPXypSxdOvi7IApaZUfwF9qPWraBqINaF
+zUovRjWSr+OoWj0lBV8w7O4sPbXmrtzGA82nSJPFLKVoC0yh+23JP1NxKuif5pXv
+GsReR64OtabMLRL4o/t6H02geuMjpixSNbXSvcM2xgODUqXdjg24tqHEhpZb6d2r
+G0Y/qONVwR8MA8yzG0cP1dAilLDFlMmBSLcrym39SU8
+-> ssh-ed25519 +vdRnA FM8l5xooEHvbwvTsM70TrDNxLATyinEftcFDy4qfWh8
+0NRZMOZYUVhLtAxbUVfvir1uiBJJmH7tv4+cgvnb9cY
+--- 5OwygAtbwYRQ3akLwQiXjG0ECE78dg02TtwurYRui9Q
+qÞ6§Üñ
+w°ÅYªaÁßZ,›d¬ùpï&PG-3ó^=#aÎ³ÞQÐŠ=†2y9þÝ’GmŠ<6D>ÿiUîÖN÷ý<C3B7>MÀù%ö“ÎpQRS,–	]òPiùÿéa´y
--- a/secrets/forgejo-nix-access-tokens.age
+++ b/secrets/forgejo-nix-access-tokens.age
@ -0,0 +1,30 @@
+age-encryption.org/v1
+-> ssh-rsa /AagBw
+pTn5hHu1X+7yoHJOnQyaDUVwNsN/e9B2d20AOKjWbQcxQHCd3sO6M2Q5tYKQJfPD
+ckXAdH1LeOvMJr6RW6twOJbGo1Dkjzr9DVUUKXkORUpbTV4vn+GY8IHOuNXDByu2
+Ay/IoX7igZFTeWRQQ+LNDdE0+Gpy6GYYloXz8g2xySFgKfRz2HHA9TopKGtlMALo
+KgUXOWcIkQmEIM/fHaaJ08IRLBR7SbxWSJn0OFAw1NaR1YuJbbUlPYd+Q0KmBVqO
+102eyAuMpJE++l0pev7TkOqjxZJ7g+zZasyduV+BX612CPt7Xuo8FFJFgTPMItiZ
+11GV0euo1QR0kQfPrzPt1eXOozEqSPexcDYG7554NDq6ueGNfzaiJP+dbeC+tIad
+NYMxgc6obD2pQ/dbFxLj8yatQeFSR9XK8mccsCXiweHcrSLF38lgIiuiZfPuvLVq
+7U5mUjPC7M5aKC3aCSFZ9b/q0utraYnPqprnMhz5LR6AuRMieDYgaCoeizJ27uV
+1cNNFhb/cMKPeQijOidvBXcqzwScQ3iBvajVv1pardjU2IGfvBNB7Ud+dINa2rEA
+gUap823PhJPa0cSK1Aqh4UAKE7DsI7pI4IVuCTpZ1uRMVyVBslyVc1gCsXhgHPEt
+fTXLdr9hg86n+M9VtyXLvr2IxUUj9/s2HFd367brsy8
+-> ssh-rsa QHr3/A
+k9zecZPt3mXsc/PE5DsETkoppXw7PEXUKPMg2GpjxmwJwAobB7DrmxQDpUq1ImQg
+1A32jJTetoVuebY2WSMefYHnIRpV2OFawbt9xqlb2N8UJm+nYMhdMlDRaKjuv4/0
+Qjfe4XpOOAKzO+ghqNY3L+psw6sh+abBpA9eQMYuVWnd7ryp9Pufq3I/98eMJxO
+eAN2VlaFuKZ211ho6TaAlFF8inEl9Y/BnGsjFjq0DofmG8xFfN9qR8ISc1Yktp5R
+V7mCpxq7rCCARX+65LzE6jPlqTX32bYRzOlJRFukgD0HZ8amDacyC6JBAm/+d7OH
+YUtPIesMJLu1hJgTWWrgAOdGcFPm7HX1XsbPnseqT5vK6QQ9Yu5l+KzTTy0cRr/y
+PV9917aaC1FexQS2SaD+SKHlOOX4rmPQhrqIhmsbshFU30kps9TGYW12Dwpsp19h
+uzpNAbZ69Vif9Clh7A7p7b+Ds9KKhEZSF0HXdFB8GQ5Ru1aNDJDxQu9sLLi/oZ7l
+oN/AXBT0XiLTasPM9qR0uGk6yoS4sfUKH4t7GLBAc8UTLl3Lf7qLf1gtYLgrBptF
+KCQCMq+MTrHIdjTchAdvbwthW8M7QoeB6OLcW73+0L5tuq4rOqadnq+6wODQbYg+
+4A+C3cUhndnSEQut+GLGEX4TLHgGNU9kiL9jF11FDqE
+-> ssh-ed25519 /WmILg 3o1zcD8VTn7yU5QbqORPGlMR1U38Sp6B/a4EMOfl5gc
+O4i2VexgADirOZ+Ptu2eNd+IuHlFvCYbaBSE7R2LIK0
+--- 2Hkjuqj+B/gS/JcW256ZrtUlWE001xGaA8W7OiJWm0Y
+¿Xª=Ì<Ø:Ï(Ô^<5E>
+¾{	ùœ)‘Wãê¼5*VkW%k›!âhwõ<77>º»nŠØ‹Xaú1`=§ÕËŒ‰FiœÂ	°z†‘Ü[&–ì[´øßÎ.
--- a/secrets/forgejo-runners-token.age
+++ b/secrets/forgejo-runners-token.age
--- a/secrets/git-workspace-tokens.age
+++ b/secrets/git-workspace-tokens.age
@ -1,33 +1,34 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-JtQnd5RfwDS7ggWC6pa3fZVvBM3HFNiGp6UFJI+r7K8Zdl9e9v43czpdlEISq2Mq
-oy34K6q8r65SfJ6QBJjSXHn8gc4wJRPX+vV/rceZnRZm+OYK4VInZky6bhhHA0Qq
-08vg5UqXTGIDCxxker1umeRs3iw7e19VVFBUGsXMEzuzjfxnnBAO6SwSNb25fC98
-I7Hq/mMR6pXmWjWjF+qZBf3ECX6ckfW528SiJu3WQo/ezWSBxY2CwYkUzIds72We
-afsgaVu3zlwRDIY04rQrWVjrNUQ3uIP9FZEPGoVDmzRtBXrudXlzoMjn9jYsbIgn
-wrJpDTinT9Tk3AeKaqbRlOV/s62zGPEc8ehj2DdejMx6VRVYsqSde2bYCa9puzqE
-q+BATvdWfbkGt+YHE3iCIM2TfAVnHGi6kzCcFmN1twB4p9ZRl32L+Zg+FTflcj9L
-NzBb0SPw4OG+Kp8i5+wqQ5gmpIj+7bPqJobSld2RTogccT4Xj83vTE2mFAqzFqcg
-vhBjMpAapg05VP2Zxdh3VB2msm9aDpOQS04wnGr6lPjN6lWq7CeeCpxxfGpr5GIW
-XWuuZiBq+KPSRskWOMajMMBcpOCgUNDl/KP73zfLmZQn4q9qFTM9DXu/hLKkaSbs
-8F/J/g+atMgwdyrqWbvx+uHyzoEt9PV3kz0iiW45pNs
+k6EkuUum8X2lQ154/86tT+B6tfbL2dyR6l6y6pLTe9yeD2tojW9uhkQLKn8DWfzp
+FjN++VgN4jkORG10mj49agWe4bKnNPFqdQCCTVv1XDIXytaTnjGoFfQ9aF4AR5aV
+8505zmUm4r4TGko+4Pa4dAcVcFKk3jmFRoqh9Mvkhrlx+Gjf2zFhcdIlNTEtfWbW
+lcOKGVwNBvQWLtGA0vFT48TFSwG5sqqgfa5DiDY7GjckLVp/7DppkJ2TajrqqBf5
+9LjVV1XeIzor+wLPxg6k/hp8lwUKVRqyYOWY0Lq5GbIDA3gSc85aE/3wCcwCBJ3R
+kTwNPtHmKjzLbTbputV9/z94UhkFzb+FZDeSHDVr/u0FWP/K3NoLbnXmZRuPu2Z1
+8EjQ7QKjqiKsVAJt2xZ5+6mxCf8MpDjZKSEZvcTYShjBXzCG2afBkXZNYeRRBTjA
+e1izAbbcbvPkcbI1en/fppG/cdeeOnBzUe6o0UxX3Y+ry3gIZMHsu09lYxqaUhHV
+lUXyQ1zV4b5MM4nNFPXB4rkzgv3KLevwoY2PYJfVtiVslcHuNebH8MvjgBCYlNKt
+j8IVapmeqjS4RSL6QjwwQmH526u+EL9tHg3v3hQQO7UpLDR6pHXDG1SdvoIFy/LV
+DMc7XL6G2BEQLOIuptpVYDFdHQbzbL7Ly7rB22aCIm0
 -> ssh-rsa QHr3/A
-jTDkTqXuqGrH/mV2qbXBZ4CVIyAEOuMjRpUmWLrrypj7zK42vAFRuCC18ehrZ3H/
-mnbSsUUWdqhqeSuvjcl09x2R1jblG1LSLDu9HsiDJYC+WDIij9tUnNeQyWCIhCTl
-4BhwYMDTxV9rwDX0PEzfErwgmvKAXcYthAHK1JOuJE9ypJflfQ3uxl1K+Oqwh0kI
-QkDhDrhiqbQon20PyZWI25WR05fBgILJJKv14/8MLN97QcbDjobOjIDT4Wpi2D+F
-LfhrgBe/TzFhnqyE73ALojpaOpqAkkXjwvU92Tizo134chdzNKrmETJx8tdZ2A3S
-iWEdJLqsq7AbbqALEK9ZlGUAPMlL6y6doisA5v4hoV416TPrBwpPgKTwVRuS2J+K
-AumRkpXI2wRpTQ30EzsjepnW9h4VENw6f0jvl3ZqC2QNtsOLBpshgjwukfaelv44
-QEWjbAVQHPjBYjmTLtHIvaA0YT42Y49RqH0TQg0SbnQ8HHror7h+ULt2yZ504HV3
-ZupNqqSB5Aa8BHg37u9u47TPHmvSfk+nk3TStXkaFnWvJVN1HPz3lQtciv1s5+dH
-U6V7AnEF5IbHozVRpSGbPXLDNasqGNe35FjEVZHimQJsjHABipvJrRefQ3NUrQHS
-TMh/rQkZnoUKqwg6oFsLs+elVoj0ZCIjp61Bz/I8Psk
-> ssh-ed25519 q+UPnA rstNPHsGiALxXhFJRiCTYtrX0SxqBkwcjKIucLBCy0s
-5qzbvfkAJwEB7YLkCgzRY2hjacaUvRTyUdCmkRya4cU
-> ssh-ed25519 /yLdGQ 694KSG4/P7TR8tyQ7jWsg/6EyX/VbjrXcUvVaeHQZ0w
-kfs05/wV7GpR5DTI9qajHXpX1UGreUgcalHDTaqRjvo
-> ssh-ed25519 /WmILg aqGF/PklW+J7dCF/MTBck+XD/2yHrOVS5+SF083Bd3o
-rw86QIKzPAM96z99SJnfyADBHukNsVtHmqi2MJVntkQ
--- X09IONogINHoYj7G7fk2DOjxHXl/VAZ27PNESfose5c
-H¹®!aeë3©<33>%é<14>' ÒèÓ<C3A8>®8,ÿ¾î‹°ºâZ]RA“ ØT<C398>ª_€ÁvgšFµ8»Z3ã‚ú,¾Qí¡-Ôk—f êKÎ<4B>)a‘ƒT¥ëw/
+B2YBE0TJ9CKMWcGctzY14eYIu7ND0045uPycpaP5NzbTtm0GhXu0K9BJsWCrgnQ3
+5HV+tORW7s5qEVjcN1ARebLQjpxiMmTPVdQLxGnjEgecSfNIvvOYTZBYiD2cFHk8
+ZMUYj52r02j05DGdTX0VUOd56k6NKxe5XzEGcFvF+AjMBvg6KDPiKkfnBoAe92Cv
+TdfLAah3DmbARGOYgi9JZPr36ktFC+bxdprbfFuBxroDNtJeJVTlAA4v+ao2iefK
+OQ7qBGsSLud5HdA1WqfKYmMW0buqDnRjxcX026GpwC2NOP41RuG8ivQGcyVeCYAU
+cYAr/gQlWv6JyhsLE0fOr7Wt6yDrfO7f8aTz9lnyC3e6kMfIX7Bc6Akgs2ndnIOl
+Wa6ZxnTKD1w9k3YY+onFJL6COa//eHzkCXpOoQ4K+OmNAzm7o7F1+oAiNgYk5Tuo
+jRWh3rQHgqOSj1AYOXgrS5wPMtDNPUV002agKp51iV8i0Zt0fGWFcU6GuxHcv3Yw
+9O7gwW3Lix3H1LSD24f8/R/SGeXGID2eeZzxFOy6SSl5e5KxvR4e6t+njeTGf10y
+v40W9eeGAnY3F0pXJv3IxqACOcLT9IHmRNagcMx0TEaXQGL4U9eO0TRuUlWXB8OY
+zThdSUUS3rrYQfddE4tWLciUHTGDvxYawgT+CPcW6mk
+-> ssh-ed25519 q+UPnA 5cNPwQ4TsvgxZDyVGbfn/Jg28Quz2zfBnCMi9l62ryU
+9LjFsw0oKa0WKxO8hXfyMMsuuWs9Ji0wnvjJqaBQOCg
+-> ssh-ed25519 /yLdGQ VuUXa/hvustaqmiRWag5HUauzJE5a5jfwKPGQs57Djk
+kwbOEbJl6834uxfCp1C5v4VRRk77n/yAW3gAKfqta5g
+-> ssh-ed25519 /WmILg 9dFGe9jW6BUHofjPSlcMwQBtRTrIMkbRNOk3PqQPLGw
+IQh/mJNRlr3kBtyUqB3LRxB1zk2PcEXvCBwSSXO59ko
+--- rAbAXar0Ad3RywEwkHOi5AgI3qE85Fo+ZAfemNF4OA0
+ÈâãÖ][z×^J	ÒØL4#óãyÝ™a¶LÃbÏï.z*	{NZˆœ/<2F>ÃÃâ×+CSüŠój/›×Ý<C397>Àº‘¶
+ÛÉ_cYòÀ€CN9’0-
--- a/secrets/hass-ssh-key.age
+++ b/secrets/hass-ssh-key.age
--- a/secrets/hercules-ci-binary-caches.age
+++ b/secrets/hercules-ci-binary-caches.age
--- a/secrets/hercules-ci-join-token.age
+++ b/secrets/hercules-ci-join-token.age
--- a/secrets/hercules-ci-secrets-json.age
+++ b/secrets/hercules-ci-secrets-json.age
--- a/secrets/home-planimetry.age
+++ b/secrets/home-planimetry.age
--- a/secrets/hydra-admin-password.age
+++ b/secrets/hydra-admin-password.age
--- a/secrets/hydra-github-token.age
+++ b/secrets/hydra-github-token.age
--- a/secrets/kirk-wireguard-private-key.age
+++ b/secrets/kirk-wireguard-private-key.age
@ -1,29 +1,30 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-bgLGH+w9jhE0p1e/sdMIT2O43CCfGyviJxohVB2JXHo13O0o/nWZCvX0ljKyFR16
-7/o3jLXZwc7WWeTEEIOHqi8QAOyhZobEMASJUSZdP6YrZ7fLBHdXl/tSEO7Ry31+
-Hgcm0XgdCEGYHRNi0TWc29lmUO8gcxgdTNZzKsmdMdx039MBsqCGvO0m1NhRHcsE
-USzOcCg9x3qWHITox+I2isw0bByMIp9iUXTe87cumpxRpQb+Z9eGoFEjI0F4lSLj
-v2Aha3TcdfSX9fhzNxRnina+01645tlzz9H3tq8u0Dd7ZZHVZkS4/QMFtqjrAfs/
-R46qsTmuPUvmjw0aD2uHLyyKKNaCyaTHyNtDGSqiTLRdgCq4TQrm8bwSP5OxiDUg
-2uyCWn2i85GYcynKEBAZ58oV4rnDRc5YjJ9tEBXrmrBqT+8XrAukN7GMomHiUWRG
-q7JVdF0GIo5C63LFOtbZN6U79LFlSAzWmiPu9WntdvZKfJSCj0cqqnuNmHVWyGZB
-xmapH+RJ9XmsTGfo1fwJQjxJ5qOxJXfxibq5CgFqYIuQZlxTs4JcNzO04y+0vqd6
-Vh2HFmuux95rQYM12LsjN2kdMnzjyIVIUAejTkdZ6nBt2hMmJG+/zlsnsZ1OABpm
-88gTnebMjcAIEFiEvDv36lX2tDX14Qujk9jiZKjqIKs
+pJbEuw/xFv2nmFSH0dBSKgXNSV1gEKTtmWb+tQZWv+Ox8fWkBvUEbLoHvU5F0QLn
+6QkGybHdpWaIYRRdkUiFVcdicKWlKCVKiW0MTQhB7or5/TG/u7xtEzUQlNs8OCrj
+awjyy+B1Qj1jW2RhJEVd7JcLacPdmyj9trf7GMW789QIdbYbWMM05SKv35SX34QQ
+HSD0durkgLheOhnxeFWOg4gTsj3qQzb4KdT6R1sfDV9R8Puv7OfUPGFrnwtldmOm
+xYa9hqsymTTWHIoOIWjT2RQNXAdUkG+lMEl8YIg1DWUvw9+iacNEg66G/FSCvWO0
+4iR0uFGcWIzLSjEWxGJOKhxtnr8eiqZnmRFwqTnKy++KHrBe47x6Z5MWVAFGmDjO
+6ysPzl2dlETgXPWoz3USEZnIIDEemdNKgmRjgIOYV1kuAjndnHFxZQmfLFyBYZOB
+DTmi+UG41xQkAMLDZq7ZWuKqhAyNJtpXVkw+q7P4vZ10R5c9hh7gnz5KJO//bVbL
+lcS84rgyQ5Ot5aOWk9zqslMx3rFHxNSBQR/mOVG/zSnZyTsavhrTyW9WU4alSg6p
+ElEEib2KEfJ7qXxjQEkh07l7D+jAFBLJKprhBs55osR9RT02JtnGCMvaMeCiy9Th
+GME/lYCA9q2Ho+n+eZL0KucULovpzPkaDHVD2n31n/0
 -> ssh-rsa QHr3/A
-IpXmrvP8/UR5QgmeqN0lTzDihnJUrADfO2uSxvux3UPGoTlew1onQIoqw/d13HO7
-pcpbgWLzwhV4oahNhi4GvgdHu+B6VZ7jNkHYtfq9PeOU7N2QRn0Hz2WgWQHa2k64
-eESqYtdiqhfXJTz9dCAPDzDtr79Ptc+9zKTrsWBVDvEO2sRUzv7iO06SBuWQfx0u
-rt5fTaervoUUUEomsO7hLLkc/2HJV43bP/7AIseb71t2agAGRrcqCHWDDqDGe2BF
-f8LtOCV0Pnj+upltqC5F6E2grcJuCkqm8rrxEKz6Kr1QBh+x5fwD1Cblt/Fm6nbS
-9XSPrX+bw65bkaN9lKE3Z6ZVGbOZZN3wM07+JWP4mWPbogkNqNpeNoPju2BzI18C
-03owA5uNdCpUXL1bjCYnxTgC7S3gtiEIZe3EROzhx+sTZCgPnWAk/XLp/m+Zsxxw
-FutzD6aIni0GAZ3otSrHvsBtFRzAga1p8UtT1tIx8nAIB9YMCdlGqJNIQsTsKbQW
-yag4fEs5FBKcRtnbZaas9BPZlPxTrf8Ms9/mv9MpeJ9h9/BAJylmxfMNbFY0J2Aj
-M/oIcI6ISo40gkirwRbCZ3+htxGEcCtSdaBj7iOQRaAlHFqAVYF0yFT4XrC/MFbV
-Nfk3DdoWaUyVKEj/iF4fRSPl7yPRN+HRB/rDe4FUWVY
-> ssh-ed25519 /yLdGQ g51tNVUwPR9t/zv5Bx/YK/LKS9i7xNupo9IiFkLjJFg
-VBpNG/vIcWi0XZ1zcDN+XedxKX87QMAMUdV0qq7REMg
--- 5KqliKNaegUMB1a6KjbQe/tn2wjMC3svKpMTYonPWY0
-)Ô
lÝPáe$<24>ù©Ã¯j<C2AF>ÿkòš¹µaã„âº?<3F><><06>jÕÇ±˜¢•\côÃÓx®¶ÅÊþ2¼ñVNåÙ^ÏŸHã&˜9ê{X?æT{
+P+AjbYYo6vEXwUgri01zmUxC56iNY0ojJgczOKWgLJ75nAgz5lNRHoPB4TSpsisf
+pDmBbEb2M4a4WllDcmErPaZTZv1OCVckCakmYDEicBiWkKa4uTZMdnsfU+T2hNKc
+b/g/VrdNdmHxGMOhHeTf23uqwmfdgekRsYKTl87UsNcyZtqXw/P9exdx9yogq0ci
+rlY90GDeqZrpb0GCJcQs4vS0eC9cPspr/TKhGcalQcgHteW25V+CLT1KhoKtdpqN
+gFNifhsgmvu5et/cbLY7Eamvk7HS5wmTLPBl++O6/gh+gXqCw8Fyv4YYFuOSq2FO
+0KFowdpdNpGNpTjwnQpjGcuehC1P0oV7wSopzX3gfd6E7mXYUAjTlieR39CDOTnH
+G3MbrMWC/yJhJf1oJL7kVXG3wc597JIsbDwJ+q43zF9oKDWQlydsSkzAcnO0ZiqO
+iIUiG0Lq7O7bC9JXxSpPBwJukEtID0uwohEw2l7h9+HTanUo0+KzQPebOKfn6Xwj
+5ER6Az29WCNAirf0U6x9OsV2MzpaSpKwZdoqkuyh14FjhheSpmTb4HBhWWarq3Va
+Wr9XuiT9G/obij6TVui8GFH7UdBPL31O+JzTbPrl4eebwmAn03XtfxWSPnEi4X+I
+96GiVWGYyO30ddB6fqrAxJ60C2ZFkP31CkbnPwBnc2Y
+-> ssh-ed25519 /yLdGQ qx3aQExzLJ2VhNd+lwxW+OYOqad+yHMsJgSMzS0qeFI
+ZA7VFdyYWFmgPED6vfPzBqK+yqrqTEvFObetbrSfuFY
+--- 4t2F3bt4j6qFoEnfzvB5W7XwjNk/pwO/SA/fkESB0wE
+<EFBFBD><1C>K<EFBFBD><19><><EFBFBD>y<10><><EFBFBD><EFBFBD>i<EFBFBD>J"<22><><EFBFBD>
+<EFBFBD>N<EFBFBD>G<EFBFBD><EFBFBD><EFBFBD>!<21><>Z<EFBFBD>vw<76>:<3A>o<EFBFBD>M<><4D><EFBFBD>!<21>v<EFBFBD>t<EFBFBD><74><EFBFBD>7ذO<D8B0><4F><EFBFBD>)+;<3B>劮<EFBFBD>"<22><>%<25>
--- a/secrets/magit-forge-github-token.age
+++ b/secrets/magit-forge-github-token.age
@ -1,32 +1,31 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-RsUCdoIs/YiuhEWV8t05BtM45CCsHRP0XvmYoondWJgAAAy5JzqFEkFXOKitC/IJ
-qaY3qpEsRgtjm+h1yvPQxZMwZH4/ZgWvjRrNhoDB0sVVOnLULuPM+5wrwEaazoHZ
-eQyRUqUB7pAOwm9ZUJPU+xu6QS60pmoFOhIybBnhii7tVdaMikAsRo2KAh68Z61z
-CG3WOkzhLHg63HKbJpHdBTokEbOPAZa4CND9nFIcY4R2nYIaY1nmvOudBJK/1tnI
-bbupu0fMwuyL+MXSySujLgK2A9/8bXuYLJrUL/Woi4OedcA9CMzCjMfm4UiH3M3u
-z2r3auNUFXjdCJOn4ynX9Ik34fwBqvCyaDCCrVPuv64ZtWMCZ3Hl8rI+C7f3SQo2
-3Qp8G6Z3koVJEfsplb/ZLwBSBBzcIFryH1nnq/VHkYuJ9qVxEMbmWnU+uXXb6OLM
-F7LmiLVOX5HuVQg3TVev172+pSfafzMfj6bu67TNzz0256RK59fpJXzGKrKyoPbS
-lMyQ7l2IGO3gxWJqBC3BwL7xO3G6mGAkJ90Anxd6llW0ZPFBl+qAMFFarvAZ4dSm
-N41ie4G3DGCUtsEn9KVkBavvrBzS/FLnzii2RwEG+OhKcHCOmoa4/ny0XefKDepW
-iXJbx1QuBHrL8CuL7cf8Dc8RX2P1SEMP4dNke6o2vbc
+jJcxlU9akef2+iWUld1+tjDQxznNAVUIVJGvZHHEeZ91xFDUv8xnFBiC2yLsjkJt
+0pP5zpYbTIxErbQUojxltOgfSArPpMn1BnzdVOTlBGV1fwst9j7Q0OshaUd5RAR1
+nwAbxDnEnu2VNeNYPdXetRgS5Qhq+ymEWqKUfR5kcue86IbTZ+3S+jiaKchEukwn
+JNQ+mt71OgHVLYfdsWRvmQJKKwUDvTpuRYOElIgJWCLoAle0Xj+OVVVdR8i3mVc0
+BvvAk28dn8LsXvNiLCDHgcyq4UflcQSRK06jnnLDFhdhxm1ifA0eq8ta6V3FPaP/
+rN3pWQ2XmkQX02RGnWWs1L6b2n2H6wvfT6woagm7JaWZnZVrtBOcoiflo8Rnc+qI
+ZqCKrCqnHritwYhrw1iWtyUhKnrePAotycG4z/0XM2iWGJYYYreC4c9RFP4TaQcD
+e6a62mzED6Rdyn90C+K9cbTzeSfdhTgVwmIbBDeG+JllgwXDT45clnTkUdygO8RC
+rtYgE0RUcASlIPC+me+TeBPGc5Sma53IvOqOrHfVny3Bu/8tK2TWgsCv+DXB7Ynu
+jLDKJFNFSeReF1yWYA9o6+5SY83XbgsXR+SnjA0r4AqJZeA3eXyaGj70mg2eJA/X
+vPonF8s7QDySX2gJuYzmknkr9DfsLTQdiSZShfmd2Aw
 -> ssh-rsa QHr3/A
-hfe1OPhhWik/WpoNitMvAOgMvCVABo2PFaultJX0boitNXztAfpuDhd3+Bkiz9N5
-3PZ5yLtKrd1PXjZuq1evt/A23esrCmApI0HCcyrTL8m80+8ZdOLvRUvJQfphqHJZ
-TgBvZPMve0d/bcEX9lRrDdID3iD2Vq3MkLLpM3TCqNQ4Kc+JWZ45QcmsLsBAX0aD
-Z0GQLSM64tOgTpkOwPXvUaj3LHEb4NelSqjK/mQbs69C47MAXw7a5hJbwdadZxSQ
-Znu4/slcy/TiBfCacJWD/ed6GoJfXZrpXXBlaHBrwnDgyXbf/KSHEN3KpHjqkKHr
-x5g7EbTtfHJ3VnZMedzJ4JDzWC4Ws6X/s98bZDjd6G1QTb4RF6jkhQE0zC/FCHlm
-JL7X82Ph57+uDjzxDR6+FFt+p8pFVVKu8ZA2lcqeYLkSA04ErAT+CA+WqpPl9XhO
-TGZajYZOmYtU+uUt2pIiNkwDul41SLS8B0hyIoKGnRNXEjGYovHOMUvjHA0dAwul
-B9RFutT+JxYsB2ab2YofOTHB0/RUfNVlv3iHf0T/qwRG1d5NQaGRstJpkczpidWv
-NeSP4zki/8xHRIGRqV+R0/Kj9hm1ZQkmsRwyfioG3Sr0aAcId4/ZQBosLL4xdKvF
-W1N5BeWy4h/rJikSqbdlP29R+FnYB4UHoGU3tQkCfVE
-> ssh-ed25519 q+UPnA OVsuJR8trB2msb8dQOp4Q6Mc5VTENt2tPGEW5qIXGQ8
-J2j/xQw6JJ2HhMdQgIfVCt3o2IZl8m3hIifUpdBbN+w
-> ssh-ed25519 /yLdGQ xEJ4ADrQD5xlwvlEr58AoQWoFWxIxFWCNbT8pSC4i1Q
-yzicFWEZBWruyBEnvazYzuEz3rGOjmav2fsQak4QNZk
--- SHRpvETnUQBtkFEZ3ddy/eTRvi6NMOHsiz126Zs2gs0
-»œäö§öH5‰K,[(ˆêqÒFžó/-êPóØ*k<>ÏÇEö¸‰ŸéŽ\¾”æã}”h£SH,Åíkrª½K¹4(
-¨ž
+HZMhl9GyRU1vtt9dIAKdUOLq+3zLehkvGfythuktLJR5RYITJaIHLxk7J/VHcgIj
+CdzkYUv8imL9UZmNXAonx45FinzpsRHb3kRbOM1dD7urQ/vKn5NKMgIrjSoy/S1z
+GGV3JhWo4avXIj8hUuChLVtrfFBKGmuNpaC7c2EA+3fZISIo9TUG3MWfg+jwuqXD
+SX0hbxpWfK2Lsnsy2da+KsJqxFaRrRksXyC586H9sDz6DgWbOAyOwyfPTBm15Dyt
+/qGTIkuyBSkqM+B+na3kK20hA01WGfGB5d5mIPq9CdIXSMu3PMKpk2lJBT8RUxmE
+SnvW+VpXxb2T7F6PzrkqY23JslE30JMhRGVsB86/FEStHu5kd0UkyVtkQGhthOMj
+67WyycwLIVbYCDo9ZaMz5L23nJ8a+zfANqmGjoWx5oGGp4EXIGsUC+/4Np3bSb7n
+Dox5nHW2o/hiROzaMaakBtnDSVUpmS+NLN1hyar+vQP34mr6RXNGZfI+l0KnlMjv
+rY7a/I5WuinD62/V49scBNl7F0e1JpJuKllUQVU+/9/03yyuwuN5ciu6G+HXE8pJ
+96UEr4hSOVvUMZ/S3xxziKxLvBU5/jsNhQh/8yCt6DvWFSt8Fgcc4d9ZDDuZE3Oz
+z37oy1KDMdSc82R92XrihK1VHNTPXR85qhA8RMR0gCM
+-> ssh-ed25519 q+UPnA PGWumbw8pA+rNbpp9CkuaSGCIq9H9R3IsO48qJhKGFc
+sXk530yDtVLKOprAPZ7TrPQ+sKNc4zCRTEXWbFzIj38
+-> ssh-ed25519 /yLdGQ 30MqhmP649yXU6HVb7ozJOdvCE/BpN2k8Wnu/7bgDUM
+QL7dVDiWbK3Vl86I6NTg7CsuO8joDrjfur1vVUUkMMM
+--- DrVYDG26Bhaqa651iNKZN7V1hHjVHflk2gicRt2E7Is
+/Dá»Ð¡Ç	º<>S ´5Ì¼Ž†a§Äè«6–fùpðµžZDÒ wU¯fWùà^lê^<11>d”mx¡Û<>åíè<C3AD>´Ý,¶¬
--- a/secrets/matrix-registration-shared-secret.age
+++ b/secrets/matrix-registration-shared-secret.age
@ -1,29 +1,30 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-UlR5iCI7jZnIqgfUm7fHrwgJroFYlqA+F8aZudS/i/RjJ6b8ldqdZnefydc+XY9i
-PeAAqAdEVpC0Dae5q4BoWFb0uS5PQPOBmnYqnSm0NMEcGizzpnF+XJL1wPLur/J9
-TRUHHA9MRvVF5QoXrm2wsqQxstnUPZU4ObA+JgnXArMw31aTPOc8KmZWTQKPg2YM
-PyH1Q2Vc3HHKi4CyY2rl18e8JaJGiifrIATl0+/hsfJnOT8o54HcT11b096hiRqU
-NEdH92y4x+hF0dStTPBIEwzLiM2CVght5lR89Lvh3ZP7b10yswB+EKkH1kwcziyn
-3Hq7RM0+jNKbedyViCAuVeis5PezQlFe3yf9eR9YMJdSjhgflLU2KQ3NnXHYoJJ/
-A1XitzFOwKTSEQqHQs2yjTNa3XcoyNDxH49q/svECHmYZamPsc1Ac8cIJOeFf+Id
-xoa0zKJhSZOBwIz5+PrbNN4lYD88sbT6wspQoJwFOvqCx87kwb3HouG0rwDq57BN
-QxybvD7Vz7JPr6D15uWGhNldabvhr+pMt+17wS+DmdjO08iHrwxTrzyvvc86vxhg
-9IvAF3mhIQvBuV9yLSTGE+J8ngp3f6PUfj0CHZTpLpsBvmr83b1gqjVIpxnmJwIW
-MZpPv/x3o81kxyibFA75T+PhGlOPOybZpleRwmLazy4
+nlpIIJgABKKlrKbrT2ldbuk9UgbTpVP95DTpFKU197cPu6P/tvDjy7GgkBEiBWzo
+jNxzt0ccxxUzcNSwT98VIwexljWwY7fSyHwahkOEPbfo1PmJNMuCIiC0UquAF4eT
+N+UaSWymGqUjR/G+xeHQvUZXVSYv88MABCdCVAKNoRIoI/op79en2AvBANYXr8El
+VuQqALSGojC3fWWh6eMnCSh0uRmaX79Aa2Qc2ZDki0qgsM+hudzUxWTCthcJQxvj
+MK09aZF7/fWjKd/OLm9VvHv4U0xM6rpIbegc80lYJaeQGG9P+Ka0KKffcVwBE0XE
+/ct8a9Q4iba3KZPZvrVBSwBYRf2wTzLbqZip6YJgkS/zLqjKbplnAG0jVucGo5bO
+6Nnk/yyIkeCCEciVfDNgjBMJGmEHLHlsOO+maiJvVeEd1iQbH7am/xDCxggIzj09
+EiDfrbJvyw3bszQIlBzgHZ2Akn57B12BPrVcLuRsi05mYSuiq8clKP67YtN2Pvjk
+gQeqkZgGDiizkepTO/GWbRBPoJKbsJrqoCl7Aw9tzwVqR/Tm1jSSSYEi5PbQtkqI
+46f148GKMKgdpOjy5A12u7AbSJKB6rukuOYxNzf4/MXESC5mps7Uaz+8/+F13dak
+r4GiQnTJ1H7M60LvLuypm2m5zpfqSUQInmJTIzU7qEY
 -> ssh-rsa QHr3/A
-HjOVYJ5qow3EL+ccqD/8azBdhynKeoSYDMOf9etmemrnBLigJzpoFFjlqyMmfFVj
-vjGvVok/iPO6rrmA27UpEiU6arW8IO1N0IUTulpMYNoDUEWPUHdCQv0pHfArEMi0
-KN37mpm22nusOL3bm8goIcyVFzqP83wGsQXamVjwYLI34XlD2d4ugxWtejoYK/rR
-4xbpgnQv3KuyWuxa5eehBuSPZVcBTwzF3sE9/7UFWZxSeHIpV+S8qoj/kfezqVUl
-lUoXC1uupwT5iNYs7NJ3WZZxWjYdpZdR01K8Z8GAh2BDsVXBBZfxmPZwcr+Ri7Gk
-Ai3AGyw7JyO7YeVXeiGze52fkxzxZmCuN8fKoxi5fgrt3sJMUurXnsCTOAPPj9oE
-FCUT9eGO3mxf213XHEySfhS1C0yEruCtJnmclr3bkFNKVFyM71ABOp8sQwsNuBeB
-3WeufPGCXliV7w+NuNBfa0NAemqDOWmTqZHQEv/D3gLBAiUxtm3Rd5wVkcY0Qy3X
-nq0VyMU+LEcC5h9HvJNnEbUzADR0bab/5jbKfbTrJVimCr6fQmkd8+ua6oGa++Jh
-7BrHauQnVKp5tKnvgUaMWfOp40pjMxUzb1JQMkVD5+uKqD+aUD2SDKODC/FKOLC0
-wNoSoE4m5vNy3SLjY66cVT2Mh80fs6GULqE05k2r5SQ
-> ssh-ed25519 OgJHCw OjjSmtLRB+pMtn+5NfDQ1FGMgQttjkoN04gs0aIuRHM
-vRwkDC8EewSDLTbB3ZNZO1d3TjulShkeDjjrAFpu2Cc
--- 4q2bfImq0xXD0apHMUgoP+oNRg9Yr8t1SXpHYtCW0ZE
-[jlE<6C>泠;
Co訰婞窌&l侾<6C>5Z>t苐 h/掠遫烌~r3<72>+縆Lg9P厯 萳▼#F揘駕7顃Sg鉀+躖)靕餿
T╁>p<><70>
+PL4MCO0H3dfKhlswspO9tcStiniGip+l43OMzBfo+DQ5XpDTIMXrGdhnxekRUvfl
+OeYxtRqTuo+TNEbRpdZt9glRnNDYGhn3BDZUYY6FuDtt7jSjWP9Qr3aEtIfOHqGN
+6bQjaxEX7t+L3NEZvGbp7695BQjOGYjKuyO7ly/2a5XnFQzdmyCk//p4Kp059lS1
+auES0dGKBPsKi59dU56geEVOlPBVwDHFcfLejkFmAVIsUsaEmRVu8Z9WZ6u0+jYz
+zgNS7A1GO3o+dL2ZrwgkH2gkYSNIQnnWjTtlgdSpXqvJASDu5t1UGUe0D7Qw9Mu3
+RWnccnJ4uRHn0YchFhhZZGld/MeIQN1u74ewzeQy7OHnBek4A5HWIxqypToA44VX
+DqLtWWouxamncHkbkiFaP/PR1/7eEHZJX2UqX1TXs+uu1Wsp8HLoI0ZpJR/68WPI
+4SPnMKb3Mn4dSnokiwBUM1SMtxMCjbT53E9YiHzdarO6DmUsANPn4MeyB+JWLPCV
+/6o70/TvYxLlR1o42D2ARsMB6+xyMg7PLWujlj37uftHPVg6n8ew3LHe5VJHMSYB
+49J9k8xpzfIgyAYNFS5Nn5w9VI98HouesUCcrhx+m/FmTJCpRc0DlqjILPB3w0TP
+Hls/bwksh6v5/giLWhiR7njLz453+hSpDjI3aOG2S/A
+-> ssh-ed25519 +vdRnA wPAuSoi5AHD8HVVplO8bYh47rtOPQYXiiDCISWsrtXg
+achfOaMNd9zwda3dpDlKQFI0TYcfTrJdwy0kzDD+fJU
+--- frT3QYeKdE/sWQBCuxrNLCw/IEerr2jpJBEmAVwP2aw
+ž{F*â)„ŕţëÍ!ĄĽ÷xÎ<78>růôq Ęr„ŮnťxńiŤJ>ÜŐtMß‰ŚřËĐÇI«b8ô ú/Z?bŰ
+djn“bŔ¶ŕS.¨÷ľś©koę
--- a/secrets/matrix-sliding-sync-secret.age
+++ b/secrets/matrix-sliding-sync-secret.age
--- a/secrets/minio-credentials.age
+++ b/secrets/minio-credentials.age
@ -1,31 +1,32 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-YAGFP0WRzpc31df3bD/w8Q0BiEjrxu8Qw4F11bTiSiq8BXWFhO9X6ggsKv0PWmKb
-GwkMJiVMm4CbP4tuU6B8Jge5kpAnkbtJLjrLDDQD1ivDX9iGw/HN2F9CTsu1l1cv
-xQm5iro7CZL8M5CQtwOiJmS0kL4A5ABWZb68kujwxa8ygjqDjEkJKymnd8oKZUvp
-zIWvjiaoZKz2iEEiHpshZ2FQh130BvkSSyec58gaNRlYfm+KDhQ2wXl5u0Chb9ef
-HXe8FjC0n0F0im//Beqe+7QVkr1qYevQMs8azVf61GWmaI9ORjJ1S/9Qbaj5Lu4S
-NpzmWJ413WLRfzITkgciXx2VDJBYn5dSmJmF3N4GL/huxT/YsXqXJoXxFNYjrVVz
-QYvpBko6ZY7QfKhiVVJv2XxqVHf3vu8R5OV6MT3OZfNKMdmwd/vdVYIAP+XuaXMN
-sugTX1VOUSKlKQ9FFchHVYC02EFn9ptpVGDE4mXMs2IzaPFm4VUk2OtEKBoaaedY
-FCVvwEex8yj480X/D9ljVWXFEjlFgDl6iW/ak6kkbQNN9/QneWKTR46zzDIRfx6h
-NJKhxLwsIyqgrMeB5fXgvwc4rbH41hX0ndlHCFe4UzcAFi2YkWNJw3ezJpdU9qGS
-oYctnjqslkihlGLE6dDO8Zkc7KlSb8lK6ITAlrTIR3Y
+gR8atodsfiVqw5Wy5kM7++YLhbrFDD288XGIynwsx0KCAPn85kmRlG7fzx/t6WAS
+f921kVJYPiqfWWXMEaY0mYRygqS37HREB6WSRaVpM16v2pWtLXIk3xDp74bsEKz5
+4OCazSZRgQLTTHTqEAQm9Wrol18Oi8oQ2FJ8aVl8ZoOJHJD8+84Ntb5ZYKhMkrBs
+Sk2FOhzauspQFRb5j4ocqaVqq2qaqpjHMgN1CHOu2a1muQmH50n8s/qeOrpe41F5
+d9yzNVwna1Z52tB6dHYeKrUsGEbFXFSplGnVjOoSu/hP2xDmo9YS/645GLhYTJS4
+UUjhmE7rhSNhsY2pXPqL1SKo9ja+da65QDm2FNcRHU/nPpAUBguxqOfIcv4qV+BX
+CioYgUmCgMUvyjK/epZqHAsMgmXSbWLy5g/vRCPrqfZx12VtreOuUf3ANEzbgh7w
+ATiJcRWZI5btFCfdA6wOkz7Nlw5QpZQVTjd5DjJyvaWAS1tTveFy3dykzgT5mww5
+OwIJ0FOayOTnUMWaIltUH5SQc0jFkaTs2Nux/mZCXwGyMUF+9uRp/qRrUyo16j1q
+JQ9tANpiUeeJsmYWU6lV8qXp/1byL/diOUTLc+tXU5oH04rRfGZGZ/CNs6vrvGih
+6YNbgQAE8WIzZSy2irSWvutBfoYP//pfpdk8tt4IS0w
 -> ssh-rsa QHr3/A
-r9UHrT2qeTs2IRgqncbfDMoTi/POmzPL5aOtxhkhtauSqH6owu6sovKDjepekmO0
-imIM7kd0nHicLBDa06ORWzGaOghB7WQUuXQFpg+2+bO7JKb6X3SGNQfaHZIq2y7N
-IZ6nBi2KdkZOxrAUXuNj/MhB99QYSBWNBS3aAGQy5j9B6LnADGG0MMhE+7VWg1Y7
-DGLsdqy95GepGOGmIrJq7Pb5uwE6RNfxvKjYqcBoWds6aOUC81W4eqhHndnlyKdX
-E6QuWxDqdU2VQ2LfdP6TavP4NRtVbLe46fWxgko4WiDTuXBnLnpyEms8vVLI7nqx
-7Nv1ufnbdLTX37SMnRr0L9vjfMfhkrZS9DM/1iaF1VXwow8ntjrVnHenJ6pzxayw
-t3gewxytLqEGoYh4dJEdtoAmmS/jVXW5mLtuauTyYETyOSXlgPQbeDefMYD17uLk
-SN/3Y9OaeE8HF2LI3idiRJogc6HCcZ44aMoWu05Xex0f53sot/p0xDn2096jldnI
-KzpAgFM359MpyU4ov3q3os7PV4cBBEg6uPrRA+OW7ypaFyrB3slyMXlE3fwl2996
-PbXGSJ8VtWK1CNZZxgrokmLfYuuhrtHeUT6SfWz38CiPOy611EWBQpC1/3KBqwmg
-Q5AwhgMjHoYb9xSfFWsS6u1DwXUVoaKgZLXHWDKsVJM
-> ssh-ed25519 /WmILg SE7EPrcqi9/B4QC+qBqz440anuYeGNXRK0pcXApWfSc
-iPlVnFjl6NR+u2peab7sDxGdoMcJNHlFzfd99+Wd0Fg
-> ssh-ed25519 OgJHCw srJQ7H4Dj0Ojh4Y0sDWrixO13hov4mcEg2/zgMvhOl4
-McpOgE2hiUrcmNntLojzEg3YLS07pso7jDchSGsrobI
--- +KjZ51myBuKTLsPxAdZ/qO07Jna3W9uZeLjQv80dpe0
-.+\wd1êux3*ü5kˆãµ›!1óƒ{è)ð<>”ž5Íê™4âÕöHÎ~w—mSa·'UŸ”˜ãx’ÚÞø˜m5‹£Á*)
«\sU!pUšÚÅ`Ö
+BSq1+D+Vk/Mz0YBELp+QGuRxtDki2KcYdM/pEqA/78bPQeBlR42LNDRO37suSspc
+OtF759wVO9N6RFnV07r1siKN56LN4XmpcJxa97Ygdl40ZLEobcw5085D2rlSfv3W
+T3Cp9RXtGAiBUfzUc5TYtksBH8CGogPyAuAye6n0x28Yyd4t4WloS24/vRkaH/l4
+y+F5I5pE5phva0erg3D5sH1Q5DRxF71eeoux36yTMAiKp9v2VycckRkbRs6OvEm
+7EJcdtVs3As2NswXuK/sKaaURWt3jQKwjZBQO9/LSTLwyeGEVdjqX2IWXZZX2IJ5
+Ytr4zhNU0aTQQ0IW9IcU+Ti19WkYTVa/EWebI4D5n779ill72zOsHuc7eDHdYSxS
+TQ/o3VgflLaSF97FpQP9t86g72XqN4DCgQVbZrZHv98xve0mMc1eJukdMNSg0kST
+CQlKRikMEiYRScjc6EkuA8VLyFUZ+UQG0se0ybS9bUlThIRTWLgdcQ+HHDYw82U5
+ZetWJaYXCsgiXyF4d6bsHZM0KDjfY1vWgO3VTv4nJUnSwxufGguyMXBETj97emgs
+3ICsCbyRYXlnUJZyu+/lay6K/et/UzPnGnX3K16G2ZGS+6pQOmEcRedYQcsBA5ke
+rZPMndWWFxY8T2LZVQjISBDGPbhXcgmJgT0N6jUwo7g
+-> ssh-ed25519 /WmILg 6xd8CKcY4ydx5YKJwYi7p2aCNYZBLyNH80Sc6rnzwCc
+jj+lPwu/nKz3VBo8GJDSCOOMYWrTLj9ENs43VGxspBs
+-> ssh-ed25519 +vdRnA Mjl2eVOiqhK4gmRET1pvlG2O/UdtXRovoVQ8NyjK5EY
+KOPdxuBvvL8BN9DjZUwnjBh022bH3KsV1bnRg4mQ8ic
+--- MUOpOmKTLQoq+TJ6nddXVlw9CDyCU00yWOXvvINLli4
+êdW¦»vö<76>xyFò€ûÞÈ¥S+]É&…^ ¥÷=ó)6â,„Üº;mAÆ\ÿtÀ>s"“°È°fl•Ñ ¤S¯À
+f
ˆ_¡½–”óšB‹YQÿî+8
--- a/secrets/nextcloud-admin-pass.age
+++ b/secrets/nextcloud-admin-pass.age
@ -1,29 +1,29 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-h4GZjX4X8CFF08mye2gedWgI9yoTMZjPDx29Mu62zmXnRcGEft71bZhWZTaFOlGi
-o3rdppx6Ggihf75WkVqYTUBNOS/YXXXlAkI24opV+C6jmdiYbyemXy9IPclYL3wn
-uMj65RohEhWKRcGgKRWTbNS7JtIWv+qdZGTRAoMHS8DJgaT+9aBQ+UdPdUIxol5C
-V+lgSwTUlhaRSxdd9u6gE/UWxVvUSR8dmjESi5l+C7AnNVabsJsZEssUEtSEKJkF
-T8VgS8enju+R+lr/UseZUBPUEqsyGGA8HeKnljCAc9EmEHwmYRv7sjn0MgvxSkgs
-/YwsqhSKIwpp4a7uWYATJUvzGrFz2czGgT2zsZvKHZ4DpCpovjFwVeMpghMpf1HV
-0i+WQUaRIjKA5x0e2ia8wJTP97g+Zs/is2RbCxFmnz1dKdNSxqQVmpBw9cT+OpeG
-VjROq3hSyAV2bspePKCYIOX07CdFNwW+sHdGFVRTGM+T3pWuK3Tf8y6emaRGtrqD
-K+/NZQ7THTruZBEu/qUMBMrEVIHoVkVb6thFk5gKgl/lSm/U9O6QYsF9TCy4y/b4
-Edhf9jZ+dhMSWECMnwlTrtsCvnuWX6UfnmGQcUni/+rBT/w4/dFEahIfHaIA50MT
-/yH0hiYXv8HsRmuo/G1IsYmjVSlmVqLVi5PnjwNhkCs
+p/rTGXJtMz8k0NlbTUE+hWhTorolYkjRpWs1uL7g9VoNIxA1I8ketl1+mct7u0si
+HGtihkjKBis9r72A3YVT8Y9HDGi2hnr5wcD0cvoj9I56xX5WQpuPg7NRedh4MkpJ
+3RtrqknwnbHYmUjCP6iwBtMXgMfZVMF1qOf5JlYioawzZcxOKBOaAKZchpO2pw0P
+L/Z5SvKxcQ+bI2gpK0jXIETAGJ3rDULdZIfDCA+2f2ml/MeqgqGOTrCulJkocMN9
+5r3JnrEsaDOsbPM5gz6IzExPUoPLRdFglDBsVx51tqhHPyzgNQ72H5dJrRz8BU1B
+F2NGsNXIuQe8Yg5q7zbMlWuKRmoB7sxvzJMFYOMfQc+q8UbstM7q/ENJz13rrz+P
+0HFyNU/4w5izJH8OU2Rz9Qj/GWKFkkCXu3QF66HsKAj+C2+ZA5rWu/AYaB2mTgT5
+JSpKuO1ajgYbT0FAehRIgk3QbGr4wv/TugH4pmvrPuzL7SdEHoNyjAjnLeluOEhU
+picks+ZE79w3R3W6ni7YuM+UYurHE3kpjOnAO7fdU08CieI8VvO1ZGS+n3Fn5QZS
+zufGvKv4bI1rQcrJb1FuTkA+P5jA9X5k+3yrDpgdk9IXFnfDaopayiExXmlf0U1K
+3O1r3iJztsdFJbMiAkhRWdKa2D8EH1I44VytD9N7hf4
 -> ssh-rsa QHr3/A
-WbZRcUxF7vmUMNczAnEtaDnLmZvTfonfQirRaqOL9/MgDE544mCoNyrTGxkAYhmf
-qg0WNyfCe3raRygfgCQhRy3Wb3YfVjSvmt6hpDdZPV/vJWKsTPSzp5xYS4gMMiGX
-ruYk4MwBbmJeXASWo01x8wWYlp6wZG8jO7R3Ey7tacik7fwYxZZKGsxQyhnsq3UY
-nDtiIjwSpqBkNtwL1tf+Vc/GdYgrWc+2Ytyqu/BJSOJpSO0bqDQIBVQmObSOPBMK
-UUyLIr+2LcnQTtSkoq4sqHIHel8u7wVoWMOmWGM1yrnRH2EVbESRJaHNduLTnpdt
-L42Rt55KhUo0llMt+yIYiMabYNqDgzRkn0w/3+ec+hF3hhPmVehTJ06bz9GehQ3Y
-r8yUJGvqo+X+JdId1nRkFWsa415/RIcIGxReKm0qsM3bGjLZQ9c3FKtu1WHWzHT6
-W6SwrbbMTcWxqwmm1fXfrzj3SLdiwFqn7a0mN16JLvLbRt9sX94jB0EQ4V/iMr5a
-Y1OF/N80dwkQ7R3yZbKL71Ko5xUh5eBw+VaFRDsH7kZH4RBGYyVkjQARKmwWGuWz
-20uAdO9AV544qAaDVgh5GNd/vD9bIFIpE3x8vpn25SCYaXhwedBCD/AQjH7jaX1W
-KocJkaUXjVUgifNqkCxxKyqnXHSb6RUmPE/wbBon80Q
-> ssh-ed25519 OgJHCw dZLJwmsvg+ZoopmvijLKbJU4nrZvxAE65tEQM2DZMDo
-ruFTJO6AD4YdIe10axOlFOTMJge0oNtRGMKFoNsACoU
--- c3GmX7lWUMZDUCFBPFXHoGRtrnOeAViZvK5fdhlNXTw
-™áÓUXÈen7o*³¹ðß[g
c$ÉÞHàÇÄaÔÆk¡€g+VÑW<C391> 
+AEEZFDu2/hZ/T8dAtgnv80BO6GXAU7WJ2zcQ+LF+dRIG0vmMUNQC1r9ZUhq2/iHP
+VFc5czyYolt8hSmCOQYmsIds9awN9dsROfKAdK/H5EfGMarn3em7dv+XaKv0L4vi
+/0oLfC5GBT/Q/xTxFXSRcNg57oh+eVZ5n3yJ/LLF3sv8AZ/H1nDenUb+aXVD+HQ+
+LbZE22MtzMbouJ0cWIxktwlXavsyt2Asc20l9xhW5xp2ANaH/Xo0nBhtoYXO+QPc
+zm+7kprabJrZpOJWc2lVDjKD1IpyYEdnOWeSYZpYXAwRTy4zJ1x5XVghsTJK0JfJ
+/0xVK+U34IRjS07lnwcKJAXuOKubbLxVqFC/OURAEBvMdDOdzNXSZUxcAevAcoWG
+JPWCPwrhR1VSsZ82dLsbMa1NjSppi3qQGpIx9iODSY6vovLVRpyX+FVQBzKzEhUB
+JZdJ0Tf1xtxCTc6xhGOyzNCFdTGY5l7iIwjE9AtMXou7aysSMSyGsw3fvSXDlVJh
+O4pjiMbMYO+WpKTHMjS405KG59Ny8Neq55GHhIfZLQqRsNijRUkQsyMmgQNCulNH
+cptgTdtjes/LrC6eFID6Tnx9PGOZOJdHnsRUj4gIEGrrlDfs/yrXogStDh9rG9As
+mIFpANNBrlN6YI4EPSmC/tUEvfSez0tQvHRtD+9+2h8
+-> ssh-ed25519 +vdRnA fjK5jkTDTSwars9b4ahL3FRRtfm1pMKaSiOXcaO0G2U
+54HIEp1SuJs/2v9lFOIUIWMBkCmduSewoG2WvyEg2mQ
+--- 6CTdxx+AwKMb6/ecjNVoSgTtY0kMvgw9U5rfzUrahqs
+ýš•/Őr<Ä'cÜ6Bžđhüě…?š#ß#/†›Đ@vI˝ůÚ¦\
--- a/secrets/picard-wireguard-private-key.age
+++ b/secrets/picard-wireguard-private-key.age
@ -1,29 +1,30 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-N86h7KNcoFnjDQHaSJwxSPT9jyF+g44DSacH6NywhKMRchwodaAJVSQsIpf8QE78
-H2fqlHmJ2DDRRpqnapncKFblFF8hBgsCsrTJ+YSfzapDYaP2QNJ+pQ6PdSGxXFPV
-N2JaFrUlXkZutrERitEHXiEkREWecCgcLlB+CSBahmn3ZklReubCOu2M1aCX1mEW
-o2nGAF73cYH5oxm+OFXls8a0FFB+AGHd2D8N0XBHMxcUyv13A8hVvMzF3Aww1mIZ
-ae/xCHhTIqNtXVZy+ymyGBRrNfBMFgkTe8JahIELUF+J7dXW37MO8eI4sXmaP/he
-UNHWWV+2yrSlAynZgCGEMTVe5vKnd6S/GkH7QqiTrYhKK6GjFGGXXhXx00eMKvL5
-mwuqHFfqH56FWDS8nLLUwJB5P9LsKZThAnY775eXFtx1amgnzdPsJjaV4EAmD4Sy
-XDUwoWJHQ0lMas/+EA4e6YDeme0phZNYBTqveRdrb/mShjoDAvcRB0i2siDCrmPy
-uWR3cOHN8ZgxWFy3QUJd/y081MMRVQtM4/JAWjNetfoP/SlxeoJJ3UTwsTr5F0pm
-oD24dkTFUilCuNBLAgcme62eVpR2IYVl32qkHVe0Fb+07o8fdc0ulq5MeLsvFs6Q
-fvAvUu6yF/ivSB+N1Ble7CMbMvxn9XD61wkOU/6oSj0
+T8vIx8tbljNdJDojKo9H8W27tIG0Jx4Pgw4wwnLBBbGACaACl48+eV6zhJ5+GX6h
+ePejW5Uysw/tgPdmTSgelVp57l91MS32volr8BsMJOngfb3TkTvtotqdrBCojt5V
+LFranTpY8v4sl/Eboko6XUTsxFN79t9X7RXASknuACugN/NBclbbWJwZUIsEOX2+
+Vvndwl9qcdyTbWy3EyerBFC6faC9/Yyr2Dz9L2GgRYXcRxdUGMm2aQ/Lxyf+b+In
+ZOpoX4gfNUb1ed7Mgcn7oHd820PoTkX7mCI2Aa8IF6UwquEAE+9Dk2V8NQ+YMLC8
+nW+0jckneiiTcoZcStHayI8C4xhYKy+iPkNON9nrnJ6yx1agby2S9w0jRuv3kFSw
+U1WbHmB4ZJsEIHkOg8LSs8Cl2nZ/+xyzdRr7lsd92tDsT7jZm5QPj4L+DAfEZFGU
+nJw3bXWB1Yo0/azxWjk5rPuFg/07RRdaciyvp/knRZU+fs83fCY7hCIZrD7q4zYD
+Y9H3TTTGp7FPHn0l71IpOdLNBJLQ4sGkhuOfKCAa4Xq+tSrc7sBKAfB3rmU3jBSb
+J2LFDp1n4adJ8g1ZsfMURz/gqD9fvx+5Ne1p+DUb37FKOApzUiAcZPbp7nmOwaG2
+1e6d1hX0KWD/Vt5b7wB3v1tsPFARNMQK9rm4Op5DSB4
 -> ssh-rsa QHr3/A
-eaee/PGdBD6xr10byJpvP437RxuutLJJ1yVizGOIsVFwQhg/BMcXiGAUlGWucgZ2
-oEkYtQzBSS3ZmGIB9iWrDFtPYIHKhZRNQQW8EfP+2SvIbgdHlkTUYouvhPqgph8a
-LbARcq8JesuXqlhwl6b8aQcbW/C7w+6lOfzjJ+iZsx02f42xzU5feL6fhA+aGdju
-uglOQ84MZRfP4WxdXz8fl6vEp5ntPl0qX4d3qvKSGQCxL9DBD0Fg4bT7hIMciiww
-jo/ZyrK6ccrxJNAcMdfvnk1m4EtkBboc/5JmjcCtP0aB1OKy/mlTxa0MhP3bV6Ku
-mPfqR0mSzfRGjfNjIq/drE6NL7zrI4fjBXBQ9m/AyGte462YJpZuGatjJ1g0yxPa
-67GYT8NgEoaOhIgwE6MwncsFDJMatBaZO7/ODkNPbbk+sYTRDk8ghqH22oL8+Ubs
-6Yo10yBzpifwSKlhNizzZWVkR0TIXFpTctbxPvxmWiyuX7/yKH8NNiiRlCMN78ZB
-uwjY+2fqa4D5d/WO8XTF9nPicY+vZOUC6nsB+wjJF+4cJaE+xj7PnG2ObOe3g+zx
-3X8/G58thg37jokAEiagiJnpCSvt3UxYq8D8m0Pe0r1vYHwyuRBfjEC1fFK6EGCR
-NNpibmtCHHwqsPAzMmVMq+GGIdW6425cScAHv5C++QY
-> ssh-ed25519 /WmILg UIXngyoJ1s8XNNt8nVn3Omh8TWLayAKPFhsM4JryxCM
-i21knTM2g34S3rm4F/L7HRiPusBzh157PWhvnnalgm8
--- xf4VzI50FqcibvwbSEw2TKPA410cgvYA/f6BJf0jFZw
-îIx[Lb½ÌMSƒv)±ü9–¾½mÏÌêšGÐaüu<C3BC>0\àº˜Ú‘ÝZ³¢ÅœSàkççþñ¬‚Õ¯^ŽTjŠ¾!´2‰Îª
+t7w8Y/4fp6QzFL6yTVsvCDICDXXvP24+Ns+9OpuG0YcNiKo3UaHe9gVyyhAC5e5Q
+Zp6KBW51+iQW/v+oMFFZHhaVKfTD2wZPHRzWae0QoaaTXiZh+bV7guKCO/4vxW2e
+2K8HAC1dNwaVc4XRkH71H9ix0CANk6W1mBUFMlHV8fFMwfV5viLAkerTJCeJz49X
+5EupAiy/AoejJu7B3+mmePRu5UCICZhqBvpWxOIjKD7SQSN5/lntxrK/wTZBfyKv
+mp+yq4iKZGZkQwBnXt8te/18nBwdboieJbqncrGwBwYnklp6Fo5WOLNtCFes0ge3
+BnzAavoPNReXB7ytGTT/4CyBJcoxRH+QY0ayZhGKcs8Legx5eJGHhwCIwGKVAguZ
+M1YEc2fWGGu9dSwcmFg6eLKK0lGLLaEDnuQyIOcrqIdgn1UafwclEUvrELC2X0lE
+oMZ1NPQd3dzrAbmoyjJKiTf8tXwZ2NSujzNTsE1ljoLGGhgcj8VEjbEuT4iv19yC
+TNhXIX04SQiFk18ZcBZQY8CjNy/1BMfXeg11Lcxk/6dwjKbfjsf4IMBOLvrv1PD
+kUC0sbrekiqVLXbAKs+LeV6Edv79Ys1csUPsaK7a839Ddji+943ps55yVJRX2xD9
+N0Q5pi+tlKLSkd+N5a1z4/w5XoMPsBxAgcFPLqgG/uc
+-> ssh-ed25519 /WmILg UMzI+3q/ssfroKeD27NSvVnH5DmJyES0w/cK+88mRjI
+ODkA4WoM2ZJUbmBph0i+Lrcmfgdf4Q968ZrN0nPSP8
+--- ysm3rz38u3A2e2bDYGnxsJWiFiPMttfKtR5BIkZYE4g
+[”JÖ<C396>{%Q|Òô²>ázYÿV†óÎ³YÁ‚?àýþ#
 ¥£Š%<25>Z
+Ó–x”ŒjA<EFBFBD>DB±¾}Z6ášA¦fñã+A‰MÅ8å
--- a/secrets/restic-hetzner-password.age
+++ b/secrets/restic-hetzner-password.age
@ -1,34 +1,33 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-L9JXxQqFl1l1T/z0WFR2F5FhWmDkqB7Kec9kIb/CoRtLwO93jR++q95II9KDxxPH
-z+ee2T2X6W37xUZXKFEi+x1jWY21s0qtW/ptKlOgqUOQkYYDqDOM55Kv/upJVivs
-2VAA+TGmZNwXnCsihfplKWv8MqmIbQNfL8NQnIrQkHyeQfxTQajH31HlJCPAKED8
-Pr3hMEUbLxHOKAZFjzD1y22kM2wY6//jIMzlDRzZVG8NLuTtJUmSXINomnmiIQcs
-Ps1WvY3Euzg7fBFn+SEMemanvisMrj3KrvGpdoJd1/J/vDrFAZrZacAed6L7DTJQ
-m2IhOBfOr0N7qzgXvQ/2TpchNIpGjH0pJKXTsLPbmiPvXCS7QfTVU10FODmRnUJr
-PumaGzOvHbEETPOKlIVORbHkbuSCNBQ4k2BoX615vlpMx2zveTd8QuW6u6LrA56A
-f76JRrM8rRyFycP5/gGQqvPBhi19rJuCFsSnbWhpnaBuJ7gcf/FTD7DnYat68x3x
-XRfoWnF/IBEt+GV+40SKct4FO386nlkfK+K18MlzzWQQOuvL/u09HzVluf37HMfT
-DBq9If98GmyQLaN/DhY4cxD8FnUShHiDxWDtnGNpMwSFv5GVKDNQaWNhHNqhKPTo
-oigxP9BccvJVS/yHk8X3RkqCYg4ZETKqANfP/SAe6dY
+CRH96mk6zyHCc/irKapfocfCpGHlvP6ajgtKUHJUeWxeQWR98T50eZRCcD6isrnD
+UDnJva5iLUh8U1UHrMo4JDNAWgqHYZs1kzP/ud+HR1KOH1zTd3BygMqioSNt/747
+qDuRXE8DQ0UN9S94GOTasCWmq5mgHEKBp8gq6S8oIAGAXOh9FyG6c+1pmUhrtmbh
+jKtfMBo5OqXCEUjgjwzRFckV0U3kxsvDDSSfyIPatTwoXTrzX7LUwfvCJ3fjC0hM
+X87l3oSoQ5/6EcPysSb+Qhwl8bhf/VN79Zpf4h8syqbtOlcFDGH9IGWg+HKuDMrw
+2DEacBdIaRptL10ESlHUV0Vzly+sA6NL1vVU85cy5WMcmk0KzqLuzeGfBbIY0uso
+SbIxRrfsoE6mfizrhR7bTRHjtY6eIED1y7JSuCYItxKemzzrEOccCF9w2u6vJnTP
+485LQ6aXtseixrZ23fYVax6FLqEX79ZIZhtpAx5JbEi0vxpsm9iK9ORq4PK1HQZB
+1qauDkGdXo9gedpFUgaE0DqXaB8f1zQs8Lh5XJW/DzPmQivW5Q5Q/Kwu18+X0vQ+
+kgjVbn/9wBig+L/kIYpfN5Ewel8kKkokwYMf+j59Zjcm3WqYUX26cOAqRmxyknkr
+M+JmzPF3sDRtjXEgAXc0GfQS4XOZdjY1fYGKdTYRHes
 -> ssh-rsa QHr3/A
-FtMht8CXk7uCX4BS09s/z1czbvplD0tFyNyVKQnjbOW4cndNeOb0ELrrCHWqG38q
-gXrN8wDawpjAnBXyubOj/8ZYaAc/lCiphoheqGFl+ZPM8eGyPSYdnKOOkOizLwnD
-tobBmpbdQcdcQ65jn+KR4rxn28r/vRXo64aUy/c5ebF07TpLKJlsmN7Pzh6FdDzC
-dLqNcHLc9RZHb6F5tn3ofIfuuqihuv1vQWSlalegDYbfM5k16CL7vtIuWs1z7a9X
-wp9ZKfm1d0gSE5iI87UvoxwWBhX3crLKLU07e33nvcPr8gqGDAK1+Cyd+chz3GXW
-6/ZKSCWRoiuEvr2EmMMqnkvNgXFssNvib7Zma5q0iiwPJuTIm5Fb7cz2dlxz2PP4
-kbKyW0VLYpGsQIZgTEpd6NHt3bWxicb7y0r8jaDhezOQPvHLV5WywaydJ8fAKSHu
-YnRJdvMsDEmX8GlK6IsdtbSCSuvdCqTMApDtJoQTcaVmYvHHsiiSi+Amdpmv7dlE
-j3sAU8pMYCVTSvdiOkZUHpcrTxVzupzl0PVsCfw0XLOsRTGcwJJQbQyagR8hVbVR
-o0xq1206ai19+usG4oGpBoaUzx3wNyJIdI+2+HWKqZqHYc8H8TVKJHikKI1YP8q0
-WQ6FyZJSg53rcbNEFk7z/Nnr1PM2VMrKB7vIIVneERM
-> ssh-ed25519 /WmILg gmfsNi3d0huJamqQ176SALD7X9W7XiCCi4bvYoC0kDo
-meZMjdMRpZp1ozN2VyB84TIQ+HzYfC5LzMD0+o18wK8
-> ssh-ed25519 OgJHCw GQoJwqKiP6IJOvYfkv8X4b57I7c6IxJPN/rvq5BgM2s
-PSGLViTT7R+GbIf5feJUoBQ/3KfLByX4TZEZx8HN9H0
-> ssh-ed25519 /yLdGQ d/hRPe+a8Ty4fk0qOTXuI5lE0AsedD2ElFu74T1u/j4
-A+bKvr6kuIKhSDFyfpaDHE1DkN5AEh3BLX/grTMyGhs
--- 6G/sAZtcd5DYUHryzrGVSvRVvqoZR5p2XbPZj8P6NoU
-™Tc%©@ì¤É¯¿¡~Ð¡ÍÐp\”)ˆŒëµZŸ˜ÁàðxŠ
- âôsv:ÿŽ¾Î¤F6<ÂWÏ
+Oh95QlrAdwFKYVyVq0FtKEDDP4LLM0cM67qeA/7fhhIbZ/jS+Uol2hs0xAJqFT7K
+sW845UyHbF5Dhrqt1Vn39JYMNk4z2Tx3wLRbLf3jlRaAIwEByMdkszRRCAmBDTku
+kOfYsUmgmq8rl2gKJK/6b3IhAGjTIKL3us3UfSkeaoxCKflPLZMTRzvnPlI4iLy7
+tHOXPLnSQXPZEcAj0Tna+5306usTMmaSTyd8jHsI17j3ZvIcdKS7O5xto2H7WnoR
+JshavaNczaHfz/kjIhqTwOOqvTJx3FfmqfAZ6Z2OVslcCFv5/LEIzuxI8lcKS2wb
+MLOmVPTG80RmJE/s1/o3kFiEQn/0tSFMuEsSOWQXB4/Dga1DBHAMIxuJm4wTzC8V
+6vnG6tejVy9eCgfhhBOWaYXvfyHFiWfdI5FvINHIVbZspeFbZRKNNzPOFTZbKA5H
+oIeNAzkZfiSOE8QEG9N6JojGiEoyiS0K8+uGK3CmTMTFTMJ4w+6DAuFHdeeOrxtj
+vmDlbqUB+JwkXnSY6zS9UiriDlluL+yYkjZjRooGGhp7WvtigNiE+nXEsRTsRr+U
+m8jYpEwlms7++k4pS+vcGFn2/IeQWnhj2WjDR/f+Qb22igLyqRLIS5QCPCBrECut
+1F2ynnkac/8KPvzVkxEWha/86Jj+ityCK2YnPyp8fuQ
+-> ssh-ed25519 /WmILg 7ZT+vnywH0b1uQ3NYNU31BF1/ECZWlUj0IabchsaJy8
+AWGhtTkw7lUIVG3figzCIZiIecWwPzap03N++O5nbhI
+-> ssh-ed25519 +vdRnA tpD7p0aFxVEwmpps9iZmjORfDU+jx7FInEUo7ZautwY
+ojG/ygBrMPCQsmgDQzOzFCFVctEoJmDDCf66LDiNn5M
+-> ssh-ed25519 /yLdGQ H4ofbEKaXTdVMhGMhqi18Ou21Dq7hCpBpsaAtSFVhgk
+G2ZVUTMfhTPkBqHX2POueO2xRp2+3eABX7eoCQpt2Ss
+--- cIJtszM0cyUmzRzFyjebeOeegdXOyfyKKjhWrdN1ioQ
+¸ýˆä_Ðñe
ýo³>ìð vºVm© ôè¶¿<C2B6>è<EFBFBD>—9€*Fëµý¤”Ü|0~|¤)ÒRñ<06>gqbÊö<13>®Ò
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@ -9,7 +9,7 @@ in
    "hydra-admin-password.age".publicKeys = [ccr-ssh ccr-gpg mothership];
    "hydra-github-token.age".publicKeys = [ccr-ssh ccr-gpg mothership];
    "cache-private-key.age".publicKeys = [ccr-ssh ccr-gpg mothership];
-    "autistici-password.age".publicKeys = [ccr-ssh ccr-gpg kirk picard];
+    "autistici-password.age".publicKeys = [ccr-ssh ccr-gpg kirk picard sisko];
    "hercules-ci-join-token.age".publicKeys = [ccr-ssh ccr-gpg mothership sisko picard];
    "hercules-ci-binary-caches.age".publicKeys = [ccr-ssh ccr-gpg mothership sisko picard];
    "hercules-ci-secrets-json.age".publicKeys = [ccr-ssh ccr-gpg mothership sisko picard];
@ -22,6 +22,9 @@ in
    "restic-hetzner-password.age".publicKeys = [ccr-ssh ccr-gpg picard sisko kirk];
    "hass-ssh-key.age".publicKeys = [ccr-ssh ccr-gpg sisko];
    "matrix-registration-shared-secret.age".publicKeys = [ccr-ssh ccr-gpg sisko];
+    "matrix-sliding-sync-secret.age".publicKeys = [ccr-ssh ccr-gpg sisko];
+    "forgejo-runners-token.age".publicKeys = [ccr-ssh ccr-gpg picard];
+    "forgejo-nix-access-tokens.age".publicKeys = [ccr-ssh ccr-gpg picard];

    # WireGuard
    "picard-wireguard-private-key.age".publicKeys = [ccr-ssh ccr-gpg picard];
--- a/secrets/sisko-wireguard-private-key.age
+++ b/secrets/sisko-wireguard-private-key.age
@ -1,29 +1,29 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-YB86rfqudhXYiCtMwwjyHq5TAuCPDDardRvI+KOOn0j/CiqsFlYxbEkf4I99Ir9e
-Ax8NKEnYMj1BohPhQeAb3llGatu5QBJoZz+OwIlnPGrxhhAXOkAy16V0sdEEG5hH
-BZ06qRBWyITIQ1Sz6NlHLdSQnADfnmQEnhKPerGpTtnhrI78vwbnOeAVnbrg55//
-A1z5Ouk2cdNT/0fWRset4feHC1n5xXHSG48u25PGX5C+W7cC+8lv5fsF19YBoRz3
-6cpi6/2r6iIVt2JoIWy+8L5N/Y/K6hfp7JS252INKV3oHPZTOegKZjm333Ez+aw1
-TQS1f70eLZ6T2PF4y7iE+d3QGThNfb344fY7sRxqZ6PersgDXh+eEfxY9Gsqjpip
-pP4JJo8UstzWD4YMPCDN2riogSrCav4RwMUaooJe0c37MEih3bTvoZxjhGN4C+Fl
-s/MgxXrpDAZI5YNGJk0aXGBcsoKb0kZZvRFzLzS13af0mxZIn35LhE+slCEoRHh7
-TiAafXNWaduulIibzvgPFcuMesNuXGkAyf+HB6mQURxYlMfbaHz0QzNfI4gkC12w
-3JhAuVMC6hd6Wgg+VQOoJCYQ2suAEsPnFijlqoOpHWFhak+xU/UypL4arU+Rz3L0
-x9OJSHm50vJq/V/dFvjaIf2psFJhyT2Dy4tf8mXCHlg
+HoN32q1xaheTnF44vN9kieckF4rXozLdg6aEKC4TxlP0H8zxmpAQ+/BNzwqj9Zr+
+YVXSRPGauMu0f3yXYVd7iBTk9zKqSmSuE1WMYmf0w5htdJsl2xpdcYUnzwKNVK8g
+714I3GJRyzAAsN1k2I3zplX02Yaru9J3dNdhjY9ACfiJqC6lHtAtJ+xeRI9VONIE
+Hcnh95ZJWoE0AfEnKaTK0UmHl8aUYF9ut8uePcq+s8skAVPKzwrjHnb39qq1dxoe
+xTOKpDttALILGhsZ0X+5HWXvVJdQLcCVr8uzhL7yu0Rde50/T0SHxo6Y2vZyckI
+/3wK9yucGf5x3NrU5RNm/BwXZiHGMsRc3MAuA6vMdZNrqtwJVSLdqn30UnwfTaIo
+nPWhr6L+2Pfh+SkkvEGqDjvsUGAdehzxB5ekUH0cm4eVWI8dKStZpjHI44vUBmdn
+k1XLJ/QjDDgOk7JeLpQjn3GwbrgmdWo/lu5vkUx1bOA7zRzr6fyc0LosQa9ugKn4
+3dRZx4W+4kZhWJ6Vr7OsVUdkJJwarQbRsVzLqyHahQy1Uo5rKc6olbGX2fpcAp0S
+PxqmtwanCZ6mrA/w6imYsENt3mHIQ34C6iDNDYbh/jeNvKD2dhVni50V5XYOXHe3
+DohZbBxtgDInJZ6OuyNjefF+axH5HsxciY7nHjs1ZKY
 -> ssh-rsa QHr3/A
-pJFF/ViRwrsnz2XE3SVbaUqVsqBU/k79BIaJr1s1OTmRO0lTR66szqM9UnbEXdM4
-1xIkk/LkUKz5okrt6K5XszYH0Q38Cwyp9G/Yt+C39ErklHd4TIT9IVB+BiDtBd2W
-t4UN1ut+AcIliAgK8HQpfbUgPm+33sUPo8LiBivpwK3HnIT1Oaass+QaqxHRulCP
-YtA2Wx/KsY8FxgDNVy0chee2tQTeENXF48cear4khzsrXpnvgppH1UQ8c4Dn+jcY
-CIUj+YwyLW2iCKikwTVavgCesJtpyjMvV03eBPtocZQvv91gjdZTOiiZpFenRSLb
-2jCCowUTgA5Md3fLN54Qs6jqZRNeJR9D8uzTJ/+xOHdiVvN46bsqhq/nPV0A9rR8
-Qq+W3SKEFo3GXcgGh3bMt7yRobzEDMLbvXg///cdGdKQaLNTm9tycS9fO0oHworS
-JWBVyqDTfQzVuqpIyyhypjXHQPVM/G+oFboAFAM8AEpYUw87W1n5DgWjBveYhRem
-8mDQrq7/d33HM1CNSWYBuiTq3Ax3++q8pADSpHBLlI8OAMTTbqGARWBK5UamMQVm
-6+526/aqzS4WJrK8Nz/ZurlPfIfjEKkbTqDaew4hgx7ZmoTkBsgMKGyjDT4JywY6
-asNFtNwyAEXRXOzRIVcULrqN0Xp9OYsWfjjrGIQf7fM
-> ssh-ed25519 OgJHCw mj9zpL+kK9+Q4cyQYntKGp0rPlaG5zsHgyR38I6UQB0
-ZS86siw838Tvj+7NS678rWlDDWF0mbsaoswGd6K6r1k
--- RPowQRJut3sGyfc/ICZYBpS8E3TFsg4ZkA+90zgE+Dw
-Ae¬/zÍn¼{;¼b=-†M/½ÓÍ}ÂŒG\Ïú—ì*„¤ðåu–ûÑÒ¾;WgÄAdcšÌM‹?ÖÆe$!¡XÙ$Ú¥•ƒðk+Ö
+R9hyFqThGgrsY5bFzeQEU0lCVbZQBdsjk9l/0F9I65grh+6jIIIhqVFxbgp5uYvz
+buSVKOFP/fj7iEY6fCvqdFyyWlbOT30Fg8b0LTE//AlUu6ELks+P9mQ12sLOdilX
+riBss89gZsm092uzE8eS4xe+MSBT1LlvHZnMyBMYq9gD/Pc/MfiJLGvBZhL+L77J
+TpIwDZgtiN1Egwa3JSWhOMMethznY6FBMTRRSEi7J89pczbA1qLYOHJeIsb1Txzl
+qojm48oOBkAZI1o4483NZH8BltS9ThKjeHfrUlSsEdFG9eAGP3gl7a5f/llYnX32
+5a2/ERpcrAlcbFwafSrI0dK8EoSg4lDtkw+X9T3LMVB4HDYSAloFtwgXoQi1eCb4
+Exg/drcVMg5IBg46GZ/WFchFVai1xCs9xDqd0a8qDceD9qN68M/13fa4QmSdrNOb
+xfcsEyZrHqUy8+gLkzKKpWtTToStzDGufWYyerrBxVfhupMokycu4suGNUWzJBb
+Kf1m/n/nxbBrSIXrh1Q6V7ZnQ1uYkpy/qmn6y7fd/GOLNQ0i7yM34LwGFR3PheCz
+Tt/TJbQx5u8cDLGkkIrvTkG9tK9MM7IhSr/gmiasYSN5oiW48bfrBO4mJJNJbll1
+cQqKYSjcBobTf+Ux3zrwcX1C3OvMTVZEJ6gtBgYAb6k
+-> ssh-ed25519 +vdRnA LSVfv42i4lO78CU9lcvukt+0jg2DznEgnLQ2Bt0pWTE
+18xZ5+AD0HQjjd1ZDsJZy2pB7/Xk/6icoiTYOvG+4ho
+--- A9c502feTNWqMWr+WnVYihe+SBw/qeFhCi4iLEJPr6Y
+¡“páÖ½Íwr×º#žoï´M‰€¼&¥Ú“©òVOãNw$J<AÀµDúB	s3‚¢<R‚ „°#ý<>—xYÙ,½SÖÆ“˜Q6ÂaG®