From 8479644fc4c1b7481d02282396a49340f47821ca Mon Sep 17 00:00:00 2001
From: Noratrieb <48135649+Noratrieb@users.noreply.github.com>
Date: Wed, 13 Aug 2025 20:36:27 +0200
Subject: [PATCH] dynamic dns updates

---
 nix/modules/caddy-base/default.nix            |   1 +
 nix/modules/caddy/default.nix                 |  11 ++++++++
 nix/modules/dns/default.nix                   |  22 ++++++++++++++-
 nix/modules/dns/noratrieb.dev.nix             |   3 +++
 nix/secrets/backup_s3_secret.age              | Bin 772 -> 772 bytes
 nix/secrets/caddy_s3_key_secret.age           | Bin 904 -> 904 bytes
 nix/secrets/docker_registry_password.age      |   8 +++---
 nix/secrets/does_it_build_private_key.age     | Bin 1916 -> 1916 bytes
 nix/secrets/forgejo_s3_key_secret.age         |   8 +++---
 nix/secrets/garage_secrets.age                |  25 +++++++++---------
 nix/secrets/generic_backup_password.age       |  24 ++++++++---------
 nix/secrets/grafana_admin_password.age        | Bin 282 -> 282 bytes
 nix/secrets/hugochat_db_password.age          | Bin 339 -> 339 bytes
 nix/secrets/immich_secrets.age                |   9 ++++---
 nix/secrets/killua_env.age                    |   8 +++---
 nix/secrets/knot_dns_rfc2136_key_config.age   | Bin 0 -> 434 bytes
 nix/secrets/knot_dns_rfc2136_key_envvar.age   |  13 +++++++++
 nix/secrets/loki_env.age                      | Bin 326 -> 326 bytes
 nix/secrets/minio_env_file.age                |  13 ++++-----
 nix/secrets/openolat_db_password.age          | Bin 321 -> 321 bytes
 nix/secrets/paperless_env.age                 | Bin 340 -> 340 bytes
 nix/secrets/pyroscope_s3_secret.age           | Bin 336 -> 336 bytes
 nix/secrets/registry_htpasswd.age             | Bin 278 -> 278 bytes
 nix/secrets/registry_s3_key_secret.age        | Bin 364 -> 364 bytes
 nix/secrets/restic_backup.age                 | Bin 784 -> 784 bytes
 nix/secrets/s3_mc_admin_client.age            | Bin 912 -> 912 bytes
 nix/secrets/secrets.nix                       |   2 ++
 nix/secrets/upload_files_s3_secret.age        | Bin 474 -> 474 bytes
 nix/secrets/website_s3_key_write.age          | Bin 344 -> 344 bytes
 nix/secrets/wg_private_dns1.age               |   9 ++++---
 nix/secrets/wg_private_dns2.age               | Bin 256 -> 256 bytes
 nix/secrets/wg_private_minipc.age             |  10 ++++---
 nix/secrets/wg_private_vps1.age               | Bin 257 -> 257 bytes
 nix/secrets/wg_private_vps2.age               |   8 +++---
 nix/secrets/wg_private_vps3.age               | Bin 257 -> 257 bytes
 nix/secrets/wg_private_vps4.age               |   8 +++---
 nix/secrets/wg_private_vps5.age               |   8 +++---
 nix/secrets/widetom_bot_token.age             |   9 ++++---
 nix/secrets/widetom_config_toml.age           | Bin 4006 -> 4006 bytes
 secrets-git-crypt/knot_dns_rfc2136_key_config | Bin 0 -> 134 bytes
 secrets-git-crypt/knot_dns_rfc2136_key_envvar | Bin 0 -> 67 bytes
 41 files changed, 128 insertions(+), 71 deletions(-)
 create mode 100644 nix/secrets/knot_dns_rfc2136_key_config.age
 create mode 100644 nix/secrets/knot_dns_rfc2136_key_envvar.age
 create mode 100644 secrets-git-crypt/knot_dns_rfc2136_key_config
 create mode 100644 secrets-git-crypt/knot_dns_rfc2136_key_envvar

diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix
index 6356e88..a33e7b3 100644
--- a/nix/modules/caddy-base/default.nix
+++ b/nix/modules/caddy-base/default.nix
@@ -4,6 +4,7 @@ let
     plugins = [
       "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
+      "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
     hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
   };
diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix
index e4c1b0a..bec542b 100644
--- a/nix/modules/caddy/default.nix
+++ b/nix/modules/caddy/default.nix
@@ -19,6 +19,17 @@
         insecure true
       }
 
+      acme_dns rfc2136 {
+        key_name "test"
+        key_alg "hmac-sha256"
+        key ""
+        server "dns1.local:53"
+      }
+
+      tls {
+        dns_challenge_override_domain "nilstrieb.dev"
+      }
+
       servers {
         metrics
       }
diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix
index 815eed0..7d1c858 100644
--- a/nix/modules/dns/default.nix
+++ b/nix/modules/dns/default.nix
@@ -1,6 +1,12 @@
-{ pkgs, lib, networkingConfig, ... }:
+{ pkgs, lib, networkingConfig, config, ... }:
 let metricsPort = 9433; in
 {
+  age.secrets.knot_dns_rfc2136_key_config = {
+    file =
+      ../../secrets/knot_dns_rfc2136_key_config.age;
+    owner = "knot";
+  };
+
   # get the package for the debugging tools
   environment.systemPackages = with pkgs; [ knot-dns ];
 
@@ -21,12 +27,25 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
+    keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ];
     settingsFile = pkgs.writeTextFile {
       name = "knot.conf";
       text = ''
         server:
             listen: 0.0.0.0@53
             listen: ::@53
+        
+        key:
+          - id: rfc2136-update
+            algorithm: hmac-sha256
+            secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds=
+        
+        acl:
+          - id: update_acl
+            address: 10.0.0.0/24
+            key: rfc2136-update
+            action: update
+            update-type: [TXT]
 
         zone:
           - domain: noratrieb.dev
@@ -35,6 +54,7 @@ let metricsPort = 9433; in
           - domain: nilstrieb.dev
             storage: /var/lib/knot/zones/
             file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
+            acl: update_acl
         log:
           - target: syslog
             any: info
diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix
index c753f0f..808e0b1 100644
--- a/nix/modules/dns/noratrieb.dev.nix
+++ b/nix/modules/dns/noratrieb.dev.nix
@@ -54,6 +54,9 @@ let
         ns1 = dns1;
         ns2 = dns2;
 
+        # --- ACME setup for caddy
+        _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ];
+
         # --- website stuff
         blog = vps1;
         www = vps1;
diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age
index af7230234fb4160110188098c8520cce111854ef..adb5d54f3a550338865d2804819a45ff136ca89a 100644
GIT binary patch
delta 683
zcmZo+Yhjz9Q*R!eU1FM^T~d~08R>1NpIPMOrf;ZiZkm%;Xk=KJoSqlvUF;U&k!zS^
zz~y69nr-3XTp3(xXp&!$5|9#A=vU_9S&&icWsx7^UYg|`9%<}XQc)J3&82InP+Xj$
zo0?)|YHDbyU}+fUQJSuh=<N~g<eiyekYntc5twRF=4KjP84{T3<631LZsw6*RT&x<
z;ppLM=HrsiRaFpW;p*q_6cP{>Ug4WlR$^jYWp3=8m04ht5>*!ElIrVkUghuZT2c@=
z@uPUSZ;5w=X>oFPNs()WSE_MdKv9*Ot8YqpQA&DQkiJP$NtCv4ZmCz1wy_0QQDlCw
zd!e?cad>9FXR%9ap`TldS5}yBv3`(iURr^7X=p}OVqS=8QfB((ct-JX%kYda%OIy>
zM?*_XcSn<~oDkPY?aG2MFK2ykAE&6GRIenjaN{J4;6P6<kK&->LhU?@fHJS(MANFk
z63gtoJd4UqbEERYk|ay#s0{t!0PRZS{HpxPXBoxo!%UnFlZ#B8tNcSEO~PHvQbNm%
z42v@z!<=(GGYe9TN>j8mGm7;yvcp2T3X_t9E8TMq^&PW{^n)@3Ej)b-eVkn^wX>tj
z%=0a?0xa_*^1My--9lZtbaizVvfKjQi^{zmGkgNV3ksYA^z+=kLLD8=3xl%#ixMqd
zJkty6OM<jR%se9<xz<jw%afMQnf=0c>p8jo)%RC@)sc|PQZmr=={8!h-gl$fsk(1#
z^n6#I>YO)))gbr&`%UFvWDc^575LU?oEPffHn&fDyXoX;=NHdf?Pgk<C9a<O%2#98
zDyHw-)HlqK&<@HFYpwTLw|R}8=kB)|3)+iztYw}5eXY_N4qoHee=7bK=4pG2YPspZ
X@c#K(+-iA$-dy#}aPiFVn`Zz32QKz_

delta 683
zcmZo+Yhjz9Q=gh+<eHtBm+kK5>f`3;X<6c&QJ89&5fKvNWZ>ss;8_`&VHlX@SYn*v
z$W;_*kY`frZWL)zW>Vm2q-|sxT#|2Ml9_Gp74B#3=;xT7>6l_%Rhr=u%B5?kP+Xj$
zo0?)|YHDbyU}+fUQJSvcs-G7bYFg?PY@F_rnNn1d<(8WlW>J=tW}fL$n3b58rXT5I
z8Re2>;U8kcl@pnkV&ItQpIcy-Wm;flV&-b(<l^p`SXJdw9#mH0l4<Fen600YoEGUg
z@uPTnsZoYuiffX0WO|mnQ=xZKs-<zRQ-Hp9Zb4Xfm0^~?bDF2KYf@4{ihDX&j%9FC
zie*8tVSsi<Zjg_Dxl?j+rEz3xky}`xzF}IBwxO$EMv<FAsJZXtct-JX$Lunnq*7O>
zid@$u|MaM;f;4@TkT4V13a`xcNQ;zEA6JtIk1SW;lyq0FGA|>Ol!#;t|B|RG!wA1z
zKTFpr-(<@ufAfF{PuJooQ?Ig2XCM8NTm#R^XBoxoT|z1&z1_VE{JioC3iOM!!y_$H
zQmPz1O?+J{jf^v^Dx3<Fs&b7&bF(bCa*fJLwUbN?L(DAABZ7*PQZwBXjZ=c7vJ8V$
z3zPG`vrApPEOJ9!jD1bGbaizV3e24i3@rmf12W80E4{S+oeYD_%{(en^Fq=?v?Ge6
zeEc)(Ljp^jqPz@4xolInuRnhF%4@$a9`mLJBA;#?mYsTI|BhbUNxf5h+sgzNyR9{i
zJH1JcEw%g(*HNX}9SjO~(=VU0cRZYR#(;b6u?rVEpPrTrofXF(U72u3T{Bhmr$@%B
zN(ZrUw^s+xBwai;jW6uXys66V!83Q&9-C{Fq`OjW<|U=sSpgNvhfS}1dBai_y-;*z
XyO>Z`(z;(#rDaF!u13^cDV+%b=!*3_

diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age
index fb3f1f48ec1054af7c92ef1b15f832eac210f897..d231b8074bf10fafdcbbe86cf82de726583f9815 100644
GIT binary patch
delta 816
zcmeBR?_i&xQy-q;;hCIj9%xWnX=LG<oL1uIVUg)<QdnW(6qc4{7+hA6l%8xEn&}i8
z$(3#tRpMUa5}s`w<x`U7<Xx3hkr<I|6yW6Q5tZs;m|75NW|mTHX&8|i$fawiP+Xj$
zo0?)|YHDbyU}+fUQJSt`R8SmQ=olPXkep*^nHCXg=$2%do>rV?<QS~)WKdAz>QNkN
z>6e@9>u3<ll~hvhoa5)77p$$H>z-H|<mBvQmhWL+;#}qt6_%Z)pPz45nx2spk!E5r
z@uPUSS*Ce*u19E@M`nInqE~QeNLZP>VW_!TN`}6xxj{)tXqIV`r%7RDX^;h1X}CwY
ziKnAuRdz&Ter2X#NvVHgQE76STY5oSg-f1ugnw|McV)JDSWx8Tct-K?WFwQTQ0LU#
z#0W?ITmw`8&~nE#k3etBK(Ao$d;?Ga5F;~vx0J*JFC!B!LnkM{$U@)pJa?Z`UxR|&
zT;I$BBj@y#VExR*sH8~G6c=B&Lig|j57XqyXBoxoE!~TZoKl=3GEJPy6N8;SeLPJ)
z90O8~OVf)hN?nUQviyQ7vWmUJ^4-(93PbZE+`WC03ZpFC68()L{CuK9yv#GalOy~?
zO-o$MJ<LmeDqS*)j0=;wbaizVLi0_W{XMe-3Ny+pOwElVvz_yj@+{nQQ<4n=i-Me;
z%v}BI4ZJN}T)YxPxy<X%<`nGdWWBIdXWfmj5ACYF=GZjM^FBZG!(63zr@iJj3G{T#
zSRB&sd@f~Xe8v&?Py8H5p4?ggN6W7*Mt7f8D#wIqJvQeF&)>e@>sfu{jF?Kwa<S;d
zb8R0)5BJ_*RKPxW=QQ>o+q9E7jwO1p_OvOTX216BnRoR&zx+G7aOvMAH=;gyO|G(i
z`F7pHsr^$+;<xmEcUtLs-B&nag@^W&o<{M61D>7VRXV2Hex8|r)k)2F|1`s7^Aj?E
zB@_cLmhI`?=rXDB+zTVO&M9xE3(K1ZxvsspmPh`@Zie_Qe&4X7cUp(yOB|n;TzTHQ
zqmkF+eH4%Q%=HqEZ`IG7ncO8&6})Y=h1K-1@{94OKA*h*z4`&q`6X@FZwfQ6Te9o@
I*N-mG0L-;Q0ssI2

delta 816
zcmeBR?_i&xQ|}&-Q&OB{8ju=ZmYI^Jt({(y7M5>Vlv$GJWEK$NVdiL_=^qjq>K{;<
z&6VWp5oO_?6O~aE;uq%ckz!$ymg4J_kz0`;WRe}?5@z8NR%qc|7!a-<%B5?kP+Xj$
zo0?)|YHDbyU}+fUQJSuh65$)_V(#POli{Tu=~tFp<rd}|nG)jU7!m5^>y%nt>X%*~
z<>BiRRb}AIm1Yr@q@5S#W0{<umT4Fi9ANGg5s_wUXpx_ir5&ton(1$9<epL-ni5bv
z@uPUSzK>66s$rzJiBXBKVWD3|RH%QDS8jSxX@S2-a7cbdse5@|cBE%gq;oQtWqP`q
zV}WUMioa=Ls8?P^U|6DORamx1nT4lma&D1NPHsU)p<hL6fKlM&ct-K?v~;(E0K*iE
z?9gnNygavx^w6q`{8ICR2>;^Bq+s{b)Kb5Ef9K#r;}BP_?2M@Ng7S(C|B4W!ibw;$
z9FJf_!xSTfzzF9;k3tu(+^C=^BR{u@VEz2bXBoxoJyHS^ox{tsB3$!B%H5-Uv;C{8
zlFCX_ODs()i*v$@1A~iQ3RBATgAF6O65X;~OI_XbQw<FQ9aFr@BU3UxvLhWUv;2y@
z%e>9KJrWBO^#i;d4FVmxbaizV{3;wn%Kd`V%uUR4vdcZ3ip`uYU7hodbG$Q3{Vk0B
z1Dq1;ef^UP6EgyRx%$M6m+pM*&~|xg*@@~8tM7Fi>gV5oyl&F5Nwu9iA!Q!H_32m3
zT}zL&K3=u5-pWhyPlN5kr|c&jPELBU#Hsbt$+ELNdW|pll{ToQls9jRi%mK3-p6JJ
zcf|+c`;Er2exlxg_6An_FpEy}nKj>NqDtc5I~EVr@6^{U=yKb-cx%mrZvUi%t1IuU
z)N<PK>+FhzpHexQ$y4-i+v*<rJ!v(Ey|SlCtXV^F?8zmH3uRBO5_u?>{AlhY(S@=N
z_0EcUdVBvDi(AaF(Y`m~S*o|LL=Cr_`nT=dB$Hpftv{x@lvPtX#f|-9*PYn?0w;Ta
zUFcq%{#&!GDk7R){ptHI6QM0xtq~hC)jf`1^t?PL?5@KNy%Q_0e*b*srkCRPEspZ~
G1<L{PLO#U+

diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age
index 83a4bc9..21dbaca 100644
--- a/nix/secrets/docker_registry_password.age
+++ b/nix/secrets/docker_registry_password.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 0u8KWoP0daJZA97H5KkNCSn839ObF87VYU4AChP2XVw
-PqtYdZR3xokf7iIQ9khrz2pt7n6FipWn5y3bmzDfdEM
---- 3tTg1eoL9exHUTtn3Uww7xWecgmzf5EyyQEZ//Bbjic
-�|�H��LX�
Z��'v2"���<�K#9�$T���	�_��
�}^ao�4�
\ No newline at end of file
+-> ssh-ed25519 qM6TYg N7lS400e/5mSV3BlhnzThydz/c3DIIOHLNQodTErR08
+vMqHXmSloSrWCxeD4QCH30GSqg1AI+6Dy16atFLNxjs
+--- aJ6lQv9jnJHyocy+Kz4jPCtpiIewxoooR0Zsm7CS/pY
+�j9��Ky�Ȱ0*Üb�ɿY�0�����I3v�+�D"*/g`�o�#���ص�
\ No newline at end of file
diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age
index 81b84bd45fdeca5ef9a86d1be3445b784c32fbca..a1a6080a499bbbae00a5b03dceb06505ef8c1dba 100644
GIT binary patch
delta 1893
zcmeyv_lIwSPQ9^9YJgj2m1{)4enw<rq_de}pka_tn!bLDNph%hn2)wsaAu`TP+)de
zAeU>od$^@@x>rzOgh!}XNNJ^8xuajXXMnSbm#JHzd5~*Xka@aAg;RQAAeXMLu0l#)
zNnl`=QFfG(M{b~}VNQyPw_C2GL4j*hK!{IzWTvB$dwoS}Sa3>;wky{wfzQueHypa`
z6y^2yZOg9w_j63H-`OR^uPFCq#}-ewL#BUy85XeSHmg`(negt${{rbxbGC?YeOl+G
z&3LGf<!$U#DZ6O)1?M;Iy3x01%`(M$)`<ltuZW#qCV46?@we&nwV4ZlKJ62exH2_1
z@|@LW=Krf(mdrn>P|x?ap=hN=wdbq+jd{T{_C7Ys;M(@|(J$|LE!H<?Y0jGayuVPh
z%wIRgnDf+)1%|B-R!U7bdVha>JU4$Lqy4ShFQ+_`)|>97Y|ZUqbYkzFVxxB!$rI}(
z4_(m9ocuuW<!OtKgAMCNVvjCc@w8P?$RqXHen<Te*3+XSA{&*&g<Vh8+c~aMYf!#=
z&g|2jTY9zoH|?9m_wnWfhPtE&(O=g-xiWFVan-=3D|(mB;(w@+XX;d5s$THHQN;Y~
zN`*s7O`Zl*58XEs5Pp5V>dn!60*|+RW4-U!;jHlHc5m~(EuYO&zr-Fm&G%;h6^m5q
zmafChtKHVLoY2qyA+g2yk?RzXPHXvk)z1eRJXb6}$Z|#KT=({rX627ZJ|uJ;T+|Y8
z{&;)1anPE7vRX~5*X~&uiF<`Ey->_}f9vjY*AU0|`yO&uy*RVHXbtbTSuBU={9AUw
za7}@K+T*po8}w70-^>c^;%|x8a9ea_?y4Wn+1o`WrYxQQ%yhS?)2sdYqHoG`PhD75
zx$jkdO+<8nZ1LuKf-NO8=f=%?v4{1UM&@yqn~ndTTl_uyVWF3r&AMMR90ivcZ;nXc
z_j$dwTI{~#i;CteEbQW%x_-{7y_X-PRIa%9c$&|lh!4{)=K1H99&gN0e){=;R{Of_
z*oooG&rbcBY5Zcpz1NG>4VHVjuf0orr{6yR^ykj&0`B$o&Z=1kv)^vr_iKLQj<V}P
zk6Jp9{5kaQ59`)iUhRtQ;rsNRdpdt;y%i|py0l}0;@vNG-mCW+MArr7HW_H_(>Q$l
z)8YTRkG3A&sAH>`6ta8MhM1m;EnI$Fl8n}K{@n@8U|AGpt=+JHQnrU6mnUzD_kG1r
z_b&1_&df+R{-I>3re0sresV&wPo<n`+O^Q2d9PV+^{Yk6%#fOFz2_r~<u$fFYqrj0
zG-6m%t9GI1#j}4GC;REJ+<PvP*=1{2S$;$F)ZFTY3k2;xhie?mlYZ~wzg^j*fPdQ&
z&mt#=Glvh}yKwo=e}}BkKNJ3x?MX{DSX0J&;rTur%YRC<UOf%)7M-=Ux4z=2&D<Z$
z#WcH@PxyV^t-{bTL*-#Zw1LsH?H>=<U0?{mblu4O_WpYwrJVax7xn&M<0I5LGjL5x
zK#Az&Q`OIw>L@*y5cd?iBeP8MqkT{0%ZvKwHH>e*N}r|tqVG84$E_Sw8NJ@R|CHY-
z%lzxuTp^Xve@Pa9BJ{U&G9UE6qWEW5eV7_EN8iq<?j>?h_^&=a+g&^VaKDG}RIh@5
zmo5&?PL9t%j)wkK<S~A+=FEd`jYS!OmlRjH9$uEcae3YiA?9CJfp45jubBzwt1oiC
zxVXH?D{8jv!SKh@u0J1{gtRFxzkktRAx13G^;wovaQ-IkAH^>H4EKWGgfta2%~E=B
z$h6+!pJAKxCQpg!Tex=`1>U@+^tdeh5tI0Py${cxF4>ZN{A&EGweEWV7rbzK`@xq{
zgWYrKncJP~S99lfe|VcFZRDeE%G4(97a3n*Bsn*xaF4x5<@Qq(zrAj;Tvt{!k8#y^
z?QZ8r>4J9(;S1ut9BfXkK6kN9ZqKUC{Obd6q`3WhUH>%AkLkEw;fv#?N(-dUzj)76
zKY7;rc%vhiEL2kbwunovS~qdVJf;WpX4F=>%QwH?eL~WE>HPKVOjGh_Ka8CCk14Y0
zw#$q;KjQXOyDHDVBA%1(9CqwL*!4>*s-0z-uAZ8rAhmVZjx<*H^(C(-Eso+{zajpD
zozY?Er-ixq+**Fs)CWhbT#@b?KR3<kp7F{v)9)tSnv%qGSn6_UrP@1ASBKmOdX;&W
zv+i-<7im&|qjw-&cmL9#J1!qtkXi2hBeLyC_gl&3m*dVkYfbjvbRgmKrt=#vZ7P`9
z78krTPrq{e)*BJu)Q+$2@My}dQGM)g^8I!B^3n(8XN_X6{C{3l)_e13eYNA{?23-9
z2ARK)neCPLy)AfX<Etx=&h2n}a*9QTQ&^}pX~Wx;ZwKF8xaxgW_V1!Y8xIC-V?6A4
zt)HRKvh!Nw%Ys+kQx8s<VB52{oMT>Hg^6R+RKD6%jMbiMqDeaz*1WWRqG6D_-+YlG
zXSucHjw_!ocAK8O-mF^6S8yu#3%6=qPGS7#C(CYkYQNf7Gk<52RmkkcUP4bL5_*K!
z-!)@+cKfR2=In@U;egcwX$rZ{UiO6tP6Yh(pQ2o;-p{)($eZB|!y#3LORqEUKJi%*
X8SduHa(qV19=@Y$SC{(s_pAT_OI)Po

delta 1893
zcmeyv_lIwSPQ6iRsB=VsbGUa|o{y`EVR&Y)b9j1sfkjA8UaotoXR<+digRv~Z(4>?
zI+tIdceb{Hc7{(xj!{ZTa)FVLnSX9zO1Wu9aZ*V|c!qCcsAFMLq`!w>IhU@ku0lYv
zTe!A+x~XBgkzZ+*XF!OllaXUluBmC7k4bo8K)6|iSG{(6X<A{KnIji}`a@rv;C0XQ
zE~!;)p5P*vpwE4rr)6o0bf(VZJ7QM3Rgr}+Y%ZjHRrtK*#U}>d^JilXxA$FDQfWJM
z@zjq6dbj+QE~^~mOEanrp6FXL>xb9zWQHmo1?i{#&tg8A>F>KPDRrlO>Pg+hDqi1x
z9qjLLP0)VM5Voz}Q?0Y=&td0-A#0rk!{*EPWh|DNc-w{XYe}q6_gR_P^_!QoF8Mo4
z??U!IiKF{o{x`mnnRmSXO3tFi_ri6(!cu>lK3QY5`g%^`udM>%ZrMCnv)6>VoBdWa
zRq5YS=$NjuDd$IBijlQhB$rCfq+c}(dToxrXXPhtmC(!GrQZCpxPH-&8C<7dPMP)C
z`(W)<`5hm>b{)v5nvlZYtDSZ#Pm49YbqiZv+;wlRCx+b&QfG4PdBn>+--Lfv`@<F}
zxIw?+zUQ5F4pRlCGG_ZHt*&(V@N;eL_x%snx=a6cx!u&dyK3Q!QpVkkceAzD>6gBA
z(!X<ZZLj4Qt2d`CCB!!8UoM+je`<N`hporVeHrK6dA_tT?Z?FpJDQEuLv1QqRCV1-
z7%QLNa+)Om(`uGj##*0u{j2_Ma?lBR`?-W~-j#dn<)_Gn`E9@H`uM6?y!woPod%|{
zbDQ=xp4jgEa~kW`Yv(k}i`F(jxv-iksHF21=Z4~W2VbY{kjaxdSS3=ptGMO0v_5Bj
zx#P9_9u|*d$^_jEUv2J*(P%e|(2L8wn16S=P?7D8-Hfdsx6TSbb(<g(pUr&1{`Zl0
z8)`qgOK|I)6fd2p8p=Ay^&iIpk>!^j`ahboU+H;cT9EhcT$M|ym8p3WXDp^OaWNcc
zShsz~zu7jMeK+>%PBwp;lDuHUh9_+M|1VK$DXZ@mPrJHT+t%Cu)zza9Dx8(yxICWd
z!0@Hrx1h%8&;lEto||cPbqyQ!CO_d0k#JSn_o_4D`HH{SqVz5wdh3+>e5RSta{a`6
z-=`NnHFt2#RNBUGVIQk1{<NSh=aoE@U84M-X+>8jIX!gEOgNUN{cHXV52k2Cd9ys$
zmN$oT9qr2M1?zpJ<zFv(;$6j**y`uacthgN4dK&g{S*ui71W&ce{<rD(VH0;o`%Q#
zwmB*;&obr4@rB-I@xT6T-|{V#<@=%SY-{g5_lS5{Diw0R*7Z+(!NjwQGT&~0k-u4y
zlM>+Q{@k+i_O*na-=7)pC<$hgO6QsTW=gVt$BIY&6OOHUlTllLT&{H0<B$uU99!=E
z-^TOy)bgTGZH67~Uu4Y_W=$^I_T;~m&aLzuzW$|+AudY$74EF_E!z6``WEl0ZXsd3
zlbljTrXH!;;?g%?ug<MwEjJf`hsbML)m4f7-irUiq<1KuKc~2vF>mI}ju#FAwqh59
zrN8s3DdfEWWT5xGwLW~$zxtQAPo5P{zpz$X`R}tCH*deyG@f7aZ{q!$uZ!!C@N38C
zE?_!+E!u43@dwu?@B0^X!eDDiSOx#pzwz7sRnyH^KYO3fC?43gS>2P3W3!LIEd|yR
ztBs*;oBMx$U75XP@r~OrI)mOOKVEBpi%aucBJ0$Hx7oTp|GE~bv~JB7Oz-+`Twi+R
z%|}knTh2W5*fw_wxJEdh4xg;Y_bs?0{Qq*b2T_-9ZsBW_GoO6NVB125wy<q~^7x)k
z6BApTxWwX&p3QQHd6m2s#_v754p?kl-hc0-F!wJr386^7O`Cm#8E(E>a6SC(=f|Nr
za|I?XkEqBwEV912@n_iD9TN_!|KZMGwymGPzCY^Zq>YjBGfJab)Bep5OSZWEUux28
zmBpP>8+T6jU-td0)`ZDb21|IVETmdY|JzHKs`I_uS{-=7z?Eyo(mzaEO?7&)Av>9}
z92-9#*!}6miX9&tG;-ZmCF*g0`NOni`K1dl(=2sOaxR@uQ}&oV)9A*}mc^AP!xFjb
znclZgkV&ZTtWJC{wflq2tV_Gt;~Ng&;NrY4fBUG6sY!VHnr9(eb39IpP29u8W3xGY
zx1-#l8;=A|UCw;<+T+0d&;FfWZB@t2CbrIQtXnpJ?oFPypsp6<XKZzSlJ#=t77bB}
z=^D0nIdS%EKkq57;k`2{rEThpj6bR|5^dq8n!jT@!)_nYuNRT|pqR5`Z-^F0a>bNS
zk{V?`?+XqDOk7~MFMY@Mbt+|dSM5sJ&;M7{wzz!N#<<&@NnAcf=bHT3ZX8#P?ds*8
z7Pn`$qW|JDQD;@_-{;)++pj()>2q!4!Og2K2?oi=`fZf;o<G+>%Cq&=@<)x|bYx@{
zB&J{cy&#1(;0mYllZUtCJeR+0y!7*ix3W@l&DTjQ^w##pFPvP-x_jcBDRLYk{{%c8
zLp@YNWPj$lAO5$gu(xCBDyE4CPo$m;bx@gn-};a6Rffy$UpfUU4(DsFQ0eJTKDJB!
Q`3#2jMX%<wJv{CY071-#G5`Po

diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age
index ae631cc..609822d 100644
--- a/nix/secrets/forgejo_s3_key_secret.age
+++ b/nix/secrets/forgejo_s3_key_secret.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg z5yLpu5zJ9m7Ukl3nEHZND8Ot2cYnADJidYjELzfr0k
-qy1n6TSeWniRFXLc1Zkpvz1+pmjFaMga0BeSE1q6RSk
---- fe6vqb3f0bRvXlQG4JglZ0h/At5kUPIM+VkRh91BCtY
-��"�.O��
J���7���6���~ԥS��H����-�4�0���[vA�D���=���^T��y"@A��@�,������P��|�q!؊M
\ No newline at end of file
+-> ssh-ed25519 qM6TYg Ln9ZxoEmhHUMbU4PufH8OYVzEnvFEm+b/SlBfitqEhw
+M0n0qe7L9peTLylt0uoTR4gQBcCxfSIm7FAR0mPeG5E
+--- BzrHhLTDQ49g2GTkJdmLpdhRBp1rfdekcW+A26jzKys
+G6�?�U'r�y����@b�$�M�Z�`��@���kv�]�6�_�۟N��ق�
$�!�m��Vk��gA�]�yW�,���d'��;Ȧ핒�܎�
\ No newline at end of file
diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age
index 7f33bee..ce127e4 100644
--- a/nix/secrets/garage_secrets.age
+++ b/nix/secrets/garage_secrets.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg jJSJ3eWbmwKqaqaH0nCAfJh6zG0wQ8NHYLch6MjVFiM
-nzMK9xuag1meleJVM6aNGK3Uj+LDiklWtAbEsEVaZrE
--> ssh-ed25519 91VHug lgN/V9/OYL6qvoDo54bMwkRjgJx72ER4rwCyBLE7JBI
-KyqOc40/5iNubbk3vuF6e5qypscUNWGXSO+TvnE60Ug
--> ssh-ed25519 XzACZQ MH28c1eBXCHnnmWeEiKbB7qnqIWb11ciYZopRwK1lzw
-kHr78ot/c9JS7L+uWk5XhCwZ8y41cEkCfjiv5ITHXpI
--> ssh-ed25519 51bcvA JbXk+iiHx+TkrosjfP28iGjQQ3lNFlo6L7ebmOmOJzs
-KQH6qVfm+48U6TzaomwPQJP3Xs8JCX1JDuVNu6+djUM
--> ssh-ed25519 vT7ExA W/tG8Jk982TcvMP+ZVY1Jgtk/0ykGlKT471OloV68G8
-9/ieFx+uf+zLUKfWtIYUiEyHHkwYLOhX8FtZP6oup/Y
---- Nr1pkXNHv0+lBg4J3QnK4f5kM3ZOWjwTCwjUYNMRABk
-�UsI�	lNdL����^���q/P�D\���%���s4�GC��Ϻքag����|-�f�+,���|vpj�]��.�L���=����U�����_?�bG&Yw����|f~4qR��*�Lx�$ڋ�Y�P�rE����N,�jW���z��#K��@̧�#7�"&�Ξ=��Gx��N�.�n�O7�c}fczT
\ No newline at end of file
+-> ssh-ed25519 qM6TYg Nl4yCNn9+FiX2uBliOH052tOjnTj4DcFzaIDjD2MVTY
+aU848NDVI6MN5JPm9FRha+HJySIEyRRcNaiiBRnxJLY
+-> ssh-ed25519 91VHug HfzLsV+15VwIFXz9mYc3dNdlFnb2MdqOMIV3DkxnJmQ
+Fr2LDl/Z5Tn9FspwZynbCvK9Let8VWGAr00lf3Uhj14
+-> ssh-ed25519 XzACZQ GWXW5myuKkabbJwdW3OsHl08KBo0wu3dJXXo13xYjR4
+SYu+6yj0om9BHFoJH8wsDPEbQCQy/oAp1jRW9wX6Ys0
+-> ssh-ed25519 51bcvA nenOCUH5VZ2j/u1fv7mD/2hZufU6KWY46UZwzINXSSo
+GbQOiKQ6ko7RpuYvmtUnf5wzNrKpR/FHkrYHhRzURDw
+-> ssh-ed25519 vT7ExA 8/Cn92m/Qtoo78VSNEYNrC4HqoIKxLyvT7A0R0CpE0U
+rehfI6pEM0nAv9AQAFa3g/PTd4uvc8zwWLAVAgoq3NA
+--- fHz+V2yXufeCvWNZ4Eu+vAdPYBoDYyuUlXcrTo8O/88
+r�����u^+�=�$!1
+�rF�-N����Hr�+��2�z>�F�iw`ˬ���0���2��4(3
���իH���=�ay$t�V������|H����I�	��d�2�_`��
	�d��r?P��M���	�bش�%qh�o���"�ߗ�lzs;r{�X�uE�n)'!���V������Z֘��܌���u�
\ No newline at end of file
diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age
index 5dd7134..d009691 100644
--- a/nix/secrets/generic_backup_password.age
+++ b/nix/secrets/generic_backup_password.age
@@ -1,13 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg WSRKNimMa2qdIrTxZIsnybHi+gzOweCGmCx2D3DPciU
-e6MO1QIL5FI0ATaR8hBUeE2ayLoyP4P7d5eO7liMBHg
--> ssh-ed25519 91VHug JZjoc5tcVSQjIpbVGVca4P2s80Rb7NTIEKPhlXx9wQ4
-QWqufjXwphL4Kes5Ky2tWozdusA5AJwqgzT5JWCQbvQ
--> ssh-ed25519 XzACZQ ek1dpX4Lqf6hd13B0dX06tTTmNRhZswxV3W1gBLKkXk
-LQMnAxrr3ZfUc3Brn39BzIdyBe8Jma8LSML+eaBuKJE
--> ssh-ed25519 51bcvA zA9GHEGOXETl9zX0yoHHB9B5On06KlEcYRba8eKGKEo
-yPTcsFhDLiSLpWoZX0b7dNzZmBaLTUY8PSMVFCUzlRA
--> ssh-ed25519 vT7ExA N7U+hiTEzwKvglQ0At36e/p0TTA7xVRb7UvuX/4Bbjs
-acP9zBODifOsHVmM7COfBX+tkxZIPnQCUR0TskHacQ8
---- tOLU9ascA2rI4R0oIg/0vsn2dEC1LBLFN6TFRcyrcvI
-{�đ��q.忳U�َcO��)��|¥�,+^]���?��PĻ$3m�4�Ǧ|�c��)�.R6@r�]���
\ No newline at end of file
+-> ssh-ed25519 qM6TYg Kmd5m9hb9QXzbbrLWC3SLcUfy/B8bEWdJMQ1iMe5MQ8
+A4ZoS84dtX+DMOzPXOMBb402q3o6LBExOda+Rm4hbO0
+-> ssh-ed25519 91VHug rXXXRgZI91mIlLAclodKDk3V14pDyRCv5kg1RCB7AH8
+CzC46ry6tCYkDX4jTW08j7Itqjb0raz2nlmU5/7zLCc
+-> ssh-ed25519 XzACZQ KbzLsMTNqcjJ2I+Bx5moRC74Z/QKHrbFVovC5hhm8DY
+aAGFH0KBdM+nm4HyZ0X7MPc3+fBbcQrQAcvrK0F7LNM
+-> ssh-ed25519 51bcvA qv9cje7I7Sxje9xV0DghaxSxyovB37O3B1Bt6sHp/Bk
+2zEnhhy6dIOWMdbQE54xtQKfZjR2vTH+Z4son1/gYr8
+-> ssh-ed25519 vT7ExA voN3ZvXhhqv4V9FpVTd2ViydPgxvjpQpeUcH6jljen4
+sLjK4aWqGSlxxeMKPrIZCjw4tsz95C1R498bFZgBMVk
+--- Kfk+aieCFtZiKPE8toWEZwZw06sELpx1FiJCVDyLGcc
+��u��M�?C�������0Z�&����rS��g��W���p�8�{*6�����y���q������ð%���
\ No newline at end of file
diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age
index 53e26d016f5a27b6d294582d9e5223cec9fec302..eecd4fcc77a12ede5288eba2af310304e06ef44f 100644
GIT binary patch
delta 246
zcmbQmG>d71PJL2ZifNFCXPQ$$c9?mXmur}#er32tVwPukLB5$!vXgsMwzf}Jj+cRf
z0as|Tsc&Moi*HnxSxRAXv3XQ(er{Swh@o$=OPIEMQCgC-n@^f=a%O&>0hg|>u0myi
zx3goQxqgI2a7tNKh(%dgZb49TR#I|GadJwMsaJY#WPYi;pGj^&XgQbBGoiyN=C1!Z
z-Nn}RC~evNvFgoRVVi#@!RJ3b%3Znp`kvyyx3%ldw_3CBNc_+6H%rno=HAwwYx4F#
zt&Dd6aNT?TOP9wx%V)k_d{c1p+)EahHnwh1e^d90rP!I_U69~J0S~p*-!B~j0F-5{

delta 246
zcmbQmG>d71PJNbVv9_OcPMK$LR+(3DwpUJewtIwWlvkBodaAymUzSmLrb%j^epzNv
zIhTiFaavWnd9rhOu5(zrrF(&!n`xk5SeRE<PEJKqZi#uhlWRy&ny*DhIhU@ku0n=?
zzEN4GrE8W?xnrV5Kwy=ZdrDPklzy0JRa%Cxc}QMBaekn-f23DcawM1PzBD@t0gKlU
zmmEF(;lkmD((+Z&obz(DwuEVvPBEJJSu<5_>XToSL?X^<avj_AH1ML*p@^DH|Epgv
z>!{xr>$T>4_N3Rd<ka4L5usaAr?1Y<zWU%Yi>t8ag_E8<Clsa|l(FjXer*o`0?A?b

diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age
index fec59be17cfc087c53a1d386796c2d3fcc51ed3f..0465eba31c0ca76d83cf3fa6c2c0c99a94ca6a00 100644
GIT binary patch
delta 304
zcmcc2beU;_PQ8<FVU(9=K}2wFM!HvtYiK}vdP$_2v5A{yZj@JPX}Mo&N<?ImQBq-q
zFIS**gkx2vXTF(HMo@aGcR{*ad61WRvU7;LuU}4BNKjNtYLuISlW~ZTFPE;au0o}M
zv1Pe|hk-?5rg4s?xnHGcs9Ca~OHhteYDkiYcZElgOMQ+{s&|@CXe8GnjxQ;HetTb;
z;hfyRCSHB^B*mvXOV8#XoBhByajsWt-TdIfs{894c<y+dSQ6yfvTv<xy~>}JU(YM2
z{51LVYkIU7_jiweLH>0NK>=4D2)Q{V2r&kAh`i*zFRXrX(xC?;+Df^(b8Iv?pQZFv
zSl)E1-hISbat4#8{xr4U>fcy*-cV<{cOf-fcS6Cx@Asm6cJ7}m6;b|Rd-F$=Ye`<m
I1V3#B04Q~RxBvhE

delta 304
zcmcc2beU;_PJO<mTTX<&yLoVaiEp7nMz~jau~S}YNv40PZ>eQLgjr^!dAV7Ize{MK
zBUhllW0Y};cTRbxX_0G~MQ&hlpqsvVsZ&LzK~R`$Rbp0(cT{PZyH8bFI+w1lu7X=>
zmWN-tWl&nOd#P_^T0xenvt>qpc(G|_WMY<fg?WifVZE2RNlsx{aXQz@LuCO=6T2Mt
zta}+K_-?}HCqW8&vmJD}*&aAp|9em^&{R>9_T0Dl%5i=dH}+RN%Dtt^I{8vh6jhu}
zFD%Sn?bXP(e%e+4=4VMKF0DIz!X|U!f^vW6v#F2clFZg~rnP@duy6a+RlJDz>E}~Z
z6EkwxwjEEXZ;aQ>Hk^Az-fn^c%R3du>|>ACOf<KaQF!~-m$!{g`n_YvhbxyGU)9$y
HGhG4z7H)k*

diff --git a/nix/secrets/immich_secrets.age b/nix/secrets/immich_secrets.age
index 08c97e4..cecada9 100644
--- a/nix/secrets/immich_secrets.age
+++ b/nix/secrets/immich_secrets.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q szKG8gw88EAiUx26fzY/pYMVb7Vb91FZC1FEQTYRZDY
-0jBl8757lsXnxWE90iZLJcO5VUXz+E2+7m/ZfNq87J0
---- huOResyzGVCip/Sdoyvid3TxFI01wiXNaHdZ/oGI5Zg
-*c��lH��x�Ah�5H(d��U�'�nҘ;M.Vx}���"�f� ����9��f�~Jv�9�
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q lRux6HhczttLaNglBB4xdx7B4GUhs50ucnyYYYlNLzo
+nxSaMiEcscZ62uEA3N4ssHN0Vc/fw0wRsGzUXHk5vyA
+--- FpSXOah6uQRaHLOxdGNFF9Pud9NsjYDLhiXzqg5/Sao
+��x�	l�l w���\v�S-�!V���]�������}g��΃[>e�;�n0�n!��;L
+�+
\ No newline at end of file
diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age
index 3633642..19d8d77 100644
--- a/nix/secrets/killua_env.age
+++ b/nix/secrets/killua_env.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg mMvnBUGVS8d0di+drDXo7mws4Uz5T+nZmQY9uUpKfQ8
-rea2peORLvRF6qYtGKFnylyEdnV0NTc6QO3xSgp/y1I
---- xyeBOfVq3hwyckUma5LWOU9cWHzg/XY2f8T/0Vc+njk
-G6kN0!�Um����[r�H����Ꟊ�t}׊X'�yq�L��bE���Y���:��n NHnH��ݰ���'�������W�|�3���z{٢���
��'�N&M`#��
\ No newline at end of file
+-> ssh-ed25519 qM6TYg w8lK7Dhc3CzenrzJTI32uTNgXVyBUKJf7F1xGG6AV2Q
+wBlK8pbH1M0NBeAFjwLyyuOKT2jk+o1BwjkQPNc9pvY
+--- 5hl/tchAPOurJ+fDLDB5/l/MuqrSTjV2Pnhc1Dy7Uhk
+a.�A����hU�wq�<.�d��z���X�М&;ⶸ��9��ۻͮc:z�<��b>`����D��
�X�L��ʳ�h�\Y����ǝ��'����U^���+�^��3k5�t4
\ No newline at end of file
diff --git a/nix/secrets/knot_dns_rfc2136_key_config.age b/nix/secrets/knot_dns_rfc2136_key_config.age
new file mode 100644
index 0000000000000000000000000000000000000000..48f95c0935a38f1de69cbe117509485000a7ae50
GIT binary patch
literal 434
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUli3&A!O;;%ONzCyq
zE6j3pE6Ptd2`Nf;EsS*W3o=hJ@o))?3M&l?C<sb*c8PQ`GU0LwEsU)4i?A%r^fD}T
zcegMzHuTH%EX&LFNX&9|4{<lq4=8ZAbk7YojzqW3G$}kdFHphKy*M!-+#n~j$g!Y2
zDJsOv)6zR6*FE1jq9oI>#HT99(<|H~D%Zm|*OklJG_TY=%_z)0F)**d)!jhbIL|ZD
z-_*%H#KJN&I4m(=+pVC`KO?dv)Pze{S64ybA}}eh%rGm`%{(hKxX9bdvph1u+`^?O
zJFqMy*k3!hGTbdPygWC>Jd*3Uz@*7PPWRe+@M!T&(h^;+GpS_T5w824Yqdo=cy*65
zwf1Zi&Gsnd-L4bnruB3K|AkfC_L$#r*!!~leZu`a-<)M5{$y@^yYRx73w}4ne9oFw
z`aYjCHG9%lgRfR!6D_vrZ*|M^uiW!~0rRy|-u5H&<^=6n6rfVsBzbeO)~lBPQJdmA
Tm2AY#&J{(OFznVgJv$Eog&m=8

literal 0
HcmV?d00001

diff --git a/nix/secrets/knot_dns_rfc2136_key_envvar.age b/nix/secrets/knot_dns_rfc2136_key_envvar.age
new file mode 100644
index 0000000..fc3744f
--- /dev/null
+++ b/nix/secrets/knot_dns_rfc2136_key_envvar.age
@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-ed25519 qM6TYg QQMDIquZuxMKwx2hl2ST9BMXa61DBdC/cMUutcRIRHw
+l7oENezyJwfJHrgNUtFMfOF08BhAYWQOjW8v7VPN/aE
+-> ssh-ed25519 91VHug wQBzeFG2xixYU5L8/d81n5FkZMqO3uCSF60Xi80mvnU
+nPAgKpJj7WDJ4tbKGnlWAhvAUOyLIyOY3aPofKM0LfY
+-> ssh-ed25519 XzACZQ HYj1Omcc8WYq6s9l5hVrjjibg1LFHnkYkXiPolGewws
+uhrQ6nmP5fMApIJzUzwXcnlILdPvmlG4QhG1laW6alk
+-> ssh-ed25519 51bcvA e2Xng7rC2SkYiDn5BRTIDBxn7vN/F95hI+okWL9TymI
+7TJrZQlJsnGMu5jaFQllI1E/+ZGHZjGmaUpuNZSAPDI
+-> ssh-ed25519 vT7ExA PSM21ZGF9T9g6rxnsCv3rAio1f5KckTHgivfclDjFFs
+rq3M2R/LHYki4nQ68iFoLXH8VVmWyBDD6yv6y4tt5qQ
+--- KqTQhyl3ef04vDQ8eu1IvTsEaSMYtQxxBAcIO+WYPr4
+�$Jk��#_����Fr�"���B}~��P�@�.���e܅��YS�L;��P�z
&0�DiK�J�^�:�Oc'��+��
\ No newline at end of file
diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age
index 3b49086d19e726dbfad8e15f94fcd8e5cc54bd5c..1c8516506264c2b2c5da1bb3f9d11636581662cf 100644
GIT binary patch
delta 291
zcmX@cbc|_&PJLofQj~vYMYfxvb4jFUzH>#oM}(nsxshppRc=X`iAQ*`n`fj!ahiu?
zIaj4+K$(|GQA%=ZX`*?ciF;UKm4T&qRB>uvv3G`}MS+iRmV0Gsl7U%8B$uwPu0p!A
zhhdacmVQK8X?anJS8`TZM3JSXe~5*ppShR6XO2gTX?;b0T2{G-Wj<Fxa(U`<=6U|!
zF1iaZehv65P<2CKo5h}IE~QDv4?f>;koCBCs+Qw_3$x;cU9S6O>)-b7U7Evkd$vbh
zc5jYvQGQG-<7?ICNy?XZtl&Sr%r9}z);T)=#BD|8+_Jk$tvct(D@IRQ&~eCi#}766
uUEd8N?%Hhk_njzn=FZX!eEm09PF39gQQqjlX5ICzUQwOPMQRM+T>${#VRt70

delta 291
zcmX@cbc|_&PJLC9g=<Qoc7%UgPP(~wK%RDvXHdFho{vFtsYOOna$3HZOM$<?cc8mr
zK9^;cerln&Poj^DV{%z&n17&~XH{{YOQF7Da)xU}MygX#c4@h5Wte_SIhU@ku7Y7k
zRY96hg-J%Xb9rF4S*c-OhNFK;VNhhMr)gkjQAt^fOMSYRzp0CFVJO$KM$Ijkt!)`9
zZ~Tf)inn|Aaq7ZpqMMrhS6shev%i1!`+}-D98wmCC3@Dc*${D+W&fG)dw3bD8N^q;
z%V;jW&1G)7Q)}M-HX(y+4^rP7KRB{Vj_H%R%4_Gi3yD%W+j+ko|2(xS>HAlXCzBW4
vP5XGkp;5~zXZ6GwnTP60k(?jcQhh^;pH7-J>r2o%1+G;`zbVQ|h8_R_hbwxo

diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age
index c046394..05d0b31 100644
--- a/nix/secrets/minio_env_file.age
+++ b/nix/secrets/minio_env_file.age
@@ -1,7 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg OO4FC/zdYJPzw8ujHG66sX2ShWSrWfCKRj1z9FYOwyU
-84DDDS2TPxxoGxxaj4WLJN6zZfVIH7m1xC1mRMMzBaM
--> ssh-ed25519 XzACZQ YydvMTzqlr24U79p1vCZ0DIB1DmLNxp/kLptb5WtmCI
-KaJ0zuNwVsYr0pLRB2MJIix22xTdujqspFPISU3Q9EU
---- TzKmJkMsYD2ZS7LJw9qdVRsBeoxMPQjOyovIoopesMI
-��������S ����p+�r��G�F	�"
�1�9����,�kV�K�Ъ��鍆S�
�h��nhy�ld�FX+�����d�;<�fL�~�Dg�-'C���B
\ No newline at end of file
+-> ssh-ed25519 qM6TYg sx4kKW1m2RrcVkyxDMdDgh5jcwfrRDAFYa0EJBZKFnI
+WPbchNFC7tTqC4DrIw7hUZSNNxE64kkXZdXB6/VFhj4
+-> ssh-ed25519 XzACZQ GXDgzIGU4X6/oOr5hcI7SoorcowGPJHx/0X2+gj+Sk0
+NATuZ7IZ0QwM9/GtaYdLXjBs6X0enhpVgWvGVpyqOO0
+--- xMESjwLO7fJhwd0HnYzypoh3s6YRx86vSdXovvSBoHg
+9I�{�֝�ʼؐZ�d���{�Yr�X��B=
+l���]���Hܴ���`l��R��ΙRw
8Q���i4�*t�#͂ƚmȟ+6h�S&�V�Ἑ';J�0]� �=�
\ No newline at end of file
diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age
index 234ac01adf08871f277cf44e52c72bf985e07831..f9a3b40b61d31f84fb41d56446052e567d0aaabc 100644
GIT binary patch
delta 286
zcmX@ebdYI+PJKvPctu!6UZ#6+kauoUs=sq&kb!AYqH(dYV@iZYNswz^Wv)-IwwJbR
zI#;E$rEx`hW~ys;YOcRQPJUsiVNyV`Wk$GrnYW>-zo}zzj!RmIx21c80hg|>u0pY&
zt9E3fb47AsVo<iDZ>5V<grT{Ir)jZ~V`NTlsZYL{QN4LpR8d)ZN;#KW2fKj7*B9w`
zKc152%6qkH@60uy_A^yX3jNzVp;lPL+wsYRLsJx|2TXbFe)xz*`N5S8FJ`suOtcf7
z{hpy}BfHEhW5<GD$2KIb_`%g#obH?Oyq`^Z@8<<4kE9z5d|{bku~f*X_Rz!T6<;SZ
pZP~_AvUPu$yQJ?nagK2D%+--`bGJAJN2C|eIr0AP@n*(V767__bqxRj

delta 286
zcmX@ebdYI+PJLpYlZj7OX^L51qCr)0o?EtGR=QJiX0oeUwp(brL8VbeNKSr+YiN49
zCs%rCNSTGPzHfF(u7z`DM2fd-nqg|GxnDuJSBic{Zl-&ccd?~mcx8ZdGMBEdu0mBs
zzI$eYevp2Nr-!kDuVaXFct(k3fMtGYMX0{MkA7BOTD@6_zDv2ct0!0J`LjKybC#t|
zpTkkOuzJa1rgMrdo42Swjrx3`-nHxZXY04ixGGNUe%V=eI!}7br0ll-1#-Rnq)J{M
z2@n*I(Vc4;aC_GQr`mMiylUg6M?U3u?A*UVOComjtz}0HW=t2Vx*BSF!szDx4#ABg
pr~W!rK4B_a7y2(<-0`K1!UJ8C$7?QXx;^DOW~a3FMCj6_CII3qcewxn

diff --git a/nix/secrets/paperless_env.age b/nix/secrets/paperless_env.age
index 1da8fb8135d02fb883434d6e52d0b9edcb5cdf23..45894df52e63e990561fe9f056c6f8cc380247e9 100644
GIT binary patch
delta 305
zcmcb@bcJbxPQ7P-QC^g#k!x02PC=?$hJjaUuxpNwex`?EfooEZTSZz#fn{J(NNH-0
zBbQgPnSrC1qor|Dq=$QPh--vJu%(HUd4{ohc7}Obc6fG4a#@m}S5CTVAeXMLu7ZDN
zWk`OWv58Y?K&Y{cvs;mGO0uO}ic6}GlaXU#sk^0lT79~2V1Y|gP&U^z$36Oad50`C
zpY@+HsC;Ap>M+lR56=5|UBXPi+=zD;I<&I;$Ev=%s2OahA1_gp49Z>g^ZeP97TsDL
z53IFz)hR_EiMqpdvnR<Y%+tiHM_7^n!SN3lg>^JOFFz7>`)*wLOVujAFqy^orLLI0
z+a#lFzNl~UFSA=(!jg`qizl=79-L(4YZ1J|^s!IBOLXUbM*kZu>>Jl_z4l*ihO<(X
ITlAx)0O4VKbN~PV

delta 305
zcmcb@bcJbxPQ9~Vq-BnqUy@-~az>b=g;$ZYQ*c&PqOog6KzL4$r-^%*K~AViK(JS4
zF;|I^cVK#yrCWZ8zENdmR#sY?v!7u^X@Fl*dALD}uTPb$uWO=#QGQUMFPE;au7Zod
zbB4BdrLT5+cA8n4lT%fCa<NZtd1zs_VWp>Exl5^EW_^%$sHvw>wgJ}_o_jXGFJE8H
zqqF3i{j2+{8y8pGqy;C>x+M8;!DANwgWh!vE4RpK9G3VSX&U+eQ%#Gg#XYvA;-N1r
zT_WF=+@Gqbs(sInwd|$dadDo`ZD$PD+id=AQ~Yepf;AuNzMZLKTirdOEcfBN$cHA|
z0##XAzG^o5@pV4cYFl@;Gt5Buo5%C!<A?7a5GpP5y(n$9dgel1Zo{BDF4Zqr-KM?w
J6`#rZ0svtdekcF{

diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age
index 637f94230129b0fe981a6da395714bae63dde8d0..cea627501d5933d8c7cccea3c00138a66a541c7e 100644
GIT binary patch
delta 301
zcmcb>bb)DtPQ8y)QdEwalTk^krIBw~NpPN@wxzb8OIko)gnw?9L9jukQDuaCN{X*>
zAXlcBOGJcYntw)FR=Sf{o>8cqubD?~S!uRoSYDxPWN4n5nMGPrW<{k@HkYohu0lwj
zr&B>tiJ`t%lBao<TcJx<g=tb&s&`(fNpQKpw}p0qQGKPCb76Q=ZZTK?USSjOKOSC+
zQD2U%c{Ayq@~MLw`5)|WENYnT<Zb+U7yG3nNiK}#9jmWixX7Lummay9^QqNc!(7(w
z{no)eD><eMu}!&RcU!Q+=fURw;}hj->#B>CSH3cw^nblr=Z8%%LsD;kaAv4oB0SMI
zyL<22!wy>052|fei<&6L*vj&`e#6}#hE=B$8u!O`ex9ALRewHJtNc#>R%S^-*Wg7K
E06PAAJpcdz

delta 301
zcmcb>bb)DtPJNk=MVYsgnR#efxNlatrAeYoSU^NhV1AHxnPYNkNN|!{c9ofLfU`$<
zF;}2vKyHYMU!YmGaeB6yc|c0CwsVG`W0hxRsk1?Na;0aIwzp4VXrXp?GMBEdu0np6
zTc}%TReqLbgk_>*u$f6_lBs`Xx>rhow`p-!khZ>wWqnXpc%r32c{Z03x8~M(WkJQF
z^1o*p?ydWo<8kxThP_|r@NHjd7yGNevb1t3r~927OJkE4GnLrspDH;O!xDRaW`KQH
z^8epo_Qnc2MJrnvB?T3`rKtW$_`hHm&+!7)dl!U`>L2siuxDLX(31Nf3f5@9bZ5V^
zr*{5qv6fdy)jnyfxk&Wsb*wwZm>=O|X)h!dc3rOIw4v3fwB`Iijf83(7+E<JbIex)
E07?LNJpcdz

diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age
index 5ffafb6492d9027815364a9a8977dead5d5d2f78..9422a04f53113fa88ea4e71836d1c9a79e591765 100644
GIT binary patch
delta 242
zcmbQnG>vJ3PJLNah^ui`c8;^DqjO}Lf2l{XUx2TRS8+yQKypQHQd(-BK}cn~w|BTv
zF_%$@uXA37iKTC*n}K7Yvzu>7ZfS(GeuZ~cezBQZQE_&*OIk{vXG&m5D3`9Tu7ZVE
zNM&GIc~P!!K#HGFfVWAqyL)P0j;V{EQD{NFb75#;Rdz~}YguYlK_J&X#Txf-g~zYO
zxmfEu&3kFIV-B<3bET)(j23kqla-t6xIyz+%Gcr;o&}dTy~|v`@13jSnRGKV#@{-%
v;yXA44ku4K99Z$;(8TUZ23z{e1RGt#OwL)Y*>P$8ck9Ku@1LI3s3-;igK%Ni

delta 242
zcmbQnG>vJ3PJNWOxocK%Mp1!zV7OmsacGreL`8OaWoS@fx_M%Fh?{w6R!CHkwoz!9
zD_3NpU#_`Za+;4xs(xZdRYsX-sYSY@my>6)w{d>HfthikcA!T@S-7R4FPE;au7XpD
zlW}mGYpI*Qu}eUqMPP}0ex#+halU&{Xi{-_nYoXrPj+#NcY3j@TRE3(`_WG^OAZU>
zeZR}A-nT?cKgeX3sf>kL_vAa(Z$#qiovz9yu1<e9%ixIESta?yD}qnRuA3Ob(VQB*
uuqvGQs18H6P+$M4yQZcbFaNBY$&zp+So7Z5AD{f0&g$l`Jg_Zg%X9#cFI+GH

diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age
index 72fe9313c066bcba3696d48a7420247f6600b591..11fe1a434bc3a69ee7e9413cbf3c8e8ad15c2018 100644
GIT binary patch
delta 329
zcmaFE^oD7IPJMDls#k89L3*%HadM7JiN2AAMPPAMcu9C*c4}&1s&S#Qg+Z8Kc0_(w
zIhT`jYFc7NSiVtOl&68Eez|#KVMc**qDN`6vs-qRbAWNAX-RfYNl~dsAeXMLu7X8w
zvY~TfN?ufWfn#8mn|q0gg?FWqYgxEah)IM=cu0n}f4!%VQAm!3K|0s+?Qb>bFfuUl
zIILLkSFrNd#1J*xO%CO^<f?gQKX1L$o!D0V&V*5Qs*A;n3(Hv!ADqdsD0EWmhPMY2
zvo7h0SzB+DcTJT$>^;d(euHq+rJ{sqFJ}HIn>Ed$<nH0x^0FS$^(C!`MFq050tF?l
zu4KKoUdbV}`HYa0sbK45#a(vW#pI36EfgYO@uq)OnO|gG_u+g0i*<MIZJJbaWx2qw
i6$u|NMT9e$U1PbB%kgI4V}2*D*3Zw*T(W%RBLDy%f`+vK

delta 329
zcmaFE^oD7IPJMZHfLVE&K~ZXXa!zKpb9R+sM3z&fU#Ue(cu8P-wvlmgxVCm_zF%&o
z30FX2ieZVVXNY%2xlgWBR7GG^VW44_N1kcEc4CR2k&mf&O16Pfa8#yCAeXMLu0mOI
zT3BLOXu46jMOH|fwo{QyWV&gHcXD!8wt=TvrlWb1SG{X~nP*vXSRmIlPS@llU(vMX
zs>N3>w(q*XZTjh-y;dvO#a8Z`!E$v^T-B#s^S+(VQ%>i-k`<osVtxDJGUHmAkF%mK
z?qOwq7{Jy)>6oc1@8TU!J6qluimi2K?ki2$Y%e04AZPM@P1Vw`J!@-oD>b*p&7bpV
zN$Z_ni#yiqndMBJ$}Z)xoq8DZzui+OxTm(F_W19YGiLAyIkzQCGcVhvwAAxMFHcqd
h)C{gw*6d1~H0<NHCHA=O&i9`**`Vrg^4(KYjRAOlh%^8I

diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age
index 38f35603c306c37e838a8a35dd71df98bf20d4b5..da315220fb46a1aca5b90aa881d270076f59af3a 100644
GIT binary patch
delta 695
zcmbQhHi2z|PJK~Oj(K>pQ)p#!WmKMXL~3b3da83ks8di@j%iv%QkiR!e~D{wv1LG3
zK37qqVQ7wHQCOy%V|uA^PD-kOpuVS>eo=8^aFIc!d$4a-U~rC6n6X!IGMBEMLUD11
zZfc5=si~o*f~8@YM`^l3poO+icutyem3L}hvZY_Sfm?8qv#DpgM{;P9WpK8)ad4`B
zYDGv+Xt7~BS5}%~fNNl;k70pXRl0tdt6NcKL~5F;f0kKEW~gs^M2cBjSy4q$NLp(7
z#E;_PJ|+>VrfIGbc@bgG>G`3#A$k7!A=(zfeibGm$rYuE*=EJwflj`m`e7DaUM2dW
zW@TX^k!C6Wi53O=&QXq0X1UqHWs#0$RVLYHhT%qKzG;D;;YlWw;~B-nL&F1&6C<?)
zd>jMPA|n#R%yN=*!;*}Ql1mFMLb9@Qiu5A`%M5(VBJy0ha?(Qsoq|H54D<~{-Q0^a
z9ZkJ_L(9UAyuI|b-K+EiEh;SvvyBVf^Q%H9pJf!Uk4Q?&H}(v&NH31440JB_tnx2+
z3Xdo(b9Hj`$Tjk@%y$WJOb^U2%#JYN(hjMpFex-CH7^d#bF9pEFE7h9Dt2`W^z%+L
z^moZl_suqNHA-_ab#zPT($&>f@D7ViD@iOchzxZyNH<Qj)b~t@OwVxji1KwYa5m5O
ziquZ7FUt*daW~A%=bHSE|MaRgZCkgV=RdoaXPrfQ)~p2+wnesh)VfTwTd?@&)5P|V
zOXl9?Yk#ZQel-7*rr7D86KBe_eWg{r-bX*Yt6eXe^=$zc-+?k~``tOxMv0=!cJT(K
z-@UD^dRKAb*DF1|3HLW{v~`v$ee1e6Az$^Lm{5e|**$tit9%moMdr+luyT`2h*z&a
k-?3EwdCT&(vz#6+YYcyDZjj&B)^XtnH%s8JY5!&c0NI58U;qFB

delta 695
zcmbQhHi2z|PQ8zxc2c@|VN!0ChnZt;s;{|kR#kFYT6tNBOHpE0pr=<wo^xPkWMo!)
zAXiCLQh07uh^bkyZ%&>`xqEhUa79R}enz%-d6aQ(K}k|nNJVIXziVVwF_*5LLUD11
zZfc5=si~o*f~8@YM`^l(Z&8N6XHKz6RH}D)rcY6Fnwv$giFtXTWsYNbc7SD;cW!A;
zm1A&`ub)#sSF%rtn{Qy4NqL2db5uxqKxs*qM__@csgFr{SWr-fpJQr(rDJ+(grT3w
z#E;_P`4$;L<pCak<=Q?51(AgnDf&i9$pseq#(u_S+5vefo+)9Ll}2Xism88czU8TI
zKBfTy`tDxg`h|{Fp($QoX~w1=DPg8Y8RaDb<xWBQA^v5NktLy%;~B-nGlNp|jf(Qk
z+{3+m+){kA%1Tno9YfL!i}H$tGn@=eg52Fba<t2RGXp)jJd0gJEX{(w{0q|c!xBsU
zqKf<zldJqHs$4R&EIdlQ{fvVP3{6ABBNII*pJf!U&o-_~@eVSJC=aPDC@(H3%5yFE
zE;26gGxiP(%W*Wy3J)sq_H{3_a1Alx^7S@0b~eejOz}1dPfyA-bP4n*&GFZc%C^+b
zGxth1Ov+0&tujpuEC?*-($&>f$cpmtFY^pDjB?D+Eeh06&h*PPEXXsp^a{yH4NgrC
zaY=Qn4+%7ONp&g;<l3dNDza#6!A^&>pSI`P$UX?xs?6T+qusD_zL@Rj-$9SP)E>t1
z_0IW~*=yWV`*b~1NX<Ns11?@6vPG=VZZ$k>aC2~Xd|-3k<6P7mckR=kobRyyy34(W
z>#w{|WbiMay#9>`o+dL`G53p4KGOcc%vk#$N1^8u9X-`Iu9M^VwIj>;ZSCfGh@Oc{
j>=a%*@j&rO`74|oVtqf&ox36CgwX?^*r{%hl|BOiO2z#j

diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age
index 0287a9e1812413cb2bad3df29d28aaf92c638e81..ba1bd5299017489b97c386061fcdd017e897790f 100644
GIT binary patch
delta 824
zcmbQhK7oCLPQ9y>TVQCCi)V#@nO|l~SxKf_ex;>BL~f9KZlH0Lvvam-phtkWsiCiN
zBv*E1fpe*gQ=)lTRfM5Qeqw}+et=hHly9L&Wq`Sdqkp7%NNHF|nTfNJ374*&LUD11
zZfc5=si~o*f~8@YM`^l(K}B(~K}5NCL7Jm}SXzmJxm#$JTXC>KR;Wo%YNWGyvUWjw
zW|*&jWM!}`SD?OsS$R}gMY?yMXIZwVe{f}CiLsNTkz;5?gmb30p?_M2VX?NGesXB~
z#E;_PjsgA_Zeh-TxmDpVZoZa=`kqnAKE7$?`jrLFd4*L)+NDMjW-j45{_e?K+POJ_
zArY13ff+_VhLQe7VIF2Kjz(Ek6@hsX>7{x4E-sFl-eKluxgoBT;~B-n9kYtcL-JfJ
zUHvi~i;|Q4E6sDwBXc7w{Ves1Gs**#!_sns%RF)n0>ZMnii$%#BXTNDBl5#5f?O+$
zLNar6+$~LglM+jPEOR~F{QbOA@**lt!a~X?pJf!UPbw?(4Js(GEcQyx@=MN4b<YcT
zEjBEP$WO8`PtDZNw$wJv3JypMtPIWPN{)0k4D@!g2yiR+k1+H%v<&v}()KOSvdjud
z^vZKJEiCZMcgzi}^32ZX($&>f(9dvoPx3HJEDJC!FZC$QN{TSEsERc7aLo>IjPi^M
zD>n73w{XucvJ7!4=F)HWn?0xIfyK@bnrk$edlQd%T@$TU576bC#&zr3yW*39W#5l8
zG40l$QR{imWP{(y#UYx)hn%0hi|KVMmQea}IQh+{pJ$fkn>_s@UR@x6-|KYfgsmn;
zN2LRJJbmhS7sMRtF!MjyWVv}!asT0qFA^HMvQ;`#FV{=u9y`?G-lyN5qGiisYvrSJ
z;M}!3U3aVaLriAtb40#h=;E2VeukLBm2d3Fw+H0?UAZ^#LGV>8&%?d*q$UJ>Uva>*
z^qg~V_Xlsk@MQU;JCB7cU3>2ktHRWET=M-=r>)vWv0a8wUvt#fvv`J0o?&bl!p|pN
zZNkeha6dwei#=OETx#8h#@L0ktyk8kTULd5%%30r*mm82i>sZpO?R|DzxugE&_%4^
Ohl4@(%=iC)c>@5rggAEq

delta 824
zcmbQhK7oCLPJLB)gjs5?nYNL$xvOt-fm3EyR;r^%wohnKSaC#nzNw3kxleXbXr_~s
z0auxMx|5l6skxzLo?o_mq+dmDfR9_TN2y=9v!i>tv%ZB>X<}h`nzv(^0hg|wLUD11
zZfc5=si~o*f~8@YM`^l(Z&{_6zK2JCZc?d5Xoi!Kv0G6@o^P^6j-f@Fp+!|tihET_
zm1lT*YD!f;S6-I8SxJg<wr`SKSyXvhdcJXRVRmRyUQwo-Wre?+cA}9>X+@5kvsY>0
z#E;_P0mhYS-sNdIRUzdmF5W&RA!&YjX6`xJp%&VXMkYRqemMczCXp`Q9(j>mu3`H6
zDV7C36-k*UDS-ju+1}*^<`yCPeopS*ZYe3IA%UKGi5b2w<s}A_;~B-nBT9Wt0#j0*
zBTa*fQ!I+i%F2V&jos371D%7a0?qx+Tue&xe4>o}OpWuo4E*zQiql=)yi7c@iriey
zt2_$xoqQwA1H#KJ4RYNg0+Xt=3yVS{QUgLKpJf!U4=9Xq^GPWvvha^`cXadhH?VY1
z^l)-13{EmM^$9i$cM5bVHwp{YHpp}2@+@(6HuUx^@eQqX$x87kO>s{4%e5%ej!X)5
z%nYhB$Te}P()M#V^2svb($&>faL@EJG&3l74|CQ|F(~!S^Kg%FP4UTbj>yvY4EC*b
zPfskXFU|AyGYSeQ=5o=z{d}Ifz0UN&IXPDa3)!`$<rH%7F8txxZ<9HB+aKe|KkrXl
zdQ4@k<x|jqyMFlx53_ImJL@8?gI1MQW}UiK`lI33701Wr6>C*$GfZ?hEq^G-9LD5o
zaVBS{DEq1W+fJXhPV~@z>f6?RbH|hrR&^1<7RjzC<@(N!zkBoQT6F||H;A6@c;-0e
z=;wZS?uFO(tU27fyiVcka^>3hnvb(2zPz0K`oz;eO&?DP6^fpm8Fk!6zkc_j?m0jI
zzCB@|lB8I9JFnv+<H|o1J$2X?o@w{vlF6T^e^9jjbWK3}+|wyfC#lxT@iA$hEVSbd
z>tZwvxN_L@S(5#0eec-%hBHwmO1o|esU>_%F4ir1D{7|gGWl2G!GPA~TIuuhn<Px_
O9i)#-D>6LwlLY|S!Z*YK

diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix
index f9fed44..f02c447 100644
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@@ -33,6 +33,8 @@ in
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
   "immich_secrets.age".publicKeys = [ minipc ];
   "paperless_env.age".publicKeys = [ minipc ];
+  "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ];
+  "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];
diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age
index 631523c23af390151ecd68122003ac31f9178bf2..003343f8300afc5d5371610bd1c34e05be4f37f2 100644
GIT binary patch
delta 440
zcmcb`e2aO4PJKvlL7st+TWL~SL{7SqzoUL(l~JluRiR&id0tS2mwt&)p?`sQXr*7e
zD_3?-ib<Zkg_B#6ew2y1r%8FaMQXXfzKK^+p?PqUpFwVjNt$-Jeu{gk0hg|>u7Yn!
zfn}+_yRlbNfOkM)Vz^JPp+|6GU}R{jS&?bFp?;K8R=r1YNrpv;ZzR`|kYlXQp|<iB
z%6wb(ekn<8zR0gG=u<bfq4LMHgRU>w^8W3dw9I@pd-&X?{<ZzVt!HO@PMX<x_x&{6
ziz})N)gJ^0PYdIk?dknVtxlx+@#U>y=akMVom<Z}G1OpX^uolpoi@Ie52r@@I^CP1
zW&31W%h!pUJt|(;H`E!t?Qk-<vMI0L?DMiZDGiJ7nI2(}zCJNa==dPP=c^c)DjfGA
z@Y1R;eU-s3EE^La`EOIzX+L2oe&ulKw}Zm@3x8@bKECp+S~o6DY=)TK%723T=QbRk
zu2E?o7~2rk<2~<_(S?ilLPxx+SoNB;JL{f>b#}AZt>47)(dnRhq2ZON%kpnes7-h@
uP3N*>rILik`$mNy7Zxt96KrYpKjczfw9Ak+u<@^kA=l>5nP=Cqp9BC#^}HDX

delta 440
zcmcb`e2aO4PQ9~1Vp?gQb8>iEilbw0X=$RFZ?Q#4enD}HetC#dP;p*jn0|?mg}$ew
z0av-3PqA-QZh&8Ierk52Ym~2JRBl04x?6f`n4^nvwv(k(MNU+zbGnC-1(&X_u0lz8
zm0NIHh^bMDiJ@^oNkNK*ad}cjgkw==qCr_sm`P4valLbyPo$+`hyj<&qq}@vTPEDm
z<Jqe3GsipAwW5btY|)g*HhSOf_9Vo(W}Ilv{{Q4>>CXDiQZtt>{P<Wk#_3GbDucco
z$1i=@za*#ksgj%XtJ*mId$x0*Z<ac*wsVD+`77}mxsLDlz6ckXnl$nG6|VhJB47Wp
z&1ZLSG5O(oq+&`+{fFjjRy!Q5-nutGk2&11PI7BXxvIVN5?S3{cSCP&*xvc@_!_x4
zt^Usp{#+<Dbp3GrqoGSo;4|s#^S`!Bhg_R7FQ+Y-eZ79;i=5vT8x>eZPE8W&H#nl6
z@+fcCkMuQ1Ix;qyv^{M&v1tFlHK`2e1>W3^kNH<MZOY1jb-La6_20cQY?qlf!(CbB
xB}?PVgLmQz_7p2er|4bhik-=`@5#5GRTpx!c2piIJN8j9xarW3+-vs^0083x%x3@q

diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age
index 9adbf2230a4e1a0e60a7c01b8b5c9ccadb76b417..42f873b0fc8544ce5b149a02943205b0e0308cfd 100644
GIT binary patch
delta 309
zcmcb?bc1PvPJL*xxk-VOPg<pZrcp*tV3od8N^!8EWx028M3ITFd4ayUX{K>fcz95b
zFPCwFb6U2czgJ{sVW_9EMMhRhM5TE~dU>#^rBg*oR%KyUUQ&QZvafN51(&X_u0n}^
zN>D_ZXKrCgzH3Bcc)E9nnWb}Dg;{DyN_ei3Yh}7mV0~tYX;4s@mkHN}*}AXlMN>Yp
zr2YJ@@YT^_i>GnYx7tYo`+jf;?LMJ*JT@h4_2OS{8&=yIFXN2ZvuE|pcgfNpe3+MU
zyByMHy&k61bH$CZ{_=yKRV-`_Uz8OsJ+?S7%{$`l?Xh>V){8YS54Jw^eyka2_Ko2~
zZ1~ycZ)rZc3lpd6Rdl{_?7RBr0H4OAI>BdsY17+21u8Z=yx+9RHNqjP{p~iz6SGZc
Nxhvb|Z4Un<0RX1wfLH(k

delta 309
zcmcb?bc1PvPQ8<{hqq6$n`3fChO>4~X=ZAWg?_1jL`Yahc5bL?cu<(Xt7oL4hpV@T
zD_5#-VT!(YqD8i)WvRALNkp1oS-N&`WOk5$QNCHeW0`reiJxzof3l0A374*}u0nCL
zXH|x=cVIz=e?>)9nrE?RWV(fcvw=lrp-)PpduDQ#Z@sojxVfpjZ$6jOpHE4$7t;L}
zerIC}QYrNps{SY<m8&8slkGJ1$mXUsx11xi!$tH2t?$l%lzZ#;kGX=m91<(eE?~R%
zsqb0J%R}=Dg)^^n&AKa^V)NwL*5JTUy{}mf-45pN>$arsTP0LzXqcnsr@5G6=EgVY
zJ}+kwI=7&)_(HJW&OMc(T(_p#gs{I^=CSVEquaLwMGaTP+sSqJl$fm7&HCThf8)an
Mj{kz(*0vmy06>*{umAu6

diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age
index f218338..59f797a 100644
--- a/nix/secrets/wg_private_dns1.age
+++ b/nix/secrets/wg_private_dns1.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg OKL541Y7HQSCBtUqWQVdIxZK9HiWeaPyAWwkcj/bsgs
-PviTqNl4VLbQtErGDpXFEJSeRf59Mx0v3qcznEZ1tTo
---- yRq8T7TGu/yBKFx2r+t8gbohrUHDkyXdvsB3n5csgpY
-kM�Ql?N'!��.LlL��BoD�Y���:���_��V��c����t�ci= �3�rKv��M�f�Du��
\ No newline at end of file
+-> ssh-ed25519 LZU5Eg YCaoZYLxmyrcSVXaTqDeC25n7lwuGlTDfWPNxg9etn0
+xSVH1o+ITY39M7X8FNpj5liEW/20HTq0ZRxsoo3U8JQ
+--- i8MfM8cVg0SJnNqUYeTQ+dY2FZ6yEhIGkiHgxBzTDYE
+
+F�0e�ҍ�Y�
-{s�h]�ƬfAp����B^��1���e�0!�3����s����"��j@��=�r��Rs��(+�"
\ No newline at end of file
diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age
index 536fb4ffc998396a24d6837bae31af7b0789ba95..64d55f036090e8040dab8ceeb11936677d515df6 100644
GIT binary patch
delta 220
zcmZo*YG9h6Q}62HsITu4kQou0o*Qo9ky2@Fn&IbCrk_`8Smb7E;GdJ_6>i{Dl%1Db
z%vDupnCP9FRA%hxmgZtvVd!VzQ&{R-k{sqAoSjw@m>3Zmm1G$dVp&*}&ZVoXt56!G
z?PzA0Y+&S=80uc?l3{6Jpq*aflN%Y}lW6W2YMJSg66&95;E|c-=E@~`Pxk54{L-CM
zJEfnl{=B?;n%KOLKT5M}rJwqGg|5Hz>df=nD<)Qpem62~(l-6bW9QOXvgy92?iuH;
X3!K^d_s=o^pWt+NS*iCswX??nz4BG{

delta 220
zcmZo*YG9h6Q}6AUZt7~0=HsJZ<l>tY<R0i!npLLnmlzxx<{qi<kz3)G?iuE7UY1{B
z!j<Hq?Os`4q@UsvZX6nr7Fgg@5T0&X92Qlm?UUwel;~1yWSN}dT#)FJ&84fWtB@NR
z5*g)T<ei`CU0G3*R#cJhnV(yjnCM)Ymgf`ZS00fa8d_DLo$Qihp3L=pbztoWr*Hf9
zx>S-r^cDWvu|T-m<fk>CsjhX~CgU$&l}S0NzrLTDcPHgu{=Uu1neFTv0)IKG-*57I
Xv9@>GzO|Psk4sLSV8?QLMeG#-Z8KNY

diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age
index 2fa88e6..1d0e1be 100644
--- a/nix/secrets/wg_private_minipc.age
+++ b/nix/secrets/wg_private_minipc.age
@@ -1,5 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q 8ESNEQZaTfjWl4qGZJV/GPN+tFozDmiZZtXCctRD8yE
-w2+Pjzmotz2X0O8ehb3TTOLk9YCk8hqRqNKfNNnLQIw
---- pfmBROvSCK/41HS44uMmwU5izVCyHrRirYjL/WBAhZQ
-m �*Q��v"����+��JQ���Ā�'�P��hD��>G���J�]�
��Ġ����Lݩ����	�N��̤ۀ
\ No newline at end of file
+-> ssh-ed25519 yMKb8Q QdFcYSyIYFlrx1vOfnWaFzULi8AxYIpH1HXLRZzs+iE
+3JG+l7U6AXmWe/H9J1B3dFjD+GCNRM4wsNWR0CHU0PM
+--- UXqL/EG0JYwnV4Owi0Gy4BnpW7QkgiF4z2P9Qskfq4w
+@
+��q�����,�YL��3�)�eq���aK@]��e���x�C�
+t���v-G!�}����J���i��$=
*��
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age
index a9442703dc960a7f1486f18065350ac5cf14f3be..5dd33e1a86e3ce1990b794961fd8f04b5fb08578 100644
GIT binary patch
delta 221
zcmZo<YGj(AQ=jaVRBUWuSeg=?o@$impJiU=6By~0RN(FH>=xl0TA5Rs8tLqr;vZ;K
z&ZS=vkZ)A!lIs&>=~nKat)H8osqbQzmTDdnY?K!jP-twL6Xcd;?(LHq%B8ETt56hZ
zP*h$~S{7*<72=VZ98{5}?Gllet)G>l?O7C@mRaOu7FJvtmYkmCk<GQ?S;*^S0&Kpw
zufI4sm*L>C$uooFC!Try?(6-d*MgSFblm(r!Q;ZTnzNnmuAe_F4OaInS${Fj!uSh+
ZmY~PMiUK$8&!--)IDeJ#f6~5v9|3Y<Tgd<b

delta 221
zcmZo<YGj(AQy-Az6;`63Y!cw&X6$F;kz16Nm6z&Y>Jgq=>5~-|Q10zwP!N{r<7Vs{
z%H`)_YU!2kUE-B(SrY7<ZRDMnm6PEUob6-bloaNeV^F0Z8BypKo|l+r!KJIKtB_^t
zWMYzKV&H4x=w)J=;+PawT2Pv8kd)$>m0anl9U4(!78Y8W7H(8(5y>^J>_d;p$2GRh
z>ls)!Uwjv;bLQ@h14Yu6O&07I^}_hu_PI~usgJYceRJ)hxaO4^vCn)TPVJpr5y$v!
YL(hd!--c^bc8iEDjaeM_*rjhV0B`S8KL7v#

diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age
index 3cf2891..dbdcbd2 100644
--- a/nix/secrets/wg_private_vps2.age
+++ b/nix/secrets/wg_private_vps2.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug nuqwTTdoNOLWvbQAIhl9WguvArxG0jNfkFn3qM8VyjE
-NvhMCreuxdWHezfH8cF4wXjO8ZbG7yQC8+sVnWFghFM
---- OGewUdFWzL1PzHGBHB7ulJVi5eX6UXKLFUyfbvGErmY
-ʋ�.\��Ņ��iқ���~`�Q�,��W;m����pQ�TY
T�z?]��T-s�4)�ZP�,6�H5b�Ԅ7��h
\ No newline at end of file
+-> ssh-ed25519 91VHug MzqFl7ZTH4laSYXRYPbIiXadl/bqVXPHRM7wD5aLhy8
+Ng19G3jaJJr1s33i0kCHxIUQeTmoISTN+VQQD3rB33I
+--- JkYGUYo6Ys48HI9UpXGardgf+k+DC71dxLiXqxMmFEQ
+C���q�
C�!�n� ��ƈ,�b�A�8"�MeNьn��M[(�֡�Xͤ�X+��~�ؓ��S�n�KX��i�8��>
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age
index 5cb419d45a29ae348afb586c44bf9e0767d1f022..f9b5098fc0a5c5f760dbf1d7cd824ef9159b2cd8 100644
GIT binary patch
delta 221
zcmZo<YGj(AQ}1k6o?;RjY?=}pP#WZ|UEyw&oS2)J<(=#knNwQjY3`aHZW83<TNW1K
z%H^8p8(?JM=i}n!<?WtqYMGXmkzVDMq@5jR8Ic_jYV4XD;!;p$>}BCy&ZVoXtB~kp
z85yEoY3ku+SZQqGlW&;o=2(?cnrv*G;+|)cnq}yn7M2zfn4RtG>dN)tm%w-Sk0rk*
zvbP;h*>Gf;@RAd!SIhS<iO=S!lk9!CBi-4T@tDs44+myBiymp&yJiXFPA>12hg&%!
Z7jI+y|K#<adx8w@LE8Jo+U|X@1OU=vRVn}g

delta 221
zcmZo<YGj(AQ(qC0=a-de;1lHGonq=5<XYinQJLlGpPS)a5t(lpknC3;YGCT(S5g_8
z%~kG{S(Te^V4RbiACwbhm|<SwY!U9~7g698S(KP$kmr+P9$w&YloRRX$fc{RtKe4d
z5}X#|Tjd*(T3nRk?NaIF9T8;|80_ril^9TH?i-Yu80K%`;pJqS?a9TH@;r3A@<WRj
z2AQ74wO1Y;SQKs>)Dtr^r(bN(cgb=mrI~Wlk9UOZvtQj|anCM%y+e-E+g<j{I<4+}
Yp8UN`n_2x@m-?<r>%X$sM5^%v02hx^{{R30

diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age
index 7915ceb..0674d3a 100644
--- a/nix/secrets/wg_private_vps4.age
+++ b/nix/secrets/wg_private_vps4.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 51bcvA jfwnJ0gZN/FeF0krZ/ERWq/eqKBGwANBwea3xCJLeHw
-x8ccoxcT8Yn99d6aWzZ667jUjE4dHPfz3ZIg9qG4xe0
---- H0b14xAs2FTADz89JQx2eOSmAgN3Rs5A2o316xzISwc
-��@��}`͠&9���WjWS�E��H�@���V�˒x
[�����?���U�u.���~����J*��7��ҷ<
\ No newline at end of file
+-> ssh-ed25519 51bcvA soCOaoBhsAvjaw29hw6Q9JkrLGbfQEwgszOIl38+CB8
+uj17MiT/crUT+LXF9TEylo131FV1cKQbNXQNWCI1djw
+--- MAVo3X1mO0iUC0mEo4wbbDbK19hKxB/zEcfqfR4Bxsw
+2�}[�I,s�W/�8����KD��k�jz�H�,(ny�ߔ8u��q.^Prͪ�C���M�`)�1��f�y�,X�Oҡ
\ No newline at end of file
diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age
index d870bc4..5bef662 100644
--- a/nix/secrets/wg_private_vps5.age
+++ b/nix/secrets/wg_private_vps5.age
@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA 5Yp0GcAOQbgRlxiIBgDt2O5NK0zoEN3PdUQOFsKtSXc
-653+sJWsCeQpu6agZn85RU6GOrpMJY+TbzqRLbYvnaw
---- SYT84Omvncdv4tQYH7Put8sXqqA3LBR4/DuVyVCVbNg
-���v_Ab���L"f��R6�W���6�hep����K��e�g�,E���;`��"�G
xu��V���B^�+k��6���
\ No newline at end of file
+-> ssh-ed25519 vT7ExA Z8248Zxd0dGjx/YtU3cVKwuKMDRaHQpo6d21bwSOWz0
+/7PxJCz7yfuGuBWioDQMizW9+tL7Ku7JEB2h6aG4vmE
+--- xEBearw/OGRugS23zBrNGj5zKY/bNsot+UQOcCEATWA
+��!�p�%~�)6-Hy*�e�����
���g�	��p�Xѷ�Ӗk�� و��m�4b��n��������x6d��e
\ No newline at end of file
diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age
index c9bb838..05e6159 100644
--- a/nix/secrets/widetom_bot_token.age
+++ b/nix/secrets/widetom_bot_token.age
@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg qE/RX7sfudkaWg+9A1jRP84PnGCC8f7y2Ai308kN+zg
-LnySP1Ywe33ECGtFx3Un0+QcxH/IscCHao49nbuEvm8
---- DYF2tyroJ1KnECqhUvzLyox9wULA/eEH5SdENW2fPVc
-)n�CzL��b�!�P[��>jl(9���P@�{�����;a#�B���q#0��+]��-���M�\5��{��)�laW�k��RCE�tc�3���
\ No newline at end of file
+-> ssh-ed25519 qM6TYg XJWJcqVabkHFOrbsNTS6+jc/pQ1a4D8lZkObT8BZwiE
+DgFVt1+01MNlPm898/qnC0wGbs6eEsLcHpyANA5tpsA
+--- VhhquCcml82lpKjXLecBoCz/2CHNl2S9htU2iIWfvyY
+~��'t/!Fb�[k"��y�f�i��ܨ�L��G��g!�FqZ�aA�3
+�i��E`v�8��<�1F�mp
x~��)gc��7R����&%U'X�DD
\ No newline at end of file
diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age
index af313d3a6781a81ffb4869949b5bf2718cd688b3..374e672200052d943c1c7ae3029b858fc3708132 100644
GIT binary patch
delta 4000
zcmZ1`zf69DPJNPhURj8Xr?a7UqMM^ply8VnUWJ*lNpMMiYNkn&Wo3v<QCdZEd4^HA
zFPDE*VwI0$XmPQdx1X1DKvju_QD{V1Nm-tYyNRnwptoVJMO39<WRy#k374*}u7bOJ
zr9qyhaiCwBlVfCfl5d!kesOVyp>buXk9T02zh`h&c71lFn^B&2c`?^@H@{hr_^M(8
znhxGfey#E_>%gqLQ3tx%eq1{D{j`48y2q}^BX~}ExcJWf#$y;{7yIbZgDw7xuN^W<
z&=<MLcWLq_Ge(!H^D3VemtEQ|xN%xcbfkZ;mBAgpy=N-aZ5}6yZux9`%`j{Ks<Vze
zIFw`~tluRcs8nOD&kE8}%X(v7;=s~Uvbx(fGc$Gfecqq1m_CF)<}5Sols};UJnuHE
z_#zp;eJb?<;^(g~k+o-1tra+NN8;^eEw<vGp5-lfWVAf1c}_%|zdHM#zw@WJ(z1Yl
zPML?%DPb@FcINK3SK0V5;AP>LpO3ct-hU>#^Ic!z>Nigl{kASYm|5R-LTHiJvqmkp
zWTwCW(~_pzxnE7$xis20Bt)iS5l<y!#617!HdbF!pG=L451Y@b^y;1*%bUxy<)*g@
zK2PX4Bk`=>Iiu3|pWaDk&IN^=eps+fH(M1`@%_;C;`ofc$IPUxBMZ|NI30O6T@yE$
zDI6yL^<wCXybV8@-Y#X=EeaK?zp~t7LIY#P=@|@vzux{NuI2DzI^XS;FT(Xi0yZ*F
z?@d^@_rV_#!3c>tmt%S~ey6C#rW|cOG9zDe(K9Qr)4_`vGQxjWw<T}>oBy{W*6#12
z_g>vqjs3e0?Z2^+A-FJ=htXGTs>g<d4s2{T(cK)ULK1o2OxSfj+op2fqFo}7YQNRT
zUO%#2IIK8l{p$)f3)Vy1zUw-3`N=N2uwj$PD}zJJ{eD>U$Nx_J{7}_=W&&s3<GHUZ
z_>u&VI4E4WnX%mT)ert;={&K($?4OcTzBN^I#+*?RpRo3W3!g%L>{?$?3@_K)Z8nk
z@A*5{I4^vA=k$k*<!;Zs13zEYTw-;uTK&Nz?&^B4)O~zbDgHdHAyscn{+TrA$9k{V
zj?rnazAW*n^JT)0cgj2E_)oBWd7Nc`>!F6@n#C~-UpC)j)p#N8d|GPm?L(>h!LPq+
zToOwxnHn%@R?M0+QVnyW=PEV?NWM7YAM<O?I{yc?*Vl1u$WKct6iePE#QrG2@O8<F
zJ?&qwuHt;Pv7Te9&!+j;?rv5%8Jp;NW6k~y-=2`GS8D_oU0_{sE6KQ0x%ZpR!Eh$E
zQ!6BMj2{a<IuKmGB%{+qWo7w3wbO^WrIe2g&#TX#YM1hu<8=9#@P$kVXFF$R1a`~4
zpB?a4wQ0)A%hl1(v_)>evHB7J&{wJE>~7z$0ux;g9h<waB(XlJ-}^lAoVJ>@y~7rV
z+b2!^gx;ubn7|n8nt!$a-rMYD$L4+fct+Mcmh%)_SyKMvTXP>LzRFxbshZL0?~}Q$
zcU?-XW(o*sT(Ug#BT4#G@q)RM8`s6iDrL=edGK^?vysWR6SF`3dOrL2ne^fpHm{b|
z)t#JSI87&G$D~M$S>~zzqPGm{??iR=WxH)VArx`$*70j>tf@;S7iyaeDX#gvZhb>a
zeBaEhv|2HhuNrN~Y>e&ZZ1dkJ*pqgd>7GJt%HNs%855PdRn~9Wz@B3{bwMm|#Hs9P
zm+A|i)o=9$n$5BwTvZn5{S(`rT@n27!-;LoVQ<B(FV7ARYukRK@%x>In6}kTo9eU9
zUh%eD^yjAfT&|nkVKW<w&qs9BI~$uFyQU!b{JLL&W4}lKy|!OQzggzZO-#<vV_miX
zNS?;C+RdwDy|*S8me~lb<_%3~(92ABcFvGkb@Z=M!gYSn{T{J=Mcq%n@m-63&p3G|
z`^hEO1R0s5*M+_~v(#qI?eB{e_j~@dsa~&E@7nyQypiYqA>+e)eq{VSFTLXO7U7A>
z^P|r6oo5U-iO{lszN<pjD`@JW;*Iar?O&J9Iz3<MN`Lhx@tpVbnBxBMOx<gA>j2-m
zne#>O9x$IHI`e&fapC9AxCg@X-EPKOO;|bE=SIAK>>&@s{uy1tPSgI^TAj(b+!=hQ
z_D{$D8^2`h>$fae)n&KptjA#y<L=00i@vRLYqlf>m8}-ve$+nfMa1?^DvACpE_oVO
z2DnCCd(0T~+kxLd$HMjYff)zfywj|2A6x9{t@1E+$)W0#_1XH>ELF1C7Co)0ytXjV
zU~aRlPyeRxErFiP)=yzl^*!p?li|PTjc-T(jQ8eJzrDR&FV|;2&OM$tN$K;g=NZ*X
zPj)PlTe*`f^xpN$Hv(JgTEu1@zOL-^{?BU52G73Y4?lLttqh5<Jkhy#$5~D@2MgPl
z=6;=>bz&FPYBN;Y-bL5X@@V#(a{1=&J}G{aLdlxb+D+daiw?+eycI8B_*qME>E`sd
zBd!4%J8oMf>{VZ`Y|A59zke^!5~*JGYnOztR9h%LU%62z`67o~T<0!Z=HJt_&wpC`
zdUJNx^|c<)IUSFSy2M^9tqY$gdRz2z_KF;?Tc&Hy_-visbIPNTS+AJE|JJRQ<;?#@
zdXi2mMOmGW&Dj@v!1VDZwpq$@z8~yk9|wMueV)*AHOQj=xXQF$`9I{?JbCNCT{d9V
z?fCIZLaNI{C{XYH{Harxv0rX*cvLNLEa*tyf(Gt|UcVwGC+<<L=Mu<!D|Ln6Pb?(<
zZ9<a9i(O4J;ruO5b%9;GE*sZP;mnbmvU6%?f|Pq@rr!4L-|q2Dn_&DbMZ}F=fl2@2
zuPXb}|9XA?-A0FF;&+`cOgzzhU1g41{R#gaoRgNm)jeab=R3F7e$yl4CwT_TmuxyB
zyv|g2g}zy>=A_k{GK!P<zw(}UIy)hwF>+G!4v(sb437^7$H_j@-egjFMb>NDrr`V5
zOI}N6Yv;sp#?@r?2fF>A&br3oMa0ZkYwox#;d${fmhYk1`$ISX+V1t_@NTiIHjh&D
z?{%#|qwDR<^yird%Y6;0>Dv2P9D1%7uJC!g?soW7slY$y9v{$OIIp>T2j5eXu2~<S
zuXx<TwZUrF%j1t?+8o$+_kK#fdY#q0El6hd58LDm`HLsLS$b1HnMdQove2&c&6n=?
z?7XFAE_CGLKhA}@#d3R<?>?1p4$f^=d6i+S&egN)gkJsa?j<L(cg_?Dt9^2$nZsZS
zpZtw{dyXlRQDr-?nsH06)KKtQcx>;5R_|4R9vknM%D-=O;r(~jWSdW1@~nkrcP6#j
zK9F0rZkq7)HRks_F7<0YWV`FvcY4)3y$e&O9hHt*`o`Sf>P>r^?+LFHr8oLwCP-h~
z{rcrg=czkg4HyIV7u0`zBzUUpV8rLB@A+$tGwxlk6a67375Ve&x6j58pYMAvfAO$7
z&*h}am%`^nR6X|Idg5$o`-Ac`+kd`!d}Qm3l($o~;*S6Pw%_M2@4-Ww?_7@T)^}hE
zntMCrp$ON<@VLo_(^;lJDW7TId_-&En*)_rs_$CnCJS?=K4!7Enyhwb>Bf5TjSt?w
zeJjJoIO$<<WYHp*b340c^t-NnBr-{AWAdRzyAIi8@>uO+pPMZaZB<gQeregZIlqo_
z-DC@Fk=vA+Sv}{@lC<F28{-@1XSQgYO7Zu;$+`dC<=uuEpWGHpm`&JXslmaZGWBxl
z?o~G7T2oXuJm2Ycmcw`6!+p8=GIa`ff7P=T^qpS!%He(4wF9SaHbfrqs&CR$tFv7j
zXfiFcOJKHwN5a;w1+VT*RPjC-#(8VihhqL#@!-a+Pyzk-e-3}2;^djRB3j$bdEu$M
zxqLls>J5Ccvwjxai*jz#I-~z?1<(KfmwWx<<?fljFTHs;Xy&o*+PyK_e$fjvrB)md
zeAr=Df0n7gQ`B<tzd0|GKXBwWCB0j)&U7i)DeLu9oFdE?dh$PYbTx`w{O;|gdqPgT
z&qUPznPT^@T2OYc7u%_m>wmr}DqqkX?z&|w*MrQbYhNx`StQ`kCi`^btUEF~TQd?|
z*)!yA)4MD(?0gngFHo57bka8V|D4q5BaH>JJ07Y%TNqHk&Z;KMFf!6%M{B~*Uu_4Q
z@3e@WIod3HhIx<kLMd;b^|>$3YECib``amcXa5uTYf~56gfITIX%EYSG?PgM4;Hga
zT)CJL|3oK$!=a09nb}V3`Rk4<^BL(rz0@jSQmG&*DRkss$mLFTC*EBjCR{LIBD4Nb
zQ-R!3_RL(lyRA<+Zq|EM?a9)5blxXHuKjeDsgT#Xs<rP!yrL|cqmM5-;eTfF`V~@d
zZb@GXZde+AJah6ki>urC7f18$DVuElNQe7j@ZtTv8dJ8h&S|mSw)fq+mopw3#XsBk
z@i<T21d9~mpvr^EI}WyNmSFtI$8bQ+HgW3`$Gh{*jZV5ujr9_<HVEquuIDm%u_nLa
zvETKJh8^1)dX=BB|Kh&$;(en0my%mMnWul8_T!n_gc;T47IsVgf>xeA5zgfEeDh@G
zYT4V{K9nr9es5Jj^H0x3>$BT#SYLP{E|k~76r-@HGF?*X`22{}+Zi45FRVnbZRA?h
zxyvcD^-|@s$z^+AOc&4;aS`EPQBc=ZuUg)6kU=tVdS8|03|C&Jxz_u>#PBTBFbpcu
z_^GeY-S=aK*xpNlI~rr{I8WNxJzL}VSY{t<vU8E}t>i!M2j(1$Ff>@#eq!d?=uexf
z>JP79r82iDQlwoi|L32DqHIAci?>N-=bVl15s9Ahx@fK5iZ(9xMElvnyE5K9aW7b%
z{i&Yy4HvKFenFkOoSIOUn=iV99HWbVTg}?ZToo(!s@VGH`&--1=h+qgPAuEuv`d61
zKA@+z?tq__y80%4gD57M?EUZWPkScpS@hUh<j8iZ^H=S4rte8isQYg$qxnzaOK<+d
zBxawTi|%a^*%~E#sPJ4_jl%J+3ESl?uOE>)Fzc00J)?J0#&H=@hCQz&GEYDGuu`3M
zsrnD)==&@;Q-8Ux-};B&PCTfv>0v`V*8|g3E4P_SUCeDITNb{%EGYXVsXLsti%GtE
z$6BfPaV}*~86`3wSnND*8@%nvv&U)GcWz}S?y)&*EURi*vXALZRrCQB;rF|*-Eigm
zsBmuo-gEE%UgxTBR~Oi5rnN)JJ@RDd<Y~Wetd8&hY|@--#PmD9BFi)G_ASdFy^cMa
zx<8Bm&e+Y%zjs;YZrSgW>=kp|)xUM{EYV-Jb-u@e^${{tKN;+;?D~29$3c&k`b%0W
z!|w%rwh2ho@8G=mNbvo==mnQr%QOpS_*^v=*tuXi-z&eCB?qIHs@C6^xV~!hEH1@P
zPqE3JZaQl<Eq`hy-8J<8H@~Ve(%NIC)m`Ur*Y_N}qI%Hlhil<B@464OgkIjbk-Bk3
zAmb+cjHPGix!(~JDAHLoC3MN;^CJA7jfdX$skvJ1{J1Q1#rqY<W#%vXx@yhsv&v=L
z1^Z9--hIvK8W=S@YrXcgdixb3PbHT>IQxPjU)i;1O$cvet9YIFmHP#;E6kR>0|1Nv
BnneHr

delta 4000
zcmZ1`zf69DPJLKZL}jUuZ;*RNVu@pMc9wRjr=M|2Muc`{d2vBzfv0h}g>iUEMu>m7
zFIRwnxwdy{p@pYqZmCI7re{!oYI%NoN@|!<WRZtUl74zsU~y5XYoNDwIhU@ku7aCK
zVNPLSQALnJuxWX^TXL9-fpL(xNr7QtVtz!0k&{!XOTCwoUw(0ct1H)|3IC7v&3+&@
zPjSnwWw+iI9y6U>$Lg-JX_bWDRYjpI0XtuA+OM%i?0VCLSs!{Ea#zTCYWjOc-jds#
z>dxSoAJ#qd!||}6Cv`NWPG35DoV)oR>(<wtuXDm)$+DVkQqgnhl-wBnVq4)!r-<y2
zrU{+T-?6%gyT4biSNoQ!^>SUa%h$f6cdlydMzQ|seKTvyeb1jywbdEzayNSJJ;V^&
z)M_cw@$<IWqs_9)D|DGm>OY@+V0%Wk!Cg)IYqX<A!Ny|oex(i5oYo2W8ZFYvXDrl|
zd>r-qrs}zziBi(v8{ehA`@1t}zG|~=)i;G*#oP4^*pKLFB&Hqd39jEX^Wh}s=*TBC
z<CsEv>h7POxo7UpUS=0XYvzS@&E>ab9Zq|_iT;{(qu#tKDk1c6^P2}VcvYtaCc4fj
zUts*}1iN_4vGbD3`&Tucd#Vugx_8~0b<QrXXOdU*C0;&w=@q}pMVo7`B1ZB4^P`k4
zwPe#)w6@2Y-=CFoMatiMa-YVJ`uIQhig>-+H;PZK4PD%B7v6hWur8^!`$@RCu5Pwj
zx@*FUulYsR7a0v0EI4a3pDk2idA03(q=@^k_3Ni!ntyM}hNQ5><92gRUw=D$k4gX7
z5%)CNgB*Jw1sC24UaldrEbbkzRKO((OYW$|UA8(?_b9N49enpFIIrHimHDHK+~Rtf
zg)<lNoxb9z7+o88D&yw*pnC_7hFN+{lMTIoq<Xus{HCBr-L(5_J{nfPJG?kFu>XpZ
zgVzcVi61i#x^CJmw!UcpycOI`F2Uv!|DE2xUFK$H>3Ziu*<Jan72CEkte1a&|6J8R
zmxm`z*YcFc#2B@`mq@>RV}kpPuN!ukNN?Hydue@|<>Xo0!X90ARjFL&w|Z4x@qLpQ
zmtUU_h|riUdQB)itwwV8<`?!B5er^U&E|ctkQ;JAP{TjR;dZF}d+AdaHD|x-|Mz(m
zt1xM$ND5mqcg19zw%sq>zo({`e7le;n!q{vdm^h@x$pXvUqROM1V#6~v^^jr#klM8
zRfC#)Kiy}qt9M?#rtrXqnSy*@^(EIma5>t1Y}<mVHx~Zn`1LlgEp27!0nV@eI-B=N
zon<qz*eUnkME2{gt-@m8rX~B?{ZF~2CmHhbN2cdy_15~r)eWL;yAv(#YBF~JQ+X!y
znCZ#ms$IqT&QcL;7TEnf@3U8!k88(Id7DE~nY*~8iu{kyz9(B&FR(|ZDAW6)ILo`e
zlfK`SVom;B`e99p=b;l%4X)?t%deUCSUWAPL3o|Z{06`O1%4?@{5ei4s_?&C%Ww2e
zciqbVho3l-_P_eG@JJBP)Z^aMI+ipnd>U(V{nEC(?D@Rb1yM7%S=pWcZG3iGBiALx
z6#0kGrf)uxGL2cwY3_`f=elg_8-pJl;LdaKKRiw03|rjZ@9CM(Z0Dc#DOYotIPKoM
z@72tc3UVJDTr4fbBlvHzi2PnDWt}gdGq==L3yYoFuvO4_PCZw4<5rtVdJAsub(Ea`
zNV?-on$5H?@0edcpLvZl=kv6Hw=(Ks%c?|KzUY~Du(E!*Ej{Oh>-lbDsW#E=GH2?a
zN982cO>p_Kdev-BeeOlG_VTbPO?6!zvx7%0vSIeTDgSp(*`Alute}47s%)xK62C9w
znkjPwr@rPsacWyCkJ#VLd2X-I%B1OZW`xX^>sPq7dz#cHcWwD7LD^Rfq8D}wA6dCu
zaLeL{6|=mLR3DxmbTs9(!g)sPD!!-gFSk89wzdAM2m8JKTY9s6HZJrE$zB$1%US7v
z@u0?0#i0C^yU*3S?WupTd#lPsCXqKLXPVX?OkOPamdW$!A_vnX*B5_!H!F2n@iG=n
z5)88Q`966{LivIBn{Ix5tN%3MgJi}3jq95(T~jDN-n{jj;_~~#nx)g%&Y3S^@ta*o
zdXuPS(VIBg-Sv7OzHzmEP4z9VtNpZS>eo1qbu!t4`Dfa99nx1zHqO`H(B<+nMo+FK
zYG;nNo{RNX?jJ6<VyixcbjI!BQix^H{Fx<JlcE%x@kPGy%^|lMy~q-lwc8TD9(|%<
z>a6}*WPkL;&-25+-4}>_s53JvO?lCbOY?p$zj-A!m2K)_&g~KPdLM4xpSLE4XOrvf
z%9tp#%A4>1MBfnU_Sx`7Zl>qOm8x!w_ImaxObVaewd<(VMNjVuc3%yrsNUG>Gw=LD
zfsc`l%*LsY9Ig1RD=&yldc%8G`ox|uFPraZ_$xa*%}D*V!0)r~%jf1==?2Fa#~HJ{
zv{YhK_N$)H)WN&{(i@gEmcn`^foAzz0tcQ;*@f;C-}3sQCwKZ$2iHQCYj0gv2EMo9
z+xRu8c~{Z%WshI(V)#2R_<WJ;!*5fBM2;+udv)NDUd68y_Eoc#r6xYwarHuTLHqsN
z=Z*{A{}6QUo}u2X((Xr(KCwDU^-Ndz{ANm6)_<Xc6&)YKx{Y}5iQIi|oM=6DV_5xC
zBPY2t(T$ad7wlM2sIM#{{{CM5<B(Dpj_nhf=iO+IsJ#DpqCp2sVnTkq+5D_OU*{xQ
z#_qJVKa<WWvA*Woaa&IB`Jc~}%>DaFIcKf=^^48t9A1m%+!TIzn?vt%*W0hzcOO(*
z9r+z{IY3Fn`B&uEEe47*|MX6u+{-;-QyY)s!}>jwzxY2;>lQ2VSlRS!=jAWwTMBlB
zttsPbv{F!Mb2N)fcKCm_cG<%T`x~FdOud_$C?>Ip>BZzsz9i1)Ho*d~Uw={)_6j?C
zL@M%-)lrA9hu!wxb2%yWW?NA4mGql?UpAx(d)&NQ)HPwHaMOx+E8qTHdGb{DuV{;3
z${W0n{ylTyQ@y{rSwg34hQQJi<&e0f-Aw<A?n`-QO>cecvF4(Ax;1mY!LRzMwtbgc
zedc&ec-1#{{;WI8_d8Wjbg%rjh`U`s>MvY5n-<g-*0`DLrL~1a?ZO394dc|GSBKwR
z@P{QU*>%R2+vyE%ZSCf~E;ohT?|LR4w!Cmm>SFO^uSs>gH>|FYUG;k1wA2=h{qa3H
z@j;u`t@Tl9*z4tTq&j$}`LWZ6i4IotehTgW@a?nazW*2hvTWKS>w7gz=9ak#>!b(s
z%`QFl7Pwql-ZiD{(eghcu3x4k#Z9ffyK99i-=Phq9U`42Y4X;&-ZI+Lqu*X#zIgN5
zGg>(xVlr2&{FK`+99^;Uc53~f|Avlb%a%>lJ=(BkA4lY#Zcmloj=GfX8gmLSg>L0|
z=Fr;W6n<I$VeS7PS(om9=shpqDq9|+<zZkH{BgpSB?<c??W`k}CzQILm*(tTD7LB4
z@b1bzU-fT9Tb=p9ryTj<Sjj>5+0ySn)fX->4Q&40%N!6=85(e;*yvh*oqN^8`kT=a
z;XB@|dYtiH_wn1|BysB-g<It;7f=6US2fM;52sx7?M2G}G}JBi{8>|e`&C)=>;JkD
za`niiAGV)<^LF-|dgPpa5vuv~cR;G;ob0>O)xZ3{Og7(pG0=bIig%S?nxFB=9$I{1
zp>WAc=6CwvQoA=>J}6%%d4x-5dv@^YoTZiZy-NbW1_$<Uf6-#GvfZb*)%3~y=)mBL
z1|KWY@_<<3nMsG{)woZ{zCLdrpK<u|eAd#<^JY$9nsp_-bk8S!--_L}nWq!)3mM7V
z9oOJn^;5d?rbMMOSNZ-o)!AYPWf-271~7e#)%f}P;)UNuWlgf2_o5no`I7aD4;zQC
z)%apCwZ1r{?A>vGx6IsmWdV8osj=1;N7uFYv=*+4KGpxR%70z<Gp~89rm^Ra-PyH`
zS6{f1yG-@S(lYK=tA^bo1*h)a3R79KceY+LFMrw8{{~j-zwgzp2~xew^>g;-2a_}E
zT7z{Ly(pa#&bws)sTZog4<}yKls>sK_2t(cJ)XPm_8i$&f5<oJ6}wsEV#)KX+)E`E
zta3KaQuJrI$N1kpDA?rC`A0k~jO(0ij{eTBmq_+9`S6*;iu>CARl8R%`y?G=|Gzpx
zk#YWC_v2SYHb2c^KF40azvJ!y&-Xw5ecg2+g74WIsl~g$Ex5uNo3JH(c9`w@Ph0tZ
zbS}^MwLj|6;un#>-n+`wGm9~~te()ibH}L{9DObJd+Igk&6Aj&dz5>b^~@5{)7Ia*
zDh_Db?e$E05jSs%nRdbAQ(xb2`m|_CR$H^VV4iWt7nLP-^4$9;KlR_EQ*XdJH*>k}
z1N*I4Pifg3@2)$Y^?~#DNqzr`jE2rVjO9=ARvhu!>+0*#v3tg%Qy-aFKi#fRUg5X2
z=&6Rpj^xzpO?P}GBz=-?8<vav&i(l;aOUdieDQO|-FI0A>hzxN+Y_?KF!<bsUj3%W
z-ahwUF67_%G%Ib#ou6lJyqZ`lbYzM0-V?{x9XXYGRsEi&X--RouV15i%elAbKR-KM
zbfn44)oW)I@84fn=A@fm+x_DCP7k+mhU)qr-n7W9+GK|43lZ^5TC*ir{^xz+X|-N1
z%vsOj<gE0mjmDzVEMKiHSz1j0&ajzqsC;^Ck*C9nlHba6&9C`f^yJ^E*mvW{F|9;>
z)gIY}oy!@7IkzkbU$;(T$#wa%>DA!^e;>|C6Kj+;Ic<8Q|0?_Y-Ikf}Vm7>Bkl~Vf
z@}6yO{ljMKqYrJ`i{uooM9zBiZLoCEExdj5Vn;>SI>T!FO~T&hrq>HTK57d;+^^<g
zvV6VI!K*EMxjL*nvjqxsxEr>ay!!ZS;k21;+J_2{f14!|`?9-KWX>`r*|zMDvo9`>
zy7Mpb_5EXF@o$y6Umn&9uj1Yk%44{u!03<ExAw!`Z#LHp_8B*pF5%Ww_?>xs>%n=o
zDR1Ag#jKgqbhkN$LE-afw)0QBR&-an{$%gk<z>xtg73zPd;ir99@hT(sIck8y8Fx#
zN46w9t=`F-x{PH(`GkkQjRNb!wF~S2F4Wk*CzE$^C4<Hdw^f<VY8P$<J8q5Ly|;eW
zi^dR5>%+SiJ~RCs*IfUXd-n^|t9o2ERX!H;rYFx{=MmWGA9wA0vE=uCmXXi<7UpX?
zYR=-&ePy4Wb}>afGbZWS*ECD%`z0sxBVR8P)|z_lT~IR1-s?I~Gq*Nx__c)plHi&H
z(Y1>ncKivddJ#8W{FU^HZHKOH+9VyjSxaQfQWv8gjaAD`&$4e(i`XFazTVKv&|e{H
zQmu%CYtdr{-sRKI$e3y=IWIU=ae0o5@a$s(y4$86NVwp}U22oe&Z+aOe%ZYO(|Jo~
z34FZy<5T#?H_y4-q7$A)*J|4Y-kcvTwcz(VyMP+m#eyD3rtWHfTzGI(<L`^hCoL}7
zWT4wBcRKUP=KFG)i!ST195YUESJ`PQx%BZ9pXL>A)iTB}q_^HnpX5`ySm}XAQOA7%
DEvlqk

diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_config b/secrets-git-crypt/knot_dns_rfc2136_key_config
new file mode 100644
index 0000000000000000000000000000000000000000..61b3a36d237bff406f13e3dc15ff34ebdc0012c5
GIT binary patch
literal 134
zcmZQ@_Y83kiVO&0DC=SS8fm#-SoOQ-!ar;0Em}H7p{lfs_qU);taX0;{LRv<<9vlB
z|HS|1?iX7n$sMqN?<otPlBd2#Yi6H)bmEwzbI`w&+h5IdxzzA{mpZ@Imkgd>{pM41
sLJqIHtZyxOW5qeu8ysH*4xG5mpL+er+iRll^fS!=NEoy#e@g!a0PL$k&;S4c

literal 0
HcmV?d00001

diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_envvar b/secrets-git-crypt/knot_dns_rfc2136_key_envvar
new file mode 100644
index 0000000000000000000000000000000000000000..5bb8e79a0efe14fc85b94c13d4e21a0e027b6d23
GIT binary patch
literal 67
zcmZQ@_Y83kiVO&0@DY)CC2OB~;$l?&{>z*%_BCqVn`a&*6jiojaY*liOz)$9x)bN#
ZdMsBP(sWKE@T2+LE%s+lc=TOw0syQv9}xfm

literal 0
HcmV?d00001