flake.{nix,lock}: bumpdeedump

Reviewed-on: #114

.gitea/workflows/eval.yml

@@ -8,6 +8,6 @@ jobs:
     steps:
     - uses: actions/checkout@v3
     - run: apt-get update && apt-get -y install sudo
-    - uses: https://github.com/cachix/install-nix-action@v23
+    - uses: https://github.com/cachix/install-nix-action@v31
     - run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
     - run: nix flake check

.mailmap

@@ -0,0 +1,25 @@
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> <daniel.olsen99@gmail.com>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel <danio@pvv.ntnu.no>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@pvv.ntnu.no>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> danio <danio@pvv.ntnu.no>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@bicep.pvv.ntnu.no>
+
+
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> h7x4 <h7x4@nani.wtf>
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein Tveit <oysteikt@pvv.ntnu.no>
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> oysteikt <oysteikt@pvv.ntnu.no>
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein <oysteikt@pvv.org>
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
+
+Felix Albrigtsen <felixalb@pvv.ntnu.no> <felix@albrigtsen.it>
+Felix Albrigtsen <felixalb@pvv.ntnu.no> <felixalbrigtsen@gmail.com>
+Felix Albrigtsen <felixalb@pvv.ntnu.no> felixalb <felixalb@pvv.ntnu.no>
+
+Peder Bergebakken Sundt <pederbs@pvv.ntnu.no> <pbsds@hotmail.com>
+
+Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian G L <adrian@lauterer.it>
+Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lauterer.it>
+
+Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
+Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>

.sops.yaml

@@ -1,6 +1,6 @@
 keys:
   # Users
-  - &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+  - &user_danio age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
   - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
   - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
   - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
@@ -12,9 +12,14 @@ keys:
   - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
   - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
   - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
-  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+  - &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
   - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
   - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
+  - &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
+  - &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
+  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
+  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
+  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
 
 creation_rules:
   # Global secrets
@@ -104,3 +109,19 @@ creation_rules:
       - *user_pederbs_bjarte
       pgp:
       - *user_oysteikt
+
+  - path_regex: secrets/lupine/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_lupine-1
+      - *host_lupine-2
+      - *host_lupine-3
+      - *host_lupine-4
+      - *host_lupine-5
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      pgp:
+      - *user_oysteikt

base/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, fp, ... }:
+{
+  pkgs,
+  lib,
+  fp,
+  ...
+}:
 
 {
   imports = [
@@ -7,8 +12,11 @@
 
     ./networking.nix
     ./nix.nix
+    ./vm.nix
+    ./flake-input-exporter.nix
 
     ./services/acme.nix
+    ./services/uptimed.nix
     ./services/auto-upgrade.nix
     ./services/dbus.nix
     ./services/fwupd.nix
@@ -55,16 +63,16 @@
   # home-manager usually handles this for you: https://github.com/nix-community/home-manager/blob/22a36aa709de7dd42b562a433b9cefecf104a6ee/modules/programs/bash.nix#L203-L209
   # btw, programs.bash.shellInit just goes into environment.shellInit which in turn goes into /etc/profile, spooky shit
   programs.bash.shellInit = ''
-   if [ -n "''${BASH_VERSION:-}" ]; then
-     if [[ ! -f ~/.bash_profile && ! -f ~/.bash_login ]]; then
-      [[ -f ~/.bashrc ]] && . ~/.bashrc
-     fi
-   fi
+    if [ -n "''${BASH_VERSION:-}" ]; then
+      if [[ ! -f ~/.bash_profile && ! -f ~/.bash_login ]]; then
+       [[ -f ~/.bashrc ]] && . ~/.bashrc
+      fi
+    fi
   '';
 
   programs.zsh.enable = true;
 
-  security.lockKernelModules = true;
+  # security.lockKernelModules = true;
   security.protectKernelImage = true;
   security.sudo.execWheelOnly = true;
   security.sudo.extraConfig = ''
@@ -76,4 +84,3 @@
   # Trusted users on the nix builder machines
   users.groups."nix-builder-users".name = "nix-builder-users";
 }
-

base/flake-input-exporter.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  data = lib.flip lib.mapAttrs inputs (
+    name: input: {
+      inherit (input)
+        lastModified
+        ;
+    }
+  );
+  folder = pkgs.writeTextDir "share/flake-inputs" (
+    lib.concatMapStringsSep "\n" (
+      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
+    ) (lib.attrsToList data)
+  );
+  port = 9102;
+in
+{
+  services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
+    serverName = config.networking.fqdn;
+    serverAliases = [
+      "${config.networking.hostName}.pvv.org"
+    ];
+    locations."/metrics" = {
+      root = "${folder}/share";
+      tryFiles = "/flake-inputs =404";
+      extraConfig = ''
+        default_type text/plain;
+      '';
+    };
+    listen = [
+      {
+        inherit port;
+        addr = "0.0.0.0";
+      }
+    ];
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow 129.241.210.128/25;
+      allow 2001:700:300:1900::/64;
+      deny all;
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+}

base/nix.nix

@@ -1,4 +1,4 @@
-{ inputs, ... }:
+{ lib, config, inputs, ... }:
 {
   nix = {
     gc = {
@@ -9,8 +9,9 @@
 
     settings = {
       allow-dirty = true;
+      auto-allocate-uids = true;
       builders-use-substitutes = true;
-      experimental-features = [ "nix-command" "flakes" ];
+      experimental-features = [ "nix-command" "flakes" "auto-allocate-uids" ];
       log-lines = 50;
       use-xdg-base-directories = true;
     };
@@ -21,11 +22,16 @@
     ** use the same channel the system
     ** was built with
     */
-    registry = {
-      "nixpkgs".flake = inputs.nixpkgs;
-      "nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
-      "pvv-nix".flake = inputs.self;
-    };
+    registry = lib.mkMerge [
+      {
+        "nixpkgs".flake = inputs.nixpkgs;
+        "nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
+      }
+      # We avoid the reference to self in vmVariant to get a stable system .outPath for equivalence testing
+      (lib.mkIf (!config.virtualisation.isVmVariant) {
+        "pvv-nix".flake = inputs.self;
+      })
+    ];
     nixPath = [
       "nixpkgs=${inputs.nixpkgs}"
       "unstable=${inputs.nixpkgs-unstable}"

base/services/auto-upgrade.nix

@@ -1,26 +1,39 @@
-{ inputs, pkgs, lib, ... }:
+{ config, inputs, pkgs, lib, ... }:
+
+let
+  inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
+in
+
 {
   system.autoUpgrade = {
     enable = true;
     flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
     flags = [
-      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
-      # https://git.lix.systems/lix-project/lix/issues/400
       "--refresh"
-      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
-      "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
       "--no-write-lock-file"
-    ];
+      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
+      # as such we instead use --override-input combined with --refresh
+      # https://git.lix.systems/lix-project/lix/issues/400
+    ] ++ (lib.pipe inputUrls [
+      (lib.intersectAttrs {
+        nixpkgs = { };
+        nixpkgs-unstable = { };
+      })
+      (lib.mapAttrsToList (input: url: ["--override-input" input url]))
+      lib.concatLists
+    ]);
   };
 
   # workaround for https://github.com/NixOS/nix/issues/6895
   # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc."current-system-flake-inputs.json".source
-    = pkgs.writers.writeJSON "flake-inputs.json" (
-      lib.flip lib.mapAttrs inputs (name: input:
-        # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
-        lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
-          // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
-      )
-    );
+  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
+    "current-system-flake-inputs.json".source
+      = pkgs.writers.writeJSON "flake-inputs.json" (
+        lib.flip lib.mapAttrs inputs (name: input:
+          # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
+          lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
+            // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
+        )
+      );
+  };
 }

base/services/postfix.nix

@@ -6,18 +6,17 @@ in
   services.postfix = {
     enable = true;
 
-    hostname = "${config.networking.hostName}.pvv.ntnu.no";
-    domain = "pvv.ntnu.no";
+    settings.main = {
+      myhostname = "${config.networking.hostName}.pvv.ntnu.no";
+      mydomain = "pvv.ntnu.no";
 
-    relayHost = "smtp.pvv.ntnu.no";
-    relayPort = 465;
+      # Nothing should be delivered to this machine
+      mydestination = [ ];
+
+      relayhost = [ "smtp.pvv.ntnu.no:465" ];
 
-    config = {
       smtp_tls_wrappermode = "yes";
       smtp_tls_security_level = "encrypt";
     };
-
-    # Nothing should be delivered to this machine
-    destination = [ ];
   };
-}
+}

base/services/uptimed.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.uptimed;
+in
+{
+  options.services.uptimed.settings = lib.mkOption {
+    description = "";
+    default = { };
+    type = lib.types.submodule {
+      freeformType = with lib.types; attrsOf (either str (listOf str));
+    };
+  };
+
+  config = {
+    services.uptimed = {
+      enable = true;
+
+      settings = let
+        stateDir = "/var/lib/uptimed";
+      in {
+        PIDFILE = "${stateDir}/pid";
+        SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
+      };
+    };
+
+    systemd.services.uptimed = lib.mkIf (cfg.enable) {
+      serviceConfig = let
+        uptimed = pkgs.uptimed.overrideAttrs (prev: {
+          postPatch = ''
+             substituteInPlace Makefile.am \
+               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
+             substituteInPlace src/Makefile.am \
+               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
+          '';
+        });
+
+      in {
+        Type = "notify";
+
+        ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
+
+        BindReadOnlyPaths = let
+          configFile = lib.pipe cfg.settings [
+            (lib.mapAttrsToList
+              (k: v:
+                if builtins.isList v
+                  then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
+                  else "${k}=${v}")
+            )
+            (lib.concatStringsSep "\n")
+            (pkgs.writeText "uptimed.conf")
+          ];
+        in [
+          "${configFile}:/var/lib/uptimed/uptimed.conf"
+        ];
+      };
+    };
+  };
+}

base/vm.nix

@@ -0,0 +1,15 @@
+{ lib, ... }:
+
+# This enables
+#     lib.mkIf (!config.virtualisation.isVmVariant) { ... }
+
+{
+  options.virtualisation.isVmVariant = lib.mkOption {
+    description = "`true` if system is build with 'nixos-rebuild build-vm'";
+    type = lib.types.bool;
+    default = false;
+  };
+  config.virtualisation.vmVariant = {
+    virtualisation.isVmVariant = true;
+  };
+}

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745502102,
-        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
+        "lastModified": 1764627417,
+        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
+        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
         "type": "github"
       },
       "original": {
@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736621371,
-        "narHash": "sha256-45UIQSQA7R5iU4YWvilo7mQbhY1Liql9bHBvYa3qRI0=",
+        "lastModified": 1764868579,
+        "narHash": "sha256-rfTUOIc0wnC4+19gLVfPbHfXx/ilfuUix6bWY+yaM2U=",
         "ref": "refs/heads/main",
-        "rev": "3729796c1213fe76e568ac28f1df8de4e596950b",
-        "revCount": 20,
+        "rev": "9c923d1d50daa6a3b28c3214ad2300bfaf6c8fcd",
+        "revCount": 22,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
       },
@@ -48,11 +48,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1746563623,
-        "narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
+        "lastModified": 1764868843,
+        "narHash": "sha256-ZXYLXKO+VjAJr2f5zz+7SuKFICfI2eZnmTgS/626YE0=",
         "ref": "refs/heads/main",
-        "rev": "4e0408887f80e61a90286ff630a7855b828ae421",
-        "revCount": 45,
+        "rev": "c095533c50e80dd18ac48046f1479cf4d83c631c",
+        "revCount": 52,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
@@ -68,11 +68,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736178795,
-        "narHash": "sha256-mPdi8cgvIDYcgG3FRG7A4BOIMu2Jef96TPMnV00uXlM=",
+        "lastModified": 1764867811,
+        "narHash": "sha256-UWHiwr8tIcGcVxMLvAdNxDbQ8QuHf3REHboyxvFkYEI=",
         "ref": "refs/heads/master",
-        "rev": "fde738910de1fd8293535a6382c2f0c2749dd7c1",
-        "revCount": 79,
+        "rev": "c9983e947efe047ea9d6f97157a1f90e49d0eab3",
+        "revCount": 81,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
       },
@@ -88,27 +88,52 @@
         ]
       },
       "locked": {
-        "lastModified": 1735857245,
-        "narHash": "sha256-AKLLPrgXTxgzll3DqVUMa4QlPlRN3QceutgFBmEf8Nk=",
+        "lastModified": 1764844095,
+        "narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "da9dc0479ffe22362793c87dc089035facf6ec4d",
+        "rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
-        "ref": "0.7.0",
+        "ref": "master",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }
     },
-    "minecraft-data": {
+    "minecraft-heatmap": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1725277886,
-        "narHash": "sha256-Fw4VbbE3EfypQWSgPDFfvVH47BHeg3ptsO715NlUM8Q=",
-        "ref": "refs/heads/master",
-        "rev": "1b4087bd3322a2e2ba84271c8fcc013e6b641a58",
-        "revCount": 2,
+        "lastModified": 1756124334,
+        "narHash": "sha256-DXFmSpgI8FrqcdqY7wg5l/lpssWjslHq5ufvyp/5k4o=",
+        "ref": "refs/heads/main",
+        "rev": "83760b1ebcd9722ddf58a4117d29555da65538ad",
+        "revCount": 13,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
+      }
+    },
+    "minecraft-kartverket": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764830810,
+        "narHash": "sha256-I/pVqi4STwmJbpFDI9TmU9PS1lKuYdbJLcztukvZ3PU=",
+        "ref": "refs/heads/main",
+        "rev": "df52aa968679a62745bf42c272de53fdd9a035ac",
+        "revCount": 16,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
       },
@@ -139,34 +164,28 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745526780,
-        "narHash": "sha256-LXXYBmFPMQU2lTb6alKWfjgQs08BKn+txMNcgbu00hI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "9204750b34cae1a8347ab4b5588115edfeebc6d7",
-        "type": "github"
+        "lastModified": 1764806471,
+        "narHash": "sha256-Qk0SArnS83KqyS9wNt1YoTkkYKDraNrjRWKUtB9DKoM=",
+        "rev": "6707b1809330d0f912f5813963bb29f6f194ee81",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.896.6707b1809330/nixexprs.tar.xz"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.11-small",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1745688173,
-        "narHash": "sha256-fgvG1O5JvSSjeQx+ea0DJ3GfMbLPVhAQta/DqQ2y6jc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "6a2957c7978b189202e03721aab901c0a9dc1e1a",
-        "type": "github"
+        "lastModified": 1764854611,
+        "narHash": "sha256-MVzFp4ZKwdh6U1wy4fJe/GY3Hb4cvvyJbAZOhaeBQoo=",
+        "rev": "3a4b875aef660bbd148e86b92cffea2a360c3275",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre906534.3a4b875aef66/nixexprs.tar.xz"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable-small",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
       }
     },
     "pvv-calendar-bot": {
@@ -176,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723850344,
-        "narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
+        "lastModified": 1764869785,
+        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
         "ref": "refs/heads/main",
-        "rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
-        "revCount": 19,
+        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
+        "revCount": 23,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -196,11 +215,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741738148,
-        "narHash": "sha256-cJo6nbcJEOjkazkZ194NDnlsZe0W0wpxeUh2/886uC8=",
+        "lastModified": 1757332682,
+        "narHash": "sha256-4p4aVQWs7jHu3xb6TJlGik20lqbUU/Fc0/EHpzoRlO0=",
         "ref": "refs/heads/main",
-        "rev": "c1802e7cf27c7cf8b4890354c982a4eef5b11593",
-        "revCount": 486,
+        "rev": "da1113341ad9881d8d333d1e29790317bd7701e7",
+        "revCount": 518,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -216,7 +235,8 @@
         "greg-ng": "greg-ng",
         "grzegorz-clients": "grzegorz-clients",
         "matrix-next": "matrix-next",
-        "minecraft-data": "minecraft-data",
+        "minecraft-heatmap": "minecraft-heatmap",
+        "minecraft-kartverket": "minecraft-kartverket",
         "nix-gitea-themes": "nix-gitea-themes",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
@@ -233,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746498961,
-        "narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
+        "lastModified": 1764816035,
+        "narHash": "sha256-F0IQSmSj4t2ThkbWZooAhkCTO+YpZSd2Pqiv2uoYEHo=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
+        "rev": "74d9abb7c5c030469f90d97a67d127cc5d76c238",
         "type": "github"
       },
       "original": {
@@ -253,11 +273,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745310711,
-        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,8 +2,8 @@
   description = "PVV System flake";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; # remember to also update the url in base/services/auto-upgrade.nix
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
+    nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
+    nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
 
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -17,12 +17,15 @@
     pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
     pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
 
-    matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/master";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
     nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
 
+    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git";
+    minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
+
     greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
     greg-ng.inputs.nixpkgs.follows = "nixpkgs";
     gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
@@ -30,7 +33,8 @@
     grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
     grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
 
-    minecraft-data.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
+    minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
+    minecraft-kartverket.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
@@ -55,19 +59,28 @@
 
     nixosConfigurations = let
       unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-      nixosConfig = nixpkgs: name: config: lib.nixosSystem (lib.recursiveUpdate
-        rec {
+
+      nixosConfig =
+        nixpkgs:
+        name:
+        configurationPath:
+        extraArgs:
+        lib.nixosSystem (lib.recursiveUpdate
+        (let
           system = "x86_64-linux";
+        in {
+          inherit system;
+
           specialArgs = {
             inherit unstablePkgs inputs;
             values = import ./values.nix;
             fp = path: ./${path};
-          };
+          } // extraArgs.specialArgs or { };
 
           modules = [
-            ./hosts/${name}/configuration.nix
+            configurationPath
             sops-nix.nixosModules.sops
-          ] ++ config.modules or [];
+          ] ++ extraArgs.modules or [];
 
           pkgs = import nixpkgs {
             inherit system;
@@ -78,23 +91,33 @@
               ];
             overlays = [
               # Global overlays go here
-            ] ++ config.overlays or [ ];
+            ] ++ extraArgs.overlays or [ ];
           };
-        }
-        (removeAttrs config [ "modules" "overlays" ])
+        })
+        (builtins.removeAttrs extraArgs [
+          "modules"
+          "overlays"
+          "specialArgs"
+        ])
       );
 
-      stableNixosConfig = nixosConfig nixpkgs;
-      unstableNixosConfig = nixosConfig nixpkgs-unstable;
+      stableNixosConfig = name: extraArgs:
+          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
     in {
       bicep = stableNixosConfig "bicep" {
         modules = [
           inputs.matrix-next.nixosModules.default
           inputs.pvv-calendar-bot.nixosModules.default
+          inputs.minecraft-heatmap.nixosModules.default
           self.nixosModules.gickup
+          self.nixosModules.matrix-ooye
         ];
         overlays = [
-          inputs.pvv-calendar-bot.overlays.x86_64-linux.default
+          inputs.pvv-calendar-bot.overlays.default
+          inputs.minecraft-heatmap.overlays.default
+          (final: prev: {
+            inherit (self.packages.${prev.system}) out-of-your-element;
+          })
         ];
       };
       bekkalokk = stableNixosConfig "bekkalokk" {
@@ -111,12 +134,6 @@
           inputs.pvv-nettsiden.nixosModules.default
         ];
       };
-      bob = stableNixosConfig "bob" {
-        modules = [
-          disko.nixosModules.disko
-          { disko.devices.disk.disk1.device = "/dev/vda"; }
-        ];
-      };
       ildkule = stableNixosConfig "ildkule" { };
       #ildkule-unstable = unstableNixosConfig "ildkule" { };
       shark = stableNixosConfig "shark" { };
@@ -159,19 +176,29 @@
           inputs.gergle.overlays.default
         ];
       };
-    };
+    }
+    //
+    (let
+      machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
+      stableLupineNixosConfig = name: extraArgs:
+          nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
+    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
+      modules = [{ networking.hostName = name; }];
+      specialArgs.lupineName = name;
+    }));
 
     nixosModules = {
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
       robots-txt = ./modules/robots-txt.nix;
       gickup = ./modules/gickup;
+      matrix-ooye = ./modules/matrix-ooye.nix;
     };
 
     devShells = forAllSystems (system: {
-      default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
+      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
       cuda = let
-        cuda-pkgs = import nixpkgs {
+        cuda-pkgs = import nixpkgs-unstable {
           inherit system;
           config = {
             allowUnfree = true;
@@ -193,6 +220,7 @@
 
         simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
+        out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
       } //
       (lib.pipe null [
         (_: pkgs.callPackage ./packages/mediawiki-extensions { })

hosts/bekkalokk/services/bluemap/default.nix

@@ -1,6 +1,7 @@
 { config, lib, pkgs, inputs, ... }:
 let
   vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
+  format = pkgs.formats.hocon { };
 in {
   imports = [
     ./module.nix # From danio, pending upstreaming
@@ -14,20 +15,24 @@ in {
   services.bluemap = {
     enable = true;
     package = pkgs.callPackage ./package.nix { };
-    
+
     eula = true;
     onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
 
     host = "minecraft.pvv.ntnu.no";
 
-    maps = {
+    maps = let
+      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
+    in {
       "verden" = {
         settings = {
           world = vanillaSurvival;
           sorting = 0;
           ambient-light = 0.1;
           cave-detection-ocean-floor = -5;
-          marker-sets = inputs.minecraft-data.map-markers.vanillaSurvival.verden;
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/overworld.hocon") ];
+          };
         };
       };
       "underverden" = {
@@ -42,7 +47,9 @@ in {
           cave-detection-ocean-floor = -5;
           cave-detection-uses-block-light = true;
           max-y = 90;
-          marker-sets = inputs.minecraft-data.map-markers.vanillaSurvival.underverden;
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/nether.hocon") ];
+          };
         };
       };
       "enden" = {
@@ -55,6 +62,9 @@ in {
           world-sky-light = 0;
           remove-caves-below-y = -10000;
           cave-detection-ocean-floor = -5;
+          marker-sets = {
+            _includes = [ (format.lib.mkInclude "${bluemap-export}/the-end.hocon") ];
+          };
         };
       };
     };

hosts/bekkalokk/services/mediawiki/default.nix

@@ -214,11 +214,11 @@ in {
       "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
         buildInputs = with pkgs; [ imagemagick ];
       } ''
-        convert \
+        magick \
+          ${fp /assets/logo_blue_regular.png} \
           -resize x64 \
           -gravity center \
           -crop 64x64+0+0 \
-          ${fp /assets/logo_blue_regular.png} \
           -flatten \
           -colors 256 \
           -background transparent \

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -53,7 +53,7 @@ in {
 
         echo "Creating thumbnail for $fname"
         mkdir -p $(dirname ".thumbnails/$fname")
-        convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
+        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
         touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
       done <<< "$images"
     '';

hosts/bicep/configuration.nix

@@ -8,7 +8,8 @@
     ./services/nginx
 
     ./services/calendar-bot.nix
-    ./services/git-mirrors
+    #./services/git-mirrors
+    #./services/minecraft-heatmap.nix
     ./services/mysql.nix
     ./services/postgres.nix
 
@@ -20,13 +21,15 @@
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;
 
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/disk/by-id/scsi-3600508b1001cb1a8751c137b30610682";
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
 
   networking.hostName = "bicep";
 
-  systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
-    matchConfig.Name = "enp6s0f0";
+  #systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
+  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
+    #matchConfig.Name = "enp6s0f0";
+    matchConfig.Name = "ens18";
     address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
       ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
   };
@@ -37,6 +40,13 @@
   # There are no smart devices
   services.smartd.enable = false;
 
+  # we are a vm now
+  services.qemuGuest.enable = true;
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.sshguard.enable = true;
+
   # Do not change, even during upgrades.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "22.11";

hosts/bicep/hardware-configuration.nix

@@ -5,22 +5,29 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ahci" "sd_mod" "sr_mod" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
+  boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/31a67903-dc00-448a-a24a-36e820318fe5";
+    { device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
       fsType = "ext4";
     };
 
+  # temp data disk, only 128gb not enough until we can add another disk to the system.
   fileSystems."/data" =
-    { device = "/dev/disk/by-uuid/79e93eed-ad95-45c9-b115-4ef92afcc8c0";
-      fsType = "f2fs";
+    { device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/198B-E363";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
@@ -30,11 +37,7 @@
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s0f1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s0f2.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s0f3.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/bicep/services/git-mirrors/default.nix

@@ -17,7 +17,7 @@ in
       zip = false;
       keep = 10;
       bare = true;
-      lfs = true;
+      lfs = false;
     };
 
     instances = let
@@ -59,7 +59,7 @@ in
   };
 
   services.cgit = let
-    domain = "bicep.pvv.ntnu.no";
+    domain = "mirrors.pvv.ntnu.no";
   in {
     ${domain} = {
       enable = true;
@@ -81,7 +81,7 @@ in
     };
   };
 
-  services.nginx.virtualHosts."bicep.pvv.ntnu.no" = {
+  services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
     forceSSL = true;
     enableACME = true;
 
@@ -94,7 +94,7 @@ in
     in toString small-pvv-logo;
   };
 
-  systemd.services."fcgiwrap-cgit-bicep.pvv.ntnu.no" = {
+  systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {
     serviceConfig.BindReadOnlyPaths = [ cfg.dataDir ];
   };
 }

hosts/bicep/services/matrix/default.nix

@@ -9,7 +9,8 @@
     ./coturn.nix
     ./mjolnir.nix
 
-    ./discord.nix
+    # ./discord.nix
+    ./out-of-your-element.nix
     ./hookshot
   ];
 

hosts/bicep/services/matrix/discord.nix

@@ -45,7 +45,7 @@ in
   };
 
 
-  services.mx-puppet-discord.enable = true;
+  services.mx-puppet-discord.enable = false;
   services.mx-puppet-discord.settings = {
     bridge = {
       bindAddress = "localhost";

hosts/bicep/services/matrix/hookshot/default.nix

@@ -77,14 +77,14 @@ in
         outbound = true;
         urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
         userIdPrefix = "_webhooks_";
-        allowJsTransformationFunctions = false;
+        allowJsTransformationFunctions = true;
         waitForComplete = false;
       };
       feeds = {
         enabled = true;
         pollIntervalSeconds = 600;
       };
-      
+
       serviceBots = [
         { localpart = "bot_feeds";
           displayname = "Aya";
@@ -94,6 +94,11 @@ in
         }
       ];
 
+      widgets = {
+        roomSetupWidget.addOnInvite = false;
+        publicUrl = "https://hookshot.pvv.ntnu.no/widgetapi/v1/static";
+      };
+
       permissions = [
         # Users of the PVV Server
         { actor = "pvv.ntnu.no";
@@ -128,6 +133,7 @@ in
 
   services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
     enableACME = true;
+    addSSL = true;
     locations."/" = {
       proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
     };

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -0,0 +1,66 @@
+{ config, pkgs, fp, ... }:
+let
+  cfg = config.services.matrix-ooye;
+in
+{
+  users.groups.keys-matrix-registrations = { };
+
+  sops.secrets = {
+    "matrix/ooye/as_token" = {
+      sopsFile = fp /secrets/bicep/matrix.yaml;
+      key = "ooye/as_token";
+    };
+    "matrix/ooye/hs_token" = {
+      sopsFile = fp /secrets/bicep/matrix.yaml;
+      key = "ooye/hs_token";
+    };
+    "matrix/ooye/discord_token" = {
+      sopsFile = fp /secrets/bicep/matrix.yaml;
+      key = "ooye/discord_token";
+    };
+    "matrix/ooye/discord_client_secret" = {
+      sopsFile = fp /secrets/bicep/matrix.yaml;
+      key = "ooye/discord_client_secret";
+    };
+  };
+
+  services.matrix-ooye = {
+    enable = true;
+    homeserver = "https://matrix.pvv.ntnu.no";
+    homeserverName = "pvv.ntnu.no";
+    discordTokenPath = config.sops.secrets."matrix/ooye/discord_token".path;
+    discordClientSecretPath = config.sops.secrets."matrix/ooye/discord_client_secret".path;
+    bridgeOrigin = "https://ooye.pvv.ntnu.no";
+
+    enableSynapseIntegration = false;
+  };
+
+  systemd.services."matrix-synapse" = {
+    after = [
+      "matrix-ooye-pre-start.service"
+      "network-online.target"
+    ];
+    requires = [ "matrix-ooye-pre-start.service" ];
+    serviceConfig = {
+      LoadCredential = [
+        "matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
+      ];
+      ExecStartPre = [
+        "+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
+        "+${pkgs.coreutils}/bin/chown matrix-synapse:keys-matrix-registrations ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
+      ];
+    };
+  };
+
+  services.matrix-synapse-next.settings = {
+    app_service_config_files = [
+      "${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
+    ];
+  };
+
+  services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/".proxyPass = "http://localhost:${cfg.socket}";
+  };
+}

hosts/bicep/services/matrix/smtp-authenticator/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub }:
+{ lib, buildPythonPackage, fetchFromGitHub, setuptools }:
 
 buildPythonPackage rec {
   pname = "matrix-synapse-smtp-auth";
@@ -6,6 +6,9 @@ buildPythonPackage rec {
 
   src = ./.;
 
+  pyproject = true;
+  build-system = [ setuptools ];
+
   doCheck = false;
 
   meta = with lib; {

hosts/bicep/services/minecraft-heatmap.nix

@@ -0,0 +1,49 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.minecraft-heatmap;
+in
+{
+  sops.secrets."minecraft-heatmap/ssh-key/private" = {
+    mode = "600";
+  };
+
+  sops.secrets."minecraft-heatmap/postgres-passwd" = {
+    mode = "600";
+  };
+
+  services.minecraft-heatmap = {
+    enable = true;
+    database = {
+      host = "postgres.pvv.ntnu.no";
+      port = 5432;
+      name = "minecraft_heatmap";
+      user = "minecraft_heatmap";
+      passwordFile = config.sops.secrets."minecraft-heatmap/postgres-passwd".path;
+    };
+  };
+
+  systemd.services.minecraft-heatmap-ingest-logs = {
+    serviceConfig.LoadCredential = [
+      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
+    ];
+
+    preStart = let
+      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
+        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
+        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
+        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
+      '';
+    in ''
+      mkdir -p '${cfg.minecraftLogsDir}'
+      "${lib.getExe pkgs.rsync}" \
+      --archive \
+      --verbose \
+      --progress \
+      --no-owner \
+      --no-group \
+      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
+      root@innovation.pvv.ntnu.no:/ \
+      '${cfg.minecraftLogsDir}'/
+    '';
+  };
+}

hosts/bob/configuration.nix

@@ -1,46 +0,0 @@
-{ config, fp, pkgs, values, ... }:
-{
-  imports = [
-      # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-      (fp /base)
-      (fp /misc/metrics-exporters.nix)
-      ./disks.nix
-
-      (fp /misc/builder.nix)
-    ];
-
-  sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
-
-  boot.loader.grub = {
-    enable = true;
-    efiSupport = true;
-    efiInstallAsRemovable = true;
-  };
-
-  networking.hostName = "bob"; # Define your hostname.
-
-  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
-    matchConfig.Name = "en*";
-    DHCP = "yes";
-    gateway = [ ];
-  };
-
-  # List packages installed in system profile
-  environment.systemPackages = with pkgs; [
-  ];
-
-  # List services that you want to enable:
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
-
-}

hosts/bob/disks.nix

@@ -1,39 +0,0 @@
-# Example to create a bios compatible gpt partition
-{ lib, ... }:
-{
-  disko.devices = {
-    disk.disk1 = {
-      device = lib.mkDefault "/dev/sda";
-      type = "disk";
-      content = {
-        type = "gpt";
-        partitions = {
-          boot = {
-            name = "boot";
-            size = "1M";
-            type = "EF02";
-          };
-          esp = {
-            name = "ESP";
-            size = "500M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-            };
-          };
-          root = {
-            name = "root";
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/georg/configuration.nix

@@ -25,6 +25,26 @@
 
   # List services that you want to enable:
 
+
+
+  services.spotifyd = {
+    enable = true;
+    settings.global = {
+      device_name = "georg";
+      use_mpris = false;
+      #dbus_type = "system";
+      #zeroconf_port = 1234;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    # config.services.spotifyd.settings.zeroconf_port
+    5353 # spotifyd is its own mDNS service wtf
+  ];
+
+
+
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -2,11 +2,12 @@
   stateDir = "/data/monitoring/prometheus";
 in {
   imports = [
+    ./exim.nix
     ./gitea.nix
+    ./machines.nix
     ./matrix-synapse.nix
     ./mysqld.nix
     ./postgres.nix
-    ./machines.nix
   ];
 
   services.prometheus = {

hosts/ildkule/services/monitoring/prometheus/exim.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  services.prometheus = {
+    scrapeConfigs = [
+      {
+        job_name = "exim";
+        scrape_interval = "15s";
+        static_configs = [{
+          targets = [ "microbel.pvv.ntnu.no:9636" ];
+        }];
+      }
+    ];
+  };
+}

hosts/ildkule/services/monitoring/prometheus/machines.nix

@@ -1,66 +1,37 @@
 { config, ... }: let
   cfg = config.services.prometheus;
+
+  mkHostScrapeConfig = name: ports: {
+    labels.hostname = name;
+    targets = map (port: "${name}.pvv.ntnu.no:${toString port}") ports;
+  };
+
+  defaultNodeExporterPort = 9100;
+  defaultSystemdExporterPort = 9101;
+  defaultNixosExporterPort = 9102;
 in {
   services.prometheus.scrapeConfigs = [{
     job_name = "base_info";
     static_configs = [
-      { labels.hostname = "ildkule";
-        targets = [
-          "ildkule.pvv.ntnu.no:${toString cfg.exporters.node.port}"
-          "ildkule.pvv.ntnu.no:${toString cfg.exporters.systemd.port}"
-        ];
-      }
-      { labels.hostname = "bekkalokk";
-        targets = [
-          "bekkalokk.pvv.ntnu.no:9100"
-          "bekkalokk.pvv.ntnu.no:9101"
-        ];
-      }
-      { labels.hostname = "kommode";
-        targets = [
-          "kommode.pvv.ntnu.no:9100"
-          "kommode.pvv.ntnu.no:9101"
-        ];
-      }
-      { labels.hostname = "bicep";
-        targets = [
-          "bicep.pvv.ntnu.no:9100"
-          "bicep.pvv.ntnu.no:9101"
-        ];
-      }
-      { labels.hostname = "brzeczyszczykiewicz";
-        targets = [
-          "brzeczyszczykiewicz.pvv.ntnu.no:9100"
-          "brzeczyszczykiewicz.pvv.ntnu.no:9101"
-        ];
-      }
-      { labels.hostname = "georg";
-        targets = [
-          "georg.pvv.ntnu.no:9100"
-          "georg.pvv.ntnu.no:9101"
-        ];
-      }
-      { labels.hostname = "ustetind";
-        targets = [
-          "ustetind.pvv.ntnu.no:9100"
-          "ustetind.pvv.ntnu.no:9101"
-        ];
-      }
-      { labels.hostname =  "hildring";
-        targets = [
-          "hildring.pvv.ntnu.no:9100"
-        ];
-      }
-      { labels.hostname =  "isvegg";
-        targets = [
-          "isvegg.pvv.ntnu.no:9100"
-        ];
-      }
-      { labels.hostname =  "microbel";
-        targets = [
-          "microbel.pvv.ntnu.no:9100"
-        ];
-      }
+      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
+
+      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+
+      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      # (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort ])
+      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+
+      (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
+      (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
+      (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
     ];
   }];
 }

hosts/kommode/services/gitea/customization/default.nix

@@ -3,7 +3,12 @@ let
   cfg = config.services.gitea;
 in
 {
-  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
+  services.gitea-themes = {
+    monokai = pkgs.gitea-theme-monokai;
+    earl-grey = pkgs.gitea-theme-earl-grey;
+    pitch-black = pkgs.gitea-theme-pitch-black;
+    catppuccin = pkgs.gitea-theme-catppuccin;
+  };
 
   systemd.services.gitea-customization = lib.mkIf cfg.enable {
     description = "Install extra customization in gitea's CUSTOM_DIR";

hosts/kommode/services/gitea/default.nix

@@ -1,4 +1,4 @@
-{ config, values, lib, unstablePkgs, ... }:
+{ config, values, lib, pkgs, unstablePkgs, ... }:
 let
   cfg = config.services.gitea;
   domain = "git.pvv.ntnu.no";
@@ -11,15 +11,17 @@ in {
     ./web-secret-provider
   ];
 
-  sops.secrets = {
-    "gitea/database" = {
-      owner = "gitea";
-      group = "gitea";
-    };
-    "gitea/email-password" = {
+  sops.secrets = let
+    defaultConfig = {
       owner = "gitea";
       group = "gitea";
     };
+  in {
+    "gitea/database" = defaultConfig;
+    "gitea/email-password" = defaultConfig;
+    "gitea/lfs-jwt-secret" = defaultConfig;
+    "gitea/oauth2-jwt-secret" = defaultConfig;
+    "gitea/secret-key" = defaultConfig;
   };
 
   services.gitea = {
@@ -45,9 +47,15 @@ in {
         ROOT_URL = "https://${domain}/";
         PROTOCOL = "http+unix";
         SSH_PORT = sshPort;
+        LANDING_PAGE = "explore";
         START_SSH_SERVER = true;
         START_LFS_SERVER = true;
-        LANDING_PAGE = "explore";
+        LFS_JWT_SECRET = lib.mkForce "";
+        LFS_JWT_SECRET_URI = "file:${config.sops.secrets."gitea/lfs-jwt-secret".path}";
+      };
+      oauth2 = {
+        JWT_SECRET = lib.mkForce "";
+        JWT_SECRET_URI = "file:${config.sops.secrets."gitea/oauth2-jwt-secret".path}";
       };
       "git.timeout" = {
         MIGRATE = 3600;
@@ -75,6 +83,10 @@ in {
       };
       admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
       session.COOKIE_SECURE = true;
+      security = {
+        SECRET_KEY = lib.mkForce "";
+        SECRET_KEY_URI = "file:${config.sops.secrets."gitea/secret-key".path}";
+      };
       database.LOG_SQL = false;
       repository = {
         PREFERRED_LICENSES = lib.concatStringsSep "," [
@@ -149,6 +161,11 @@ in {
 
   systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";
 
+  systemd.services.gitea.serviceConfig.CacheDirectory = "gitea/repo-archive";
+  systemd.services.gitea.serviceConfig.BindPaths = [
+    "%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
+  ];
+
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
     enableACME = true;
@@ -172,4 +189,31 @@ in {
   };
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
+
+  systemd.services.gitea-dump = {
+    serviceConfig.ExecStart = let
+      args = lib.cli.toGNUCommandLineShell { } {
+        type = cfg.dump.type;
+
+        # This should be declarative on nixos, no need to backup.
+        skip-custom-dir = true;
+
+        # This can be regenerated, no need to backup
+        skip-index = true;
+
+        # Logs are stored in the systemd journal
+        skip-log = true;
+      };
+    in lib.mkForce "${lib.getExe cfg.package} ${args}";
+
+    # Only keep n backup files at a time
+    postStop = let
+      cu = prog: "'${lib.getExe' pkgs.coreutils prog}'";
+      backupCount = 3;
+    in ''
+      for file in $(${cu "ls"} -t1 '${cfg.dump.backupDir}' | ${cu "sort"} --reverse | ${cu "tail"} -n+${toString (backupCount + 1)}); do
+        ${cu "rm"} "$file"
+      done
+      '';
+  };
 }

hosts/kommode/services/gitea/import-users/default.nix

@@ -11,7 +11,8 @@ in
 
   systemd.services.gitea-import-users = lib.mkIf cfg.enable {
     enable = true;
-    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
+    environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
     serviceConfig = {
       ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
         flakeIgnore = [
@@ -25,6 +26,7 @@ in
       ];
       DynamicUser="yes";
       EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
+      RuntimeDirectory = "gitea-import-users";
     };
   };
 

hosts/kommode/services/gitea/import-users/gitea-import-users.py

@@ -17,6 +17,10 @@ GITEA_API_URL = os.getenv('GITEA_API_URL')
 if GITEA_API_URL is None:
     GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
 
+PASSWD_FILE_PATH = os.getenv('PASSWD_FILE_PATH')
+if PASSWD_FILE_PATH is None:
+    PASSWD_FILE_PATH = '/tmp/passwd-import'
+
 
 def gitea_list_all_users() -> dict[str, dict[str, any]] | None:
     r = requests.get(
@@ -187,7 +191,8 @@ def main():
     if existing_users is None:
         exit(1)
 
-    for username, name in passwd_file_parser("/tmp/passwd-import"):
+    print(f"Reading passwd entries from {PASSWD_FILE_PATH}")
+    for username, name in passwd_file_parser(PASSWD_FILE_PATH):
         print(f"Processing {username}")
         add_or_patch_gitea_user(username, name, existing_users)
         for org, team_name in COMMON_USER_TEAMS:

hosts/lupine/configuration.nix

@@ -0,0 +1,35 @@
+{ fp, values, lupineName, ... }:
+{
+  imports = [
+    ./hardware-configuration/${lupineName}.nix
+
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)
+
+    ./services/gitea-runner.nix
+  ];
+
+  sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
+    matchConfig.Name = "enp0s31f6";
+    address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    networkConfig.LLDP = false;
+  };
+  systemd.network.wait-online = {
+    anyInterface = true;
+  };
+
+  # There are no smart devices
+  services.smartd.enable = false;
+
+  # Do not change, even during upgrades.
+  # See https://search.nixos.org/options?show=system.stateVersion
+  system.stateVersion = "25.05";
+}

hosts/lupine/hardware-configuration/lupine-1.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/a949e2e8-d973-4925-83e4-bcd815e65af7";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/81D6-38D3";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/82c2d7fa-7cd0-4398-8cf6-c892bc56264b"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/lupine/hardware-configuration/lupine-2.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/aa81d439-800b-403d-ac10-9d2aac3619d0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/4A34-6AE5";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/efb7cd0c-c1ae-4a86-8bc2-8e7fd0066650"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/lupine/hardware-configuration/lupine-3.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/39ba059b-3205-4701-a832-e72c0122cb88";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/63FA-297B";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/9c72eb54-ea8c-4b09-808a-8be9b9a33869"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/lupine/hardware-configuration/lupine-4.nix

@@ -5,20 +5,30 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/c7bbb293-a0a3-4995-8892-0ec63e8c67dd";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/a86ffda8-8ecb-42a1-bf9f-926072e90ca5"; }
+    ];
+
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/lupine/hardware-configuration/lupine-5.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/5f8418ad-8ec1-4f9e-939e-f3a4c36ef343";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/F372-37DF";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/27bf292d-bbb3-48c4-a86e-456e0f1f648f"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/lupine/services/gitea-runner.nix

@@ -0,0 +1,71 @@
+{ config, lupineName, ... }:
+{
+  # This is unfortunately state, and has to be generated one at a time :(
+  # To do that, comment out all except one of the runners, fill in its token
+  # inside the sops file, rebuild the system, and only after this runner has
+  # successfully registered will gitea give you the next token.
+  # - oysteikt Sep 2023
+  sops = {
+    secrets."gitea/runners/token" = {
+      key = "gitea/runners/${lupineName}";
+    };
+
+    templates."gitea-runner-envfile" = {
+      restartUnits = [
+        "gitea-runner-${lupineName}.service"
+      ];
+      content = ''
+        TOKEN="${config.sops.placeholder."gitea/runners/token"}"
+      '';
+    };
+  };
+
+  services.gitea-actions-runner.instances = {
+    ${lupineName} = {
+      enable = true;
+      name = "git-runner-${lupineName}";
+      url = "https://git.pvv.ntnu.no";
+      # NOTE: gitea actions runners need node inside their docker images,
+      #       so we are a bit limited here.
+      labels = [
+        "debian-latest:docker://node:current-trixie"
+        "debian-trixie:docker://node:current-trixie"
+        "debian-bookworm:docker://node:current-bookworm"
+        "debian-bullseye:docker://node:current-bullseye"
+
+        "debian-latest-slim:docker://node:current-trixie-slim"
+        "debian-trixie-slim:docker://node:current-trixie-slim"
+        "debian-bookworm-slim:docker://node:current-bookworm-slim"
+        "debian-bullseye-slim:docker://node:current-bullseye-slim"
+
+        "alpine-latest:docker://node:current-alpine"
+        "alpine-3.22:docker://node:current-alpine3.22"
+        "alpine-3.21:docker://node:current-alpine3.21"
+
+        # See https://gitea.com/gitea/runner-images
+        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+        "ubuntu-noble:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+        "ubuntu-jammy:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+
+        "ubuntu-latest-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
+        "ubuntu-24.04-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
+        "ubuntu-noble-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
+        "ubuntu-22.04-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
+        "ubuntu-jammy-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
+      ];
+      tokenFile = config.sops.templates."gitea-runner-envfile".path;
+    };
+  };
+
+  virtualisation.podman = {
+    enable = true;
+    defaultNetwork.settings.dns_enabled = true;
+    autoPrune.enable = true;
+  };
+
+  networking.dhcpcd.IPv6rs = false;
+
+  networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
+}

justfile

@@ -1,25 +1,56 @@
+set positional-arguments # makes variables accesible as $1 $2 $@
 export GUM_FILTER_HEIGHT := "15"
-nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
+nom := `if [[ -t 1 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
+nix_eval_opts := "--log-format raw --option warn-dirty false"
 
 @_default:
   just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
 
-check:
-  nix flake check --keep-going
+check *_:
+  nix flake check --keep-going "$@"
 
-build-machine machine=`just _a_machine`:
-  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
+build-machine machine=`just _a_machine` *_:
+  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel "${@:2}"
 
-run-vm machine=`just _a_machine`:
-  nixos-rebuild build-vm --flake .#{{ machine }}
+run-vm machine=`just _a_machine` *_:
+  nixos-rebuild build-vm --flake .#{{ machine }} "${@:2}"
   QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
 
-@update-inputs:
-  nix eval .#inputs --apply builtins.attrNames --json \
-    | jq '.[]' -r \
-    | gum choose --no-limit --height=15 \
-    | xargs -L 1 nix flake lock --update-input
+@update-inputs *_:
+  @git reset flake.lock
+  @git restore flake.lock
+  nix eval {{nix_eval_opts}} --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
+    | { printf "%s\n" --commit-lock-file; jq '.[]' -r | grep -vxF "self" ||:; } \
+    | gum choose --no-limit --header "Choose extra arguments:" \
+    | tee >(xargs -d'\n' echo + nix flake update "$@" >&2) \
+    | xargs -d'\n' nix flake update "$@"
+
+@repl $machine=`just _a_machine` *_:
+  set -v; nixos-rebuild --flake .#"$machine" repl "${@:2}"
+
+@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
+  set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
+
+@eval-vm $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
+  just eval "$machine" "virtualisation.vmVariant.$attrpath" "${@:3}"
 
 
+# helpers
+
+[no-exit-message]
 _a_machine:
-  nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter
+  #!/usr/bin/env -S sh -euo pipefail
+  machines="$(
+    nix eval {{nix_eval_opts}} .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r
+  )"
+  [ -n "$machines" ] || { echo >&2 "ERROR: no machines found"; false; }
+  if [ -s .direnv/vars/last-machine.txt ]; then
+    machines="$(
+      grep <<<"$machines" -xF  "$(cat .direnv/vars/last-machine.txt)" ||:
+      grep <<<"$machines" -xFv "$(cat .direnv/vars/last-machine.txt)" ||:
+    )"
+  fi
+  choice="$(gum filter <<<"$machines")"
+  mkdir -p .direnv/vars
+  cat <<<"$choice" >.direnv/vars/last-machine.txt
+  cat <<<"$choice"

keys/oysteikt.pub

@@ -26,29 +26,40 @@ eJAiipB0QOH9SEa5Io6BSiqsBQJmqp4CBQkFpUs7AIF2IAQZFgoAHRYhBPPNqGzF
 Wp8Q16BpgZ8vfYJQ81FGBQJi5oZHAAoJEJ8vfYJQ81FGFZgBALN+Rh4m323TaM5z
 dJfCTV7V0aP3J0RdKmtKvz/Y9a7uAP4oP8UlbM9ucyG252gZ8IjM0VprNzP9CpNl
 4GzpD4CRDgkQRrkijoFKKqwYoQEAz0D3G/dD6DBYBf7p6pGYqXd2X0Dv8nmnalol
-Z6SxfUMA/jT/XjPh7c4Ui8nZO7XDzYWrbV/eZwGMd1zXq2mU42MLuQINBGLmhnoB
-EADa1yBK0NKxVIto3hSh21hooYpWcEXWqMPXHO34rcAhktVFOOHIl2bFGScQAZXt
-jAcqUmMyC+PMs1DZoocFk+9PJt17hAa/s6CRrw8vK+1fVqhj0XOLtevGV9iC6IRv
-hPxzTsOaeOssgMGIU8xDmMKT2nGHGNUkqOXGld63E3NKsK3lnl+BCdpJ0f3GEB7a
-SQ+pk6k1uzODXX/mhAUJmL1MkVZ6jJA3vhsre0Kfa9p+C5mP4hLJ6jF+oESvA4HC
-+LuCSGm66gIDMC39jnLo6hwYEEjfPXD7CUAN4S2eISSFd+ZclN2vYcrKYgsCZS0h
-BFOgDhKKCHBuMwP12AIM8y8L64/eOWFpR7s2StAPjjYbZeZECHLWZt1zGVvkS7Xp
-6lsAg6/T8EysKG7vTl2Qq9W0BmzNgk2ODTZkhv0gqqXppdr8eRiq+h0qMfJptG0G
-ycOvqb9PoEO2dfNCjjII8VfaSGfSEYo8UwsqYTtfgdoNnFCXKd1r7QmvrdbNsFDR
-mkv+wWJoipwUaVquyb2KN652jSlpwMECW6fSEsT/5C3mJLgAmi6l6yosw6HdIY6j
-gpCGtxnHW2zReIS6ezZdtxYBCkEHK70yASyaIHrLLDknw+DuKvXAWOAecob8GNBH
-OjXZe3LzBt2rVgOCRa+W7milNgjUCsz+R3rM8XfR+wNEGwARAQABiH4EGBYKACYW
-IQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaGegIbDAUJA8JnAAAKCRBGuSKOgUoq
-rDE0AQDBxRsmW9L60mxGCp1CpNWBXD2T6D605PlNiNCcM+cOCgD/c2OitSSG50M0
-YRbyh1LPYL6YQePL0dQkYsjm6XVmrAKIfgQYFgoAJgIbDBYhBPfTeJAiipB0QOH9
-SEa5Io6BSiqsBQJmqp4FBQkFpUsIAAoJEEa5Io6BSiqsydsA/ihBulpSSLg4B9pJ
-sffqphMht7yT3Dnz57iexUEgj3jBAQDedI+gwpZlMjV6IdH/Epz244j82Ta04cqk
-SOz2Y63LBrgzBGLmhsUWCSsGAQQB2kcPAQEHQFg/avgj0sZbxqL58tZEpcaieeL1
-OWOoVU3mZX/K7GU+iH4EGBYKACYWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaG
-xQIbIAUJA8JnAAAKCRBGuSKOgUoqrN5jAP96aO0MEPQSIKdLaa9+ilpPp+glJ9du
-IJ7zdR0U15tONAEA0WqeRc8Jhv10UjIz/Q3UlcfvKPzVW6yVKo+Lg1FI2QSIfgQY
-FgoAJgIbIBYhBPfTeJAiipB0QOH9SEa5Io6BSiqsBQJmqp4GBQkFpUq9AAoJEEa5
-Io6BSiqsjF0BAJn0EBEJfszskYiZzMshFHW5k0QUF+Ak3JNh2UG+M6FJAQCQVY/l
-DkrvOytuFnKbkDrCaTrtLh/JAmBXpSERIejmDw==
-=7cFp
+Z6SxfUMA/jT/XjPh7c4Ui8nZO7XDzYWrbV/eZwGMd1zXq2mU42MLiPUEGBYKACYC
+GwIWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCaI6lzgUJCWqGhwCBdiAEGRYKAB0W
+IQTzzahsxVqfENegaYGfL32CUPNRRgUCYuaGRwAKCRCfL32CUPNRRhWYAQCzfkYe
+Jt9t02jOc3SXwk1e1dGj9ydEXSprSr8/2PWu7gD+KD/FJWzPbnMhtudoGfCIzNFa
+azcz/QqTZeBs6Q+AkQ4JEEa5Io6BSiqsCG0BALDNFlploZWjQ0Xn3B9fd+1sTUmY
++e0s95lEY7XqVkF2AQCkKzMd2mHsymyVtY32bSsZ0iJxHTmxomS0uQ/TGIugB7kC
+DQRi5oZ6ARAA2tcgStDSsVSLaN4UodtYaKGKVnBF1qjD1xzt+K3AIZLVRTjhyJdm
+xRknEAGV7YwHKlJjMgvjzLNQ2aKHBZPvTybde4QGv7Ogka8PLyvtX1aoY9Fzi7Xr
+xlfYguiEb4T8c07DmnjrLIDBiFPMQ5jCk9pxhxjVJKjlxpXetxNzSrCt5Z5fgQna
+SdH9xhAe2kkPqZOpNbszg11/5oQFCZi9TJFWeoyQN74bK3tCn2vafguZj+ISyeox
+fqBErwOBwvi7gkhpuuoCAzAt/Y5y6OocGBBI3z1w+wlADeEtniEkhXfmXJTdr2HK
+ymILAmUtIQRToA4SighwbjMD9dgCDPMvC+uP3jlhaUe7NkrQD442G2XmRAhy1mbd
+cxlb5Eu16epbAIOv0/BMrChu705dkKvVtAZszYJNjg02ZIb9IKql6aXa/HkYqvod
+KjHyabRtBsnDr6m/T6BDtnXzQo4yCPFX2khn0hGKPFMLKmE7X4HaDZxQlynda+0J
+r63WzbBQ0ZpL/sFiaIqcFGlarsm9ijeudo0pacDBAlun0hLE/+Qt5iS4AJoupesq
+LMOh3SGOo4KQhrcZx1ts0XiEuns2XbcWAQpBByu9MgEsmiB6yyw5J8Pg7ir1wFjg
+HnKG/BjQRzo12Xty8wbdq1YDgkWvlu5opTYI1ArM/kd6zPF30fsDRBsAEQEAAYh+
+BBgWCgAmFiEE99N4kCKKkHRA4f1IRrkijoFKKqwFAmLmhnoCGwwFCQPCZwAACgkQ
+RrkijoFKKqwxNAEAwcUbJlvS+tJsRgqdQqTVgVw9k+g+tOT5TYjQnDPnDgoA/3Nj
+orUkhudDNGEW8odSz2C+mEHjy9HUJGLI5ul1ZqwCiH4EGBYKACYCGwwWIQT303iQ
+IoqQdEDh/UhGuSKOgUoqrAUCZqqeBQUJBaVLCAAKCRBGuSKOgUoqrMnbAP4oQbpa
+Uki4OAfaSbH36qYTIbe8k9w58+e4nsVBII94wQEA3nSPoMKWZTI1eiHR/xKc9uOI
+/Nk2tOHKpEjs9mOtywaIfgQYFgoAJgIbDBYhBPfTeJAiipB0QOH9SEa5Io6BSiqs
+BQJojqXOBQkJaoZUAAoJEEa5Io6BSiqsiXkBAJ0JTRmdQQpEK9KSh8V7FEkblIsm
+Ngko2cs+OhNSUgW9AQD0a7FHM3Dx32a7yD0zE3QwWi5VgeZZVIPyhItrOaANDbgz
+BGLmhsUWCSsGAQQB2kcPAQEHQFg/avgj0sZbxqL58tZEpcaieeL1OWOoVU3mZX/K
+7GU+iH4EGBYKACYWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaGxQIbIAUJA8Jn
+AAAKCRBGuSKOgUoqrN5jAP96aO0MEPQSIKdLaa9+ilpPp+glJ9duIJ7zdR0U15tO
+NAEA0WqeRc8Jhv10UjIz/Q3UlcfvKPzVW6yVKo+Lg1FI2QSIfgQYFgoAJgIbIBYh
+BPfTeJAiipB0QOH9SEa5Io6BSiqsBQJmqp4GBQkFpUq9AAoJEEa5Io6BSiqsjF0B
+AJn0EBEJfszskYiZzMshFHW5k0QUF+Ak3JNh2UG+M6FJAQCQVY/lDkrvOytuFnKb
+kDrCaTrtLh/JAmBXpSERIejmD4h+BBgWCgAmAhsgFiEE99N4kCKKkHRA4f1IRrki
+joFKKqwFAmiOpc4FCQlqhgkACgkQRrkijoFKKqwSMAD/bbO/uwwdFEJVgcNRexZU
+6aoSxAGI1vjS92hSyfxZ9AABAK8KYO8sBGGCiVu+vWUpoUYmp3lfYTJHtf+36WMc
+D5MD
+=Gubf
 -----END PGP PUBLIC KEY BLOCK-----

modules/grzegorz.nix

@@ -1,4 +1,4 @@
-{config, lib, pkgs, ...}:
+{ config, lib, pkgs, unstablePkgs, ... }:
 let
   grg = config.services.greg-ng;
   grgw = config.services.grzegorz-webui;
@@ -11,6 +11,13 @@ in {
     settings.port = 31337;
     enableSway = true;
     enablePipewire = true;
+
+    mpvPackage = unstablePkgs.mpv;
+  };
+
+  systemd.user.services.restart-greg-ng = {
+    script = "systemctl --user restart greg-ng.service";
+    startAt = "*-*-* 06:30:00";
   };
 
   services.grzegorz-webui = {
@@ -41,6 +48,15 @@ in {
         allow 2001:700:300:1900::/64;
         deny all;
       '';
+
+      locations."/docs" = {
+        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
+      };
+
+      locations."/api" = {
+        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
+        proxyWebsockets = true;
+      };
     };
 
     "${machine}-backend.pvv.ntnu.no" = {

modules/matrix-ooye.nix

@@ -0,0 +1,211 @@
+# Original from: https://cgit.rory.gay/nix/OOYE-module.git/
+
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.matrix-ooye;
+  mkStringOption =
+    name: default:
+    lib.mkOption {
+      type = lib.types.str;
+      default = default;
+    };
+in
+{
+  options = {
+    services.matrix-ooye = {
+      enable = lib.mkEnableOption "Enable OOYE service";
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.out-of-your-element;
+      };
+      appserviceId = mkStringOption "The ID of the appservice." "ooye";
+      homeserver = mkStringOption "The homeserver to connect to." "http://localhost:8006";
+      homeserverName = mkStringOption "The name of the homeserver to connect to." "localhost";
+      namespace = mkStringOption "The prefix to use for the MXIDs/aliases of bridged users/rooms. Should end with a _!" "_ooye_";
+      discordTokenPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-token";
+      discordClientSecretPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-client-secret";
+      socket = mkStringOption "The socket to listen on, can either be a port number or a unix socket path." "6693";
+      bridgeOrigin = mkStringOption "The web frontend URL for the bridge, defaults to http://localhost:{socket}" "";
+
+      enableSynapseIntegration = lib.mkEnableOption "Enable Synapse integration";
+    };
+  };
+  config = lib.mkIf cfg.enable (
+    let
+      baseConfig = pkgs.writeText "matrix-ooye-config.json" (
+        builtins.toJSON {
+          id = cfg.appserviceId;
+          namespaces = {
+            users = [
+              {
+                exclusive = true;
+                regex = "@${cfg.namespace}.*:${cfg.homeserverName}";
+              }
+            ];
+            aliases = [
+              {
+                exclusive = true;
+                regex = "#${cfg.namespace}.*:${cfg.homeserverName}";
+              }
+            ];
+          };
+          protocols = [ "discord" ];
+          sender_localpart = "${cfg.namespace}bot";
+          rate_limited = false;
+          socket = cfg.socket; # Can either be a TCP port or a unix socket path
+          url = if (lib.hasPrefix "/" cfg.socket) then "unix:${cfg.socket}" else "http://localhost:${cfg.socket}";
+          ooye = {
+            server_name = cfg.homeserverName;
+            namespace_prefix = cfg.namespace;
+            max_file_size = 5000000;
+            content_length_workaround = false;
+            include_user_id_in_mxid = true;
+            server_origin = cfg.homeserver;
+            bridge_origin = if (cfg.bridgeOrigin == "") then "http://localhost:${cfg.socket}" else cfg.bridgeOrigin;
+          };
+        }
+      );
+
+      script = pkgs.writeScript "matrix-ooye-pre-start.sh" ''
+        #!${lib.getExe pkgs.bash}
+        REGISTRATION_FILE=registration.yaml
+
+        id
+        echo "Before if statement"
+        stat ''${REGISTRATION_FILE}
+
+        if [[ ! -f ''${REGISTRATION_FILE} ]]; then
+          echo "No registration file found at '$REGISTRATION_FILE'"
+          cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
+        fi
+
+        echo "After if statement"
+        stat ''${REGISTRATION_FILE}
+
+        AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE})
+        HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE})
+        DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)
+        DISCORD_CLIENT_SECRET=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)
+
+        # Check if we have all required tokens
+        if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then
+          AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
+          echo "Generated new AS token: ''${AS_TOKEN}"
+        fi
+
+        if [[ -z "$HS_TOKEN" || "$HS_TOKEN" == "null" ]]; then
+          HS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
+          echo "Generated new HS token: ''${HS_TOKEN}"
+        fi
+
+        if [[ -z "$DISCORD_TOKEN" ]]; then
+          echo "No Discord token found at '${cfg.discordTokenPath}'"
+          echo "You can find this on the 'Bot' tab of your Discord application."
+          exit 1
+        fi
+
+        if [[ -z "$DISCORD_CLIENT_SECRET" ]]; then
+          echo "No Discord client secret found at '${cfg.discordTokenPath}'"
+          echo "You can find this on the 'OAuth2' tab of your Discord application."
+          exit 1
+        fi
+
+        shred -u ''${REGISTRATION_FILE}
+        cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
+
+        ${lib.getExe pkgs.jq} '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' ''${REGISTRATION_FILE} > ''${REGISTRATION_FILE}.tmp
+
+        shred -u ''${REGISTRATION_FILE}
+        mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE}
+      '';
+
+    in
+    {
+      warnings =
+        lib.optionals ((builtins.substring (lib.stringLength cfg.namespace - 1) 1 cfg.namespace) != "_") [
+          "OOYE namespace does not end with an underscore! This is recommended to have better ID formatting. Provided: '${cfg.namespace}'"
+        ]
+        ++ lib.optionals ((builtins.substring 0 1 cfg.namespace) != "_") [
+          "OOYE namespace does not start with an underscore! This is recommended to avoid conflicts with registered users. Provided: '${cfg.namespace}'"
+        ];
+
+      environment.systemPackages = [ cfg.package ];
+
+      systemd.services."matrix-ooye-pre-start" = {
+        enable = true;
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = script;
+          WorkingDirectory = "/var/lib/matrix-ooye";
+          StateDirectory = "matrix-ooye";
+          DynamicUser = true;
+          RemainAfterExit = true;
+          Type = "oneshot";
+
+          LoadCredential = [
+            "discord_token:${cfg.discordTokenPath}"
+            "discord_client_secret:${cfg.discordClientSecretPath}"
+          ];
+        };
+      };
+
+      systemd.services."matrix-ooye" = {
+        enable = true;
+        description = "Out of Your Element - a Discord bridge for Matrix.";
+
+        wants = [
+          "network-online.target"
+          "matrix-synapse.service"
+          "conduit.service"
+          "dendrite.service"
+        ];
+        after = [
+          "matrix-ooye-pre-start.service"
+          "network-online.target"
+        ];
+        requires = [ "matrix-ooye-pre-start.service" ];
+        wantedBy = [ "multi-user.target" ];
+
+        serviceConfig = {
+          ExecStart = lib.getExe config.services.matrix-ooye.package;
+          WorkingDirectory = "/var/lib/matrix-ooye";
+          StateDirectory = "matrix-ooye";
+          #ProtectSystem = "strict";
+          #ProtectHome = true;
+          #PrivateTmp = true;
+          #NoNewPrivileges = true;
+          #PrivateDevices = true;
+          Restart = "on-failure";
+          DynamicUser = true;
+        };
+      };
+
+      systemd.services."matrix-synapse" = lib.mkIf cfg.enableSynapseIntegration {
+
+        after = [
+          "matrix-ooye-pre-start.service"
+          "network-online.target"
+        ];
+        requires = [ "matrix-ooye-pre-start.service" ];
+        serviceConfig = {
+          LoadCredential = [
+            "matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
+          ];
+          ExecStartPre = [
+            "+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
+            "+${pkgs.coreutils}/bin/chown matrix-synapse:matrix-synapse ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
+          ];
+        };
+      };
+
+      services.matrix-synapse.settings.app_service_config_files = lib.mkIf cfg.enableSynapseIntegration [
+        "${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
+      ];
+    }
+  );
+}

packages/mediawiki-extensions/default.nix

@@ -12,7 +12,7 @@ let
     name
   , commit
   , hash
-  , tracking-branch ? "REL1_42"
+  , tracking-branch ? "REL1_44"
   , kebab-name ? kebab-case-name name
   , fetchgit ? pkgs.fetchgit
   }:
@@ -33,63 +33,63 @@ in
 lib.mergeAttrsList [
   (mw-ext {
     name = "CodeEditor";
-    commit = "9f69f2cf7616342d236726608a702d651b611938";
-    hash = "sha256-sRaYj34+7aghJUw18RoowzEiMx0aOANU1a7YT8jivBw=";
+    commit = "9f19fe510beb671d6ea3076e2e7cbd1025451924";
+    hash = "sha256-Bl0evDM4TpsoU5gvZ02UaH5ehFatJcn8YJPbUWRcK9s=";
   })
   (mw-ext {
     name = "CodeMirror";
-    commit = "1a1048c770795789676adcf8a33c1b69f6f5d3ae";
-    hash = "sha256-Y5ePrtLNiko2uU/sesm8jdYmxZkYzQDHfkIG1Q0v47I=";
+    commit = "050d8257c942dfd95b98525c0a61290a89fe8ef4";
+    hash = "sha256-3DnY9wlaG9BrnSgt8GMM6fzp3nAAPno49vr2QAz50Ho=";
   })
   (mw-ext {
     name = "DeleteBatch";
-    commit = "b76bb482e026453079104d00f9675b4ab851947e";
-    hash = "sha256-GebF9B3RVwpPw8CYKDDT6zHv/MrrzV6h2TEIvNlRmcw=";
+    commit = "122072bbfb4eab96ed8c1451a3e74b5557054c58";
+    hash = "sha256-L6AXoyFJEZoAQpLO6knJvYtQ6JJPMtaa+WhpnwbJeNU=";
   })
   (mw-ext {
     name = "PluggableAuth";
-    commit = "1da98f447fd8321316d4286d8106953a6665f1cc";
-    hash = "sha256-DKDVcAfWL90FmZbSsdx1J5PkGu47EsDQmjlCpcgLCn4=";
+    commit = "5caf605b9dfdd482cb439d1ba2000cba37f8b018";
+    hash = "sha256-TYJqR9ZvaWJ7i1t0XfgUS05qqqCgxAH8tRTklz/Bmlg=";
   })
   (mw-ext {
     name = "Popups";
-    commit = "9b9e986316b9662b1b45ce307a58dd0320dd33cf";
-    hash = "sha256-rSOZHT3yFIxA3tPhIvztwMSmSef/XHKmNfQl1JtGrUA=";
+    commit = "4c22b8604b0dca04f001d9e2bc13b1ea4f934835";
+    hash = "sha256-mul9m5zPFSBCfBHZJihJrxP55kFMo/YJ18+JLt5X6zA=";
   })
   (mw-ext {
     name = "Scribunto";
-    commit = "eb6a987e90db47b09b0454fd06cddb69fdde9c40";
-    hash = "sha256-Nr0ZLIrS5jnpiBgGnd90lzi6KshcsxeC+xGmNsB/g88=";
+    commit = "4a917ed13212f60c33dbc82d3d18c7f5b8461fdc";
+    hash = "sha256-3qQgXyPb00V9McN8fxgZlU+MeBzQm5ikH/vkXazibY8=";
   })
   (mw-ext {
     name = "SimpleSAMLphp";
     kebab-name = "simple-saml-php";
-    commit = "fd4d49cf48d16efdb91ae8128cdd507efe84d311";
-    hash = "sha256-Qdtroew2j3AsZYlhAAUKQXXS2kUzUeQFnuR6ZHdFhAQ=";
+    commit = "d41b4efd3cc44ca3f9f12e35385fc64337873c2a";
+    hash = "sha256-wfzXtsEEEjQlW5QE4Rf8pasAW/KSJsLkrez13baxeqA=";
   })
   (mw-ext {
     name = "TemplateData";
-    commit = "836e3ca277301addd2578b2e746498ff6eb8e574";
-    hash = "sha256-UMcRLYxYn+AormwTYjKjjZZjA806goMY2TRQ4KoS5fY=";
+    commit = "1b02875f3e668fa9033849a663c5f5e450581071";
+    hash = "sha256-vQ/o7X7puTN1OQzX3bwKsW3IyVbK1IzvQKV9KtV2kRA=";
   })
   (mw-ext {
     name = "TemplateStyles";
-    commit = "06a2587689eba0a17945fd9bd4bb61674d3a7853";
-    hash = "sha256-C7j0jCkMeVZiLKpk+55X+lLnbG4aeH+hWIm3P5fF4fw=";
+    commit = "0f7b94a0b094edee1c2a9063a3c42a1bdc0282d9";
+    hash = "sha256-R406FgNcIip9St1hurtZoPPykRQXBrkJRKA9hapG81I=";
   })
   (mw-ext {
     name = "UserMerge";
-    commit = "41759d0c61377074d159f7d84130a095822bc7a3";
-    hash = "sha256-pGjA7r30StRw4ff0QzzZYUhgD3dC3ZuiidoSEz8kA8Q=";
+    commit = "d1917817dd287e7d883e879459d2d2d7bc6966f2";
+    hash = "sha256-la3/AQ38DMsrZ2f24T/z3yKzIrbyi3w6FIB5YfxGK9U=";
   })
   (mw-ext {
     name = "VisualEditor";
-    commit = "a128b11fe109aa882de5a40d2be0cdd0947ab11b";
-    hash = "sha256-bv1TkomouOxe+DKzthyLyppdEUFSXJ9uE0zsteVU+D4=";
+    commit = "3cca60141dec1150d3019bd14bd9865cf120362d";
+    hash = "sha256-HwbmRVaQObYoJdABeHn19WBoq8aw+Q6QU8xr9YvDcJU=";
   })
   (mw-ext {
     name = "WikiEditor";
-    commit = "21383e39a4c9169000acd03edfbbeec4451d7974";
-    hash = "sha256-aPVpE6e4qLLliN9U5TA36e8tFrIt7Fl8RT1cGPUWoNI=";
+    commit = "d5e6856eeba114fcd1653f3e7ae629989f5ced56";
+    hash = "sha256-U5ism/ni9uAxiD4wOVE0/8FFUc4zQCPqYmQ1AL5+E7Q=";
   })
 ]

packages/out-of-your-element.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchgit,
+  makeWrapper,
+  nodejs,
+  buildNpmPackage,
+}:
+buildNpmPackage {
+  pname = "delete-your-element";
+  version = "3.1-unstable-2025-06-23";
+  src = fetchgit {
+    url = "https://git.pvv.ntnu.no/Drift/delete-your-element.git";
+    rev = "67658bf68026918163a2e5c2a30007364c9b2d2d";
+    sha256 = "sha256-jSQ588kwvAYCe6ogmO+jDB6Hi3ACJ/3+rC8M94OVMNw=";
+  };
+  npmDepsHash = "sha256-HNHEGez8X7CsoGYXqzB49o1pcCImfmGYIw9QKF2SbHo=";
+  dontNpmBuild = true;
+
+  nativeBuildInputs = [makeWrapper];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share
+    cp -a . $out/share/ooye
+    makeWrapper ${nodejs}/bin/node $out/bin/matrix-ooye --add-flags $out/share/ooye/start.js
+    makeWrapper ${nodejs}/bin/node $out/bin/matrix-ooye-addbot --add-flags $out/share/ooye/addbot.js
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Matrix-Discord bridge with modern features.";
+    homepage = "https://gitdab.com/cadence/out-of-your-element";
+    longDescription = ''
+      Modern Matrix-to-Discord appservice bridge, created by @cadence:cadence.moe.
+    '';
+    license = licenses.gpl3;
+    # maintainers = with maintainers; [ RorySys ];
+    mainProgram = "matrix-ooye";
+  };
+}

packages/simplesamlphp/default.nix

@@ -8,18 +8,18 @@
 
 php.buildComposerProject rec {
   pname = "simplesamlphp";
-  version = "2.2.1";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "simplesamlphp";
     repo = "simplesamlphp";
-    rev = "v${version}";
-    hash = "sha256-jo7xma60M4VZgeDgyFumvJp1Sm+RP4XaugDkttQVB+k=";
+    tag = "v${version}";
+    hash = "sha256-vv4gzcnPfMapd8gER2Vsng1SBloHKWrJJltnw2HUnX4=";
   };
 
   composerStrictValidation = false;
 
-  vendorHash = "sha256-n6lJ/Fb6xI124PkKJMbJBDiuISlukWQcHl043uHoBb4=";
+  vendorHash = "sha256-vu3Iz6fRk3Gnh9Psn46jgRYKkmqGte+5xHBRmvdgKG4=";
 
   # TODO: metadata could be fetched automagically with these:
   #   - https://simplesamlphp.org/docs/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html

secrets/bekkalokk/bekkalokk.yaml

@@ -35,86 +35,82 @@ bluemap:
     ssh-key: ENC[AES256_GCM,data:nPwsT4RYbMbGp2MChLUh6NXW4ckYr7SQcd6Gy2G8CEU+ugew5pt4d6GOK1fyekspDtet3EkPL2F1AsoPFBB2Rv0boARMslAhBqwWSsbBJTXeTEgAABSMxTPJRBtfJucvv426nyIj3uApoknz6mDCQh1OI6mER0fis7MPaM1506HlDlnIT0FV9EairEsaAmbd0yddByGJSccKIza2vW0qWqrz83P+xrakEONxFz0fJlkO5PRXCcQJVBCqWQfnaHNrWeBWv0QA7vAHlT0yjqJCpDRxN2KYrPWsz7sUbB4UZOtykCRM5kKFq73GUaOKqVECJQhcJi6tERhpJELwjjS8MSqvBD90UTKTshGugfuygTaOyUx4wou3atxMR2Rah9+uZ6mBrLAOLX3JKiAtyhFewPMWjd/UhbMPuzNageVBNz2EMpa4POSVwz5MyViKNSgr9cPcNGqmrnjvr/W/lnj6Ec+W80RiXQlADSE4Q6diLLwB9nlHvKs8NTDgv6sUafcPHpJ2+N4Jkb96dE14bMffQ385SI4vLDcQ8xCQ,iv:WdJIHRzjlm8bEldolCx1Q7pZJvjxGkNZALSOy3IjizU=,tag:5ZAikiqttq/76+thG+4LMw==,type:str]
     ssh-known-hosts: ENC[AES256_GCM,data:J6V+NJ9TvYUL2gmcqWWYt8X+n0M7i0RpDpBelWAbFMH64+e9ztHNnC491sm+RogDxqKk0kwQyX2Mz00iq3Gc3wDYyozGOdv3tBKrp7/LcfjUQ9T9hi0yTD3eNV0LAjlAWMTdlW65VGHqGst8ncKbUuVxbBASVlh3A321toZgD+xxUAtNz7qKFa6fDbOS0xLD1+CmTwVp+aPos//QIKzjuk1HqxfBNK82maKtD4JHPS+Y3be2wIEjGWq3H6JYN/RDojD88D/jzo9RwvEjpqLXoOVfy8uX/fbEsgkgfAmPiaG+ePCnchSExEe3a6Y0E+I6YIzvP+tGThJpu4HaT/yW2Rww/jvsxKrXSUhtBZI/SIX5ZAIFB3sFjJXQefJjfNpQTQWhbspLfdemafGaRiDnzVgKDhNL1HNMNsXKDfWa0SLs4//dqerom/QCCNsaqV+4HVzv5x44srChGERadQI/Wh4UG2R19xxbdyIsKPHzv7BhEKufJkjc5upBjWygQrGAkTRHugFpw2Tdkz9yUQSujMkaeRKhVkA+ZUAjwnY5TwqNZBj7U3K2JXoNVHAq194XmrA2dNghh0OmRrvKGwM3HKexX22SXT0bPlpdWRQpMbUgV+uHLMerlDpNMFTIueEBkaF/FWeSW2N5WUrUb1uJ91QcJ8JBgN1riuD1Oxv9RRPrY9VVNJMrYjpAAREN8i8brMTOCJ35s7jnqIei0dNmnNXOoQZPs9kUMeEtUc/Df1E8/aO2Y4yU9gHUuevXnAJWFAiu2IxssgPk6CcNxvapJEmlwkLK/JyuDsWwFxVOHfw5QIEsoDVWXt6eMhquqUgzJI1q7QrTWUQsBb5A5sQKYWQHempOaXuQn1bzA7mU3Gzsr8bNNc6tpy+6j3zTXYR067EX00yqPG+kqRn4QVIuhByxXP3cwXLUG9uD1lsqWrGzs6WCnHr7txhRBXf4WbBVmXModO3uf36cDYEwrUa6yBsARtSl8PJ0UadfY/xULcT5PFvu9+Hi2qj3vp4IU3JCJa9AvXB+11pbSdawprjuDhwQtPwkJ4CQyvZsom3/BOrmwYM5+EyMDIluEQ0z6eDE5buiIVbX6IvXnDCKbrnqVwavX2wqyiDduFLjRfWL/3U2O1yRim78smrDMJABJZvtW+a+GfmlnTd/gnFvS70Fmm/lgtY051ISL/iFx6toJRoBMMiI/Zvy13uQry+w/HbyFl42DIank8tf7kuN3E9M7ADGMubRJJ0AZOcQddrFnR4Gl2nU2+3RS5fLHaBf9QHK6W92/n//xmPkYqrkPacew4eBjUqM32jVGuBpDc964fK9kdtIdw8q5P1s/ph3I79Y24kGeuO1AVJuZvkaTv1Z7GgI9+K9TstKJ9XpRCidLpLSP+uHOWkqcNsQlt6ilTlfHj+MKoD85dKZ315QMmpiuYEvzCSP1aYTb9dpd61Su/IVuM3r2NuINNEZ166YlHQVsLNpDn8E5ahk3ZInOAg6/kaKTmjUI8KEvX4BR3PbbViAlJJb3suJ0oZBGPUlrW5uLRmADvf2mMDVO5zY7/m9DQwxjt4Miu0l8ZaUc0YJQ850lBKucQ==,iv:GI8w7h7xX8gMHuAoWUyrW+BQb85LNlASoYvGBPlCZaI=,tag:WnHNMevfFSMc0ikBZwWn/g==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbjFxWk5lY0kxaStxcnVh
-            SnlYamw5WXBRTkU0ZGFEWnZvME1nZk94TlIwCmlhVGFtckJpN1RZdXRBYkxDbnVS
-            UmZtWENzZWNYRmptY2kwem42ek1LbXcKLS0tIElsRXBmNHNmdjdqTmFLL2ltMnFC
-            VG11M3ZpeUJPUGlEQmExOEdSZFJERE0KSIo1pzx8AcoJWEzNzEDoV3eM7194IHxL
-            4pCSSztKDCF+XdJZLh5sgudaYLJGtX5n7q1hbuL0wOmotM9bN2YLog==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvQjZvVEplU2pMQmgrQXE2
+            Qy9FY1NRZEhpSTVCdy9rVEFHekM4NHJEVlRvCkNnVUlCQzdGenlKOW56ZGY4bzJm
+            K1c1N25ZbDFNMDY0YzlGMTlMN2htSEEKLS0tIEYvWEVoMUVtVDRkeEt5eWFZckJs
+            aFRsYmhNMkQwdFlDa1ROWXdhWGFKUUEKqixofKZBMXpV8q801HtVoHzZWJhsifSB
+            DLPHbOAWpXjKygNJ1ogi66FWBFfRL0KGffQEuaIozTA1r1NafSCLKA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBybXRjNEM3ZDYwa21LdWpE
-            dDg1MUxaeHlJSHRhWk40TndYbHZLWHVsVWk4CkxkRVJ4c1lhaXZodGxhNGhkUy9q
-            M0I1SHdjeXVXL1E4OXgxS2x0cU9ESFkKLS0tIFpNMjNKLzNDWWtvTkhHRDFSTklH
-            T1k1cXp4NXVvVGdkYXp0VVNJejVJRkkK6K31gqRRvo0mbJy6aCTKotVmrfqZoARG
-            w6wKe1TJLWJv8RAD3GQrub9MJwQhUG38Jtj1WrXgNMlF24zFPlZDEQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1YmhFNHNuaXlFZXMxNmtR
+            S3ZIM25xVnYxNE5kL0RJR0lpNWo1c2ZTczFRCkRKakRNek8xdVcxcFN5Wkc1VDJ5
+            QjJuQjcwZ25RVkpoMXFpQXltU21MOTQKLS0tIFVrNVJ1alAwM1RtTy9zUUIzMkpi
+            bnFVWG5xWW1hSDZob0NzZVZNOHdqRTAKci5uPZI7K/ljVRZ1j2qQFABpf+Anuj2a
+            yqz92A7DbMUSUqmUNCHWg2vKmMwuRL3CXLPzZoXgIN07dpYQlk6qgg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2azhwMEJRZ3JQRnhDNlFR
-            a283MitGTTdaMTZURmFYam85TU43RkdXYTI0CnQxWnRUZ2F6MHd1TWlHMDZ4b1p0
-            WStOVndGTUpmdncvd1k0WlV3c0xKYmMKLS0tIFpSb1hKbHJyM1dCOVBMa1Jabndp
-            NWlGSFhQUngvWG5BQ1lyOFAxanlGdlEKt09a9bMErR3wqbutxhDRfSWp40mmfShJ
-            KAAO2TEMKkEGFvaxYu+G9rbR37h/ZttikJMvIVlfRzmVADlFwO7eHw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUZExMODZvbUo5VWt4UWs4
+            ZXRXWkdDczQxcGRJbUFyU3V5bDllampVWTF3CndVSzZESmlwUFcxMjZKODhPY1pz
+            WHo5aC9JOUg0VndhdGIxeU1PU2t2QWMKLS0tIExQelVMSWUrMkUrY3htMVIxTHFo
+            blNkNG02ZTFHR1ZjL1dBbjlDNXk5VmMK+EbzW0Rdq5cxIm8EnQ2P87BTxfMKywyM
+            Q3LGAw4RDR/Gstj9hzpTPnNjb4D5tMcQmeQlAvBriZPFXCrmq5WCXA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtYVJLMTZma08xZVo3cEZs
-            Ym1FTU9ZdmxlcUxselltWDRwdUhUdU1udnpjCmh4TlJEK09UdlNFLzN0YnN3WGtt
-            aGpzd25Vckc1TmVCamQ0ekk2QWpraUEKLS0tIG9CNzBOM1g2aTRlQmt3WWVrTlNB
-            ZWsrZy9HSWt4OUdMb3ZZQmNjNGZNZjQKMhvkRnis8P2iV3hoigiN2IXeIFvFuYRK
-            FeMG/cNOtAUsOgHMs4xDPqpLrhpay7IEvwQukBxscd/88I8/ZdGeHQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSGFIdjJwTkpRdzdIQ2Iz
+            WW1jamZFY1JrTTBZRjM5enZmNkNEMTRaQ24wCjdJY2l4OVJyU2pVR3dQZFg0cHRl
+            dU1xS0gwbWM0MktPL2d6dG1wN1ZsWEkKLS0tIHJscElDRVFrakJCZmtMbk0xaVp4
+            MDBoekhiMWZaeU9IWkcybFNWczVtUUUK4BOBttXkGhmUYTjR68ZvaT0BpbIw67rr
+            Ls5XV6Azkid7GAttNayqb/OjshUco1xIbAyGRz77b5uzMzM1cM6+dA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtazZ2RUo3ZjdKeStLWW0r
-            bm1NVWJRbjZpZTVRcEFWTnJwYkp2YUN3OTM4CnhRa2RpOS83MW9zaWlUV1M4b21t
-            OG5Ub3VkK1dSMkVzN2VtT0JrWkFSTkEKLS0tIGMvOFU2U243RnpUTThRRWthaHpZ
-            SjBhZjJpNGlUclF3bXRKOXk0KzlHdzQKp/asp39bRfNXyetc3ySVpnzfO6it9D/e
-            XWyhq0yKRFAC8yMYeAuA4kIcNM4DGRc0PnwA/ce3IgHsV1ZNdvdWfg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNSmVyNkNiWkxob05lakJI
+            N1dWVWl4bnd0cWV0bzlzQTdhMTZ6aWZJMFU4CkYwc29NTW5PODVVTU5DNFdCV0RO
+            RTJHaDVmbWZ1WFdSRVE4Tk9SbHhsdUkKLS0tIFhiN3M1aGJtY2ZqTkIwYjB6S095
+            WkpCQWlab2s5anVIa2Vlak1vNzI5U0kKRhPzmr9IW0fVDRKzfR1du7KgevNUchxJ
+            GDz5B/EekvwZwhcAGvkE6uwHIAIMaau49S9iwqK4NjIcBIGagoqiDQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnT3lTUEFaN3pOMGhsQ1Ra
-            SVZ6cE90a1BteXgzaldsN3ZTSGZpZXlyWHdvClhJM2ZDRHR0VzVSQXd0b1drK3hG
-            aW8zUWlHcVFkTFpJYXpxWlAwVHV0ckUKLS0tIGVmR0g2Vk56dlZCU01Dd3NzUFZU
-            UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
-            4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpSXJKL3RzUEMzZXN5Qmsw
+            aFRrMXE2b2dNU05NeWNuaEZOdkcyMWpvUlM0ClVkMVJoS3Y5SnJxQ3RtaUtncDcw
+            cWRKYjdFbEJ3aWE1ei9wYnpVRGhBd00KLS0tIFFycFgyWGVvMFc3azN3T2Z4aHln
+            UzR0dUp5MHFWdDFya0hlRXM4M1d5YVUKhaXAFsId/SGv5wmKvjTLSAAlDNuSH80H
+            SahjRm7nj5Z6ZHJfBZu9cGoZ5ZdvPsr1DtLgErSndnOnh7TWA8SgGQ==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2024-12-09T21:18:23Z"
     mac: ENC[AES256_GCM,data:scdduZPcJZgeT9LarRgxVr/obYsGrJAbMoLGJPPPp19qxOJMTdvYfMz8bxPjCikB4MacEgVZmcnKIn5aCzHJAnCI/7F2wm1DDtW9ZI5qbhDJKSSld+m2leOSPfR8VY/0qj6UNgGnwkwx7dfcAlv8cP2Sp3o1M2oyQxeXPr5FWEg=,iv:JEAwkCewMp0ERmYU62kZkbl7+FET1ZeRr6xeEwt6ioM=,tag:jxvli935X3JyZYe7fFbnLg==,type:str]
     pgp:
-        - created_at: "2024-08-04T00:03:28Z"
+        - created_at: "2025-12-01T10:58:17Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA0av/duuklWYAQ/7BlyYej03uyhLheXS406h3Ew7v7D+rHHvHjiw3FCJxHoC
-            1revUrMa/M6iTNQteaBvBcYVR4+SpUpRyN/6BSzEQBrNhUBR+70VWL2yzeeb6Bw7
-            GBtuyS7O3DEd0froE3aFETR0NfQ1FfcndOBd3SDKOsCgL5nfJSyOPQtr1OMLKzoW
-            +CARt457xEx0KY7IIpN6e57IT7bVjJx5UuDcN0ZncUyuGUAKHdn0nAHzWqiSZV9w
-            bIftLJ936zvBOhhl3DkzvALnI9+//KPSMM3o/1ti07FoAx8cK2w83VA5Ia9qeNkB
-            wfVuE6f5a2KP/KrfnVCfvweMh/MIEUGb14XEaniyYwvlW5vwF9YgPH6HGc0c+lH6
-            UWy8+Iw7kXkUEJuhtNWyBPJeVKheSBieoWUBZZAK4uWUpChJxfc5M3+P3mgzTIP+
-            7P04xdtS0GwrNwMBiQFqc56hoYDAwMYbn9lFzM3LLq+h8Ztg2G4X9LXjD956TP5C
-            bPV7BFcjTSaAt1TDJcDJRxfrtx6Mo/DLknpGTMRM0UfQ/22uMz2GAH38L0C7lD9B
-            RrKlpDuMKzj/LUihO33Ry9J0IpZ3XF6oaSl/+P+uO9QYNxA/zkuxuSWfqoysldyN
-            bSo1dHGapY/+PVMjM0E/2Dkk9T2IbQUlkVxPrlvuUd3YfrJ7bCva2GDjLvXSp7LS
-            XgGgLgrj54YoOn4uUFsxzDIS7yVps3fCkByVtc1Lc3C8uPPF1B+jOX7O87kZOHag
-            XvT2ze2ITfdxPzoyZO1nWVIGO8rAtQ/vK/Iv2/hHtc4gfzL+gy7GeUWGHkvZ1Kk=
-            =wDmH
+            hQIMA0av/duuklWYAQ/+IxSo/UF0bv0ktR4aYDhZF/7y8Xv56jaZbW+bI8os57SY
+            mk7MbCqMmujf31gDlWwvytn3sEBTs69tre2rJH0JhDnfxrfL4uHJqD2Idtfhejgv
+            6ezh37/aFy0GgkUKUMpVG3sksZjQrKrSvJiHgfIAaiEiNU6grc6EDLPqDrgO0s1V
+            RBUiv2VMyg6a2MBf6TSrdoHw/HtK/PvOgrQ/C3q3jjUzVLUnScIsewwTq0zdmVf6
+            WPG5/sTjKoIYRdjrEZOIZglU61Q2/d0GTGkI7nkr5xl+iJicRO8O4cYmZ2NivMLt
+            pjsYGQ+Kyuxzmgqjh2aRv5uu7p4g1fYIBZdcqmm14Jc/IznNUAdfpgoRGUxEbnGW
+            R6C2eTzvhZGFj0+jssLwcWtGxa2xxPAHL8TbAvroffzx7W9IdyWkmOEaMuyHFAWT
+            FpsdlSkYmQs1H5YCdRnapFkNbaIPsQy/c4dQhzYakrheMdpXo6efSPmk9RdjKZrd
+            HvJaepwJA7Uf9+eY+LgPVTKY4ObJziJEEIM8QwmBW4h7ZujbntUHXhL1dt2Bc8nZ
+            5foSRmLA0lsd59QSPA3lg30TpJARC8aq4dlYsTFqQgHVTHA2W1m5gYvIgNKlhR/F
+            NGNaAWW0+3V6NeQF5UVp/ug4RbJK+qbrQw/+jeyRaPj3TWaFobOfs+Ad5zcL5QfS
+            XgG1ix1Re4pnbeGbTE0QsFQ/Ir0mwPGuNzr1CFuVQWvPUYqA4iv8nlxIj2E43gcL
+            4ihGEE6dKrrwLJuALNq4p7mqnCMJ7/kjLNTRUSmWY8fHaVmX/QL0uGZwYH1Y5P4=
+            =2j4b
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted

secrets/bicep/bicep.yaml

@@ -5,88 +5,89 @@ mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
 gickup:
     github-token: ENC[AES256_GCM,data:H/yBDLIvEXunmaUha3c2vUWKLRIbl9QrC0t13AQDRCTnrvhabeiUFLNxZ/F+4B6sZ2aPSgZoB69WwnHvh1wLdiFp1qLWKW/jQPvzZOxE4n+jXrnSOutUWktbPzVj,iv:KFW4jRru93JIl9doVFtcNkJDWp89NlzWjPDflHxcL/U=,tag:YtgyRxkoZO9MkuP3DJh7zA==,type:str]
+minecraft-heatmap:
+    postgres-passwd: ENC[AES256_GCM,data:T8s9xct07AJ4/Z6MQjNrqZQq7FerHz8Op+ea8zO2MDLPWWgU7/hBfrr+T4sc1TgT3e5vtE0dVcqCSbZCZj+6zQ==,iv:prx6d8c92OvbL8IjBLAvi1Vqk69D6ZIkAp7E8CSljok=,tag:UA5YS4YwViYZJ2PWzIIM3g==,type:str]
+    ssh-key:
+        private: ENC[AES256_GCM,data:h9OtD6hxrxyokFDe9bveAkMICrs3YrsAEqg0RVHV+xCkgkNAdoh85wb1QI8FJ0tga4Bfq8ZxZTdMnexQvbYWL8m/N/P6gWoPPJd7dwGuxaUZu5lqngVuHIhH0yWFWtPXjQ0Zyl5Q1aBKyjzJMvJc/H2iprgVH4YFs/fWf/KDEp17Plvvz0AoPGPrOZErDmne4MtLbW3pUm1r5ACo/41OyXYwjHk1Ywgsoz1CMxe/DrmkADnf7jSDWL6Q0mz8hIIYi8GbToJS4BIJ2plttraxV9sqpIPzS/1jMERNchItlkCppSYIy/eohVmskP8dAySm5Z7HNGGtzWSSGLxq15xKc7OVFYPMI+B35nPnp1LVOUWqBHAqVo7dwxc3VXOlVat7AMknUZnr67d4TIIl5BOdy/rvAxzXS/fDV0zntIs5o3phKStVvq07eZFaOVva45B7Pyyn0PdBhHBt2JcBtm+Xtg9i3xvZdwQgbeeJRhnYgDqK6BVhmtTuirwp1GOyslqaFCjg0MJj+W+d8R9gbbfyFR6YrZQAkcd/o/yZGg86z7Phe18=,iv:nt/+qPBwPZKQt43VJ9FbKjLYioFwCxD7VK9WNCJCmpQ=,tag:MuDfnTiro3VVJq9x5rkEQg==,type:str]
+        public: ENC[AES256_GCM,data:+fiCO8VRSmV7tmyweYSpZJMOuMORLHkWetYbr20aTQ1vRYr927nYGes4E464t+Dv9OyJPCLmHBdgt7UvxJWuC3pZE8iStnBYnej3D4ebMzi2SMfOkJjGuQSplXtl8QeAYe1YvROmtQ==,iv:thgGQUyWdXfwUt1E/vudoNjl8JjnksFd1rb/asTry+g=,tag:t1iQPocvfI+JafuJycaLuw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
-        - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+        - recipient: age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiOVc1eXg1bU9BZmc0cXhM
-            L0dpbVBvQTNzcnFWcktSaW5rQXhnZks4dlhRCmVla3kzWDlJN2V0dDFYWkxJUUVo
-            RTlqNWM4c0lmbkc3cUM0dTgyWGpSNWcKLS0tIEx4SkxDdTFGUi9OQ0NRVGxXeSs4
-            b3Zaa3p1MnU1UTk1T3hmejVkM2RDLzAKmk63I60GEenLt0l4FHmz9mBAumw105Qs
-            mDbQBfAj1m1FTE6tl38J8wVyFI8LT550bqYdymvnT2mnEIAIP/04ag==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSWXVrN3MwSkh4RUJHcmRu
+            V0YrMkhIVGZtLzFsbEZ4dmNSV1FmT1Y2M3prCnhWOSs5VElEOUhuQU1xa2FmRlIw
+            YXQvZFpGYXh1eTMwVkZEempxdHA5eGsKLS0tIHlGQXlHc1ZJaWlPNitrSlQ3R25h
+            a28xWWRwbTlaZjIrbUpxUDJzMnp1alkK3awAxPMvmrh42Pwhv4mBUvWH5ev+OK+i
+            nKWXHOMyYPudYg062Ex7iAHS5WTw71bsMkUEwmU0Mt5XbopkXCyyZA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dmJpdUxVcllPYXpxRlN6
-            ZnYyc25sbjdWNUNEQnE3UU5Ea0JPK3o0Ukc0CnFIOU0rOU5lV0tGb2NuNnQzejhw
-            cTBkOFJHTXJIMFhzZ0tpODJ6N1pJRTgKLS0tIEhPVlBMcjdHNVRKWDhkTXFTOFFu
-            NUREdmFNR2NkY0Uzcm9tbmhteHFtSTgKSUTGoNb2/0rljN7oojVk1fMAulK669ud
-            fpacGQFBJzJOusx29YC01W6mn8TW8Cdw6mKmS3QEsYYx7S4HpX0v1g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZZ3k1VjN4SlVPcHhkNXpw
+            MTFncDF6cDdKVmVSQUdDQUQwNW5scjZ6TUdFCnY0UkJjdE5DaUFNZm00VEVmZG92
+            U0VINHJqbDd4RGFnOWdxaVhoMjRYN0EKLS0tICtESEFUbHBDamFJelphbTlMNmNQ
+            amJIdU5iaWNLQ28wYXJxZ0ptVUxRQVEKZtVEIcBrGHpmg/wGCzDshYZ83pJUf5CY
+            I4hmsoPRnq7Zh45eCuE7j+RNhGiQWGi8q/+sUnSJQMGjzIHf0QfVkA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUmNyQWU2Ym5NMjJnUUpu
-            Vi9yeWhFM0NDTGZtRThXQWMxYVI2aEUrNUVvCklxTldQRnp4dTVXMjRXWU5DNWhz
-            dzllOXp1RVRaMDFNWExuK01maFk0blEKLS0tIC9hUENybThmWlBab3IwSTQxSHBj
-            Q0IyL20vdlRBNWZyNXc3MGVtcUNza1UKLDq74TMy5hXhimnDA06/Ku5RJQcDvkjn
-            QKSGCxZ6FJ/io22qNiw0vDRzTfW1Dz+9/Yog3Pi870IcAljkdmoxEA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0TXZuS2pvOTd0RmdtU1ZE
+            MmIzUUxFV2NKcXJtempJdVpUQVZwWVBlZm5ZCkJZeVZiUjNPdW1XZlJ0YWxDa092
+            aGs5R3VUYkdBbVQ0V2dzcGV5alZxQ00KLS0tIHJqdGExb05DVFhka3duRTY1dFhz
+            MGFxVlJDcEZjc0Jxc3loV1ZjNkl0TjQKu+gUS5uyfWBNn67WFt1NwjzkwYWG4r04
+            hFh9hxB8efiMxYiDp2fc9EKvn1FlTBQJE1KWyiD88twzhKDKaDqQJg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTUpYam1KQ2laek42V1NE
-            eUY2TlY2Q0JNTHR6QUEvZEhhem5ZKzhPQ0JFClZldDE3dDVIeTQrOVpJNGI5dDlR
-            YStuTlRDcXdiWE9LdThaUERnbEpkU28KLS0tIDNidFQ3ZTdINXpTZGljZmh3Q1ky
-            Ynk3aUtFOFdGV1NHb2d4YXJXb0xNYU0K07jwIfF+US++qz9rKn0TgR/vZam12vvr
-            lq5s694hHkSRmAP5uJ4lNQKUkacH9qlBXB+aU+D98vKRDGYIkKhlQg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArQTF3bXhXa1AxazZqZWZv
+            dWFpWGwyUDZkZnczc2NpbnBWeTJGQUVBSFFzCkwyRFVVa0l3dS9GaGN3Mm5TY3dh
+            Z0VkRU1uZGVscnlLNXArZVMyVFhxTWMKLS0tIHV2ZExtVnFONTlQRVNMTFRzQnFu
+            ZmtGTVJqKzlGWDBaUWs1Qk1PSnc2WE0KrIJy3b1TdI7ur02ZzOfWJGWl6WuSUFV4
+            h9Bb3uSpVZLWb0MRKTK5RIeedQZ0NuVOqAP3hCglzzNkZ10/r7ly2Q==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjaURPbENOQ2l2N2lsd2l4
-            aUdQNlUyWjNFM2JhcXF1Z1NJZ0lzZWFjYmhNCnF0VmZzd0hJSjJvekpzN3hoYnlq
-            UDg0VHVlMUFTc2xNdGtLb2VXVzBySHMKLS0tIHdVWjlnTmdxSGpMR09zOFpVYmZF
-            M3ljcDgyUHB3Zm00bUxWeHRvK3o1bE0KGWWaSuPmvzA4PqBg3y+XOpnVCkv34eV3
-            ZEnPJood5bkBlVqfiBbwJaF98rCH1f5WI6S0NA/5ol5kckDpfwpePg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5L0hVVnE0bVp4d3MwQXo3
+            bnl5aWMxajZRNHFHQzhXVDZtK2k3TjJGRlFZCnRORzNTVEJOeTZ6OGZFNDNlQzZG
+            MmFHRFpQMW0vSVl1c29yTFoySFEyNEkKLS0tIHVPUlhIdHlxWHV3a1Nra0lEN21Z
+            cWxLUTBIeEZ0Sy9Ta2Jsajh5eVd4bTQKvmpiIPGbgPjqssx4sc/bqaCLeGIPcRfF
+            BVWm8tEpDmpjvFPgRKhgIKFAQZXumd/9ykWAJE02OWeOOD/LjfSSMA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMczFnbUlONTI0M083bzNB
-            RVdYQ3ZIT2dwbVJVS3pjZjc4d1htMVQxZGtZCjlPejdVNFVrV0t2MjJ5NEZuYklt
-            U0ZiUWgzdytMSHd1N3FPdmNmb3B3UkEKLS0tIGtPdmhpT0NQSGpPWWVublF6dVZt
-            cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
-            0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUczg1MEI0VFhFNUxYcCtj
+            UXZZaUhPNEZ3cDkvc2lZMm9ZYnZGTit4U3lnCmR0cC94dDVQcjJYWTh0Zkhkclps
+            WkVrZmdCSE0wdzYwNXMra0hLYWEzU1UKLS0tIHY5MG1LZkFpeisxeDNXQkFrdm9J
+            dndlQmsyTFBOQlIrcnJlOVdWS214aTAK4RSsxV89Ccb5K8JP20J+R621LWdtuQJ6
+            vwWhWkbtBU1Ck3NeEa4UanRqFJxl0bkpdFzHWoQnCm9TmzRf+Oikfw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-07T21:34:48Z"
-    mac: ENC[AES256_GCM,data:n6GHD+nQmZL17WvUZiMCBLRHbtpoKU6U8o/Oraj0VSRi/pQ74QWGVEcIX87kFjBvR2C+UPd3KwXzjQHhjUfHpz9EjIGi6tXLTTo8K3ptd2wCL8MW418TVO4KV+BFmHGT4kwlbdoqaJ2SA7HcfXNaC68e/2CTXhtkLpIwGXtYWJA=,iv:iC5QX/JMwno4mBljPdorNmcQSD2wy/wOYvGrUoC2yzg=,tag:GuFNQ6+d6o9DYC6Do/IEqQ==,type:str]
+    lastmodified: "2025-08-25T12:27:53Z"
+    mac: ENC[AES256_GCM,data:GoJ2en7e+D4wjyPJqq7i1s8JPdgFO3wcxrtXOgSKTxi6HTibuIcP4KQcKrCMRAZmXOEL1vpnWFA2uk7S00Av7/QOnzP0Zrk3aPBM6lbB+p9XSabN0sOe1UpZDtAM3bzvS9JZzyztT5nHKvO/eV2rP71y/tYbsT6yvj7Y9zxpvKg=,iv:tQiCr7zpo7g5jZpt2VD9jtFKo32XUWs94Jay+T4XWys=,tag:npBqmlbUUfN+ztttajva3w==,type:str]
     pgp:
-        - created_at: "2024-08-04T00:03:40Z"
+        - created_at: "2025-12-02T00:51:13Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA0av/duuklWYAQ//XP1HnmkjG/wdSC2lQm2XJkB5hMU+eJxglsPVaQpqTODr
-            dtVslBr/4nvCLypWhwYCG4jSz9YHU1sI9kDOsuo7PtwCrhfefeOL6CO+O40ECFMR
-            CEMmPLrTXg3LV3TzulchXY6x72LRzJ/aJ1Ra/6sGmffL7JHJ7vHz+U63oXyYivdX
-            9zsxP+iGRpQBK6wcA+Wg30rFV1ENE77H5Wh3PGRRXBSVE1fF6I3USgOxlQvGGnK8
-            cobLecH6V2TwSAptVcGk1gEmn6RUZdxATBnt0vE/Wr/zxZLuoRJgxmiwXuL5+kYW
-            QjCvCgAAEyFJtDRycwPPpDtTCBECPV97Ryev0Z8PdrYHfjNcgNVgDwNH9L3TuIEY
-            QL/f/+9PgNuUjf/7nktn1c5eAvmMyKJCiy9yKYZ1H9ynwN5Bxf+KJflVtTWbdJJo
-            ITXP2RyU2ttM2WjAM87E0HJD3XZ9x9I8Se/f5eQbg2Om7E2HXYr/v2uWf2ByRn5y
-            PV232/rR/whf/vpiwChDsBT97ZfZJibU8Xot7WMkQhgjCJaYH0wzYcrnvg3EIAo6
-            MBN1ufKNAp8BoXrM2P4yu+UOjrN8O+54Sxg7CSwg/a/ldDdjUnsGfbf3vzY1EJcY
-            2lhLZ8sOQyl+Ppe095pcTLvcYp2FOihf6d3i7GGG6Q9Uh2Ljs7EB02GDKP1XozjS
-            XgEsx/GScE/PE15VKlOHhrrF7OJj8P+uvlriVqk/MSWUVO2+X1yS09gXFtazLZBo
-            yqK2yWAOsjFnrMv4A8YHM7COkKvJ9BGdefsoGQu1O838/T7R9+e1OK9iDhfbcMM=
-            =vMG8
+            hQIMA0av/duuklWYAQ//eMoBqyI6G8T7c+LwLWl0KxVl4bPv8B1w6l2h+DbwYbki
+            s/u0EToWGFKNTcoio1Xwwhb8pVnUprLONKe1LHgDSsWhvZXBaq3OHxWJuGQ+T0lS
+            1nEOZt1aRp9ff4RA4BLS2LIB5+2lkVvQ2jWhgzzrEgC4FXI+d5XMhgXtPlO8Dgv7
+            Dwp+zTkYyCRny3FzL/AhHCYkqxHuuH19u4j9taN5VidKp9a1EKvjYZW4+xPM0gek
+            9AR89EIzVeLGMSVUFToAfmZ2jFOfMj42pmbQg29Dr3iUVvOZ1sP+w6Jt/1j4FoNe
+            iylriaZtSMLb6kjqN6xf0TnA6exa7hHuAlK3WbPv6JAYrGxs7+l9lGLJkgdXqkzt
+            oxyJTilv1+YJuXy4O2oW6hV8yymOfAKGHt/dkEnPX6UtddH+RDCo+HdWmXWy1Feo
+            skEfvwsbzKPCHInPGbo9Yq5NIgJgaisJlHVf5XHxuVVWdEgmpPZ1XxRvmk5B/9lu
+            gvr+kG4nN2ZxjBC8sZmHQrvuF93x3mXmHIyu/W2LV5era7Q7tUjaikBMba3a3Rpo
+            OQw0auB1OBSmZOFWMa4ppWU3H5V1hOBoD6tygpJvRvuKxJIVGMg1XWBuLJuAhLF8
+            Sdz9AtHR7zeHtNG+4/da/5iYFLi8e0j0H16TlKlW+BuN9kXfmuw1UC1cl+gRLPrS
+            XAEXT6KxURapNNTZTbM66rJNdP60J4u8LhvBD4RLQNGXYQe8Q6RrOdrVRCYO1cjx
+            71Sydx+N+XLbNHfgi1AnaVXmWmZ5PRsAxt4xXPWZb0lV8heh8T1FBKeQM35p
+            =Ur6q
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.10.2

secrets/bicep/matrix.yaml

@@ -9,91 +9,92 @@ mjolnir:
 discord:
     as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
     hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
+ooye:
+    hs_token: ENC[AES256_GCM,data:QBrdRt4ozAh2XYJtssm82uHlk9aGO1Nr0fEZetmWfLvmw52FZEq8ijyKOgwS6uTcndMi4gGKkq9r4eapLwcMdQ==,iv:VHOAqxR1WGzZ9dmNx+FmjGAKRpUFjWOwyOVmgDswpE0=,tag:k5it/yx7pOfGbJXZUlV69Q==,type:str]
+    as_token: ENC[AES256_GCM,data:RMkY0xVj14FwDbYaAysSmzB0IlJuk0ucicNhhTmVAEgiU05PxWG+qk3/elFcaFwaXRFgQQtVyGFZEcK5gpE9hA==,iv:8JgNrTe7GQqPMdUCxEaxJ9qV7Uec2fkYBmF9LmH4X3o=,tag:tRnFpRAZs9kO3u2SDMwNnA==,type:str]
+    discord_token: ENC[AES256_GCM,data:6rzv3glW03jcYiJ7sAvDcvDmQHs9iVbV11tIFwgD3GuTkVn6mbAoQhjUaz3zpb/OeoGt+j/pCBRlZgk=,iv:JwkqLpeGYhgwLX7SACNh0AUO53XSx9IKgncI0+KkvyU=,tag:30C0X9nVSlEYPITVzuN0qA==,type:str]
+    discord_client_secret: ENC[AES256_GCM,data:wbM7bPZCWa2+UNUqXi27fP0ppdinRkEC4N9KB68TJzg=,iv:Y2j+8oI+kI7DMrBfFU3G5HtFWguNxDpxbNvJkpK5lQs=,tag:GntocbTCybCVqZ2T3lNSIQ==,type:str]
 hookshot:
     as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
     hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
-        - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+        - recipient: age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcndkMFhyZzdCK0JDN2FZ
-            ME4rTWo5dm9yVGFSQS92M0FpaW5WMGpzRm13CnZ3OEluNWNnMHJWaTBuZXc1dk9X
-            VXRDOHlXUmloYUVYT2pzT2llYU8rK2sKLS0tIENJVUgxUzFxTFg0S1BScm5tNU5x
-            M09CZ0Y3NTQzUVY2ZXA3cG9pYUx1SG8KkZXHZmB5yBh/zoMBMdMwlHyjIQE31EK7
-            cwAfWYVLjk0CDM1JScTCy7RoQpbqNsMWFyUpu1p+1N0FE8IgefOU6w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPL2Z6RVEyWnBPSXZXZFNn
+            dTlKd2xPREVLVjIrcnB4MTRHNU9LQklodGo4CjNuZmwrV2hCSlBXbWMzQk56WStE
+            MW9uVk1ZOWtZb0dFQjZFS1VUZ2ZOd2cKLS0tIFkvU0s4L0h4TS9zemVLc1JyTVhB
+            WEU3d1ZsMVdyYXNFNVpyallMSk1QaG8KYtDGiTY2Cf5YmmAKgr2s0FNeZDRpUCUD
+            vJEm+1XFJI4fkOytpOZt0ZywTDZZd6JkXD1V713Kvr+sDCvuT6HW2A==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTekd4bHhLeVh3RkNsRjBu
-            V2h0azluRmJzalZGdy9MR2RENkY2WkpyakN3CkdFWHB3cUhQYkZlU2Q3d1ZtcUlr
-            UTBzUU1lVFZZaHUrUENiWlFCYXErT3cKLS0tIEZUcVNRN1QwdnNPYnI0ejRyNDBJ
-            QXJzMmFkdDh3SHJCSjlCQmVSKy9McU0Ki8UxAzALy7EPr6Nve8UGLmOCqstCcOfP
-            OkTpjXFcTBJ9wMj1ZXCoH3KYqvJSu0gvB97phnkN9X8aXkf2DsOCfQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoeTFLdGNER2lRZWlWT3RS
+            RXQ5UmMyNm4wRklwRTUyK2RsVlRxMUU3RGdJCmtLa0VTNmFoSWRsc3Nhc0ZhQklJ
+            MVV6M3pvQzdtVTR5Lyt4VmpjMkFhcGcKLS0tIDZzcnpDclZLM21MYjFlbkRKUi9P
+            L1NFL3RQSlh5c0hjVXJ4RWZObUExaWsKyU9dDDimP60N7aF8wda4g+Uqw1Hcx13R
+            9kuemMqS1cj9HPRuEhCOINAHIqtnYGmHaow6UlEc/nuKrsV6Ibbvmw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwT05zbjVqY0NNQ2ozdEhx
-            MWFlMWpvMUorR2RnY1Nva3h3VHRjZTJiQlFjCjNtUzZxRlRlZkxGNncyQVExSVN4
-            UTJINkxHZU13aXpOdDhRNW56M3RXMUUKLS0tIHBqWHNIZ0dYTWNaclVDVk5sS3I5
-            YlFkckxlcjROank3eXdtdWhMY2N2Sm8Khqzk4NUSeaPBYkMbHBhBkagFBQs7Z9MX
-            HYLiY5pOdCkOteDSOGlqSdiKI7yVNsETjDXeXybLHk/RNaJbhvhqwg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpdFphcGt3V2I1UGdVcFJW
+            RUt2cXNIaUlJbjE3bVRLcFlRalhZODM4ajNrCjdjSC92a0cweG0yWFVBR3BBOUsz
+            OVloN1craG1PdGVnTFdXSllOVkpRb2sKLS0tIDI0UE1QMFpwUG9Xemp2TjJRWTRS
+            UUFYczFnSExjZEJkQzhYc0M3ZFJOOVEKxqyXt/2CmKiuIBKdA24atjD8Ns84mV3C
+            6i2H1P7+XCDTjT+MyaRV7TlOyGPv/AqcXnAgKxk0CNX5O3qoAXmjqg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQNUU3aE84RnpaR1pET1l1
-            b2dDYjZmSVd3N05iMTloKzVTc3phOVVGYlRrCkpGMUZhL0Ywd1dEZm5TYStCNjlX
-            ZUJnWU8yZ0htbHowMzNBekNRSDBjWVkKLS0tIDlXczh1VDNsdDYzTDMvK1U3TWxQ
-            V2tXdk9BUG50c2ZCMVRoY0hxeFlkYkkK+XdRap/LtxzZ3q4ulPRb3LQyeeuO0mu8
-            So+7G2acSDhcNqZtW4jsu/NzSNqcv1bwd4XcKe7xqVDVYRpN8LBb2Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVTVyMy9mOGtnK01hRG02
+            TG56MSt6Mzk5Qm9jNE1uTVQ4bUh6M1ZJS3hJCkxlZ004TXJwZUxIYTQrRy9KaGdQ
+            U0VHdHptVmIzazBMMmVjMmt1WXhlOFUKLS0tIGJpNHZxbEhFWENhdDNBS3JZbVBO
+            WFdFdjNPNXRRdUFBZERjRVhLbWhYa1kKDULOz7tab3nP/o3W+2lYQVZy+5R1r5dg
+            V82DVkqygJwhjMD+UHV9KnkHSnaSfwQxF1pVKq1ZZN1l+mgNcISbjA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhMW8wMi9rdStMSkx5dlpL
-            V250UlpET1k0NmZzaFpYRG15OG9NWVBKMGtnClFxeERxc1kvS1QxNTc0WFFQTDU4
-            UmNGaTluelF4NElXUWhHQ3ZnN2FYa1EKLS0tIEJHT1FZZEFwc3lxYWJFc083ZG92
-            TllFaWFqOXZhVldlcVJwQ09TSGRFMzQK+smZIE1hYx8urWrAqqAb9zId6ZblQesr
-            pc7lDe5AAumIh8t8tzFwl72XtSMrStDqaneibbRjr0N39L0xN/nhTw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjaFl6VUtDN0JFeDB5ODUx
+            Q3dEeUFlWWtCV3p3TWUyWHFMc0pTamo2Q1RNCllyR211ZmdTaTdRNzBDVXhqc2xi
+            Rk1Tc2thTGZLNW1hejJzdUpOOTBDUDAKLS0tIEFhb3BPQTcrMXhlenZpeExCNHNH
+            OU9sN3hoTHIxWXUxRGFQekJDaVB2S1UK20kKBwClp4zSlgMShCC5l9EmhbTZ4jwT
+            m82tXz1tCuYqJeyklyHW5vol4jE5To2AL3im7WyepD9C5pgA1xNiZA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnZ2gvZXFXNmdod1IxWm1o
-            djN2Sm1iVkpHYTJ4LzdLWVI3dGJIZTdQK0VrCjJqVnA5NFlXVGFFUDhXdE9GZmRJ
-            K3ZNTnVDZ2w2NjZEemRNUnVoaXJhN28KLS0tIFVxa0NBNlVVNlBDZ1pxSWRZNFY5
-            WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
-            pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRQjFGZVdKTGRXdHBtMjY4
+            Yi83alRTNnpZTnl1c1R2ajJYRXYrRnZUYUY0CkE5THJVSXYwT0lHTGZvMGFCcnY2
+            YTJhS3ZyY1ZqNTZmL0ZnZHRUNmhmWmcKLS0tIC9nc0xIMmIzSGl3aG9kaEM1Kzlo
+            aENqOUhnSjZpNi93SDBaRy96MWhjblUKqvy6v1CdL1pqOt3N1gEPCT01ypwd/SG5
+            dVaVKV2nEWoAS0/+mho0KmdHQNJi1Qejhk5RSkoaZRd/jSC8sR8hdA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-13T23:30:01Z"
-    mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
+    lastmodified: "2025-06-21T21:23:24Z"
+    mac: ENC[AES256_GCM,data:bEJoCzxph/MOnTOJKdrRiQmbVWmAgsKy8vbD5YBeWagWUCJPDAZNDFLzEzmPvt0jDBol04JosrSIKZS1JzJIIm0zRkcOWSqERQCgjgtGdAYmfp0V6ddseDUVfKlZYJDkt6Bdkqg+9LzrP8dDVm2tMDXpo8vzs02o9dTYFm7imVQ=,iv:buP/297JMfvEm9+IdMWRGV7AgZwF0+G6Z2YIeYw/z1o=,tag:+zG612MJA4Ui8CZBgxM+AQ==,type:str]
     pgp:
-        - created_at: "2024-08-04T00:03:46Z"
+        - created_at: "2025-12-02T00:51:22Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA0av/duuklWYAQ//TtjTsxf5xHnu4g5Y22qvyMud17MN4j4hCoLXjRSbzG8K
-            /E+0Gs08P3QqV6DddmLvxeAcnLBTAdE4XCMFsRX9eK0BLqPe++yoamOpoPe896zm
-            BW2BXn/oemGdOFVOf43LRuMEYn32pjg4RNzR4bn3om2TY3S0nr7GP5J9B1QrSPfH
-            AFdR78MwX7PrOkkh4jSLPftjAI8jUtvS/TzX8AXnzy1A8xSkWxww00GMvTvSSAwZ
-            wxU6fePkLwuxVwZVqI5pdsjAscwy7FE7NWDgE9GMIxxwAJRRwJcsJ+eVM6ykWMyq
-            Xqo24kWkAqgs7vbxU55gOqPVHN50M22fQ4+RYaLnLyj6BO+0WegW1OmK88q0flaA
-            QADZHLGrsuiVgc4KxHskwQou1RuHZnPUSqn+Nhnsp8rtAfboHS28v7ekRNTmhTWG
-            qPVPlOlVnY0AemohDjBnk3o4rCxJhviL9KTjmAtIGTK03Fqzk2v23H3+LRo/rocm
-            gQCXzN6Igdwn7n9x8wXmuO6iL9Jftu4MoaQ0W55hZiBfh8pG76TGdNhycZr2T40w
-            MBnRX3ydwH2T+y2pGM9tJY+nlgGsyTiOw01SN7/mio3YdCSvChXTkV3PaX28u+CJ
-            5TaYLM2IP8W5DJU3r3dV3I3JYED1O5Arq7Xrv5Z4qr8vwamnCN6SZGe2qCqxTOrS
-            XgEHGwiK1pFQIBxkI0gFmGX0ckd1NYUfsUCyYrFkcAsicWetBhdlgMjLc86bVHwQ
-            7p4iGLGsr7GZEArBnP0J5Ee+Hr9MCiW/OCLY4M4jlTsyimlsdgDgyr+RqoOnvig=
-            =SRZU
+            hQIMA0av/duuklWYAQ//ScZ/w12TKrcPdjlPMgE25vVMG3oH5ozWfVdnzSpDJF/O
+            ELT0FRqoDOQfW+XCi6os3ovWQUqDSxuflLdLUkWJFC801LV9gn63loCZlwvMga5C
+            TWcw1ZwGw+El4I8GklzHc5t+vcWvfICjBj9c0s6b+NlmPhRDt9k9cCtvX2QTHbTm
+            9tO9371o3CuEwzPCBou1WvAvhQHH61j6KmWo+gfaGv2MjF+spB2CDhKGlQZAfaPy
+            Q5SspigrBwv6JhqqqrBMT364OI/mNUfm+y8yX+EdQ/4ZIDmA9JCLmDmA1GMaXBqS
+            XjANHb0rGStNuQKhluUmqYEguzicDWpHDaoFXiJ4C3x9NF2u56cb8IauJ5rBqdC1
+            xyeCc1Ja8dUIHQkTwEvIOXfyxtDrVT2B8gM1AYHHTxNjRgJTXIVBUo826ccN4Uyb
+            GdprWu7Dy0RjC8v2IyVvQiDGzekE4l5ddSgz1N9HIAfbo+j/6vCMTycdsp2FRJ9O
+            1CHzgcQfBRnIgOkgSfxh+b7eKKkL11x4SbT36f9zWL+wSSCtO6p66BxK5kJgQO0X
+            ACWE1gqKdJJlgw3QcBZwCxFT/cIGjfqRE9Rwyi26NvHyd4EnH/BU6xcKtZ3cZkIl
+            D599+UTygoyWz7l2s6h0O2t5KFNP0DarcRHlv6BPJ4KuNwq0+nGa1E54kDHeqfzS
+            XgEg7wqYz9QXtiHHofPEgVOo2MD6FTYNTBQ3Fj91CW65ME0hBfzsliqoLq9B2mvZ
+            3t7SL3uR1vngmtFaXxCyERcsAnAQz1ClSK9Ee5vzAWLazC58xvctwam1eXKkuew=
+            =G9kW
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.10.2

secrets/ildkule/ildkule.yaml

@@ -8,86 +8,82 @@ keys:
         postgres_exporter_env: ENC[AES256_GCM,data:8MEoikoA6tFNm9qZbk0DFWANd7nRs5QSqrsGLoLKPIc1xykJaXTlyP5v8ywVGR8j7bfPs4p6QfpUIWK8CCnfQ1QhsFPXUMksl8p+K+xuMakYZr9OoWigGqvOHpFb9blfBN1FBdRrk38REXWAMUn74KSRI9v+0i5lpC4=,iv:anpjWVUadKfSAm9XbkeAKu+jAk+LxcpVYQ+gUe5szYw=,tag:4tzb/8B/e1uVoqTsQGlcKA==,type:str]
         postgres_exporter_knakelibrak_env: ENC[AES256_GCM,data:xjC7DGXrW2GIJq8XioIZb+jSe/Hzcz0tv9cUHmX/n1nhI+D64lYt+EKnq1+RX/vJzU4sTaKjveKBh88Qqnv6RQm+MZC//dIxcvnnAdl50qnHZyBCaFFEzSNI8I8vGyArMk8Ja72clBq3kMpUz/pLBP0qDrjblKDoWkU=,iv:ZW98hJy8A5t4Oxtu17R3tM7gou183VLbgBsHA8LFuJY=,tag:VMOvQz3X/XDylV1YFg2Jsg==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbW1FZmt2ZDRZcWs4SEkr
-            R3ZDaUgyVlVvRHNNRTZCS2pxQThsT0NmYkFJCkk1Y1NpT1RSTFp1MWJ4aVNrelVx
-            blYvS0l3ZHczaVcvZDE3U0k4ejVtZmsKLS0tIC84WEE0WERiTCtKNTN0NmZUbDhV
-            c1QwV1l5b1ZQNitFRnFhQmIzSWNZd2MKokg6XMIFfjxB6sO8EBjBc7E7Ur3zBw1o
-            akXuA4I1Xw2H1W8B6HkVSDp4BpBEe8xi0z8TUmzkA9/IBoypG5EJKA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTVFo0QzdTbnE3QUN3NGwz
+            VlYwYkVMd1ZWMlVZcm10cGtDVTdFZGxBdGd3ClArQWRxZ0V5RWY1dXF5MUorTS9P
+            RjhMaXFKaThud3ROcTYrTmt1aUZkSjgKLS0tIGZZczNJVFMrNlBRKzN0dE9rZUsv
+            bkx4ZVg4OXFUWUhPcTRmRERSQmZDUlUK4jdVIeagp0RJ0511jqT8GL9Y2gezzWD6
+            hIYAXFePO/CkN/RA7DF0Y72fawmRWdPjipaFOMMZcKn7FClsZzqVtw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrQzVtTFRFTnNNQTFXL2dF
-            UC84d1o5Z0p2by80QW9Sck8zVHJvMjdjd25nCitBRWtzVVdTUU85RzFpN1FmOVQ1
-            SlNESXBKc1BUdTRaWk5nSENvUXdraWMKLS0tIDlkUFZRVUV2Qi9iSUpFRmN1Tm5S
-            dW9lTkxsNXBBN0wwZ0NFbThRdzlvOU0KbLzteBt0VTr825sfKLNs3i3FT0/dgn2z
-            kOpJQf7KZKEVBkInUOkPmobtw6oM9vfWha035tTJPYjWy+Lp939tBw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWcnBRdEJodU8wbGZlV01t
+            VDBPOXRJY2NtK1l0UTZhSHFDQk1JWHVtcWlBCnBEeWRkZnUvbnZMV0hNbjkrNkZD
+            MjFwaUFyVjlkN3o4SHMxMlFpcnpEZlEKLS0tIFFxN0doOExOak5kUFhyZWVtWWRk
+            QlEyZUlveXVvZ2d3M1dqSkVlV0s2djgK4QAE3eKNYKN12CBteu897jQ8+4sbxBAM
+            wC/mzVvdlf2WXIF6m+R1ugDyQdWZeWZiGcZMX+BwwqE7Qu2egUdxqg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCR25sQzNkMHhETzY5cXRm
-            Y3QzYXZOemFTTmN3aTVpODlQclB1Y0JRNlRRCi9wQWVGUVFYd3ppMUVMdUVQNnBC
-            bVVRVHlsTWIzMitqNlQxN2NKcWl3a28KLS0tIEJrNk44TEN0ZzJ5L0JaKzFZaE9M
-            MmxPN3RUT0hDRW9MSm92LzZJY1lCZlUKM+r/35me5K74KkidKLUTZxqMqR++izHK
-            69gXZEHY+ZSvJ+9IBzcIxcFdSFyVUAN7wobBWZGDxmGJRClS/8jcHw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4ZHNYRldRR3N2eVR0TFhO
+            bi83WnNRT2lRUUVUSDhhQXg5U2RmQTN6RW0wCkswRlgycCs2RWxVQUVTcWcreTVp
+            R1JScWViT1FXUGhVYW1KNTZ6eFdaeEEKLS0tIFpyeCtmRDZtOWY0OEZRZk4vVUhh
+            VnlnZFFDOHNKejBQNEUvUG5xTkphOW8KXskAnKTfKQmQOhgcmGsIA3XXfWfubBeA
+            QQQ3YSlLKPd9czV13SpSo9IDr/jWCUHF5SblpOD4t/ZFZR4ajV/VQQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXbzZHMHVqVkVrTVdiUmli
-            OVhhVTZhbVRVU3VKd1Jxa0Y5dlFReXQ0QmlZCkVtVEhCcVlHamozeDYrQlVvRjlZ
-            YUNXM3FML2ZLOW5PZ0tpZjlPc2lpdlkKLS0tIHVXZHoyRmlscSt2TlpLb2lDd3Bt
-            bmJJS3JPWlVMd0FRaExUZEZMdXk5N0kKY6qYVva2aOkvo1huKH50gkT1iQAUhZCB
-            ieUD1aQumHe1OYVeEWJCf2nYgApwq1tPjea5nqc4VzOogTbLVcKMFA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQTdHaXRLTFROWVE3dVR5
+            YlV4VGNsd0hCNjc1U3ZOZFVHRVB1cFF3QXdnCkExQTlqalJXVkp1Umt4SDZJME5q
+            R2tmbmNaKzRISkRQN2MrQXY3OGdINU0KLS0tIEtjcDI5WlVPQmFVU1NzNWxZSHQw
+            dE9kZW9OK3FPRHc3YUVobjlwZVpUNDgKeIL32Sbecv/d0FFX+FKYxQqyyiipZbW4
+            GxOVsjUaZsifGsCdT9V2xNlXsuYmoc98azFqRHq9W1VbXP+sUuk9mg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNWc0RVNQRzJkRTBKS2xD
-            R3ArQ2lkc3F3QXN3bldZbkJMaFhoaDI4Mm1RClhuSmdRbWxlM1lxOURRWWVocC9X
-            dWFSOG5yN2x3Vm9CZ0pSN1BLTWk1ZmsKLS0tIHRpRmJmL3FmaTFpL0czV0tIOWhX
-            NHZLaEx3dEozc21MR3ROWHRBQzR3T00KQQiQ4SxpyMTDZyGY7TZrdQEioZAB+BQ/
-            u24WgbBdSP6VDvqmq2gG8BqZ3Aog2/7SQ0CVzrsimAoXi7YCWCTetA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Q3lUUS9wMGI5V1NiOWZZ
+            dXppS0ZsL0VXODdsZTlnZW9OS1VjWGticHlzClZPNFBmWjA1dXFvMXlPekZoOEpr
+            NHJtSEIxNU1nb1VDcFdqd3BCWVFEYkUKLS0tIEEwczZSSS80U1MyaW5yTnFZWDFO
+            eVRpUDB1VjZkZTNVSFRRSFlqVUpBVUkK6X6Y0du2C6eslGR9O7r5Wg0P6GO/KBP7
+            HQibU10/HhLOjdzj0LKQldHWDnDUzisUHQH2srRSzCg+RQ/FL+BmUg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVcERwTTJmdlgvZjhWeTBP
-            eGJ0aG5RQ0xrRVBSMldEMEFpUHo0TnM1aFNzCkhReEZ2dWVGelNadjdITCthcTZn
-            RzlQZmh0MzF5RmZGRW5UVXhYL3RHRFkKLS0tIEtrV1ZjQkovZFlmcDM2OUNYaHZx
-            WDRSdDZRa1lIbEVTdDlhU1dwUXUzQTgK5iE4Cf/zjsPYHKcqYA0rFqY0TNcCnzNU
-            vTM+cEPaA+/FXTwLfPpaiSkg5Fq8k2XdeMQsjQnglTBSWCwAJin27g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwUFZ1N01mQzZUOGdQemhM
+            VUYvSW53U3VpSnZIN2pHMlBlVzN2UFBiSzJZCkFUeGd2QTRud0tSWHZSSXVNT2dp
+            Z2UrTFFZeTV0dTNUSW0wbkFHV2tqZ1EKLS0tIHJJWGZYeEdSS2hSemtnMmh2c0xt
+            MkZJS1JJUGZBSkU2bWRONHVNK1ZjNTQKbwBOAnmCTTlILx4MVZjt4qg4yIENrrgv
+            x3IogdZAHt5TNBM6TzFT7eEpvmS1WWMveeetT9jFb/rlTVroturzqQ==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-03-16T20:08:18Z"
     mac: ENC[AES256_GCM,data:C2tpWppc13jKJq5d4nmAKQOaNWHm27TKwxAxm1fi2lejN1lqUaoz5bHfTBA7MfaWvuP5uZnfbtG32eeu48mnlWpo58XRUFFecAhb9JUpW9s5IR3/nbzLNkGU7H5C0oWPrxI4thd+bAVduIgBjjFyGj1pe6J9db3c0yUWRwNlwGU=,iv:YpoQ4psiFYOWLGipxv1QvRvr034XFsyn2Bhyy39HmOo=,tag:ByiCWygFC/VokVTbdLoLgg==,type:str]
     pgp:
-        - created_at: "2024-08-04T00:03:54Z"
+        - created_at: "2025-12-01T10:58:21Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA0av/duuklWYARAAs0o2EHlphoU4JcO5fhmplhmHQp7GXjaUc5zakGACrl0w
-            0NVVLXf3hlb3saPgbRkf+ugVXd5dRDYfa3vbIDKpQwHVLSNVrVb7M8eIc0RXM41q
-            MqpueXLo6YfxbgOvsfNlgCvDFgMoBMVv/rWz0QGTj8VCvD5AkxiLQJxZ8TnlKn0w
-            NF6yQ7LCGgKVU8YHpKYjPmmDU/VegRYVe6wz4ackk0MZ5ITSFXF4qOG93Uj2SZfe
-            ocpPYZ9BrOnxzCYd9ZS1yUmMRLRC61l66oG1hGrBTN7fcmHZaycCdcvABWOB/fxJ
-            940zMb5NYK6whToCWY++m3I6123k+/vLJe+3NoFc/wYdvpnxVqLZqijxYPZZkbRN
-            gCtRE67AFWny0VQ2k1CGzBGbRAxM2EtIfDlbNgMUNBNuGST4tgxApp5QEa1yecHC
-            mr3jDhR8UuFdIrq2sTz/uMUptTrsB3oaZmfuZ47pCVHtDNc2ri4U1gsI6oI03utO
-            u/q6nMHiJlf8HUwI59GemBaHTiMgzKl0REAoV3SpdfjWSDZiro42au6E20M1dgup
-            rQG8Gz33QnIHg5ezEHcTSeHk3SgMTbAqQy7/aD3pqI6wEgXqU2neDFZEkNu4FnzD
-            ofnm1oAGnbOIH2+SFtd33hDe/2nuFBo3CYEyz/fezhbMwCwoA4Iwd7FBQW4ideXS
-            XAGU2gt1hdPfgMQ55GeRI01C2dqiLQOpvTHy2uBl9ekPtSw2Ws27hVhdHvU7B5ZG
-            Jr388jC5d5dKGNv1I8nVNlfmPvb4hwGazrHdCYiQdwrpggajFtWD/LIgUcW2
-            =aK5J
+            hQIMA0av/duuklWYAQ//fm0H3oXbEcd0f5QwmAggrRzyy49KMXXpZVFm3xa9K2AX
+            W9+GJb9YDiCQ2shiKYas1QNcwxF8EQKWqDGGP5vHpUNb3el89sfE54qnz+MGcAiS
+            eVqggFbtHlDFG6iYt4Rgng4CmVnPv+CKdFuRs0WWO4ouNbG8NKIuqXuDrGw7yxBE
+            i4AvIynHHkrQ8Bu4KAgjhZOCTAd53TH6EFPa4qy1x9fe8Ki1QTJsBcNk4KXIT5ws
+            LUzbcCFths5JzpEdCLEViaFP7joSSlXBKQ7AtAXdznmmrX5JhoiBIEHusYY7Hjoe
+            urzppufh38LF6KFCRAl7EltJPlenA6NhMlTg4jEEi2v6IjqcEGrj9kyAgBnS3uz8
+            MtFovJ2IzENgsIWZxUxr9vbQQY5PYy9ZcJpEPBRVRDfP+tlNs+kA58AD5ZqLkZwM
+            NOZmQZyjRP0L+8HfCiWRBt3dSJGabO4jNIBydKU40/2bTOIY8MnnYR9pss3qIRzf
+            TpePQd7PoGwcU446FV3py3yKecBUMEfb8uA0TYfp+7WMbJqetuQ+fGxCCNDDJKar
+            gMSEhFhduTSvQQPGjZemI89qZhO/0HCxyMMYpIPNYwiohqIGXFfFzCjz+CCt9xOj
+            5eTg+MSV6R8njgbiOpYyrNJE1K9LpKtCZop6QWNtSusaoKOT1jCVQLhvFSNfOeTS
+            XAFdZOYFB/qtaxBF5Uu++jz2MkFZKbSkD+1niVgmusJV/dGwNUU+pvX6Ua1tH3mi
+            WAN4e6EtqtlL2BTIOAv6xPqMFYe7wQw5fdky8J8diGbBd1v77YXpibZoNWfd
+            =Z56A
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted

secrets/jokum/jokum.yaml

@@ -11,86 +11,82 @@ matrix:
     registrations:
         mx-puppet-discord: ENC[AES256_GCM,data:nvWSaZ4we8BD50Op/bZMrlMXGBwzvG3IXGPGJe2paCZ10tTm9v4+aYGYhILNhcQM095AD9KdEJ44TAyPxZ/c5iYLqb/LJzEpa5X2jKoiF6r7PjNFGevKQs7fzJk4Y9MxHwZ2KJT+uHjtXF8erJvFDs3S3WgmuAQW1U9b5fYQNc4ZF0tY+BsWU2ehqMejpx7w93TkcIiZY7Uoj4kPMEp8aI6v/7VPIjM9g7b+R5KGZ1/yIpiNCzZuT+x2mxCtqGfbOynWON8PaCIojp7sbLaRWhX2bd4GG2wP3T5MsgwjJzQSfyXjK1Dyxzr8fVmh0R2mJoZHTYNQLLwYncLwqXQEHr6tXNWPTwxPslW+BdLsp/8//m0F04vUf4Z0dbf22NSaPkH9GdRLB3zXh07VxqG+B7OvAjDULHUmA5uwgtZq9h0G73TWDJ8U75eAxrTdsgQgmIsyhpLljFW2QSnOPL/93ieovh5qRgXjgyqrljDOkB+fhC0gdQalPeBM8l5zPI8aaJsVp/l15rx4nUIrFka0g+v+SRhAIPtQAKA=,iv:3gzyGz7T9PK/J92X46YXYT98bpTnx1uPiiwXuls/kOA=,tag:Vm+zNmA53HIb2dP8FIgP6Q==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmLzAzMzNCdGxSMVdiNUVK
-            SFlJeTEyRW5SenQrMnFGZEJ5TGJxNDIvSmhzCkdBUnYvNDVxZ1ZNSkYxanZQY3Iw
-            akhuK01haFVRTUlKcjloVU9QVmhldGMKLS0tIDZmMjk1WlNNYUFXN2pWQ0oxRjRv
-            bzFmcnJUaUJmU2pCZTRnRTZZZHVkQnMKrKLbYFE2+0rj5BUchhYtWghzbRJTFDaY
-            +RQpJC+5gSinmUuP3nMGR2bv+gL9v/EOJKeVrC7/sZM9mQeXI36CUg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvKzl4b1VWTHQ2bGI4bXJl
+            SFNhY2xVNm9XdG56akFWZkR5NHliUnpFaTFJCkhRY2hONTVvRkZaN0JrM0lkZUVu
+            N3kxWVBWOUV2WHJMZ3Jsd24rOS9hc2cKLS0tIHFDWXBMcmppeHJBb3RLZ08rdVlE
+            R00zS0R1Q29QYUlTamI3MkhNNWpaZ2cKMTZ8G2ZVNsAKgZj8B857eH4yfw/fvwtJ
+            YmDTcA0w+uXI+qTtSLs/UPQ54KcW7zNvMUUSoyKrYSDul0SFUDk+Vw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtU0xjY0NEelJvaFJEdjl0
-            YVVDYXFxbFg4d241ZjdRRjZVM1lJd0R3NldJCjJQRW9EOGMrcHRUNlRhNEJ3cWhS
-            UWlycHYvaXA4TkxEVjZ1QThQUTlrcjAKLS0tIHNXWk1mQWJFcmU1Qmp4a3YrRngy
-            LzZ3bU1nd0FLa0hNR25CY0hzNS9GZjQKRoRMDXESUtwRGDat2gJ9Fjqy/m6FThzk
-            k6byBSt605skrUd2YQZ+JF9cUs6p9y9Fm6t+HfK/kHQ7jchiS3ZLmQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3U1hmbE0rWVYvenhwQUpQ
+            NFlKcFZtMWVWNGU3cVkvcVY1Mklyb0x6cHg0CkhGTHZPZEFCSnV1aFB0eG1ZOHNU
+            UGJLY3BxOHF6V3NuWGZJUWkzcEVUc2cKLS0tIHhVY2xjaXZCdXR3VU92UUE4eWFF
+            RHNtb1RlUmdpd0RibFlES0FDRjg3RFUKFBfH7eVw3j9wFWYjK3nwd5BuW9V4R29U
+            sD/5X7wLRmfo0zCNkf50RnN3oxiP5Sj8zprQnaZMX95EGZXgqeWuWQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuSjFQb0I4eHlhL0NMN1ZF
-            WldhZ2ZiTTZDMXM3aXgxeHUyZm43dmVVNlFvCnQzd0VYdVd1azB4dlJkdDd3bE0r
-            VHlwMFZzaUhkVzhhanl4cWxGWUlDWFEKLS0tIFdWck9qVVRoTWZsK2RNYzF2WEhN
-            eFpOY1UzWHpYb3p4eDNRU1VSdnJyZ0UKrF9vihQPmmv4nrDf+tPAssfZLNJbdK1L
-            N4IlFTUPchiPW1ss22bjtiooekHAuP4ygePYLKlKEi3w1SsKa9REGg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMGc0a2FyTU9MaThIUDlz
+            VWJTOC9ZUktuejl6WFRtdlV5VEFIakZHeENvCkpFRDF4RDRQMnpjZTNCdkE1cWlO
+            VExPNXdxcGk5RTVEUE5KcHY1U1M5VTAKLS0tIEIramZ4R2sycnFnS3AvMWZ2Q1RK
+            dGhDZnVraGlQQkFzdHBRUjEyWEJFMlkK0M3q1NqZdaC9E1hSUOwdTOUWdyvW1xPb
+            E/9SHuRZ+YTzXiECIEx/4ZiQEEcCWOS/wLTQjYpzoozBrmrjGaKC3Q==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZEhYTVRBWVJkYndjOEZq
-            WlF1UCtJN3Uwb0FNdHJITTdiTXZVRWQyUFh3CkJOOHRHSHhXdW5uTEhVeTFHWWNi
-            QTd1cW5YTkFJZTRaN2RaMnRKQi93T1UKLS0tIEwzSnVleWduTkRhMnduNVFEMjFL
-            NmVHOFd6eVhXdTQ3RE1adkhUaHB3TVEKPFmS1njkM6FPToIKML396vfM3T39co/v
-            mvyOUCq921mTIzlPfVpfpXd9pmiyMKi/spDS4xZ2nFLyHMhXMKW20A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJTXJkckNBWERIWUNXMERK
+            UzRnL2FJaUlLTmxvYTBQTXlvSTRvbmhmajFJCnNCZjdxUXpVNDlwY1JDaDNCbWlH
+            ZWJFR1o2YkxLMlVNWStoYnFYL2pNcmsKLS0tIEEzM1ZIN3dBb2paeWcxa0hJSDN2
+            a01lK3hSa3prWERxQ1Z6Q3A5OW42NnMKxfCqjDityZvhOoH1DG0JJuEvowlzFBVv
+            WOofbRQ7HdB17OyZh3u5Kbd37D65bbse4HVUaL3NDbdfpUxsbZIUAg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXbDVRaU9pTkROV0VoNm5p
-            VUhsenhxR1cyTFZVeDJZd1gvVUx6TXdQY3hzCnBwUDZmaE5FdFdVODZFN0lxbTdB
-            dXRBVHpUak00RnZBRUpGeFRuajhZK2cKLS0tIGRaODBlM1FnRU5iV0RrWDlEMHUr
-            U3AybkRZV2EzVjE1QktEcjdwNG00dXcKnWaJwHyA4Q5RFgOWg3wbPwL4E8Mgijph
-            wCuujSzIUMGBqIBzr6ADbQ38lnUSKjGz8EQyrIa4/vILXzuJ/44SbQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkcExDUDNndXRLY2J5NnpD
+            YTFnWndXYWZvRG1EdGZZekZXYUtBOXFVOVVvCmJJOEc2MVhqSDJPRTBVRU0xcElK
+            SzJYS092eXc2WWExVFFheUZnLzlHb3cKLS0tIHJPRUt0RnlzWGozM1NtTlNzbzVK
+            WUtwa3NvWDlsYmwyalYyL2FoNVBhaDgKiRmCO8OOU94uxnzUmGwnUjipDBVeF88x
+            hF92Hj7+9yBaEi4O1Je0b3ShjHfEsg690ajQKkzojGDX/awkdlcF1Q==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQ3RYV2tYVy9ubFQ2cTg3
-            L0xqNlcycHZiU2hlRGxmd05EZldMa0xMWENzCkhHdmR0dVRYMjZkdit0Mjc4dy9X
-            ZEtLY3hrbUZjaXpCdHBhVm9wZkJ0WlUKLS0tIHdsNHhNSEZVSHRuWE9tOXdoY3ZK
-            Ti9TOVhUWVdsVmw2U2ZvazVKajJSRTAKnAxtMLh5U4xL3UsLehdo2JMBRcX9Vy+X
-            oWlgVviORYtHaaU7Y9MFTmhV3OS+He38wX0l4NZOI0d8mZ/6uJ1JMA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyc1NLMmZzRUt5TWpyaXhH
+            c01CYTJsQUdBWmZ5eEVRWXduL2ZLQ1crTHgwCndRYzQ1ZU9ybmxlRlZtUVFnL21m
+            eDhYZy82RFJqb1Y4Q1pZMTRRRHpQa2sKLS0tIEk0enhSL0Jjcld0QXNCbjNKNjJm
+            c241QUEvbE9iL2RPTFJCQ1dvVW9kVkEK3N7ojkIdpcN/ui1xw7IEzBKduk9aDKrt
+            KajZLOkcaJWsYZISxP8kmN3CGOBlOx77MxC/rV1yM+/Su0S0TxIC1A==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2023-02-13T00:12:03Z"
     mac: ENC[AES256_GCM,data:FolV94dIwYSL5r1ZHTPdmqMKVTAhrnePG+5M4S1H/wBYbED3sr6oPPmmxwiwm5E4K0YR1+ou4yR/vGTV3lfRdxIGWhfAT0WW8WGTZVIlcJCEk5H7Rels6rkma12BCjZ1zOGjZZCcFTm+4NI2KNv+zTc29zry4539jkkxk+8Skog=,iv:KBxSFVaFI3S5J9xG2Lc7FINUI8TRKxPtrbP3f2wXkHo=,tag:TWAtix03ZnB71+O7cF8b4A==,type:str]
     pgp:
-        - created_at: "2024-08-04T00:04:00Z"
+        - created_at: "2025-12-01T10:58:23Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA0av/duuklWYAQ//QIfxaAOVl0QStvZe6irI0GHS8+7EExn88dP1QdMnVijv
-            W/IiVffs/Bb0t0hcNFY3SaU4ea+zOT5bdMOlQGA383hTYvwXXdI+uSFmn3hrysZS
-            eY7394Z9c8jubEDXfJOHTt0mbpfzOglZjiCcQYnZlhkgOzilDXMCjVsjVvuAN0bz
-            MFN/DjC50fIdlaeWe7h7NgK3Mu9j39tUrgDCGn2YlCycxcpPz8+83Ge8bOnyskZs
-            P/04wfkOGSrwb1ingxHjZP9lR2NABdqOqSBzC+x7EQs6xNAmC4XayeTnASBDYp8B
-            +H/3Hiv1nWtS//PQr/5+KHR1/iLaSNI2fUAUFimIwEQTU1vpMaV2tVmJtpmSQRAg
-            MpwljVoCSWvhmU4oZU8ObTjcMy58YfWHIOcIN2HHgWBVdITve3sca6J1VHs0rWFm
-            4tqPElsfa59WPy3HKLGg8pPahoBlj4X1PGJVHxXBMJsPnbX0gg6V7ajQaVdOsJAF
-            LMgAel7eNq0KBzk/rrVRoV5ii2lipUtKmb+FKTXKvSnwgqhVNkRppsl9BqgeXvTR
-            P7AsKnNgQBydz9vDTkDOuspyTluDmhXkwNQyhjH0enPAyeQWN2qs/A8qgmfdTXff
-            TzvlfOEy/6r4zl7V+L+qcw0pYrzi5K2CtemN8TlGhRvAYgiURY/78kD6EGrjMLLS
-            XAHBQn0q8dYgKf2uA0JcfNehgpI5fr3gZxQFKhnuXkXRa5h9hMn1mzdhtO4VyN1e
-            d8eL57iFeApC9SAmAGMOz0DBbskD470qnYObUliViWQpcj2VR6W4BwZG28QX
-            =iviy
+            hQIMA0av/duuklWYAQ//R733yCFFSYFZX2bORvyI/xgHjzxNxWPkVZagrWDvjthK
+            zJH6EiHZrivSRx6cXQIQ4SoR0LWHNidmIj188l8oB/Dh7jj42zd93+U99EeUhVNs
+            qPN9C88/e/tEWs05HTSm4oUQpoSeDVBeZEd+du+eP+DJWypSi63fh5sqjPrPHXdq
+            apayt9XGSGBIhWsACb9d56VqCb1eNF/SOcOTLPHWvA074TxmvcbWH5CfiqQLcYGd
+            r600nWol5qhmCqgiLFueUiYDikKVHi+MitatCM15yrnMi0ZLp3B32n3zPjbTUpAh
+            0NHtXHhH4ihBqWxnVSTqAqWiqM+oMORhzVatq0PjUq20XayELsY8yn7YvtJMZLjD
+            CstNQc6NqYxwjLpsuqZQHse5MnAgXapp5ogKLpjxRX9ZKWo5QD1VDB4wELG16sdv
+            h/ZvS7nh0mMWRRyXAe5OL8vTJIeiQBday5aVgqk58OrdhzVtqp3isIKRb5W92W4z
+            53Cw23prLhZnVssMLQiKUVFTIu2f1d907Kj+sH5AUybkbt93T7m/NCaEpDyxPPur
+            QDOT1KFFVTQIBHLyqg8pASJyJMiuSuQ3cbFkTDWrOWpKEDfpxo9Vy64dEKNCeWMb
+            XhVHWMIJXmLXalPePDaCEYCkR8usWZpQsRei2DHaRbXt1dcOjWuLOZeHNizy7CbS
+            XAGkGgNySuI5IFbVBfKG0OaYXu6PM4Kbh8XBnxxREaSH+EiEe11ig6CImV2pbcbU
+            pfHSdTioB03UnQvgVSP2M2DgMr3dkJnqXKrzRO80kVBd9uwR4I/1TUzsk0K+
+            =4Nje
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted

secrets/kommode/kommode.yaml

@@ -8,88 +8,87 @@ gitea:
     gpg-signing-key: ENC[AES256_GCM,data:AyafTF3H8p1qDk9xsNvT68BksoKGLwE2uE3hjz0TrT2XPxCRDOIlfAVYEPSu2Ih6l5a2uruEJhHPtU2fPCB2hln3Bv3gZfFGLb3GFWkSvdePIYFxG56uqGK5dE1KaMccc2cTi+raDImKqSTbp7Qpdo/c6C0WYVglYrD+2l8Y4QOiFuazyLY9zwcX0qG7pIjJ+akCUjfE4rJDAW6H/v+OqvHpcED3q4iXOYuw9sj/UeIgZfJ5Xc/uVrRmPewP4yALnA8o9gsaaLdjWRFIILe7VRwPr0YqwQ6XGgc+pEartkV8AzxjCq6DOtifOOzmu8EI1U1yoaOViYCAMbSHfP6SIKr7pJbrdU+YDBq9mvRx8KPXWUU2uNGrMObATEzlqMYAYA/HJeOdV4w3Axvq8RG2FLkJxJJniwNP5VZRF3bbbI3w+hprRP2yAwgeQw19KBU8yF8upKga/GdMNScpKJvRyVLjZtI0rsfvSC81lHawouuje6aPXT3dH1S5ROJBHMTeV0sP0vK6liBevz9RZpvNs6JVyNCgiRRtRSSYqsgwPJonDKuPeI/Zpgih7HboA8HqhIibqpO96h5/4yO69oJAbLUYV3zlKQcMDTaqadL4Ox5Z+8ygSAL3l1ufZIFGSj73SNHGQqQlIS/a3dAccRi5fPqv0gOmGFAAUJPKfeauFn3TclwojKzu5vwmQxZ5g50txEpTSTaYOy++qq6UZa/dXEyDC7fle75dXhqXyqMCf9kDwZZl5E9eBsabNdTF+auQCp82iLQivdBy7uJX2hkJFSg84fF9MLgH4mOcMQc2E/z961uNzEgoyvVhbDY6+SIJ+6SGmnardbFW7mYrj/QqnSUiMc4tHukAB4NGQYHgjOYRZMpHfVO/6dLbjmTOljnPsnfQUCepvb9rGim8NazvnARaVzezx4t3tfbNR8uLQudSeLZzn/Fu1mKSQvpP+IjdglmyAgp6QhB4OCDPbiaMRDUtOQIzlVILdz1/geUVzhZkJ4xzkm5klGukhtv+3TqjiTcEnoVJC+A1jRvxBQUfEE92GFuupJUfrw8bIDqsWQLkHPCNUMgdoKa/q2OkrWeQz2zm2yUqMAJn1/puoLHdSH5aCELUggx1gQZoc480pSBUvSCML+Qc4B4Cd6hX2PPp+/KQeKtfqHIsKz2I+DMT6KDirReX6WHxqk+s2DtLw7Wx/j65PWCIWLCz,iv:c9BDRxQImWTmwq11+T2CW0S00Dixd8d0od5xn5zZmY8=,tag:brnMedsdTwlkbaHaLa2w2g==,type:str]
     ssh-known-hosts: ENC[AES256_GCM,data:P6hKaCpcZdXIy4rE/1b1+66Md/3Kmviileb0OIT3Vz4IVsDLecBh3IiadHq66V4KocXC4LBUNFjcrxlVVGIonHJ3qd6VpQUwG0n83yhj6LD5hgxmZ5phAyR77Ri8BiH1lWUcg51L2k0U+WJFPP6JkumT9MEz1t1+JYr5Imij6GKRWRKFwTbU6QJwFH4tCA/iGw0ElrzIjSHiNiwIKfbm8yas9vlOhr4y7vCeV10hVyvV,iv:dZ8hQxhn7pokWbQG/8rQ2vFDpPYut7WCG3xy9g6kzNs=,tag:xMyPtJJoh8kjJcOT4t9aRA==,type:str]
     import-user-env: ENC[AES256_GCM,data:9SE2k3/IJqbdexj0QFSQBQ1+u1AduWNjt+0XIHryJlxIEdvv9a+6hP4EXPo+31GnaE4=,iv:qZlWOBV5owr3ESTyFaV/R8VwlGl04kaui80I2zYk4zY=,tag:PhjRfEC1xoHaYyl648yCVw==,type:str]
+    secret-key: ENC[AES256_GCM,data:YqwSJazPqz1OOsUVIPKsGvIHbX7SyJqryan1KWSRGRJkt9yZlaiRtQG/mQugAM6IvLFD3pj+gPTcXyqenaAQKA==,iv:nyPnL7wuhpb0kl0tm1JhOHmF7KI9vVcTN1SRGTgD2o8=,tag:Rt/IPC/YtBcmTx5osGlbBg==,type:str]
+    oauth2-jwt-secret: ENC[AES256_GCM,data:YUVbf0xgnzeNoahu57yzoib2XSB0rR2AAIkdlEe8eC9AFEdv4vE0S372jw==,iv:k1cEa/sWqJZ9b/NetVSR37BYy6UUOM4qAnbsfLEw+5Y=,tag:CrUh0xDWA77dAFp8FY0jPA==,type:str]
+    lfs-jwt-secret: ENC[AES256_GCM,data:fAirrt7Ue1XpHYB12e8l+47x1dY/eIsDV61KrDA/sRSKvZherRNnahtLQw==,iv:S6+rQHf3TL/1tKcknX/jHJ7k79GCU1BRBZHhuqXSRME=,tag:WUjNaP8bb1HvZnAX3+vXoQ==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjWnlOa1NGME00dVhBQ3Z2
-            UE1HZlc0Nldrb1VwZTk0Z2I2Nm5ZazV6WndFCnNoM2JaWFJnazJaWlltVW9uNGhm
-            UmdPSWlsdllORFhyMzRhYXBKQjRqWmcKLS0tIC91RmRCNG91UW1xb1pETXczSDlM
-            aStmM20xL0hHT3VnMWpTSEltZEpqT1kKj7Io72QSR/dgggQRBZ0gjs0Q7Y3GIP9K
-            GPgvKGxEi8CcrUj5J9u7rDUed1/TowgWWs/ujt/8q2zfli7AjTpS1w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQXdwU1FtbkZ0MUw3UXg4
+            WmJWdUFKT0NaTkpjUWFlWTN2cFk0dmJNTG53ClVzUE9jS3RQcjN5WHBacERlZ09N
+            eHRRcnVMaitpeVBGVjNmMzBkNVVBOFUKLS0tIFFxcjBUTjNmVDVLNGw0VENpL1pK
+            NDJCVVNUNG5samc5WTlyYVZvYUNZVGMKvd5QBRv+HRc/DDILlmyhQVqhEDk/ZbBg
+            nsqPf4wmzhqg7l1Fu8FQcjcSwTv/0nCKyWpLC+TvYjnQ5ZSn/eukFA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByclROelpuQUFPQlFpREJr
-            NjhlUDA0TGw4R2FKbmRwWEVCSldrem9neVI0CmU1Q29qUUNZbmZDSkx0UmZmNkVL
-            dmNQMEJjRjJtcWFYNE1SamV5SUozZVUKLS0tIFBMdFB5TTV4dGRoeVNnYWV5dERY
-            ejV3RTlSMjNlcGNreXM0YjhpUkVxUzQK2xB69WIRrMPNdZuJUzwuNM/a/Qzpyp7b
-            nInPmTCCOhqc3eNFSc+od6y5urMeW+r2i2iNV4B2rIdJTdLl1434eg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRHo0UHhmZmUxdS9KUS9P
+            TDk3Uk1NL2pxSjJYTDlLaTFCRmhzbXZueFI0ClNWTEttaFNmbTNZQWRROEl5OUdr
+            c1RTRW9IaEtXakZSMTYrTERPK0dCRWsKLS0tIHZzSVI3WW5EaE1rRDNmamZnRkhG
+            QTVMaEJxMzB6dFRlY3BXbEl3Mm9CM0EKZ2pXa04/YjjrEPo5SRzFHeT5twZkTqRP
+            mcIO5tm9dmZOXPoauFh8iu1ElbNicfQjELnhAwYLlkjzHcw6HKHnEA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVFEyaWtlV0F1d0QvMGpU
-            KzUxdGpXRUMzOWhSODJNYU1Id1Evbm1QelVzCmNZS3NSNWZlZDhPYUVCS3ZIUXRM
-            aVdScUI5aFI0aXU1ZUx0VjBBQW1hRUUKLS0tIGtOcmFNTXIxdEV0RlI0akJpWEM0
-            bk9lWDZkS3BrM0t6V2xEbVdtZlQ1aTgKv7bIQpdGIoXMxPZDmLzqunIEaqQ5M63r
-            Qu1oFC+yZh2UlkjGxKE6HMlMGn0CnBcTa8XvBaEVMfchVR/2WVq8TQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMdVkyOTRQWEhrSmYzaDNi
+            K2RJMEJHK0JNYkFETXRZN1ZQbHVQeDZmY1VFCjdNdXBWL0ZTZ1RFbFp3TzdkNENu
+            STV3SktsVDBuTVMveFVTZUU3dTROem8KLS0tIHRFU3B4K2lETnRPZDJpd2R3ZVh4
+            eHJEUU1WS2R2TTY0Y0xWY3lzT3FTVncKb6dOw1CM7Z1XzdOfjJug7StgdM2HSYDd
+            wHCqZEF5Fbz/wLLnNdUExyOysw5jjemBStCsy3TNZ1bJOEGE6ST2cQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQWM5dlFCbTIrSXlZYnBw
-            VVQzK1ZiaXpQcTcwQzV5YVV3d1A2L012K1NBCmpXNnNnenNrNTZDUjdXdzNXd2R2
-            T3FSc3BLdUUxWEs2OXlRNEdieXU1bEkKLS0tIFJkU0ZGcjd4bEUyOWFZeHVUMHow
-            dVNTbk41S0VUNndQLzRoZ2ZpVTVqNU0Kp6okYalYtbI1CFuJq/881ZyOVpFoRq0j
-            DvG2E2U+go6XftSaJ59DIUC6rzVBg1JKpJX3TS6SJhe+T+1paoxG/A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0N0paRTJhSk8zak9pYVdk
+            YXFITC9qb2NuM01udUhBL2ZKbGZMUFU2aG1zCkRHVmlVb2lvdVM3c3NMMnNWb2ZX
+            b1VhZjFzTjFxak5vbEJmWW5tSHJoTlUKLS0tIDBmSStwTmtWdVhUc1NtV3E0MTFH
+            bVBqRk94byt5M1Y3LzdhajBhZTZuTlEKCDchRx9INlVgBz80g5FYP8hrMuDlWBHT
+            hN7jLWcbvzJBsVWTOGMaraEKmebSpOuCSakbu9iYE0lKIZa/YbedlA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArYVdXc2hrQ0JFQnF6NFpG
-            UWVMVTN5U0JuQkRxU1ExdUlpWkV4RHlvYUNZCmIzOFI5QnVrMU84VTV6WmcxdjdZ
-            aTZpOWZNdGNoSnJ2c0R2UzJ2cU1TRmMKLS0tIGFxTkxaYjUvaUxsRmhxRmpVeFFD
-            aWt5dnlUYWxoUUlHTjRnWEVBU0NzODQKQ2v9oCbXhUhRnURyHWbAIJHGjgb/eVp1
-            h9Tdld0TWTxxbyN8JkRa80B8JpUVwHgeqJmq2krnhDrYLN9zaugVMQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnU0Z4eklkNUpJVnh5ZkRD
+            YVUrYjlidTRFRy9BRTBnRUFKMXBwcnBxeW5JCkFiK25UTlY0b0FaZ21jUitsSXdB
+            SmM3Sm5FOWFNK1hVbC9VWTk1WHFQQTAKLS0tIDN2a2EraldQRWxzSThGa1AvTVk1
+            eFhPcnlBQW5tVCtBSmtjUU9rS2kwQ3MKwuktSYQpOPyj43kks2XL4Vs++Kdw+FJ6
+            xoZjfxmyUi5dOl+GPB7+AKyAXWUU4eQPcGHDPp7x+FZfa49jvE4aRA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4bFd5OGpvY0YxczdkVnVY
-            ZXExNnY1UXBtb0d4MFNYR3JrMTN1SXhNOUhrCi9xVm1HZDhHZmpEdmdJNVBFcWhv
-            UjI3VDNycEpKdTNnbVU1eVFUeUZuZTAKLS0tIE5GdEJ3Nk1oam9KYUVCMk9CVmpL
-            OCtLcUZwL084TUp0QmpSQXNtSFhHYkUKwGvXXE9AWlrlDgRl2ECCmej7IMztO+fx
-            852Vu610cI9FLv5oghlKM769+/A2QP82KwdxZ4MaRSDvJwXKBi16aw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0T1ZnRFliTE96alg1eDFt
+            dCsvelJHTUxyQUFPemZjbjZOeTRmWTd6ampNCkVTdTdoeGdjcHpzelJDbU1tNWll
+            b1hHTGZSbTVzNWU3YWJ1YmVHU2RKT0EKLS0tIEs1Qm92N1NCZFI1TjR4Z2pxMzZT
+            ZWRCSXpESTNpbnQzU3A3VG1xSE1BeXcKDr35W9phmGfEQtNb7V/f+g4GIcbk/klU
+            +1EJsJ+jK1qCSDgO7omQge5Jx1XqSAg8H+21fnHA4JLhfIeZbntBTQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-16T13:03:12Z"
-    mac: ENC[AES256_GCM,data:cuMHvEjR3nA/LqGHwIGOD+rWwmvg0fPiFtVTDLATKuc0Ulf+0PKogv9cddmXlmqaBOLMkmZue44egEpiLoNm38kEr7gPfP7XKj3kkwL2U4BiS43JEokt5CEq44sSETKylEMEVajgOEwyWn1od4MLxa7xsuhbvGvDpsbvjyPvzh0=,iv:zWFNpOS9cgCs36rdW9FcJ+jG3HrjRmcw2Ogz7QZuyJQ=,tag:L3x6Bsu+7n5A0/Dx0HghkA==,type:str]
+    lastmodified: "2025-08-03T01:35:52Z"
+    mac: ENC[AES256_GCM,data:wQPIW9zRhB6IjK1OQy69Ln+dj6OMNLnNKIzFIhv/vbQ4GllMJ3N/gZjuzMJIumcVND+jEY/qiYnsCFSptStlDYtB3/zHWo1e6It2pM4igtoTP29uiQME0vPJSz0guakZlDMa20mOTN0vVZODEbeBiQNXWtnTbl93R2JVJlZrWcI=,iv:L9Dk5S+hbBO0LTM0irfLuqjLYHzVtY5Tq+Q7m65u6p8=,tag:0GT9IyPeGY5YM6PP/LNs/Q==,type:str]
     pgp:
-        - created_at: "2025-03-16T13:02:45Z"
+        - created_at: "2025-12-01T10:58:24Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA0av/duuklWYAQ/9Ey8zpaRU7DuvVaKTaybgkLCPTKNyq6mKXAusKqC0adMu
-            9G4M8G18uEoo6/Oa1LpJsQneU05EFuStZPaCs9+zxe5ZU2YhcVcDGAHgCDFBbI27
-            7kzUVxA/n5cK61CfIslNYdJolceJeLyH9HSrS3k3eI3V6zEQL9Yz05dDz7Nlma4q
-            AKsnGtLY4og0j2k7HZcK39ikhJGkllZHhsM4RT8/UVeVZF9CxKzwQ2OKbHkhJZyn
-            LGEpioYAKuIIWm/20y/DQwIYpAilltWkg+RWQUnYeAINAZKSzFNi9vd3N4n6e41t
-            ikq8Ukpjbesy42w0ju9sbNWayga14OG5STg/qacrCDjp+wY55VJCcEEM/6kPj1rf
-            e2dBR+eN8VMgcPOlexOf1pkrVhNqz9eDfEfaEtDbFDIgznt0pmLeeYcL3NBa5+Xf
-            vpGXG3fmgoXvQYW05yY4efBRiex9f70lbhnnngeY9ZbmSpy3ZuzIKq8RgBxy1ve+
-            4B6RYC2Ag8Tndj1xYfHcrqSNfmxq+xNieFV49PMGDO1hjJF++VASqPuRtX9lz3tZ
-            Y7E7VPtTESaxEp9IuUgLYYnvSHh1SNIRl3OtcctL+bwbF2wNk5iBha+jC/aXNRU/
-            PoRv1y+G+0R6aV3hLJjoC+Hrm2JX3FIksk64LRDM9mSI7Yl7MfEFrIzcH4HEzlTS
-            XAHugaMjpRCntUxlaP2tq4jlrv+PQLh7+uBzzbhLBK6qSjybKiqHBKeluxfYVsDs
-            rJJicnclRfI1eJPfZDlCr2iggd+2ABYG7uINQVrZYuw2dfb4IvvrqCQz/fBy
-            =Qb5k
+            hQIMA0av/duuklWYAQ//TluENVomEd/KwhRiN54IeFeknRyVGWqkTMm2bCV3BGs5
+            1ehbfO+9djAXfDeOfq+66XUWOjKs1arhrv2MeQdxhuJ7Ywa73UGMGSMi+sEobTXv
+            w6iYRxJpzCkcpqhmX3L/FbXDWOVBzJv9Y5itc6sn8/0JXk9CHfZU8CfDB1U9A2H9
+            oRlCT4bTRsAfLirZLZss389zjtV+84cJ+zCnekEZD0pS+wcoo8MICPW3DkFBM76a
+            EJLe8Asx3xlaxht5uxEpWrBseaBfKLEXTgtDW8MZYM7A50aDEvSJ8zolWBH1GTX/
+            6kCvKyTRqbm+mEQ08fktNJW5hd1799+XH9U9gOPP7fme79H98cMrFMNk4cTV8p9I
+            5W3RXROwgnlRdVQIHj6lfkOP+kx7YYrL7UqtKPj3vIVpNeAXEvx0RpnIjJGqOpTP
+            QZWHBUM+UT6QyRTAFsWuNPjo3MwItOfP1WyD0480FKKWFVmwdj8SSk9dsjPhNNv/
+            SiYzJ2elr3/i1R7jf4PqaxSDRjyC1JMmRtKxhhklNi1tIvb1xf2H6EGJLYZpNAxA
+            14q8A9i0GUSaxD2xMaQeF7eVmgMyhcHxNHBydCG8mzP9xuPmOlpkYRBNuB2EBDyd
+            77gGy6xad7KEu4sGaheB/XbHzFSAw6Yet/bvafP3+jKimPP1OsmKhkat/NuueGLS
+            XAGt64/PXo8iDY6iPOifElmFEbepxMaE20Xp1GbF2P5acvBp7v3uDeB4cwUU27QV
+            lTX8wlmKIH3m3nCwk20CBuEnGD1j+/eviUu91Pkz7VAgZrRxOJnPQ3qhH7v5
+            =fg2d
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.10.2

secrets/lupine/lupine.yaml

@@ -0,0 +1,124 @@
+gitea:
+    runners:
+        lupine-1: ENC[AES256_GCM,data:x8uPQSPid/dJkR/OrYOX9qrCyWTrAj2mRT/B/rSMgYyaI70+8I/l6w==,iv:Kx90gGKAscNXW3RUI5+xH5IcYnyNHtvzCakyd6TLUUA=,tag:esgEMeN+n6cgocMvV9XIuQ==,type:str]
+        lupine-2: ENC[AES256_GCM,data:yNdtPGHuIJoCIJJPt7/iDwG3cgYcmkTLHUGNbWSYEtAbmh14jAjnQQ==,iv:ffcuL9ivs2Mag9Q+foHG2hS4IWWBwGyrZXXdiZV64hs=,tag:/27xqi65VqBz5Sw/fekN/Q==,type:str]
+        lupine-3: ENC[AES256_GCM,data:STJw6hmlOFcy14nfev+E9nin+WJzxAgGwV4IKIVuoqjF7rIqniY4MQ==,iv:+72Qro4naAzdqXvCGi7utHVkT1xeyQkXktahpOTpRjQ=,tag:R66yUHSOT/czhlNcTPXRtg==,type:str]
+        lupine-4: ENC[AES256_GCM,data:5Yw/iv2P1WxarZbRuT7XjxZfdYI9msOBJrl5l4XusivX+BOq95hcSw==,iv:TY9K+8NCCof6oq1CI1E8h3GeF4oJM1KgF5+cufXIfdg=,tag:Cd6+hgxfClsQAlsS+cZTjQ==,type:str]
+        lupine-5: ENC[AES256_GCM,data:+PYUtLBx9MdIebR0nWSNGKKCyKcGpI62BXj7AN1iV4wU4+2awrWZ2Q==,iv:PALEU/sYebhPTO4ZXEm2uV6z9hN678ZxqOSnaHVlyro=,tag:Enb08N6TYlOh+x70pcpJYA==,type:str]
+sops:
+    age:
+        - recipient: age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVlBuRVBBRFVndWV4L3ZJ
+            eE1qWEZWdUpRd1pOQ3VjVExEQjFWcCtmdkM4CmZyQVJWTEw3NnFGeHcxZjRta3ox
+            eTVaNmZ4WC9wTVpYeGpLNHpXbStteUUKLS0tIFZTL3BNZFR5YVNDZE1zKzJLZWNM
+            UkJyek9tcWdwejVqR3hzSDFiaW1zdDgKNqzd1dNco9Ynys03GNOpuKmL9Kyea2Ko
+            xzsDBG08XQc9wpAcjTzXbqujhVvLQJi3IOSUQW4LOAx3BxTsZBHaQw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTnFTSUlSWE9vNmc3Ui9p
+            MFJsNnU5MzdaRGdoMUNlSW5qVi95Z3pFTG5jClBRRXNabUZWKy8xTmVpYllXT0d1
+            a25zY1BmQW5VdTRrT2l0Q3VqSmFYL2cKLS0tIGVvK1luSWNsVnBBd3N3L2Z1VlY1
+            WThsUEhIUE0wV01XR1dMS08vQW1oNDQKRu2REcJeR2vTbbiU8Mt7aVjCgpT33lUg
+            N+UW2oYPh8G+DmLLy203+WeyktuAZR1+b+1pyeaF0O3SWNvgxnyMLw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVT0JmS2FPbE4xMU5MbHdt
+            cktSSitNU21XblBXWldPR3hsam5rYXF0Q0Y4CnkyWnk4K0VndG1WRndMUm00azls
+            aURrbFh0MWlwUGQ4ajZoNXRubFQ1R2MKLS0tIGtlcGwrQzNEc3Y5cTNuSHplZFRV
+            SnhzRFIycVdSaTh2OWRmVDJDWmltemsKc1M2gWp+RQ1LYPI3u3Z+qqPLhB/2vQtZ
+            HieQVRYITLdZ73RKn7jhgvu8cGNdvhkWRNFBcsZ7JsqW1FQ3qs9wLw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNHlSbmRyejljUzc0VFdZ
+            VW9SV1E1ZGREZWZ6bUMvYWExR3FIUTB2NUNRCnFmdUtjUjJiUHRQbG1vZDB5S0xq
+            bDVkai9EdW5IUjE1alBiL2JST2dTblUKLS0tIE56SFhxU2IvNmFxS0YzYUNnQTFv
+            M09tSCtCVTlndkNZSWtQc1lrV3FxeTgKfgJuAE34QcFnnL1/MajJU9Kv2ygDhHlA
+            LVlfRAfrNsJf4JGus8VuADbsSPpvGJMJMq6UAY10FbMO7KfNaIVA6w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVVQzRG5ySzNLb2xvMTAw
+            K2RORGxzVU1YWnFteVZadTdTU3BVZW04VWg4CjNBMHFwUmpSaEs2S3ZneFhBNVBO
+            ZHVaTXQrQVBQaHZhT3RiNVJ5QVV3VGsKLS0tIDFTSGNuVFpsK0txeENkQjI0cXpZ
+            NFF0VHl2V2NSNzN5L3FhcUZwR2RjanMKKLZVnAGuv1tcAUzFabvgf0i5N4Jtyujm
+            /oYMZHJy0nETeSpDb/tCEwFThQoEY/qdEmvbg4FOOVZH6tfV0nLnuA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6NDJ3WUEyZmJIdGxhcmkv
+            M0VSK3NCZ2FVRTB6RnlSZlVXRUNzR0xpZHpJCkJZVXlXbUhEZHI0MlhMK0FtUlhU
+            ZmZBZXdpTURWQTZEWGgrQ0c2RG1JQVUKLS0tIFhkaGxGVVV4NzBKOU5PVURnWmwz
+            MFBiNUtvakhISUR4SjJ3OWhSeUVsT0UKJbo5zlvD17GYTlRzkNCC7zCCCWSyKRUg
+            IChEvMpUKNgYA1xKHOwfPuXuZ4RtcJq/ra4GeVD4OmIGrnXpPWah8A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGemlWOHMwR0RFRGk3alN5
+            ek9idytadU1NeEtzUmpyNnNFM2hZek80S1dBCkxYeEtDdlRac1hvcjZZVEdqY3BR
+            Ynp5MlBycW9MSGlnMWx3QldTZzZ6cDgKLS0tIGNweEh0cDhOZHZvY2RUYXVJMTcy
+            S1J5Ujd6Y1gxTExuVzhaZ1UwazhHd0EKAgDI4cNTj2txorTKKwwQIAvgUPRaMlzU
+            4j/JTrNjlFLQrxdigAY0toJfX8ByWWOGMLWm5G7knAi9zR/KH95wNg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQys4dFZDZ2pnQ1ZlWUc5
+            YmtJNk1VZGExNDk3VTJ3V0ZDcjdOTFZkQ1dNCjVESFFjb09PWG94eU9BQWFDMEg0
+            SHZXU1Fla252eGtNbFk1OFE0T2R6ZlEKLS0tIEIybTFFWGp2T2NiWHFMdlVkVWkw
+            bjFkSTR2OWNCV2NadGZJSmxxUG9FVW8KTeF00gXMc9ws3QbvHXvRIIDa3KCYh5/H
+            5mdUFmOBO1JYrab6M5HRVF9DovyMMM7IrBBL8KOtxUk3UeOpijZioA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdGZQZDBPUmFMK2JhNE9G
+            d0gweTV0b3lRNkQyRTlHYWtrZ3lwSzlMM3kwCmRPTUN4WTEydy91ZDQxNkkyelhH
+            UEFsd1ZRQUc3emg5Qk50Z2xSZzZjNlUKLS0tIFVsNWs4Und6bjgxZWt0ZllwRTlk
+            SzJ0YlIrK0Jlazkzc3F5U3dXT3dIcG8KkaqYMrJqDGlLN+JwvnJfcGJt1ot+X7ep
+            8st2H2uwLo8groSw1bEnwJhoqaBgu5dBFUCKhSbHMYVIfT7M0JHPGw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZUtqMHgrakhhQ3k3dCtN
+            T3cranZIVFdLRWJlOWMzaDF0NTZCM3poWFFjCkY4TFdmOXdwK1pLcWQzWENTNHR4
+            TkpWNEt4VTdWUG5XdzEwOXY1ZzVsbFEKLS0tIC9RR1MvdmJoYlFiMWM4TUEzNHNv
+            RjQxS2g4QStNeXpKcmFqK21MNGdvM3MKOCnDVWJa5F1Vss2D7l7GMq1xCNurjfRz
+            vvK8S091itHZVy6wamTz2/jAj7YYXDjSu0V1sKPOLdThKNZZcBe1hw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-04T05:53:51Z"
+    mac: ENC[AES256_GCM,data:o55keAaJEXVOAGvoMp8FWvtlxMgfF/qR50FGnNM1whYz+5+naRJ1dAOW9NKYHWbtOa/ZXEMTkjoFrTJidAaIXza1Ot8llbTGYh56fsnu0FKZfVM+rvecRDhXKWxiAqyiLUvtUfA2fSg9LGveh2U+0dulcU25sb3Wf0RcFrtM3xI=,iv:3/UllekmGIaluv8y8I6Azd/52dJzk+C5ah6XLJj7Zik=,tag:T5ILXiC5hK++0jGOnHCMYA==,type:str]
+    pgp:
+        - created_at: "2025-12-01T10:58:24Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYARAAmW8iNyzlWC9aeHxLSs3OuZza2Sxmmm+RbtA/n1X2M/iI
+            FeQsvO4m+HB0Y6H7cy8hjyJHa/kGwL4kenDCF+unqJCfF6XQQm+S740+uWndFVFi
+            u02svjncMnGTTrkxazj90ULASXxT0Z5Z+2heCkuQe/spfX+qVJVa5RvzTPBj/Bjm
+            k2NafAW0cfM5MyyeVkF1Rei1LJ860b442vUMpNmU1Av+fbgIyG4f/LEswv/upJWX
+            UdNFvU5yW98FXvUDP6ThJRg6OJqN1ZIYix2UJ6OakUuJN51sywVO4LBZmdsJ21SY
+            cdEjyi+vvAoOsBD2jX+64KzvzoSHkV2MWcez19ZMPguaCwNU9wmrdGD/vVKq8WOl
+            Zs/0BOnOCJ0nEbprzCUCE+RtRZxkKUYmDKYxbu70FSsHWCnRyybKsj7CVak59EZE
+            Ok7IuK6mQ0HT00FQfOCy4ZytgTQSB2fXEGyZsVv65RDdorfapAkwMM1TYVc4j2mD
+            ImoY85xMo/E/KwfAhzL2E2lJLXpAamvBj86RcNW/FEytEEI+l5CIZr6l6UDSDO+W
+            ETYbNcqK8utLTmH539czbXGZ9Cid8i0+QyLtZ8ApHn7s1FsFOAzMpxMyKPYKRSnA
+            VospnGQ3TbdPbbOfVHQvD32iaGw8idP1xb3XNXelD0RZ9OuVxHGELO7re7n/G2jS
+            XgEOiTCRtyQONpfIiii1s7613OfbliWWe5ufhnm0Qsr6Om7jSsm3JfLkSmd/alxf
+            cEk3MFResmtancl1D/2sGhM1ROR6huUChxtgGmz6ZdE2sb8JIXtQOFHzfRw9xo4=
+            =3liy
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

secrets/ustetind/ustetind.yaml

@@ -4,86 +4,82 @@ gitea:
         beta: ENC[AES256_GCM,data:HmdjBvW8eO5MkzXf7KEzSNQAptF/RKN8Bh03Ru7Ru/Ky+eJJtk91aqSSIjFa+Q==,iv:Hz9HE3U6CFfZFcPmYMd6wSzZkSvszt92L2gV+pUlMis=,tag:LG3NfsS7B1EdRFvnP3XESQ==,type:str]
         epsilon: ENC[AES256_GCM,data:wfGxwWwDzb6AJaFnxe/93WNZGtuTpCkLci/Cc5MTCTKJz6XlNuy3m/1Xsnw0hA==,iv:I6Zl+4BBAUTXym2qUlFfdnoLTHShu+VyxPMjRlFzMis=,tag:jjTyZs1Nzqlhjd8rAldxDw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIYVl6ZnI5TkhxK0JKNnlL
-            WE5YZUZ2T1JEbCtvSVUxemZ1QUs4R2pjMWc0ClJ0cnU0c0d5bU5jWU1aVGd6WE45
-            Wm9OT0xPaTJ3Y2kxMU5RTHdRKy81b2sKLS0tIEx4SkFoV240VUJieWFlc3hRWU1Y
-            SWlwZnNOT3paRHRsTC9CQUp5SlBvTncKdcMI8pWtsfBpgeUagOmZUXIC6svkfmwE
-            QF3GpWZgeVvo8e2oT2kBjerCDlUlzd0jJ8aK+B56xifTm7ii3oCAIA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBTG0xUXQ2OTJDVnVtb2xp
+            M2NEaENPUDJvL1Y5QWtaQ1lQaTBRRzd4bmh3CkdZd3V4bzFJZHAvWVVNVGhZdzhn
+            WTBoSmUzbUs5azZHZzIwVWtSSGFtNTAKLS0tIDFFb2lBbkdBRW4wZ0RkYTBsMDJj
+            TWlNa25udytHRkR4RW92TmRCRkxPR00KXf2XPR/+16GpNdIfaa1biMFSFJ48UIC8
+            5+MLAu+2I/NROLKmg3tOfsxQ2xnlF4FGRdmMuxaeKTZGD580sYiQ6Q==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+        - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3QVBaQWlSZk43dEtHVWF1
-            WmFBcmx3eFUvU2lrd0RCUGx3a2hDWHEzTUR3Cm9BclM3OU9SUnpySDZJZHRudmtO
-            Ulp5OEZvZmMyRGJvQXJnUDVLdVRJUVkKLS0tIHE3M3MycE9pU1huYUREN3luWEZV
-            WlNuN3BWeHhqL1dEOUJBSVNTaVJ3eTgKb5MRfeaay22PI9V5hni5mhnb0QF8PG8H
-            bKWbc2SwdMNolrxhUiiIhdppEtXGHqLyBel786tuOdtEwVcy+m/rtA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWZVFmMFZWeDBCS0dta3pR
+            czJYV0ZhRmpMWVIvYVFEK2tVbHc3WENhTEhVCnpYSjIxZWtFcEc3ZHFVaDZmM1BD
+            aGNIWnp0aDVjeXZPdkdLdE40UjZNV28KLS0tIDg1Y3dYU3ZDWU50NlBoaWc4VUVx
+            dUk3VG9ZeWVmY1VwWGViUVU2dEtnb2cKo5sHSm3HQNOYlyYirZ1oMz/InAT0QT7x
+            8aYL0afUQ/D++gvX7tGDbBgIkO1Zud+KiKO9CGqz1Wn9krFL20cjJA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQaDB6enozMFpqcWxFdU93
-            MEg5RTRzZExzWGppenlBTlZZRlpqWDBPT0UwCnhOaXI5R3Jrd0hWY0xqc1VXaDJZ
-            TUxwSTZDcHd0bnZPR2N2d0JVTUJONnMKLS0tIENzOW9PM0tQSndVNmF1bTZ4anpw
-            b1RzL0NEOWg0dGZUa0Jpd3hiTlRGSm8KleRV5c/Xoe0B1VtnR3y0sgXpmhMS8pKl
-            TWaAQTRlM9X2Pk5M/J/bu369ncmw/kycJKjK6W1yluaGwBNuEP+K4Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVdWxWTlFJSnA3VHljM0Ix
+            SVN5aGdaREJEYjVWNWNUOWdGT2lDUklMZXlvCjNKaHBweDVpdUhuNlluUERzVDdq
+            eVc2RlFKR1dHdGFDb2dRcGl0TDNqRGsKLS0tIDQzTFpYUk5LaTlPZUxxNHVZd0o4
+            dzNCbzdkdC9DNDFYZjVPSjNVd3ErbWcKkJcjk/4zy458WLyOs+NTXbrQ3EkxCBVH
+            bX3+b5yH2YGyvTS2vHnCEY7Zis7KhuxAAIrdLobzKlwLf8LB+p14XQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0N1JvRVE0Y0xOMERMVXdB
-            enZiNk1DZTJTUnluRVBIWm9WNmFPc21rU0FZCjBIeHErSHgveFFFdk9ybWwrRXZG
-            WGpVcHliUW9Qb3dLb2Q0aWlrZmpiVm8KLS0tIG0wcXJVK2dMeG9NUTFQSzVtY2RG
-            UE1FS3MvSXlxdEtJVWxJVDRFSkRmQkkK/2z7Lu6LVd6RLZAXKs+JsPc+1kcqFAET
-            0zlTTTU0goTBLuXZ7uxFVZtqc1Nmoarf5Ksm/zcZ2B80P5ox9CzcWQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBydmhTM1Mrc1dpWkE4M09s
+            MitqYjJuY0UwVVlITFRlTDB6UUFtdis5bFc0CjNIQURZaURwTEllQTVoZUZiS3BG
+            blM5Y1F6VE5HZXBuNVFlNGtHaXJPem8KLS0tIGFUQ3JHb0dVVllIMlVnY2pZMFZE
+            TU84Tkp3OWxoY1o0LzAvc3BrcXdyME0KyTv0mHUi9voKj0ZTXZ6CEkouTdupYl+F
+            /wLMQn1h4D6Jl3kxh12h4yACLCE9mOAM9wuylzOf/MpbDLbakymWew==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4SFpKcVBTTlp3SXhVaGQy
-            QVVEV3h6dTZVcmx6aFc1eHF4UzJPbXQ2RnhvCkZiOEYydWhCYUtwcUdieGpBeTZh
-            Z3dYVno5bFNkOUszNHBJNTdQWS9jUTQKLS0tIEhPVEdLK0RaclVvdklFNUJCcHNi
-            OXVobVJCTjhQZ2RTQ21xK2dUY0h5RGcKcPBgD5FIWuyQBhmPt5aqrWgEG1tzhtr0
-            gVyLxgtMFGeeShjdpivgcWI/GZZlhWJilJOoZo7f6TknvCIIKsrUSA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4ek5lZTdFK0ROYUNUeEtp
+            bHVhWUF6VkdEUWpUL0ltWW54dFg1Q2wxckZvCi9OYllUN2xnL1dEMlE0RVkrbEMw
+            dTd1SS8wQnhrdm1peWRMbVI4YXBzbnMKLS0tIFFIcVlIcWpxT2RPSlR0dzh3UHZ3
+            LzZLaDdMZlAzV0hBTHpWb1cwNElpUEEKrgfWuu6RKq9dolGP00CiGZsZ0me20PCX
+            NKHY/eQ2RGF6YLF35v3rBGuH73d2cqmCh/6d0DELX+F/nzOi+ZWb1Q==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWlhiS1dxekZGZkRCQU9O
-            SktHRHRXL2VhNUJSRVhBeEM5UEZ1R0pFdXdrCnZQOUZaYitpSlJ0aXFpZXFrRFJj
-            MmZiLytvekZtVXYzamJDakc1RjdIREEKLS0tICtiOTZMRGZuWEdHTmZwRjZ2dUNT
-            aU4xWjVYYlNvSmYxajVGdzk5dTQ4WG8Klq12bSegsW29xp4qteuCB5Tzis6EhVCk
-            53jqtYe5UG9MjFVQYiSi2jJz5/dxfqSINMZ/Y/EB5LxbwgbFws8Yuw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuUkxPN0VIWUNydmJPRmZW
+            V0o3UmZGYkd2NktMdlc0dlpjS0htL24yVVN3ClVjbEViV25ibEwxb3c0TlNOSDB5
+            SjlvNUpSZGpnU3R2aGVIaExBby9qYkEKLS0tIGtJNCtaOGw4OUQrc2JxZExnUHA1
+            bjBzby9HZjFKc2lEMzVLUGxJTndrSzQK7iOGVTi6XuodwBargQ7fUl2gtqIMEnL4
+            Ql0K8J2F2qXtk7/wMHxFAIxwDP5KS5O8uLFjcmOTdGJeAal7Cvv1hQ==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2024-12-12T12:20:19Z"
     mac: ENC[AES256_GCM,data:D9/NAd/zrF6pHFdZjTUqI+u4WiwJqt0w5Y+SYCS1o/dAXJE/ajHzse/vCSGXZIjP0yqe+S/NyTvhf+stw2B4dk6Njtabjd+PhG0hR4L0X07FtFqzB3u5pLHCb0bH9QLG5zWcyMkwNiNTCvhRUZzbcqLEGqqJ7ZjZAEUfYSR+Jls=,iv:5xPfODPxtQjgbl8delUHsmhD0TI2gHjrxpHV+qiFE00=,tag:HHLo5G8jhy/sKB3R+sKmwQ==,type:str]
     pgp:
-        - created_at: "2024-12-09T21:17:27Z"
+        - created_at: "2025-12-01T10:58:25Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA0av/duuklWYARAAv2XS2jzoymOzpRHquUbYpUtbIeKXhPS8i9uk2zBvSKnr
-            b/jZCpvtkCcSz1UFm+HzSn/i1eNkj9ghObisifvqY6JbO0DIa1jFlx1TfE9pj8dE
-            rrNTsYfxNwdGOvklPBHm3vKY5qPiGlE71TaKkJcO79vE5jxwhUqzWI9SWAZY3cFw
-            IVJN44DT0I4ctTlwPM9eAYYodL8QP8OMXHJ/mjI4SPODRsvrOyy6rpip40Q+dU/N
-            DwRupzrRlxJ8BDSh/x6J/AryZSwkmChX9cYyGaDknJ3ONQ0XLhVUtLkAvPWtWeow
-            6NVHmUOJ39ockT1clhYy2P5rQTraZESuI7vaSS9zVIuScBnJwbSRZ5xgxSD6Fj+C
-            Y/JyogXa8FtyG6xeMgIwW7t/m/rbXL5OkP4w8D+CJs+4I55WXz054XOZ937EisVH
-            XAlNBIHixjQVckbb+sS7rEmegfoC+rvOXA0irpwXFiapAbMGUePCwQHdSBMP8orC
-            Tb3E8kqHATN40b8CpUBcPw6HCQKmbhe8o+R8NG6TZh6JH7kSztl2+SIIuMzhDflr
-            1AphY047Ku2RANaWfo+xyVZMWgAQcnoaUOeYaHJ9nZ7f2klJ3fnRtdXJn1gcO3i3
-            NZVRjjYHJgzCVCIZJa1b1TMGep84naF7NmRkNlS4wyv6MXGqSpHHZUGUBAQOCMPS
-            XAEqjZt8va0LKtsPsBOTGQDuzTar+2069fu6TjS07mJM2sTp/G8bGBnvjc0TIplZ
-            M5FOiCilI9yX7vQ0O3LUKJW5zELWnW2d+3okpGjgkr0BFERtM7BMCp6nxR6+
-            =rEY5
+            hQIMA0av/duuklWYAQ/+NLY+1iw6BqMfPzgcoiR3i7e/8G6MVP91zGjoUx3D6rGQ
+            EhUrdz6xdRY5KnqC2Wt7BJLO4jl/pvKo+w530Ik3wEzXiaZg1AGiUjUi4JhqueUi
+            EQk41mWYifS6nd9T84x8C6luAUjxYXmZDpIY1/lRDEeh4GG9qE4v32f/66+nxFdV
+            icblN90D7Rz6KTinX7RWVYRXHd3Te74NHhzOTPYkouxwnwvFiS2qN4k+7oIKl3+S
+            OyYKeaAVSc3+nfVxuphNlVvl8ih9/f2tWz8XTPu7ohtck9T//5PXawvR51cateXe
+            2A9HNgefysd90XyCozQ8N7uunZsUKxgngqPhzgP2f0FRYeNWqrIOUWjrmI7nYg+A
+            w7Z7TRQwVzptVUAe+v9WfWkWBYFreb3NlbfEQfEC0xAAFQ5TPqL66PlXXMJqyBhN
+            wWhBY50ETDBvhCv2hTghiRy9tczAgyBKoPr2yZNctqyNTuJlaql4o5LT6RTHusK+
+            vUGGYY/qj9XwrcQBi+bRr/Q9zHHjXowwKPr1/UVbdVa6ntMMjUL1D+T26QPhTT2Q
+            7gT57JmXLJKk85MUGyAG3y4TNNdCbxH096kb1Z1O7VwHZfQDNoYXhPXGhYvnz/4q
+            YWHnYLLApuGN6apqETbE8xizKkUR4k0ReXCjHNvsky/nf30k4iUetDeGBwLJRjzS
+            XAGCykcK7VviDM7YOMlXIbeUBK3Rb2rGsgkBby/cPiNh3zS8HzqOti2vn7ioLMbJ
+            Peic2r2TAUUp/aVmU34YqREi071fKpL0zho75IJ2ZtavDOYmDPopEiluIVuV
+            =JCHR
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted

shell.nix

@@ -5,6 +5,7 @@ pkgs.mkShellNoCC {
     jq
     gum
     sops
+    ssh-to-age
     gnupg
     statix
     openstackclient

users/albertba.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  users.users.albertba = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "drift" "nix-builder-users" ];
+
+    packages = with pkgs; [
+      htop
+      neovim
+      ripgrep
+      fd
+      tmux
+    ];
+
+    shell = pkgs.zsh;
+
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICheSCAxsYc/6g8hq2lXXHoUWPjWvntzzTA7OhG8waMN albert@Arch"
+    ];
+  };
+
+}
+

users/oysteikt.nix

@@ -13,7 +13,6 @@
       bottom
       eza
       neovim
-      diskonaut
       ripgrep
       tmux
     ];

users/vegardbm.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+{
+  users.users.vegardbm = {
+    isNormalUser = true;
+    description = "noe";
+    extraGroups = [
+      "wheel"
+      "drift"
+      "nix-builder-users"
+    ];
+    packages = with pkgs; [
+      btop
+      eza
+      neovim
+      ripgrep
+      tmux
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVA3HqEx3je6L1AC+bP8sTxu3ZTKvTCR0npCyOVAYK5 vbm@arch-xeon"
+    ];
+  };
+}

values.nix

@@ -41,10 +41,6 @@ in rec {
       ipv4 = pvv-ipv4 209;
       ipv6 = pvv-ipv6 209;
     };
-    bob = {
-      ipv4 = "129.241.152.254";
-      # ipv6 = ;
-    };
     knutsen = {
       ipv4 = pvv-ipv4 191;
     };
@@ -72,6 +68,26 @@ in rec {
       ipv4 = pvv-ipv4 240;
       ipv6 = pvv-ipv6 240;
     };
+    lupine-1 = {
+      ipv4 = pvv-ipv4 224;
+      ipv6 = pvv-ipv6 224;
+    };
+    lupine-2 = {
+      ipv4 = pvv-ipv4 225;
+      ipv6 = pvv-ipv6 225;
+    };
+    lupine-3 = {
+      ipv4 = pvv-ipv4 226;
+      ipv6 = pvv-ipv6 226;
+    };
+    lupine-4 = {
+      ipv4 = pvv-ipv4 227;
+      ipv6 = pvv-ipv6 227;
+    };
+    lupine-5 = {
+      ipv4 = pvv-ipv4 228;
+      ipv6 = pvv-ipv6 228;
+    };
   };
 
   defaultNetworkConfig = {