gaming

nix/deploy/smoke-tests.sh

@@ -4,20 +4,28 @@
 
 set -eux
 
+check_single_dig_answer() {
+    dns="$1"
+    type="$2"
+    host="$3"
+    grep="$4"
+
+    dig "@$dns.infra.noratrieb.dev" "$type" "$host" +noall +answer | grep "$grep"
+}
+
 check_dig_answer() {
     type="$1"
     host="$2"
     grep="$3"
 
-    dig @dns1.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
-    dig @dns2.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
-
+    check_single_dig_answer "dns1" "$type" "$host" "$grep"
+    check_single_dig_answer "dns2" "$type" "$host" "$grep"
 }
 
 # Check DNS name servers
 check_dig_answer A "dns1.infra.noratrieb.dev" "154.38.163.74"
 
-check_dig_answer A "nilstrieb.dev" "161.97.165.1"
+check_single_dig_answer "dns1" A "nilstrieb.dev" "161.97.165.1"
 
 # Check the NS records. The trailing dot matters!
 check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev."

nix/hive.nix

@@ -24,7 +24,7 @@
             wg = {
               privateIP = "10.0.1.1";
               publicKey = "7jy2q93xYBHG5yKqLmNuMWSuFMnUGWXVuKQ1yMmxoV4=";
-              peers = [ "vps3" ];
+              peers = [ "minipc" "vps3" "vps5" ];
             };
             tags = [ "dns" ];
           };
@@ -88,7 +88,7 @@
             wg = {
               privateIP = "10.0.0.5";
               publicKey = "r1cwt63fcOR+FTqMTUpZdK4/MxpalkDYRHXyy7osWUk=";
-              peers = [ "vps1" "vps2" "vps3" "vps4" ];
+              peers = [ "dns1" "vps1" "vps2" "vps3" "vps4" ];
             };
             tags = [ "apps" ];
           };
@@ -98,7 +98,7 @@
             wg = {
               privateIP = "10.0.2.1";
               publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
-              peers = [ "vps3" ];
+              peers = [ "dns1" "vps3" ];
               noEndpoint = true;
             };
             tags = [ "home" ];
@@ -320,7 +320,9 @@
       ./modules/immich
       ./modules/tailscale
       ./modules/paperless
+      ./modules/home-assistant
       ./modules/caddy-base
+      ./modules/caddy-acme-dns
     ];
 
     system.stateVersion = "25.05";

nix/modules/caddy-acme-dns/default.nix

@@ -0,0 +1,13 @@
+{ config, ... }: {
+  age.secrets.knot_dns_acme_dns_01_key_envvar.file = ../../secrets/knot_dns_acme_dns_01_key_envvar.age;
+  systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.knot_dns_acme_dns_01_key_envvar.path ];
+
+  services.caddy.globalConfig = ''
+    acme_dns rfc2136 {
+      key_name "acme-dns-01"
+      key_alg "hmac-sha256"
+      key "{$CADDY_DNS_RFC2136_KEY}"
+      server "dns1.local:53"
+    }
+  '';
+}

nix/modules/caddy-base/default.nix

@@ -6,7 +6,7 @@ let
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
       "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
-    hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
+    hash = "sha256-EGkboqppRr2xcZ+7ie+WrqdP8sHSoouX4STl4NajMYs=";
   };
 in
 {
@@ -32,6 +32,7 @@ in
       format json
     '';
     globalConfig = ''
+      email tls@noratrieb.dev
       auto_https disable_redirects
 
       servers {

nix/modules/caddy/default.nix

@@ -7,9 +7,6 @@
   systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
   services.caddy = {
     globalConfig = ''
-      email tls@noratrieb.dev
-      auto_https disable_redirects
-
       storage s3 {
         host "localhost:3900"
         bucket "caddy-store"
@@ -18,21 +15,6 @@
 
         insecure true
       }
-
-      acme_dns rfc2136 {
-        key_name "test"
-        key_alg "hmac-sha256"
-        key ""
-        server "dns1.local:53"
-      }
-
-      tls {
-        dns_challenge_override_domain "nilstrieb.dev"
-      }
-
-      servers {
-        metrics
-      }
     '';
     virtualHosts = {
       "http://" = {

nix/modules/dns/default.nix

@@ -1,9 +1,9 @@
-{ pkgs, lib, networkingConfig, config, ... }:
+{ pkgs, lib, networkingConfig, config, name, ... }:
 let metricsPort = 9433; in
 {
-  age.secrets.knot_dns_rfc2136_key_config = {
+  age.secrets.knot_dns_acme_dns_01_key_config = {
     file =
-      ../../secrets/knot_dns_rfc2136_key_config.age;
+      ../../secrets/knot_dns_acme_dns_01_key_config.age;
     owner = "knot";
   };
 
@@ -27,42 +27,57 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
-    keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ];
-    settingsFile = pkgs.writeTextFile {
-      name = "knot.conf";
-      text = ''
-        server:
-            listen: 0.0.0.0@53
-            listen: ::@53
-        
-        key:
-          - id: rfc2136-update
-            algorithm: hmac-sha256
-            secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds=
-        
-        acl:
-          - id: update_acl
-            address: 10.0.0.0/24
-            key: rfc2136-update
-            action: update
-            update-type: [TXT]
+    keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
+    settings = {
+      server.listen = [ "0.0.0.0@53" "::@53" ];
+      acl = [
+        {
+          id = "update_acl";
+          address = "10.0.0.0/16";
+          key = "acme-dns-01";
+          action = "update";
+          update-type = [ "TXT" ];
+        }
+      ];
+      zone = [
+        {
+          domain = "noratrieb.dev";
+          file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
 
-        zone:
-          - domain: noratrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-          - domain: nilstrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-            acl: update_acl
-        log:
-          - target: syslog
-            any: info
-      '';
+      ] ++ (if name == "dns1" then [
+        {
+          domain = "nilstrieb.dev";
+          file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
+        {
+          domain = "noratrieb-acme-delegate.dev";
+          storage = "/var/lib/knot/zones/";
+          file = "noratrieb-acme-delegate.dev.zone";
+          acl = "update_acl";
+        }
+      ] else [ ]);
+      log = [{
+        target = "syslog";
+        any = "info";
+      }];
     };
   };
 
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
+  systemd.services.knot.preStart =
+    lib.mkIf (name == "dns1")
+      (lib.getExe
+        (pkgs.writeShellApplication {
+          name = "knot-prestart.sh";
+          text = ''
+            mkdir -p /var/lib/knot/zones/
+            cp ${
+              import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
+            } /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
+          '';
+        }));
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
   services.prometheus.exporters.knot = {
     enable = true;
     port = metricsPort;

nix/modules/dns/nilstrieb.dev.nix

@@ -29,14 +29,11 @@ let
       ];
 
       NS = [
-        "ns1.nilstrieb.dev."
-        "ns2.nilstrieb.dev."
+        "ns.nilstrieb.dev."
       ];
 
       subdomains = {
         ns = dns1;
-        ns1 = dns1;
-        ns2 = dns2;
 
         localhost.A = [ (a "127.0.0.1") ];
 

nix/modules/dns/noratrieb-acme-delegate.dev.nix

@@ -0,0 +1,39 @@
+# https://github.com/nix-community/dns.nix
+{ pkgs, lib, networkingConfig, ... }:
+let
+  data = with pkgs.nix-dns.lib.combinators;
+    let
+      hour1 = 3600;
+      hostsToDns = builtins.mapAttrs
+        (name: { publicIPv4, publicIPv6, ... }:
+          lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
+          lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
+        networkingConfig;
+    in
+    with hostsToDns;
+    {
+      TTL = hour1;
+      SOA = {
+        nameServer = "ns.noratrieb-acme-delegate.dev.";
+        adminEmail = "void@noratrieb.dev";
+        serial = 2024072601;
+      };
+
+      CAA = [
+        { issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
+        { issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
+      ];
+
+      NS = [
+        "ns.noratrieb-acme-delegate.dev."
+      ];
+
+      subdomains = {
+        ns = dns1;
+      };
+    };
+in
+pkgs.writeTextFile {
+  name = "noratrieb-acme-delegate.dev.zone";
+  text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
+}

nix/modules/dns/noratrieb.dev.nix

@@ -97,10 +97,15 @@ let
         infra.subdomains = hostsToDns;
 
         # --- internal stuff
-        internal.subdomains = {
-          immich = minipc;
-          paperless = minipc;
-        };
+        internal.subdomains = builtins.listToAttrs (builtins.map
+          (name: {
+            inherit name;
+            value = minipc // {
+              subdomains = {
+                _acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
+              };
+            };
+          }) [ "immich" "paperless" "home-assistant" ]);
 
         # --- other verification
         _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];

nix/modules/home-assistant/default.nix

@@ -0,0 +1,26 @@
+{ config, ... }: {
+  services.home-assistant = {
+    enable = true;
+    extraComponents = [
+      # Recommended for fast zlib compression
+      # https://www.home-assistant.io/integrations/isal
+      "isal"
+    ];
+    config = {
+      default_config = { };
+      http = {
+        use_x_forwarded_for = true;
+        trusted_proxies = [ "::1" ];
+      };
+    };
+  };
+
+  services.caddy.virtualHosts."home-assistant.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.home-assistant.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.home-assistant.config.http.server_port}
+    '';
+  };
+}

nix/modules/immich/default.nix

@@ -13,7 +13,6 @@
     environment = {
       IMMICH_TELEMETRY_INCLUDE = "all";
     };
-    openFirewall = true;
   };
 
   services.postgresql = {
@@ -30,5 +29,14 @@
     '';
   };
 
+  services.caddy.virtualHosts."immich.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.immich.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.immich.port}
+    '';
+  };
+
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
 }

nix/modules/paperless/default.nix

@@ -12,6 +12,7 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
       PAPERLESS_TIME_ZONE = "Europe/Zurich";
       PAPERLESS_ADMIN_USER = "nora";
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
+      PAPERLESS_URL = "https://paperless.internal.noratrieb.dev";
     };
     exporter = {
       enable = true;
@@ -20,5 +21,12 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 8010 ];
+  services.caddy.virtualHosts."paperless.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.paperless.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
+    '';
+  };
 }

nix/secrets/backup_s3_secret.age

@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 7Skt5gktvb9YK6/irBF/1+75lfq21qcgnVKsFXHm1l0
-L2uk8HCySy14opdPdZqNvHIphuJ8oTGujCWY3NtxvWk
--> ssh-ed25519 91VHug aKHSBKih0l3EhQe0v5SyTQiLEz3W6HgzyUVXAHI6LDg
-zpZ8ENOBTPZWxMlvt43z73Cjip4dZvZDeMO7zOGEtpQ
--> ssh-ed25519 XzACZQ MtKX5scktrEXJe3nPrzFEMdWrdgvR/4btZ+MmuJr+38
-rYoSGq+I3WioIsDeqNFdJjVMs/REnfpKuUhzanT5big
--> ssh-ed25519 51bcvA 9WhV9RBsA199GA4jlTEY+ypVJC/KLBZReJbJW3b8SQI
-HsRsq+n8PvJSa5zQt9knn8yi72wqtb9CZh/SP+y3ozo
--> ssh-ed25519 vT7ExA V4C1cr4CzOTY4WEvdUwr1siAVClIipd2ud+ihs/hkVU
-qbcSyGm1/Ajr/RiQ8IMqLCD9+kZv7o9jP9oXnK4/FUE
---- jFQGrwJAhLPWppCP/nGJUAA7qRkOra8DIgptR+T6IYA
-­<EFBFBD>>nl›è=µÎ¿{ߪõ,j"0)L‹2 ¯M±6Ê~ö¬.M©Ê‰ž”0mßï²wôÁpMhÏ<12>¶<EFBFBD>Ž·5“[Cèæ…>™96a«•êM(ºª÷¶'°˜+Rh…L®³¬.I»íh ‡r¸­Ÿ÷­Ì
3ëüxýqn+K*F/èKùó:§<>n<EFBFBD>'iWi÷³˜
+-> ssh-ed25519 qM6TYg 4LRAh4VUnxT4kdbR8IYYH9Y5Gpx0KORJRzBW3HsjGxk
+JJD2Mk2Fb3EmFyqYq7hVD4DZiBLMqTGTRxKy46buAbs
+-> ssh-ed25519 91VHug eq8UIjMBKHOeR8coknHBLZCfGUaCtLlznCk1/iE/exs
+eUIdvYMK1QOcjPg7owZScNFcVkXEJ7B80t3sRk0weP8
+-> ssh-ed25519 XzACZQ a6/9wiA7IeQLHGccQdfvpwowFh5OdKgIqqrqq+qQZUY
+sUsOYDhlv8n8HNj3ZCyhNbfPZWlbvd5haV3ZMBPJGrg
+-> ssh-ed25519 51bcvA 9dbiKUhvYOHt2QhZvOhW4EH/S/OOLx7oACgSUXH0nQc
+Rxq1B9yZLI/LKg/FvNXrL7sZSB12t552k9RBLieIBsk
+-> ssh-ed25519 vT7ExA XWX+UVri3OJrpSXyrWQVvhQ9IQVFpcvopMLetFNoagQ
+WSDbM8LDuMC8RKBzf4I4NffEUGtfPrjPJ0jdrrR5lzQ
+--- bd3tx9uq8j3zhQZ4rAWBuZHgzez6eSRz4O7VcdoJMvM
+Øf)<29>Øz·Í›däTaùÃ#¬óŸß±ðR§<52>hkáú×ôhmô],Xø‚FNîö$'0Kæ¹—jà0¤™VÚ|kÎÒÁ–O)
+"¢è
‹r·&IBÓB[5‰Sg5꺜Yêú8µ¬Áx²ý‡cý`,©ÒÓ±ã®ã¡0W*
ÇÁÕ
O[i+FùMÑN±·_€n äÆæwǵ

nix/secrets/docker_registry_password.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg N7lS400e/5mSV3BlhnzThydz/c3DIIOHLNQodTErR08
-vMqHXmSloSrWCxeD4QCH30GSqg1AI+6Dy16atFLNxjs
---- aJ6lQv9jnJHyocy+Kz4jPCtpiIewxoooR0Zsm7CS/pY
-éj9ò†ÇKy€È°0*ÃœbÉÉ¿Y£0ûÅÅþ<C385>I3v +¶D"*/g`Šo™#Š³âصñ
+-> ssh-ed25519 qM6TYg UVJ4EkIz+aHGJHW/UWVOod/NSUrmLL4pNvK60KPWxzE
+pQ3h/qZ8XfwCqb2QshUxuLs6F+YddX2QSp8MLQnxBR0
+--- gox0jFVFKNb46LsZ/aOEpkxCWnx8sTe7Rvv+tdzkvq8
+Â×iB<69><'+ŒÌ½Å˨¸L‘Ydî6cÛ6B‹gé]UGôŠƒ»N€¥cª]4Y<

nix/secrets/forgejo_s3_key_secret.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Ln9ZxoEmhHUMbU4PufH8OYVzEnvFEm+b/SlBfitqEhw
-M0n0qe7L9peTLylt0uoTR4gQBcCxfSIm7FAR0mPeG5E
---- BzrHhLTDQ49g2GTkJdmLpdhRBp1rfdekcW+A26jzKys
-G6à?ÑU'réy¸†ÃÉ@b<0B>$ÏMçZŸ`ñ÷@äÂëkv£]Ÿ6Þ_°ÛŸNÜæÙ‚ø
$ò!ám“ìVk€<6B>gA‰]ÿyW°,¾ë´ød'ª ;Ȧ핒ÅÜŽˆ
+-> ssh-ed25519 qM6TYg nMMawatvWfcdHyOTJu5UBTCZbB8MDbvdd5XaSCR9ARQ
+iUI0FSTyjhx0xdfUn3ikxR3dcW8GQH1Flu2kwlkP1HA
+--- Fb7A45fAQY9VJN6Er23jTuEMvm5eDHJflTiiNFB4dYs
+Û.Ÿ)!<21>$Y­QÊÏŽ$ß9i3—3b_z
+©ÒTR˲qîhs|[®í¯óF(´m‰â¦I®Ž‰q1z÷^&÷&	'Á‹(¨g×<67>6<EFBFBD>’FÕ¾Š^.¸j]®­DÉi
M5ýq<C3BD>

nix/secrets/garage_secrets.age

@@ -1,14 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Nl4yCNn9+FiX2uBliOH052tOjnTj4DcFzaIDjD2MVTY
-aU848NDVI6MN5JPm9FRha+HJySIEyRRcNaiiBRnxJLY
--> ssh-ed25519 91VHug HfzLsV+15VwIFXz9mYc3dNdlFnb2MdqOMIV3DkxnJmQ
-Fr2LDl/Z5Tn9FspwZynbCvK9Let8VWGAr00lf3Uhj14
--> ssh-ed25519 XzACZQ GWXW5myuKkabbJwdW3OsHl08KBo0wu3dJXXo13xYjR4
-SYu+6yj0om9BHFoJH8wsDPEbQCQy/oAp1jRW9wX6Ys0
--> ssh-ed25519 51bcvA nenOCUH5VZ2j/u1fv7mD/2hZufU6KWY46UZwzINXSSo
-GbQOiKQ6ko7RpuYvmtUnf5wzNrKpR/FHkrYHhRzURDw
--> ssh-ed25519 vT7ExA 8/Cn92m/Qtoo78VSNEYNrC4HqoIKxLyvT7A0R0CpE0U
-rehfI6pEM0nAv9AQAFa3g/PTd4uvc8zwWLAVAgoq3NA
---- fHz+V2yXufeCvWNZ4Eu+vAdPYBoDYyuUlXcrTo8O/88
-r›º¾À´u^+Ä=ú$!1
-¡rFç-Nà™ïöHræ³+ü°2äz>äFÔiw`ˬó öÖ0ðëÎ2íŒ4(3
ÿÑÍÕ«HÌ÷³=¹ay$tÔV†ÂßÉ‚É|H×å ØIÕ	“ådæ2´_`åä‹
	<19>dÜðr?P›³M‹Îý	æ…bØ´Ä%qhùo‚Çë"áß—™lzs;r{…XÿuEãn)'!äýò»V ”°·°ÓZÖ˜ÓêÜŒ—™¡uÓ
+-> ssh-ed25519 qM6TYg GE45kAK/hBIkfDcJ9T5KSf2ZlRuznfyCXNgyiROKSho
+07IiEZYSR+BoaHsNOMfpTB7KvFI5erLqiLkxHeghNA0
+-> ssh-ed25519 91VHug I5YszjRHyHEIPSO9ATRx/hgSiBnq6CmQeCiEWyThKQY
+6cyqqeR7jyvWCC3yfxqVk9YtjhR8LmUISxoScoAl0Ac
+-> ssh-ed25519 XzACZQ qqZvo9xbK4rQRDzCsyKD0NVYhk3960UW5FRfavIoI24
+AjsMDfEzmGMCGekIAHPXkN2RRZHC4ZjACo3cNGx/iqc
+-> ssh-ed25519 51bcvA mvDGI9jBis304qlduEX3kDb2Y5E2fiNL70i110hdDUo
+OJl67yJ26ZZVLgobEbh63J9kku+whdmgawpPrlyAgFs
+-> ssh-ed25519 vT7ExA NgHlD7tjMUF2kIeMmHyE/qsZI9VzIkg4drUCDj0GABs
+kxwMjB9CBd5IRlh2SBHIQJSjCjARLMwOg40DSdbDO3k
+--- hzXf515cyiJHjcIAg+kmCeZ4Hy2GI/b21F5O+Pq7r5A
+§=ä)€BTÁÖ¢ È(¯_±_ÃÛ
È2ì{¡EÇãdõÚι¥±	wŒMSÛVs9TÈj_+˜q¸¦}‹™îføñ5Ä1ôÞ¿Ý^Ú>Q¹Fìg¿^Qvn²ZœÍ”dŽÎ˜ïõl=ÛåYȬ»Ù¾\!ëFú4v±ßt´÷ ­h·˜à!•AÿmÌ%'‘šnìר<W‚wiºghmÚ¬À/'í»á‚·¡¨Y|ACºÎ÷¨`zXŠ–£×»-µ3Œ

nix/secrets/generic_backup_password.age

@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Kmd5m9hb9QXzbbrLWC3SLcUfy/B8bEWdJMQ1iMe5MQ8
-A4ZoS84dtX+DMOzPXOMBb402q3o6LBExOda+Rm4hbO0
--> ssh-ed25519 91VHug rXXXRgZI91mIlLAclodKDk3V14pDyRCv5kg1RCB7AH8
-CzC46ry6tCYkDX4jTW08j7Itqjb0raz2nlmU5/7zLCc
--> ssh-ed25519 XzACZQ KbzLsMTNqcjJ2I+Bx5moRC74Z/QKHrbFVovC5hhm8DY
-aAGFH0KBdM+nm4HyZ0X7MPc3+fBbcQrQAcvrK0F7LNM
--> ssh-ed25519 51bcvA qv9cje7I7Sxje9xV0DghaxSxyovB37O3B1Bt6sHp/Bk
-2zEnhhy6dIOWMdbQE54xtQKfZjR2vTH+Z4son1/gYr8
--> ssh-ed25519 vT7ExA voN3ZvXhhqv4V9FpVTd2ViydPgxvjpQpeUcH6jljen4
-sLjK4aWqGSlxxeMKPrIZCjw4tsz95C1R498bFZgBMVk
---- Kfk+aieCFtZiKPE8toWEZwZw06sELpx1FiJCVDyLGcc
-éÈuøÜMú?Cš¬†ìÒóô0Z©&Œß‡ÊrSÓÖgµ™W«‹áp´8ã¦{*6§‚ÿ›Ày•¤§q“‘›¯‚õð%‡øÎ
+-> ssh-ed25519 qM6TYg NaiDsYFYQAZuJinDZ60OiPEZMsnmPOggyW/lKwLPWR0
+vLZKSA9iaFIdOjE7K9n7vtlF8UKCS+AKuSS3O8jlfbw
+-> ssh-ed25519 91VHug O5htAKX31xr2plcilbKy/AZ0xtyIDekjtr6GYeIXcns
+aK43EBfhqDCEtkB/1RephM7PK0tB0xHjS+GIDTFw2A8
+-> ssh-ed25519 XzACZQ NRs3M2HrY9vZ94a+MccGZisn/cEyY9lg6l/ZiOaECgY
+aZ84NrESzU+yhsxXk+XiHEFJ+5/8B5wmFZVhPU5K8p4
+-> ssh-ed25519 51bcvA 74NdYVJKbbDBuhxqUUAgx4GpGbKFzL0/+KRXJKoxh0M
+nXjmvzBfiq5Y7EUeUM5aoEColQa80JUCMwaLX36Scss
+-> ssh-ed25519 vT7ExA buG7ZHfGrdKqobgouN2DHkOointeeSo3LbQ5TbXxMT4
+v+CfO/1CDfu2d/Oy7LX1S/tPa25zaY6rWafpQB+yzdo
+--- 1urbgjL5IrFAQbt9FPGt+Hv5hJ99uiFaC3K3G4X5JSQ
+?
+A€>•$-ťÉ>6<>ÁŘń<1F>ŇîÁǵÂÂ蝠ܬČ>/RZsŤYĹÉ®4Ă5ŁŃşR}ň<1B>a§9SŚXwŔúíËR9¨

nix/secrets/immich_secrets.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q lRux6HhczttLaNglBB4xdx7B4GUhs50ucnyYYYlNLzo
-nxSaMiEcscZ62uEA3N4ssHN0Vc/fw0wRsGzUXHk5vyA
---- FpSXOah6uQRaHLOxdGNFF9Pud9NsjYDLhiXzqg5/Sao
-ëóxÞ	l×l w¦¹Ž\v¦S-Ñ!V”ý›]å·õÛðõýé}gëÉ΃[>e®;¢n0›n!‘œ;L
-·+
+-> ssh-ed25519 yMKb8Q ttfca/hqpWJm9dRJYWBXj9Of1rdWg2NbgfsAJFMUQTY
+qokH5RFlOmZMETgkqlWhcx41EtXtN2IxKpvP/WGz6mk
+--- vn3HoHqGBa02fSSeO8LGjhGb/7JK/tN/0Zh1Pjz25dY
+]?møÌõ±D“C:gà‹_klU×G¼¦ð¶Qù•ÈçJ+‹°g3àuê9FH"ìöÙ'g¨êáé‹d‡¡è߃

nix/secrets/knot_dns_acme_dns_01_key_config.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 LZU5Eg REfGT+ZHVlXvO+6s9AgIGQCBS+AQYfAG012IfRipJhQ
+V/O4nPGoAOpB/4DyBWuEV/GxoRJ7hdgVomIQwcxnSdg
+-> ssh-ed25519 5bWSnQ vFGAKwm8eJ/Fqv+LxLo+1mnzg4ht1BLTA7zdJuWdlnI
+Lhh3d9dWKyRcVTKeMOJb/cVzwnnqrBYNE0ijDgAxut0
+--- Du4x4K3KsDMktwzmEMiFRxGXq63eP5x9CBowtGJWM+w
+‹1÷{$Ôeü’9î»b”Âð`ëê+gÖüpœƒÆîÉD¥åx<1B>hK*/­Zå~eAÔ¥æHö}lÖÝÐ0¾ý”ÎŒ««sì»Z…tî<74>ÁÚ¸ßÐ:!¼µ®kçjÅ!Iœ_×y«Ià[eÀûê<>é§FØéGˆ»Žî<C5BD>¨Cbûð¼xÜ’ì›Ê

nix/secrets/knot_dns_acme_dns_01_key_envvar.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 vT7ExA UhRU412YTV9dkMkINM4xDQvQqwosWzIRGap+NxS7MFQ
+FUlsU461cxI+2befwB1v3ygyYAeTwfpJft/EX7eCGCo
+-> ssh-ed25519 yMKb8Q 2kpI3iQwInOH+TYnbvuyKyksGD9Q8UthqF1eBG5I+0g
+Si5Q1xNovm8hBmSfHx6l4PsiFU/cPa52rLw8OAGWQl0
+--- PO+gCtXKMloPmRAplw/pOAVPDHqh5PwzrQqrzSPN5Ng
+_W÷ÿî[ƒ<>VNÅJÚÓ1×ÚÛD-ºž±:…ᔆ|Vžz¢ñlñÿŠS¢vÝ*{´žGø9V"òøºóŽ_ÊîG˜r¡öS\‘cÄ?sõ±Å&ê°¶öSöä	

nix/secrets/knot_dns_rfc2136_key_envvar.age

@@ -1,13 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 qM6TYg QQMDIquZuxMKwx2hl2ST9BMXa61DBdC/cMUutcRIRHw
-l7oENezyJwfJHrgNUtFMfOF08BhAYWQOjW8v7VPN/aE
--> ssh-ed25519 91VHug wQBzeFG2xixYU5L8/d81n5FkZMqO3uCSF60Xi80mvnU
-nPAgKpJj7WDJ4tbKGnlWAhvAUOyLIyOY3aPofKM0LfY
--> ssh-ed25519 XzACZQ HYj1Omcc8WYq6s9l5hVrjjibg1LFHnkYkXiPolGewws
-uhrQ6nmP5fMApIJzUzwXcnlILdPvmlG4QhG1laW6alk
--> ssh-ed25519 51bcvA e2Xng7rC2SkYiDn5BRTIDBxn7vN/F95hI+okWL9TymI
-7TJrZQlJsnGMu5jaFQllI1E/+ZGHZjGmaUpuNZSAPDI
--> ssh-ed25519 vT7ExA PSM21ZGF9T9g6rxnsCv3rAio1f5KckTHgivfclDjFFs
-rq3M2R/LHYki4nQ68iFoLXH8VVmWyBDD6yv6y4tt5qQ
---- KqTQhyl3ef04vDQ8eu1IvTsEaSMYtQxxBAcIO+WYPr4
-Â$Jk–¾#_“¼ø¼Frë"çà‘B}~¾åœP«@ì.÷›ëŸeÜ…¢ŸYS’L;ÎÐPŠz
&0ÑDiKÿJ´^ÿ:à¨Oc'’—+âá

nix/secrets/loki_env.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ aRbZOixkF1CtYIoCxgHX1Cw25ozmtV4HWsFIY0sfHAw
-y9PvJ4rdceua7Q4GVqz09KZsensKhA8pLMjGyub06xY
---- gCH1ZBj/XvuwrtJcjVXr99OT89N7JOIlHd5xofjwH9o
-Pcwe§žOKD-¡ÑõPýzض8¼æDub3àóØ@HÞÊ}ÿ„!<21>ºE¿í<7F>½¥lÛ›H^k<>lMro\…
ë%ƒ’#Ó¸¨˦Na¼µœ,þ=FkŠu:‰œ![” ˆÂ=¸ø&º÷0XÝ<·OM‘ÌÜ¥Ð<0E>Ù©•!·ñ2À³-¯…JZ‰§|1îÔ
+-> ssh-ed25519 XzACZQ YEK1qlKkw4KVnbOpskeVcNSTkzHvIHGLTkXfo7t8+Ak
+MsWSttjHmrX/VknsxcVCDUnItE8ypvAvlD3oEWhqg8w
+--- 5TI3aOOUZNicoLqjN9qM+PFW4vtHWwE0d8YzBzQMWWo
+l‰LãebYGô­º¶Øùp§†dÑišàÔ¯):º.œžïsíL1A¡ÖbnqMzyã­ª”v*ÝÀ£ì‚†Ö<E280A0>£Zoª-“Ä2‹æbñó2	økYûòÅ‘R׸w Ë_Ò\Ïd–­ûˆ3!BV!Ö{JÞΔ/µïj©>o«$<24>Ö<07>SV—J3^öÒЂ

nix/secrets/registry_htpasswd.age

@@ -1,5 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg vZTE3zklC5ACYvOuHSNPMDJshQPcxmbfen0TygKKW2s
-2TMCnx49MiF0AqCFMTmuXC/xKzos66rskkDfdnIdQTU
---- 8JTyQvwrmMPdNLPK4cGGenl5DN2UpoCqUQzdbEvezpQ
-Þ!|GöqÇÖ^D;-Bžé2¸œ>ç"åÖ2¢ˆÆ<1E>A°)Ædõs\ Ó²îi¯¾îE!Ìg66
û,}¸	PÃc’ÃQxð‘‹’0´<30>v<11>DV4Î:¬¸Ò¯÷;£mïåÉ(xs
+-> ssh-ed25519 qM6TYg b9QXaopOE4ffCV1mNelzUSBejlwg+p2x5GuFiQJtXEE
+Vx9fJQWJju9TPMYU6qZJ6aHb3atQExfSlUHmbXkoyr0
+--- uiYOy/yar6oKQHnP1eNkFlkiD4O9oOxng35UKQNf8FU
+‰·å6²¸Ii=ȹ8	ˇ/Ö"*þÔ#˜^<5E>ñÊ*©Ìð«Õü
+¦¹ùf‘ô…g›<08>k·eã<65>úô4ßv
+c™$ã$´©dþzªÎ’¾¦<C2BE>¬›ž…Ýлn<ø

nix/secrets/secrets.nix

@@ -33,8 +33,8 @@ in
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
   "immich_secrets.age".publicKeys = [ minipc ];
   "paperless_env.age".publicKeys = [ minipc ];
-  "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ];
-  "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
+  "knot_dns_acme_dns_01_key_config.age".publicKeys = [ dns1 dns2 ];
+  "knot_dns_acme_dns_01_key_envvar.age".publicKeys = [ vps5 minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];

nix/secrets/wg_private_dns1.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg YCaoZYLxmyrcSVXaTqDeC25n7lwuGlTDfWPNxg9etn0
-xSVH1o+ITY39M7X8FNpj5liEW/20HTq0ZRxsoo3U8JQ
---- i8MfM8cVg0SJnNqUYeTQ+dY2FZ6yEhIGkiHgxBzTDYE
-
-Fã0e<EFBFBD>Ò<EFBFBD>ŠYØ
-{sóh]‚ƬfAp»ùûûB^ú£1ûäÄeð0!ä¾3šþÍÜs™§ÄÙ"·új@æþ=²rµ¯Rsí‚(+˜"
+-> ssh-ed25519 LZU5Eg 8zZFvGVb6VIefxLJERJ16VqhKczWW2tcUEdSU4dIsC4
+5k+Qpn+ZloytTx4DhcgT3Il5lBlXIuNmwMvNKC1hvNY
+--- rEDDdmvnau74yyYkVHKGx8kKi+Is/s/Ygt7PKfs4dv0
+=@±_‘ýyçÿ\Åô<C385>Ô-*垣ªöF<ý¤KV^uíˆWCzZøl‰ª•}oo
©6äh"¡»EÿÜpÎòk#l••ÕaÊ°¡&

nix/secrets/wg_private_minipc.age

@@ -1,7 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q QdFcYSyIYFlrx1vOfnWaFzULi8AxYIpH1HXLRZzs+iE
-3JG+l7U6AXmWe/H9J1B3dFjD+GCNRM4wsNWR0CHU0PM
---- UXqL/EG0JYwnV4Owi0Gy4BnpW7QkgiF4z2P9Qskfq4w
-@
-ŁţqűŻČĐÍ,‘YLłŃ3ü)×eq¶ąŮaK@]Ż˙e»ŕ‰xˇCĎ
-tţňÎv-G!Í}Šš±çJŇÁ i<14>Č$=
*‚Ş
+-> ssh-ed25519 yMKb8Q OK8Z0x1tfsdGQo0Acqxj99IDVwfRRO4nHmtBuwDXpEo
+FNfKD0EJ3FMQ8neRd5tNldCLp9Wk2K4/wlaEjKQPxPQ
+--- y32/fNgc6fz2cAr76vUej99Xu5DMcmO8bDQepK04TRM
+Ñ£`'mo¡HK{O¿Ö-Ÿ¥¤—Ð<>yýlœÖ,X49 Ú
'+¶t÷¤r&OKñ^â®Öç
ßš>
+¿(°æ«GŸúð>æAç×n—

nix/secrets/wg_private_vps2.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug MzqFl7ZTH4laSYXRYPbIiXadl/bqVXPHRM7wD5aLhy8
-Ng19G3jaJJr1s33i0kCHxIUQeTmoISTN+VQQD3rB33I
---- JkYGUYo6Ys48HI9UpXGardgf+k+DC71dxLiXqxMmFEQ
-C<15>‘æqÎ
C<11>!<21>nÐ ý½Æˆ,ýbæA«8"ºMeNÑŒnÀÍM[(üÖ¡¶Xͤ×X+•á~ãØ“„ýS¾nßKXõÄià8¿†>
+-> ssh-ed25519 91VHug v7DD5jgO2eah7KvV9shAkyFRG1zce0kKKD6U/QBIzCk
+hKwCVfnc/5wKEs2ow0etWhet/8+AT318LOnrEgTVEdw
+--- WWKcK5xf8FeUsA7atbz8r/ScBM857aXQA9mN9TdpRB8
+Ђ¾Ó/ ?K!A>ü–9q¥mׂö¶ð,Ûl°Àþˆ÷^[pÄ»°!rûmMEÆýzÊ€“OÓ`„ÓãÞq>qý^cRòKí3Ã

nix/secrets/wg_private_vps5.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA Z8248Zxd0dGjx/YtU3cVKwuKMDRaHQpo6d21bwSOWz0
-/7PxJCz7yfuGuBWioDQMizW9+tL7Ku7JEB2h6aG4vmE
---- xEBearw/OGRugS23zBrNGj5zKY/bNsot+UQOcCEATWA
-ƒœ!«pÕ%~¢)6-Hy*îeÀŸ¡Ÿ»
º âgã	¨‡pÒXÑ·‹Ó–k÷Ý Ùˆ¿èmé4bÖùn”ŸÀÙÁª¬êx6d‹íe
+-> ssh-ed25519 vT7ExA 1SyRWnZNW7piWgD9AhV3evIk5qmlPZw3vtaYysYPKUo
+vC2skZEXjrM2HgU6nhrzqZhwVtIZWrZyaVZwUp5PE5c
+--- 46tHy1OYd8fqnjpLu+MVYrJyPaP6UdgubrsvhI7KO4A
+òÅJ¶·HJÍSívá}áù+	<17>‘¾jÐÇ/„Ô
ÄêÙMJ§’P“+~8Aé웧üf™^Û„Õlj˜K–AbHóó5·U"@

nix/secrets/widetom_bot_token.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg XJWJcqVabkHFOrbsNTS6+jc/pQ1a4D8lZkObT8BZwiE
-DgFVt1+01MNlPm898/qnC0wGbs6eEsLcHpyANA5tpsA
---- VhhquCcml82lpKjXLecBoCz/2CHNl2S9htU2iIWfvyY
-~‚<>'t/!Fb†[k"õýy¦føiª¢Ü¨ŸL½ÑGêêg!ËFqZ¡aA<61>3
-úiý¡E`vÕ8Õ÷<Í1Fýmp
x~õ¦)gc¹«7R¾³×ð¿µ&%U'XäDD
+-> ssh-ed25519 qM6TYg p+Rts+QHTmO+vPpCHEp2LTAdPF8UMq0BqoN3rAPzCgM
+g5RaqS2rCOdp8/vllNb3Revq+bfDdHQkwYKsnNRN97c
+--- Ws0i3nFuR6DNeO1RpdUvc3Irt4I3HuzBtPgxXsBaOvU
+P¨ŒÚn_8ùPÿÆlJßìêÃP(<1A>lÊæ¾É*=V+QXù=ØR¸Ob±åf'l&çu‡UÑ=ºFßø«.†½î`sγ‰
·é_ø&<26>Â}šÎ¬-<Ï0€_-‚