bekkalokk: restructure website files

Co-authored-by: Jørn Åne <yorinad@pvv.ntnu.no>

.sops.yaml

@@ -17,6 +17,9 @@ creation_rules:
     key_groups:
     - age:
       - *host_jokum
+      - *host_ildkule
+      - *host_bekkalokk
+      - *host_bicep
       - *user_danio
       - *user_felixalb
       - *user_eirikwit

base.nix

@@ -59,7 +59,6 @@
     gnupg
     htop
     nano
-    ripgrep
     rsync
     screen
     tmux
@@ -84,9 +83,26 @@
     settings.PermitRootLogin = "yes";
   };
 
-  # nginx return 444 for all nonexistent virtualhosts
+  sops.age = {
+    sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    keyFile = "/var/lib/sops-nix/key.txt";
+    generateKey = true;
+  };
 
-  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
+  # nginx 404 for nonexistent virtualhosts
+
+  # sops.secrets = lib.mkIf (config.services.nginx.enable) {
+  #   "snakeoil_cert/public" = {
+  #     owner = "nginx";
+  #     group = "nginx";
+  #     sopsFile = ./secrets/common.yaml;
+  #   };
+  #   "snakeoil_cert/private" = {
+  #     owner = "nginx";
+  #     group = "nginx";
+  #     sopsFile = ./secrets/common.yaml;
+  #   };
+  # };
 
   environment.snakeoil-certs = lib.mkIf (config.services.nginx.enable) {
     "/etc/certs/nginx" = {

hosts/bekkalokk/services/mediawiki/default.nix

@@ -22,7 +22,7 @@
           --replace '$SAML_ADMIN_NAME' '"Drift"' \
           --replace '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
           --replace '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/admin_password".path}")' \
-          --replace '$SAML_TRUSTED_DOMAINS' 'array( "wiki.pvv.ntnu.no" )' \
+          --replace '$SAML_TRUSTED_DOMAINS' 'array( "wiki2.pvv.ntnu.no" )' \
           --replace '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=mediawiki_simplesamlphp"' \
           --replace '$SAML_DATABASE_USERNAME' '"mediawiki_simplesamlphp"' \
           --replace '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path}")' \
@@ -31,7 +31,7 @@
     };
   };
 in {
-  services.idp.sp-remote-metadata = [ "https://wiki.pvv.ntnu.no/simplesaml/" ];
+  services.idp.sp-remote-metadata = [ "https://wiki2.pvv.ntnu.no/simplesaml/" ];
 
   sops.secrets = lib.pipe [
     "mediawiki/password"
@@ -64,10 +64,12 @@ in {
       name = "mediawiki";
     };
 
-    webserver = "nginx";
+    # Host through nginx
-    nginx.hostName = "wiki.pvv.ntnu.no";
+    webserver = "none";
-
+    poolConfig = let
-    poolConfig = {
+      listenUser = config.services.nginx.user;
+      listenGroup = config.services.nginx.group;
+    in {
       inherit user group;
       "pm" = "dynamic";
       "pm.max_children" = 32;
@@ -75,6 +77,8 @@ in {
       "pm.start_servers" = 2;
       "pm.min_spare_servers" = 2;
       "pm.max_spare_servers" = 4;
+      "listen.owner" = listenUser;
+      "listen.group" = listenGroup;
 
       "catch_workers_output" = true;
       "php_admin_flag[log_errors]" = true;
@@ -89,7 +93,7 @@ in {
     };
 
     extraConfig = ''
-      $wgServer = "https://wiki.pvv.ntnu.no";
+      $wgServer = "https://wiki2.pvv.ntnu.no";
       $wgLocaltimezone = "Europe/Oslo";
 
       # Only allow login through SSO
@@ -104,7 +108,9 @@ in {
       $wgGroupPermissions['*']['edit'] = false;
       $wgGroupPermissions['*']['read'] = true;
 
-      # Allow subdirectories in article URLs
+      # Misc. URL rules
+      $wgUsePathInfo = true;
+      $wgScriptExtension = ".php";
       $wgNamespacesWithSubpages[NS_MAIN] = true;
 
       # Styling
@@ -150,12 +156,23 @@ in {
 
   users.groups.mediawiki.members = [ "nginx" ];
 
-  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
+  services.nginx.virtualHosts."wiki2.pvv.ntnu.no" = {
     forceSSL = true;
     enableACME = true;
+    root = "${config.services.mediawiki.finalPackage}/share/mediawiki";
     locations =  {
-      "= /wiki/Main_Page" = lib.mkForce {
+      "/" = {
-        return = "301 /wiki/Programvareverkstedet";
+	index = "index.php";
+      };
+
+      "~ /(.+\\.php)" = {
+        extraConfig = ''
+          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+          fastcgi_index index.php;
+          fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
+          include ${pkgs.nginx}/conf/fastcgi_params;
+          include ${pkgs.nginx}/conf/fastcgi.conf;
+        '';
       };
 
       # based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx
@@ -177,6 +194,8 @@ in {
         '';
       };
 
+      "/images/".alias = "${config.services.mediawiki.uploadsDir}/";
+
       "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
       "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
       "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
@@ -193,6 +212,5 @@ in {
 	  $out
       '';
     };
-
   };
 }

hosts/bekkalokk/services/mediawiki/simplesaml-authsources.php

@@ -5,7 +5,7 @@ $config = array(
     ),
     'default-sp' => array(
         'saml:SP',
-        'entityID' => 'https://wiki.pvv.ntnu.no/simplesaml/',
+        'entityID' => 'https://wiki2.pvv.ntnu.no/simplesaml/',
         'idp' => 'https://idp2.pvv.ntnu.no/',
     ),
 );

modules/snakeoil-certs.nix

@@ -5,7 +5,7 @@ in
 {
   options.environment.snakeoil-certs = lib.mkOption {
     default = { };
-    description = "Self signed certs, which are rotated regularly";
+    description = "TODO";
     type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
       options = { 
         owner = lib.mkOption {
@@ -18,13 +18,13 @@ in
         };
         mode = lib.mkOption {
           type = lib.types.str;
-          default = "0660";
+          default = "0770";
         };
         daysValid = lib.mkOption {
           type = lib.types.str;
           default = "90";
         };
-        extraOpenSSLArgs = lib.mkOption {
+        opensslOptions = lib.mkOption {
           type = with lib.types; listOf str;
           default = [ ];
         };
@@ -36,21 +36,17 @@ in
           type = lib.types.str;
           default = "${name}.key";
         };
-	subject = lib.mkOption {
-	  type = lib.types.str;
-	  default = "/C=NO/O=Programvareverkstedet/CN=*.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
-	};
       };
     }));
   };
 
   config = {
-    systemd.services."generate-snakeoil-certs" = {
+    systemd.services."gen-snakeoil-certs" = {
       enable = true;
       serviceConfig.Type = "oneshot";
       script = let
         openssl = lib.getExe pkgs.openssl;
-      in lib.concatMapStringsSep "\n----------------\n" ({ name, value }: ''
+      in lib.concatMapStringsSep "\n" ({ name, value }: ''
         mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
         if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
         then
@@ -60,10 +56,9 @@ in
              -new -x509 \
              -days "${toString value.daysValid}" \
              -nodes \
-             -subj "${value.subject}" \
              -out "${value.certificate}" \
              -keyout "${value.certificateKey}" \
-             ${lib.escapeShellArgs value.extraOpenSSLArgs}
+             ${lib.escapeShellArgs value.opensslOptions}
         fi
         chown "${value.owner}:${value.group}" "${value.certificate}"
         chown "${value.owner}:${value.group}" "${value.certificateKey}"
@@ -71,12 +66,12 @@ in
         chmod "${value.mode}" "${value.certificateKey}"
       '') (lib.attrsToList cfg);
     };
-    systemd.timers."generate-snakeoil-certs" = {
+    systemd.timers."gen-snakeoil-certs" = {
       wantedBy = [ "timers.target" ];
       timerConfig = {
         OnCalendar = "*-*-* 02:00:00";
         Persistent = true;
-        Unit = "generate-snakeoil-certs.service";
+        Unit = "gen-snakeoil-certs.service";
       };
     };
   };

secrets/common.yaml

@@ -0,0 +1,97 @@
+snakeoil_cert:
+    public: ENC[AES256_GCM,data:YBV90zdyW39hnprJFgvtDYfBjRFvQam7a3SjOVwg+N7qeRc2JNl3rAUHyMMA5y0pUlzVCyVM6IyU7Nh7+rHvTEnQ8IHOxbnZzYnj3ccdFTMSTwQCJsy8tgMSYrrDvc/KqzNjjdUjSJm4iyVbkvxbV5UWm41k8pGMe++wkL2JmF4SyAm1ex3EriipoPohmGnO4XPz8ph8nXlyCE9OePQNkYjmN0zrPq9tv7jeEbMWsRhe/tjFGPvByBqnTLZ5cpx3Qqb78U93VYcrYozlKz4k40Wh1j94PRdLUD1KEpGvaIYmvs9E+RTvYdEYKlysNrPOKI0pHz5MhFnVgQsCfuWe4hyC6EkPoYK16eA6STjN9NGt/fQCUjoEYCDTUqaPhi2rIEw8EwQu3V2WdK1CiscLH16CTsmOksrnBC5awADP8prloBamAVwGotL/8C9STsfdZjJye2WLBw4jn1teZuFCJRxXfIQyJXgr+XsdaUIRV9SrQlnYu7+wsD/fFH4gn5DCLl5PHr4tu13ecGFS8UmOAEUg0AfpXjxIFodZNjUVraCKEUCeqG0NpbeOVifHfrjzbiiOIAKe3IBtXVsLBhHF1pLeP2Y4gdswleA/DvTNeHctIn6Fm/o3zavvJTCELCMHZy8imUVZ3xlqRNt+mavgpkbht1xiv8bfV6zQL90WVI1EwAT8OclwSObpwS14fmC4kgHsTkFMwK1Lj+2xK3HctW9hkzGPg/rBkc1ZQZSNAqM3KlMkLueuO6XuYxIT80D2D2CZdaYwYRAtfAvqWzwJXfU7D7VyzMj6rAbLX+Jjc9UyBSigH1ipvMHQeL8259QIeuV+J8kABUNUi4CqRHqhQmO4XQWriFZBXY6YB5VR1EEOJ3yDiLcgSq0Y/qi7sJpSNhY5Qmfm+q23M0sFUAvYPpWJArnkuXfyZopgDaIdqnVl2zabw5V+/McaL7cDcHsHG51eEoSquzv2jXejKE4Z4NGfGGqYj0ORO3nViW7oQzS5W72HsGB+yuCBDvJ3YCT9mX5vM+G/LsPoQyqJOmmammI0vgaLGI0LDqFB6s1+Mrvu51ln7V2kKGx7GIyUVdETfOvZq0mrIxN0YHhXvIdj4LcMlDxgN3TdtsU0GdtOXLGPWzykptgOe0pxujY0PRwMEFBAuyJ+gsMNDDucbFsrvyzpSI6+advL7oUhI0aC9VAhCtTAFCnyZVq9hRgRgEQm6hWbP/zLqTm59kjs6Un6m5YW0lR2Tpn5HXE7C1Q7pM+3cqHsTGItjkbSqWBmpamkYIEgyQtbcBNus6mBLqbnDTQmYmkZMNtYlBq4tSfkYDKyZWojuIE4zab87Sx7myNEkrgxu0By5KXQX8brELLhLClrTW/j+Dmu14D4obOgbAVFlPn2EAs2ZXPgQKrChnmnthkFeR1KRgLXO24U5pqNiN5tfqUFZ8rJ0QTYww1zN7j/Cd+mLGQ4ZDA872istz1Lkl7x1zmwLesKcGgczgfGjjqRHwC/ZKBjFyAg6bnTNjfoKAh98RJ7Hm4KTeACytWZvK2I+QLpuKTQjjNIzgDQXI8Ifke0OD83Tcy0IWtuRODRYqJJ9Y9uIyvvaPuNVMUWLycVHbOvKd6624GYU3ESWm5n8ynIXqDbTwEBkXtEkxAjW8KB4U2k/vvMkCSgacndmrJE8GhUROO5IAw0yFQYsy0p2jyxddTNvF9H594zvQMHxMQd6/xZXJnI4RxY+MoShiLGaj+1tHAKn6whtv2KMI5Tsq26Gh32nivvIp9Sodcvz9OziHLXDjEuSRXy9FXU/L11F4gWcIGNpts1oa/Cmk9d2dYzVr8B3jwk4Z3I6gc/LgwMdR65N8KfmvHBMkilaQ5B9K+RFCXmhLAu0sf0seVuFn0Vtzs7hkHDXFmjXzv3XAKQTk24jgFHUzSg68w3cf+b75GcRfbInCcB7KO+IKnL82tVG220hFK+3i4XkDkFAe/lukmJry/pJ/t9YYdzZMUiQW7g0F/LvEhWXPdF6o/Z9/QPoNvNcK83hJhSSxAz35He/JaFANgLqIECv2KHGEodG2dL2dHW/Q1YLCzkoLasQfNK/HPS9fxhh54B9BeNw/bOWsdsSwSLvMfughdv527FLI61h70rE5hMXhO0SKqoSNPEdomOA6nTG8Nbc0gmoODe94A7LfDsED7nqMTCH3SH6YRJVxOMAuoBw8eDpCwsN+d046kghm0eHJLDqa7wk9/pmGxnV506QikTLAWvHoPhLkXhvhXYSqRijpFQX1eT5pVUADTAY1JaYnzW7TKAdo82sIb3L8EnojOGAnEC+r82hjJj/k79BA2Irxufe0+zb+XIYnKdSrL27PsVqEiVkAb6+iDWDEwHoVR9RhMRmUKFE5ziV7idyEIKDUidOaDT3UaMlmQLDZ2AwKIxOXOsxNdwbtDlffZNYI2O5u5O7sM8mINOHUvMIR6moUyscyBEEbycQn1+PP/b9W68dHeV7goqafPxoqnsiwpWoCKtjTTYsNlBFOHiGMzds6L0q9YnZ24YXeF1PtxR0x9/z87gRxffjXx1eSG66K19dsOhyVIkcf814sSyQvq9FDEDkDI3tPWAxCbK1uFm/eelZcMfI5o+D3qZHY3ClNnky4m19Agn2dNtoVOgoyYnKe6T5njbhX/eK/plMidt6zM976sKNX1QoByy7xnU9lpgYnW4T5vwDO6thh6H,iv:3cF66kWxR/z89P8nyo2oBmS1vvVYzwXg21517VMyLnw=,tag:839M+5Q2fQb7tuq/Vk3VBw==,type:str]
+    private: ENC[AES256_GCM,data:wH2SCm9a+otsjbLzBeevjFgK2c3v1Ev/+NqZ7/N+53O3G0uuiS2yCO+/8Lunsl8AyNVHBHPoKFBNgDjo/RmAktuQl2U8pcgw2ARnWcR07QCPnGhco9aYM6GtsqnvOotclyPvP68w/Nn1g8ueVSNjUAR1kS2oO1NbOlxc8MaY66Y7wXyYiNN05td5+3qDsIUd9Ceez5xNIkfDtM1ueRQVY5GQNTEroAIQgqdedjumdbqgKTZMm3oQm+mc7TbQpKa+i5jXBKsN7FRg98fZWKsuEEUe4L0Y+Dzve8iWrTfQbt0zIU74/fGi1Lca0k+NfaaMrRRqT1Ub4OVp4OmIztn8Fle4QL4mJQcNsaORxBPC6npBxirHbNXJ6vM/+ljznt1Xjq60R1TqagWIfNPvKNMN67/Ua/eofSg/kK3kl3rzz88Znd9iAJshqdzwsuS7beLbxJlk3JyiwdAv7KRjPn1S4majiPQ0YGjI6QWk+4WsZNYhIFBepZKQD8v/6jcCtLwa7zYGGjs6iWG2+qrKNlvBowPlVJ7yU7h2lsJhhESG7mPusxy1iwqJt+l+lAh/vWSyskGoSdBV8U0F21TKkOZOxiMzTKHZXvOLkLirUjZYoOJTyjEZEj9C0Ci01gDm9gMYhniMT4am7RY/UAFcoMKtt1ertku2tfTw8MlWUTwrxYJ6T4L4UF7MxgTVqW/DEtn2BlQNJ2oqKfXJLdeRU3nRFxxsH1p/PL0LFp8s4zlprYahTVUnpt6QVBaFqriqcitBEfZ+DJSRak5/oygNzE0clShra20wgphD5sdVY5lGGKLhuwmTX3QSCDtWtSL6A07NuL/97g8/8t05bK0o5hIK377aMsOSbFcYy/FcCr+ELM8oHAehog4c5gPmp+zr9FnCfAGC0skqoboEIPe8nu6ee/V7Rl7oMLlpXI1yM90QGUMCemcwdQA1+r9cr11qkaUopNRvuv1exEjSnPZevO5DRuTF2iHAjWnucXw5V3XczCY0T0GGMpEBLJivB6PvSHgNQ0MClkcr0r5k7nlJ9BLkDkbGCRc2E8s+puu/uyFgexQjvIQBTcL2TmvIZq2Oas4pSQpn2Tr79SnJiyznhjuHcWZTCez6yV4UfKhmxkk76XdNL6UnIn7bwWZNjGfI6kt1ErVXtxnCCH5taXr+pvnjZoSW7zUX6Ubk6eGtcrQGkTt0x/jYqDocSsqVuKRCJlhrtkZ5/WR58147cr0bY445Im240nYQ5/CYqmuirLdIJHYeBS0FCkUmfysc5Q4qouCE/KMQfIg0bt/RqXr40n7msuCexzwzDxyjK8BjDlFYFvACkI0vFVbEWDpx9KKlt6V4cfm6AoewRZ4qMdaJ1xXtjy1lB8ugFXhlHBRKz5LwM6RU40a6Rra77s8e4i/g+MzDZIeGx9XPX3wVOwJg6W8/Pw+vghmZyv/3jF7zPT7L8Odety8tG3kVb+e6GFnYTkoIWHTFOV5UMCErQxADd/LDszK7Fp1+P/ScZo9ckV9DcqzZ1EEEvApfFLZHHCv3agb+MViGS2hue2AspKuv4E8aNTUL6yIDG0DpD401p2P/C7EwPWruY+Y8S04Y87YoRhMetnyOxbEQIchSfwhz8wkfuwVsSVPGWFvz5/kygA7OPCHoS0m+GjwO1VfjDhoiy1gQpsgXIeMi97k2SX/1Oxzp6oTWy7WiZ2jvJn1wR7eEAaXAAIv1jveHLU607rAN3zcV9MsfV6PaddJGFI22V4gc9qGiubCFxj51opGHnerx4G0ACjuY/B3sAF5JqU1ruLIpijprLtx89rVTH5p57NV5MQtQDoCZan5poCXFX3MA6KqjVQrEWIbr6T4Am5essSZLK+zWzwdLT7eoKkhMK/+0YnBeAB4CeETpQrcRmfOypFZo5JUn9EdAQsY5F4iwStEmgce5k+Mt63E/CUH5CoH/5nNSLqTbdoQRLaPup4Pb9qun07pI1TpdTM0DABso+gwbbgYG3Bq14yG3QIXq+6r6HVM2e0nlThl+fGj8F+9RPWeW6s5AgORRoZifG5CmXUJfTLU7bao63bZuoAKRZUrctT9/Mu23toj+x8tKrkIlEV7C5LR3bQh00IkfB5l+kafhjq73bg6dEgIiClTZHGSz2/6LMr5aHH01jmmnjhAZtpb4g9OfxDp/DKCYiSZrVCx/fN7QJQQ87baX7gj3SxwRY13NyiYsrtIhQ4k0KJQu6b/X7QXKAtngj760lpAfn0xw07C66A8geOoG9XHvG33DDkBW/3SJVG92VNkMLg124cgZxEsS2zP9EobbpwJoAd9KbDdrdaJsA3DvxIxl8uYpxHrRQiiGwzUdS84mmPGratUnYOPGSQzMyy3cXH4EpsypF3fi03yqOJTOvXXa+jcfK6GCYGAqeR4M116cyqEGasc14ZaCYcq4toMzeXrVvuV9hJ40umyhDL+tQ++2Mi2/Vz8OwaLDz5+oBxlnVYqsTrEfKADvH24Jry+IsWhP5gon3Q4SBP5YfDAvcJbmwMeJsIXAJi6YnHFFdMUC37Rd1nOEKY9vjnrzXfKEPLHqL7/NYrQ3sMjp+I53jdmXAICPF9AzndbnupA5XqZK+mmu/VKXTqOY8uoRZiIyVpN1m9mRboTSyzHUJV5vBHTchhpJbIYIV6MdMYKimrU7iONj3ql+ie6uI5rqNTsYQvCNehpNZ3f/8cINY1/+PO9Bi40Btsq+PcJgHuOY2bsPB87DM1/Jwgux7jA8ENVJnBSX7abE/W138I5XnxAKBTFSIq40iqCxAK+k72pMC6pjKr6oaZzzb9pwv9raN8Qc695C3dnZgEriaZbB/AbTjRbJjorHHgI234DIEb3dr3pspoFoJMRP3OKeG43ro5u6IZo6bBg8lH50TxVwbfTPPLYDNNSpsm0StaYOOPbIDdUcnP+guGVsHw89Dx4k2xjTMQhuKjyrORSJCBy2uaZWMlS/Y7NddIcN9+D9gOluT/Ewj7bA0lUCe04r0sdoewZ4u8IZ4gZbEipUAJaj4aOlpP0Bm5MIpCsy0COgjaTVYARXo3OeG82kfBuUAMqmrcoU4U7eJhkVcFgrrYbET05TG3dPuBIRccwejV2UW8Fe9Y4ZH1xx5GM3gbIRxdnoBixMbbfepgOWQIn/SIuv8hW6uBblAYom691q4PVC1XH3io6eeceNKOeAkANpGp1Ma7fy2DsMCvmCqwJS/x0M2bBVPs5694rbNMy6LErzR/hRxxHoL3BLFFl8C65FTSOiCRLF2wlnvVv5GkBahKUUCHMfQfp2OSgZh8UdT9t/fTNYctTWPVeijXRvD7uqmlcZnFlXgqI1gPVz+ByblF7vi9Br5M4gE7PdvVjxmlWmT2iPaTjY6eygdHZY105aQX2gSSEbWHc4u6p5qqT04+FfOgWp+7ocraQfV/orMkSHglswpRZYA0mAMXoUYRsxQfc6p0vkPsshsVwgrDMJwMNEsK+bs2OvvihrsPt5Hav3gUc2eINIA5TKr1Wbzzb+mbhZwjMt2AlYDv5xFs2+ZyLPZVnd5NzA2oZIP6C9xtzs/1VItTif9q9iGlC0E+NS/McZ2Nmwg5FuCyeN85RJW6SbJmxrR9a3wU8lmVjmk1PSnDmNo2YWP1ARO4XrHpK905Mv+ueDqhQJu1zURdON6BRtJDsOfWANb7Kj93nlJCn4MKzwWw8dXZkkikzw9u5Jg1H1FgDxW5kTE5w6FQmxw82AVqmO8pWVEz7K06wh2RQJfrEIpnwu5fUsXlhxZl+99ksxqlwG9TwhY+wUTkiklDDqRc9AFdkh2UL3JRHvIUhURfKSQSSX9LMYYFDV8EA+dHxbu5IAiXGa8Vj5SD0Dg6fZMxFFtSm6iTpkqN21qmlI6YvXmwFjimnuC9uyI1WHcWq2bQQuHT+6VTBxOkBATCCqFJZtKz+gc54Ly693scKATHoYxcLW5I5ZYLUzVcyEdu2+2cflRStWTR9meo1d1fiioaaTXAW6e1Aa9/x++TwtBZdt7s2vTN7ZBeTQA+RNFGHYbKnV1URzTSVYnEr1Ls6omGGoxyxryMlxWYV9UNa/sX4aJvQm+Liy4YhvC7l7qbUE+ycSww2GFldQcg3ngxcbPw9L4CWWoF0/iG3ykZHahZ9PW9jVzrZyf/BjUMaK8/2QdR0pg9HTaKmQMKubPlBdYriJY2sYrVq3mzGDeiRJXL91k2rImCT3NsNG7VMERBSTJ82L4qfU3zJnw92/NZlNnVd7JH2cpurUO40gAI6ylrqZiuZKVoYoufU8EmRrd76Rx+vuwBgukvwogUR2OM9mIqHbrfpN5Pq79Rts7YCl4HYBXM6l2Vdh6yiXnXoWgNybMNKPa/X8Bgz2C914V/OGiyQ=,iv:xq056Ani+OGZ3/Fx4r6s6awdH2SAk6antLMxBGJaM3g=,tag:ORy1QO+Fw9vrv0wetg82UQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhK3hTbmdjYlhPNk1vM2Y3
+            YjVUb3Q5MytwbGgvU0lCVHJsOUxhQWNhc1ZRCnYwT05Xd3JIVktQWUNwcXkzKzEy
+            eUl2WTlqRHBnUzFWNnorUGc3RFJQQ00KLS0tIHAyUWlqR0VaOERjMWVuOFVtZkt4
+            Mmk0V1o1V2pTcE9DWUM2bUdMWVNPa2cK+KI1lwxxcwk+mXPKBoxMbIKzLvLgVp9m
+            +gLSg0W4UJgxSjyzlk6z9i+xhS6u67YL3hUvth3JzPn0WeAARZLqrQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlR1dGT3FKamI3MW9DVDBz
+            dDY0RmRwVDVyRkVnOEhRVlNUSG9TcUg4RXp3ClRNalZHM0RwdG4xait6ZGpKd3BT
+            dFdTa1NvV211N0ZXZWgrRmtqMmxzS0kKLS0tIDFQK1ArRW9keVc3OXIxTkFVQUhx
+            UlJCV3hUNEkzRTZmaE1SdVJnN2V0QzQKQU8A+8IOqWsSV17Sfro5qxSS4TrfHocH
+            nl32Zlz4xb6QS6o7PbORGo/Ck0UUWE1SNqHfLj0zOLlgTZU4mPFtww==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RHFDTE1TbjlpQzFDTm5T
+            L0J0TmlJSUVBUFdlM0dkY3RjaGVYNmJRMm1JCmF2Z1FxVXdaWm41YXBuQVNWRUR6
+            UUNkL3lYQSttaVJKVVhuM2ovQ2paMW8KLS0tIEFtVzA2bEhXYjJxdmpLSUQ2YlVw
+            RGxqcTR3Njc2dUozcEZLWmMrRldDaE0KWPflKVLM0mj8TuLRYD23hBB5jtJ/MbN6
+            BBJ41efzm+3GMvZ/whahl3mF/csCOuefoUL1S9MYmocfwl4K5tR5wQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRSXdoUEpaaEZxb01wVjgz
+            YzNVNzJYSGx0OGlFYnR2ZmNnVEE3MVVqZjI0CnR4eVkxYXFEUmlxcDFXTWpUYjFY
+            TTcvaXNrUTFaVHdXZ29qcThJYzViQUEKLS0tIG85SThFTnN6QnI2dGxtRjJwVlQ3
+            ODZUK0ZMZW9GUVNMWktiNHJPSVE5d0EKBGM7ay7sJbvIZdiOjDFNLhc5sRB8aFE7
+            iUGgikUNQ1UFHtcaXu7MNbhIrqUBkaQNfDtPPLE6aM483sAbkBz4rQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdzBtbG55bGYzTllTbHIw
+            SGtUQk1EcHpTbkNFWHNKb20zMTlRY3QrU3owCkhjVkhGLzZpMHgzQ1VCNnZsMSt6
+            M0ZOOFBhOE5IeGdGc3M4b3RycU51a00KLS0tIGZPTTEwTzkyMVlIVDk0bm81ckVx
+            UzdOWE4rZVhpcGZpb3dWSVY5OG8wSVkKNWXZO2zPVS3hgPYU5ktQNPGXB1GA9WaD
+            ac7b1YEfbG8fRF7hGu1p3uCI9+cz8VrNE3fbDUXRmp+zkVoK62Fzig==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzUjJQbk5sV0VDU2drUmx0
+            c3JYdTUybVRqZmNqcWdiNDV5L1VhaWp5MTBJCnhPc2hxMzlja3Ftbk5jQm9EVVdG
+            aUI4M25mb04vdnJ0WFU4bzU2UzZiQ28KLS0tIE1rbFNqM2NHdThRL1VvQ2JkeEwy
+            THRaQ20zSlVmRXpOVnQ1R2g1OVJLek0KStr3Qmu4P00vqxVq/mzVFKQc+3uTH1u4
+            PPo7Tw2f9PWE7A+EUi9LDKxNHJ/HugrUkq1YXDIPbL56tfHpVeCtzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArRHhoQis4M3dXeDdCRWNu
+            UmJKR0lnaUpIeFFZQVUxV2RHb001SGRuSFJZCmhlT1RBUEZKcWhTMWRwZWZIb2Rm
+            ZkxWQi9lek5sU2c2My9aeFBPbTRTNTAKLS0tIEh2VmV2d0d2TEhBUzZoME1JVTQ4
+            T212OUN5VmxmLzlKSHROdjZ3WjVSNW8Kr7K2Y7GIDqR5sbte+yZIFTLMSaa6cyUJ
+            of5clYcJSv9jkvNOOLR3ZWMK+c1NY9SUSS+No8phPrtqBqcIWsGxYQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-01T11:12:03Z"
+    mac: ENC[AES256_GCM,data:Ky2xbYdZijuS5TWWwum0ed8d2L/EdbFi0Bnrxlpw5Hc9XWnoXoJUXFLL3skfEMF0H/tLvtVuV6q10nBrKHkKeA2ex99I+KTRNyw7NmXikr7QZFXqBadul63lAFKlwm/js8q+3rIgVeu9uTsXX2QJqbN7rJ2frwIDYolSCvUSD/I=,iv:Y0UbW9AFMz0YmJzld+hipjmmurDl73ZOKDTFIg5AEqs=,tag:CPPvWdVknamBaT3M93tD/w==,type:str]
+    pgp:
+        - created_at: "2024-04-01T10:55:18Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYAQ/8D9k8KG7kvpTuGZ+khrB4RxGNGEQKV9qmrrX2TzSlajDs
+            dAt+qjh670Wh23xnYwg62G49g0tmZpaOhrZ9bvPL7GCbABm5eNNWh25owKpIcStb
+            J1cpytoKw5f2fjEcVj0Pw1gkx1YojZW46nE/Hkak9sJNqKR/9mGRYlZ537TjySzq
+            HqEr32VxyCbwnWSicxnCpGez6g7D/Z8ET3V8IVCEsaqyUMGCIzsUqWzgZoTxbryF
+            osvir8lyAc4U0pHjma9jHudjhyAHSbX5IAQBRUbRcDitAwmFOWdQ/1ts/7xs+atd
+            bC4aQnDrk7JpApXNj3+LKFnt3ZgLu3aCV6Fxp2BJBW7XYgulGOCEO/x5MOh0tZOi
+            RAu89PA4+vBpJvMq9mMNQhYfOa6e7WVYitKjjTRVAZbArjNjMYEj9EVYxC00vmwK
+            ZIs8zTfQsyYPPr9MyKvRPDScOf0f3Gw0WyH5VIHpO8dtlTOABqJddhmomD8jImsZ
+            VsXXcuqTWRUMS/z4f3/OmQ7nLaA3bX6/bi7VAUg9g22YJBwzDSbVi/M409+uakaO
+            eC6otcyn8uzIBar/cBf4ovgpCTBPVZ+Pf7qmL0AN4pQk+Pi94J12yTUyDZJfCfrP
+            PXUsjjYb+7rlAXo+KYkVjAOkhPn2zfNHPHi1naDGYBYaMwa1hoAqAeW15r4MRgvS
+            XgGsC1YeMF955Gysqaqk6VStaHAJuIHTPb6p4+iTdYYUYn5JPgjjTzFw3Sy9QBN+
+            h2YFCxL1PXQedRQ2VCVNkvwFChQDxFGTmXA0f4ItK9z5AzRM6NSbI5cYa/o/wEc=
+            =stLw
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1