cleanup

nix/hive.nix

@@ -66,7 +66,7 @@
             wg = {
               privateIP = "10.0.0.3";
               publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0=";
-              peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" ];
+              peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" "minipc" ];
             };
             tags = [ "apps" ];
           };
@@ -92,6 +92,17 @@
             };
             tags = [ "apps" ];
           };
+          minipc = {
+            publicIPv4 = null;
+            publicIPv6 = null;
+            wg = {
+              privateIP = "10.0.2.1";
+              publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
+              peers = [ "vps3" ];
+              noEndpoint = true;
+            };
+            tags = [ "home" ];
+          };
         };
       };
 
@@ -300,4 +311,16 @@
 
       system.stateVersion = "23.11";
     };
+  minipc = { name, nodes, modulesPath, config, pkgs, lib, ... }: {
+    imports = [
+      ./modules/minipc
+      ./modules/wg-mesh
+      ./modules/nas-mount
+      ./modules/postgres
+      ./modules/immich
+      ./modules/tailscale
+    ];
+
+    system.stateVersion = "25.05";
+  };
 }

nix/modules/caddy/default.nix

@@ -6,7 +6,7 @@ let
       "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
     ];
-    hash = "sha256-mrsiXQi+5SIA/vhRuyiPUE5EXmLgUHCC5I+L8ARFDDg=";
+    hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
   };
 in
 {

nix/modules/default/default.nix

@@ -2,9 +2,12 @@
 let
   pretense = import (pkgs.fetchFromGitHub my-projects-versions.pretense.fetchFromGitHub);
   quotdd = import (pkgs.fetchFromGitHub my-projects-versions.quotdd.fetchFromGitHub);
+  networkConfig = networkingConfig."${name}";
 in
 {
-  deployment.targetHost = "${name}.infra.noratrieb.dev";
+  deployment.targetHost =
+    if networkConfig.publicIPv4 == null
+    then name else "${name}.infra.noratrieb.dev";
 
   # TODO: ensure that the rust programs have frame pointers
 
@@ -20,6 +23,8 @@ in
     nixPath = [ "nixpkgs=${nixpkgs-path}" ];
   };
 
+  nixpkgs.config.allowUnfree = true;
+
   environment.systemPackages = with pkgs; [
     vim
     wget
@@ -27,10 +32,14 @@ in
     traceroute
     dnsutils
     nftables
+    htop
   ];
 
   networking.hostName = name;
 
+  # Swiss german console tty keyboard layout
+  console.keyMap = "sg";
+
   time.timeZone = "Europe/Zurich";
   users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG0n1ikUG9rYqobh7WpAyXrqZqxQoQ2zNJrFPj12gTpP nilsh@PC-Nils'' ];
 

nix/modules/immich/default.nix

@@ -0,0 +1,34 @@
+{ config, pkgs, ... }: {
+  age.secrets.immich_secrets.file = ../../secrets/immich_secrets.age;
+
+  services.immich = {
+    enable = true;
+    mediaLocation = "/mnt/nas/HEY/_Nora/immich";
+    secretsFile = config.age.secrets.immich_secrets.path;
+    host = "0.0.0.0";
+    database = {
+      enableVectors = false;
+      enableVectorChord = true;
+    };
+    environment = {
+      IMMICH_TELEMETRY_INCLUDE = "all";
+    };
+    openFirewall = true;
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "immich" ];
+    ensureUsers = [
+      {
+        name = "immich";
+        ensureDBOwnership = true;
+      }
+    ];
+    authentication = pkgs.lib.mkForce ''
+      #type database  DBuser  auth-method
+      local all       all     peer
+    '';
+  };
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
+}

nix/modules/minipc/default.nix

@@ -0,0 +1,8 @@
+{ ... }: {
+  imports = [ ./hardware-configuration.nix ];
+
+  networking.networkmanager.enable = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+}

nix/modules/minipc/hardware-configuration.nix

@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/9327fdbf-f6d2-41ae-b69f-6dbb97ab388a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/2A59-D3C9";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/db30dd66-fa2a-46a4-b81a-b0fc935db5ac"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nix/modules/nas-mount/default.nix

@@ -0,0 +1,6 @@
+{ ... }: {
+  fileSystems."/mnt/nas" = {
+    device = "nas:/volume1/homes";
+    fsType = "nfs";
+  };
+}

nix/modules/postgres/default.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }: {
+  config.services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_18;
+  };
+}

nix/modules/prometheus/default.nix

@@ -85,6 +85,13 @@
           scrape_interval = "1h";
           static_configs = [{ targets = [ "localhost:7846" ]; }];
         }
+        {
+          job_name = "immich";
+          static_configs = [
+            { targets = [ "minipc.local:8081" ]; labels = { server = "minipc"; }; }
+            { targets = [ "minipc.local:8082" ]; labels = { server = "minipc"; }; }
+          ];
+        }
       ];
   };
 

nix/modules/tailscale/default.nix

@@ -0,0 +1,13 @@
+{ ... }: {
+  networking.nftables.enable = true;
+
+  services.tailscale = {
+    enable = true;
+    extraUpFlags = [ "--advertise-exit-node" ];
+    useRoutingFeatures = "server";
+  };
+
+  systemd.services.tailscaled.serviceConfig.Environment = [
+    "TS_DEBUG_FIREWALL_MODE=nftables"
+  ];
+}

nix/modules/wg-mesh/default.nix

@@ -35,7 +35,9 @@ in
           let peerConfig = (builtins.getAttr peer networkingConfig).wg;
           in {
             inherit (peerConfig) publicKey;
-            endpoint = "${peer}.infra.noratrieb.dev:${toString listenPort}";
+            endpoint =
+              if !(builtins.hasAttr "noEndpoint" peerConfig) || !peerConfig.noEndpoint
+              then "${peer}.infra.noratrieb.dev:${toString listenPort}" else null;
             allowedIPs = [ "${peerConfig.privateIP}/32" ];
             # sometimes there's some weirdness....??
             persistentKeepalive = 25;

nix/nixpkgs.json

@@ -1,6 +1,6 @@
 {
   "nixos-25.11": {
-    "lastUpdated": "2026-05-10T14:35:41.703Z",
+    "lastUpdated": "2026-05-28T12:57:27.843Z",
-    "commit": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5"
+    "commit": "b77b3de8775677f84492abe84635f87b0e153f0f"
   }
 }

nix/secrets/backup_s3_secret.age

@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg Iwzv4FA1pIES6SynmQejkarTCRc3xwqJhbPK+U197BI
+-> ssh-ed25519 qM6TYg vf1l0o7K8ZIZGEBx2x7EzWKG7UKFQtuOhBqj/Nyq6xU
-0F6drTGs14E6tf0/eDcWu2y9b9yYLXjkAkHV0hT01MQ
+8b0863lHC83pZZ/dIkKS3f7L+PE0I+m0f2zqtef4tuU
--> ssh-ed25519 91VHug NhInO02XlDKVDYeEk+Y4jmaAG03YO1yy50R9vnUGPWU
+-> ssh-ed25519 91VHug r5WkIt9V+TM/zupGjYH7FrIz2ZSctKh0cWixaaL8vH8
-0lgqjusLVxCLIQA8BSQveTNKEQf7uyEctRX+TDqipj4
+c0J8wy8gRmgoA5vEA3AeXa8orH2amWdIgxJJDaBSjTQ
--> ssh-ed25519 XzACZQ vtBUTFyr4gjqcUsn3WCYOPspjnVwL19izhKYGX4kiy4
+-> ssh-ed25519 XzACZQ Z6z3pornKWMM08RxpWV4YjWs8qKF9xn8lNS6S3SpFSI
-bW6zwWar6COr58s/U6GJZsOPicAECUJr2VQZ0nOneF0
+1O4YNGfKjiY/BJDKwm1J3ZOhpPrMAiTdUHfZ305mSco
--> ssh-ed25519 51bcvA itN8U0WXocUWmsO7Hy3a94j+aUyH83BN4iG9RK/9lCk
+-> ssh-ed25519 51bcvA cxBUjrD7stWdK400O/2HJM3YcKGjDGpWZt4Yq1sVdVg
-Eyuawwp7+bv9/f2UOihOqFLcETsFgPS+iJRrLID6jT0
+mw2xRTGFWiWI959J8GOCTp/kiV85+k2/+bYJpw95/ew
--> ssh-ed25519 vT7ExA tJoU7e9muJvOLU1a50SI7+KgbHYke/vaMn77u9gAyTw
+-> ssh-ed25519 vT7ExA 8bQ4LWtqj2AodnJHcV8lEk+3EcZBfWHUVHQKcG4nCwI
-p0Ofeh74R/UTpaBRDITNjwwXkUs/grBnsHiSvzUxCKU
+dIfddL4LTMun+EQQuPdLJNkGVysvTPm2059vQUUnEGk
---- EsDITASaNlbxImI3s/hCMpOM6Up4UrZgez1fTJlRT1M
+--- VIlkl9DdBWVgTiJvBK3jgdpsLgGkvv/dFfbZLEYMmT0
-:Ž,ß<>¥²ì Õn.<2E>|*ƒ#<23>ü‘C¿a%ùI¿ýíw$`î<¡øÚÁM_AÑZZorýiêm\Ö^×/#\:(8*’´×?½åfˆEVÑWm¦Šaó†~ËõEâ5±ÒÕÈ«h¯©½¨h<C2A8>SÛdx&‹K²Ûº¼9¦€†·3\–P¢2ò¾d§Û_mýŠ‚©+\ý8dyj
+ ‰ù£
GE=ù0bþÊ®ÀäP±*èäÏ&<26>ó^V)?‹0,ö½¦vpaȧ}‰p笆<C2AC>¾YÇ­Ç[ˆ±;Ìž²@Š[o
g»$xܶ³9g
+ä{Y}­ö_ƒˆ!ÄÆøðÜ¿©(‡‹[R¡·VÜÏ	U'q’¥–ŸC%SZëw ŸTC=ì5âaIJ<C384>xFÿ›Æÿ´)Jà

nix/secrets/docker_registry_password.age

@@ -1,7 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 8d5Jze4wRBsRqy+/ifnIMf5IhQZrn2Hs0k4/RCJoAko
+-> ssh-ed25519 qM6TYg I4FIet5K6KGjWaCvKbhK7UV4LFJthRpRVDO/FoARzxw
-IUgnzcCHmQhsrJfUuOG5s7nl98/X+ycpr0JWQeqc1Ps
+F/KQtQI78KlLe1jT84oxdg4UG8QuG8xAVAutzVM+kJw
---- dNJXPA7jEVJs5yQmvcaidVnJoN5pRMbh6okQsjjDabc
+--- TEgDiZeZQL2K8Nq/xqUKrkPKSXyO5NgRbx8SkfGl62o
-–Ñf˜… ï<ŠSœs—[<5B>‰‹-iõMp”cî
+(L× *‡2þ¿ëÊÚƒjö¥E‹D*
ȹÅ^䥶IJs<C2B2>´<EFBFBD>yð:…7
o†Reâ
-a5KÑ
-S‹ü`U¦Â$öEC8t^Jˆ•¥"

nix/secrets/forgejo_s3_key_secret.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg oDQzYAbe3UasUjgyw2AAtcYaID6nKD+j6C2R05R8Bw0
+-> ssh-ed25519 qM6TYg pA28Ib4AvSxoAZuGE7ZDW7CpA1GQkYm77WKNahcUFEE
-NnPZ81p1PafEEfYHP+MafDdrhq83aJ2NuH8iYz2Uk/Q
+HjzZ2b/iVig4reIgU3z0O1El+tct50LS5fp+SiQB+Pk
---- FM0robN+6H2uAp+ASaCVxlLmD6xVp5oNHHAz1BE8/+A
+--- ExFpE2FxaqSuuSMtQTU+kzVz4rI2SriLKhcy0JHZXPo
-6K×(6ÁF	Ys#+\á,\’LíÓâê¨:RøÖ@Øtü糆Bž¸ƒìp
+KÀ¦îÐz)`Q=¥­ýgXŒµgì èµ}<7D>|ÿ
øªR—!Ùw›D6ˆÖï¿é?^4ÜùHγMV]¸`7L0TŒÏ6ã1×ûNãøŒd<>1\¬Ø×¥C~Ï<>êF±¶Š«ü›
-.±6<C2B1>Š>L·çÓøê}`Q¹ÚDÓ5†ÅQÑæ-i<19>ŽÓ§F	<09>Çš— ¿”1‡VÃÑ

nix/secrets/generic_backup_password.age

@@ -1,13 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg EOynzb0Op5bNKRZ1jRaS+ZZDowhMmGYkv4u0OjWqJjE
+-> ssh-ed25519 qM6TYg AcP/Za8jdEONeSNcC2fm0rZg1VOMvqCreXdpd/iDKDY
-po5rR/gfWwB24nNa3w5VqW8o8AGEqTk40yQTTxNUfEI
+dgBlpFUcvP/n86idjIWuKsx7jX6xEWQJKY+pdGG8XVY
--> ssh-ed25519 91VHug /NK1O4g1DWl6xNwHgkizeLJoFomY2zy/heEMChzrwWQ
+-> ssh-ed25519 91VHug R4SIqnNLIoIVGIR0XnUsh3RCz+20M3pWoQGJta4y2CM
-yc+fwswX7at6eEcAjJrcYhdGlJwHJa6ZFpbBhntVtsA
+s4O6GBECMUQpUX7yhx9CrNgedDn6yomCg8Bkke+4vu8
--> ssh-ed25519 XzACZQ RUMXGNZ6fpgmOVGKuspoOf5cgGUvjyzCmBipU64BikI
+-> ssh-ed25519 XzACZQ OVHPNsSR5IfrAslyKuIMAZakz+k12GUGNYsGc7e5WQ4
-XID++wcObepaGXScGD8KJwSHyX45UjrT2oRlh/VYGHs
+IQKyRtlh7lkwIdH79IYCYod93+qAqap6rGL/VJ04Mdo
--> ssh-ed25519 51bcvA TmB9sS4plGSx0ScZxYr2sWCo0UesyceyYPKWi+rVUy0
+-> ssh-ed25519 51bcvA NYivGhQwqPbjLY+Bb08ow38Rb1SBfbEotPwdDr/v7gE
-yZrk2FbXpqb7XZoullu0JivQ97yTQLBiDv8BOox3evc
+VRT0QUnImc0unH4DoEg07+PhQ0a3IsJRrJIcgDzBtjU
--> ssh-ed25519 vT7ExA n0kaB8lgH4OWR9l3hxlMT7tSjYZzNNlQLZJXnzHKf2Q
+-> ssh-ed25519 vT7ExA 6gW6MAGGmz7wqrE1cNgAJqhLyLBDnAkh3IFB/EJf7Us
-kswoozAAVll/lFIG66Iikzu086tnzGF523fVnAGLFbw
+nhE8i7G/n/CnLTOUYsprFFjWCA+v/CmOpYRB8dAAjaE
---- Sa3qvrEI+FxIoDUmXRW4tEcNjdhWPw4U15Xy197wb6w
+--- WvW+S65yf7YP+UsQH7VY1CSRqIFyNQAMBzVDCKcgk28
-8q¢9þ‹3lx~JŠ/’’üÔÎVñdœhoIL{`O!76·ØìÒºË
´6Ze.¥_lÿãœ?JrÒf¯É4
+²±¬wBÑ<EFBFBD>*çN¿%uz>¦Î9`?T7…­LÈìÈ?)Ñ:<3A>ÅgâºÕ0é°ô7Þµ
‚LËbxµ…aÕñÞ·$‡­?±ä

nix/secrets/immich_secrets.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 yMKb8Q wDQ9QOIpJMfsxGr63x9PozZEVfy1M0XvW9MvIjBjlSo
+eAbDN8ZB52vcC1zEXKqjWUYb+vvIJVQ+f9CZmk1Jcos
+--- ZRGd4IncBO5g0BIoezzfvCxNMAVP3cgmsF8Co06u+fc
+Ui¨,ž•¥Wÿb%dõ9º:˜dŽ¤Úq¹¦È{û
À®€Å½Lš[M<>£	,Ýd™š§8{6

nix/secrets/killua_env.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg bPkp8HZ9R6dGxYgND2mPKC85fyDhuNyhlnobEZnGRmw
+-> ssh-ed25519 qM6TYg 4XizqcJTul2c4nKebIgHNBlX1wfNM6ZdJIi+uD4STCI
-xFKtdyfAEQyFQt8c0hKB5uB+YYVow4nEJkejcDBl5Ls
+wLKLC8dfC1jVWNLQR2pmJM3+yvlILUkn6be+x/l1Se4
---- xSKVxbaHOvIFnprTjxfV1rv1L1jc/Y2PkB7TLbWam3E
+--- kgeOkLbbLqXAK8urZUOVhqPKn4AWulo4hGbOkgr+fOU
-_Tîfv@Î$&kèÿc*s£L]™v"ÞF½‡¿t!Õ4Šq<C5A0>Û‰ð‚2éæ7´Ò"db8¦~0äº<C3A4>ØxyJûÎÖð¦`(nb]ÈÝr8䈺âµ{<7B>¨å$tŸÊYÞqua€^W9¾6úöÊåóxé)û
+þþ§¨BøòáSæXN<LÃå㵆|sÏ®à;Ã<>Évî|»¿p`9ª"ˆèh€ÂUÕiçn8¤ûÅêdêŸUÕY¬¸àèžÇ«œoPuVë¦àJg‚Ô7áH)#ÌG
+ä«Â¿îu

nix/secrets/minio_env_file.age

@@ -1,9 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg LSDtwlm9BBqnpzsXoeCQnJ7YImkiMJvqfet0MROaBFA
+-> ssh-ed25519 qM6TYg bv3MPWeJTJj/lrwKDBAv4T+OrRdD3ViwX8HLCmCKghE
-h/efW4ApyMTnp/p+3tUa8RaMreI00/T5Q4Gh71lFeTk
+MGP87vT3Rmf+aqhMMXyZIs4OeMkS+uc+je6Zkod0hrY
--> ssh-ed25519 XzACZQ of8qdZPKfTtCKNMA+eHgX+WijYZHrHrzq0alH1mTJyE
+-> ssh-ed25519 XzACZQ cUkJyWCO6HkdxCqSnv9onmEUhEQY+Pj4seR/lH8KSAg
-rVW21YZw3kbe1TCQj/Ch1krrJt0o6PXThAV/eUbY8B8
+qTUgF/iT2IoJf7UOleaayWbkJbn5dgSVHKctKWnqfIw
---- gWUT/+evFTR4ARdKZK01i8qgDCjt/EKnpKCAS5fCt1w
+--- BOvXie+k6OIewLDVF+Rx2YzkpytshqkFGCL/uYgljNQ
-é(H
¹ûAt_ï
+…}ËpˆŽSS  íy*Sp*>ŸÝ–Å
¹uí¯:0bŸŽ:=)
t…¶ÍS\HNœbòµ9_m‰ØÙ<C398>‘jµÚ{<7B>‹)˜º(­<»3&Ó˜`ÑR<>	õ¸[«{aÜ“Øô!Àòó
-5–oÃÎJV.DÍ€¥#lG”‹u#ɉ¬K!-ÏT~"ksÒ–±oüŠÇ£¿ï­þipñÝ1>
-Ã𗣫iDÜ6<0F>‰ÿyèPOia€¿<E282AC>$<24>ò/Õ]ª:dk]œA3

nix/secrets/openolat_db_password.age

@@ -1,5 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg ONh+83MLxToMgANja31F4qVxE47NVjXat06RLj4qG0E
+-> ssh-ed25519 qM6TYg 7Nt/x/IT9ofXjrRRV7coT6nrrCSOCkqUqflm1oXLXTk
-9vRKxWSdW2Bvc/KsWqbbi5mGhLekViT87WhGnPf5ZUM
+BafDaEiVpuT3SDVXvuD31WIKe0QlvAGoyn4MzUm9LfQ
---- m/MMUEWaa8RewCOG6fOBQpu8M+pgFMWUs67NQcnI4c8
+--- BsY9/meRTzX5oCBD+w9f+2TO/TdPD936xOjgtQMWuag
-J¬±ÂÜ%Ï»ÙîlNÔB¸×™šÅ#¸^Ã@äƒfT¬¨Àrâxt=‹…If&§óIæC‰ÀÀ¥Ž¶l@Ññ–œ´Š	Ò/å¢ïD8c¶‚{MäRÉÂÔ3…9æ“»—÷<E28094>Õ¶3ñ`·Ÿõ;
¯…å$höøõãýÛÚ¾ö÷Ùãœ>ÚsOœŸí•…!<21>¯U}
+RN|å-ò
+–[¯6Š‡ùq
+rú7ìˆÎd% 襡¬[3K`‹I{Š!™u5™¨‹èƃnÇè<C387>ÓºMvo÷dÿò§z A…Ì~á‹åâ“ûò<18>ó–Ç<E28093>Tƒ	QñåóG¸h?N¯“w/YBëQn•_ñ`¦ÜÕÃÍ_‘€,¿ýZ‰€ƒšF”VÆ8yw‹

nix/secrets/pyroscope_s3_secret.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ m7q/k7PLJpNDFEFxm1SNobF2abWhncqxWri+CbVqkCc
+-> ssh-ed25519 XzACZQ ver7uyV552D1F9hTxFYb61szNWPeIxsTr4M6RWZH1DY
-3NB/uTmOdkPH3N+kZrSep7u0A57KpQzI4tlzyT6Z5rg
+BF2bL0xu6rAx21EQkGF8KNc/4+jqo/0E6O89vZ8WhfQ
---- cI9WvpISFVi7fXb5pcNgyu3rH+4L8o5dZUnAxhQ1x4Y
+--- b3peeNoZ70tv7mAtQokJ8IUgE6nTGPvUkSf8p6jika8
-W‚¡j; lx»Ï8ðýmŠÌqþßß®ˆô´Xˆ+‚µMJSzÕ¡Ë4Íã`à=´8<>ÿ$9`Ò}µwÿ~âډשa“6øtÛ«ÓJtu"|p`T“b³("ájÃ:˜<>I<EFBFBD>5P’ärSúd3é%ùÍØ[„ äÍÕok´!gõÜc\¾™6s©„® ©dõ5ã†é2%jµ
+庭<E<>ﾋ7L{Wﾟ<57>鵡燐aｫ躇	ﾏ<>ｶﾖLﾋ<4C>｡[Чdﾛ-!0ﾊﾁﾆ4U<34>?无C酵ｾ營1l
ｫｽeﾄﾂ1<EFBE82>!_I単ｺｾ2Ce剋ﾘ1滉Wｮz寇<7A>VR}ﾚkA<18>從ﾍﾕ腓ｧﾍb<EFBE8D>)%ﾌｪｶｩｺR跨wｿ<77>AﾗﾖwA6ﾜ6Zｩｺ畳kql葹gz=ﾖK<EFBE96><4B>

nix/secrets/registry_s3_key_secret.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg zUespYByALhutVeTKDYRCXpskuwotOzfTjWCVtGcXTg
+-> ssh-ed25519 qM6TYg /73Z7R1RE4lfUfVSeJqZjbGA5yjygfrxKi5iuMMxrno
-LxTqOV8sk6zOQv1eAIvSfUoeCfpus5lB4VwQV7joMks
+tsbPaW/x9HFT/tG+5F3n/3SsuhmswVIfHVLNRAzdiP0
---- bCKKLMK0Alw89Sh6HB4EW76P29aNUC5btlNFHDBTsQk
+--- jHapfTz6oq7gdrgBn+XNQdMZ67DbrFPBY6KKzb+wfjE
-¦å4m†ŠXA/‰µu ØÒU’Ÿ´”ÁÑ}Öhöz¾Ç<¯5f2ž<¶Ý¾jÊãµYO=FW÷IW%ú%8f~`Žü vl€@:1ľµçÛk¨Ywa“ÊL:
\³öùê:ýG㚢»HÇÙ­r¯ðkbÊEbt/N}v-x‚ÜÅMë©Xñ£ãÄËÜ¿òt°GûRpt°Ç­Ç.°hòbÔ“8›š´íx5L†ÜF"qaG<xðr
+œÅÇU1ör(RßMN8<14>ÑOlè$ùüÔDN¦u±ÿ³·ØÆðŒ´¿3ê¨Jo<4A>în‚ÜBOc%ÿATµ~RV##–[‡‘íù;3*½¶±Þ6˜/Ð5gD€]ƒö˜2À¿žñÿŽÿñ¢%Õfü)fxv
“
+¼›]Ìé¥höî<C3B6>†…:ßd¥{_O½~Ñ2Œ‘t¤iŒz28¡Ï ÒW>ÐêBT(aõ%<25>—ŠŒ•™¢Í‰l`é³\õ

nix/secrets/secrets.nix

@@ -6,6 +6,7 @@ let
   vps3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvupo7d9YMZw56qhjB+tZPijxiG1dKChLpkOWZN0Y7C";
   vps4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpoLgBTWj1BcNxXVdM26jDBZl+BCtUTj20Wv4sZdCHz";
   vps5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWbIznvWQSqRF1E9Gv9y7JXMy3LZxMAWj6K0Nq91kyZ";
+  minipc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINApZRrvK4RC1SU5m4OLbill7HZYPQtuvh/m/AB4q5dG";
 in
 {
   "widetom_bot_token.age".publicKeys = [ vps1 ];
@@ -30,6 +31,7 @@ in
   "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
   "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
+  "immich_secrets.age".publicKeys = [ minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];
@@ -37,4 +39,5 @@ in
   "wg_private_vps3.age".publicKeys = [ vps3 ];
   "wg_private_vps4.age".publicKeys = [ vps4 ];
   "wg_private_vps5.age".publicKeys = [ vps5 ];
+  "wg_private_minipc.age".publicKeys = [ minipc ];
 }

nix/secrets/wg_private_dns1.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg T16scfWokKj/4TaHvplWuIdHCs/oR4t3V9x4hFo9yhU
+-> ssh-ed25519 LZU5Eg 3Bde2BfrG8qdngKCIg4xeXnkqqdrtcAZfW0REYwkmWc
-h8RoAXndXCwUBskJlJTLWoXapWMUTF0yPnqUV9u7qt8
+0Js204/ZpkBK9mDZwhYOY1IGW8yA5L/iMAmrZR1r940
---- qGJTnOXdnz8D9eA8AKtYarVa1l75x10SqjhsKchfQ+E
+--- V7Xj3KkcueKzPhl6wjk12zRrEmFPMpUcQd799p0Dqr4
-a›Ò¿ú/Žõã}Ã=7_ç¢r^<5E>rÔ•?‰yÖÈ×"oõؘ;U`*Ö¢’(”„Z®†·tz7ñ¢·úÍÅãs“Üô，$^k`
+Ö~”TO80
}	ó‰¥ÕQ.<2E><0B>…{°„q6ÑÚQuˆù׆ú%NÒ6­¢ÐŒÁaÛ|”—41Ö€åZòÕ€Ò;DözÏ*»^©ÉôÑ»

nix/secrets/wg_private_dns2.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 5bWSnQ eiSLsSWrjQldff9ZbhjhrvGgNGWxmxKu1JfsWmjo0Qg
+-> ssh-ed25519 5bWSnQ V/5bLxQqdZEF9tgSPGgm7nEpnyNGScgSVfjS3KOvxA0
-cCLcVTC9hzN79cOMOuuOMo5VpwlBKraqxqeQuvVzqqU
+oKHKz5IIZNdsWhBCTCqvHVLAJGC+LEC7RuMgQHI9Wkk
---- bgLRe7t+KD2ehc2gAp4RERJ3nN5pGLA04L06KHVeQvw
+--- 71jtq96kfCYsB8UGSccc2F6qWtj7DO658MeVWSD+L64
-¥nsª4¼!nt3…Ü»ú:#ši›”?š ÆJ¡Ê·	¨Ó'1d!Öö¡? $/Œ{u…XÙÒÓ6e¯rL.æÍ]„Çî[
+U”XĄd2ŮC<C5AE>¬lEV~FgŮđiíďčöpŢă%áN6ů
+ŮÖt%͢Ż{LZş@˛ÂB9$ŕ{Żg&PŮBHQ¸Ű<C2B8>%4

nix/secrets/wg_private_minipc.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 yMKb8Q o1qLnZBL+o8wrQYM6bo01DsCKVmA/NCzLe84aO4NSlI
+iEnVZGcr4wyMN5b5f9Qzt1lmycZVe+km/8ApNvq6ME4
+--- MiV3GRLz1rEy283zGsbTtrAbQgmdW0pobJE83BmPrmU
+<EFBFBD>¶ƒéƒG^÷ì%L˜ûj,´¶sC€ÖIC&@Ö>#¢t<C2A2>$.2ÏÿRñ+p.‹µ4ðù
¡•ªkÃeüÍÇ^+”sCg–õn-šz©{

nix/secrets/wg_private_vps3.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ EsFwUOjtcoWVd5gJxu0vAfcXxGZovBBKcGuin+TE6kY
+-> ssh-ed25519 XzACZQ JO+9ZDfv/rjpGHSL8WBm286V164a2CwppavSZ4+L+Ws
-51vzn9SvfX8WCDe8f5dtblAhFykUIxLkvsNK6XjMSuQ
+hqfAaluHnH5XHzI/oc71q7HlKioHMAbKP9cg9wRJ6kw
---- VTYLeqYga9RKPLxjB6JotAMC4StSGh9PNNnG3+kq6vs
+--- maAUQCFkFuMs55Yr6wX+2q+VUM/c3h8rNb6u+VrJnEM
-…]#A š›*R1*´{TM¸ÉÚ<C389>íq2~pGJ<03>ÃÙù#¹ƒRÕW•ârWàõCð
µÒ·¤ê‰#ƒÇÅàü	¨3^Í—ƒ
+)<>ïWþFþºäj³
+ö„
}ÃÇ,ÂØÁê·ÛE\G¤Óá–Ý&xï÷@¯,·ˆ[r+<ÿ—v·ð²wº¤Ÿ,Ält¥F±tº.³O¹j

nix/secrets/wg_private_vps4.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 51bcvA 14yVvUnmbYRhz0jbTEsj5bEZnJleq6ZT3NgOqVybzFk
+-> ssh-ed25519 51bcvA CkaPksfSDKWRMaL4FV7vI4VZ2c8Fd2RlyRW8DEkOkgM
-F0cCQQhghlR3rHDEiBwIWdBXv6Cfac+JL9MArEXOHuY
+NrvBSSPDrwNL+YKgBTHqQuLhKgGy1+/H51JTsA70Dww
---- bB7RaiP/rNyTpjpoa2qXmZw7RCa73b2FEy2WN+CTpfk
+--- 6qkEageKcIweJ7wWcqb2HZp9zJNTyLcoQ+Gv/+O6CJA
-M<EFBFBD>):<3A>8&<26>=$<24>8.<2E><>U<EFBFBD><55><1E><>7<1F>~<7E><>j<EFBFBD><6A>]<5D><>QHC$^"˿<><CBBF>
+(¦©,¸Ê<08><>›zfßðD8¸Ÿ)Šü]¥Î|P+Úáaƒƒ‰
ñ{n·•ƒ$ ¸Añ<41>x"•ù¢]綤©è…Kî‹æÕð
-W<EFBFBD>C<EFBFBD>Z#<23><18>u<EFBFBD>A<EFBFBD><41>!d<><64>Xpx"<22>1<EFBFBD>c