From 70d8a0e941e7d126c9d910a01166b07c8f58c044 Mon Sep 17 00:00:00 2001
From: Noratrieb <48135649+Noratrieb@users.noreply.github.com>
Date: Sun, 31 May 2026 13:22:40 +0200
Subject: [PATCH] gaming

---
 nix/deploy/smoke-tests.sh                     |  16 +++-
 nix/hive.nix                                  |   8 +-
 nix/modules/caddy-acme-dns/default.nix        |  13 +++
 nix/modules/caddy-base/default.nix            |   3 +-
 nix/modules/caddy/default.nix                 |  18 ----
 nix/modules/dns/default.nix                   |  85 ++++++++++--------
 nix/modules/dns/nilstrieb.dev.nix             |   5 +-
 .../dns/noratrieb-acme-delegate.dev.nix       |  39 ++++++++
 nix/modules/dns/noratrieb.dev.nix             |  13 ++-
 nix/modules/home-assistant/default.nix        |  26 ++++++
 nix/modules/immich/default.nix                |  10 ++-
 nix/modules/paperless/default.nix             |  10 ++-
 nix/secrets/backup_s3_secret.age              |  25 +++---
 nix/secrets/caddy_s3_key_secret.age           | Bin 904 -> 904 bytes
 nix/secrets/docker_registry_password.age      |   8 +-
 nix/secrets/does_it_build_private_key.age     | Bin 1916 -> 1916 bytes
 nix/secrets/forgejo_s3_key_secret.age         |   9 +-
 nix/secrets/garage_secrets.age                |  25 +++---
 nix/secrets/generic_backup_password.age       |  25 +++---
 nix/secrets/grafana_admin_password.age        | Bin 282 -> 282 bytes
 nix/secrets/hugochat_db_password.age          | Bin 339 -> 339 bytes
 nix/secrets/immich_secrets.age                |   9 +-
 nix/secrets/killua_env.age                    | Bin 293 -> 293 bytes
 .../knot_dns_acme_dns_01_key_config.age       |   7 ++
 .../knot_dns_acme_dns_01_key_envvar.age       |   7 ++
 nix/secrets/knot_dns_rfc2136_key_config.age   | Bin 434 -> 0 bytes
 nix/secrets/knot_dns_rfc2136_key_envvar.age   |  13 ---
 nix/secrets/loki_env.age                      |   8 +-
 nix/secrets/minio_env_file.age                | Bin 397 -> 397 bytes
 nix/secrets/openolat_db_password.age          | Bin 321 -> 321 bytes
 nix/secrets/paperless_env.age                 | Bin 340 -> 340 bytes
 nix/secrets/pyroscope_s3_secret.age           | Bin 336 -> 336 bytes
 nix/secrets/registry_htpasswd.age             |  10 ++-
 nix/secrets/registry_s3_key_secret.age        | Bin 364 -> 364 bytes
 nix/secrets/restic_backup.age                 | Bin 784 -> 784 bytes
 nix/secrets/s3_mc_admin_client.age            | Bin 912 -> 912 bytes
 nix/secrets/secrets.nix                       |   4 +-
 nix/secrets/upload_files_s3_secret.age        | Bin 474 -> 474 bytes
 nix/secrets/website_s3_key_write.age          | Bin 344 -> 344 bytes
 nix/secrets/wg_private_dns1.age               |   9 +-
 nix/secrets/wg_private_dns2.age               | Bin 256 -> 256 bytes
 nix/secrets/wg_private_minipc.age             |  11 ++-
 nix/secrets/wg_private_vps1.age               | Bin 257 -> 257 bytes
 nix/secrets/wg_private_vps2.age               |   8 +-
 nix/secrets/wg_private_vps3.age               | Bin 257 -> 257 bytes
 nix/secrets/wg_private_vps4.age               | Bin 256 -> 256 bytes
 nix/secrets/wg_private_vps5.age               |   8 +-
 nix/secrets/widetom_bot_token.age             |   9 +-
 nix/secrets/widetom_config_toml.age           | Bin 4006 -> 4006 bytes
 .../knot_dns_acme_dns_01_key_config           | Bin 0 -> 201 bytes
 .../knot_dns_acme_dns_01_key_envvar           | Bin 0 -> 89 bytes
 secrets-git-crypt/knot_dns_rfc2136_key_config | Bin 134 -> 0 bytes
 secrets-git-crypt/knot_dns_rfc2136_key_envvar | Bin 67 -> 0 bytes
 53 files changed, 273 insertions(+), 168 deletions(-)
 create mode 100644 nix/modules/caddy-acme-dns/default.nix
 create mode 100644 nix/modules/dns/noratrieb-acme-delegate.dev.nix
 create mode 100644 nix/modules/home-assistant/default.nix
 create mode 100644 nix/secrets/knot_dns_acme_dns_01_key_config.age
 create mode 100644 nix/secrets/knot_dns_acme_dns_01_key_envvar.age
 delete mode 100644 nix/secrets/knot_dns_rfc2136_key_config.age
 delete mode 100644 nix/secrets/knot_dns_rfc2136_key_envvar.age
 create mode 100644 secrets-git-crypt/knot_dns_acme_dns_01_key_config
 create mode 100644 secrets-git-crypt/knot_dns_acme_dns_01_key_envvar
 delete mode 100644 secrets-git-crypt/knot_dns_rfc2136_key_config
 delete mode 100644 secrets-git-crypt/knot_dns_rfc2136_key_envvar

diff --git a/nix/deploy/smoke-tests.sh b/nix/deploy/smoke-tests.sh
index 5054a61..d2a939c 100755
--- a/nix/deploy/smoke-tests.sh
+++ b/nix/deploy/smoke-tests.sh
@@ -4,20 +4,28 @@
 
 set -eux
 
+check_single_dig_answer() {
+    dns="$1"
+    type="$2"
+    host="$3"
+    grep="$4"
+
+    dig "@$dns.infra.noratrieb.dev" "$type" "$host" +noall +answer | grep "$grep"
+}
+
 check_dig_answer() {
     type="$1"
     host="$2"
     grep="$3"
 
-    dig @dns1.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
-    dig @dns2.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
-
+    check_single_dig_answer "dns1" "$type" "$host" "$grep"
+    check_single_dig_answer "dns2" "$type" "$host" "$grep"
 }
 
 # Check DNS name servers
 check_dig_answer A "dns1.infra.noratrieb.dev" "154.38.163.74"
 
-check_dig_answer A "nilstrieb.dev" "161.97.165.1"
+check_single_dig_answer "dns1" A "nilstrieb.dev" "161.97.165.1"
 
 # Check the NS records. The trailing dot matters!
 check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev."
diff --git a/nix/hive.nix b/nix/hive.nix
index eee6101..347f10a 100644
--- a/nix/hive.nix
+++ b/nix/hive.nix
@@ -24,7 +24,7 @@
             wg = {
               privateIP = "10.0.1.1";
               publicKey = "7jy2q93xYBHG5yKqLmNuMWSuFMnUGWXVuKQ1yMmxoV4=";
-              peers = [ "vps3" ];
+              peers = [ "minipc" "vps3" "vps5" ];
             };
             tags = [ "dns" ];
           };
@@ -88,7 +88,7 @@
             wg = {
               privateIP = "10.0.0.5";
               publicKey = "r1cwt63fcOR+FTqMTUpZdK4/MxpalkDYRHXyy7osWUk=";
-              peers = [ "vps1" "vps2" "vps3" "vps4" ];
+              peers = [ "dns1" "vps1" "vps2" "vps3" "vps4" ];
             };
             tags = [ "apps" ];
           };
@@ -98,7 +98,7 @@
             wg = {
               privateIP = "10.0.2.1";
               publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
-              peers = [ "vps3" ];
+              peers = [ "dns1" "vps3" ];
               noEndpoint = true;
             };
             tags = [ "home" ];
@@ -320,7 +320,9 @@
       ./modules/immich
       ./modules/tailscale
       ./modules/paperless
+      ./modules/home-assistant
       ./modules/caddy-base
+      ./modules/caddy-acme-dns
     ];
 
     system.stateVersion = "25.05";
diff --git a/nix/modules/caddy-acme-dns/default.nix b/nix/modules/caddy-acme-dns/default.nix
new file mode 100644
index 0000000..e5455af
--- /dev/null
+++ b/nix/modules/caddy-acme-dns/default.nix
@@ -0,0 +1,13 @@
+{ config, ... }: {
+  age.secrets.knot_dns_acme_dns_01_key_envvar.file = ../../secrets/knot_dns_acme_dns_01_key_envvar.age;
+  systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.knot_dns_acme_dns_01_key_envvar.path ];
+
+  services.caddy.globalConfig = ''
+    acme_dns rfc2136 {
+      key_name "acme-dns-01"
+      key_alg "hmac-sha256"
+      key "{$CADDY_DNS_RFC2136_KEY}"
+      server "dns1.local:53"
+    }
+  '';
+}
diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix
index a33e7b3..c77a7d5 100644
--- a/nix/modules/caddy-base/default.nix
+++ b/nix/modules/caddy-base/default.nix
@@ -6,7 +6,7 @@ let
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
       "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
-    hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
+    hash = "sha256-EGkboqppRr2xcZ+7ie+WrqdP8sHSoouX4STl4NajMYs=";
   };
 in
 {
@@ -32,6 +32,7 @@ in
       format json
     '';
     globalConfig = ''
+      email tls@noratrieb.dev
       auto_https disable_redirects
 
       servers {
diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix
index bec542b..207821c 100644
--- a/nix/modules/caddy/default.nix
+++ b/nix/modules/caddy/default.nix
@@ -7,9 +7,6 @@
   systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
   services.caddy = {
     globalConfig = ''
-      email tls@noratrieb.dev
-      auto_https disable_redirects
-
       storage s3 {
         host "localhost:3900"
         bucket "caddy-store"
@@ -18,21 +15,6 @@
 
         insecure true
       }
-
-      acme_dns rfc2136 {
-        key_name "test"
-        key_alg "hmac-sha256"
-        key ""
-        server "dns1.local:53"
-      }
-
-      tls {
-        dns_challenge_override_domain "nilstrieb.dev"
-      }
-
-      servers {
-        metrics
-      }
     '';
     virtualHosts = {
       "http://" = {
diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix
index 7d1c858..3970d45 100644
--- a/nix/modules/dns/default.nix
+++ b/nix/modules/dns/default.nix
@@ -1,9 +1,9 @@
-{ pkgs, lib, networkingConfig, config, ... }:
+{ pkgs, lib, networkingConfig, config, name, ... }:
 let metricsPort = 9433; in
 {
-  age.secrets.knot_dns_rfc2136_key_config = {
+  age.secrets.knot_dns_acme_dns_01_key_config = {
     file =
-      ../../secrets/knot_dns_rfc2136_key_config.age;
+      ../../secrets/knot_dns_acme_dns_01_key_config.age;
     owner = "knot";
   };
 
@@ -27,42 +27,57 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
-    keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ];
-    settingsFile = pkgs.writeTextFile {
-      name = "knot.conf";
-      text = ''
-        server:
-            listen: 0.0.0.0@53
-            listen: ::@53
-        
-        key:
-          - id: rfc2136-update
-            algorithm: hmac-sha256
-            secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds=
-        
-        acl:
-          - id: update_acl
-            address: 10.0.0.0/24
-            key: rfc2136-update
-            action: update
-            update-type: [TXT]
+    keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
+    settings = {
+      server.listen = [ "0.0.0.0@53" "::@53" ];
+      acl = [
+        {
+          id = "update_acl";
+          address = "10.0.0.0/16";
+          key = "acme-dns-01";
+          action = "update";
+          update-type = [ "TXT" ];
+        }
+      ];
+      zone = [
+        {
+          domain = "noratrieb.dev";
+          file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
 
-        zone:
-          - domain: noratrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-          - domain: nilstrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-            acl: update_acl
-        log:
-          - target: syslog
-            any: info
-      '';
+      ] ++ (if name == "dns1" then [
+        {
+          domain = "nilstrieb.dev";
+          file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
+        {
+          domain = "noratrieb-acme-delegate.dev";
+          storage = "/var/lib/knot/zones/";
+          file = "noratrieb-acme-delegate.dev.zone";
+          acl = "update_acl";
+        }
+      ] else [ ]);
+      log = [{
+        target = "syslog";
+        any = "info";
+      }];
     };
   };
 
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
+  systemd.services.knot.preStart =
+    lib.mkIf (name == "dns1")
+      (lib.getExe
+        (pkgs.writeShellApplication {
+          name = "knot-prestart.sh";
+          text = ''
+            mkdir -p /var/lib/knot/zones/
+            cp ${
+              import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
+            } /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
+          '';
+        }));
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
   services.prometheus.exporters.knot = {
     enable = true;
     port = metricsPort;
diff --git a/nix/modules/dns/nilstrieb.dev.nix b/nix/modules/dns/nilstrieb.dev.nix
index c013f4f..528fc83 100644
--- a/nix/modules/dns/nilstrieb.dev.nix
+++ b/nix/modules/dns/nilstrieb.dev.nix
@@ -29,14 +29,11 @@ let
       ];
 
       NS = [
-        "ns1.nilstrieb.dev."
-        "ns2.nilstrieb.dev."
+        "ns.nilstrieb.dev."
       ];
 
       subdomains = {
         ns = dns1;
-        ns1 = dns1;
-        ns2 = dns2;
 
         localhost.A = [ (a "127.0.0.1") ];
 
diff --git a/nix/modules/dns/noratrieb-acme-delegate.dev.nix b/nix/modules/dns/noratrieb-acme-delegate.dev.nix
new file mode 100644
index 0000000..cf4308d
--- /dev/null
+++ b/nix/modules/dns/noratrieb-acme-delegate.dev.nix
@@ -0,0 +1,39 @@
+# https://github.com/nix-community/dns.nix
+{ pkgs, lib, networkingConfig, ... }:
+let
+  data = with pkgs.nix-dns.lib.combinators;
+    let
+      hour1 = 3600;
+      hostsToDns = builtins.mapAttrs
+        (name: { publicIPv4, publicIPv6, ... }:
+          lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
+          lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
+        networkingConfig;
+    in
+    with hostsToDns;
+    {
+      TTL = hour1;
+      SOA = {
+        nameServer = "ns.noratrieb-acme-delegate.dev.";
+        adminEmail = "void@noratrieb.dev";
+        serial = 2024072601;
+      };
+
+      CAA = [
+        { issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
+        { issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
+      ];
+
+      NS = [
+        "ns.noratrieb-acme-delegate.dev."
+      ];
+
+      subdomains = {
+        ns = dns1;
+      };
+    };
+in
+pkgs.writeTextFile {
+  name = "noratrieb-acme-delegate.dev.zone";
+  text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
+}
diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix
index 808e0b1..3edc5a5 100644
--- a/nix/modules/dns/noratrieb.dev.nix
+++ b/nix/modules/dns/noratrieb.dev.nix
@@ -97,10 +97,15 @@ let
         infra.subdomains = hostsToDns;
 
         # --- internal stuff
-        internal.subdomains = {
-          immich = minipc;
-          paperless = minipc;
-        };
+        internal.subdomains = builtins.listToAttrs (builtins.map
+          (name: {
+            inherit name;
+            value = minipc // {
+              subdomains = {
+                _acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
+              };
+            };
+          }) [ "immich" "paperless" "home-assistant" ]);
 
         # --- other verification
         _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];
diff --git a/nix/modules/home-assistant/default.nix b/nix/modules/home-assistant/default.nix
new file mode 100644
index 0000000..36e942a
--- /dev/null
+++ b/nix/modules/home-assistant/default.nix
@@ -0,0 +1,26 @@
+{ config, ... }: {
+  services.home-assistant = {
+    enable = true;
+    extraComponents = [
+      # Recommended for fast zlib compression
+      # https://www.home-assistant.io/integrations/isal
+      "isal"
+    ];
+    config = {
+      default_config = { };
+      http = {
+        use_x_forwarded_for = true;
+        trusted_proxies = [ "::1" ];
+      };
+    };
+  };
+
+  services.caddy.virtualHosts."home-assistant.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.home-assistant.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.home-assistant.config.http.server_port}
+    '';
+  };
+}
diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix
index 9d3b52c..97213e6 100644
--- a/nix/modules/immich/default.nix
+++ b/nix/modules/immich/default.nix
@@ -13,7 +13,6 @@
     environment = {
       IMMICH_TELEMETRY_INCLUDE = "all";
     };
-    openFirewall = true;
   };
 
   services.postgresql = {
@@ -30,5 +29,14 @@
     '';
   };
 
+  services.caddy.virtualHosts."immich.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.immich.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.immich.port}
+    '';
+  };
+
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
 }
diff --git a/nix/modules/paperless/default.nix b/nix/modules/paperless/default.nix
index 5cb60cb..bfb6414 100644
--- a/nix/modules/paperless/default.nix
+++ b/nix/modules/paperless/default.nix
@@ -12,6 +12,7 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
       PAPERLESS_TIME_ZONE = "Europe/Zurich";
       PAPERLESS_ADMIN_USER = "nora";
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
+      PAPERLESS_URL = "https://paperless.internal.noratrieb.dev";
     };
     exporter = {
       enable = true;
@@ -20,5 +21,12 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 8010 ];
+  services.caddy.virtualHosts."paperless.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.paperless.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
+    '';
+  };
 }
diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age
index adb5d54..c8828d3 100644
--- a/nix/secrets/backup_s3_secret.age
+++ b/nix/secrets/backup_s3_secret.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 7Skt5gktvb9YK6/irBF/1+75lfq21qcgnVKsFXHm1l0
-L2uk8HCySy14opdPdZqNvHIphuJ8oTGujCWY3NtxvWk
--> ssh-ed25519 91VHug aKHSBKih0l3EhQe0v5SyTQiLEz3W6HgzyUVXAHI6LDg
-zpZ8ENOBTPZWxMlvt43z73Cjip4dZvZDeMO7zOGEtpQ
--> ssh-ed25519 XzACZQ MtKX5scktrEXJe3nPrzFEMdWrdgvR/4btZ+MmuJr+38
-rYoSGq+I3WioIsDeqNFdJjVMs/REnfpKuUhzanT5big
--> ssh-ed25519 51bcvA 9WhV9RBsA199GA4jlTEY+ypVJC/KLBZReJbJW3b8SQI
-HsRsq+n8PvJSa5zQt9knn8yi72wqtb9CZh/SP+y3ozo
--> ssh-ed25519 vT7ExA V4C1cr4CzOTY4WEvdUwr1siAVClIipd2ud+ihs/hkVU
-qbcSyGm1/Ajr/RiQ8IMqLCD9+kZv7o9jP9oXnK4/FUE
---- jFQGrwJAhLPWppCP/nGJUAA7qRkOra8DIgptR+T6IYA
-��>nl��=���{ߪ�,j"0)L�2��M�6�~��.M�ʉ��0m��w��pMh������5�[C��>�96a���M(����'��+Rh�L���.I��h��r������
3��x�qn+K*F/�K��:��n�'iWi���
\ No newline at end of file
+-> ssh-ed25519 qM6TYg 4LRAh4VUnxT4kdbR8IYYH9Y5Gpx0KORJRzBW3HsjGxk
+JJD2Mk2Fb3EmFyqYq7hVD4DZiBLMqTGTRxKy46buAbs
+-> ssh-ed25519 91VHug eq8UIjMBKHOeR8coknHBLZCfGUaCtLlznCk1/iE/exs
+eUIdvYMK1QOcjPg7owZScNFcVkXEJ7B80t3sRk0weP8
+-> ssh-ed25519 XzACZQ a6/9wiA7IeQLHGccQdfvpwowFh5OdKgIqqrqq+qQZUY
+sUsOYDhlv8n8HNj3ZCyhNbfPZWlbvd5haV3ZMBPJGrg
+-> ssh-ed25519 51bcvA 9dbiKUhvYOHt2QhZvOhW4EH/S/OOLx7oACgSUXH0nQc
+Rxq1B9yZLI/LKg/FvNXrL7sZSB12t552k9RBLieIBsk
+-> ssh-ed25519 vT7ExA XWX+UVri3OJrpSXyrWQVvhQ9IQVFpcvopMLetFNoagQ
+WSDbM8LDuMC8RKBzf4I4NffEUGtfPrjPJ0jdrrR5lzQ
+--- bd3tx9uq8j3zhQZ4rAWBuZHgzez6eSRz4O7VcdoJMvM
+�f)��z�͛d�Ta��#��߱�R��hk����hm�],X��FN��$'0K���j�0��V�|k����O)
+"��
�r�&IB�B[5�Sg5꺜Y��8���x���c�`,��ӱ��0W*
���
O[i+F�M�N��_�n ���wǵ
\ No newline at end of file
diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age
index d231b8074bf10fafdcbbe86cf82de726583f9815..e0a51383a54cc91e6823c2be96b01fa287fb56fc 100644
GIT binary patch
delta 816
zcmeBR?_i&xQ?GAg9#xTR;q70ZX{4W+mE)8VnVXZC9^js%9hqxk6c~^ikztWrmhWtk
z&Xr!|<&%>gV3w_)R%IFL9h~l26mAxlQQ@m?=INi8rtjsIp&j5=8sO?*&ZTRoP+Xj$
zo0?)|YHDbyU}+fUQJSvcY-Aj0WSNua=v-#0pBieK=4KL*Vw~cX6{%lf;ae0~Vc}>V
z;o=ckVUcUVWtwm49#ZP<78011rteyz?H-)(=jaiTX6jks?_uO==^W`1tet3_ZRU|Y
z@uPTnvWtg#rjbdMex+}sUs17JZiI`zsd1@ahHqGQa;9-&aYaaEMY6GLevm6ydTvU&
zL6wnfPH0$iNuIN*X^xk3c2%Nha)GC3a)_^fnP-YYLB3a7T3GVrct-K?(87ok{mK$g
zi(GRH7ayafY$HPhzfk{514j$@fRZYUuoQ12Ps4m8%L)^&+^8f21B*<f&~nqj$gHwb
z*StjE%tWW0V!xcwl7b}tAVZ@P{R$s56AO#UXBoxovs2BCd^0@EETf{lbItQ3!xEiC
z-3`pbwF|>a+&wHD12RlY42|{EQ{A$;jLJ;hipm4LqKqO-z4MZ^eezv>^YkrqecXJV
z%FB)YEJ6}<(^8BQOSH4ObaizVB1(&+g42`q9es_m4NOg3N+XQ}+}yIl!}Yxayn=$O
zEKM`&EsTwdb4$I`xt7di5%l#}kX%qxx9U&k5zqC1Cz(xUc-hPm_x>^0{r@2m`D|iL
zwiyhM6n9*zKCO55$EUWQ|0a&EF@fgQ9~aiOoe~yVZ1LxNaZHs*=#ND^4(a#JD>0p#
z9XV4<fAZYB${h0bi$aY{7w>J8xvpzGm+@EO4=&HuE9!e0J|Eolx_#yLZIY`E^?2jY
z#Xq-Q6TLe|-I49>-YPcTSFT5R`{r?2@zyE6oj&7ZLWPUj&*c@JK^DLMR`;BA`^5G1
zW6-i7DOuZ;iQ5jm7vIv@b8X{ubJ>S4CI;30Jr@(+a(C%0kB3#urtG>HD&>9JSo_19
zzh}2xV(#)gyJzXAHg(r&tkeH%gl%9kV?VyF(L3u#)}QqE`3D!|MJ68*{Q26Sc}L^f
HT9*9)-qtsI

delta 816
zcmeBR?_i&xQy-q;;hCIj9%xWnX=LG<oL1uIVUg)<QdnW(6qc4{7+hA6l%8xEn&}i8
z$(3#tRpMUa5}s`w<x`U7<Xx3hkr<I|6yW6Q5tZs;m|75NW|mTHX&8|i$fawiP+Xj$
zo0?)|YHDbyU}+fUQJSt`R8SmQ=olPXkep*^nHCXg=$2%do>rV?<QS~)WKdAz>QNkN
z>6e@9>u3<ll~hvhoa5)77p$$H>z-H|<mBvQmhWL+;#}qt6_%Z)pPz45nx2spk!E5r
z@uPUSS*Ce*u19E@M`nInqE~QeNLZP>VW_!TN`}6xxj{)tXqIV`r%7RDX^;h1X}CwY
ziKnAuRdz&Ter2X#NvVHgQE76STY5oSg-f1ugnw|McV)JDSWx8Tct-K?WFwQTQ0LU#
z#0W?ITmw`8&~nE#k3etBK(Ao$d;?Ga5F;~vx0J*JFC!B!LnkM{$U@)pJa?Z`UxR|&
zT;I$BBj@y#VExR*sH8~G6c=B&Lig|j57XqyXBoxoE!~TZoKl=3GEJPy6N8;SeLPJ)
z90O8~OVf)hN?nUQviyQ7vWmUJ^4-(93PbZE+`WC03ZpFC68()L{CuK9yv#GalOy~?
zO-o$MJ<LmeDqS*)j0=;wbaizVLi0_W{XMe-3Ny+pOwElVvz_yj@+{nQQ<4n=i-Me;
z%v}BI4ZJN}T)YxPxy<X%<`nGdWWBIdXWfmj5ACYF=GZjM^FBZG!(63zr@iJj3G{T#
zSRB&sd@f~Xe8v&?Py8H5p4?ggN6W7*Mt7f8D#wIqJvQeF&)>e@>sfu{jF?Kwa<S;d
zb8R0)5BJ_*RKPxW=QQ>o+q9E7jwO1p_OvOTX216BnRoR&zx+G7aOvMAH=;gyO|G(i
z`F7pHsr^$+;<xmEcUtLs-B&nag@^W&o<{M61D>7VRXV2Hex8|r)k)2F|1`s7^Aj?E
zB@_cLmhI`?=rXDB+zTVO&M9xE3(K1ZxvsspmPh`@Zie_Qe&4X7cUp(yOB|n;TzTHQ
zqmkF+eH4%Q%=HqEZ`IG7ncO8&6})Y=h1K-1@{94OKA*h*z4`&q`6X@FZwfQ6Te9o@
I*N-mG0L-;Q0ssI2

diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age
index 21dbaca..71e7bdd 100644
--- a/nix/secrets/docker_registry_password.age
+++ b/nix/secrets/docker_registry_password.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg N7lS400e/5mSV3BlhnzThydz/c3DIIOHLNQodTErR08
-vMqHXmSloSrWCxeD4QCH30GSqg1AI+6Dy16atFLNxjs
---- aJ6lQv9jnJHyocy+Kz4jPCtpiIewxoooR0Zsm7CS/pY
-�j9��Ky�Ȱ0*Üb�ɿY�0�����I3v�+�D"*/g`�o�#���ص�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg UVJ4EkIz+aHGJHW/UWVOod/NSUrmLL4pNvK60KPWxzE
+pQ3h/qZ8XfwCqb2QshUxuLs6F+YddX2QSp8MLQnxBR0
+--- gox0jFVFKNb46LsZ/aOEpkxCWnx8sTe7Rvv+tdzkvq8
+��iB�<'+�̽����L�Yd�6c�6B�g�]UG􊃻N��c�]4Y<
\ No newline at end of file
diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age
index a1a6080a499bbbae00a5b03dceb06505ef8c1dba..cc6be8839588413d54eef7af1c90ccda48ae064e 100644
GIT binary patch
delta 1893
zcmeyv_lIwSPQ8aqxp%60Mrvx5M`CGun4x8racWAio2g-0j%iMWwn=7DVyS*=PEuKB
zGFM8rrM9bOK(1RsN_bgVqF0z_NOE9Mns<1Paj}!7nQuu*roK^?YnXwdCzr0Su0nE#
zTVP&bVqRosc2!b#mA6@VPD+%ypS!++xj~hqp?R4{WxYpkxp}C!Njle(wE-^<1r)#d
z^UF6cNY3eF$<KMSj@3(Fc+V2Bx9v(LzgOs)=QdA6ruc4MnJ{HX%)U>8*8`i@y^&AY
zH(!D8=<JB_X_{&eWTY3}Pqz4WU559TRCmXHkKE19tA+fp)NeTSF<r{={lpZrp9)tD
z4U7D>V|S=qM*Q}zclz7i_4stC`p+J|`C=~Fw$7>t7h6ejIzH~?d0d-X9(45E=J*Yz
zlkexRn)Ln3)#k6=GdKSHch54HW#-oRYR8$b?q0j>sZHU|s*fHyIxpjI91L;$?Edt(
z@xP~$ypl4XLK%O{Xx(1g{i@pTfD<p@0?$}WLD|2Pu9PdQoqQWGtLbq4%Z{n%Ynnta
zvp<hW3@?`Yd{XmQ^f#?Vj^9><2=Sbb%-NEf8FsHhw53yg{mnpz^SsTe+cZzM-d^H&
z*!$*YIkBf7swZ-%_t<J5`+aX^LiR=HYoeDc9X~ER)be?WlG!=UwJBVTmG{#Un`W|p
zj=lS6TIuEK(=K)GSCOhXe)7B1!sYdTM(<yXew`R`PhM)tqhqqu-^^dJeX*0q%+jW}
zPIqQ_|KbULGs!CYPypwB^(e=`+OLoQerd`s5Zc|p+Oy;*$A)D4k6vu93i~CjSx-A9
zHSo>a!Tj|7g}oERZ#o<_eB~2n#MJztbTj(~Mqk_e_0MJoE${f;6e1nJCgSbdv)kp~
z?yUb5#kZfOxl7mQ5Oaw7K1<<MUjAQsH_lZ&8n8$BQRh|R{B?h>l}aAUI(sFcCT#Le
z=RfOKFk8#ao~xVSk*iXa|6t3;s?LwMP9+v8U(9jSGqKoEcAPtI#llvbR{<T|9NhIy
z2itbO(pll(mZtXpnXMgbqvPhiYv1Ybuvo$U|Cd64eTynzXM4fw9ep3Urn1*Ad!?&$
zryy2`?Q3boFMl@CTMfleR+=3$S;jdp)n3I|{pA8lJx>1lx0tsr`KBN3*!fH^xbn?H
z{mCn$Coi0s>1M>d^5W`QEn8R^Z@pOXS(T$Wq3KG7SL$=|!~Tk<Mfr28>NGhLulyJM
zTJ?5?N!$8_J5u!;H)a1^Hh*a3B$oEi$&W4X`2RQAqK_^b?YX+;#H<~68Xwdq@`np@
zh{>JPfBZH^$)+JRJZo#N-AT3H>2beU>(9PfpHZiJ`rMg08jDp9u4bLNg10{V@1g^<
zQ*JSqYJcad(Pfz&=f3p=bLM)@FhytG;Dh&mK1k(KubnXGe&eJU*7afw7q3b%xH)l-
zaSty~>3+jKXFD%j@7c+Ip>e~fH>n2S+ni5Ebw4@95dBNSzk9*O8t&iv5{?tiAEYpE
zl-BXgW_CT+U%Kp~Vgbj7n+vzR=w7|y;lEwi3XC;Vt~@yAv)KLpALfeZa=9N=#3O#r
zSY3Ku`Qtv1o7bOwoj?DIlVtJCqWT%X%nmF6Ew0%T?|Aa<r4Yx`s%ahDFRUn*a<-YC
zZew!ye3azQSv4=8H*j6c+I7p;xKob1s9V~I<Mg-6tZ(bzvKwswn&KE&Y5Mx7UgEhV
z&dW8OYEK_^PJ4B$QOHP?`)1p-Gr5)(-5!M-j$4OZdHG}J^!u+TS-$P`>-c23ZS#=@
z^<0cIlCM-V-|rKc{$!%N&cz>(QiY;Q-Xui2><{o}oUnNJ%_TE_n6H1$VEk^<T)8E+
zb5_fhUg5TQ{2~1H)b7YxJ9{msCEQyyHT0P#qfzJ5lFfe{Zn66mnk(hl7*1S!%<)!m
zw1QElw9b3&bM^7LdScgj>t7eGVt;R3dHDL5JxitQZ<l{#e(1+BVXr*@hAQP1u^A_>
z=p2tva?fY0c^=xrdfRcWX!pl?QJ0=?IdouUBj*mKgS)qSOg$+V6C3<CBJYT9%j+Dj
zl4;TGcHDR8KfY31$WgfEoukGXuIf+xvTc(2{Cg~SbN;y=>hW>ItLc)do9-AT=)c_W
za3aZS<EKNC*SPBC|1-bcqVi6+vx>QOr+%#35!ZW1qo(~zTdL*6ZsfE?v&Wfjsc=lp
zuMc;f4k>GeG#*j1jc4ept=Yt-_cLR&>;F#wsn2FVOAxhi*<cf~&rWW?soislNBizQ
z(7Vi++BL&%Z`Xsg+rKySv{&h7dp*1{RcOuQ)mjoN39oAoxOyLGt6zH7^(3!pX4Itp
zy0r`yT6&W?6u!>+u`{mpeq*a)ilsnT!i~F%?(@3dUz9IjvGc5}Z9w_i@2A}@<&-(E
zu35D8P5F||KC%YFd=06It{128jM!SgtooTsIp>s~$k0vGcP(079~P;-o!!{!;HTqr
zbPgPBFTEVDExOs0U$*~ChwIk3I_)J9?+$M}sneU2&{K9ZiiNTAX>smX^^c!*70$;W
znZ52^*~=KEm9Oin^V|#~Z`-bqeiX@~ZFo6sj=NKKR{iujl6LO{|JI9W&i!yl^2}|m
TE5UNccb}bqe$yv#9os|z->{di

delta 1893
zcmeyv_lIwSPQ9^9YJgj2m1{)4enw<rq_de}pka_tn!bLDNph%hn2)wsaAu`TP+)de
zAeU>od$^@@x>rzOgh!}XNNJ^8xuajXXMnSbm#JHzd5~*Xka@aAg;RQAAeXMLu0l#)
zNnl`=QFfG(M{b~}VNQyPw_C2GL4j*hK!{IzWTvB$dwoS}Sa3>;wky{wfzQueHypa`
z6y^2yZOg9w_j63H-`OR^uPFCq#}-ewL#BUy85XeSHmg`(negt${{rbxbGC?YeOl+G
z&3LGf<!$U#DZ6O)1?M;Iy3x01%`(M$)`<ltuZW#qCV46?@we&nwV4ZlKJ62exH2_1
z@|@LW=Krf(mdrn>P|x?ap=hN=wdbq+jd{T{_C7Ys;M(@|(J$|LE!H<?Y0jGayuVPh
z%wIRgnDf+)1%|B-R!U7bdVha>JU4$Lqy4ShFQ+_`)|>97Y|ZUqbYkzFVxxB!$rI}(
z4_(m9ocuuW<!OtKgAMCNVvjCc@w8P?$RqXHen<Te*3+XSA{&*&g<Vh8+c~aMYf!#=
z&g|2jTY9zoH|?9m_wnWfhPtE&(O=g-xiWFVan-=3D|(mB;(w@+XX;d5s$THHQN;Y~
zN`*s7O`Zl*58XEs5Pp5V>dn!60*|+RW4-U!;jHlHc5m~(EuYO&zr-Fm&G%;h6^m5q
zmafChtKHVLoY2qyA+g2yk?RzXPHXvk)z1eRJXb6}$Z|#KT=({rX627ZJ|uJ;T+|Y8
z{&;)1anPE7vRX~5*X~&uiF<`Ey->_}f9vjY*AU0|`yO&uy*RVHXbtbTSuBU={9AUw
za7}@K+T*po8}w70-^>c^;%|x8a9ea_?y4Wn+1o`WrYxQQ%yhS?)2sdYqHoG`PhD75
zx$jkdO+<8nZ1LuKf-NO8=f=%?v4{1UM&@yqn~ndTTl_uyVWF3r&AMMR90ivcZ;nXc
z_j$dwTI{~#i;CteEbQW%x_-{7y_X-PRIa%9c$&|lh!4{)=K1H99&gN0e){=;R{Of_
z*oooG&rbcBY5Zcpz1NG>4VHVjuf0orr{6yR^ykj&0`B$o&Z=1kv)^vr_iKLQj<V}P
zk6Jp9{5kaQ59`)iUhRtQ;rsNRdpdt;y%i|py0l}0;@vNG-mCW+MArr7HW_H_(>Q$l
z)8YTRkG3A&sAH>`6ta8MhM1m;EnI$Fl8n}K{@n@8U|AGpt=+JHQnrU6mnUzD_kG1r
z_b&1_&df+R{-I>3re0sresV&wPo<n`+O^Q2d9PV+^{Yk6%#fOFz2_r~<u$fFYqrj0
zG-6m%t9GI1#j}4GC;REJ+<PvP*=1{2S$;$F)ZFTY3k2;xhie?mlYZ~wzg^j*fPdQ&
z&mt#=Glvh}yKwo=e}}BkKNJ3x?MX{DSX0J&;rTur%YRC<UOf%)7M-=Ux4z=2&D<Z$
z#WcH@PxyV^t-{bTL*-#Zw1LsH?H>=<U0?{mblu4O_WpYwrJVax7xn&M<0I5LGjL5x
zK#Az&Q`OIw>L@*y5cd?iBeP8MqkT{0%ZvKwHH>e*N}r|tqVG84$E_Sw8NJ@R|CHY-
z%lzxuTp^Xve@Pa9BJ{U&G9UE6qWEW5eV7_EN8iq<?j>?h_^&=a+g&^VaKDG}RIh@5
zmo5&?PL9t%j)wkK<S~A+=FEd`jYS!OmlRjH9$uEcae3YiA?9CJfp45jubBzwt1oiC
zxVXH?D{8jv!SKh@u0J1{gtRFxzkktRAx13G^;wovaQ-IkAH^>H4EKWGgfta2%~E=B
z$h6+!pJAKxCQpg!Tex=`1>U@+^tdeh5tI0Py${cxF4>ZN{A&EGweEWV7rbzK`@xq{
zgWYrKncJP~S99lfe|VcFZRDeE%G4(97a3n*Bsn*xaF4x5<@Qq(zrAj;Tvt{!k8#y^
z?QZ8r>4J9(;S1ut9BfXkK6kN9ZqKUC{Obd6q`3WhUH>%AkLkEw;fv#?N(-dUzj)76
zKY7;rc%vhiEL2kbwunovS~qdVJf;WpX4F=>%QwH?eL~WE>HPKVOjGh_Ka8CCk14Y0
zw#$q;KjQXOyDHDVBA%1(9CqwL*!4>*s-0z-uAZ8rAhmVZjx<*H^(C(-Eso+{zajpD
zozY?Er-ixq+**Fs)CWhbT#@b?KR3<kp7F{v)9)tSnv%qGSn6_UrP@1ASBKmOdX;&W
zv+i-<7im&|qjw-&cmL9#J1!qtkXi2hBeLyC_gl&3m*dVkYfbjvbRgmKrt=#vZ7P`9
z78krTPrq{e)*BJu)Q+$2@My}dQGM)g^8I!B^3n(8XN_X6{C{3l)_e13eYNA{?23-9
z2ARK)neCPLy)AfX<Etx=&h2n}a*9QTQ&^}pX~Wx;ZwKF8xaxgW_V1!Y8xIC-V?6A4
zt)HRKvh!Nw%Ys+kQx8s<VB52{oMT>Hg^6R+RKD6%jMbiMqDeaz*1WWRqG6D_-+YlG
zXSucHjw_!ocAK8O-mF^6S8yu#3%6=qPGS7#C(CYkYQNf7Gk<52RmkkcUP4bL5_*K!
z-!)@+cKfR2=In@U;egcwX$rZ{UiO6tP6Yh(pQ2o;-p{)($eZB|!y#3LORqEUKJi%*
X8SduHa(qV19=@Y$SC{(s_pAT_OI)Po

diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age
index 609822d..0a2c88c 100644
--- a/nix/secrets/forgejo_s3_key_secret.age
+++ b/nix/secrets/forgejo_s3_key_secret.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Ln9ZxoEmhHUMbU4PufH8OYVzEnvFEm+b/SlBfitqEhw
-M0n0qe7L9peTLylt0uoTR4gQBcCxfSIm7FAR0mPeG5E
---- BzrHhLTDQ49g2GTkJdmLpdhRBp1rfdekcW+A26jzKys
-G6�?�U'r�y����@b�$�M�Z�`��@���kv�]�6�_�۟N��ق�
$�!�m��Vk��gA�]�yW�,���d'��;Ȧ핒�܎�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg nMMawatvWfcdHyOTJu5UBTCZbB8MDbvdd5XaSCR9ARQ
+iUI0FSTyjhx0xdfUn3ikxR3dcW8GQH1Flu2kwlkP1HA
+--- Fb7A45fAQY9VJN6Er23jTuEMvm5eDHJflTiiNFB4dYs
+�.�)!�$Y�Q�ώ$�9i3�3b_z
+��TR˲q�hs|[����F(�m��I���q1z�^&�&	'��(�g׏6��Fվ�^.�j]��D�i
M5�q�
\ No newline at end of file
diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age
index ce127e4..9d822f6 100644
--- a/nix/secrets/garage_secrets.age
+++ b/nix/secrets/garage_secrets.age
@@ -1,14 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Nl4yCNn9+FiX2uBliOH052tOjnTj4DcFzaIDjD2MVTY
-aU848NDVI6MN5JPm9FRha+HJySIEyRRcNaiiBRnxJLY
--> ssh-ed25519 91VHug HfzLsV+15VwIFXz9mYc3dNdlFnb2MdqOMIV3DkxnJmQ
-Fr2LDl/Z5Tn9FspwZynbCvK9Let8VWGAr00lf3Uhj14
--> ssh-ed25519 XzACZQ GWXW5myuKkabbJwdW3OsHl08KBo0wu3dJXXo13xYjR4
-SYu+6yj0om9BHFoJH8wsDPEbQCQy/oAp1jRW9wX6Ys0
--> ssh-ed25519 51bcvA nenOCUH5VZ2j/u1fv7mD/2hZufU6KWY46UZwzINXSSo
-GbQOiKQ6ko7RpuYvmtUnf5wzNrKpR/FHkrYHhRzURDw
--> ssh-ed25519 vT7ExA 8/Cn92m/Qtoo78VSNEYNrC4HqoIKxLyvT7A0R0CpE0U
-rehfI6pEM0nAv9AQAFa3g/PTd4uvc8zwWLAVAgoq3NA
---- fHz+V2yXufeCvWNZ4Eu+vAdPYBoDYyuUlXcrTo8O/88
-r�����u^+�=�$!1
-�rF�-N����Hr�+��2�z>�F�iw`ˬ���0���2��4(3
���իH���=�ay$t�V������|H����I�	��d�2�_`��
	�d��r?P��M���	�bش�%qh�o���"�ߗ�lzs;r{�X�uE�n)'!���V������Z֘��܌���u�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg GE45kAK/hBIkfDcJ9T5KSf2ZlRuznfyCXNgyiROKSho
+07IiEZYSR+BoaHsNOMfpTB7KvFI5erLqiLkxHeghNA0
+-> ssh-ed25519 91VHug I5YszjRHyHEIPSO9ATRx/hgSiBnq6CmQeCiEWyThKQY
+6cyqqeR7jyvWCC3yfxqVk9YtjhR8LmUISxoScoAl0Ac
+-> ssh-ed25519 XzACZQ qqZvo9xbK4rQRDzCsyKD0NVYhk3960UW5FRfavIoI24
+AjsMDfEzmGMCGekIAHPXkN2RRZHC4ZjACo3cNGx/iqc
+-> ssh-ed25519 51bcvA mvDGI9jBis304qlduEX3kDb2Y5E2fiNL70i110hdDUo
+OJl67yJ26ZZVLgobEbh63J9kku+whdmgawpPrlyAgFs
+-> ssh-ed25519 vT7ExA NgHlD7tjMUF2kIeMmHyE/qsZI9VzIkg4drUCDj0GABs
+kxwMjB9CBd5IRlh2SBHIQJSjCjARLMwOg40DSdbDO3k
+--- hzXf515cyiJHjcIAg+kmCeZ4Hy2GI/b21F5O+Pq7r5A
+�=�)�BT�֢��(�_�_��
�2�{�E��d��ι��	w�MS�Vs9T�j_+�q��}���f��5�1�޿�^�>Q�F�g�^Qvn�Z�͔d�Θ��l=��YȬ�پ\!�F�4v��t����h���!�A�m�%'��n���<W�wi�ghmڬ�/'��Ⴗ��Y|AC����`zX���׻-�3�
\ No newline at end of file
diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age
index d009691..504b519 100644
--- a/nix/secrets/generic_backup_password.age
+++ b/nix/secrets/generic_backup_password.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Kmd5m9hb9QXzbbrLWC3SLcUfy/B8bEWdJMQ1iMe5MQ8
-A4ZoS84dtX+DMOzPXOMBb402q3o6LBExOda+Rm4hbO0
--> ssh-ed25519 91VHug rXXXRgZI91mIlLAclodKDk3V14pDyRCv5kg1RCB7AH8
-CzC46ry6tCYkDX4jTW08j7Itqjb0raz2nlmU5/7zLCc
--> ssh-ed25519 XzACZQ KbzLsMTNqcjJ2I+Bx5moRC74Z/QKHrbFVovC5hhm8DY
-aAGFH0KBdM+nm4HyZ0X7MPc3+fBbcQrQAcvrK0F7LNM
--> ssh-ed25519 51bcvA qv9cje7I7Sxje9xV0DghaxSxyovB37O3B1Bt6sHp/Bk
-2zEnhhy6dIOWMdbQE54xtQKfZjR2vTH+Z4son1/gYr8
--> ssh-ed25519 vT7ExA voN3ZvXhhqv4V9FpVTd2ViydPgxvjpQpeUcH6jljen4
-sLjK4aWqGSlxxeMKPrIZCjw4tsz95C1R498bFZgBMVk
---- Kfk+aieCFtZiKPE8toWEZwZw06sELpx1FiJCVDyLGcc
-��u��M�?C�������0Z�&����rS��g��W���p�8�{*6�����y���q������ð%���
\ No newline at end of file
+-> ssh-ed25519 qM6TYg NaiDsYFYQAZuJinDZ60OiPEZMsnmPOggyW/lKwLPWR0
+vLZKSA9iaFIdOjE7K9n7vtlF8UKCS+AKuSS3O8jlfbw
+-> ssh-ed25519 91VHug O5htAKX31xr2plcilbKy/AZ0xtyIDekjtr6GYeIXcns
+aK43EBfhqDCEtkB/1RephM7PK0tB0xHjS+GIDTFw2A8
+-> ssh-ed25519 XzACZQ NRs3M2HrY9vZ94a+MccGZisn/cEyY9lg6l/ZiOaECgY
+aZ84NrESzU+yhsxXk+XiHEFJ+5/8B5wmFZVhPU5K8p4
+-> ssh-ed25519 51bcvA 74NdYVJKbbDBuhxqUUAgx4GpGbKFzL0/+KRXJKoxh0M
+nXjmvzBfiq5Y7EUeUM5aoEColQa80JUCMwaLX36Scss
+-> ssh-ed25519 vT7ExA buG7ZHfGrdKqobgouN2DHkOointeeSo3LbQ5TbXxMT4
+v+CfO/1CDfu2d/Oy7LX1S/tPa25zaY6rWafpQB+yzdo
+--- 1urbgjL5IrFAQbt9FPGt+Hv5hJ99uiFaC3K3G4X5JSQ
+?
+A�>�$-��>6������������蝠���>/RZs�Y�ɮ4�5�ѺR}��a�9S�Xw����R9�
\ No newline at end of file
diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age
index eecd4fcc77a12ede5288eba2af310304e06ef44f..a8f2696b5b7e9b90a46b9ff6c810c287d3abe6af 100644
GIT binary patch
delta 246
zcmbQmG>d71PJL#+k)wN6iC1btmA*$<iA!arziB~1PGo7Wvvy>zrD;`YSyow9m2pUU
zGFNV{S4oI}w!6N$M_y={cW!~JZ$^-7kYRX+b5ekBVR5j5Wr}f_xmjV61(&X_u0myD
zsgtLliC>U!a)onMflHE+pP_F^nsJIrut8B~cxkSyc79rzXLfmoMJU(8<9m<pE{Uu9
z`25@|<&t^}$=fd{aI!0h-c~!~q}=$l;LZfglYaT1yMi{0pZo8>WJ~?crRuR9)9;>N
z@_o;WQ%5b22tC+d=PH@%c4=4gde6q5r>BpknD*-YiItqf8QY(|<MP)>okbG>DoJNL

delta 246
zcmbQmG>d71PJL2ZifNFCXPQ$$c9?mXmur}#er32tVwPukLB5$!vXgsMwzf}Jj+cRf
z0as|Tsc&Moi*HnxSxRAXv3XQ(er{Swh@o$=OPIEMQCgC-n@^f=a%O&>0hg|>u0myi
zx3goQxqgI2a7tNKh(%dgZb49TR#I|GadJwMsaJY#WPYi;pGj^&XgQbBGoiyN=C1!Z
z-Nn}RC~evNvFgoRVVi#@!RJ3b%3Znp`kvyyx3%ldw_3CBNc_+6H%rno=HAwwYx4F#
zt&Dd6aNT?TOP9wx%V)k_d{c1p+)EahHnwh1e^d90rP!I_U69~J0S~p*-!B~j0F-5{

diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age
index 0465eba31c0ca76d83cf3fa6c2c0c99a94ca6a00..82504b11e710bee3057d641122c46e3d8dbebfea 100644
GIT binary patch
delta 304
zcmcc2beU;_PJMP&Vx+UVe~6cPfq!O>fqtrXp_#UCxwBJ7rE{sazePcIP>F$0NoiGB
zB$s8FuSrg>Z<$wNqKA`lcv@9bl~Y<?roTmgh(~&8m0?*_mA6r{K}cFiIhU@ku0lXS
zws%!>rH`3QYE@KPP(WyzXINIAQF>O0siRv-WKdE>Mtx#ZfTw4nzAM+A|4MgDO@9^h
zvn+mB@iqER-sXuK6F3&%)P7#+p8R-O)1f0LuW{SfZkcCQe}ql>_1AP}9tR)u7fS*b
zDVe`g`Y52kZ`+;QVMmre@LFd3;;YCt?`sD>xS6eD>i>Ty=kR?q#V1NX9xm)YAMsAf
z?(ARti3_LZYMw5$(`@7U#h>A<9^Uc#fw#L>{rjZuubGQyO4?o)6ulp0U+m3&m%}jY
I{HM@z0E$0?CjbBd

delta 304
zcmcc2beU;_PQ8<FVU(9=K}2wFM!HvtYiK}vdP$_2v5A{yZj@JPX}Mo&N<?ImQBq-q
zFIS**gkx2vXTF(HMo@aGcR{*ad61WRvU7;LuU}4BNKjNtYLuISlW~ZTFPE;au0o}M
zv1Pe|hk-?5rg4s?xnHGcs9Ca~OHhteYDkiYcZElgOMQ+{s&|@CXe8GnjxQ;HetTb;
z;hfyRCSHB^B*mvXOV8#XoBhByajsWt-TdIfs{894c<y+dSQ6yfvTv<xy~>}JU(YM2
z{51LVYkIU7_jiweLH>0NK>=4D2)Q{V2r&kAh`i*zFRXrX(xC?;+Df^(b8Iv?pQZFv
zSl)E1-hISbat4#8{xr4U>fcy*-cV<{cOf-fcS6Cx@Asm6cJ7}m6;b|Rd-F$=Ye`<m
I1V3#B04Q~RxBvhE

diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age
index cecada9..3ecb67a 100644
--- a/nix/secrets/immich_secrets.age
+++ b/nix/secrets/immich_secrets.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q lRux6HhczttLaNglBB4xdx7B4GUhs50ucnyYYYlNLzo
-nxSaMiEcscZ62uEA3N4ssHN0Vc/fw0wRsGzUXHk5vyA
---- FpSXOah6uQRaHLOxdGNFF9Pud9NsjYDLhiXzqg5/Sao
-��x�	l�l w���\v�S-�!V���]�������}g��΃[>e�;�n0�n!��;L
-�+
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q ttfca/hqpWJm9dRJYWBXj9Of1rdWg2NbgfsAJFMUQTY
+qokH5RFlOmZMETgkqlWhcx41EtXtN2IxKpvP/WGz6mk
+--- vn3HoHqGBa02fSSeO8LGjhGb/7JK/tN/0Zh1Pjz25dY
+]?m����D�C:g��_klU�G���Q����J+��g3�u�9FH"���'g�����d���߃
\ No newline at end of file
diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age
index 19d8d7762d3a4a2e9d76be0a1f7ef6d66b1583f6..91975e5b4f3febefc696e5193001bdaa35505a52 100644
GIT binary patch
delta 257
zcmZ3=w3KOrPQ9Orr(;xJu&Zl$WVms<kEumKig9XyS9xTlkw<ZwQ>kNaMo6GjskUow
zGM9;ktA139K}BAmcdn;JMoxgYqj6fUWqELDLAt(UNmz=7xpSeprHN;FAeXMLu0pzR
zxn*R8slUH@QhJDMURZ!nUWlPnK%}XGXLxpzS4LKpewC?zZgO^HMlo0X%h~G|-)Cpq
z$->kmutVhbr*4CDHI4he)VY5sT_g3***QYawLw<+zmCJ+9XB^W$~?L|$A3eDT7xqG
zj~{`jrbelGF*{rB<D6wH$iT4sL4M8Qp2N$xu;^vWg#WtwtD}ie$dvEkl>3?XEUQ_%
KosPXew*dg(yJD39

delta 257
zcmZ3=w3KOrPJOvWj<>l>MzXPURcc;Ql~;(Tu~BJ=UwTAXrBkT4SDLw-VTHT9nPZqy
zAXm9lj<-cYl82$MfuB>Vqgz(FPi1APzjugHR<?G&p;LKQc3^;CvSmS8B$uwPu7YVs
zj($mUhGT$#X_1$9nv0K%lc|1=zHez^QE*6Bm{CApMpd$*OQm^eMm867qTWBpXWY9#
zoyZ97DlhD}(UW|_oFX~#TGa&UIeQ`wUYMh1&Gcy7j^m#!Zy&n7`|P^pdaJ6#HlIEv
z*(K~deeI{qk88YFBi{J@_;hOXw~W6rkqZtVoO*oj)ZJ|A&wp(A5*jD}WBM%Z*>MYh
M7-x%{UM(>J0A>4aB>(^b

diff --git a/nix/secrets/knot_dns_acme_dns_01_key_config.age b/nix/secrets/knot_dns_acme_dns_01_key_config.age
new file mode 100644
index 0000000..b47832e
--- /dev/null
+++ b/nix/secrets/knot_dns_acme_dns_01_key_config.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 LZU5Eg REfGT+ZHVlXvO+6s9AgIGQCBS+AQYfAG012IfRipJhQ
+V/O4nPGoAOpB/4DyBWuEV/GxoRJ7hdgVomIQwcxnSdg
+-> ssh-ed25519 5bWSnQ vFGAKwm8eJ/Fqv+LxLo+1mnzg4ht1BLTA7zdJuWdlnI
+Lhh3d9dWKyRcVTKeMOJb/cVzwnnqrBYNE0ijDgAxut0
+--- Du4x4K3KsDMktwzmEMiFRxGXq63eP5x9CBowtGJWM+w
+�1�{$�e��9�b���`��+g��p�����D��x�hK*/�Z�~eAԥ�H�}l���0���Ό��s�Z�t��ڸ��:!���k�j�!I�_�y�I�[e����F��G���Cb��x����
\ No newline at end of file
diff --git a/nix/secrets/knot_dns_acme_dns_01_key_envvar.age b/nix/secrets/knot_dns_acme_dns_01_key_envvar.age
new file mode 100644
index 0000000..9503cd7
--- /dev/null
+++ b/nix/secrets/knot_dns_acme_dns_01_key_envvar.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 vT7ExA UhRU412YTV9dkMkINM4xDQvQqwosWzIRGap+NxS7MFQ
+FUlsU461cxI+2befwB1v3ygyYAeTwfpJft/EX7eCGCo
+-> ssh-ed25519 yMKb8Q 2kpI3iQwInOH+TYnbvuyKyksGD9Q8UthqF1eBG5I+0g
+Si5Q1xNovm8hBmSfHx6l4PsiFU/cPa52rLw8OAGWQl0
+--- PO+gCtXKMloPmRAplw/pOAVPDHqh5PwzrQqrzSPN5Ng
+_W���[��VN�J��1���D-���:�ᔆ|V�z��l���S�v�*{��G�9V"����_��G�r��S\�c�?s���&갶�S��	
\ No newline at end of file
diff --git a/nix/secrets/knot_dns_rfc2136_key_config.age b/nix/secrets/knot_dns_rfc2136_key_config.age
deleted file mode 100644
index 48f95c0935a38f1de69cbe117509485000a7ae50..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 434
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUli3&A!O;;%ONzCyq
zE6j3pE6Ptd2`Nf;EsS*W3o=hJ@o))?3M&l?C<sb*c8PQ`GU0LwEsU)4i?A%r^fD}T
zcegMzHuTH%EX&LFNX&9|4{<lq4=8ZAbk7YojzqW3G$}kdFHphKy*M!-+#n~j$g!Y2
zDJsOv)6zR6*FE1jq9oI>#HT99(<|H~D%Zm|*OklJG_TY=%_z)0F)**d)!jhbIL|ZD
z-_*%H#KJN&I4m(=+pVC`KO?dv)Pze{S64ybA}}eh%rGm`%{(hKxX9bdvph1u+`^?O
zJFqMy*k3!hGTbdPygWC>Jd*3Uz@*7PPWRe+@M!T&(h^;+GpS_T5w824Yqdo=cy*65
zwf1Zi&Gsnd-L4bnruB3K|AkfC_L$#r*!!~leZu`a-<)M5{$y@^yYRx73w}4ne9oFw
z`aYjCHG9%lgRfR!6D_vrZ*|M^uiW!~0rRy|-u5H&<^=6n6rfVsBzbeO)~lBPQJdmA
Tm2AY#&J{(OFznVgJv$Eog&m=8

diff --git a/nix/secrets/knot_dns_rfc2136_key_envvar.age b/nix/secrets/knot_dns_rfc2136_key_envvar.age
deleted file mode 100644
index fc3744f..0000000
--- a/nix/secrets/knot_dns_rfc2136_key_envvar.age
+++ /dev/null
@@ -1,13 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 qM6TYg QQMDIquZuxMKwx2hl2ST9BMXa61DBdC/cMUutcRIRHw
-l7oENezyJwfJHrgNUtFMfOF08BhAYWQOjW8v7VPN/aE
--> ssh-ed25519 91VHug wQBzeFG2xixYU5L8/d81n5FkZMqO3uCSF60Xi80mvnU
-nPAgKpJj7WDJ4tbKGnlWAhvAUOyLIyOY3aPofKM0LfY
--> ssh-ed25519 XzACZQ HYj1Omcc8WYq6s9l5hVrjjibg1LFHnkYkXiPolGewws
-uhrQ6nmP5fMApIJzUzwXcnlILdPvmlG4QhG1laW6alk
--> ssh-ed25519 51bcvA e2Xng7rC2SkYiDn5BRTIDBxn7vN/F95hI+okWL9TymI
-7TJrZQlJsnGMu5jaFQllI1E/+ZGHZjGmaUpuNZSAPDI
--> ssh-ed25519 vT7ExA PSM21ZGF9T9g6rxnsCv3rAio1f5KckTHgivfclDjFFs
-rq3M2R/LHYki4nQ68iFoLXH8VVmWyBDD6yv6y4tt5qQ
---- KqTQhyl3ef04vDQ8eu1IvTsEaSMYtQxxBAcIO+WYPr4
-�$Jk��#_����Fr�"���B}~��P�@�.���e܅��YS�L;��P�z
&0�DiK�J�^�:�Oc'��+��
\ No newline at end of file
diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age
index 1c85165..cbbf258 100644
--- a/nix/secrets/loki_env.age
+++ b/nix/secrets/loki_env.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ aRbZOixkF1CtYIoCxgHX1Cw25ozmtV4HWsFIY0sfHAw
-y9PvJ4rdceua7Q4GVqz09KZsensKhA8pLMjGyub06xY
---- gCH1ZBj/XvuwrtJcjVXr99OT89N7JOIlHd5xofjwH9o
-Pcwe��OKD-���P�z��8��Dub3���@H��}��!��E�퍽�lۛH^k�lMro\�
�%��#Ӹ�˦Na���,�=Fk�u:��![����=��&��0X�<�OM��ܥ��٩�!��2��-��JZ��|1��
\ No newline at end of file
+-> ssh-ed25519 XzACZQ YEK1qlKkw4KVnbOpskeVcNSTkzHvIHGLTkXfo7t8+Ak
+MsWSttjHmrX/VknsxcVCDUnItE8ypvAvlD3oEWhqg8w
+--- 5TI3aOOUZNicoLqjN9qM+PFW4vtHWwE0d8YzBzQMWWo
+l�L�ebYG������p��d�i����):�.���s�L1A��bnqMzy㭪�v*���삆֐�Zo�-��2��b��2	�kY��őR��w��_�\�d����3!BV!�{J�Δ/��j�>o�$���SV�J3^��Ђ
\ No newline at end of file
diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age
index 05d0b31676df521ffa98a8393550ff8b9121ccb4..9937f85f272b49294966d9296d9fc67fde35320e 100644
GIT binary patch
delta 362
zcmeBW?q!~!Q}3EwlIxq4nG_ik;cS#?k)D_3WLoHIT$N^07*OStm1q#@lM@x3<?f%8
z&Q<PS>X%hv>7gGU6qH?TU=|WqmgQlbSLPpJ;!;!^=9q5jZDJOfk(+Ai$)#(jP+Xj$
zo0?)|YHDby5K-mm92KbG=^vPv9vNa%7*yzQS(p=LUY}dy8E#T)WMN#E?CE1tloOV0
zS(OwK8E)jtWoep}Xzb%_=v?k%<e6wuRA5$^qn()_QJiFKS>Tpp;2c$HWMr6{o#Af4
zrK_u}U=rf0pRFAdX&F?NoRgTWU*eS$<ye^Img#Ql<yYzF=WUSg7M7jo=24Q(#j|G0
zv^7unaV0Az-<Phh=WV{n;B~n=@6Qvhz!Te_=1lvZG~@cbna-<X<N69TpKxWpKR#jh
zmyKL&YkZBbP5PK|!oMd&%t`mLXSZ3frb^PAg;H*(^lqiRJ#Z)1SJg14KlSG;jrOgJ
LpFK-_ba)>C>=ubw

delta 362
zcmeBW?q!~!Q(s(RlI<OCm}?YNlpK~_S>fWF;*y?Wnw4ChRutso=oXo1;OgZR<?WW|
z$rT=ul$_z`=4@UPQs`{rQsh}~o)H=q?B`eEYG#t19TAlh;bf*C=9ZCV!li4cP+Xj$
zo0?)|YHDby5K-mm92KbG9^sN+<>?-35@DvF?_Xq^QJ?H-9-N<Fl$>Ag9^mCsp>Ggj
zq@A9n9h_~z<>weu8fESoWe`~IYpL&Ek{Frd6OrXqY!+dVnwL=!mL6W_9#&9U=<jd9
zrK_u}P~qzuoK^1QZ=U9rQJ!Mpkr!E2S&*M$Tx=E@RAFIO7Mv21Use|El<$$wW$F2+
zdfT<RTa!=ixiKN?Qwsaa)h*S}B8yf=u&({)WXqM)-0?EDe(@`w%N}>OTs`|?M?%h{
zkAgu>PtMH@Drd9^oc{J#rpXtrl2@CR&o&*Kl`DT@zP4G$!eF&$Qek}$_smqc_F|oB
L5PMQ#zwJT*Edz?P

diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age
index f9a3b40b61d31f84fb41d56446052e567d0aaabc..6c79515b3287f8094dd2646906648ab2a9353599 100644
GIT binary patch
delta 286
zcmX@ebdYI+PQ8Vff3bFcMoM;hT7gHJi@$kBp@Dg^mxZT$UZr7WX+georD<t$QNB^0
z371hwc#>N|WLCOawpp4}x_ho;hF@TyVTMzRS+;>md8uW3vbT#-rkj3LB$uwPu7bP2
zxs$J3V0uudS)x;MUPiK+Np?_jagJ}kNmXWmTT+o*Sbcg`X;PqRcsZB%hFc<Pa}7n$
zoUu(dxEZH%-lwQ@^`8@;4=p$N<X+1^@x?+(reM<<TaN30%G%2Hl5_o{GiJft3|+3P
zuK2lmw<>dB?39{z#isniJLl&{9%X%dYq?a&og+Di<bwaaC_Cl4$mxY($|=DGtXJ20
ptXnYsu~?7BSp~~);wC{4-8c9;e&DbP7K-{fYyBH<9k1ILssZ^5c2)oY

delta 286
zcmX@ebdYI+PJKvPctu!6UZ#6+kauoUs=sq&kb!AYqH(dYV@iZYNswz^Wv)-IwwJbR
zI#;E$rEx`hW~ys;YOcRQPJUsiVNyV`Wk$GrnYW>-zo}zzj!RmIx21c80hg|>u0pY&
zt9E3fb47AsVo<iDZ>5V<grT{Ir)jZ~V`NTlsZYL{QN4LpR8d)ZN;#KW2fKj7*B9w`
zKc152%6qkH@60uy_A^yX3jNzVp;lPL+wsYRLsJx|2TXbFe)xz*`N5S8FJ`suOtcf7
z{hpy}BfHEhW5<GD$2KIb_`%g#obH?Oyq`^Z@8<<4kE9z5d|{bku~f*X_Rz!T6<;SZ
pZP~_AvUPu$yQJ?nagK2D%+--`bGJAJN2C|eIr0AP@n*(V767__bqxRj

diff --git a/nix/secrets/paperless_env.age b/nix/secrets/paperless_env.age
index 45894df52e63e990561fe9f056c6f8cc380247e9..7dfa32a06b0697ce2956c953cfc6dcda3ea5e2ca 100644
GIT binary patch
delta 305
zcmcb@bcJbxPQ7+`QdEIUv89VeU_owDa7Cnkv1MeTnUQ6rQ9)t3dumCTg{f;%d01(t
zFPBlIp=CgEgt1$4W@&a>u6CYhc%GYcd2ym~xPE1XdsIfQwo!#kvUah5I+w1lu7Yuu
zvvGillYvW;M^aI;PgY{8hf{W7kXfN$W@bf1Re?udYQ1qqK}MNtULY4kblt)=cKmJo
zXI%)KCx5T~l}E{$K(nkjyH_s=iPSTUc)6+j^B=J{-j^R49enuZyURAULyNC0v|3mD
zZB_rKYvFdcR%~~%QZCsu%_Gm(mV5F%7nP9Ym95`%D+H>O_A<|S6(tj~@$q!$f7`uo
z>y*FuesTWR%3fxEEw<lBqIfo)4BEN2-R9H#MQJk%mi6jSJ176~b;0_^xZl5n>Xyt7
KKl1XbEdv0~qlOp&

delta 305
zcmcb@bcJbxPQ7P-QC^g#k!x02PC=?$hJjaUuxpNwex`?EfooEZTSZz#fn{J(NNH-0
zBbQgPnSrC1qor|Dq=$QPh--vJu%(HUd4{ohc7}Obc6fG4a#@m}S5CTVAeXMLu7ZDN
zWk`OWv58Y?K&Y{cvs;mGO0uO}ic6}GlaXU#sk^0lT79~2V1Y|gP&U^z$36Oad50`C
zpY@+HsC;Ap>M+lR56=5|UBXPi+=zD;I<&I;$Ev=%s2OahA1_gp49Z>g^ZeP97TsDL
z53IFz)hR_EiMqpdvnR<Y%+tiHM_7^n!SN3lg>^JOFFz7>`)*wLOVujAFqy^orLLI0
z+a#lFzNl~UFSA=(!jg`qizl=79-L(4YZ1J|^s!IBOLXUbM*kZu>>Jl_z4l*ihO<(X
ITlAx)0O4VKbN~PV

diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age
index cea627501d5933d8c7cccea3c00138a66a541c7e..13bf603df7e34853ed230184f732a9544c06d4db 100644
GIT binary patch
delta 301
zcmcb>bb)DtPQ9m5M2SzXwzp+SNqVliv71w>U$U!fm2YK`Phz1{j<=`3e{OI@S(1NF
zGM7<KL{MsYM0jvXiFR08WR#J%qpxLfifejyUWB1`a!y`_S4Krvnx}7>374*}u7ZJq
zw}(e*s84ual4pjKzkjijSyGyNWp;*(X>p#nab`-gQ+;7kg+Zp1S2mZf{6_9ehW74<
z??(GbbqRbqaI?LXYi`-XGr^LqUgjZfdaGZW{CIe8UVp=rNvG;xdu;hX{ZHGS<41+2
z%)IB}%l`dh{)$O!4(C?2El;mnY*g83Y`9A)`DxPwwIr5kgI&i?o3HCi3Xo5F<<}Ob
zv?*|R@8UE53wYVo;->U<K3sotcSGUi??)yF{fcWdX^TjZIe9-$<KePQ>o8vHyUdRk
F0{~)^e)RwV

delta 301
zcmcb>bb)DtPQ8y)QdEwalTk^krIBw~NpPN@wxzb8OIko)gnw?9L9jukQDuaCN{X*>
zAXlcBOGJcYntw)FR=Sf{o>8cqubD?~S!uRoSYDxPWN4n5nMGPrW<{k@HkYohu0lwj
zr&B>tiJ`t%lBao<TcJx<g=tb&s&`(fNpQKpw}p0qQGKPCb76Q=ZZTK?USSjOKOSC+
zQD2U%c{Ayq@~MLw`5)|WENYnT<Zb+U7yG3nNiK}#9jmWixX7Lummay9^QqNc!(7(w
z{no)eD><eMu}!&RcU!Q+=fURw;}hj->#B>CSH3cw^nblr=Z8%%LsD;kaAv4oB0SMI
zyL<22!wy>052|fei<&6L*vj&`e#6}#hE=B$8u!O`ex9ALRewHJtNc#>R%S^-*Wg7K
E06PAAJpcdz

diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age
index 9422a04..d027b5a 100644
--- a/nix/secrets/registry_htpasswd.age
+++ b/nix/secrets/registry_htpasswd.age
@@ -1,5 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg vZTE3zklC5ACYvOuHSNPMDJshQPcxmbfen0TygKKW2s
-2TMCnx49MiF0AqCFMTmuXC/xKzos66rskkDfdnIdQTU
---- 8JTyQvwrmMPdNLPK4cGGenl5DN2UpoCqUQzdbEvezpQ
-�!|G�q��^D;-B��2��>�"��2����A�)�d�s\�Ӳ�i���E!�g66
�,}�	P�c��Qx�‘��0��v�DV4�:��ү�;�m���(xs
\ No newline at end of file
+-> ssh-ed25519 qM6TYg b9QXaopOE4ffCV1mNelzUSBejlwg+p2x5GuFiQJtXEE
+Vx9fJQWJju9TPMYU6qZJ6aHb3atQExfSlUHmbXkoyr0
+--- uiYOy/yar6oKQHnP1eNkFlkiD4O9oOxng35UKQNf8FU
+���6��Ii=ȹ8	ˇ/�"*��#�^���*�����
+���f��g��k�e���4�v
+c�$�$��d�z�����������n<�
\ No newline at end of file
diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age
index 11fe1a434bc3a69ee7e9413cbf3c8e8ad15c2018..1ce82a2bc226268b016fedc9764b79924d40e4e4 100644
GIT binary patch
delta 329
zcmaFE^oD7IPJKaYP=>j=cCmACaZY7qWvHu@uR(-=V4#I>nqOXISYSv}PKH59k#UBb
z0hgI+iGPMiX{m3Zn`yGQlcAf7r<s3pU|N)8m0M1(c1~ucn@3WCxkZR`K9{bpu0oKj
zXQ63QuxEx>XufA+YE+PAX=F~emw$OtexX@JSYTp=Q@w|IRaU5ZxGz^uV$`M$+x?jG
z_P*XHWhk?D#e<0o(SIxU2{pdCka6QtME|bk-Y%bCUwtuu-hZbbAKf+w%NJ?!O}lmM
zo~2|*bjxM&z|V#6PcS8LpWS-hcK5VWFNV1%)<vI4GYDQeV@=~J`~Pd0oeLPsdp&ob
zIlpu2kCoc@nwFpW=)}QzJXx}`z53LpxCCAU&-F)t`-%3yS9O@jFVq`0Ih?m=VdstW
j)@gZi8!ox7xm2>Y+%v64P~Z3m_uM;mvksonKj;krI<t-+

delta 329
zcmaFE^oD7IPJMDls#k89L3*%HadM7JiN2AAMPPAMcu9C*c4}&1s&S#Qg+Z8Kc0_(w
zIhT`jYFc7NSiVtOl&68Eez|#KVMc**qDN`6vs-qRbAWNAX-RfYNl~dsAeXMLu7X8w
zvY~TfN?ufWfn#8mn|q0gg?FWqYgxEah)IM=cu0n}f4!%VQAm!3K|0s+?Qb>bFfuUl
zIILLkSFrNd#1J*xO%CO^<f?gQKX1L$o!D0V&V*5Qs*A;n3(Hv!ADqdsD0EWmhPMY2
zvo7h0SzB+DcTJT$>^;d(euHq+rJ{sqFJ}HIn>Ed$<nH0x^0FS$^(C!`MFq050tF?l
zu4KKoUdbV}`HYa0sbK45#a(vW#pI36EfgYO@uq)OnO|gG_u+g0i*<MIZJJbaWx2qw
i6$u|NMT9e$U1PbB%kgI4V}2*D*3Zw*T(W%RBLDy%f`+vK

diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age
index da315220fb46a1aca5b90aa881d270076f59af3a..935f42a4ec0bb5916f2c865861513cf0b66bd311 100644
GIT binary patch
delta 695
zcmbQhHi2z|PJN<NR7zN?d!=DmVtIzMNpV<Gct&AvM80FBxv`Ung|@zLNU~*ckU_bV
zFITxqc#4rpQg%g_vw3!2zJG{OqHD29uA^6$TS~D@q(Ny!K(?EqYo%dHAeXM4LUD11
zZfc5=si~o*f~8@YM`^l(p>{!WWp031m2YLDcSv4Drkh1jh_j1js8>cta9DVVS7ceZ
zmzz<EuWMx_SD{ykvAIV<aY=S|L}ZCekW02%u2-;!W43Q{P^5WwaG-}taGrOlmxo9G
z#E;_P#i<n)WuAU{CB6m$QAL)aCXS{_d5J-$VG-WmrY2G8ra?i8j;R^`W|e_l5&E9`
zrCv@>`X!!;m05Wy#Xe=FrrKE++7@9+?&Tg;LE-7<r9MuDxu(UF;~B-njm$mtvqK_0
zoC`7yO)X6G-2zQaGRpEwJj3;!^*vp}vdf$@BeGN6iu01Wd@Mp;Je(YpJ<2TtvrKbS
z{X-)Qyh4*wU4xtxD@vV={j~iHjLZVGOFa!HpJf!U&oi>r_suLz$|&$GG0io1PA}BX
zc8YY*_w`8iiOk3j4=69KayBU{^vuZTN{Nhc4lu0>Ni2#=N)EELEDZO`HZUo6^vUw5
zbP5f$sB%fns!BB1cQ>=(($&>fFbIis4~{4{FiI&*F$(f_vB(PvDlSQKb&M)1(>KfW
z%@3}q&q{GOj118C<uX$2S##lmz(1Z1K`%Y@HnqI-SJ`&e_(#ITQxa)&mEHaSPLpy~
z`TMx!<}M$xEo`#SoxQhgeZYR}v*yVu%T6x5smLZ)#G7*1?Dwf6vl_pvvTa|ORHgC*
zCyFR0DlNL4V5JvX&=;My^unqIs}nPBihn#Eq_E3zu8bZ#k9w!QLq)YQ<3m+GXE$%t
iNwy1}<g~kQ=8CWj9(#8%fBg@(`huc}tm)ov3>g5~d-R|H

delta 695
zcmbQhHi2z|PJK~Oj(K>pQ)p#!WmKMXL~3b3da83ks8di@j%iv%QkiR!e~D{wv1LG3
zK37qqVQ7wHQCOy%V|uA^PD-kOpuVS>eo=8^aFIc!d$4a-U~rC6n6X!IGMBEMLUD11
zZfc5=si~o*f~8@YM`^l3poO+icutyem3L}hvZY_Sfm?8qv#DpgM{;P9WpK8)ad4`B
zYDGv+Xt7~BS5}%~fNNl;k70pXRl0tdt6NcKL~5F;f0kKEW~gs^M2cBjSy4q$NLp(7
z#E;_PJ|+>VrfIGbc@bgG>G`3#A$k7!A=(zfeibGm$rYuE*=EJwflj`m`e7DaUM2dW
zW@TX^k!C6Wi53O=&QXq0X1UqHWs#0$RVLYHhT%qKzG;D;;YlWw;~B-nL&F1&6C<?)
zd>jMPA|n#R%yN=*!;*}Ql1mFMLb9@Qiu5A`%M5(VBJy0ha?(Qsoq|H54D<~{-Q0^a
z9ZkJ_L(9UAyuI|b-K+EiEh;SvvyBVf^Q%H9pJf!Uk4Q?&H}(v&NH31440JB_tnx2+
z3Xdo(b9Hj`$Tjk@%y$WJOb^U2%#JYN(hjMpFex-CH7^d#bF9pEFE7h9Dt2`W^z%+L
z^moZl_suqNHA-_ab#zPT($&>f@D7ViD@iOchzxZyNH<Qj)b~t@OwVxji1KwYa5m5O
ziquZ7FUt*daW~A%=bHSE|MaRgZCkgV=RdoaXPrfQ)~p2+wnesh)VfTwTd?@&)5P|V
zOXl9?Yk#ZQel-7*rr7D86KBe_eWg{r-bX*Yt6eXe^=$zc-+?k~``tOxMv0=!cJT(K
z-@UD^dRKAb*DF1|3HLW{v~`v$ee1e6Az$^Lm{5e|**$tit9%moMdr+luyT`2h*z&a
k-?3EwdCT&(vz#6+YYcyDZjj&B)^XtnH%s8JY5!&c0NI58U;qFB

diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age
index ba1bd5299017489b97c386061fcdd017e897790f..a35f4dcd9238732d4fbcab10b723b338fe169ccc 100644
GIT binary patch
delta 823
zcmbQhK7oCLPJLoYl1WLDQ<+7DlW(a@xQV|-WM*(~vA>s@esH>(X;esIex|=urC)MH
zI+tmrrDvLng-cFFc1f~pafzi_hI6oXXu4NLa6wpPVZKjLW?G_eW_pyiBbTn7LUD11
zZfc5=si~o*f~8@YM`^l(qosLJVyJnlYm!BInscUarJG-PdXAq<xqGmAVU>4EwyUL+
znPZM)PIj09SH7uZsdG_ASfXiCYNel3Nrba+c2#<?K|qN|aHvsQSU`4Zu4h!bpSF|l
z#E;_P<^jb<d4+kU78V}b&iR$)Vc{uZ`IhMsZtniYj%CG>RV79lQ6`SLSvkdAiJ|3D
zhVGVur7ns2iKP~XK^cWkRY86Ro&m*$;eOiXp;ft+d4}%6`R>`1;~B-n3QP@3wNnbU
zU7X9jBZ>{OTwDrW${n3U{EgEL4a$ovqDu8M%(C=Nd@>BUO7ijyjh({M^ZcDXosE<H
zqmoJ^DvSgDv=bvzg2N0lN;8Tpe0;RS4gDvdVU(yhFba#Rj0!Lgtjse{F*7SHOiA_*
zD$))$^7eGqPD-_OuQbUi@pm#YH1g#tw~R1x&P{a5GIaE@OpOYw(6<N(C=AXicPoxc
zH7YT8wM_JgEK5$d$aLk>)zwvS_3|z=36Co9vdq*kEzQZw@kp}FNzW?uO$~E$bg#(D
zH#e!zugoZnbag7{(!ccOyUPzI-io<g>Zh~Y%}!*Ne0p@@Mck^Yv<BCClhi7HpSaSl
zb~Q|jUAQ^Ddhg@uca+>pJ0}Na+?>~VS-W=Uaix}qh^JYr4#<>V`s5~jebr)Kk+a+M
zl20<4c%8ku`LFWir3s&`4u@>guzokAVq<}kN{#lDFZK6CWM^5-aXjoB%eh1+WGi2-
z-RZwSi!I)3?%0*47r!9M`=0!fmK*lLFO@cIEcEY)p0UxiETg@xNo1dn`l&A&{cOLs
z->%_Nm!H$AQxFtndF;mYh4Q;U?%{fOB>iUKp+mp>-=+4wlBnJg%Y5NAPiI~Ycbnb^
zk#1H07>0}`Nz*6lyG>elD6hpcEd9t5)2lI)1TutJuV3+usrhp5;p-fYFGcY(N!;I)
O+zy)lnv!YM8U+BT=s%JG

delta 823
zcmbQhK7oCLPQ9y>TVQCCi)V#@nO|l~SxKf_ex;>BL~f9KZlH0Lvvam-phtkWsiCiN
zBv*E1fpe*gQ=)lTRfM5Qeqw}+et=hHly9L&Wq`Sdqkp7%NNHF|nTfNJ374*&LUD11
zZfc5=si~o*f~8@YM`^l(K}B(~K}5NCL7Jm}SXzmJxm#$JTXC>KR;Wo%YNWGyvUWjw
zW|*&jWM!}`SD?OsS$R}gMY?yMXIZwVe{f}CiLsNTkz;5?gmb30p?_M2VX?NGesXB~
z#E;_PjsgA_Zeh-TxmDpVZoZa=`kqnAKE7$?`jrLFd4*L)+NDMjW-j45{_e?K+POJ_
zArY13ff+_VhLQe7VIF2Kjz(Ek6@hsX>7{x4E-sFl-eKluxgoBT;~B-n9J7kbL-JfJ
zUHvi~i;|Q4E6sDwBXc7w{Ves1Gs**#!_sns%RF)n0>ZMnii$%#BXTNDBl5#5f?O+$
zLNar6+$~LglM+jPEOR~F{QbOA@**lt!a^pWVU(y(Dl791Dk!il_Daq2OU_Jn&kJ`g
zHY|zAPqHvi&D77f)Hcit4oC~E49(|Cj&wE*^meica4YwZF!VRH4EFHS_ASq{%nC^K
z%5ya>Ebz;B%nhva%+BZ1)zwwd&v156@-Ry*3otA%^(f3riZHXNiZt|a%?@yk@{9^A
zHubBwaL+EX3~?#u(r@;gJ*Vb@#m*0!Yc!a96OVXZ6RlMb(B+%Pb?e%@;*)`8-;Xmf
z?be@B>v_&(gWt);A)3O6oS(dl>2)iXQ2KE=`OT)EXO`ugJpCeGT_Ato>vZUZttLfB
zr2}|8ed>1?#2o1`^FP>Rxp`4>|KW=-5*oU)RXS2H*GuIdJJjLcr{A8UWy@k~<)d@p
z+_gGgcdPhAOlIqIM803>;+eUAhM2;YZ|ujn2ju--xi|1Z@Kr0%!@cvQCIoz6alo_m
zoO5sY2XDXdWci~zkA*8;d+!jd!qjzK^8He$t=dJgU4~CzbJW(ec!o`$VQd(}&nI1N
z!pkpkKSGO(JzGCqYTbs$*oCvLSJtOnR)u)XpCA6%cHMuAtDUn=ceFmg`ng2VMXcb5
NgF*Jp_y2!+0|0D=H~#<t

diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix
index f02c447..00d810c 100644
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@@ -33,8 +33,8 @@ in
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
   "immich_secrets.age".publicKeys = [ minipc ];
   "paperless_env.age".publicKeys = [ minipc ];
-  "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ];
-  "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
+  "knot_dns_acme_dns_01_key_config.age".publicKeys = [ dns1 dns2 ];
+  "knot_dns_acme_dns_01_key_envvar.age".publicKeys = [ vps5 minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];
diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age
index 003343f8300afc5d5371610bd1c34e05be4f37f2..33b042cde29b224bcf0619f0ec4d4d4a2bfc4fc9 100644
GIT binary patch
delta 440
zcmcb`e2aO4PQ7=cOLBgue??@fQ(1;(etM<3d7_b-L6&(?dS+IUuX|2pg@=E-W4KYE
zBbUBWPL@Tcah{o{M|OH;L1AiGM0Sx=W`&DqYF0#UQI=D(lY2>+QEF9kHkYohu0m#5
zV6mZ@iFa{9a+Xh#p<#JiW>9IliF06Xn0JPUYi3foSAAicX`q2uRymjP1LMft;E+|H
z0&boUc&UA#q0MI3j0K;vrG7m7^-EFr`24RYJ8V~0$}dzd2sb=7MfbkEI@{65|JE4V
ze15q-_&{QT@P(hr^L>sTb==f*@^#KquG_Bc*EJLu@<hqBD=MmdGh3q`%UNhWkNr>h
z&nDJ`*KXT{Ui@QS@A+j`+3GDvSh5ctDGNHOsl+InaPN1=dGqrh7Mx|~DT*%fy7)1n
zEXBN0Z>?`n#0H;y*;~QF+ZRquo?y+Cy-h3XVu55RQ`jr3MJN2uOxtwoeU-F>&Pr$P
zk7ZM1MZ~T2XMC!S;6JP7roml#OFe-12{-%XfVqvUjvCIr^+b45wx?mj?`>y_xu%=G
wN<DGnNLR+HO<&(s38Z{jJYQM*s}{qTulpAy9x!w~pfKU(k1Ko!Hy?Bc0F<M`-2eap

delta 440
zcmcb`e2aO4PJKvlL7st+TWL~SL{7SqzoUL(l~JluRiR&id0tS2mwt&)p?`sQXr*7e
zD_3?-ib<Zkg_B#6ew2y1r%8FaMQXXfzKK^+p?PqUpFwVjNt$-Jeu{gk0hg|>u7Yn!
zfn}+_yRlbNfOkM)Vz^JPp+|6GU}R{jS&?bFp?;K8R=r1YNrpv;ZzR`|kYlXQp|<iB
z%6wb(ekn<8zR0gG=u<bfq4LMHgRU>w^8W3dw9I@pd-&X?{<ZzVt!HO@PMX<x_x&{6
ziz})N)gJ^0PYdIk?dknVtxlx+@#U>y=akMVom<Z}G1OpX^uolpoi@Ie52r@@I^CP1
zW&31W%h!pUJt|(;H`E!t?Qk-<vMI0L?DMiZDGiJ7nI2(}zCJNa==dPP=c^c)DjfGA
z@Y1R;eU-s3EE^La`EOIzX+L2oe&ulKw}Zm@3x8@bKECp+S~o6DY=)TK%723T=QbRk
zu2E?o7~2rk<2~<_(S?ilLPxx+SoNB;JL{f>b#}AZt>47)(dnRhq2ZON%kpnes7-h@
uP3N*>rILik`$mNy7Zxt96KrYpKjczfw9Ak+u<@^kA=l>5nP=Cqp9BC#^}HDX

diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age
index 42f873b0fc8544ce5b149a02943205b0e0308cfd..cc2d8cb978fe2871bd2dd70c4e1e0da6b77618da 100644
GIT binary patch
delta 309
zcmcb?bc1PvPJMcre_mizNxrLvM_@!=j%RXyL0WQnvX?<ffvJ~?VUWA0sd=Syu#cIs
z1(#PuT3AZ9ey&qNd1*yXZjwcgrI&%ZcZG#lrB6skMO9(BW2tMVxvz0nGMBEdu7bB^
zWsZ47x~E&VPiC5Bp?;91Z=!!innz)vbFNc<m0x+1Wqn?#ab93aiUpTxxt*@~PJhl_
z;U-x>(-czm43}7`KX}I2-MK?dEUcyb$wFpF?qk`{9_DLa^g6B4o~)nJ;vbjhH}leh
zgtb@W{cYYU1Sp>0Z>4oVGv)KLHtUj=HbK))+nk&e)cEcBm*?T94+<)N6`Oa<Wz}md
zX(KKd{_p4X<ZJX|<pq+8gjtrS`71dVg=Qr=U9`KJ=v%huv5Hjj-13yyVo4e2Mb1SS
LuUXrnEgB5~h2eQF

delta 309
zcmcb?bc1PvPJL*xxk-VOPg<pZrcp*tV3od8N^!8EWx028M3ITFd4ayUX{K>fcz95b
zFPCwFb6U2czgJ{sVW_9EMMhRhM5TE~dU>#^rBg*oR%KyUUQ&QZvafN51(&X_u0n}^
zN>D_ZXKrCgzH3Bcc)E9nnWb}Dg;{DyN_ei3Yh}7mV0~tYX;4s@mkHN}*}AXlMN>Yp
zr2YJ@@YT^_i>GnYx7tYo`+jf;?LMJ*JT@h4_2OS{8&=yIFXN2ZvuE|pcgfNpe3+MU
zyByMHy&k61bH$CZ{_=yKRV-`_Uz8OsJ+?S7%{$`l?Xh>V){8YS54Jw^eyka2_Ko2~
zZ1~ycZ)rZc3lpd6Rdl{_?7RBr0H4OAI>BdsY17+21u8Z=yx+9RHNqjP{p~iz6SGZc
Nxhvb|Z4Un<0RX1wfLH(k

diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age
index 59f797a..da9fe8c 100644
--- a/nix/secrets/wg_private_dns1.age
+++ b/nix/secrets/wg_private_dns1.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg YCaoZYLxmyrcSVXaTqDeC25n7lwuGlTDfWPNxg9etn0
-xSVH1o+ITY39M7X8FNpj5liEW/20HTq0ZRxsoo3U8JQ
---- i8MfM8cVg0SJnNqUYeTQ+dY2FZ6yEhIGkiHgxBzTDYE
-
-F�0e�ҍ�Y�
-{s�h]�ƬfAp����B^��1���e�0!�3����s����"��j@��=�r��Rs��(+�"
\ No newline at end of file
+-> ssh-ed25519 LZU5Eg 8zZFvGVb6VIefxLJERJ16VqhKczWW2tcUEdSU4dIsC4
+5k+Qpn+ZloytTx4DhcgT3Il5lBlXIuNmwMvNKC1hvNY
+--- rEDDdmvnau74yyYkVHKGx8kKi+Is/s/Ygt7PKfs4dv0
+=@�_��y��\����-*垣��F<��KV^u�WCzZ�l���}oo
�6�h"��E��p��k#l���aʰ�&
\ No newline at end of file
diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age
index 64d55f036090e8040dab8ceeb11936677d515df6..5e3c22cc624f5d5347a08bf7cd53d6d9aa36275b 100644
GIT binary patch
delta 220
zcmZo*YG9h6Q}3;9QEE_>=U!&vTbz~{RB4c!8WmFRU+i5RlpK&*QIS_*7-1e3WSQ)i
z%@u0tTbz{cZ&+?xVQE-e7*yet;$mqMmYY=Sn5~~zSZ0x`pJeG|5g1_M%B8ETtKd@=
zmTp<@?B(tj>Q`10<WpE)<?9p@?w9Np<dt7(=9V5*7;2tw;2CJ{Yr&PtdFj>iH(iQL
zp6#>Pzx~)2ZFvugbL<;;Oxr3VuWV&srufo>SL&D_zq(_h>OQ^Ok-B~c!R`H@Z^m6N
X^en#fyf#N_+rHYRa~J6;T@wcY!kAIi

delta 220
zcmZo*YG9h6Q}62HsITu4kQou0o*Qo9ky2@Fn&IbCrk_`8Smb7E;GdJ_6>i{Dl%1Db
z%vDupnCP9FRA%hxmgZtvVd!VzQ&{R-k{sqAoSjw@m>3Zmm1G$dVp&*}&ZVoXt56!G
z?PzA0Y+&S=80uc?l3{6Jpq*aflN%Y}lW6W2YMJSg66&95;E|c-=E@~`Pxk54{L-CM
zJEfnl{=B?;n%KOLKT5M}rJwqGg|5Hz>df=nD<)Qpem62~(l-6bW9QOXvgy92?iuH;
X3!K^d_s=o^pWt+NS*iCswX??nz4BG{

diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age
index 1d0e1be..a3c964b 100644
--- a/nix/secrets/wg_private_minipc.age
+++ b/nix/secrets/wg_private_minipc.age
@@ -1,7 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q QdFcYSyIYFlrx1vOfnWaFzULi8AxYIpH1HXLRZzs+iE
-3JG+l7U6AXmWe/H9J1B3dFjD+GCNRM4wsNWR0CHU0PM
---- UXqL/EG0JYwnV4Owi0Gy4BnpW7QkgiF4z2P9Qskfq4w
-@
-��q�����,�YL��3�)�eq���aK@]��e���x�C�
-t���v-G!�}����J���i��$=
*��
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q OK8Z0x1tfsdGQo0Acqxj99IDVwfRRO4nHmtBuwDXpEo
+FNfKD0EJ3FMQ8neRd5tNldCLp9Wk2K4/wlaEjKQPxPQ
+--- y32/fNgc6fz2cAr76vUej99Xu5DMcmO8bDQepK04TRM
+ѣ`'mo�HK{O��-����Ёy�l��,X49��
'+�t��r&OK�^���
ߚ>
+�(��G���>�A��n�
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age
index 5dd33e1a86e3ce1990b794961fd8f04b5fb08578..c88ff5f8f42365a90f8000c0d1a059f95aaa2c81 100644
GIT binary patch
delta 221
zcmZo<YGj(AQ*V-ES>;n?5>^;sTxD#U9ANHTWRzO!8183M?pkJ+nrQBx<!BO`<ZkX{
z!If;1@1N;k7?z&lo9!LoRFUmf;Tfr4?2{krT56H+US<|zY95+i=$2!c&84fWtKd;k
z8Q>pOQIs5zQ|#pB9hFs5Wtf;!R^gSDS>|t^;boW|5@uYM<msN3<;eAb<HY<E6Q+rT
zwM1!rSN;|H<<u6*=9i~<R{r8&e}l13-&){u*3?6{0_r&=BhFPW)tM!(>zSXkMz=Kl
Y?z4I720O%3(=?B6-KSh&kaBzl035PY%>V!Z

delta 221
zcmZo<YGj(AQ=jaVRBUWuSeg=?o@$impJiU=6By~0RN(FH>=xl0TA5Rs8tLqr;vZ;K
z&ZS=vkZ)A!lIs&>=~nKat)H8osqbQzmTDdnY?K!jP-twL6Xcd;?(LHq%B8ETt56hZ
zP*h$~S{7*<72=VZ98{5}?Gllet)G>l?O7C@mRaOu7FJvtmYkmCk<GQ?S;*^S0&Kpw
zufI4sm*L>C$uooFC!Try?(6-d*MgSFblm(r!Q;ZTnzNnmuAe_F4OaInS${Fj!uSh+
ZmY~PMiUK$8&!--)IDeJ#f6~5v9|3Y<Tgd<b

diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age
index dbdcbd2..b951cf0 100644
--- a/nix/secrets/wg_private_vps2.age
+++ b/nix/secrets/wg_private_vps2.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug MzqFl7ZTH4laSYXRYPbIiXadl/bqVXPHRM7wD5aLhy8
-Ng19G3jaJJr1s33i0kCHxIUQeTmoISTN+VQQD3rB33I
---- JkYGUYo6Ys48HI9UpXGardgf+k+DC71dxLiXqxMmFEQ
-C���q�
C�!�n� ��ƈ,�b�A�8"�MeNьn��M[(�֡�Xͤ�X+��~�ؓ��S�n�KX��i�8��>
\ No newline at end of file
+-> ssh-ed25519 91VHug v7DD5jgO2eah7KvV9shAkyFRG1zce0kKKD6U/QBIzCk
+hKwCVfnc/5wKEs2ow0etWhet/8+AT318LOnrEgTVEdw
+--- WWKcK5xf8FeUsA7atbz8r/ScBM857aXQA9mN9TdpRB8
+Ђ��/ ?K!A>��9q�mׂ���,�l�����^[pĻ�!r�mME��zʀ�O�`����q>q�^cR�K�3�
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age
index f9b5098fc0a5c5f760dbf1d7cd824ef9159b2cd8..63c109dd3f9a36183c4406247a5fb86a3ef7de3c 100644
GIT binary patch
delta 221
zcmZo<YGj(AQ=eV#mXsM)S?W<zm1F4~;Oyy<6Ox@)Zd8!xmt_={Utr)=n&}#qn-f}L
z!DZp5ALeRU<sFc3V&olIs-NzcQc&ub=4%n*Y?7H77*UiR6clJ`67CU|%%!WVt6;3{
zY8hq{X^~~-6jo?p?qeS27*$kkURYsTWMYvNP!y!E9hOy;7FFt0n$Bf2`=zo#rO)2Q
z?+a_U%POsD4Q8{~nl(SZ@k6HGM(?%y0qazj`qjOiWTDsR7`4ETN6hh^Rq-k%hc~*X
Yvy{Fqx3Ay-Q~2baT@PKXFMM4F0G;$w&Hw-a

delta 221
zcmZo<YGj(AQ}1k6o?;RjY?=}pP#WZ|UEyw&oS2)J<(=#knNwQjY3`aHZW83<TNW1K
z%H^8p8(?JM=i}n!<?WtqYMGXmkzVDMq@5jR8Ic_jYV4XD;!;p$>}BCy&ZVoXtB~kp
z85yEoY3ku+SZQqGlW&;o=2(?cnrv*G;+|)cnq}yn7M2zfn4RtG>dN)tm%w-Sk0rk*
zvbP;h*>Gf;@RAd!SIhS<iO=S!lk9!CBi-4T@tDs44+myBiymp&yJiXFPA>12hg&%!
Z7jI+y|K#<adx8w@LE8Jo+U|X@1OU=vRVn}g

diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age
index 0674d3af8208e95f4c5c7f67d6ab0212583bf7e3..44987eb036a3482450199717ed7ea857a94bdd16 100644
GIT binary patch
delta 220
zcmZo*YG9h6Q=jB)s&88AlIfbAYnB-4RN)@v6q*wr9FXN-;A~XnX&&b0=xtzBZkXYb
z%oV6#6p$U6>EUhaSmYfL80MZ?UJ{&H;9OP|o|EinWS*iO=;>YJ>gE<%&ZVoXtKgHS
z9cJlPq@C|)n&y$=m|Yd-mso7!XJi=W;Tag5l9-X_8fs=?SYn>-9m;iwb*IL&Nx?@g
z)EPLIel?T0a!xLCenqg<L1hW0iy!#KHyvXRU7tHk`Rps<Wm1!}?k!)i_m1)k+Y8bS
YPk%1#)0ep`%Dm(5p$!ka7cMvf0DwqRdH?_b

delta 220
zcmZo*YG9h6Q(v6#?4OwLlu_(hmX%m;WSLQJ7HH{}UF74Qlose(o?cw#@0nw4q3!Hs
z!Bv`NXzrUCqMuw88lvqJ;bs})TA7n?Xl&>fW|-_9nB*4`=ojwnX_%5#&ZVoXtKjPx
zmTw$knCowl8R~41>zZ#;o|NR0<ZWn~;a%aRU*(#d7Fw7VWa3m&T+U_0`lmMfkEc#?
zQ@H*Ui*++ree-sie=b|Fi!H0F$zzR<MqVYyvinmkN<ZH!)Qbx!I=hPFzVqMdAC~xD
XNzi=5Vz_)k+MLQSIuU>TFD(QBD`8Vg

diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age
index 5bef662..2f52122 100644
--- a/nix/secrets/wg_private_vps5.age
+++ b/nix/secrets/wg_private_vps5.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA Z8248Zxd0dGjx/YtU3cVKwuKMDRaHQpo6d21bwSOWz0
-/7PxJCz7yfuGuBWioDQMizW9+tL7Ku7JEB2h6aG4vmE
---- xEBearw/OGRugS23zBrNGj5zKY/bNsot+UQOcCEATWA
-��!�p�%~�)6-Hy*�e�����
���g�	��p�Xѷ�Ӗk�� و��m�4b��n��������x6d��e
\ No newline at end of file
+-> ssh-ed25519 vT7ExA 1SyRWnZNW7piWgD9AhV3evIk5qmlPZw3vtaYysYPKUo
+vC2skZEXjrM2HgU6nhrzqZhwVtIZWrZyaVZwUp5PE5c
+--- 46tHy1OYd8fqnjpLu+MVYrJyPaP6UdgubrsvhI7KO4A
+��J��HJ�S�v�}��+	���j��/��
���MJ��P�+~8A�웧�f�^ۄ�lj�K�AbH��5�U"@
\ No newline at end of file
diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age
index 05e6159..401e63c 100644
--- a/nix/secrets/widetom_bot_token.age
+++ b/nix/secrets/widetom_bot_token.age
@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg XJWJcqVabkHFOrbsNTS6+jc/pQ1a4D8lZkObT8BZwiE
-DgFVt1+01MNlPm898/qnC0wGbs6eEsLcHpyANA5tpsA
---- VhhquCcml82lpKjXLecBoCz/2CHNl2S9htU2iIWfvyY
-~��'t/!Fb�[k"��y�f�i��ܨ�L��G��g!�FqZ�aA�3
-�i��E`v�8��<�1F�mp
x~��)gc��7R����&%U'X�DD
\ No newline at end of file
+-> ssh-ed25519 qM6TYg p+Rts+QHTmO+vPpCHEp2LTAdPF8UMq0BqoN3rAPzCgM
+g5RaqS2rCOdp8/vllNb3Revq+bfDdHQkwYKsnNRN97c
+--- Ws0i3nFuR6DNeO1RpdUvc3Irt4I3HuzBtPgxXsBaOvU
+P���n_8�P��lJ����P(�l���*=V+QX�=�R�Ob��f'l&�u�U�=�F���.���`s���
·�_�&��}�ά-<�0�_-�
\ No newline at end of file
diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age
index 374e672200052d943c1c7ae3029b858fc3708132..34b8537e4ddcf8a605d2c7f600b78a60f1d64382 100644
GIT binary patch
delta 4000
zcmZ1`zf69DPJN!UhrYi@Sb2DQl4E+JM^S#TpQoXTsdh<tmU~7>ny<gPVOo`IhO>`B
zHdkm_MPg)Lpl?})uYOWgx?4b|PoYJcTabUISzdlpL`0-vS(tNhK$vl!Czr0Su7XEN
zg?FT(f4R1&zHwS{s$+zOSz&>Gl}l1VW<|J>uY0h6a($+crLTK{b0C*+ZpS~450$qH
znfSDJm57RO$~n%&sb)6wyZ$?2w=18_SgQAid}lt@DfM-i@hc6cvYfOgOJ0Q=ifLi)
zIq#m7?^AHjZT;!DCnEZ-<?l%`YP>AZZ~tZdcJsXT(>1~CG8X^bxjol<X6Y98&o@>G
zE8Sfkl*ISlC}?Z_S(b&$FSHLGOmy)tYw-$RzT*BYfjJEZAKEuwc(8o>x(m)bO1GXk
zK51@-Z0g^p+*egqPL;Q1CimQ5sj}^G)kfL!BK`A=d7j^VeS**X;ZoPIiFHyos*N^W
z;f5A50XJjZT^D<BM80fY`10cHCimr1Zx75WtopQuv)#BcW!0DZMBe%{=U$2iopjps
zRZdr6%`IJfiH#z0Jd^sKdK9nLw>o%g`lP1`B_W&Qth3tNSXNZs3)j@TeCdsoSsBY+
zd2hi-+Go#+x2u1Ye|poEH}KB+%yb5q7kw9`9~7yivvk+2`y0OSK-HP)ck0^jUy3%|
zAh6jtx<h{Uuk>5j`(!Td`F2zALcOoitcH?R_c|ryD}T(&@%?5xH|X1!jRwM6YD_m5
zyL;VsD7SyG=t*%wN65tckFM1hd^f6MTKDd34`=9%oW!^O(T$?w(XL!6DZWhSr|o#1
zv?t5-;`iUD1+(@&Df`@|s`XFGtNrpGdz*m$W`<=4UT3jnUevV=GVNOyq5jQR&f#DE
zIrkIA$ATViHQV?2#cSK*vp;$h#bqL<@jW%!vy}6+1>d0~GoI!qxV0TN`uEds(zeH%
z1x{XfUzW_0U&*X;XZ77IiMpB1%XX~2=)*1Z{crB|7pu)Yd0t(vIa4g>!0?Mte@~}$
z_tga~#yosIe($z)Ma-&T__wRQYDxcg`Od3%=B=%lSZ?<HkKJ>nomC8*u7u34ja;_U
zZtnlgI|sGixA^m?{?@lQYtn0&e0kp!W6vYzzg8VF(R!Etvo*0?T+ymrm0!`|Z%W#V
z(DO;5r^K%Bo+)P@ARQ3+RrX=rr1imBr)T`D+4MebDc2Y6f9sBltK2=GYnycT$Q^+l
z+qg|OzP-Fz?n1r!UK5^c`oH3D*^B*`SGatjZPNnx`-?*T^s1v-555hW$=fLO-H|iN
zm)WB%)SU0xtki?AnGf4|{R~{0uyb{e)HUzPJ1trn|F7RBUuhj4eY)`NOvA+t^5$}X
z?r&cAZut)@BhLKbmbG1LS_Gf8d;DDYFOPS<Zf!>u$7<#BeAmdI^|RD(Ob&}<U{Jed
zwxrnlbJ+iOt95HUCc6Z1oGRda+@k34KSuN4Yfh_a!n%Cf8+M8L+Xmh&S$OZ;+q_zt
z>FX<ZZLslcY1t<j@H-;&Lglv1b5-iyi`NTHkq@rrGqDi;^y1y&rF+D#ukzrJV7$z8
z)bPZ?;`7cqhdB9HYW`{8_U%V~_H~|9C&Sh!O**Y`RFgX)^&^AEth56&?KbEgT6Dan
z_7T(DT0ZRx)0dVfmq+JKtyJfhO6@6J|FuU#A>)#HSH_c%M~_z={kzvsEkkNUVWIn6
zIZdlvqn(%jsvKzil=pOV;Z=d%cOw3t+pAkWr)bY^sf(`lbL%s0%ckwhDG5>7y}f=P
z3k%bgUD>u@*7Qt$Z4$_6x%2VaNS6F{dHbgYh^9S#AXf6Wc;4p=$C=)|miL(@HIegB
zLFFamRZ;83cYc#xRldb*rSH7d@`oo>)|?ZGanFx438`f-WM4b|R`buPZ0}Fc>2>%t
zA*oGE@$<bn9rdl=;g&XatLAPpD#`u7aUsjOY4!8>iMT!yz4$vy=56`DZ`Fm0H?wEj
zzwvrF*>8)f%;YIa$#dgbzv)~#CAR!d-h9<w7Trxsw<3z<J}K-y+TPA*C((39;ekts
zyX=2i^Xne_`Hq}D_x0{u-wl&|J!*b3%C6kakrOz-B4JyqXTXnTt5<W+TD&S=zUOi#
z54Y6XD|hX!>(@P&&OgQSZvD1XRX)5X=O<M49{rwBY_eBTi6{BxDGNpckM~XC=Wg%b
zJA2i$;#s%S1F~W~osJrr{mS$2To(3Is{F3WJXhv3jvdQ#!$R_|J!TRtlU;f`G*+VH
zmdm%ZQ~0yiFgrbY+HAJ!m1Vv8>2>XP`9UwAZCqfI{^j1aSx5KPzgDSv9Bg;Bn(xaC
z&Z)=ms(4&I^r7}+(oNS%N<q<vzv|-xiv)Ok&3`q2IXT6Cx~J-|vp*#K`d5U`Uyzb~
zaO1R7c7M4WQ@!5{F!F5{*y>j;cK4!J>X*9P{FZELJ<iW1D_J6qBZDqIIdO59?%Vfl
ztaB!=JKlAuBTDF!P0Zsj`7HIk-tHW{THl)X#@27L<&ad5N|N)9b<Hl<yZ=usQ&@j#
zT)0I#XM<gC{bJ#ZN%t0ZUvhZ)j6r5k&A)hVJ~0axIlVU_NxeHd4*6Yc;yg5;HzLG@
zt6{xd>0*CPjSEX(ZCf?HV?})R5+3E>D>olHzGCGKT}f+^rn~Vk`wx3OH#L#1-(#?m
z^*q~;JraQujN$J(#V)t~n{dI)G+N<k&C_W4_5Qcg3Uc%3d(=Pe+cYoojlJlrDf(>!
z{jURE=9D+TdG=;ij`|Cg=Q>MYeYy75o8@on+|_lQGTMboF?k$D5;I)de~Mns)h$Sg
zk>2=)&Gc@{s-3G!3byloXk>Fy*#AC5a7}&N68^2)S?@cmtL&Rj9+u5WZroMAgf%bb
z{;kDgZ!*iJvlBwOmLJGz*;@G7_T{I*-DkU2DT(gc+&lM1!VgO&O=e%WAFIV>V=fsK
zPM2BwbVjE(zuVTj8<jhCE8o3{bp2qL?J~1c?NNtPkPVyu;g7Nn0?ezg9bIIho4Rkd
zv6h-<z3>+C|FREQ8CHGzWm4SQpC<cl@7AyPW@q$wo_;I7Mt)6R%a*W-l8JYeqNH9J
zZqNPGXH>s={i2ow%PUP^GFVUGe3VgO(>d=&rG@yS|Ezt@9)TSjf3~Q9R}}uA;X6Om
z_qhIv?A?OrvuCo;PQNrINVGb+b$ek^Eob>=!5MkpqKE6*-_1A^)cB^xdE@TL+rnqI
zoMydq;?~YJ_ngumD|K&vuNPj|nYekCuW5q7@-^3(#FCbFhkkjI8P>!QJ*n}nR}*i_
zc2kz?`)zJMw_AEQCi#o(C+W-eym<#(N{<*a-&-LVWELH@-RzNF%&PfTzj(_Ie~`3J
z{PTR)W>){gsa?DDpVZfi&V7Dwb8#z6N=4)hEp@m4*B^{#`lZxb7B?jb*mwl9Kl`;*
zugTft&<;h(vd*gaLP0Lq?`41fwQ0ip{Oet6KP2^6v6Retv@2;v_(xCI_}}~V*QnTE
z`IOSg`R=Y1&jr!rDNYss(f>awXmO<+iik`)e2|;tiJ9elohONm9qViB%{DE2ZJCtL
z$0_qbcWN$Y5(m$I<8`SzQdjPOuS>grd6WOipXT5C&jcpx?%nn>G(uA>)#aLL)11kZ
zrSC;Pn5-vr%vJb9nZ8dFZ-A}%i(_jJdOqjtII&(V>V30P#jbW6yBTFi!khjVPp$IL
zOjxeE=N!{ggGKW<Xr*6l*l2vLwzi&ep>Oz8nH87Bn3vp>n{#oQL{Dh)z3=~KO%{kR
zP`|T{F(Z?iQSfSzQcK~ikKw95`#KgBsGYj2Y0<Us+1XWITB?HEtBTCmu0HU=T{iof
z_wqg+p*E38CoXMb5oj`;u_omxPwhQB*YjEt``+K0`@!+m!KKPtO}0-Cyp(at%(QAT
ztIsWq>sr`4W#7(<2_B+80T=)IX&+gVyg=o#<p=X$w{`W4eCIr}4miSeG<|c+4Tj=U
zu4dtgK)&OVKHERlOufwdY>AlFceRDAFN!t_Xy45$m$=Fu{FQ$b=j&{tuCwWTcHi9f
zSXt*@jN1Xz2?rX=7iXC~X>(Ltv{Nf%!x!t0rhk(4yaqA}-z|ABzMjJxye!~BW`t{V
z<Y!~HjQR5xOuKU-YvS#n4b$~_&Nx4q^D1jw*qSf%Yy%rx9^|Ury7Q2y<jsdl?#B#a
zD&Lg8WbA+Uaouj2rhkV_d5az`u|BWt@nO|LO)q!vYX*0GWcLQNhh^)W)j2(NQr)in
z8z#pLj=j9l%e1)u$-$C)s;_F2T^9acqmUrd$5!`p?{vOX1{+VTxDnMEx|X@O^{ebX
z`+$12uhFcNLask+Zrv`+ovWAeiCfutkwC`%&$-8<AN;Iemwx@$&c6p{XFYVyI>=Dc
z*;7%y%6TH!<u#?NVpP)@%NCvHpQLBkeRkFhsk`ANhc91tcra_8_Tzf5vwq({F5Z7B
z!RUqJ)>~bDTW@`R;UtvYE^EzFdtpMQqRM^g{cjSptlSPQ@-qpXYka+H-vcfm|KLZ<
z?`Gs|$V}GtI<s(H*4pZw4W=#o?~D8vYM-hc9<TZ8rplGQ((ms3E_?VbZZqd;U9a0^
zjZA4x#}hg<m1jh$+-ffr%J_S4QN6^i{7q(=4W|Q6wsH9#*_qOmnD_9D2X~IMb~ICP
zCi}k+k()O3`m4@pKAUyrMp{>l`J;J1;-=O+EZ=J9f9BMZM<>2*Yd^xg{HLu^&#7Oo
zA2%IVxZ%pCbZ-Bx+DEc=hc=m-_Egw0AM?x8-FV{U<2+9$S^Z@!BK5zY=RV+TfAR52
zeP)(eq=}P_M4a~~hmx}W83kd9e^{?oue{cs{L}xU(6@K<Z2q|MW-PxQbzqmxUDg_Y
zvxp-?b5`%j%F;Yk^ru1XiaE>w6+N$Og{^w+e@)lfTJ_>-b=2%VY&$DtZ_mi`T2SP^
z%_Q8LW1ek-qlo_6Ni9?7|MfEGX1CaW(Bt>|zzy~3(m&T<y6m|1-7aI9s^xQeYM1Yw
zYZ4+m_w@N=60XhLZ<f!vG>z%?|3&NaY{cF;vhuaRJ0)s(a9JhKK9=X__a)A=XkOy;
z=MHZ`-gGy!&j!|aw;J_Y+<O~(N9!|hi>LL;y7zuZmh{?9*`gh4_9e{ZLhLuO=hMqK
z9h$|!TQzs$wt{+A?z8Luy(^roR{i3Ot!RI9mVLI$L8+4-6Xz~Cq2Bs`#{x5U>ysC4
zUN*@5-WRT6{#|>Ds*2^OB>#ZBta{IWdwt*3>%ow+xQP2b*TKMzGdI>LO?%TCRrhfl
z&!ub?^R*XC61127*NGR|c`n4AJ!{%iqo^jo_^bj}8;#S_y$r%S^|I`JUPt#|W4~;)
z?fTS9i_d$@PUlX&7PVTU@O6o!tm%iD+ZOEIo!)5ksn^m@vMJCo&9(01Z;SF}d>o4d
z#Xi6AxBhi3(oBEjIqi_Du=2(nA?{70i>)^W`<%I9E>!tn;|60$uJ6&bn=j8DJ=yXj
z{_^!_LFsQId<$!J1ti|PJzpbv-nN>3#+?4;w>dgi9-k<4rnz^!^D_U{7hVAX#9^K^

delta 4000
zcmZ1`zf69DPJNPhURj8Xr?a7UqMM^ply8VnUWJ*lNpMMiYNkn&Wo3v<QCdZEd4^HA
zFPDE*VwI0$XmPQdx1X1DKvju_QD{V1Nm-tYyNRnwptoVJMO39<WRy#k374*}u7bOJ
zr9qyhaiCwBlVfCfl5d!kesOVyp>buXk9T02zh`h&c71lFn^B&2c`?^@H@{hr_^M(8
znhxGfey#E_>%gqLQ3tx%eq1{D{j`48y2q}^BX~}ExcJWf#$y;{7yIbZgDw7xuN^W<
z&=<MLcWLq_Ge(!H^D3VemtEQ|xN%xcbfkZ;mBAgpy=N-aZ5}6yZux9`%`j{Ks<Vze
zIFw`~tluRcs8nOD&kE8}%X(v7;=s~Uvbx(fGc$Gfecqq1m_CF)<}5Sols};UJnuHE
z_#zp;eJb?<;^(g~k+o-1tra+NN8;^eEw<vGp5-lfWVAf1c}_%|zdHM#zw@WJ(z1Yl
zPML?%DPb@FcINK3SK0V5;AP>LpO3ct-hU>#^Ic!z>Nigl{kASYm|5R-LTHiJvqmkp
zWTwCW(~_pzxnE7$xis20Bt)iS5l<y!#617!HdbF!pG=L451Y@b^y;1*%bUxy<)*g@
zK2PX4Bk`=>Iiu3|pWaDk&IN^=eps+fH(M1`@%_;C;`ofc$IPUxBMZ|NI30O6T@yE$
zDI6yL^<wCXybV8@-Y#X=EeaK?zp~t7LIY#P=@|@vzux{NuI2DzI^XS;FT(Xi0yZ*F
z?@d^@_rV_#!3c>tmt%S~ey6C#rW|cOG9zDe(K9Qr)4_`vGQxjWw<T}>oBy{W*6#12
z_g>vqjs3e0?Z2^+A-FJ=htXGTs>g<d4s2{T(cK)ULK1o2OxSfj+op2fqFo}7YQNRT
zUO%#2IIK8l{p$)f3)Vy1zUw-3`N=N2uwj$PD}zJJ{eD>U$Nx_J{7}_=W&&s3<GHUZ
z_>u&VI4E4WnX%mT)ert;={&K($?4OcTzBN^I#+*?RpRo3W3!g%L>{?$?3@_K)Z8nk
z@A*5{I4^vA=k$k*<!;Zs13zEYTw-;uTK&Nz?&^B4)O~zbDgHdHAyscn{+TrA$9k{V
zj?rnazAW*n^JT)0cgj2E_)oBWd7Nc`>!F6@n#C~-UpC)j)p#N8d|GPm?L(>h!LPq+
zToOwxnHn%@R?M0+QVnyW=PEV?NWM7YAM<O?I{yc?*Vl1u$WKct6iePE#QrG2@O8<F
zJ?&qwuHt;Pv7Te9&!+j;?rv5%8Jp;NW6k~y-=2`GS8D_oU0_{sE6KQ0x%ZpR!Eh$E
zQ!6BMj2{a<IuKmGB%{+qWo7w3wbO^WrIe2g&#TX#YM1hu<8=9#@P$kVXFF$R1a`~4
zpB?a4wQ0)A%hl1(v_)>evHB7J&{wJE>~7z$0ux;g9h<waB(XlJ-}^lAoVJ>@y~7rV
z+b2!^gx;ubn7|n8nt!$a-rMYD$L4+fct+Mcmh%)_SyKMvTXP>LzRFxbshZL0?~}Q$
zcU?-XW(o*sT(Ug#BT4#G@q)RM8`s6iDrL=edGK^?vysWR6SF`3dOrL2ne^fpHm{b|
z)t#JSI87&G$D~M$S>~zzqPGm{??iR=WxH)VArx`$*70j>tf@;S7iyaeDX#gvZhb>a
zeBaEhv|2HhuNrN~Y>e&ZZ1dkJ*pqgd>7GJt%HNs%855PdRn~9Wz@B3{bwMm|#Hs9P
zm+A|i)o=9$n$5BwTvZn5{S(`rT@n27!-;LoVQ<B(FV7ARYukRK@%x>In6}kTo9eU9
zUh%eD^yjAfT&|nkVKW<w&qs9BI~$uFyQU!b{JLL&W4}lKy|!OQzggzZO-#<vV_miX
zNS?;C+RdwDy|*S8me~lb<_%3~(92ABcFvGkb@Z=M!gYSn{T{J=Mcq%n@m-63&p3G|
z`^hEO1R0s5*M+_~v(#qI?eB{e_j~@dsa~&E@7nyQypiYqA>+e)eq{VSFTLXO7U7A>
z^P|r6oo5U-iO{lszN<pjD`@JW;*Iar?O&J9Iz3<MN`Lhx@tpVbnBxBMOx<gA>j2-m
zne#>O9x$IHI`e&fapC9AxCg@X-EPKOO;|bE=SIAK>>&@s{uy1tPSgI^TAj(b+!=hQ
z_D{$D8^2`h>$fae)n&KptjA#y<L=00i@vRLYqlf>m8}-ve$+nfMa1?^DvACpE_oVO
z2DnCCd(0T~+kxLd$HMjYff)zfywj|2A6x9{t@1E+$)W0#_1XH>ELF1C7Co)0ytXjV
zU~aRlPyeRxErFiP)=yzl^*!p?li|PTjc-T(jQ8eJzrDR&FV|;2&OM$tN$K;g=NZ*X
zPj)PlTe*`f^xpN$Hv(JgTEu1@zOL-^{?BU52G73Y4?lLttqh5<Jkhy#$5~D@2MgPl
z=6;=>bz&FPYBN;Y-bL5X@@V#(a{1=&J}G{aLdlxb+D+daiw?+eycI8B_*qME>E`sd
zBd!4%J8oMf>{VZ`Y|A59zke^!5~*JGYnOztR9h%LU%62z`67o~T<0!Z=HJt_&wpC`
zdUJNx^|c<)IUSFSy2M^9tqY$gdRz2z_KF;?Tc&Hy_-visbIPNTS+AJE|JJRQ<;?#@
zdXi2mMOmGW&Dj@v!1VDZwpq$@z8~yk9|wMueV)*AHOQj=xXQF$`9I{?JbCNCT{d9V
z?fCIZLaNI{C{XYH{Harxv0rX*cvLNLEa*tyf(Gt|UcVwGC+<<L=Mu<!D|Ln6Pb?(<
zZ9<a9i(O4J;ruO5b%9;GE*sZP;mnbmvU6%?f|Pq@rr!4L-|q2Dn_&DbMZ}F=fl2@2
zuPXb}|9XA?-A0FF;&+`cOgzzhU1g41{R#gaoRgNm)jeab=R3F7e$yl4CwT_TmuxyB
zyv|g2g}zy>=A_k{GK!P<zw(}UIy)hwF>+G!4v(sb437^7$H_j@-egjFMb>NDrr`V5
zOI}N6Yv;sp#?@r?2fF>A&br3oMa0ZkYwox#;d${fmhYk1`$ISX+V1t_@NTiIHjh&D
z?{%#|qwDR<^yird%Y6;0>Dv2P9D1%7uJC!g?soW7slY$y9v{$OIIp>T2j5eXu2~<S
zuXx<TwZUrF%j1t?+8o$+_kK#fdY#q0El6hd58LDm`HLsLS$b1HnMdQove2&c&6n=?
z?7XFAE_CGLKhA}@#d3R<?>?1p4$f^=d6i+S&egN)gkJsa?j<L(cg_?Dt9^2$nZsZS
zpZtw{dyXlRQDr-?nsH06)KKtQcx>;5R_|4R9vknM%D-=O;r(~jWSdW1@~nkrcP6#j
zK9F0rZkq7)HRks_F7<0YWV`FvcY4)3y$e&O9hHt*`o`Sf>P>r^?+LFHr8oLwCP-h~
z{rcrg=czkg4HyIV7u0`zBzUUpV8rLB@A+$tGwxlk6a67375Ve&x6j58pYMAvfAO$7
z&*h}am%`^nR6X|Idg5$o`-Ac`+kd`!d}Qm3l($o~;*S6Pw%_M2@4-Ww?_7@T)^}hE
zntMCrp$ON<@VLo_(^;lJDW7TId_-&En*)_rs_$CnCJS?=K4!7Enyhwb>Bf5TjSt?w
zeJjJoIO$<<WYHp*b340c^t-NnBr-{AWAdRzyAIi8@>uO+pPMZaZB<gQeregZIlqo_
z-DC@Fk=vA+Sv}{@lC<F28{-@1XSQgYO7Zu;$+`dC<=uuEpWGHpm`&JXslmaZGWBxl
z?o~G7T2oXuJm2Ycmcw`6!+p8=GIa`ff7P=T^qpS!%He(4wF9SaHbfrqs&CR$tFv7j
zXfiFcOJKHwN5a;w1+VT*RPjC-#(8VihhqL#@!-a+Pyzk-e-3}2;^djRB3j$bdEu$M
zxqLls>J5Ccvwjxai*jz#I-~z?1<(KfmwWx<<?fljFTHs;Xy&o*+PyK_e$fjvrB)md
zeAr=Df0n7gQ`B<tzd0|GKXBwWCB0j)&U7i)DeLu9oFdE?dh$PYbTx`w{O;|gdqPgT
z&qUPznPT^@T2OYc7u%_m>wmr}DqqkX?z&|w*MrQbYhNx`StQ`kCi`^btUEF~TQd?|
z*)!yA)4MD(?0gngFHo57bka8V|D4q5BaH>JJ07Y%TNqHk&Z;KMFf!6%M{B~*Uu_4Q
z@3e@WIod3HhIx<kLMd;b^|>$3YECib``amcXa5uTYf~56gfITIX%EYSG?PgM4;Hga
zT)CJL|3oK$!=a09nb}V3`Rk4<^BL(rz0@jSQmG&*DRkss$mLFTC*EBjCR{LIBD4Nb
zQ-R!3_RL(lyRA<+Zq|EM?a9)5blxXHuKjeDsgT#Xs<rP!yrL|cqmM5-;eTfF`V~@d
zZb@GXZde+AJah6ki>urC7f18$DVuElNQe7j@ZtTv8dJ8h&S|mSw)fq+mopw3#XsBk
z@i<T21d9~mpvr^EI}WyNmSFtI$8bQ+HgW3`$Gh{*jZV5ujr9_<HVEquuIDm%u_nLa
zvETKJh8^1)dX=BB|Kh&$;(en0my%mMnWul8_T!n_gc;T47IsVgf>xeA5zgfEeDh@G
zYT4V{K9nr9es5Jj^H0x3>$BT#SYLP{E|k~76r-@HGF?*X`22{}+Zi45FRVnbZRA?h
zxyvcD^-|@s$z^+AOc&4;aS`EPQBc=ZuUg)6kU=tVdS8|03|C&Jxz_u>#PBTBFbpcu
z_^GeY-S=aK*xpNlI~rr{I8WNxJzL}VSY{t<vU8E}t>i!M2j(1$Ff>@#eq!d?=uexf
z>JP79r82iDQlwoi|L32DqHIAci?>N-=bVl15s9Ahx@fK5iZ(9xMElvnyE5K9aW7b%
z{i&Yy4HvKFenFkOoSIOUn=iV99HWbVTg}?ZToo(!s@VGH`&--1=h+qgPAuEuv`d61
zKA@+z?tq__y80%4gD57M?EUZWPkScpS@hUh<j8iZ^H=S4rte8isQYg$qxnzaOK<+d
zBxawTi|%a^*%~E#sPJ4_jl%J+3ESl?uOE>)Fzc00J)?J0#&H=@hCQz&GEYDGuu`3M
zsrnD)==&@;Q-8Ux-};B&PCTfv>0v`V*8|g3E4P_SUCeDITNb{%EGYXVsXLsti%GtE
z$6BfPaV}*~86`3wSnND*8@%nvv&U)GcWz}S?y)&*EURi*vXALZRrCQB;rF|*-Eigm
zsBmuo-gEE%UgxTBR~Oi5rnN)JJ@RDd<Y~Wetd8&hY|@--#PmD9BFi)G_ASdFy^cMa
zx<8Bm&e+Y%zjs;YZrSgW>=kp|)xUM{EYV-Jb-u@e^${{tKN;+;?D~29$3c&k`b%0W
z!|w%rwh2ho@8G=mNbvo==mnQr%QOpS_*^v=*tuXi-z&eCB?qIHs@C6^xV~!hEH1@P
zPqE3JZaQl<Eq`hy-8J<8H@~Ve(%NIC)m`Ur*Y_N}qI%Hlhil<B@464OgkIjbk-Bk3
zAmb+cjHPGix!(~JDAHLoC3MN;^CJA7jfdX$skvJ1{J1Q1#rqY<W#%vXx@yhsv&v=L
z1^Z9--hIvK8W=S@YrXcgdixb3PbHT>IQxPjU)i;1O$cvet9YIFmHP#;E6kR>0|1Nv
BnneHr

diff --git a/secrets-git-crypt/knot_dns_acme_dns_01_key_config b/secrets-git-crypt/knot_dns_acme_dns_01_key_config
new file mode 100644
index 0000000000000000000000000000000000000000..e1802502072e3ebbedaa296908b6a63b29607778
GIT binary patch
literal 201
zcmZQ@_Y83kiVO&0xWN;BS@z&HuCE)X9WAnr`+DN_gT*bq@f>BWDknXiwl~*i`hNL&
zZ~CKe8<%bPBiSQ<d#201xPr%Qh1Q8KYGEJz6d9CbCj33W<&xb*lj(&|Zdy)#eXQ`Q
zW>6e^bNI1;?x8<pxGyN3tNu6T%bDF`wJHZyCU>QDJo>uySMkHecjxn@CY)y#3h(Ed
zko3WTjm2X(Pqodg+p_H2*vuDbU(q$2cE~VJtm#8jC+ET#C!3kY1%;)ihO-0xjBo!q
K_o-CaY8e11iD6v;

literal 0
HcmV?d00001

diff --git a/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar b/secrets-git-crypt/knot_dns_acme_dns_01_key_envvar
new file mode 100644
index 0000000000000000000000000000000000000000..c6793144e837a1ae3a866bf32b4234b6059d5487
GIT binary patch
literal 89
zcmZQ@_Y83kiVO&0U@h2UE+tT#Y@9n~sgr8u)iV`QEzeejdwhJ6v1Wnn+Gt0q*T2@B
x{*cG}!m6<Rk;L5HH~xHaJ9hGOj-CF_Z^yT8TWbC5`Pulz!F$Xn-d^$48~_*FE<OMN

literal 0
HcmV?d00001

diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_config b/secrets-git-crypt/knot_dns_rfc2136_key_config
deleted file mode 100644
index 61b3a36d237bff406f13e3dc15ff34ebdc0012c5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 134
zcmZQ@_Y83kiVO&0DC=SS8fm#-SoOQ-!ar;0Em}H7p{lfs_qU);taX0;{LRv<<9vlB
z|HS|1?iX7n$sMqN?<otPlBd2#Yi6H)bmEwzbI`w&+h5IdxzzA{mpZ@Imkgd>{pM41
sLJqIHtZyxOW5qeu8ysH*4xG5mpL+er+iRll^fS!=NEoy#e@g!a0PL$k&;S4c

diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_envvar b/secrets-git-crypt/knot_dns_rfc2136_key_envvar
deleted file mode 100644
index 5bb8e79a0efe14fc85b94c13d4e21a0e027b6d23..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 67
zcmZQ@_Y83kiVO&0@DY)CC2OB~;$l?&{>z*%_BCqVn`a&*6jiojaY*liOz)$9x)bN#
ZdMsBP(sWKE@T2+LE%s+lc=TOw0syQv9}xfm