nix/deploy/smoke-tests.sh

@@ -4,28 +4,20 @@
 
 set -eux
 
-check_single_dig_answer() {
-    dns="$1"
-    type="$2"
-    host="$3"
-    grep="$4"
-
-    dig "@$dns.infra.noratrieb.dev" "$type" "$host" +noall +answer | grep "$grep"
-}
-
 check_dig_answer() {
     type="$1"
     host="$2"
     grep="$3"
 
-    check_single_dig_answer "dns1" "$type" "$host" "$grep"
-    check_single_dig_answer "dns2" "$type" "$host" "$grep"
+    dig @dns1.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
+    dig @dns2.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
+
 }
 
 # Check DNS name servers
 check_dig_answer A "dns1.infra.noratrieb.dev" "154.38.163.74"
 
-check_single_dig_answer "dns1" A "nilstrieb.dev" "161.97.165.1"
+check_dig_answer A "nilstrieb.dev" "161.97.165.1"
 
 # Check the NS records. The trailing dot matters!
 check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev."

nix/hive.nix

@@ -24,7 +24,7 @@
             wg = {
               privateIP = "10.0.1.1";
               publicKey = "7jy2q93xYBHG5yKqLmNuMWSuFMnUGWXVuKQ1yMmxoV4=";
-              peers = [ "minipc" "vps3" "vps5" ];
+              peers = [ "vps3" ];
             };
             tags = [ "dns" ];
           };
@@ -88,7 +88,7 @@
             wg = {
               privateIP = "10.0.0.5";
               publicKey = "r1cwt63fcOR+FTqMTUpZdK4/MxpalkDYRHXyy7osWUk=";
-              peers = [ "dns1" "vps1" "vps2" "vps3" "vps4" ];
+              peers = [ "vps1" "vps2" "vps3" "vps4" ];
             };
             tags = [ "apps" ];
           };
@@ -98,7 +98,7 @@
             wg = {
               privateIP = "10.0.2.1";
               publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
-              peers = [ "dns1" "vps3" ];
+              peers = [ "vps3" ];
               noEndpoint = true;
             };
             tags = [ "home" ];
@@ -320,9 +320,7 @@
       ./modules/immich
       ./modules/tailscale
       ./modules/paperless
-      ./modules/home-assistant
       ./modules/caddy-base
-      ./modules/caddy-acme-dns
     ];
 
     system.stateVersion = "25.05";

nix/modules/caddy-acme-dns/default.nix

@@ -1,13 +0,0 @@
-{ config, ... }: {
-  age.secrets.knot_dns_acme_dns_01_key_envvar.file = ../../secrets/knot_dns_acme_dns_01_key_envvar.age;
-  systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.knot_dns_acme_dns_01_key_envvar.path ];
-
-  services.caddy.globalConfig = ''
-    acme_dns rfc2136 {
-      key_name "acme-dns-01"
-      key_alg "hmac-sha256"
-      key "{$CADDY_DNS_RFC2136_KEY}"
-      server "dns1.local:53"
-    }
-  '';
-}

nix/modules/caddy-base/default.nix

@@ -4,9 +4,8 @@ let
     plugins = [
       "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
-      "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
-    hash = "sha256-EGkboqppRr2xcZ+7ie+WrqdP8sHSoouX4STl4NajMYs=";
+    hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
   };
 in
 {
@@ -32,7 +31,6 @@ in
       format json
     '';
     globalConfig = ''
-      email tls@noratrieb.dev
       auto_https disable_redirects
 
       servers {

nix/modules/caddy/default.nix

@@ -7,6 +7,9 @@
   systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
   services.caddy = {
     globalConfig = ''
+      email tls@noratrieb.dev
+      auto_https disable_redirects
+
       storage s3 {
         host "localhost:3900"
         bucket "caddy-store"
@@ -15,6 +18,10 @@
 
         insecure true
       }
+
+      servers {
+        metrics
+      }
     '';
     virtualHosts = {
       "http://" = {

nix/modules/dns/default.nix

@@ -1,12 +1,6 @@
-{ pkgs, lib, networkingConfig, config, name, ... }:
+{ pkgs, lib, networkingConfig, ... }:
 let metricsPort = 9433; in
 {
-  age.secrets.knot_dns_acme_dns_01_key_config = {
-    file =
-      ../../secrets/knot_dns_acme_dns_01_key_config.age;
-    owner = "knot";
-  };
-
   # get the package for the debugging tools
   environment.systemPackages = with pkgs; [ knot-dns ];
 
@@ -27,57 +21,28 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
-    keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
-    settings = {
-      server.listen = [ "0.0.0.0@53" "::@53" ];
-      acl = [
-        {
-          id = "update_acl";
-          address = "10.0.0.0/16";
-          key = "acme-dns-01";
-          action = "update";
-          update-type = [ "TXT" ];
-        }
-      ];
-      zone = [
-        {
-          domain = "noratrieb.dev";
-          file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
-        }
+    settingsFile = pkgs.writeTextFile {
+      name = "knot.conf";
+      text = ''
+        server:
+            listen: 0.0.0.0@53
+            listen: ::@53
 
-      ] ++ (if name == "dns1" then [
-        {
-          domain = "nilstrieb.dev";
-          file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
-        }
-        {
-          domain = "noratrieb-acme-delegate.dev";
-          storage = "/var/lib/knot/zones/";
-          file = "noratrieb-acme-delegate.dev.zone";
-          acl = "update_acl";
-        }
-      ] else [ ]);
-      log = [{
-        target = "syslog";
-        any = "info";
-      }];
+        zone:
+          - domain: noratrieb.dev
+            storage: /var/lib/knot/zones/
+            file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
+          - domain: nilstrieb.dev
+            storage: /var/lib/knot/zones/
+            file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
+        log:
+          - target: syslog
+            any: info
+      '';
     };
   };
 
-  systemd.services.knot.preStart =
-    lib.mkIf (name == "dns1")
-      (lib.getExe
-        (pkgs.writeShellApplication {
-          name = "knot-prestart.sh";
-          text = ''
-            mkdir -p /var/lib/knot/zones/
-            cp ${
-              import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
-            } /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
-          '';
-        }));
-
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
   services.prometheus.exporters.knot = {
     enable = true;
     port = metricsPort;

nix/modules/dns/nilstrieb.dev.nix

@@ -29,11 +29,14 @@ let
       ];
 
       NS = [
-        "ns.nilstrieb.dev."
+        "ns1.nilstrieb.dev."
+        "ns2.nilstrieb.dev."
       ];
 
       subdomains = {
         ns = dns1;
+        ns1 = dns1;
+        ns2 = dns2;
 
         localhost.A = [ (a "127.0.0.1") ];
 

nix/modules/dns/noratrieb-acme-delegate.dev.nix

@@ -1,39 +0,0 @@
-# https://github.com/nix-community/dns.nix
-{ pkgs, lib, networkingConfig, ... }:
-let
-  data = with pkgs.nix-dns.lib.combinators;
-    let
-      hour1 = 3600;
-      hostsToDns = builtins.mapAttrs
-        (name: { publicIPv4, publicIPv6, ... }:
-          lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
-          lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
-        networkingConfig;
-    in
-    with hostsToDns;
-    {
-      TTL = hour1;
-      SOA = {
-        nameServer = "ns.noratrieb-acme-delegate.dev.";
-        adminEmail = "void@noratrieb.dev";
-        serial = 2024072601;
-      };
-
-      CAA = [
-        { issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
-        { issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
-      ];
-
-      NS = [
-        "ns.noratrieb-acme-delegate.dev."
-      ];
-
-      subdomains = {
-        ns = dns1;
-      };
-    };
-in
-pkgs.writeTextFile {
-  name = "noratrieb-acme-delegate.dev.zone";
-  text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
-}

nix/modules/dns/noratrieb.dev.nix

@@ -54,9 +54,6 @@ let
         ns1 = dns1;
         ns2 = dns2;
 
-        # --- ACME setup for caddy
-        _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ];
-
         # --- website stuff
         blog = vps1;
         www = vps1;
@@ -97,15 +94,10 @@ let
         infra.subdomains = hostsToDns;
 
         # --- internal stuff
-        internal.subdomains = builtins.listToAttrs (builtins.map
-          (name: {
-            inherit name;
-            value = minipc // {
-              subdomains = {
-                _acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
-              };
-            };
-          }) [ "immich" "paperless" "home-assistant" ]);
+        internal.subdomains = {
+          immich = minipc;
+          paperless = minipc;
+        };
 
         # --- other verification
         _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];

nix/modules/home-assistant/default.nix

@@ -1,28 +0,0 @@
-{ config, ... }: {
-  services.home-assistant = {
-    enable = true;
-    extraComponents = [
-      # Recommended for fast zlib compression
-      # https://www.home-assistant.io/integrations/isal
-      "isal"
-      "fronius"
-      "integration"
-    ];
-    config = {
-      default_config = { };
-      http = {
-        use_x_forwarded_for = true;
-        trusted_proxies = [ "::1" ];
-      };
-    };
-  };
-
-  services.caddy.virtualHosts."home-assistant.internal.noratrieb.dev" = {
-    extraConfig = ''
-      tls {
-        dns_challenge_override_domain "_acme-challenge.home-assistant.internal.noratrieb-acme-delegate.dev"
-      }
-      reverse_proxy * localhost:${builtins.toString config.services.home-assistant.config.http.server_port}
-    '';
-  };
-}

nix/modules/immich/default.nix

@@ -13,6 +13,7 @@
     environment = {
       IMMICH_TELEMETRY_INCLUDE = "all";
     };
+    openFirewall = true;
   };
 
   services.postgresql = {
@@ -29,14 +30,5 @@
     '';
   };
 
-  services.caddy.virtualHosts."immich.internal.noratrieb.dev" = {
-    extraConfig = ''
-      tls {
-        dns_challenge_override_domain "_acme-challenge.immich.internal.noratrieb-acme-delegate.dev"
-      }
-      reverse_proxy * localhost:${builtins.toString config.services.immich.port}
-    '';
-  };
-
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
 }

nix/modules/paperless/default.nix

@@ -12,7 +12,6 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
       PAPERLESS_TIME_ZONE = "Europe/Zurich";
       PAPERLESS_ADMIN_USER = "nora";
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
-      PAPERLESS_URL = "https://paperless.internal.noratrieb.dev";
     };
     exporter = {
       enable = true;
@@ -21,12 +20,5 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
     };
   };
 
-  services.caddy.virtualHosts."paperless.internal.noratrieb.dev" = {
-    extraConfig = ''
-      tls {
-        dns_challenge_override_domain "_acme-challenge.paperless.internal.noratrieb-acme-delegate.dev"
-      }
-      reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
-    '';
-  };
+  networking.firewall.allowedTCPPorts = [ 8010 ];
 }

nix/secrets/docker_registry_password.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg UVJ4EkIz+aHGJHW/UWVOod/NSUrmLL4pNvK60KPWxzE
-pQ3h/qZ8XfwCqb2QshUxuLs6F+YddX2QSp8MLQnxBR0
---- gox0jFVFKNb46LsZ/aOEpkxCWnx8sTe7Rvv+tdzkvq8
-Â×iB<69><'+ŒÌ½Å˨¸L‘Ydî6cÛ6B‹gé]UGôŠƒ»N€¥cª]4Y<
+-> ssh-ed25519 qM6TYg 0u8KWoP0daJZA97H5KkNCSn839ObF87VYU4AChP2XVw
+PqtYdZR3xokf7iIQ9khrz2pt7n6FipWn5y3bmzDfdEM
+--- 3tTg1eoL9exHUTtn3Uww7xWecgmzf5EyyQEZ//Bbjic
+’|˜H¦ôLXñ
Zºõ'v2"ÕóÈ<‘K#9ÿ$TÔûÇ	Ó_Ì«
æ}^aoÜ4¤

nix/secrets/forgejo_s3_key_secret.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg nMMawatvWfcdHyOTJu5UBTCZbB8MDbvdd5XaSCR9ARQ
-iUI0FSTyjhx0xdfUn3ikxR3dcW8GQH1Flu2kwlkP1HA
---- Fb7A45fAQY9VJN6Er23jTuEMvm5eDHJflTiiNFB4dYs
-Û.Ÿ)!<21>$Y­QÊÏŽ$ß9i3—3b_z
-©ÒTR˲qîhs|[®í¯óF(´m‰â¦I®Ž‰q1z÷^&÷&	'Á‹(¨g×<67>6<EFBFBD>’FÕ¾Š^.¸j]®­DÉi
M5ýq<C3BD>
+-> ssh-ed25519 qM6TYg z5yLpu5zJ9m7Ukl3nEHZND8Ot2cYnADJidYjELzfr0k
+qy1n6TSeWniRFXLc1Zkpvz1+pmjFaMga0BeSE1q6RSk
+--- fe6vqb3f0bRvXlQG4JglZ0h/At5kUPIM+VkRh91BCtY
+†Ã"Ô.O†ë
J‰±º7ÄçªÝ6ÛàÜ~Ô¥SõñHÈø»ó-’4¡0’ýÍ[vA¶D‡ÐÜ=‰´²^T°ýy"@A¤‰@÷,§¼ÝáéüPÛÝ|¶q!ØŠM

nix/secrets/garage_secrets.age

@@ -1,13 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg GE45kAK/hBIkfDcJ9T5KSf2ZlRuznfyCXNgyiROKSho
-07IiEZYSR+BoaHsNOMfpTB7KvFI5erLqiLkxHeghNA0
--> ssh-ed25519 91VHug I5YszjRHyHEIPSO9ATRx/hgSiBnq6CmQeCiEWyThKQY
-6cyqqeR7jyvWCC3yfxqVk9YtjhR8LmUISxoScoAl0Ac
--> ssh-ed25519 XzACZQ qqZvo9xbK4rQRDzCsyKD0NVYhk3960UW5FRfavIoI24
-AjsMDfEzmGMCGekIAHPXkN2RRZHC4ZjACo3cNGx/iqc
--> ssh-ed25519 51bcvA mvDGI9jBis304qlduEX3kDb2Y5E2fiNL70i110hdDUo
-OJl67yJ26ZZVLgobEbh63J9kku+whdmgawpPrlyAgFs
--> ssh-ed25519 vT7ExA NgHlD7tjMUF2kIeMmHyE/qsZI9VzIkg4drUCDj0GABs
-kxwMjB9CBd5IRlh2SBHIQJSjCjARLMwOg40DSdbDO3k
---- hzXf515cyiJHjcIAg+kmCeZ4Hy2GI/b21F5O+Pq7r5A
-§=ä)€BTÁÖ¢ È(¯_±_ÃÛ
È2ì{¡EÇãdõÚι¥±	wŒMSÛVs9TÈj_+˜q¸¦}‹™îføñ5Ä1ôÞ¿Ý^Ú>Q¹Fìg¿^Qvn²ZœÍ”dŽÎ˜ïõl=ÛåYȬ»Ù¾\!ëFú4v±ßt´÷ ­h·˜à!•AÿmÌ%'‘šnìר<W‚wiºghmÚ¬À/'í»á‚·¡¨Y|ACºÎ÷¨`zXŠ–£×»-µ3Œ
+-> ssh-ed25519 qM6TYg jJSJ3eWbmwKqaqaH0nCAfJh6zG0wQ8NHYLch6MjVFiM
+nzMK9xuag1meleJVM6aNGK3Uj+LDiklWtAbEsEVaZrE
+-> ssh-ed25519 91VHug lgN/V9/OYL6qvoDo54bMwkRjgJx72ER4rwCyBLE7JBI
+KyqOc40/5iNubbk3vuF6e5qypscUNWGXSO+TvnE60Ug
+-> ssh-ed25519 XzACZQ MH28c1eBXCHnnmWeEiKbB7qnqIWb11ciYZopRwK1lzw
+kHr78ot/c9JS7L+uWk5XhCwZ8y41cEkCfjiv5ITHXpI
+-> ssh-ed25519 51bcvA JbXk+iiHx+TkrosjfP28iGjQQ3lNFlo6L7ebmOmOJzs
+KQH6qVfm+48U6TzaomwPQJP3Xs8JCX1JDuVNu6+djUM
+-> ssh-ed25519 vT7ExA W/tG8Jk982TcvMP+ZVY1Jgtk/0ykGlKT471OloV68G8
+9/ieFx+uf+zLUKfWtIYUiEyHHkwYLOhX8FtZP6oup/Y
+--- Nr1pkXNHv0+lBg4J3QnK4f5kM3ZOWjwTCwjUYNMRABk
+é•UsIó	lNdLðÀò¥Ð^üÉÉq/P•D\Úé˜î%µÞýs4¡GCÌþϺքag¼¢÷¡|-ˆfŸ+,‹è²|vpj…]à„.ŽL“Êö=Œ¦ù<C2A6>UÊßä‹À_?§bG&Ywëí¨ò|f~4qRšõ*¢Lx¦$Ú‹³Y–P­rEÿáÁÕN,˜jW¦Ž„zÉà«#KÉò@̧ó·#7¶"&™Îž=®äGx ÷N¦.„n‰O7ôc}fczT

nix/secrets/generic_backup_password.age

@@ -1,14 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg NaiDsYFYQAZuJinDZ60OiPEZMsnmPOggyW/lKwLPWR0
-vLZKSA9iaFIdOjE7K9n7vtlF8UKCS+AKuSS3O8jlfbw
--> ssh-ed25519 91VHug O5htAKX31xr2plcilbKy/AZ0xtyIDekjtr6GYeIXcns
-aK43EBfhqDCEtkB/1RephM7PK0tB0xHjS+GIDTFw2A8
--> ssh-ed25519 XzACZQ NRs3M2HrY9vZ94a+MccGZisn/cEyY9lg6l/ZiOaECgY
-aZ84NrESzU+yhsxXk+XiHEFJ+5/8B5wmFZVhPU5K8p4
--> ssh-ed25519 51bcvA 74NdYVJKbbDBuhxqUUAgx4GpGbKFzL0/+KRXJKoxh0M
-nXjmvzBfiq5Y7EUeUM5aoEColQa80JUCMwaLX36Scss
--> ssh-ed25519 vT7ExA buG7ZHfGrdKqobgouN2DHkOointeeSo3LbQ5TbXxMT4
-v+CfO/1CDfu2d/Oy7LX1S/tPa25zaY6rWafpQB+yzdo
---- 1urbgjL5IrFAQbt9FPGt+Hv5hJ99uiFaC3K3G4X5JSQ
-?
-A€>•$-ťÉ>6<>ÁŘń<1F>ŇîÁǵÂÂ蝠ܬČ>/RZsŤYĹÉ®4Ă5ŁŃşR}ň<1B>a§9SŚXwŔúíËR9¨
+-> ssh-ed25519 qM6TYg WSRKNimMa2qdIrTxZIsnybHi+gzOweCGmCx2D3DPciU
+e6MO1QIL5FI0ATaR8hBUeE2ayLoyP4P7d5eO7liMBHg
+-> ssh-ed25519 91VHug JZjoc5tcVSQjIpbVGVca4P2s80Rb7NTIEKPhlXx9wQ4
+QWqufjXwphL4Kes5Ky2tWozdusA5AJwqgzT5JWCQbvQ
+-> ssh-ed25519 XzACZQ ek1dpX4Lqf6hd13B0dX06tTTmNRhZswxV3W1gBLKkXk
+LQMnAxrr3ZfUc3Brn39BzIdyBe8Jma8LSML+eaBuKJE
+-> ssh-ed25519 51bcvA zA9GHEGOXETl9zX0yoHHB9B5On06KlEcYRba8eKGKEo
+yPTcsFhDLiSLpWoZX0b7dNzZmBaLTUY8PSMVFCUzlRA
+-> ssh-ed25519 vT7ExA N7U+hiTEzwKvglQ0At36e/p0TTA7xVRb7UvuX/4Bbjs
+acP9zBODifOsHVmM7COfBX+tkxZIPnQCUR0TskHacQ8
+--- tOLU9ascA2rI4R0oIg/0vsn2dEC1LBLFN6TFRcyrcvI
+{ÏÄ‘<C384>‹q.忳U×ÙŽcO¹Å)¨ì|Â¥ü,+^]¥Ÿë?­©PÄ»$3mº4©Ç¦|…cõø)ó.R6@r‘]ˆ½´

nix/secrets/grafana_admin_password.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ io2AGztJepz/HVtDyyO5pplYumC+Ym95zUvjvzz3Twc
-mmJtTOkG/7HnUVKmpEMhRER1WhCbPMqsS09d3V76qr8
---- yquBIN4NRMcxCzpDb2N1MTf3d4S0riWumE+fVIkwx8U
-¡Ç½Å»t^zñçΪ#t8Ûé<C39B>	#UÛ&ÌB#<23>åpÜ<70>9ÉNoóŠR³ÎÿO¤´Ù¥']—ÝϤ÷¼¨ÊÅ9Äà·~EeFÒºc¯I<C2AF>ŒåËÄd5<64>,ü]”	]<5D>k¸Óõâ‰r<E280B0>
+-> ssh-ed25519 XzACZQ jIs+NClvISjvJSkJlkkGX5ZJzFge/1Nj2Wi4en/viRw
+H1sfzg7cCWmCVg9GpFF5QNVVJjllxbmt7wBETRfM8hw
+--- hOo2vi9EjLwAa8PQzJGdzUZ/VIzfhM7TnPsQ+OYJzcY
+%¾f>8ëá¤ÅÃðÐÀuwª[	žl*´V(u”2‘ó)e&•äú’XÎ)
+ƼåQÑ"ÂX|iOÕôÓ,'Û<16>;æä<C3A6>ItʽoÚZËÕ<C38B>kÕàÓE)ÐÉIÈ —0v/»ë?

nix/secrets/hugochat_db_password.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg kzaYC7OTJ7pOil0/e+q6+MwCBhyCu+O8pkRt0LtuzVY
-9VM4lmMvJqaHB3WfzbzBfniO8oTHgUz1vZzK2c0TfTw
---- PPkKzcyL6DezZfRPUvIVjn2gjT5AFtYRbXhabPIIq/E
-Üÿ"Ýu5ús£îxõ[Ün³‘(<28>£Ù+çyGc㦂ÂÄÉÖ=}´ž:Ä#ëõg@L7è¤P¢"7ê"ñ/¾¶ÜÛVÄ¥àJ¦=èõÖKÖÀðF6ª<02>ÿÜlÃß6!ä"øá¡‹ÏXî">Íý?‘¡•m)Ëv>†úhC'WˆëàKG*ïb‹õi£™=ÓßR?sKÝ1jÏòUw
+-> ssh-ed25519 qM6TYg o9FlX/G7SotMq0hWJWsBnutiOuMu9pX6iY7w6xODUQA
+Q/AZ3tKlwi5rEV8mQSQF/7uBxy0RVEzajdKZuVGLzvg
+--- FujHNw9RfcGuMYfpj5C9hoWs5iYaj+x7tDqJ74lqVsg
+ÉÂvP¥aŠ@¼®éQî<>³äR .›@,à@;þà{‚xtfçMsÔÇDFê#<23>u#,oä!$C5Сk«J<C2AB>¯–ÕOƒæbÈÒ®ÍÈ<i¡ wOÍeã^b6¯	f‡ö`?†òŠs¢
åóÊ•ahm­†Ç`<>_k1<6B>Ä><3E>0î$
kÆ⬑7; ííM
†ïAˆðÔÓ<C394>ê¦5¤

nix/secrets/immich_secrets.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q ttfca/hqpWJm9dRJYWBXj9Of1rdWg2NbgfsAJFMUQTY
-qokH5RFlOmZMETgkqlWhcx41EtXtN2IxKpvP/WGz6mk
---- vn3HoHqGBa02fSSeO8LGjhGb/7JK/tN/0Zh1Pjz25dY
-]?møÌõ±D“C:gà‹_klU×G¼¦ð¶Qù•ÈçJ+‹°g3àuê9FH"ìöÙ'g¨êáé‹d‡¡è߃
+-> ssh-ed25519 yMKb8Q szKG8gw88EAiUx26fzY/pYMVb7Vb91FZC1FEQTYRZDY
+0jBl8757lsXnxWE90iZLJcO5VUXz+E2+7m/ZfNq87J0
+--- huOResyzGVCip/Sdoyvid3TxFI01wiXNaHdZ/oGI5Zg
+*c‘ÚlH¢àxôAhã5H(d‘çŸUé'ònÒ˜;M.Vx}‘À•"Öf· ø«§³9Š¼fß~JvÍ9–

nix/secrets/knot_dns_acme_dns_01_key_config.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 LZU5Eg REfGT+ZHVlXvO+6s9AgIGQCBS+AQYfAG012IfRipJhQ
-V/O4nPGoAOpB/4DyBWuEV/GxoRJ7hdgVomIQwcxnSdg
--> ssh-ed25519 5bWSnQ vFGAKwm8eJ/Fqv+LxLo+1mnzg4ht1BLTA7zdJuWdlnI
-Lhh3d9dWKyRcVTKeMOJb/cVzwnnqrBYNE0ijDgAxut0
---- Du4x4K3KsDMktwzmEMiFRxGXq63eP5x9CBowtGJWM+w
-‹1÷{$Ôeü’9î»b”Âð`ëê+gÖüpœƒÆîÉD¥åx<1B>hK*/­Zå~eAÔ¥æHö}lÖÝÐ0¾ý”ÎŒ««sì»Z…tî<74>ÁÚ¸ßÐ:!¼µ®kçjÅ!Iœ_×y«Ià[eÀûê<>é§FØéGˆ»Žî<C5BD>¨Cbûð¼xÜ’ì›Ê

nix/secrets/knot_dns_acme_dns_01_key_envvar.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 vT7ExA UhRU412YTV9dkMkINM4xDQvQqwosWzIRGap+NxS7MFQ
-FUlsU461cxI+2befwB1v3ygyYAeTwfpJft/EX7eCGCo
--> ssh-ed25519 yMKb8Q 2kpI3iQwInOH+TYnbvuyKyksGD9Q8UthqF1eBG5I+0g
-Si5Q1xNovm8hBmSfHx6l4PsiFU/cPa52rLw8OAGWQl0
---- PO+gCtXKMloPmRAplw/pOAVPDHqh5PwzrQqrzSPN5Ng
-_W÷ÿî[ƒ<>VNÅJÚÓ1×ÚÛD-ºž±:…ᔆ|Vžz¢ñlñÿŠS¢vÝ*{´žGø9V"òøºóŽ_ÊîG˜r¡öS\‘cÄ?sõ±Å&ê°¶öSöä	

nix/secrets/openolat_db_password.age

@@ -1,6 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 8JOs+ohdkwfpHfDO7hq07sJ8IGny1yupoCy5ucro2n4
-2TWbFpYjg6k6fBgGmAhNQQ1hBd6k04wu9gcKD2iF/ZY
---- GO7BMFQgRi6aBsnhc64kRcslMo4ziPFbrFVgzubQ5Ww
-K°Ú&<26>1ÌÌ=c0Ù^$ÏLr‰«üÈó§0òG}‘è¡S5˜´Ç/òjµ
-é	¯¢Ì6S¶1D×%¨ù³»%Q]”|‡!‚oqÜÏ<C39C>YÅíÚ§TÜÄlÂSüèvÊE¢BèdÊ Õ®H® —ãŒ(Í 9ö4RáG°MAð<SZñš¯ìK,JÛÐ{
+-> ssh-ed25519 qM6TYg anB4Ljud6na0zsnFkNjgBcicE6kFUg0y2xTlohEUggI
+gUTv83/Mktm8CyXdKEf1eu7NpWJd/hmiGzKs91WyPCc
+--- zxoGip/R/tIH30MATCWht9P9oUxU//L/jnf6T/DwKEI
+UĎÍŚ5ś¦f—śqˇ{¤ĂÎ!„ł´%ĺZóŔEŠűó;í¦
+xČ»é‰vËn´’k†Ź ŤľtéÄP\-ť1PŰşŔB}gMn{3ĄÄňo<C588>ąż *]łÚ¦Ä0<C384>—zŐU5Č2Ůß<C5AE>±Ęý@yär®UţgAé ŕ-4ă¬Ń)Fĺ
+Ć>"­ČUĄb‚

nix/secrets/secrets.nix

@@ -33,8 +33,6 @@ in
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
   "immich_secrets.age".publicKeys = [ minipc ];
   "paperless_env.age".publicKeys = [ minipc ];
-  "knot_dns_acme_dns_01_key_config.age".publicKeys = [ dns1 dns2 ];
-  "knot_dns_acme_dns_01_key_envvar.age".publicKeys = [ vps5 minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];

nix/secrets/wg_private_dns1.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg 8zZFvGVb6VIefxLJERJ16VqhKczWW2tcUEdSU4dIsC4
-5k+Qpn+ZloytTx4DhcgT3Il5lBlXIuNmwMvNKC1hvNY
---- rEDDdmvnau74yyYkVHKGx8kKi+Is/s/Ygt7PKfs4dv0
-=@±_‘ýyçÿ\Åô<C385>Ô-*垣ªöF<ý¤KV^uíˆWCzZøl‰ª•}oo
©6äh"¡»EÿÜpÎòk#l••ÕaÊ°¡&
+-> ssh-ed25519 LZU5Eg OKL541Y7HQSCBtUqWQVdIxZK9HiWeaPyAWwkcj/bsgs
+PviTqNl4VLbQtErGDpXFEJSeRf59Mx0v3qcznEZ1tTo
+--- yRq8T7TGu/yBKFx2r+t8gbohrUHDkyXdvsB3n5csgpY
+kMõQl?N'!œñ¦.LlL¹±BoDæ§Y‹<59>ï¼:¯¹Ö_¹‚Vù“cèàžðtì¬ci= ã3ärKv¹<1D>MÛfîDuúÑ

nix/secrets/wg_private_dns2.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 5bWSnQ K+8u0rnGv8MsfaRy0eeZTwOsKsRcPixxnp1X7VR9cFk
-U9MsbgO1w5x91uqRxLdD94VmbuAk/nqv8e/b9B8QP8E
---- LzVg9wCJGFUNvtRLqwzMBTWNcJRJoy6FgRq7g0IQ7M8
-i	ﾒ<><EFBE92>!､貔8ｿｷﾆｴ+Hﾎｱｸ矛#:?v!飃
ﾆN'Aa%ｾ.ﾛY-N0S㍼<53>^ﾓqIsﾜ轗lｶｾ}･擇."ﾖ
+-> ssh-ed25519 5bWSnQ KNg5E8fLL/rDMbRGQDujv/NaSUVGY/HmxFgIVK7vox4
+bH+Gywr/dDW3UPfQpLpWg9sVZq+LfE2aDs29chCpaDk
+--- mYTYZH2KoiKyxtfrxgIomqaaCyfnLVNwXkUzp+cDl7c
+ç«Q}ðBö¿.Š$bðŽqú¸ {4ù;5-;†²3ôJybleú÷ÌžÜdÞo¾³#i‡(ý{ï²Jè­<C3A8>–¾­ÒyÇ•<>>˨]Ô

nix/secrets/wg_private_minipc.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q OK8Z0x1tfsdGQo0Acqxj99IDVwfRRO4nHmtBuwDXpEo
-FNfKD0EJ3FMQ8neRd5tNldCLp9Wk2K4/wlaEjKQPxPQ
---- y32/fNgc6fz2cAr76vUej99Xu5DMcmO8bDQepK04TRM
-Ñ£`'mo¡HK{O¿Ö-Ÿ¥¤—Ð<>yýlœÖ,X49 Ú
'+¶t÷¤r&OKñ^â®Öç
ßš>
-¿(°æ«GŸúð>æAç×n—
+-> ssh-ed25519 yMKb8Q 8ESNEQZaTfjWl4qGZJV/GPN+tFozDmiZZtXCctRD8yE
+w2+Pjzmotz2X0O8ehb3TTOLk9YCk8hqRqNKfNNnLQIw
+--- pfmBROvSCK/41HS44uMmwU5izVCyHrRirYjL/WBAhZQ
+m í<>*QÀØv"­›<>¢+˜…JQ®ñÔÄ€ý'òPø´hD·¡>G’¹ð Jû]§
êÀÄ Ÿø‡×LÝ©¯ù¹¼	ÁN÷žÌ¤Û€

nix/secrets/wg_private_vps2.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug v7DD5jgO2eah7KvV9shAkyFRG1zce0kKKD6U/QBIzCk
-hKwCVfnc/5wKEs2ow0etWhet/8+AT318LOnrEgTVEdw
---- WWKcK5xf8FeUsA7atbz8r/ScBM857aXQA9mN9TdpRB8
-Ђ¾Ó/ ?K!A>ü–9q¥mׂö¶ð,Ûl°Àþˆ÷^[pÄ»°!rûmMEÆýzÊ€“OÓ`„ÓãÞq>qý^cRòKí3Ã
+-> ssh-ed25519 91VHug nuqwTTdoNOLWvbQAIhl9WguvArxG0jNfkFn3qM8VyjE
+NvhMCreuxdWHezfH8cF4wXjO8ZbG7yQC8+sVnWFghFM
+--- OGewUdFWzL1PzHGBHB7ulJVi5eX6UXKLFUyfbvGErmY
+Ê‹Ì.\†—ŅدiÒ›ÎóÒ~`êQ–,¿§W;m´‚<C2B4>­pQóTY
TÅz?]¯£T-sÃ4)ÑZPý,6ŸH5bìÔ„7—ƒh

nix/secrets/wg_private_vps5.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA 1SyRWnZNW7piWgD9AhV3evIk5qmlPZw3vtaYysYPKUo
-vC2skZEXjrM2HgU6nhrzqZhwVtIZWrZyaVZwUp5PE5c
---- 46tHy1OYd8fqnjpLu+MVYrJyPaP6UdgubrsvhI7KO4A
-òÅJ¶·HJÍSívá}áù+	<17>‘¾jÐÇ/„Ô
ÄêÙMJ§’P“+~8Aé웧üf™^Û„Õlj˜K–AbHóó5·U"@
+-> ssh-ed25519 vT7ExA 5Yp0GcAOQbgRlxiIBgDt2O5NK0zoEN3PdUQOFsKtSXc
+653+sJWsCeQpu6agZn85RU6GOrpMJY+TbzqRLbYvnaw
+--- SYT84Omvncdv4tQYH7Put8sXqqA3LBR4/DuVyVCVbNg
+øöòv_Ab¿‹ÓL"fªÉR6<52>W<EFBFBD>›¡6Áhep¸¿¬–KÉêeðg–,EÑâà¨;`Šñ"ýG
xu¿þV<C3BE>í©B^ø+kíç6¾äç

nix/secrets/widetom_bot_token.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg p+Rts+QHTmO+vPpCHEp2LTAdPF8UMq0BqoN3rAPzCgM
-g5RaqS2rCOdp8/vllNb3Revq+bfDdHQkwYKsnNRN97c
---- Ws0i3nFuR6DNeO1RpdUvc3Irt4I3HuzBtPgxXsBaOvU
-P¨ŒÚn_8ùPÿÆlJßìêÃP(<1A>lÊæ¾É*=V+QXù=ØR¸Ob±åf'l&çu‡UÑ=ºFßø«.†½î`sγ‰
·é_ø&<26>Â}šÎ¬-<Ï0€_-‚
+-> ssh-ed25519 qM6TYg qE/RX7sfudkaWg+9A1jRP84PnGCC8f7y2Ai308kN+zg
+LnySP1Ywe33ECGtFx3Un0+QcxH/IscCHao49nbuEvm8
+--- DYF2tyroJ1KnECqhUvzLyox9wULA/eEH5SdENW2fPVc
+)nˆCzL‚ËbŸ!šP[õò>jl(9Â<39>ÊÓèP@‡{îÂ÷½”;a#”B<E2809D>ÉÝq#0¡<30>+]óõ-‹µ–MÀ\5²‘{ÿƒ)‘laW–kù³RCE›tcÖ3¿²ë